xmrig | f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2024, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
Size 1.3MB
Sample241031-hspfxstrdr
SHA256 f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab
MD5 b43555dddbdf37c4fabe3614835eb71f
SHA1 b1a69221f039aa1c32e221006b05f3c09b9f2d6c
SHA512 6393bdee56aace2a5759987b051ec2a994ccba3b6555bd6e83ffba6feea4571943613d739ea73b859f5b35f236f853afdb74d1abe93a232409428a00e62574b2
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcu:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5g
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/files/0x000400000001e432-4.dat	xmrig
behavioral2/files/0x000a000000023b98-17.dat	xmrig
behavioral2/files/0x000a000000023b97-16.dat	xmrig
behavioral2/files/0x000c000000023b8e-12.dat	xmrig
behavioral2/files/0x000a000000023b99-21.dat	xmrig
behavioral2/files/0x000a000000023b9a-37.dat	xmrig
behavioral2/files/0x000a000000023ba1-50.dat	xmrig
behavioral2/files/0x000a000000023b9d-57.dat	xmrig
behavioral2/files/0x000a000000023ba6-85.dat	xmrig
behavioral2/files/0x000b000000023bab-101.dat	xmrig
behavioral2/files/0x000e000000023bba-126.dat	xmrig
behavioral2/files/0x0009000000023bc8-147.dat	xmrig
behavioral2/files/0x0008000000023c05-171.dat	xmrig
behavioral2/files/0x0008000000023bd6-170.dat	xmrig
behavioral2/files/0x0008000000023bd5-169.dat	xmrig
behavioral2/files/0x0008000000023bd4-165.dat	xmrig
behavioral2/files/0x000b000000023ba9-161.dat	xmrig
behavioral2/files/0x0009000000023bc9-160.dat	xmrig
behavioral2/files/0x0008000000023bd3-158.dat	xmrig
behavioral2/files/0x000e000000023bce-145.dat	xmrig
behavioral2/files/0x0009000000023bca-142.dat	xmrig
behavioral2/files/0x0008000000023bc3-128.dat	xmrig
behavioral2/files/0x000a000000023ba7-124.dat	xmrig
behavioral2/files/0x000a000000023ba3-122.dat	xmrig
behavioral2/files/0x000a000000023bb3-120.dat	xmrig
behavioral2/files/0x0008000000023bd0-146.dat	xmrig
behavioral2/files/0x000b000000023baa-114.dat	xmrig
behavioral2/files/0x000a000000023ba8-110.dat	xmrig
behavioral2/files/0x000a000000023ba5-108.dat	xmrig
behavioral2/files/0x000a000000023ba4-106.dat	xmrig
behavioral2/files/0x000a000000023ba2-97.dat	xmrig
behavioral2/files/0x000a000000023ba0-64.dat	xmrig
behavioral2/files/0x000a000000023b9f-63.dat	xmrig
behavioral2/files/0x000a000000023b9e-59.dat	xmrig
behavioral2/files/0x000a000000023b9c-55.dat	xmrig
behavioral2/files/0x000a000000023b9b-53.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2416	YRGtSPe.exe
1108	jAkpUqz.exe
3120	qwfBjOh.exe
3648	zJGgTYj.exe
4992	PUepHpf.exe
2972	nlXcGSi.exe
3036	nPkXafo.exe
4292	hGUHsKD.exe
3152	XyNCEoA.exe
3356	WmkCetZ.exe
1984	VqPEFwu.exe
2936	QyzSjfw.exe
3360	dTqUGVH.exe
4224	hyjVGeq.exe
2928	FWclwib.exe
1220	witiTtM.exe
1248	KJdQPAV.exe
4792	GZYScDS.exe
220	RcFaHzD.exe
3504	CfuSJez.exe
5012	iEiVDMj.exe
4832	JpXnIvF.exe
4020	JjUQjYB.exe
3800	qKwskMk.exe
3456	FWNxJSY.exe
764	eKmHEFX.exe
1948	tQeFVjc.exe
4712	dkIHqMQ.exe
4704	WFXVVVs.exe
4268	cHCigNA.exe
4080	FPeOgUt.exe
888	UFVpLvE.exe
1696	beGNcSY.exe
4608	zoGQbDJ.exe
748	Ttracbb.exe
4520	vcVMqBz.exe
2492	wzQxvXC.exe
3300	IuoamCo.exe
1772	XoNrKLZ.exe
1532	RtnOSzA.exe
3380	IlstlZy.exe
2268	mGjbdcq.exe
1764	DWcsSET.exe
2264	oeSaXWs.exe
5100	aiZmgqm.exe
2616	RJtlzJo.exe
3428	CtMvebg.exe
2620	vPrrSYU.exe
4916	UwvWsVA.exe
5060	wlwokYD.exe
1784	DANTDjN.exe
4768	YTULaoh.exe
3292	olOdJfb.exe
1752	nWXueal.exe
1748	CRlzwLI.exe
3516	fhixxRW.exe
1260	EYuPcFN.exe
2204	oJSqQdP.exe
3316	qohMuHo.exe
1644	fEeuKIP.exe
2800	XrxqZVd.exe
1216	WdfmkPv.exe
3652	UpdWJJx.exe
2896	iliODpl.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SZYNfLr.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\yFJfoXc.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\oQcorQi.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\HmYEmqq.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\gwBmxfx.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\IuoamCo.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\OkXfVdI.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\lddmgTk.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\aiZmgqm.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\qlikCyn.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\OBMHVmf.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\nAqyOnl.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\YBPWitv.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\RPHMcHm.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\skXopDP.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\UglIXdg.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\wiaysUj.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\SFrDOvg.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\QsHnmvz.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\MfHCfxz.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\JpXnIvF.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\YTmsYfN.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\MrYuSLG.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\rVXvrwT.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\QBLARhp.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\mBAuEua.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\gVXuiYX.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\SVPsDDG.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\NAmLrNk.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\ViHTfxA.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\oXLxRFC.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\xuTHmZU.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\PtsvGmp.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\QXpWyuo.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\NTZbunR.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\cycdPKh.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\iliODpl.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\JDBTWpH.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\NloLaQm.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\SrtAeWX.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\MXCtivy.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\UZsnRaU.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\dXpPZBi.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\ziHjBkO.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\qFmBzSa.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\KiiGjZQ.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\qFNjnjP.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\DANTDjN.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\ekaNQtZ.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\rXVPqUj.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\EgpDFZo.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\BApvqyf.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\iLKtNgF.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\dTqUGVH.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\gJBAdBo.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\hDZcEmP.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\WxvlQoj.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\mCZCAds.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\mGjbdcq.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\QRrDBwf.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\IkimUrQ.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\suYvbdn.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\TMeQcvP.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
File created	C:\Windows\System\iLNIhAJ.exe	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 2416	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	85
PID 4124 wrote to memory of 2416	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	85
PID 4124 wrote to memory of 1108	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	86
PID 4124 wrote to memory of 1108	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	86
PID 4124 wrote to memory of 3120	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	87
PID 4124 wrote to memory of 3120	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	87
PID 4124 wrote to memory of 3648	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	88
PID 4124 wrote to memory of 3648	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	88
PID 4124 wrote to memory of 4992	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	89
PID 4124 wrote to memory of 4992	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	89
PID 4124 wrote to memory of 2972	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	90
PID 4124 wrote to memory of 2972	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	90
PID 4124 wrote to memory of 3036	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	91
PID 4124 wrote to memory of 3036	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	91
PID 4124 wrote to memory of 4292	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	92
PID 4124 wrote to memory of 4292	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	92
PID 4124 wrote to memory of 3152	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	93
PID 4124 wrote to memory of 3152	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	93
PID 4124 wrote to memory of 3356	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	94
PID 4124 wrote to memory of 3356	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	94
PID 4124 wrote to memory of 1984	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	95
PID 4124 wrote to memory of 1984	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	95
PID 4124 wrote to memory of 2936	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	96
PID 4124 wrote to memory of 2936	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	96
PID 4124 wrote to memory of 3360	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	97
PID 4124 wrote to memory of 3360	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	97
PID 4124 wrote to memory of 4224	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	98
PID 4124 wrote to memory of 4224	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	98
PID 4124 wrote to memory of 4792	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	99
PID 4124 wrote to memory of 4792	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	99
PID 4124 wrote to memory of 2928	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	100
PID 4124 wrote to memory of 2928	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	100
PID 4124 wrote to memory of 1220	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	101
PID 4124 wrote to memory of 1220	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	101
PID 4124 wrote to memory of 1248	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	102
PID 4124 wrote to memory of 1248	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	102
PID 4124 wrote to memory of 220	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	103
PID 4124 wrote to memory of 220	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	103
PID 4124 wrote to memory of 3504	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	104
PID 4124 wrote to memory of 3504	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	104
PID 4124 wrote to memory of 5012	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	105
PID 4124 wrote to memory of 5012	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	105
PID 4124 wrote to memory of 4832	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	106
PID 4124 wrote to memory of 4832	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	106
PID 4124 wrote to memory of 4020	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	107
PID 4124 wrote to memory of 4020	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	107
PID 4124 wrote to memory of 3800	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	108
PID 4124 wrote to memory of 3800	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	108
PID 4124 wrote to memory of 3456	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	109
PID 4124 wrote to memory of 3456	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	109
PID 4124 wrote to memory of 764	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	110
PID 4124 wrote to memory of 764	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	110
PID 4124 wrote to memory of 1948	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	111
PID 4124 wrote to memory of 1948	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	111
PID 4124 wrote to memory of 4712	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	112
PID 4124 wrote to memory of 4712	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	112
PID 4124 wrote to memory of 4704	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	113
PID 4124 wrote to memory of 4704	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	113
PID 4124 wrote to memory of 4268	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	114
PID 4124 wrote to memory of 4268	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	114
PID 4124 wrote to memory of 4080	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	115
PID 4124 wrote to memory of 4080	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	115
PID 4124 wrote to memory of 888	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	116
PID 4124 wrote to memory of 888	4124	f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe	116

