Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\kgRNGFr.exe	N/A
N/A	N/A	C:\Windows\System\tLWKlVW.exe	N/A
N/A	N/A	C:\Windows\System\MVHnbRK.exe	N/A
N/A	N/A	C:\Windows\System\JeRWwke.exe	N/A
N/A	N/A	C:\Windows\System\DunWGVd.exe	N/A
N/A	N/A	C:\Windows\System\qejdoFC.exe	N/A
N/A	N/A	C:\Windows\System\PVrrPJh.exe	N/A
N/A	N/A	C:\Windows\System\xszfSsR.exe	N/A
N/A	N/A	C:\Windows\System\zBXZERf.exe	N/A
N/A	N/A	C:\Windows\System\VcqbdEO.exe	N/A
N/A	N/A	C:\Windows\System\cZmXroi.exe	N/A
N/A	N/A	C:\Windows\System\gZUGDSa.exe	N/A
N/A	N/A	C:\Windows\System\MIdWDGr.exe	N/A
N/A	N/A	C:\Windows\System\EEKSuxy.exe	N/A
N/A	N/A	C:\Windows\System\VkaFmBR.exe	N/A
N/A	N/A	C:\Windows\System\esNZPuY.exe	N/A
N/A	N/A	C:\Windows\System\scaHoTu.exe	N/A
N/A	N/A	C:\Windows\System\BfCxhGW.exe	N/A
N/A	N/A	C:\Windows\System\plXHVkW.exe	N/A
N/A	N/A	C:\Windows\System\InzrZHW.exe	N/A
N/A	N/A	C:\Windows\System\clbFDVd.exe	N/A
N/A	N/A	C:\Windows\System\NQJxJnh.exe	N/A
N/A	N/A	C:\Windows\System\lvyaHUG.exe	N/A
N/A	N/A	C:\Windows\System\IIDkpUW.exe	N/A
N/A	N/A	C:\Windows\System\HrlMqbK.exe	N/A
N/A	N/A	C:\Windows\System\JaayroQ.exe	N/A
N/A	N/A	C:\Windows\System\WmZxWEL.exe	N/A
N/A	N/A	C:\Windows\System\NrffVCj.exe	N/A
N/A	N/A	C:\Windows\System\AmdJtic.exe	N/A
N/A	N/A	C:\Windows\System\LiXwUsD.exe	N/A
N/A	N/A	C:\Windows\System\VAPuWyZ.exe	N/A
N/A	N/A	C:\Windows\System\uBvgyZs.exe	N/A
N/A	N/A	C:\Windows\System\NvTpLql.exe	N/A
N/A	N/A	C:\Windows\System\pWRlncC.exe	N/A
N/A	N/A	C:\Windows\System\ZhYkNrB.exe	N/A
N/A	N/A	C:\Windows\System\cZDxcjb.exe	N/A
N/A	N/A	C:\Windows\System\GDtlZAu.exe	N/A
N/A	N/A	C:\Windows\System\rGaEFAt.exe	N/A
N/A	N/A	C:\Windows\System\rrpzvFa.exe	N/A
N/A	N/A	C:\Windows\System\vvUNtFd.exe	N/A
N/A	N/A	C:\Windows\System\lgpfHbe.exe	N/A
N/A	N/A	C:\Windows\System\uEctaHD.exe	N/A
N/A	N/A	C:\Windows\System\BdzwYok.exe	N/A
N/A	N/A	C:\Windows\System\cizpMnY.exe	N/A
N/A	N/A	C:\Windows\System\WgVovyu.exe	N/A
N/A	N/A	C:\Windows\System\NjbkJbi.exe	N/A
N/A	N/A	C:\Windows\System\GSwetlD.exe	N/A
N/A	N/A	C:\Windows\System\NgXghTA.exe	N/A
N/A	N/A	C:\Windows\System\EavdmOE.exe	N/A
N/A	N/A	C:\Windows\System\eemtmHZ.exe	N/A
N/A	N/A	C:\Windows\System\eOIEopE.exe	N/A
N/A	N/A	C:\Windows\System\yCqBKjX.exe	N/A
N/A	N/A	C:\Windows\System\gyjHzsA.exe	N/A
N/A	N/A	C:\Windows\System\depowob.exe	N/A
N/A	N/A	C:\Windows\System\cdgCsVB.exe	N/A
N/A	N/A	C:\Windows\System\bRlfLFF.exe	N/A
N/A	N/A	C:\Windows\System\OEFGfpf.exe	N/A
N/A	N/A	C:\Windows\System\FOBzUPe.exe	N/A
N/A	N/A	C:\Windows\System\seuGTZH.exe	N/A
N/A	N/A	C:\Windows\System\PvjDzeY.exe	N/A
N/A	N/A	C:\Windows\System\ENUDUUU.exe	N/A
N/A	N/A	C:\Windows\System\peseZzC.exe	N/A
N/A	N/A	C:\Windows\System\hGhVQLV.exe	N/A
N/A	N/A	C:\Windows\System\HnPMzlh.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\KkxMhNf.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fexIlBh.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bXmkHRQ.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zXVImUm.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kzhCxuc.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mKZbtMi.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LGAAqVn.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZRULJku.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LzEukYD.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dDxFyiA.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YkRObWE.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bOPgzsn.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JWhZFGC.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\liQGtza.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lXbghuX.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vBiCeYj.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BqFnyOi.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ViUoMch.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pbVWqbL.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JhTbRfF.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mQkNRlU.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CSZhWMt.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pAdTFTY.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\saflEWJ.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZVAnIkk.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JaayroQ.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GhqDpIF.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jnLnUCn.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CXfWekN.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SGKlLnt.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tUFlvyq.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xGRIMyS.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DnqedUo.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vzoXENC.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tsxbYJs.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ArRIlhN.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nKsCPIk.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WEUrEFq.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nlcLdfC.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CYTjVZi.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\emDWguG.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZpjOWIH.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZaRuLwI.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yNudbve.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WdAhEUB.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iXfSDfC.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vumArab.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JdZPraa.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AtgSmmP.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AOLWvak.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lwqZcBs.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eygfgOY.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dSXjKer.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fzMuHaD.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SfrbTZy.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IPvBPiE.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eFDYcLJ.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PafvhdR.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WnzlYGL.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LuLioML.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yGEqBQy.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GROfTAP.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FABEhLP.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sdeJgCX.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2264 wrote to memory of 3004	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\kgRNGFr.exe
PID 2264 wrote to memory of 3004	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\kgRNGFr.exe
PID 2264 wrote to memory of 3004	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\kgRNGFr.exe
PID 2264 wrote to memory of 1168	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\tLWKlVW.exe
PID 2264 wrote to memory of 1168	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\tLWKlVW.exe
PID 2264 wrote to memory of 1168	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\tLWKlVW.exe
PID 2264 wrote to memory of 2308	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\MVHnbRK.exe
PID 2264 wrote to memory of 2308	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\MVHnbRK.exe
PID 2264 wrote to memory of 2308	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\MVHnbRK.exe
PID 2264 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\VcqbdEO.exe
PID 2264 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\VcqbdEO.