C:\Users\Admin\AppData\Local\Temp\f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe
"C:\Users\Admin\AppData\Local\Temp\f0fdd3598289c4722e197480690f87cd4bf6e620144ccdc07b350e3c5453edab.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\System\YRGtSPe.exe
  C:\Windows\System\YRGtSPe.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\jAkpUqz.exe
  C:\Windows\System\jAkpUqz.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\qwfBjOh.exe
  C:\Windows\System\qwfBjOh.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\zJGgTYj.exe
  C:\Windows\System\zJGgTYj.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\PUepHpf.exe
  C:\Windows\System\PUepHpf.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\nlXcGSi.exe
  C:\Windows\System\nlXcGSi.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\nPkXafo.exe
  C:\Windows\System\nPkXafo.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\hGUHsKD.exe
  C:\Windows\System\hGUHsKD.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\XyNCEoA.exe
  C:\Windows\System\XyNCEoA.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\WmkCetZ.exe
  C:\Windows\System\WmkCetZ.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\VqPEFwu.exe
  C:\Windows\System\VqPEFwu.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\QyzSjfw.exe
  C:\Windows\System\QyzSjfw.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\dTqUGVH.exe
  C:\Windows\System\dTqUGVH.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\hyjVGeq.exe
  C:\Windows\System\hyjVGeq.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\GZYScDS.exe
  C:\Windows\System\GZYScDS.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\FWclwib.exe
  C:\Windows\System\FWclwib.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\witiTtM.exe
  C:\Windows\System\witiTtM.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\KJdQPAV.exe
  C:\Windows\System\KJdQPAV.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\RcFaHzD.exe
  C:\Windows\System\RcFaHzD.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\CfuSJez.exe
  C:\Windows\System\CfuSJez.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\iEiVDMj.exe
  C:\Windows\System\iEiVDMj.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\JpXnIvF.exe
  C:\Windows\System\JpXnIvF.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\JjUQjYB.exe
  C:\Windows\System\JjUQjYB.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\qKwskMk.exe
  C:\Windows\System\qKwskMk.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\FWNxJSY.exe
  C:\Windows\System\FWNxJSY.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\eKmHEFX.exe
  C:\Windows\System\eKmHEFX.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\tQeFVjc.exe
  C:\Windows\System\tQeFVjc.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\dkIHqMQ.exe
  C:\Windows\System\dkIHqMQ.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\WFXVVVs.exe
  C:\Windows\System\WFXVVVs.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\cHCigNA.exe
  C:\Windows\System\cHCigNA.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\FPeOgUt.exe
  C:\Windows\System\FPeOgUt.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\UFVpLvE.exe
  C:\Windows\System\UFVpLvE.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\beGNcSY.exe
  C:\Windows\System\beGNcSY.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\zoGQbDJ.exe
  C:\Windows\System\zoGQbDJ.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\Ttracbb.exe
  C:\Windows\System\Ttracbb.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\vcVMqBz.exe
  C:\Windows\System\vcVMqBz.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\wzQxvXC.exe
  C:\Windows\System\wzQxvXC.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\IuoamCo.exe
  C:\Windows\System\IuoamCo.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\XoNrKLZ.exe
  C:\Windows\System\XoNrKLZ.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\RtnOSzA.exe
  C:\Windows\System\RtnOSzA.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\DANTDjN.exe
  C:\Windows\System\DANTDjN.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\IlstlZy.exe
  C:\Windows\System\IlstlZy.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\mGjbdcq.exe
  C:\Windows\System\mGjbdcq.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\DWcsSET.exe
  C:\Windows\System\DWcsSET.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\oeSaXWs.exe
  C:\Windows\System\oeSaXWs.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\aiZmgqm.exe
  C:\Windows\System\aiZmgqm.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\RJtlzJo.exe
  C:\Windows\System\RJtlzJo.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\CtMvebg.exe
  C:\Windows\System\CtMvebg.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\vPrrSYU.exe
  C:\Windows\System\vPrrSYU.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\UwvWsVA.exe
  C:\Windows\System\UwvWsVA.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\wlwokYD.exe
  C:\Windows\System\wlwokYD.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\YTULaoh.exe
  C:\Windows\System\YTULaoh.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\olOdJfb.exe
  C:\Windows\System\olOdJfb.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\nWXueal.exe
  C:\Windows\System\nWXueal.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\CRlzwLI.exe
  C:\Windows\System\CRlzwLI.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\fhixxRW.exe
  C:\Windows\System\fhixxRW.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\EYuPcFN.exe
  C:\Windows\System\EYuPcFN.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\oJSqQdP.exe
  C:\Windows\System\oJSqQdP.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\qohMuHo.exe
  C:\Windows\System\qohMuHo.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\fEeuKIP.exe
  C:\Windows\System\fEeuKIP.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\XrxqZVd.exe
  C:\Windows\System\XrxqZVd.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\WdfmkPv.exe
  C:\Windows\System\WdfmkPv.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\UpdWJJx.exe
  C:\Windows\System\UpdWJJx.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\iliODpl.exe
  C:\Windows\System\iliODpl.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\Drrrqma.exe
  C:\Windows\System\Drrrqma.exe
  2⤵
  PID:1464
- C:\Windows\System\XAjfoQL.exe
  C:\Windows\System\XAjfoQL.exe
  2⤵
  PID:4972
- C:\Windows\System\oicefQH.exe
  C:\Windows\System\oicefQH.exe
  2⤵
  PID:728
- C:\Windows\System\seeadWG.exe
  C:\Windows\System\seeadWG.exe
  2⤵
  PID:3268
- C:\Windows\System\chaXsgX.exe
  C:\Windows\System\chaXsgX.exe
  2⤵
  PID:116
- C:\Windows\System\TLDXDxa.exe
  C:\Windows\System\TLDXDxa.exe
  2⤵
  PID:3148
- C:\Windows\System\rycFwWy.exe
  C:\Windows\System\rycFwWy.exe
  2⤵
  PID:1212
- C:\Windows\System\rFhSNGu.exe
  C:\Windows\System\rFhSNGu.exe
  2⤵
  PID:880
- C:\Windows\System\FrtPMOa.exe
  C:\Windows\System\FrtPMOa.exe
  2⤵
  PID:2380
- C:\Windows\System\rFVcjbi.exe
  C:\Windows\System\rFVcjbi.exe
  2⤵
  PID:3156
- C:\Windows\System\uwFoPuI.exe
  C:\Windows\System\uwFoPuI.exe
  2⤵
  PID:848
- C:\Windows\System\UUqwBLV.exe
  C:\Windows\System\UUqwBLV.exe
  2⤵
  PID:4212
- C:\Windows\System\cUPmncf.exe
  C:\Windows\System\cUPmncf.exe
  2⤵
  PID:4344
- C:\Windows\System\OfiGCQk.exe
  C:\Windows\System\OfiGCQk.exe
  2⤵
  PID:1768
- C:\Windows\System\XNdYlUY.exe
  C:\Windows\System\XNdYlUY.exe
  2⤵
  PID:1960
- C:\Windows\System\hdJEEBZ.exe
  C:\Windows\System\hdJEEBZ.exe
  2⤵
  PID:1072
- C:\Windows\System\eRRBTFO.exe
  C:\Windows\System\eRRBTFO.exe
  2⤵
  PID:2328
- C:\Windows\System\cSxNOot.exe
  C:\Windows\System\cSxNOot.exe
  2⤵
  PID:1776
- C:\Windows\System\esxSVHm.exe
  C:\Windows\System\esxSVHm.exe
  2⤵
  PID:1392
- C:\Windows\System\MXCtivy.exe
  C:\Windows\System\MXCtivy.exe
  2⤵
  PID:4680
- C:\Windows\System\CKPdHTa.exe
  C:\Windows\System\CKPdHTa.exe
  2⤵
  PID:4376
- C:\Windows\System\vQbmqkf.exe
  C:\Windows\System\vQbmqkf.exe
  2⤵
  PID:4408
- C:\Windows\System\BDILfCJ.exe
  C:\Windows\System\BDILfCJ.exe
  2⤵
  PID:4012
- C:\Windows\System\JHHukaK.exe
  C:\Windows\System\JHHukaK.exe
  2⤵
  PID:4184
- C:\Windows\System\PcRzTOd.exe
  C:\Windows\System\PcRzTOd.exe
  2⤵
  PID:3796
- C:\Windows\System\BHVzqdx.exe
  C:\Windows\System\BHVzqdx.exe
  2⤵
  PID:4028
- C:\Windows\System\FQCmjoP.exe
  C:\Windows\System\FQCmjoP.exe
  2⤵
  PID:4480
- C:\Windows\System\sXPROlH.exe
  C:\Windows\System\sXPROlH.exe
  2⤵
  PID:1692
- C:\Windows\System\OfGoihr.exe
  C:\Windows\System\OfGoihr.exe
  2⤵
  PID:3848
- C:\Windows\System\RdJQWpQ.exe
  C:\Windows\System\RdJQWpQ.exe
  2⤵
  PID:4444
- C:\Windows\System\craQVeY.exe
  C:\Windows\System\craQVeY.exe
  2⤵
  PID:4420
- C:\Windows\System\gMyOlDt.exe
  C:\Windows\System\gMyOlDt.exe
  2⤵
  PID:1316
- C:\Windows\System\gMOdoxk.exe
  C:\Windows\System\gMOdoxk.exe
  2⤵
  PID:4004
- C:\Windows\System\joNIjez.exe
  C:\Windows\System\joNIjez.exe
  2⤵
  PID:2348
- C:\Windows\System\ZyYRpph.exe
  C:\Windows\System\ZyYRpph.exe
  2⤵
  PID:4908
- C:\Windows\System\bMBDIES.exe
  C:\Windows\System\bMBDIES.exe
  2⤵
  PID:3256
- C:\Windows\System\meXqLcq.exe
  C:\Windows\System\meXqLcq.exe
  2⤵
  PID:3080
- C:\Windows\System\TDAfDVd.exe
  C:\Windows\System\TDAfDVd.exe
  2⤵
  PID:2708
- C:\Windows\System\wHrEKFa.exe
  C:\Windows\System\wHrEKFa.exe
  2⤵
  PID:1268
- C:\Windows\System\HARPUUB.exe
  C:\Windows\System\HARPUUB.exe
  2⤵
  PID:5076
- C:\Windows\System\iaTrqje.exe
  C:\Windows\System\iaTrqje.exe
  2⤵
  PID:2436
- C:\Windows\System\vmvcxSX.exe
  C:\Windows\System\vmvcxSX.exe
  2⤵
  PID:448
- C:\Windows\System\xuTHmZU.exe
  C:\Windows\System\xuTHmZU.exe
  2⤵
  PID:2968
- C:\Windows\System\scQlWpC.exe
  C:\Windows\System\scQlWpC.exe
  2⤵
  PID:4840
- C:\Windows\System\rbMCxiB.exe
  C:\Windows\System\rbMCxiB.exe
  2⤵
  PID:5132
- C:\Windows\System\hzmqSCP.exe
  C:\Windows\System\hzmqSCP.exe
  2⤵
  PID:5156
- C:\Windows\System\BrSJQpr.exe
  C:\Windows\System\BrSJQpr.exe
  2⤵
  PID:5196
- C:\Windows\System\IJXeldG.exe
  C:\Windows\System\IJXeldG.exe
  2⤵
  PID:5228
- C:\Windows\System\MFHHjAq.exe
  C:\Windows\System\MFHHjAq.exe
  2⤵
  PID:5256
- C:\Windows\System\mBAuEua.exe
  C:\Windows\System\mBAuEua.exe
  2⤵
  PID:5280
- C:\Windows\System\NRQdjFH.exe
  C:\Windows\System\NRQdjFH.exe
  2⤵
  PID:5312
- C:\Windows\System\BtMgspA.exe
  C:\Windows\System\BtMgspA.exe
  2⤵
  PID:5336
- C:\Windows\System\eolaklp.exe
  C:\Windows\System\eolaklp.exe
  2⤵
  PID:5360
- C:\Windows\System\gHWXsDX.exe
  C:\Windows\System\gHWXsDX.exe
  2⤵
  PID:5376
- C:\Windows\System\mSyFvKe.exe
  C:\Windows\System\mSyFvKe.exe
  2⤵
  PID:5424
- C:\Windows\System\TpIOGPq.exe
  C:\Windows\System\TpIOGPq.exe
  2⤵
  PID:5448
- C:\Windows\System\yHkYFqo.exe
  C:\Windows\System\yHkYFqo.exe
  2⤵
  PID:5472
- C:\Windows\System\VcgupYp.exe
  C:\Windows\System\VcgupYp.exe
  2⤵
  PID:5492
- C:\Windows\System\IiodfGi.exe
  C:\Windows\System\IiodfGi.exe
  2⤵
  PID:5532
- C:\Windows\System\YTmsYfN.exe
  C:\Windows\System\YTmsYfN.exe
  2⤵
  PID:5560
- C:\Windows\System\bhwrTTL.exe
  C:\Windows\System\bhwrTTL.exe
  2⤵
  PID:5584
- C:\Windows\System\BDfPQZR.exe
  C:\Windows\System\BDfPQZR.exe
  2⤵
  PID:5620
- C:\Windows\System\ykRpevg.exe
  C:\Windows\System\ykRpevg.exe
  2⤵
  PID:5644
- C:\Windows\System\oJuFwMm.exe
  C:\Windows\System\oJuFwMm.exe
  2⤵
  PID:5676
- C:\Windows\System\UTIxKcn.exe
  C:\Windows\System\UTIxKcn.exe
  2⤵
  PID:5696
- C:\Windows\System\MgHVKRy.exe
  C:\Windows\System\MgHVKRy.exe
  2⤵
  PID:5728
- C:\Windows\System\SrtAeWX.exe
  C:\Windows\System\SrtAeWX.exe
  2⤵
  PID:5756
- C:\Windows\System\otFGjZH.exe
  C:\Windows\System\otFGjZH.exe
  2⤵
  PID:5776
- C:\Windows\System\QeUsLIa.exe
  C:\Windows\System\QeUsLIa.exe
  2⤵
  PID:5808
- C:\Windows\System\NDXaHxw.exe
  C:\Windows\System\NDXaHxw.exe
  2⤵
  PID:5824
- C:\Windows\System\xDPFzmN.exe
  C:\Windows\System\xDPFzmN.exe
  2⤵
  PID:5860
- C:\Windows\System\NMXtzEQ.exe
  C:\Windows\System\NMXtzEQ.exe
  2⤵
  PID:5884
- C:\Windows\System\xuMTIIm.exe
  C:\Windows\System\xuMTIIm.exe
  2⤵
  PID:5920
- C:\Windows\System\QsHnmvz.exe
  C:\Windows\System\QsHnmvz.exe
  2⤵
  PID:5948
- C:\Windows\System\cCVcmyC.exe
  C:\Windows\System\cCVcmyC.exe
  2⤵
  PID:5984
- C:\Windows\System\uTQcnWD.exe
  C:\Windows\System\uTQcnWD.exe
  2⤵
  PID:6004
- C:\Windows\System\XJJJOYK.exe
  C:\Windows\System\XJJJOYK.exe
  2⤵
  PID:6032
- C:\Windows\System\eBsOKZT.exe
  C:\Windows\System\eBsOKZT.exe
  2⤵
  PID:6072
- C:\Windows\System\eLKyNtH.exe
  C:\Windows\System\eLKyNtH.exe
  2⤵
  PID:6088
- C:\Windows\System\BCfXxay.exe
  C:\Windows\System\BCfXxay.exe
  2⤵
  PID:6128
- C:\Windows\System\FqQWdco.exe
  C:\Windows\System\FqQWdco.exe
  2⤵
  PID:1468
- C:\Windows\System\NnyXzyo.exe
  C:\Windows\System\NnyXzyo.exe
  2⤵
  PID:5204
- C:\Windows\System\zEmeJps.exe
  C:\Windows\System\zEmeJps.exe
  2⤵
  PID:5248
- C:\Windows\System\gAmbrVR.exe
  C:\Windows\System\gAmbrVR.exe
  2⤵
  PID:5296
- C:\Windows\System\XPZyAkc.exe
  C:\Windows\System\XPZyAkc.exe
  2⤵
  PID:5372
- C:\Windows\System\QIJUAYK.exe
  C:\Windows\System\QIJUAYK.exe
  2⤵
  PID:5440
- C:\Windows\System\SVPsDDG.exe
  C:\Windows\System\SVPsDDG.exe
  2⤵
  PID:5484
- C:\Windows\System\UvmFOZc.exe
  C:\Windows\System\UvmFOZc.exe
  2⤵
  PID:5548
- C:\Windows\System\OBMHVmf.exe
  C:\Windows\System\OBMHVmf.exe
  2⤵
  PID:5596
- C:\Windows\System\AIOHaDe.exe
  C:\Windows\System\AIOHaDe.exe
  2⤵
  PID:5652
- C:\Windows\System\UIwArip.exe
  C:\Windows\System\UIwArip.exe
  2⤵
  PID:5712
- C:\Windows\System\GwQzWSg.exe
  C:\Windows\System\GwQzWSg.exe
  2⤵
  PID:5788
- C:\Windows\System\iUVXZbi.exe
  C:\Windows\System\iUVXZbi.exe
  2⤵
  PID:5820
- C:\Windows\System\EcmkEQB.exe
  C:\Windows\System\EcmkEQB.exe
  2⤵
  PID:5872
- C:\Windows\System\KhiZzDN.exe
  C:\Windows\System\KhiZzDN.exe
  2⤵
  PID:5936
- C:\Windows\System\TVdZJwN.exe
  C:\Windows\System\TVdZJwN.exe
  2⤵
  PID:6000
- C:\Windows\System\IKakwHG.exe
  C:\Windows\System\IKakwHG.exe
  2⤵
  PID:6064
- C:\Windows\System\EgBwufn.exe
  C:\Windows\System\EgBwufn.exe
  2⤵
  PID:6100
- C:\Windows\System\PrOqtoP.exe
  C:\Windows\System\PrOqtoP.exe
  2⤵
  PID:5268
- C:\Windows\System\KljtruX.exe
  C:\Windows\System\KljtruX.exe
  2⤵
  PID:5400
- C:\Windows\System\ZlcURMg.exe
  C:\Windows\System\ZlcURMg.exe
  2⤵
  PID:5636
- C:\Windows\System\ImfbcEb.exe
  C:\Windows\System\ImfbcEb.exe
  2⤵
  PID:5724
- C:\Windows\System\vQsoGuP.exe
  C:\Windows\System\vQsoGuP.exe
  2⤵
  PID:5876
- C:\Windows\System\VLUkgvg.exe
  C:\Windows\System\VLUkgvg.exe
  2⤵
  PID:6024
- C:\Windows\System\GyYTcWc.exe
  C:\Windows\System\GyYTcWc.exe
  2⤵
  PID:5840
- C:\Windows\System\ynMvHhf.exe
  C:\Windows\System\ynMvHhf.exe
  2⤵
  PID:5344
- C:\Windows\System\ppRYUbN.exe
  C:\Windows\System\ppRYUbN.exe
  2⤵
  PID:6168
- C:\Windows\System\zMkNOmP.exe
  C:\Windows\System\zMkNOmP.exe
  2⤵
  PID:6196
- C:\Windows\System\vnzEyHm.exe
  C:\Windows\System\vnzEyHm.exe
  2⤵
  PID:6224
- C:\Windows\System\mCZCAds.exe
  C:\Windows\System\mCZCAds.exe
  2⤵
  PID:6248
- C:\Windows\System\PvmHBSK.exe
  C:\Windows\System\PvmHBSK.exe
  2⤵
  PID:6288
- C:\Windows\System\aFcdlRq.exe
  C:\Windows\System\aFcdlRq.exe
  2⤵
  PID:6316
- C:\Windows\System\SoORAXJ.exe
  C:\Windows\System\SoORAXJ.exe
  2⤵
  PID:6344
- C:\Windows\System\LmquvIS.exe
  C:\Windows\System\LmquvIS.exe
  2⤵
  PID:6364
- C:\Windows\System\epyMkUv.exe
  C:\Windows\System\epyMkUv.exe
  2⤵
  PID:6396
- C:\Windows\System\UZsnRaU.exe
  C:\Windows\System\UZsnRaU.exe
  2⤵
  PID:6420
- C:\Windows\System\tCGfpUy.exe
  C:\Windows\System\tCGfpUy.exe
  2⤵
  PID:6444
- C:\Windows\System\TiwaevL.exe
  C:\Windows\System\TiwaevL.exe
  2⤵
  PID:6480
- C:\Windows\System\tQrKdFm.exe
  C:\Windows\System\tQrKdFm.exe
  2⤵
  PID:6508
- C:\Windows\System\qxscxHZ.exe
  C:\Windows\System\qxscxHZ.exe
  2⤵
  PID:6528
- C:\Windows\System\DFRkZgd.exe
  C:\Windows\System\DFRkZgd.exe
  2⤵
  PID:6548
- C:\Windows\System\qLfiodq.exe
  C:\Windows\System\qLfiodq.exe
  2⤵
  PID:6584
- C:\Windows\System\urVbazs.exe
  C:\Windows\System\urVbazs.exe
  2⤵
  PID:6608
- C:\Windows\System\utRdWqE.exe
  C:\Windows\System\utRdWqE.exe
  2⤵
  PID:6632
- C:\Windows\System\baRMzZH.exe
  C:\Windows\System\baRMzZH.exe
  2⤵
  PID:6656
- C:\Windows\System\JjCDouF.exe
  C:\Windows\System\JjCDouF.exe
  2⤵
  PID:6684
- C:\Windows\System\fNYUkod.exe
  C:\Windows\System\fNYUkod.exe
  2⤵
  PID:6708
- C:\Windows\System\uYHvvMB.exe
  C:\Windows\System\uYHvvMB.exe
  2⤵
  PID:6736
- C:\Windows\System\TJTVmax.exe
  C:\Windows\System\TJTVmax.exe
  2⤵
  PID:6760
- C:\Windows\System\UMkPNuI.exe
  C:\Windows\System\UMkPNuI.exe
  2⤵
  PID:6788
- C:\Windows\System\MrYuSLG.exe
  C:\Windows\System\MrYuSLG.exe
  2⤵
  PID:6816
- C:\Windows\System\FxDhWPw.exe
  C:\Windows\System\FxDhWPw.exe
  2⤵
  PID:6848
- C:\Windows\System\VLjPtGs.exe
  C:\Windows\System\VLjPtGs.exe
  2⤵
  PID:6880
- C:\Windows\System\xxaOcEb.exe
  C:\Windows\System\xxaOcEb.exe
  2⤵
  PID:6908
- C:\Windows\System\iVpNFtQ.exe
  C:\Windows\System\iVpNFtQ.exe
  2⤵
  PID:6932
- C:\Windows\System\nXGkUrR.exe
  C:\Windows\System\nXGkUrR.exe
  2⤵
  PID:6960
- C:\Windows\System\PrnyNJr.exe
  C:\Windows\System\PrnyNJr.exe
  2⤵
  PID:6984
- C:\Windows\System\pnquYAr.exe
  C:\Windows\System\pnquYAr.exe
  2⤵
  PID:7020
- C:\Windows\System\KvVVUPW.exe
  C:\Windows\System\KvVVUPW.exe
  2⤵
  PID:7056
- C:\Windows\System\GAIPZNu.exe
  C:\Windows\System\GAIPZNu.exe
  2⤵
  PID:7080
- C:\Windows\System\WxFNgqE.exe
  C:\Windows\System\WxFNgqE.exe
  2⤵
  PID:7116
- C:\Windows\System\MgJxmCH.exe
  C:\Windows\System\MgJxmCH.exe
  2⤵
  PID:7144
- C:\Windows\System\vOteWJv.exe
  C:\Windows\System\vOteWJv.exe
  2⤵
  PID:5764
- C:\Windows\System\NMufhNr.exe
  C:\Windows\System\NMufhNr.exe
  2⤵
  PID:6192
- C:\Windows\System\ygDmuzM.exe
  C:\Windows\System\ygDmuzM.exe
  2⤵
  PID:6212
- C:\Windows\System\TPAaPBJ.exe
  C:\Windows\System\TPAaPBJ.exe
  2⤵
  PID:6244
- C:\Windows\System\sMYzjhS.exe
  C:\Windows\System\sMYzjhS.exe
  2⤵
  PID:6356
- C:\Windows\System\vvJYpSu.exe
  C:\Windows\System\vvJYpSu.exe
  2⤵
  PID:6440
- C:\Windows\System\YTEgAeN.exe
  C:\Windows\System\YTEgAeN.exe
  2⤵
  PID:6416
- C:\Windows\System\yCflOcC.exe
  C:\Windows\System\yCflOcC.exe
  2⤵
  PID:6496
- C:\Windows\System\ecNsgUc.exe
  C:\Windows\System\ecNsgUc.exe
  2⤵
  PID:6604
- C:\Windows\System\PqrZGKR.exe
  C:\Windows\System\PqrZGKR.exe
  2⤵
  PID:6672
- C:\Windows\System\ALrPAVm.exe
  C:\Windows\System\ALrPAVm.exe
  2⤵
  PID:6704
- C:\Windows\System\LRvbjbb.exe
  C:\Windows\System\LRvbjbb.exe
  2⤵
  PID:6828
- C:\Windows\System\EvzmZmf.exe
  C:\Windows\System\EvzmZmf.exe
  2⤵
  PID:6808
- C:\Windows\System\xiFuLDB.exe
  C:\Windows\System\xiFuLDB.exe
  2⤵
  PID:7064
- C:\Windows\System\XGaPKuM.exe
  C:\Windows\System\XGaPKuM.exe
  2⤵
  PID:7016
- C:\Windows\System\SFrDOvg.exe
  C:\Windows\System\SFrDOvg.exe
  2⤵
  PID:6928
- C:\Windows\System\ZIslhwG.exe
  C:\Windows\System\ZIslhwG.exe
  2⤵
  PID:7156
- C:\Windows\System\cHoMTLI.exe
  C:\Windows\System\cHoMTLI.exe
  2⤵
  PID:5516
- C:\Windows\System\WHBpcJt.exe
  C:\Windows\System\WHBpcJt.exe
  2⤵
  PID:6376
- C:\Windows\System\NzTBHKz.exe
  C:\Windows\System\NzTBHKz.exe
  2⤵
  PID:6432
- C:\Windows\System\NAmLrNk.exe
  C:\Windows\System\NAmLrNk.exe
  2⤵
  PID:6644
- C:\Windows\System\rhdJZoZ.exe
  C:\Windows\System\rhdJZoZ.exe
  2⤵
  PID:7044
- C:\Windows\System\UHhbSRG.exe
  C:\Windows\System\UHhbSRG.exe
  2⤵
  PID:7128
- C:\Windows\System\fbWJNTW.exe
  C:\Windows\System\fbWJNTW.exe
  2⤵
  PID:6328
- C:\Windows\System\sjQnruh.exe
  C:\Windows\System\sjQnruh.exe
  2⤵
  PID:6600
- C:\Windows\System\HNHCVTH.exe
  C:\Windows\System\HNHCVTH.exe
  2⤵
  PID:6216
- C:\Windows\System\yMEhCNv.exe
  C:\Windows\System\yMEhCNv.exe
  2⤵
  PID:6728
- C:\Windows\System\lwOioBW.exe
  C:\Windows\System\lwOioBW.exe
  2⤵
  PID:7192
- C:\Windows\System\xsQddrp.exe
  C:\Windows\System\xsQddrp.exe
  2⤵
  PID:7212
- C:\Windows\System\FaKbvfR.exe
  C:\Windows\System\FaKbvfR.exe
  2⤵
  PID:7240
- C:\Windows\System\Gjnqomm.exe
  C:\Windows\System\Gjnqomm.exe
  2⤵
  PID:7264
- C:\Windows\System\xKsHmUP.exe
  C:\Windows\System\xKsHmUP.exe
  2⤵
  PID:7288
- C:\Windows\System\vFFAGaf.exe
  C:\Windows\System\vFFAGaf.exe
  2⤵
  PID:7316
- C:\Windows\System\AQuVkyi.exe
  C:\Windows\System\AQuVkyi.exe
  2⤵
  PID:7340
- C:\Windows\System\rVsSZup.exe
  C:\Windows\System\rVsSZup.exe
  2⤵
  PID:7368
- C:\Windows\System\hWBDfwi.exe
  C:\Windows\System\hWBDfwi.exe
  2⤵
  PID:7400
- C:\Windows\System\fcITXFa.exe
  C:\Windows\System\fcITXFa.exe
  2⤵
  PID:7428
- C:\Windows\System\hDaZbrG.exe
  C:\Windows\System\hDaZbrG.exe
  2⤵
  PID:7452
- C:\Windows\System\YxDRgeL.exe
  C:\Windows\System\YxDRgeL.exe
  2⤵
  PID:7484
- C:\Windows\System\hDZcEmP.exe
  C:\Windows\System\hDZcEmP.exe
  2⤵
  PID:7504
- C:\Windows\System\WxvlQoj.exe
  C:\Windows\System\WxvlQoj.exe
  2⤵
  PID:7524
- C:\Windows\System\RUSOuxs.exe
  C:\Windows\System\RUSOuxs.exe
  2⤵
  PID:7548
- C:\Windows\System\dXpPZBi.exe
  C:\Windows\System\dXpPZBi.exe
  2⤵
  PID:7576
- C:\Windows\System\ziHjBkO.exe
  C:\Windows\System\ziHjBkO.exe
  2⤵
  PID:7592
- C:\Windows\System\IMiBwmh.exe
  C:\Windows\System\IMiBwmh.exe
  2⤵
  PID:7624
- C:\Windows\System\PkLAkdk.exe
  C:\Windows\System\PkLAkdk.exe
  2⤵
  PID:7644
- C:\Windows\System\ADiexln.exe
  C:\Windows\System\ADiexln.exe
  2⤵
  PID:7668
- C:\Windows\System\odphIjC.exe
  C:\Windows\System\odphIjC.exe
  2⤵
  PID:7696
- C:\Windows\System\GPCoWBb.exe
  C:\Windows\System\GPCoWBb.exe
  2⤵
  PID:7728
- C:\Windows\System\EgpDFZo.exe
  C:\Windows\System\EgpDFZo.exe
  2⤵
  PID:7752
- C:\Windows\System\AkqIWYM.exe
  C:\Windows\System\AkqIWYM.exe
  2⤵
  PID:7780
- C:\Windows\System\xzuaXSp.exe
  C:\Windows\System\xzuaXSp.exe
  2⤵
  PID:7808
- C:\Windows\System\yIcOBFh.exe
  C:\Windows\System\yIcOBFh.exe
  2⤵
  PID:7840
- C:\Windows\System\hzdrFpn.exe
  C:\Windows\System\hzdrFpn.exe
  2⤵
  PID:7868
- C:\Windows\System\WjmCcap.exe
  C:\Windows\System\WjmCcap.exe
  2⤵
  PID:7884
- C:\Windows\System\LcsKNae.exe
  C:\Windows\System\LcsKNae.exe
  2⤵
  PID:7932
- C:\Windows\System\swTfcDZ.exe
  C:\Windows\System\swTfcDZ.exe
  2⤵
  PID:7964
- C:\Windows\System\mafFfZB.exe
  C:\Windows\System\mafFfZB.exe
  2⤵
  PID:7988
- C:\Windows\System\LNpvRCg.exe
  C:\Windows\System\LNpvRCg.exe
  2⤵
  PID:8024
- C:\Windows\System\apvWTHi.exe
  C:\Windows\System\apvWTHi.exe
  2⤵
  PID:8048
- C:\Windows\System\rUvvQKS.exe
  C:\Windows\System\rUvvQKS.exe
  2⤵
  PID:8080
- C:\Windows\System\ASwBfDb.exe
  C:\Windows\System\ASwBfDb.exe
  2⤵
  PID:8108
- C:\Windows\System\qFmBzSa.exe
  C:\Windows\System\qFmBzSa.exe
  2⤵
  PID:8140
- C:\Windows\System\AVBWbLw.exe
  C:\Windows\System\AVBWbLw.exe
  2⤵
  PID:8164
- C:\Windows\System\emwsHkZ.exe
  C:\Windows\System\emwsHkZ.exe
  2⤵
  PID:6436
- C:\Windows\System\JdCITlS.exe
  C:\Windows\System\JdCITlS.exe
  2⤵
  PID:6336
- C:\Windows\System\yrEcrqc.exe
  C:\Windows\System\yrEcrqc.exe
  2⤵
  PID:7224
- C:\Windows\System\lzTJgCf.exe
  C:\Windows\System\lzTJgCf.exe
  2⤵
  PID:7332
- C:\Windows\System\dDvQwPS.exe
  C:\Windows\System\dDvQwPS.exe
  2⤵
  PID:7436
- C:\Windows\System\zUXfbWM.exe
  C:\Windows\System\zUXfbWM.exe
  2⤵
  PID:7476
- C:\Windows\System\kvImXXl.exe
  C:\Windows\System\kvImXXl.exe
  2⤵
  PID:7532
- C:\Windows\System\vhIoEXP.exe
  C:\Windows\System\vhIoEXP.exe
  2⤵
  PID:7556
- C:\Windows\System\QRrDBwf.exe
  C:\Windows\System\QRrDBwf.exe
  2⤵
  PID:7604
- C:\Windows\System\bSlmZpF.exe
  C:\Windows\System\bSlmZpF.exe
  2⤵
  PID:7740
- C:\Windows\System\HuEROAi.exe
  C:\Windows\System\HuEROAi.exe
  2⤵
  PID:7768
- C:\Windows\System\SpCoUMP.exe
  C:\Windows\System\SpCoUMP.exe
  2⤵
  PID:7824
- C:\Windows\System\wWLQuff.exe
  C:\Windows\System\wWLQuff.exe
  2⤵
  PID:7916
- C:\Windows\System\LOoNXns.exe
  C:\Windows\System\LOoNXns.exe
  2⤵
  PID:7948
- C:\Windows\System\zqQjZfe.exe
  C:\Windows\System\zqQjZfe.exe
  2⤵
  PID:7996
- C:\Windows\System\WbnBxiH.exe
  C:\Windows\System\WbnBxiH.exe
  2⤵
  PID:8032
- C:\Windows\System\zJNDvxZ.exe
  C:\Windows\System\zJNDvxZ.exe
  2⤵
  PID:8132
- C:\Windows\System\gIBYovO.exe
  C:\Windows\System\gIBYovO.exe
  2⤵
  PID:7096
- C:\Windows\System\qZMZEjN.exe
  C:\Windows\System\qZMZEjN.exe
  2⤵
  PID:7284
- C:\Windows\System\FKlTqOa.exe
  C:\Windows\System\FKlTqOa.exe
  2⤵
  PID:7440
- C:\Windows\System\fUiAKMI.exe
  C:\Windows\System\fUiAKMI.exe
  2⤵
  PID:7536
- C:\Windows\System\VxikMFk.exe
  C:\Windows\System\VxikMFk.exe
  2⤵
  PID:7796
- C:\Windows\System\PWPOlrb.exe
  C:\Windows\System\PWPOlrb.exe
  2⤵
  PID:8036
- C:\Windows\System\YBPWitv.exe
  C:\Windows\System\YBPWitv.exe
  2⤵
  PID:7984
- C:\Windows\System\IYTEcXh.exe
  C:\Windows\System\IYTEcXh.exe
  2⤵
  PID:8188
- C:\Windows\System\mcMMBFx.exe
  C:\Windows\System\mcMMBFx.exe
  2⤵
  PID:8092
- C:\Windows\System\jHIFlkv.exe
  C:\Windows\System\jHIFlkv.exe
  2⤵
  PID:8204
- C:\Windows\System\koJTKWB.exe
  C:\Windows\System\koJTKWB.exe
  2⤵
  PID:8232
- C:\Windows\System\tfFfUhF.exe
  C:\Windows\System\tfFfUhF.exe
  2⤵
  PID:8260
- C:\Windows\System\slTkbHM.exe
  C:\Windows\System\slTkbHM.exe
  2⤵
  PID:8288
- C:\Windows\System\qrosNOt.exe
  C:\Windows\System\qrosNOt.exe
  2⤵
  PID:8312
- C:\Windows\System\aAZUgTm.exe
  C:\Windows\System\aAZUgTm.exe
  2⤵
  PID:8340
- C:\Windows\System\txboHZl.exe
  C:\Windows\System\txboHZl.exe
  2⤵
  PID:8372
- C:\Windows\System\yTxKtNh.exe
  C:\Windows\System\yTxKtNh.exe
  2⤵
  PID:8392
- C:\Windows\System\Ffkubwm.exe
  C:\Windows\System\Ffkubwm.exe
  2⤵
  PID:8424
- C:\Windows\System\LelBSyU.exe
  C:\Windows\System\LelBSyU.exe
  2⤵
  PID:8452
- C:\Windows\System\wzonxjv.exe
  C:\Windows\System\wzonxjv.exe
  2⤵
  PID:8480
- C:\Windows\System\EGUasLw.exe
  C:\Windows\System\EGUasLw.exe
  2⤵
  PID:8508
- C:\Windows\System\mjajJVy.exe
  C:\Windows\System\mjajJVy.exe
  2⤵
  PID:8540
- C:\Windows\System\FhWUWeJ.exe
  C:\Windows\System\FhWUWeJ.exe
  2⤵
  PID:8564
- C:\Windows\System\xDxvfqg.exe
  C:\Windows\System\xDxvfqg.exe
  2⤵
  PID:8596
- C:\Windows\System\tDItGEu.exe
  C:\Windows\System\tDItGEu.exe
  2⤵
  PID:8616
- C:\Windows\System\ioYIqxt.exe
  C:\Windows\System\ioYIqxt.exe
  2⤵
  PID:8640
- C:\Windows\System\ocogQgR.exe
  C:\Windows\System\ocogQgR.exe
  2⤵
  PID:8664
- C:\Windows\System\BxdUzGl.exe
  C:\Windows\System\BxdUzGl.exe
  2⤵
  PID:8692
- C:\Windows\System\qNVRLPZ.exe
  C:\Windows\System\qNVRLPZ.exe
  2⤵
  PID:8720
- C:\Windows\System\wsFxZHZ.exe
  C:\Windows\System\wsFxZHZ.exe
  2⤵
  PID:8748
- C:\Windows\System\IkimUrQ.exe
  C:\Windows\System\IkimUrQ.exe
  2⤵
  PID:8780
- C:\Windows\System\KLPAMNL.exe
  C:\Windows\System\KLPAMNL.exe
  2⤵
  PID:8812
- C:\Windows\System\qOsToZS.exe
  C:\Windows\System\qOsToZS.exe
  2⤵
  PID:8840
- C:\Windows\System\vxfJDpZ.exe
  C:\Windows\System\vxfJDpZ.exe
  2⤵
  PID:8868
- C:\Windows\System\SyZyAHG.exe
  C:\Windows\System\SyZyAHG.exe
  2⤵
  PID:8892
- C:\Windows\System\IjceWYP.exe
  C:\Windows\System\IjceWYP.exe
  2⤵
  PID:8920
- C:\Windows\System\nrhfnGi.exe
  C:\Windows\System\nrhfnGi.exe
  2⤵
  PID:8948
- C:\Windows\System\jfXFugG.exe
  C:\Windows\System\jfXFugG.exe
  2⤵
  PID:8984
- C:\Windows\System\LdlMisb.exe
  C:\Windows\System\LdlMisb.exe
  2⤵
  PID:9016
- C:\Windows\System\suYvbdn.exe
  C:\Windows\System\suYvbdn.exe
  2⤵
  PID:9048
- C:\Windows\System\AwUZELp.exe
  C:\Windows\System\AwUZELp.exe
  2⤵
  PID:9080
- C:\Windows\System\lhWrSPP.exe
  C:\Windows\System\lhWrSPP.exe
  2⤵
  PID:9104
- C:\Windows\System\PnVzpbY.exe
  C:\Windows\System\PnVzpbY.exe
  2⤵
  PID:9144
- C:\Windows\System\pFKduTJ.exe
  C:\Windows\System\pFKduTJ.exe
  2⤵
  PID:9184
- C:\Windows\System\VezNuRw.exe
  C:\Windows\System\VezNuRw.exe
  2⤵
  PID:7464
- C:\Windows\System\WZsqRXm.exe
  C:\Windows\System\WZsqRXm.exe
  2⤵
  PID:7852
- C:\Windows\System\vgoZfoO.exe
  C:\Windows\System\vgoZfoO.exe
  2⤵
  PID:8228
- C:\Windows\System\YUilckz.exe
  C:\Windows\System\YUilckz.exe
  2⤵
  PID:7424
- C:\Windows\System\ROAZTqN.exe
  C:\Windows\System\ROAZTqN.exe
  2⤵
  PID:8244
- C:\Windows\System\EpBhMcS.exe
  C:\Windows\System\EpBhMcS.exe
  2⤵
  PID:8388
- C:\Windows\System\fXwpQAr.exe
  C:\Windows\System\fXwpQAr.exe
  2⤵
  PID:8352
- C:\Windows\System\KurKuGO.exe
  C:\Windows\System\KurKuGO.exe
  2⤵
  PID:8504
- C:\Windows\System\VigtMCz.exe
  C:\Windows\System\VigtMCz.exe
  2⤵
  PID:8560
- C:\Windows\System\ZjVxHUU.exe
  C:\Windows\System\ZjVxHUU.exe
  2⤵
  PID:8660
- C:\Windows\System\ybwmWKd.exe
  C:\Windows\System\ybwmWKd.exe
  2⤵
  PID:8628
- C:\Windows\System\cQDweEn.exe
  C:\Windows\System\cQDweEn.exe
  2⤵
  PID:8800
- C:\Windows\System\OkXfVdI.exe
  C:\Windows\System\OkXfVdI.exe
  2⤵
  PID:8880
- C:\Windows\System\RMdtJyj.exe
  C:\Windows\System\RMdtJyj.exe
  2⤵
  PID:8956
- C:\Windows\System\JZmieXi.exe
  C:\Windows\System\JZmieXi.exe
  2⤵
  PID:8884
- C:\Windows\System\AhQYcKz.exe
  C:\Windows\System\AhQYcKz.exe
  2⤵
  PID:8968
- C:\Windows\System\boLKgHE.exe
  C:\Windows\System\boLKgHE.exe
  2⤵
  PID:8976
- C:\Windows\System\InTMiym.exe
  C:\Windows\System\InTMiym.exe
  2⤵
  PID:9172
- C:\Windows\System\fcaZbYA.exe
  C:\Windows\System\fcaZbYA.exe
  2⤵
  PID:9204
- C:\Windows\System\DIiAtBt.exe
  C:\Windows\System\DIiAtBt.exe
  2⤵
  PID:9196
- C:\Windows\System\YkKwGZb.exe
  C:\Windows\System\YkKwGZb.exe
  2⤵
  PID:8300
- C:\Windows\System\RpBcxgO.exe
  C:\Windows\System\RpBcxgO.exe
  2⤵
  PID:8444
- C:\Windows\System\SxhlkYU.exe
  C:\Windows\System\SxhlkYU.exe
  2⤵
  PID:8576
- C:\Windows\System\BbfuURc.exe
  C:\Windows\System\BbfuURc.exe
  2⤵
  PID:8708
- C:\Windows\System\uEydPOt.exe
  C:\Windows\System\uEydPOt.exe
  2⤵
  PID:8760
- C:\Windows\System\VbzGlbP.exe
  C:\Windows\System\VbzGlbP.exe
  2⤵
  PID:8904
- C:\Windows\System\PAsBnfY.exe
  C:\Windows\System\PAsBnfY.exe
  2⤵
  PID:7468
- C:\Windows\System\tmxQBbN.exe
  C:\Windows\System\tmxQBbN.exe
  2⤵
  PID:9096
- C:\Windows\System\kNngjkK.exe
  C:\Windows\System\kNngjkK.exe
  2⤵
  PID:8608
- C:\Windows\System\mfuNkGQ.exe
  C:\Windows\System\mfuNkGQ.exe
  2⤵
  PID:9236
- C:\Windows\System\fQZkjeP.exe
  C:\Windows\System\fQZkjeP.exe
  2⤵
  PID:9264
- C:\Windows\System\BuaRZgr.exe
  C:\Windows\System\BuaRZgr.exe
  2⤵
  PID:9292
- C:\Windows\System\eGYQArU.exe
  C:\Windows\System\eGYQArU.exe
  2⤵
  PID:9320
- C:\Windows\System\hSDcMcn.exe
  C:\Windows\System\hSDcMcn.exe
  2⤵
  PID:9348
- C:\Windows\System\ZIObfZb.exe
  C:\Windows\System\ZIObfZb.exe
  2⤵
  PID:9368
- C:\Windows\System\uyArIks.exe
  C:\Windows\System\uyArIks.exe
  2⤵
  PID:9400
- C:\Windows\System\RtpEANj.exe
  C:\Windows\System\RtpEANj.exe
  2⤵
  PID:9428
- C:\Windows\System\WUswEGA.exe
  C:\Windows\System\WUswEGA.exe
  2⤵
  PID:9452
- C:\Windows\System\ZyiDLZG.exe
  C:\Windows\System\ZyiDLZG.exe
  2⤵
  PID:9476
- C:\Windows\System\mWBzYvM.exe
  C:\Windows\System\mWBzYvM.exe
  2⤵
  PID:9504
- C:\Windows\System\qzRFujQ.exe
  C:\Windows\System\qzRFujQ.exe
  2⤵
  PID:9528
- C:\Windows\System\xUCugtx.exe
  C:\Windows\System\xUCugtx.exe
  2⤵
  PID:9552
- C:\Windows\System\ytJTcxX.exe
  C:\Windows\System\ytJTcxX.exe
  2⤵
  PID:9576
- C:\Windows\System\SCbgewf.exe
  C:\Windows\System\SCbgewf.exe
  2⤵
  PID:9600
- C:\Windows\System\YKnEnFK.exe
  C:\Windows\System\YKnEnFK.exe
  2⤵
  PID:9628
- C:\Windows\System\daSMDKM.exe
  C:\Windows\System\daSMDKM.exe
  2⤵
  PID:9660
- C:\Windows\System\pJPKZec.exe
  C:\Windows\System\pJPKZec.exe
  2⤵
  PID:9684
- C:\Windows\System\oNQMhss.exe
  C:\Windows\System\oNQMhss.exe
  2⤵
  PID:9708
- C:\Windows\System\jPlSVdU.exe
  C:\Windows\System\jPlSVdU.exe
  2⤵
  PID:9724
- C:\Windows\System\dUshUXf.exe
  C:\Windows\System\dUshUXf.exe
  2⤵
  PID:9748
- C:\Windows\System\PpPWZET.exe
  C:\Windows\System\PpPWZET.exe
  2⤵
  PID:9776
- C:\Windows\System\hULqyVf.exe
  C:\Windows\System\hULqyVf.exe
  2⤵
  PID:9804
- C:\Windows\System\txEDehn.exe
  C:\Windows\System\txEDehn.exe
  2⤵
  PID:9824
- C:\Windows\System\gQoZXGr.exe
  C:\Windows\System\gQoZXGr.exe
  2⤵
  PID:9848
- C:\Windows\System\DsOWGFR.exe
  C:\Windows\System\DsOWGFR.exe
  2⤵
  PID:9876
- C:\Windows\System\PfqaVZX.exe
  C:\Windows\System\PfqaVZX.exe
  2⤵
  PID:9900
- C:\Windows\System\vMECuPf.exe
  C:\Windows\System\vMECuPf.exe
  2⤵
  PID:9924
- C:\Windows\System\oClVCLZ.exe
  C:\Windows\System\oClVCLZ.exe
  2⤵
  PID:9948
- C:\Windows\System\RTxxEyt.exe
  C:\Windows\System\RTxxEyt.exe
  2⤵
  PID:9976
- C:\Windows\System\LQzHKXT.exe
  C:\Windows\System\LQzHKXT.exe
  2⤵
  PID:10004
- C:\Windows\System\rVXvrwT.exe
  C:\Windows\System\rVXvrwT.exe
  2⤵
  PID:10032
- C:\Windows\System\NatCzbb.exe
  C:\Windows\System\NatCzbb.exe
  2⤵
  PID:10056
- C:\Windows\System\QBLARhp.exe
  C:\Windows\System\QBLARhp.exe
  2⤵
  PID:10080
- C:\Windows\System\PVioGFj.exe
  C:\Windows\System\PVioGFj.exe
  2⤵
  PID:10108
- C:\Windows\System\TMeQcvP.exe
  C:\Windows\System\TMeQcvP.exe
  2⤵
  PID:10132
- C:\Windows\System\VUjQNiu.exe
  C:\Windows\System\VUjQNiu.exe
  2⤵
  PID:10156
- C:\Windows\System\nYfIIoW.exe
  C:\Windows\System\nYfIIoW.exe
  2⤵
  PID:10184
- C:\Windows\System\vkzVRbn.exe
  C:\Windows\System\vkzVRbn.exe
  2⤵
  PID:10212
- C:\Windows\System\FuGjNqq.exe
  C:\Windows\System\FuGjNqq.exe
  2⤵
  PID:8532
- C:\Windows\System\EAMxWSp.exe
  C:\Windows\System\EAMxWSp.exe
  2⤵
  PID:8788
- C:\Windows\System\FKuimAG.exe
  C:\Windows\System\FKuimAG.exe
  2⤵
  PID:9288
- C:\Windows\System\fAoFLms.exe
  C:\Windows\System\fAoFLms.exe
  2⤵
  PID:9360
- C:\Windows\System\qBZaSaP.exe
  C:\Windows\System\qBZaSaP.exe
  2⤵
  PID:9276
- C:\Windows\System\OmgMxoC.exe
  C:\Windows\System\OmgMxoC.exe
  2⤵
  PID:9472
- C:\Windows\System\fKnKAZE.exe
  C:\Windows\System\fKnKAZE.exe
  2⤵
  PID:9396
- C:\Windows\System\GIbAygN.exe
  C:\Windows\System\GIbAygN.exe
  2⤵
  PID:9468
- C:\Windows\System\aPnkAmv.exe
  C:\Windows\System\aPnkAmv.exe
  2⤵
  PID:9496
- C:\Windows\System\xXohkYR.exe
  C:\Windows\System\xXohkYR.exe
  2⤵
  PID:9544
- C:\Windows\System\BNXQSjE.exe
  C:\Windows\System\BNXQSjE.exe
  2⤵
  PID:9700
- C:\Windows\System\cLCMhzm.exe
  C:\Windows\System\cLCMhzm.exe
  2⤵
  PID:9892
- C:\Windows\System\dbFhkfl.exe
  C:\Windows\System\dbFhkfl.exe
  2⤵
  PID:9844
- C:\Windows\System\RvgOGmN.exe
  C:\Windows\System\RvgOGmN.exe
  2⤵
  PID:9800
- C:\Windows\System\Pxsomqu.exe
  C:\Windows\System\Pxsomqu.exe
  2⤵
  PID:9896
- C:\Windows\System\JUqnPhW.exe
  C:\Windows\System\JUqnPhW.exe
  2⤵
  PID:10024
- C:\Windows\System\YQNRnlI.exe
  C:\Windows\System\YQNRnlI.exe
  2⤵
  PID:10148
- C:\Windows\System\BGJRVVg.exe
  C:\Windows\System\BGJRVVg.exe
  2⤵
  PID:8200
- C:\Windows\System\jbSHnrN.exe
  C:\Windows\System\jbSHnrN.exe
  2⤵
  PID:10096
- C:\Windows\System\EfKJtLK.exe
  C:\Windows\System\EfKJtLK.exe
  2⤵
  PID:9248
- C:\Windows\System\yoZOePu.exe
  C:\Windows\System\yoZOePu.exe
  2⤵
  PID:8364
- C:\Windows\System\JgLvABi.exe
  C:\Windows\System\JgLvABi.exe
  2⤵
  PID:9568
- C:\Windows\System\Rhsbotj.exe
  C:\Windows\System\Rhsbotj.exe
  2⤵
  PID:9620
- C:\Windows\System\RWGTGGT.exe
  C:\Windows\System\RWGTGGT.exe
  2⤵
  PID:9932
- C:\Windows\System\PnqrHxq.exe
  C:\Windows\System\PnqrHxq.exe
  2⤵
  PID:10172
- C:\Windows\System\DycrTcv.exe
  C:\Windows\System\DycrTcv.exe
  2⤵
  PID:9588
- C:\Windows\System\DnHtuSL.exe
  C:\Windows\System\DnHtuSL.exe
  2⤵
  PID:9996
- C:\Windows\System\hggEElt.exe
  C:\Windows\System\hggEElt.exe
  2⤵
  PID:10264
- C:\Windows\System\RlcGMCl.exe
  C:\Windows\System\RlcGMCl.exe
  2⤵
  PID:10280
- C:\Windows\System\xVSvdIo.exe
  C:\Windows\System\xVSvdIo.exe
  2⤵
  PID:10312
- C:\Windows\System\DVKghfV.exe
  C:\Windows\System\DVKghfV.exe
  2⤵
  PID:10344
- C:\Windows\System\lMNkRDo.exe
  C:\Windows\System\lMNkRDo.exe
  2⤵
  PID:10384
- C:\Windows\System\TImuJTh.exe
  C:\Windows\System\TImuJTh.exe
  2⤵
  PID:10412
- C:\Windows\System\FFQpGsU.exe
  C:\Windows\System\FFQpGsU.exe
  2⤵
  PID:10432
- C:\Windows\System\fBcaOGn.exe
  C:\Windows\System\fBcaOGn.exe
  2⤵
  PID:10456
- C:\Windows\System\DwSUiYF.exe
  C:\Windows\System\DwSUiYF.exe
  2⤵
  PID:10492
- C:\Windows\System\yFJfoXc.exe
  C:\Windows\System\yFJfoXc.exe
  2⤵
  PID:10516
- C:\Windows\System\gVXuiYX.exe
  C:\Windows\System\gVXuiYX.exe
  2⤵
  PID:10548
- C:\Windows\System\mTklebr.exe
  C:\Windows\System\mTklebr.exe
  2⤵
  PID:10568
- C:\Windows\System\ZfJnZVf.exe
  C:\Windows\System\ZfJnZVf.exe
  2⤵
  PID:10596
- C:\Windows\System\oQcorQi.exe
  C:\Windows\System\oQcorQi.exe
  2⤵
  PID:10616
- C:\Windows\System\xGkLYGV.exe
  C:\Windows\System\xGkLYGV.exe
  2⤵
  PID:10632
- C:\Windows\System\zrGZNJh.exe
  C:\Windows\System\zrGZNJh.exe
  2⤵
  PID:10668
- C:\Windows\System\uVVcEbb.exe
  C:\Windows\System\uVVcEbb.exe
  2⤵
  PID:10692
- C:\Windows\System\mjsxEOX.exe
  C:\Windows\System\mjsxEOX.exe
  2⤵
  PID:10708
- C:\Windows\System\GUFZMQU.exe
  C:\Windows\System\GUFZMQU.exe
  2⤵
  PID:10736
- C:\Windows\System\skXopDP.exe
  C:\Windows\System\skXopDP.exe
  2⤵
  PID:10764
- C:\Windows\System\fUincpk.exe
  C:\Windows\System\fUincpk.exe
  2⤵
  PID:10796
- C:\Windows\System\bLZhpEv.exe
  C:\Windows\System\bLZhpEv.exe
  2⤵
  PID:10812
- C:\Windows\System\YcAUUPF.exe
  C:\Windows\System\YcAUUPF.exe
  2⤵
  PID:10840
- C:\Windows\System\QefkiCY.exe
  C:\Windows\System\QefkiCY.exe
  2⤵
  PID:10868
- C:\Windows\System\diWLOwT.exe
  C:\Windows\System\diWLOwT.exe
  2⤵
  PID:10900
- C:\Windows\System\BrrsxDR.exe
  C:\Windows\System\BrrsxDR.exe
  2⤵
  PID:10928
- C:\Windows\System\lddmgTk.exe
  C:\Windows\System\lddmgTk.exe
  2⤵
  PID:10956
- C:\Windows\System\iLNIhAJ.exe
  C:\Windows\System\iLNIhAJ.exe
  2⤵
  PID:10972
- C:\Windows\System\zJScNgT.exe
  C:\Windows\System\zJScNgT.exe
  2⤵
  PID:10996
- C:\Windows\System\WOHtkBJ.exe
  C:\Windows\System\WOHtkBJ.exe
  2⤵
  PID:11024
- C:\Windows\System\kxNDAvs.exe
  C:\Windows\System\kxNDAvs.exe
  2⤵
  PID:11056
- C:\Windows\System\CSzyDNV.exe
  C:\Windows\System\CSzyDNV.exe
  2⤵
  PID:11088
- C:\Windows\System\GpTnQpI.exe
  C:\Windows\System\GpTnQpI.exe
  2⤵
  PID:11112
- C:\Windows\System\QUnivYX.exe
  C:\Windows\System\QUnivYX.exe
  2⤵
  PID:11144
- C:\Windows\System\ZHbebHh.exe
  C:\Windows\System\ZHbebHh.exe
  2⤵
  PID:11160
- C:\Windows\System\JSEJIbi.exe
  C:\Windows\System\JSEJIbi.exe
  2⤵
  PID:11192
- C:\Windows\System\ViHTfxA.exe
  C:\Windows\System\ViHTfxA.exe
  2⤵
  PID:11216
- C:\Windows\System\KGCJFKz.exe
  C:\Windows\System\KGCJFKz.exe
  2⤵
  PID:11236
- C:\Windows\System\akLXwUJ.exe
  C:\Windows\System\akLXwUJ.exe
  2⤵
  PID:11256
- C:\Windows\System\PtsvGmp.exe
  C:\Windows\System\PtsvGmp.exe
  2⤵
  PID:9564
- C:\Windows\System\FGHYqMm.exe
  C:\Windows\System\FGHYqMm.exe
  2⤵
  PID:10300
- C:\Windows\System\dToRwio.exe
  C:\Windows\System\dToRwio.exe
  2⤵
  PID:10340
- C:\Windows\System\MhHImJb.exe
  C:\Windows\System\MhHImJb.exe
  2⤵
  PID:9200
- C:\Windows\System\OmZJfbN.exe
  C:\Windows\System\OmZJfbN.exe
  2⤵
  PID:10368
- C:\Windows\System\iyJWQnH.exe
  C:\Windows\System\iyJWQnH.exe
  2⤵
  PID:10584
- C:\Windows\System\yhUeROg.exe
  C:\Windows\System\yhUeROg.exe
  2⤵
  PID:10376
- C:\Windows\System\fXPynuR.exe
  C:\Windows\System\fXPynuR.exe
  2⤵
  PID:10664
- C:\Windows\System\MkRTZCx.exe
  C:\Windows\System\MkRTZCx.exe
  2⤵
  PID:10732
- C:\Windows\System\UglIXdg.exe
  C:\Windows\System\UglIXdg.exe
  2⤵
  PID:10576
- C:\Windows\System\iQGzlCn.exe
  C:\Windows\System\iQGzlCn.exe
  2⤵
  PID:10748
- C:\Windows\System\WXVAjIw.exe
  C:\Windows\System\WXVAjIw.exe
  2⤵
  PID:10684
- C:\Windows\System\FZuigno.exe
  C:\Windows\System\FZuigno.exe
  2⤵
  PID:10700
- C:\Windows\System\KCERdMo.exe
  C:\Windows\System\KCERdMo.exe
  2⤵
  PID:11152
- C:\Windows\System\BApvqyf.exe
  C:\Windows\System\BApvqyf.exe
  2⤵
  PID:10892
- C:\Windows\System\gxhVOpP.exe
  C:\Windows\System\gxhVOpP.exe
  2⤵
  PID:11132
- C:\Windows\System\dBAPkMx.exe
  C:\Windows\System\dBAPkMx.exe
  2⤵
  PID:11068
- C:\Windows\System\COOcvKg.exe
  C:\Windows\System\COOcvKg.exe
  2⤵
  PID:11104
- C:\Windows\System\bCvcZHk.exe
  C:\Windows\System\bCvcZHk.exe
  2⤵
  PID:9444
- C:\Windows\System\gJBAdBo.exe
  C:\Windows\System\gJBAdBo.exe
  2⤵
  PID:10988
- C:\Windows\System\IUbMSib.exe
  C:\Windows\System\IUbMSib.exe
  2⤵
  PID:10588
- C:\Windows\System\TPPgTNW.exe
  C:\Windows\System\TPPgTNW.exe
  2⤵
  PID:10752
- C:\Windows\System\CQasich.exe
  C:\Windows\System\CQasich.exe
  2⤵
  PID:11228
- C:\Windows\System\zusLuGP.exe
  C:\Windows\System\zusLuGP.exe
  2⤵
  PID:10400
- C:\Windows\System\iyVPHJL.exe
  C:\Windows\System\iyVPHJL.exe
  2⤵
  PID:11020
- C:\Windows\System\xhEseox.exe
  C:\Windows\System\xhEseox.exe
  2⤵
  PID:11248
- C:\Windows\System\XJrnhJs.exe
  C:\Windows\System\XJrnhJs.exe
  2⤵
  PID:11280
- C:\Windows\System\FwTEgSM.exe
  C:\Windows\System\FwTEgSM.exe
  2⤵
  PID:11304
- C:\Windows\System\vQBJIwo.exe
  C:\Windows\System\vQBJIwo.exe
  2⤵
  PID:11340
- C:\Windows\System\ZJsQSil.exe
  C:\Windows\System\ZJsQSil.exe
  2⤵
  PID:11600
- C:\Windows\System\WdUlAXx.exe
  C:\Windows\System\WdUlAXx.exe
  2⤵
  PID:11636
- C:\Windows\System\SduVPls.exe
  C:\Windows\System\SduVPls.exe
  2⤵
  PID:11664
- C:\Windows\System\tTnZDwP.exe
  C:\Windows\System\tTnZDwP.exe
  2⤵
  PID:11680
- C:\Windows\System\RihVmHQ.exe
  C:\Windows\System\RihVmHQ.exe
  2⤵
  PID:11704
- C:\Windows\System\HmYEmqq.exe
  C:\Windows\System\HmYEmqq.exe
  2⤵
  PID:11724
- C:\Windows\System\cSBixDs.exe
  C:\Windows\System\cSBixDs.exe
  2⤵
  PID:11740
- C:\Windows\System\UGSdxtc.exe
  C:\Windows\System\UGSdxtc.exe
  2⤵
  PID:11768
- C:\Windows\System\KiJJEGF.exe
  C:\Windows\System\KiJJEGF.exe
  2⤵
  PID:11788
- C:\Windows\System\kOpQBAB.exe
  C:\Windows\System\kOpQBAB.exe
  2⤵
  PID:11820
- C:\Windows\System\xHswZxr.exe
  C:\Windows\System\xHswZxr.exe
  2⤵
  PID:11860
- C:\Windows\System\kobsuaO.exe
  C:\Windows\System\kobsuaO.exe
  2⤵
  PID:11892
- C:\Windows\System\UVjxeUU.exe
  C:\Windows\System\UVjxeUU.exe
  2⤵
  PID:11940
- C:\Windows\System\wNLaDvg.exe
  C:\Windows\System\wNLaDvg.exe
  2⤵
  PID:11964
- C:\Windows\System\zfvdbbw.exe
  C:\Windows\System\zfvdbbw.exe
  2⤵
  PID:11988
- C:\Windows\System\jEJVGbJ.exe
  C:\Windows\System\jEJVGbJ.exe
  2⤵
  PID:12012
- C:\Windows\System\uEUWnIf.exe
  C:\Windows\System\uEUWnIf.exe
  2⤵
  PID:12028
- C:\Windows\System\GRkLfIq.exe
  C:\Windows\System\GRkLfIq.exe
  2⤵
  PID:12056
- C:\Windows\System\piHxEHt.exe
  C:\Windows\System\piHxEHt.exe
  2⤵
  PID:12080
- C:\Windows\System\hcuZxIK.exe
  C:\Windows\System\hcuZxIK.exe
  2⤵
  PID:12100
- C:\Windows\System\MlOViFD.exe
  C:\Windows\System\MlOViFD.exe
  2⤵
  PID:12132
- C:\Windows\System\WQZQMDY.exe
  C:\Windows\System\WQZQMDY.exe
  2⤵
  PID:12160
- C:\Windows\System\ikVEgqG.exe
  C:\Windows\System\ikVEgqG.exe
  2⤵
  PID:12188
- C:\Windows\System\QZLieFt.exe
  C:\Windows\System\QZLieFt.exe
  2⤵
  PID:12216
- C:\Windows\System\iDEFwtQ.exe
  C:\Windows\System\iDEFwtQ.exe
  2⤵
  PID:12248
- C:\Windows\System\Irwsbli.exe
  C:\Windows\System\Irwsbli.exe
  2⤵
  PID:12276
- C:\Windows\System\gWzHhyG.exe
  C:\Windows\System\gWzHhyG.exe
  2⤵
  PID:10888
- C:\Windows\System\TrcBLSZ.exe
  C:\Windows\System\TrcBLSZ.exe
  2⤵
  PID:11172
- C:\Windows\System\MYZfpeI.exe
  C:\Windows\System\MYZfpeI.exe
  2⤵
  PID:10072
- C:\Windows\System\zJnamZE.exe
  C:\Windows\System\zJnamZE.exe
  2⤵
  PID:11008
- C:\Windows\System\ZxgVfRm.exe
  C:\Windows\System\ZxgVfRm.exe
  2⤵
  PID:11348
- C:\Windows\System\qStEljQ.exe
  C:\Windows\System\qStEljQ.exe
  2⤵
  PID:11652
- C:\Windows\System\xdisYMi.exe
  C:\Windows\System\xdisYMi.exe
  2⤵
  PID:11592
- C:\Windows\System\bFPkTJD.exe
  C:\Windows\System\bFPkTJD.exe
  2⤵
  PID:11696
- C:\Windows\System\yDtcttq.exe
  C:\Windows\System\yDtcttq.exe
  2⤵
  PID:11624
- C:\Windows\System\dkstQxy.exe
  C:\Windows\System\dkstQxy.exe
  2⤵
  PID:11780
- C:\Windows\System\rsaQDwH.exe
  C:\Windows\System\rsaQDwH.exe
  2⤵
  PID:11736
- C:\Windows\System\ymHjaJO.exe
  C:\Windows\System\ymHjaJO.exe
  2⤵
  PID:11804
- C:\Windows\System\REgZIjo.exe
  C:\Windows\System\REgZIjo.exe
  2⤵
  PID:11948
- C:\Windows\System\bcCzRBu.exe
  C:\Windows\System\bcCzRBu.exe
  2⤵
  PID:11828
- C:\Windows\System\YyLftyz.exe
  C:\Windows\System\YyLftyz.exe
  2⤵
  PID:12024
- C:\Windows\System\GvDRrzF.exe
  C:\Windows\System\GvDRrzF.exe
  2⤵
  PID:12088
- C:\Windows\System\blRTKHJ.exe
  C:\Windows\System\blRTKHJ.exe
  2⤵
  PID:12096
- C:\Windows\System\EaYjhBR.exe
  C:\Windows\System\EaYjhBR.exe
  2⤵
  PID:12284
- C:\Windows\System\BeuBgxF.exe
  C:\Windows\System\BeuBgxF.exe
  2⤵
  PID:12184
- C:\Windows\System\IWbYKJu.exe
  C:\Windows\System\IWbYKJu.exe
  2⤵
  PID:11208
- C:\Windows\System\ziMTnox.exe
  C:\Windows\System\ziMTnox.exe
  2⤵
  PID:11620
- C:\Windows\System\KiiGjZQ.exe
  C:\Windows\System\KiiGjZQ.exe
  2⤵
  PID:11660
- C:\Windows\System\gWCiUYb.exe
  C:\Windows\System\gWCiUYb.exe
  2⤵
  PID:11644
- C:\Windows\System\aouVehO.exe
  C:\Windows\System\aouVehO.exe
  2⤵
  PID:11784
- C:\Windows\System\AyHwrxr.exe
  C:\Windows\System\AyHwrxr.exe
  2⤵
  PID:12076
- C:\Windows\System\WWnfInl.exe
  C:\Windows\System\WWnfInl.exe
  2⤵
  PID:12200
- C:\Windows\System\dcakfko.exe
  C:\Windows\System\dcakfko.exe
  2⤵
  PID:10604
- C:\Windows\System\iNgqAvo.exe
  C:\Windows\System\iNgqAvo.exe
  2⤵
  PID:12312
- C:\Windows\System\jGgCkuV.exe
  C:\Windows\System\jGgCkuV.exe
  2⤵
  PID:12340
- C:\Windows\System\qFNjnjP.exe
  C:\Windows\System\qFNjnjP.exe
  2⤵
  PID:12368
- C:\Windows\System\uGObMYC.exe
  C:\Windows\System\uGObMYC.exe
  2⤵
  PID:12404
- C:\Windows\System\lVcFiAf.exe
  C:\Windows\System\lVcFiAf.exe
  2⤵
  PID:12428
- C:\Windows\System\cXgOtnD.exe
  C:\Windows\System\cXgOtnD.exe
  2⤵
  PID:12456
- C:\Windows\System\SldCuJS.exe
  C:\Windows\System\SldCuJS.exe
  2⤵
  PID:12500
- C:\Windows\System\yeBppEV.exe
  C:\Windows\System\yeBppEV.exe
  2⤵
  PID:12528
- C:\Windows\System\rXVPqUj.exe
  C:\Windows\System\rXVPqUj.exe
  2⤵
  PID:12556
- C:\Windows\System\xylJFpL.exe
  C:\Windows\System\xylJFpL.exe
  2⤵
  PID:12592
- C:\Windows\System\wojwDSJ.exe
  C:\Windows\System\wojwDSJ.exe
  2⤵
  PID:12612
- C:\Windows\System\MrfKYMw.exe
  C:\Windows\System\MrfKYMw.exe
  2⤵
  PID:12636
- C:\Windows\System\gLvAGYR.exe
  C:\Windows\System\gLvAGYR.exe
  2⤵
  PID:12668
- C:\Windows\System\lmzjdeW.exe
  C:\Windows\System\lmzjdeW.exe
  2⤵
  PID:12700
- C:\Windows\System\EuEBmEm.exe
  C:\Windows\System\EuEBmEm.exe
  2⤵
  PID:12732
- C:\Windows\System\KTOEEgW.exe
  C:\Windows\System\KTOEEgW.exe
  2⤵
  PID:12760
- C:\Windows\System\LfuDgFV.exe
  C:\Windows\System\LfuDgFV.exe
  2⤵
  PID:12788
- C:\Windows\System\vHUnDFY.exe
  C:\Windows\System\vHUnDFY.exe
  2⤵
  PID:12812
- C:\Windows\System\RXaAjDn.exe
  C:\Windows\System\RXaAjDn.exe
  2⤵
  PID:12836
- C:\Windows\System\VmsRTXr.exe
  C:\Windows\System\VmsRTXr.exe
  2⤵
  PID:12864
- C:\Windows\System\cUYaRyb.exe
  C:\Windows\System\cUYaRyb.exe
  2⤵
  PID:12880
- C:\Windows\System\CSMkKYG.exe
  C:\Windows\System\CSMkKYG.exe
  2⤵
  PID:12900
- C:\Windows\System\aolcKkq.exe
  C:\Windows\System\aolcKkq.exe
  2⤵
  PID:12932
- C:\Windows\System\nAqyOnl.exe
  C:\Windows\System\nAqyOnl.exe
  2⤵
  PID:12964
- C:\Windows\System\ngRuGPS.exe
  C:\Windows\System\ngRuGPS.exe
  2⤵
  PID:12992
- C:\Windows\System\MbqbsLv.exe
  C:\Windows\System\MbqbsLv.exe
  2⤵
  PID:13020
- C:\Windows\System\UKTlnyr.exe
  C:\Windows\System\UKTlnyr.exe
  2⤵
  PID:13052
- C:\Windows\System\PnCENbD.exe
  C:\Windows\System\PnCENbD.exe
  2⤵
  PID:13076
- C:\Windows\System\pqMtHeE.exe
  C:\Windows\System\pqMtHeE.exe
  2⤵
  PID:13100
- C:\Windows\System\pBlFRHi.exe
  C:\Windows\System\pBlFRHi.exe
  2⤵
  PID:13132
- C:\Windows\System\nZdHWnf.exe
  C:\Windows\System\nZdHWnf.exe
  2⤵
  PID:13160
- C:\Windows\System\GLTffXJ.exe
  C:\Windows\System\GLTffXJ.exe
  2⤵
  PID:13188
- C:\Windows\System\suafMzo.exe
  C:\Windows\System\suafMzo.exe
  2⤵
  PID:13216
- C:\Windows\System\XnyaCBK.exe
  C:\Windows\System\XnyaCBK.exe
  2⤵
  PID:13240
- C:\Windows\System\BEhHspW.exe
  C:\Windows\System\BEhHspW.exe
  2⤵
  PID:13268
- C:\Windows\System\vvRYbyL.exe
  C:\Windows\System\vvRYbyL.exe
  2⤵
  PID:13292
- C:\Windows\System\rAKHJKu.exe
  C:\Windows\System\rAKHJKu.exe
  2⤵
  PID:10908
- C:\Windows\System\XZIVihe.exe
  C:\Windows\System\XZIVihe.exe
  2⤵
  PID:11956
- C:\Windows\System\dvWIZBT.exe
  C:\Windows\System\dvWIZBT.exe
  2⤵
  PID:12356
- C:\Windows\System\LXkUvNg.exe
  C:\Windows\System\LXkUvNg.exe
  2⤵
  PID:12304
- C:\Windows\System\oXLxRFC.exe
  C:\Windows\System\oXLxRFC.exe
  2⤵
  PID:12420
- C:\Windows\System\pvyQFtv.exe
  C:\Windows\System\pvyQFtv.exe
  2⤵
  PID:12480
- C:\Windows\System\JDBTWpH.exe
  C:\Windows\System\JDBTWpH.exe
  2⤵
  PID:12716
- C:\Windows\System\nOcsypc.exe
  C:\Windows\System\nOcsypc.exe
  2⤵
  PID:12620
- C:\Windows\System\fZBYkly.exe
  C:\Windows\System\fZBYkly.exe
  2⤵
  PID:12752
- C:\Windows\System\AKizTWs.exe
  C:\Windows\System\AKizTWs.exe
  2⤵
  PID:12848
- C:\Windows\System\EyFTQKD.exe
  C:\Windows\System\EyFTQKD.exe
  2⤵
  PID:12776
- C:\Windows\System\AVnwSeH.exe
  C:\Windows\System\AVnwSeH.exe
  2⤵
  PID:12908
- C:\Windows\System\EeIrNLy.exe
  C:\Windows\System\EeIrNLy.exe
  2⤵
  PID:12976
- C:\Windows\System\WayKpsH.exe
  C:\Windows\System\WayKpsH.exe
  2⤵
  PID:13176
- C:\Windows\System\WcmPoLJ.exe
  C:\Windows\System\WcmPoLJ.exe
  2⤵
  PID:13068
- C:\Windows\System\NbUbaJM.exe
  C:\Windows\System\NbUbaJM.exe
  2⤵
  PID:13288
- C:\Windows\System\ekaNQtZ.exe
  C:\Windows\System\ekaNQtZ.exe
  2⤵
  PID:13144
- C:\Windows\System\lpyyZUP.exe
  C:\Windows\System\lpyyZUP.exe
  2⤵
  PID:12040
- C:\Windows\System\jBZbUXc.exe
  C:\Windows\System\jBZbUXc.exe
  2⤵
  PID:13252
- C:\Windows\System\dDfDLCB.exe
  C:\Windows\System\dDfDLCB.exe
  2⤵
  PID:12608
- C:\Windows\System\wWyUHjj.exe
  C:\Windows\System\wWyUHjj.exe
  2⤵
  PID:12208
- C:\Windows\System\wpPjlVy.exe
  C:\Windows\System\wpPjlVy.exe
  2⤵
  PID:12416
- C:\Windows\System\MtSpCVW.exe
  C:\Windows\System\MtSpCVW.exe
  2⤵
  PID:12916
- C:\Windows\System\wTzduOD.exe
  C:\Windows\System\wTzduOD.exe
  2⤵
  PID:13096
- C:\Windows\System\ijUkFmY.exe
  C:\Windows\System\ijUkFmY.exe
  2⤵
  PID:13032
- C:\Windows\System\nUBBkNh.exe
  C:\Windows\System\nUBBkNh.exe
  2⤵
  PID:12384
- C:\Windows\System\crcTeMP.exe
  C:\Windows\System\crcTeMP.exe
  2⤵
  PID:13316
- C:\Windows\System\kakJKyw.exe
  C:\Windows\System\kakJKyw.exe
  2⤵
  PID:13348
- C:\Windows\System\IaRejLl.exe
  C:\Windows\System\IaRejLl.exe
  2⤵
  PID:13376
- C:\Windows\System\XyAAOwd.exe
  C:\Windows\System\XyAAOwd.exe
  2⤵
  PID:13400
- C:\Windows\System\iLKtNgF.exe
  C:\Windows\System\iLKtNgF.exe
  2⤵
  PID:13436
- C:\Windows\System\UidSJfX.exe
  C:\Windows\System\UidSJfX.exe
  2⤵
  PID:13460
- C:\Windows\System\UVqeoaN.exe
  C:\Windows\System\UVqeoaN.exe
  2⤵
  PID:13484
- C:\Windows\System\QyXAQEN.exe
  C:\Windows\System\QyXAQEN.exe
  2⤵
  PID:13504
- C:\Windows\System\hbFRDvg.exe
  C:\Windows\System\hbFRDvg.exe
  2⤵
  PID:13528
- C:\Windows\System\aHjunao.exe
  C:\Windows\System\aHjunao.exe
  2⤵
  PID:13544
- C:\Windows\System\RGmVHis.exe
  C:\Windows\System\RGmVHis.exe
  2⤵
  PID:13564
- C:\Windows\System\mwEfMZC.exe
  C:\Windows\System\mwEfMZC.exe
  2⤵
  PID:13596
- C:\Windows\System\gWltiCW.exe
  C:\Windows\System\gWltiCW.exe
  2⤵
  PID:13624
- C:\Windows\System\lydHplL.exe
  C:\Windows\System\lydHplL.exe
  2⤵
  PID:13648
- C:\Windows\System\PwwgxDv.exe
  C:\Windows\System\PwwgxDv.exe
  2⤵
  PID:13672
- C:\Windows\System\eQQAHzV.exe
  C:\Windows\System\eQQAHzV.exe
  2⤵
  PID:13700
- C:\Windows\System\OQRyfis.exe
  C:\Windows\System\OQRyfis.exe
  2⤵
  PID:13724
- C:\Windows\System\kwjSkKw.exe
  C:\Windows\System\kwjSkKw.exe
  2⤵
  PID:13752
- C:\Windows\System\pDrwTcB.exe
  C:\Windows\System\pDrwTcB.exe
  2⤵
  PID:13776
- C:\Windows\System\bXMxbED.exe
  C:\Windows\System\bXMxbED.exe
  2⤵
  PID:13800
- C:\Windows\System\zKaCqgu.exe
  C:\Windows\System\zKaCqgu.exe
  2⤵
  PID:13832
- C:\Windows\System\PozwuLK.exe
  C:\Windows\System\PozwuLK.exe
  2⤵
  PID:13864
- C:\Windows\System\wNcXHdp.exe
  C:\Windows\System\wNcXHdp.exe
  2⤵
  PID:13888
- C:\Windows\System\tDmyfLe.exe
  C:\Windows\System\tDmyfLe.exe
  2⤵
  PID:13928
- C:\Windows\System\cssRvlY.exe
  C:\Windows\System\cssRvlY.exe
  2⤵
  PID:13956
- C:\Windows\System\dDGwYzw.exe
  C:\Windows\System\dDGwYzw.exe
  2⤵
  PID:13988
- C:\Windows\System\INexFcN.exe
  C:\Windows\System\INexFcN.exe
  2⤵
  PID:14012
- C:\Windows\System\pReQaxW.exe
  C:\Windows\System\pReQaxW.exe
  2⤵
  PID:14036
- C:\Windows\System\QdlbMQP.exe
  C:\Windows\System\QdlbMQP.exe
  2⤵
  PID:14060
- C:\Windows\System\PHHJgKX.exe
  C:\Windows\System\PHHJgKX.exe
  2⤵
  PID:14076
- C:\Windows\System\bbcUNhV.exe
  C:\Windows\System\bbcUNhV.exe
  2⤵
  PID:14104
- C:\Windows\System\juPjCmI.exe
  C:\Windows\System\juPjCmI.exe
  2⤵
  PID:14128
- C:\Windows\System\wiaysUj.exe
  C:\Windows\System\wiaysUj.exe
  2⤵
  PID:14156
- C:\Windows\System\VtOarjq.exe
  C:\Windows\System\VtOarjq.exe
  2⤵
  PID:14172
- C:\Windows\System\RKSgnDe.exe
  C:\Windows\System\RKSgnDe.exe
  2⤵
  PID:14196
- C:\Windows\System\xAdxvba.exe
  C:\Windows\System\xAdxvba.exe
  2⤵
  PID:14220
- C:\Windows\System\sFVaWqx.exe
  C:\Windows\System\sFVaWqx.exe
  2⤵
  PID:14260
- C:\Windows\System\ysWenKT.exe
  C:\Windows\System\ysWenKT.exe
  2⤵
  PID:14284
- C:\Windows\System\bQxPslt.exe
  C:\Windows\System\bQxPslt.exe
  2⤵
  PID:14316
- C:\Windows\System\QRFuHwe.exe
  C:\Windows\System\QRFuHwe.exe
  2⤵
  PID:12872
- C:\Windows\System\PbOTJiB.exe
  C:\Windows\System\PbOTJiB.exe
  2⤵
  PID:11836
- C:\Windows\System\pqEtoyq.exe
  C:\Windows\System\pqEtoyq.exe
  2⤵
  PID:11572
- C:\Windows\System\zQByYBt.exe
  C:\Windows\System\zQByYBt.exe
  2⤵
  PID:13408
- C:\Windows\System\qlikCyn.exe
  C:\Windows\System\qlikCyn.exe
  2⤵
  PID:13452
- C:\Windows\System\SmUTzEL.exe
  C:\Windows\System\SmUTzEL.exe
  2⤵
  PID:13492
- C:\Windows\System\nwGGrXd.exe
  C:\Windows\System\nwGGrXd.exe
  2⤵
  PID:13552
- C:\Windows\System\EPYwavU.exe
  C:\Windows\System\EPYwavU.exe
  2⤵
  PID:13608
- C:\Windows\System\gMCNVCs.exe
  C:\Windows\System\gMCNVCs.exe
  2⤵
  PID:13816
- C:\Windows\System\GgbGmpb.exe
  C:\Windows\System\GgbGmpb.exe
  2⤵
  PID:13856
- C:\Windows\System\myNSzJS.exe
  C:\Windows\System\myNSzJS.exe
  2⤵
  PID:13916
- C:\Windows\System\GpJurOq.exe
  C:\Windows\System\GpJurOq.exe
  2⤵
  PID:13948
- C:\Windows\System\UUpIkaO.exe
  C:\Windows\System\UUpIkaO.exe
  2⤵
  PID:13764
- C:\Windows\System\HhOWyId.exe
  C:\Windows\System\HhOWyId.exe
  2⤵
  PID:14124
- C:\Windows\System\DegFYju.exe
  C:\Windows\System\DegFYju.exe
  2⤵
  PID:14136
- C:\Windows\System\ipiZTWb.exe
  C:\Windows\System\ipiZTWb.exe
  2⤵
  PID:14164
- C:\Windows\System\NXXkAJt.exe
  C:\Windows\System\NXXkAJt.exe
  2⤵
  PID:14324
- C:\Windows\System\vfSwJSX.exe
  C:\Windows\System\vfSwJSX.exe
  2⤵
  PID:13300
- C:\Windows\System\OfSCpNg.exe
  C:\Windows\System\OfSCpNg.exe
  2⤵
  PID:14272
- C:\Windows\System\LMUmoZg.exe
  C:\Windows\System\LMUmoZg.exe
  2⤵
  PID:14212
- C:\Windows\System\JwgPpMC.exe
  C:\Windows\System\JwgPpMC.exe
  2⤵
  PID:13372
- C:\Windows\System\IZoThuI.exe
  C:\Windows\System\IZoThuI.exe
  2⤵
  PID:13912
- C:\Windows\System\PmMrNJE.exe
  C:\Windows\System\PmMrNJE.exe
  2⤵
  PID:13980
- C:\Windows\System\nSMHKcp.exe
  C:\Windows\System\nSMHKcp.exe
  2⤵
  PID:13968
- C:\Windows\System\QkmplgM.exe
  C:\Windows\System\QkmplgM.exe
  2⤵
  PID:13688
- C:\Windows\System\FEFFRGl.exe
  C:\Windows\System\FEFFRGl.exe
  2⤵
  PID:13008
- C:\Windows\System\jIraCHr.exe
  C:\Windows\System\jIraCHr.exe
  2⤵
  PID:14364
- C:\Windows\System\vxFBLej.exe
  C:\Windows\System\vxFBLej.exe
  2⤵
  PID:14388
- C:\Windows\System\SWxHFRB.exe
  C:\Windows\System\SWxHFRB.exe
  2⤵
  PID:14420
- C:\Windows\System\IHaCfYt.exe
  C:\Windows\System\IHaCfYt.exe
  2⤵
  PID:14448
- C:\Windows\System\ANfTXBK.exe
  C:\Windows\System\ANfTXBK.exe
  2⤵
  PID:14472
- C:\Windows\System\zdmNpiK.exe
  C:\Windows\System\zdmNpiK.exe
  2⤵
  PID:14496
- C:\Windows\System\SfxkzwY.exe
  C:\Windows\System\SfxkzwY.exe
  2⤵
  PID:14516
- C:\Windows\System\VJvxvae.exe
  C:\Windows\System\VJvxvae.exe
  2⤵
  PID:14540
- C:\Windows\System\TgirKCG.exe
  C:\Windows\System\TgirKCG.exe
  2⤵
  PID:14560
- C:\Windows\System\lvuyEEp.exe
  C:\Windows\System\lvuyEEp.exe
  2⤵
  PID:14584
- C:\Windows\System\GygVOoY.exe
  C:\Windows\System\GygVOoY.exe
  2⤵
  PID:14612
- C:\Windows\System\iShpRHt.exe
  C:\Windows\System\iShpRHt.exe
  2⤵
  PID:14640
- C:\Windows\System\UjOKLeo.exe
  C:\Windows\System\UjOKLeo.exe
  2⤵
  PID:14668
- C:\Windows\System\OsFhHQN.exe
  C:\Windows\System\OsFhHQN.exe
  2⤵
  PID:14700
- C:\Windows\System\KFEchbR.exe
  C:\Windows\System\KFEchbR.exe
  2⤵
  PID:14716
- C:\Windows\System\BBEQGaG.exe
  C:\Windows\System\BBEQGaG.exe
  2⤵
  PID:14740
- C:\Windows\System\WFJWmOp.exe
  C:\Windows\System\WFJWmOp.exe
  2⤵
  PID:14768
- C:\Windows\System\NgbBxmi.exe
  C:\Windows\System\NgbBxmi.exe
  2⤵
  PID:14800
- C:\Windows\System\GyKblJx.exe
  C:\Windows\System\GyKblJx.exe
  2⤵
  PID:14820
- C:\Windows\System\bKhORSe.exe
  C:\Windows\System\bKhORSe.exe
  2⤵
  PID:14844
- C:\Windows\System\jkoOern.exe
  C:\Windows\System\jkoOern.exe
  2⤵
  PID:14872
- C:\Windows\System\IOpurSl.exe
  C:\Windows\System\IOpurSl.exe
  2⤵
  PID:14896
- C:\Windows\System\qxYHgdU.exe
  C:\Windows\System\qxYHgdU.exe
  2⤵
  PID:14932
- C:\Windows\System\GwoOfSf.exe
  C:\Windows\System\GwoOfSf.exe
  2⤵
  PID:14956
- C:\Windows\System\ERvTgFn.exe
  C:\Windows\System\ERvTgFn.exe
  2⤵
  PID:14988
- C:\Windows\System\MTuWQDx.exe
  C:\Windows\System\MTuWQDx.exe
  2⤵
  PID:15012
- C:\Windows\System\fYEvjpr.exe
  C:\Windows\System\fYEvjpr.exe
  2⤵
  PID:15040
- C:\Windows\System\pXhERGA.exe
  C:\Windows\System\pXhERGA.exe
  2⤵
  PID:15076
- C:\Windows\System\cIugHQh.exe
  C:\Windows\System\cIugHQh.exe
  2⤵
  PID:15100
- C:\Windows\System\aXCoxqG.exe
  C:\Windows\System\aXCoxqG.exe
  2⤵
  PID:15128
- C:\Windows\System\HxLVjRX.exe
  C:\Windows\System\HxLVjRX.exe
  2⤵
  PID:15160
- C:\Windows\System\iSwWxnW.exe
  C:\Windows\System\iSwWxnW.exe
  2⤵
  PID:15192
- C:\Windows\System\sztatcX.exe
  C:\Windows\System\sztatcX.exe
  2⤵
  PID:15216
- C:\Windows\System\PnJYyCI.exe
  C:\Windows\System\PnJYyCI.exe
  2⤵
  PID:15244
- C:\Windows\System\qmlUBul.exe
  C:\Windows\System\qmlUBul.exe
  2⤵
  PID:15272
- C:\Windows\System\xPFIsqg.exe
  C:\Windows\System\xPFIsqg.exe
  2⤵
  PID:15296
- C:\Windows\System\XjNyySU.exe
  C:\Windows\System\XjNyySU.exe
  2⤵
  PID:15320
- C:\Windows\System\yIVwOqj.exe
  C:\Windows\System\yIVwOqj.exe
  2⤵
  PID:15340
- C:\Windows\System\XeUKEaM.exe
  C:\Windows\System\XeUKEaM.exe
  2⤵
  PID:14256
- C:\Windows\System\VrukYAu.exe
  C:\Windows\System\VrukYAu.exe
  2⤵
  PID:14024
- C:\Windows\System\QUyzKYg.exe
  C:\Windows\System\QUyzKYg.exe
  2⤵
  PID:14240
- C:\Windows\System\kBjWjtp.exe
  C:\Windows\System\kBjWjtp.exe
  2⤵
  PID:14400
- C:\Windows\System\CiCRkRj.exe
  C:\Windows\System\CiCRkRj.exe
  2⤵
  PID:12744
- C:\Windows\System\prifoiE.exe
  C:\Windows\System\prifoiE.exe
  2⤵
  PID:14432
- C:\Windows\System\pEOztoG.exe
  C:\Windows\System\pEOztoG.exe
  2⤵
  PID:14604
- C:\Windows\System\JqgxHiN.exe
  C:\Windows\System\JqgxHiN.exe
  2⤵
  PID:14652
- C:\Windows\System\LfROvGw.exe
  C:\Windows\System\LfROvGw.exe
  2⤵
  PID:14752
- C:\Windows\System\JhzqbNi.exe
  C:\Windows\System\JhzqbNi.exe
  2⤵
  PID:14624
- C:\Windows\System\smoTOaI.exe
  C:\Windows\System\smoTOaI.exe
  2⤵
  PID:14708
- C:\Windows\System\xcRwOUU.exe
  C:\Windows\System\xcRwOUU.exe
  2⤵
  PID:14812
- C:\Windows\System\tilydhk.exe
  C:\Windows\System\tilydhk.exe
  2⤵
  PID:14688
- C:\Windows\System\jotfFpy.exe
  C:\Windows\System\jotfFpy.exe
  2⤵
  PID:14944
- C:\Windows\System\EuPKJxB.exe
  C:\Windows\System\EuPKJxB.exe
  2⤵
  PID:14808
- C:\Windows\System\qeQyZLx.exe
  C:\Windows\System\qeQyZLx.exe
  2⤵
  PID:14888
- C:\Windows\System\AGaoMdJ.exe
  C:\Windows\System\AGaoMdJ.exe
  2⤵
  PID:15088
- C:\Windows\System\rcpWYKE.exe
  C:\Windows\System\rcpWYKE.exe
  2⤵
  PID:15184
- C:\Windows\System\LMqdACK.exe
  C:\Windows\System\LMqdACK.exe
  2⤵
  PID:15112
- C:\Windows\System\AzCPFfP.exe
  C:\Windows\System\AzCPFfP.exe
  2⤵
  PID:15304
- C:\Windows\System\TmWQLBR.exe
  C:\Windows\System\TmWQLBR.exe
  2⤵
  PID:12600
- C:\Windows\System\zfeHECL.exe
  C:\Windows\System\zfeHECL.exe
  2⤵
  PID:15208
- C:\Windows\System\EKbkkrP.exe
  C:\Windows\System\EKbkkrP.exe
  2⤵
  PID:14764
- C:\Windows\System\kYEbWsd.exe
  C:\Windows\System\kYEbWsd.exe
  2⤵
  PID:14340
- C:\Windows\System\LtmzSTr.exe
  C:\Windows\System\LtmzSTr.exe
  2⤵
  PID:14680
- C:\Windows\System\zoQCjFS.exe
  C:\Windows\System\zoQCjFS.exe
  2⤵
  PID:14508
- C:\Windows\System\SNoEZJp.exe
  C:\Windows\System\SNoEZJp.exe
  2⤵
  PID:15368
- C:\Windows\System\VxXGqdG.exe
  C:\Windows\System\VxXGqdG.exe
  2⤵
  PID:15404
- C:\Windows\System\aRYTLHQ.exe
  C:\Windows\System\aRYTLHQ.exe
  2⤵
  PID:15428
- C:\Windows\System\gAyBxQF.exe
  C:\Windows\System\gAyBxQF.exe
  2⤵
  PID:15460
- C:\Windows\System\bBQjEGN.exe
  C:\Windows\System\bBQjEGN.exe
  2⤵
  PID:15484
- C:\Windows\System\HsDcsLh.exe
  C:\Windows\System\HsDcsLh.exe
  2⤵
  PID:15512
- C:\Windows\System\uOWPPtl.exe
  C:\Windows\System\uOWPPtl.exe
  2⤵
  PID:15536
- C:\Windows\System\xCyaMnO.exe
  C:\Windows\System\xCyaMnO.exe
  2⤵
  PID:15576
- C:\Windows\System\QMOREvn.exe
  C:\Windows\System\QMOREvn.exe
  2⤵
  PID:15596
- C:\Windows\System\buJVeNA.exe
  C:\Windows\System\buJVeNA.exe
  2⤵
  PID:15620
- C:\Windows\System\KLdwNTZ.exe
  C:\Windows\System\KLdwNTZ.exe
  2⤵
  PID:15640
- C:\Windows\System\GzZcQrU.exe
  C:\Windows\System\GzZcQrU.exe
  2⤵
  PID:15668
- C:\Windows\System\xWmBxPS.exe
  C:\Windows\System\xWmBxPS.exe
  2⤵
  PID:15692
- C:\Windows\System\VYgqbOK.exe
  C:\Windows\System\VYgqbOK.exe
  2⤵
  PID:15716
- C:\Windows\System\PTiOQTC.exe
  C:\Windows\System\PTiOQTC.exe
  2⤵
  PID:15736
- C:\Windows\System\ATEOkTK.exe
  C:\Windows\System\ATEOkTK.exe
  2⤵
  PID:15764
- C:\Windows\System\AOBGqAk.exe
  C:\Windows\System\AOBGqAk.exe
  2⤵
  PID:15788
- C:\Windows\System\ELTokrA.exe
  C:\Windows\System\ELTokrA.exe
  2⤵
  PID:15816
- C:\Windows\System\Kmouljf.exe
  C:\Windows\System\Kmouljf.exe
  2⤵
  PID:15840
- C:\Windows\System\SQcdsWw.exe
  C:\Windows\System\SQcdsWw.exe
  2⤵
  PID:15856
- C:\Windows\System\YNxeVjZ.exe
  C:\Windows\System\YNxeVjZ.exe
  2⤵
  PID:15872
- C:\Windows\System\MaDVxRo.exe
  C:\Windows\System\MaDVxRo.exe
  2⤵
  PID:15896
- C:\Windows\System\SFRXGHi.exe
  C:\Windows\System\SFRXGHi.exe
  2⤵
  PID:15920
- C:\Windows\System\IUVAxeI.exe
  C:\Windows\System\IUVAxeI.exe
  2⤵
  PID:15952
- C:\Windows\System\rLdzrsV.exe
  C:\Windows\System\rLdzrsV.exe
  2⤵
  PID:15976
- C:\Windows\System\WTZHAne.exe
  C:\Windows\System\WTZHAne.exe
  2⤵
  PID:15996
- C:\Windows\System\MmWKSuw.exe
  C:\Windows\System\MmWKSuw.exe
  2⤵
  PID:16016
- C:\Windows\System\NloLaQm.exe
  C:\Windows\System\NloLaQm.exe
  2⤵
  PID:16044
- C:\Windows\System\QXpWyuo.exe
  C:\Windows\System\QXpWyuo.exe
  2⤵
  PID:16076
- C:\Windows\System\OTtVotm.exe
  C:\Windows\System\OTtVotm.exe
  2⤵
  PID:16096
- C:\Windows\System\FJfsBso.exe
  C:\Windows\System\FJfsBso.exe
  2⤵
  PID:16116
- C:\Windows\System\siXSEMw.exe
  C:\Windows\System\siXSEMw.exe
  2⤵
  PID:16144
- C:\Windows\System\DoSisHe.exe
  C:\Windows\System\DoSisHe.exe
  2⤵
  PID:16172
- C:\Windows\System\gOPzWYj.exe
  C:\Windows\System\gOPzWYj.exe
  2⤵
  PID:16200
- C:\Windows\System\wrWMyDM.exe
  C:\Windows\System\wrWMyDM.exe
  2⤵
  PID:16224
- C:\Windows\System\QgkUuJJ.exe
  C:\Windows\System\QgkUuJJ.exe
  2⤵
  PID:16264
- C:\Windows\System\LcwNqea.exe
  C:\Windows\System\LcwNqea.exe
  2⤵
  PID:16288
- C:\Windows\System\pjfRqoI.exe
  C:\Windows\System\pjfRqoI.exe
  2⤵
  PID:16316
- C:\Windows\System\sFTcmgn.exe
  C:\Windows\System\sFTcmgn.exe
  2⤵
  PID:16340
- C:\Windows\System\bezhcgS.exe
  C:\Windows\System\bezhcgS.exe
  2⤵
  PID:16360
- C:\Windows\System\HqRKTIw.exe
  C:\Windows\System\HqRKTIw.exe
  2⤵
  PID:13684
- C:\Windows\System\DZwxnxT.exe
  C:\Windows\System\DZwxnxT.exe
  2⤵
  PID:14784
- C:\Windows\System\fDMuxih.exe
  C:\Windows\System\fDMuxih.exe
  2⤵
  PID:15292
- C:\Windows\System\SxHpdce.exe
  C:\Windows\System\SxHpdce.exe
  2⤵
  PID:15476
- C:\Windows\System\VWqnvNA.exe
  C:\Windows\System\VWqnvNA.exe
  2⤵
  PID:14864
- C:\Windows\System\akVDmbq.exe
  C:\Windows\System\akVDmbq.exe
  2⤵
  PID:15176
- C:\Windows\System\fQsmeea.exe
  C:\Windows\System\fQsmeea.exe
  2⤵
  PID:13844
- C:\Windows\System\YGHOtfs.exe
  C:\Windows\System\YGHOtfs.exe
  2⤵
  PID:15444
- C:\Windows\System\CnQezMx.exe
  C:\Windows\System\CnQezMx.exe
  2⤵
  PID:15700
- C:\Windows\System\Wiogghb.exe
  C:\Windows\System\Wiogghb.exe
  2⤵
  PID:15752
- C:\Windows\System\XzuFQKN.exe
  C:\Windows\System\XzuFQKN.exe
  2⤵
  PID:15364
- C:\Windows\System\pdqsAJw.exe
  C:\Windows\System\pdqsAJw.exe
  2⤵
  PID:15828
- C:\Windows\System\HEGebOl.exe
  C:\Windows\System\HEGebOl.exe
  2⤵
  PID:15888
- C:\Windows\System\veDPobC.exe
  C:\Windows\System\veDPobC.exe
  2⤵
  PID:15968
- C:\Windows\System\liFvTlG.exe
  C:\Windows\System\liFvTlG.exe
  2⤵
  PID:15728
- C:\Windows\System\vyNsJNF.exe
  C:\Windows\System\vyNsJNF.exe
  2⤵
  PID:15800
- C:\Windows\System\UjDURww.exe
  C:\Windows\System\UjDURww.exe
  2⤵
  PID:3364
- C:\Windows\System\vUzGfcm.exe
  C:\Windows\System\vUzGfcm.exe
  2⤵
  PID:16084
- C:\Windows\System\UMVJvbn.exe
  C:\Windows\System\UMVJvbn.exe
  2⤵
  PID:15852
- C:\Windows\System\jGjajmg.exe
  C:\Windows\System\jGjajmg.exe
  2⤵
  PID:15932
- C:\Windows\System\CYNvHMO.exe
  C:\Windows\System\CYNvHMO.exe
  2⤵
  PID:16212
- C:\Windows\System\ymuAvlM.exe
  C:\Windows\System\ymuAvlM.exe
  2⤵
  PID:15748
- C:\Windows\System\YABYzBc.exe
  C:\Windows\System\YABYzBc.exe
  2⤵
  PID:16108
- C:\Windows\System\RYbxoax.exe
  C:\Windows\System\RYbxoax.exe
  2⤵
  PID:15560
- C:\Windows\System\lbFzitu.exe
  C:\Windows\System\lbFzitu.exe
  2⤵
  PID:15664
- C:\Windows\System\VnJyCnC.exe
  C:\Windows\System\VnJyCnC.exe
  2⤵
  PID:16356
- C:\Windows\System\CYzrqOl.exe
  C:\Windows\System\CYzrqOl.exe
  2⤵
  PID:15584
- C:\Windows\System\ObYfzjq.exe
  C:\Windows\System\ObYfzjq.exe
  2⤵
  PID:15948
- C:\Windows\System\reExGIh.exe
  C:\Windows\System\reExGIh.exe
  2⤵
  PID:14456
- C:\Windows\System\WXtnFOE.exe
  C:\Windows\System\WXtnFOE.exe
  2⤵
  PID:16188
- C:\Windows\System\keLtqQy.exe
  C:\Windows\System\keLtqQy.exe
  2⤵
  PID:16416
- C:\Windows\System\dXaDEqJ.exe
  C:\Windows\System\dXaDEqJ.exe
  2⤵
  PID:16444
- C:\Windows\System\dQvEYVb.exe
  C:\Windows\System\dQvEYVb.exe
  2⤵
  PID:16480
- C:\Windows\System\UaEDnvQ.exe
  C:\Windows\System\UaEDnvQ.exe
  2⤵
  PID:16504
- C:\Windows\System\LHDkPNc.exe
  C:\Windows\System\LHDkPNc.exe
  2⤵
  PID:16532
- C:\Windows\System\gyzdfKp.exe
  C:\Windows\System\gyzdfKp.exe
  2⤵
  PID:16556
- C:\Windows\System\hyFZnId.exe
  C:\Windows\System\hyFZnId.exe
  2⤵
  PID:16584
- C:\Windows\System\NkQIdiq.exe
  C:\Windows\System\NkQIdiq.exe
  2⤵
  PID:16612
- C:\Windows\System\XaQyWmM.exe
  C:\Windows\System\XaQyWmM.exe
  2⤵
  PID:16640
- C:\Windows\System\izRkbpK.exe
  C:\Windows\System\izRkbpK.exe
  2⤵
  PID:16668
- C:\Windows\System\iuxjlXP.exe
  C:\Windows\System\iuxjlXP.exe
  2⤵
  PID:16700
- C:\Windows\System\YHNpPNY.exe
  C:\Windows\System\YHNpPNY.exe
  2⤵
  PID:16720
- C:\Windows\System\SZYNfLr.exe
  C:\Windows\System\SZYNfLr.exe
  2⤵
  PID:16748
- C:\Windows\System\TLdLzie.exe
  C:\Windows\System\TLdLzie.exe
  2⤵
  PID:16764
- C:\Windows\System\QMRBNqj.exe
  C:\Windows\System\QMRBNqj.exe
  2⤵
  PID:16804
- C:\Windows\System\ZqqRlhn.exe
  C:\Windows\System\ZqqRlhn.exe
  2⤵
  PID:16856
- C:\Windows\System\UyFdkFO.exe
  C:\Windows\System\UyFdkFO.exe
  2⤵
  PID:16880
- C:\Windows\System\erUOGnE.exe
  C:\Windows\System\erUOGnE.exe
  2⤵
  PID:16908
- C:\Windows\System\aBtPfFi.exe
  C:\Windows\System\aBtPfFi.exe
  2⤵
  PID:16940
- C:\Windows\System\GVHVfGY.exe
  C:\Windows\System\GVHVfGY.exe
  2⤵
  PID:16960
- C:\Windows\System\SXCKcND.exe
  C:\Windows\System\SXCKcND.exe
  2⤵
  PID:16992
- C:\Windows\System\jiTdgyd.exe
  C:\Windows\System\jiTdgyd.exe
  2⤵
  PID:17020
- C:\Windows\System\uQrahXZ.exe
  C:\Windows\System\uQrahXZ.exe
  2⤵
  PID:17040
- C:\Windows\System\ZLGSMBU.exe
  C:\Windows\System\ZLGSMBU.exe
  2⤵
  PID:17056
- C:\Windows\System\NTZbunR.exe
  C:\Windows\System\NTZbunR.exe
  2⤵
  PID:17076
- C:\Windows\System\KWMDNKi.exe
  C:\Windows\System\KWMDNKi.exe
  2⤵
  PID:17096
- C:\Windows\System\WNULmDh.exe
  C:\Windows\System\WNULmDh.exe
  2⤵
  PID:17124
- C:\Windows\System\fLlkWDQ.exe
  C:\Windows\System\fLlkWDQ.exe
  2⤵
  PID:17148
- C:\Windows\System\SQoMUVt.exe
  C:\Windows\System\SQoMUVt.exe
  2⤵
  PID:17180
- C:\Windows\System\tJSYsIn.exe
  C:\Windows\System\tJSYsIn.exe
  2⤵
  PID:17204
- C:\Windows\System\QWFaytN.exe
  C:\Windows\System\QWFaytN.exe
  2⤵
  PID:17228
- C:\Windows\System\ZKxLUnx.exe
  C:\Windows\System\ZKxLUnx.exe
  2⤵
  PID:17264
- C:\Windows\System\fYUwels.exe
  C:\Windows\System\fYUwels.exe
  2⤵
  PID:16352
- C:\Windows\System\MTPOZCK.exe
  C:\Windows\System\MTPOZCK.exe
  2⤵
  PID:16744
- C:\Windows\System\viSYqCX.exe
  C:\Windows\System\viSYqCX.exe
  2⤵
  PID:16440
- C:\Windows\System\WXvogXq.exe
  C:\Windows\System\WXvogXq.exe
  2⤵
  PID:16500
- C:\Windows\System\KneXZqR.exe
  C:\Windows\System\KneXZqR.exe
  2⤵
  PID:16572
- C:\Windows\System\ppnycJH.exe
  C:\Windows\System\ppnycJH.exe
  2⤵
  PID:17072
- C:\Windows\System\aqYrArW.exe
  C:\Windows\System\aqYrArW.exe
  2⤵
  PID:17192
- C:\Windows\System\BbOFyYw.exe
  C:\Windows\System\BbOFyYw.exe
  2⤵
  PID:17332
- C:\Windows\System\wALozEc.exe
  C:\Windows\System\wALozEc.exe
  2⤵
  PID:17092
- C:\Windows\System\MvxvoiJ.exe
  C:\Windows\System\MvxvoiJ.exe
  2⤵
  PID:13876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CfuSJez.exe

Path C:\Windows\System\CfuSJez.exe
Size 1.3MB
SHA256 2e32f3a15937b233e1becffa813b65ac33a3c261f5001c21ed6e942767db29fa
MD5 7ad7a0619fbc1316bc6f53596be6312e
SHA1 48e4ec4bcf334a0e39c0a40e41d0886767e35584
SHA512 dfd4757e9b9ab9a3e7652525d904e43daf40eea0b06b7425444f9a5d037bacfa6bea328e39b8cd0069b15bc8a4b719e12f4211770731bfcac6dac786f395e054
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbc8:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c52
MD5 SHA1 SHA512 SSDEEP

Submit Download

FPeOgUt.exe

Path C:\Windows\System\FPeOgUt.exe
Size 1.3MB
SHA256 92292a3b351290e330ec3b0f37a5785dcde3a4fc907b3afcc75e66d0638f3cf4
MD5 8686d792befed732fb5b231bf4873e36
SHA1 e65bec1ec4917e3e7d79df3bbcfc3c72fd7c24e0
SHA512 dff63ec1bb1c8906a4471ad087a1c87667b8c3e2e0dc20e5caa62ec0e5d0434e562d611268dfe042b42b6f1a096f047e98418ad8aa18bc272121d747b3420b96
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcc:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5i
MD5 SHA1 SHA512 SSDEEP

Submit Download

FWNxJSY.exe

Path C:\Windows\System\FWNxJSY.exe
Size 1.3MB
SHA256 94ff4c45179fa6d241638a430a3cf7adf4651c0913c5cb257f758b2c40af89eb
MD5 d29d0ebbbb73f3deb3fd80d17d811dda
SHA1 1a04c9b08c4b58a8d4f9d877730af1a38fa44b14
SHA512 9a0e190899d8902af8ae51e9041916d33fc9a38601f58927f9bf4a64078e17341acfadbde163aae21f30b0d6eeb30a94236aa2c80012d0ca30f0a44d5bd4cca0
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbca:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5M
MD5 SHA1 SHA512 SSDEEP

Submit Download

FWclwib.exe

Path C:\Windows\System\FWclwib.exe
Size 1.3MB
SHA256 834c7cf7b807fdfad98654f8d9abb55649e7654f13cf535697276e0274427541
MD5 b5d0a45ded833f0cf7f1fafdbab33a1d
SHA1 175b9d6b962d2609bfead43f683bdcbbe21cbb78
SHA512 9afbd64e17cf0fe4c3a35e143c3caed48ed54904fbdd893e52b3d4c488e1428370afea44b80b332ecccb9993e9952de707ec5b1208e01723afb6f65fc052cc4c
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcl:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5T
MD5 SHA1 SHA512 SSDEEP

Submit Download

GZYScDS.exe

Path C:\Windows\System\GZYScDS.exe
Size 1.3MB
SHA256 0dca9e393c5ba6a3222cfa18e49acb52dfd2caaec9681b5d9cef96af0108fbc1
MD5 e4503f21898e2fafab75305f421def86
SHA1 7207216f5c8280f2f387f0da9defba1148bebcb2
SHA512 80230d09459a8e945a56c872fcf04af04a7a2f47d88d421c61832bdcfa90d515dc35e476d4e0745b2c63d5c5fc09468bbfb4112cfda1f656e2ac0facc7d0a026
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcA:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c52
MD5 SHA1 SHA512 SSDEEP

Submit Download

JjUQjYB.exe

Path C:\Windows\System\JjUQjYB.exe
Size 1.3MB
SHA256 a84cf504cecc4433a353be9bc7748a9492d2bb55e68a5127e39128b9fadf6d42
MD5 db5edca67aa0feb8b3f6a5fef9f2d963
SHA1 dfe18600e0338178a01dd4af1470e8c672503208
SHA512 329d8188d09b9b9d268a083ed8e36a82d62160e110873282cfc708e4db23af7087cc73cd8e9444bb2380b372d9e59151b4d01e6343f6492b1fa9e2c4c0ba1cac
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbc+:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c58
MD5 SHA1 SHA512 SSDEEP

Submit Download

JpXnIvF.exe

Path C:\Windows\System\JpXnIvF.exe
Size 1.3MB
SHA256 e10482b8aeac255abe7a518491c6263a54a7714ea1fbc4bffd9db2f8bbca0b07
MD5 edf7c195034b566bf0330403d3de970d
SHA1 d93e27a518400b5c1df39228c90c475d6e3ad005
SHA512 dfc448a180822a3846929869bfac287bc7aa8b695c77eca24b2b95e03939508876ed974a6399ba87dc31d3827a038d53f303a53104326726523f4db9cf72adc2
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcC:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5w
MD5 SHA1 SHA512 SSDEEP

Submit Download

KJdQPAV.exe

Path C:\Windows\System\KJdQPAV.exe
Size 1.3MB
SHA256 03d557d56d907df431cd9b0247782d71457e2afe2923f5f59bfddff28dc12e94
MD5 1da748c8c22d0ea2780b5a508b964ca5
SHA1 c6261ea87872f9f19e514c2cf83283e7a4503c6a
SHA512 189cc0b27d12dab1661da59a38f5dca9dd70ec4f942c6f4a049e913daaed7e4d8c71815c19ecb69c5d4f24dfb78deb5636355880d70ca432e7e5c3f4deeb78cc
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcD:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5N
MD5 SHA1 SHA512 SSDEEP

Submit Download

PUepHpf.exe

Path C:\Windows\System\PUepHpf.exe
Size 1.3MB
SHA256 9df504abd97f5a2bd6dec77dfc0ca77dd5b5de84fe2e7ac9021263b64a306a48
MD5 50910b15705d54675f8464648d9eb47b
SHA1 c94eecb0d8d0353b10cadf3f5326c7ec5607f53d
SHA512 7d5f13d9ea6677c78f83d96dbf21cf2bdb0ce8cc01b36ab4586a780b2e46c784a7c6a5672acd9e0a1cf53236445b98ed8b0c9d079cf9a0788e034ed9b09ef50a
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcH:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5p
MD5 SHA1 SHA512 SSDEEP

Submit Download

QyzSjfw.exe

Path C:\Windows\System\QyzSjfw.exe
Size 1.3MB
SHA256 3654558ce024dbe02e70e88c11077f5ca94e1a5b0d9be6970cc10696aaa8d0af
MD5 75ecca268662dddfb6d10f75ed5fa039
SHA1 148f39d324f4902dd191f4e121ef17756cade512
SHA512 1d08c835907e35251d5962dc3bbfb79d173f766560c4e5b60962e7ac3eb6f1ec5bdeba7d85f66e6956dd0d3c3ed51567dce09e486b62a34a288f97e962255a9a
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcZ:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c57
MD5 SHA1 SHA512 SSDEEP

Submit Download

RcFaHzD.exe

Path C:\Windows\System\RcFaHzD.exe
Size 1.3MB
SHA256 0464be6cd60925049faead5526a924fcfa6576ec367c1b914d6b77bb66952338
MD5 157380e010b5ebae3c3aac456da8da0f
SHA1 8b9e605a8bd23a14f5a56746bc487d1e446935a0
SHA512 317bb606f32507516224b33493ca6e0e08bf96841dd29a55666b99efbcb64cf90d4723517e7f3d236753d37d3caaafcf1260c331e313bbd635e2e5aec3aab86b
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcl:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ttracbb.exe

Path C:\Windows\System\Ttracbb.exe
Size 1.3MB
SHA256 1fce60a7c066ec7979fcd26fff626b01d3e588972f84038dc8b484b61196943b
MD5 c0986ff4484a880d472957938053b48c
SHA1 1181c25bfda488c5af03e35b7eca49a96611f5fa
SHA512 4c65718af8ccc7f0af095a7ce2c4ced5767f19ce19ceee172858a1dc0dd76be82c275d8e063895dc388e12a767af9658f7fceb5a8df6a105ec65c8e4feb88e8e
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbca:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5s
MD5 SHA1 SHA512 SSDEEP

Submit Download

UFVpLvE.exe

Path C:\Windows\System\UFVpLvE.exe
Size 1.3MB
SHA256 9c3f36b0da3329f7b79eece7475080994a77e574a6280f891693410420efbe90
MD5 9febe467fba9a1e03f998e81148a48c5
SHA1 bbbb5c5dfc71499e1df117f798303bc2fc54ea1f
SHA512 237c01cc8fc3d2c932ec05f29289f8775d6cb12901dbebefda01a65ffb51af6d2126cab58434906272eed718e13f6a42eaebb0572a2abf8f714fb8771f6a1c70
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcJ:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5/
MD5 SHA1 SHA512 SSDEEP

Submit Download

VqPEFwu.exe

Path C:\Windows\System\VqPEFwu.exe
Size 1.3MB
SHA256 b1149af41c2bed699ce2c6d063f672d37a4080522d7eaacc26171714eb14e044
MD5 2ac14eb3a8de84e2b1bdaa1cf051c0c1
SHA1 2e0001a5107d75abb71ac786a5408f039a680479
SHA512 cf58dc5268992fbd296feb60483ab905410466118c109c56d3be75fe8dadd644c6da94b872d8b925eb387af6b026e90f62ea1ddd447c38c05bada819855c58fd
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcj:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5x
MD5 SHA1 SHA512 SSDEEP

Submit Download

WFXVVVs.exe

Path C:\Windows\System\WFXVVVs.exe
Size 1.3MB
SHA256 1a54bee0427e54dcaa63190d347ed284a428d86c9530022176d05a24c7e500f3
MD5 87f87e1d904f133d48a0a5767a6179d2
SHA1 3338c435ed0a99153aa740c7265836c8a37fee29
SHA512 03bb5f08255104b6e710d17988148f309fe2af001caa58cc8fc87033afd42992a8ad4f038b39858f5a818a8d255c544f00fb8ed5c33d9d4d3a4ffda7db2ae516
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcO:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5A
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmkCetZ.exe

Path C:\Windows\System\WmkCetZ.exe
Size 1.3MB
SHA256 28f584f4e111b4edb661d3291212ba5e66151e1f4870bdc94310a19291cfb0d0
MD5 b0f120bc217bdb9863df51c9392e2269
SHA1 a4726b1f10b53cce7d23038dd6b5aa2fbce14280
SHA512 ab0ed272ff8ec5f6f05f4b2d2773064d5bf9dc4dfce36d5bdad4ccac71e8a575dd4bdb8f838814fe8a50e729ee13d4af8fb2ce368d1b39e9534efe7956ce1c75
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbck:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5q
MD5 SHA1 SHA512 SSDEEP

Submit Download

XyNCEoA.exe

Path C:\Windows\System\XyNCEoA.exe
Size 1.3MB
SHA256 3a801c96b5b04ba16697234e4a7ccacf90e3d0e5eef0194133a13c0b3901c8f4
MD5 101d0ca39d74d83eac19df8ec41cf366
SHA1 6a05b9384ef11f507335f28099c24eab3a88be84
SHA512 1bf452ff863cf1b03da8de0013f23213e24dfc22109835cdab5f0cdf0e6959a373f9d348814d18d48808b1701b700970c1d8800ea5aa2781fa56edc3be77093a
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbc0:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5q
MD5 SHA1 SHA512 SSDEEP

Submit Download

YRGtSPe.exe

Path C:\Windows\System\YRGtSPe.exe
Size 1.3MB
SHA256 4bb5441886eb968cc3af64d0dbe17fed8a12a3d42c34f940e630062cfdfe6fde
MD5 50b1264a03a445fdce55b73d45dcbc27
SHA1 88f3d7919441e5b13cd9a451075db558b09522a8
SHA512 ee4f5eab426bddbc1cbfb095943f626ae3182ad32a60c92680d5c461c2d6804786f3c3d9a5ce824d5d14273b58986177459e64ae88a3a7347e4ad03d019b7983
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcy:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5k
MD5 SHA1 SHA512 SSDEEP

Submit Download

beGNcSY.exe

Path C:\Windows\System\beGNcSY.exe
Size 1.3MB
SHA256 2640a34c31250b3f337391bc2e0e55cd3c97d97aeb0bd5ee1057c6987a72a52a
MD5 57205646b96c15d3cf2cd1985eca930e
SHA1 93b34ec6aebafd7e29c5cf102cce0be94946c657
SHA512 0df549d79dfec122370e2cc2b33176d85a418af1ed4973db4d2b3f1f6ddc8a1528f6b740b58f14fac54e34ef0308e4a2d7c98446539914c39538f8d0ad02a6f5
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcU:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c56
MD5 SHA1 SHA512 SSDEEP

Submit Download

cHCigNA.exe

Path C:\Windows\System\cHCigNA.exe
Size 1.3MB
SHA256 f9c614f313947e4d024e921b6c1ce386d5a63f8c42f28d8183f803efae8c09c1
MD5 7eee58f52f85dbbbd92886da8f0b8197
SHA1 23e275b9211f9bd4d86fd3ad1699915d9f8d336d
SHA512 990c26f2420a24854acaef83dc2b71a7df43dab50d5e8ba60d5472bc8c8672fa18dbb84e01fa95c22a2fc7b804a9f9f2d38469844677e022466912fba1da0697
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcA:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5q
MD5 SHA1 SHA512 SSDEEP

Submit Download

dTqUGVH.exe

Path C:\Windows\System\dTqUGVH.exe
Size 1.3MB
SHA256 afd37006f74d60a38a8cbdb4d7a3b06d60909b8934d14280e2130b42be7628c8
MD5 4db8c9738d81760c645871659acc31ca
SHA1 b0f6a2e9cf2112fa7b1805b1b14c0a2c334384ec
SHA512 aa60797ed2c00f95abf7f6f735247fdc853c04c2e62e6da722c051cac5dcecd9f123db37130a0b682f5d9906cd716ff62e5f983f2a39b5b8df088e1a9bc95823
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbch:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c53
MD5 SHA1 SHA512 SSDEEP

Submit Download

dkIHqMQ.exe

Path C:\Windows\System\dkIHqMQ.exe
Size 1.3MB
SHA256 8bf79b47e8dea2141e9c98159548dcd7dfb1e589d0f67dec7ea527baf7916d61
MD5 09b398714dd02d17e12f4f2b1b705038
SHA1 dfd27a30dda107c1e39239883be69a7d23ff0dd4
SHA512 ebd0c0770717d5dd2069e4cc952e387be1c580176cf1f60f5ed5c560f3668b980c5926fab5cdafc2005ed23a01a82434ffece5832e0f4bb864962f6db69b4107
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcM:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5e
MD5 SHA1 SHA512 SSDEEP

Submit Download

eKmHEFX.exe

Path C:\Windows\System\eKmHEFX.exe
Size 1.3MB
SHA256 974533eba40c48b4ab862d3bcf4470a34200f781f68de205c34eb409f581172e
MD5 907fb217d984e9f82e7e8eafe37bb7af
SHA1 e3c8fc6d14cb23788aa69ce2ee29aa9be3ae2dd3
SHA512 fd22eaee8e59f663027feb87546b5e72d5b01746710f93411eb15f7fdaa152827a9215435c09dc55bf1a38549da075a39da5ef8d7f3073ece6c7f4f473449e12
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcg:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5y
MD5 SHA1 SHA512 SSDEEP

Submit Download

hGUHsKD.exe

Path C:\Windows\System\hGUHsKD.exe
Size 1.3MB
SHA256 c12a1c624671d6b62c46a5fbd9adc8c862a7219bf0625ea7f3ade4ff27d3d99c
MD5 b3f575a3b0c02b52cbaf2233107df4ad
SHA1 eaf4f06a80e6369317ccb5ac78afba1aaba6b7e9
SHA512 94a16d6d879c42e2bd036a8ba4f699ef7ae005985e38d3b86a44ead52519f3c5fdb8c1f8b6a2de3ca08a2086626b47d1f0df6a48ad0952e703c499a5d32296ef
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbce:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c54
MD5 SHA1 SHA512 SSDEEP

Submit Download

hyjVGeq.exe

Path C:\Windows\System\hyjVGeq.exe
Size 1.3MB
SHA256 cf7816d34091d5e9060508e636a601d6463313c9c1ac341e81ce2f9f519459be
MD5 9b5ae8b13bfe3368c67943fc9d83c518
SHA1 7b0fbe5e445a7e2b2c1615a3dfd752bf4379bfda
SHA512 6749fe71743276ee1fe7e8f9eff72f45dcb22ac1a60d5951effc0f866e4eafc96d9b5592d072bca903ef1167d3a411ffb1699c39dae702a6e35baec30de436c3
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcD:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5J
MD5 SHA1 SHA512 SSDEEP

Submit Download

iEiVDMj.exe

Path C:\Windows\System\iEiVDMj.exe
Size 1.3MB
SHA256 70e7738cc7f5d339a437838aa96c865b029c8f5c89ef11499cc7ae00bf4b2917
MD5 0e3cafebda72818690422c44027f2dd4
SHA1 ee74320b2153e176b4ef7f01f4d67e85786d9cbb
SHA512 bc03cda06d2ed4f53bbe79937b16936d763a1d4d1e4e37491b19e3acda225dbb0b24c01955690d4e860332d8468348c85209e513705a78965ea57000b0cac0c6
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcx:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5X
MD5 SHA1 SHA512 SSDEEP

Submit Download

jAkpUqz.exe

Path C:\Windows\System\jAkpUqz.exe
Size 1.3MB
SHA256 9bb1f30d890c4554ced143d89b0fef6bd95b40de8b1d0a38bf7949cf1f3af3a8
MD5 bc94c9cb81caae326faa4c471f8f7114
SHA1 81850eb59520df2ef147eb0f909a81884171eb03
SHA512 033883f5ff826073d10b5f91986bcb8bc913a183e0e4f1f77fda01d283e1ca6bbecc568653141fdb91348c3ff9db87db26d7aba35c1e85674572031d622dafd4
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcf:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5p
MD5 SHA1 SHA512 SSDEEP

Submit Download

nPkXafo.exe

Path C:\Windows\System\nPkXafo.exe
Size 1.3MB
SHA256 e67f5977ebf269a2014ff5ef3ddb17d3cc9c3010853b1ee2e91e5105f0feb0d4
MD5 11e4a03c68875d74e2816793b7a8539b
SHA1 45f7199fac189e9b85a9df4eb987c9b6aea66d16
SHA512 619f35decae6f64f74e93c3e2b981a88e23e6590c8b828a9795c78041dae2efb287deb7089fe3b80aa5309cb7d0c4d924c5f9113bb9123ec1cffd1d4b65527d7
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcx:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5T
MD5 SHA1 SHA512 SSDEEP

Submit Download

nlXcGSi.exe

Path C:\Windows\System\nlXcGSi.exe
Size 1.3MB
SHA256 dab90e9c7f124a45b7eba4d6c00c4600bfced63931f00ffb70a254f4d4e234ad
MD5 6dcb2b81cfa96dca556e1be5855dd47f
SHA1 946823e86ff86855aa9a79191ecd41d213074ac1
SHA512 b4f74ca90da5bfcf8bc12e7054cf3f24256467afb11970bdbdb455ab66be6239192f6c6eba6039a05ef7e7d1de9a69e59b7f5979eae68206c4f62d5f4ce03aa2
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbc1:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5D
MD5 SHA1 SHA512 SSDEEP

Submit Download

qKwskMk.exe

Path C:\Windows\System\qKwskMk.exe
Size 1.3MB
SHA256 74244ce9c5cf9cd2361b6fd960eae5153d6b7fed192bf75e18431006932099eb
MD5 11177b385b002e673b68fe9c25032449
SHA1 1ffacc733745461550647319dc48ed4c5a436830
SHA512 bc1d0a8f9c9570fe9e6391cd86503df1a36ee149e8c4f0fbe1e7fda234234019e909206333443d5944b3480a9b4c9230e6e2feb5078b91e2ef2e7af60e37df05
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcC:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5E
MD5 SHA1 SHA512 SSDEEP

Submit Download

qwfBjOh.exe

Path C:\Windows\System\qwfBjOh.exe
Size 1.3MB
SHA256 a10e074acb2be6a97e966cc6a3aca58a0407a2e1166cc3341fdf22374e5e5643
MD5 1a43e97b5c7072712608301b76e97179
SHA1 a89817826eebef1bb273e0b340ef97c56705d6b5
SHA512 25f518e4ee6c3bc94f1233291ccbf469b8fecc9c3383355df3810a0976340f70aadf2c0fd5267b289b93527f299211e5d402778274dfcad010ceea0abd2e9b1d
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcW:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c58
MD5 SHA1 SHA512 SSDEEP

Submit Download

tQeFVjc.exe

Path C:\Windows\System\tQeFVjc.exe
Size 1.3MB
SHA256 c8d8a51f4eb930e5765b3729b172e4e8c03bd40de41b8d32f5129ccae3aac7ab
MD5 df6f58dfe65314777e327158cbb234d3
SHA1 517feb2485e9b942f5593a0bb3940fd89be0c62f
SHA512 bab90afe4c573492e563bd791ce99e24e2f35695f0b8cad57f7623285773267cc85f7fa54c468a6a12dc7e8bd209a9afd455a73af6b1df10d0d0a95ec70b330b
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcu:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5c
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcVMqBz.exe

Path C:\Windows\System\vcVMqBz.exe
Size 1.3MB
SHA256 0908ed2dd8c4e493db7fb56fbb1fc98fdcfc827a35c57cc7ac335432f405f846
MD5 1fc223154752a1c4d2152c2c438ca8d6
SHA1 9f017c1bdc5e735e0a91e3fb1cbe21a763fc4b1b
SHA512 56804cc4cfca2ffa8db67b53b4060a5226b4e2565303d019b274bd04ce4af646e0f336cfdc655d5a5df2f6a99ebf8ed1964ee22c7ea00fc23f461ccbcc56d196
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcJ:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5b
MD5 SHA1 SHA512 SSDEEP

Submit Download

witiTtM.exe

Path C:\Windows\System\witiTtM.exe
Size 1.3MB
SHA256 166e64e0c0be88cb990751a45f8c0cb7d093c866f6b8b10c0c400486855c70d3
MD5 6f7169c17a709d561a1987a7b5cf0afc
SHA1 4b2a3e479bc79733e1045acb4268ba6a9595dfad
SHA512 fc58a9be0ddce73c28abe2bac030035f4c080b6429f5df22122e0a317bf0590451b1215b6e4392347406bad3201989842cee161ce7bb6adeddd6b68c37d361d7
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcE:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5K
MD5 SHA1 SHA512 SSDEEP

Submit Download

zJGgTYj.exe

Path C:\Windows\System\zJGgTYj.exe
Size 1.3MB
SHA256 44260140a27ffcec6740f3823631ca8c2480064a66e5474df719f10b7f3c7393
MD5 ac3cee62baeaafd18253a48784d33651
SHA1 d72f68f2e132e4770c478b8b43daba7e4fa5b55b
SHA512 e06401f2bdba44e83ea65bb126a702300b5b17e5d55d7429fe277ece65bdda6b6de7779d2e0cdb98d8c7bb48d4677ee4864556205b976bdb4cf74fefb1e64d20
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcQ:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5q
MD5 SHA1 SHA512 SSDEEP

Submit Download

zoGQbDJ.exe

Path C:\Windows\System\zoGQbDJ.exe
Size 1.3MB
SHA256 8382e4f0e1d9e573329cd767fe0c5c8e921834d8e36e8896767345e597d499cc
MD5 dd54998ffdf388c1cfeb05c4241e1d46
SHA1 0bed701d997a01ca98adb037cafd50766d1149ca
SHA512 b480dcc4af78684986857390bc57f9b6e987b63550775e8513c7b7c27084ae1b26bfb3af83fd3fa91d675cda410147b007680d38e55f3f1f97d1705798190a37
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcs:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4124-0-0x0000029565DC0000-0x0000029565DD0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads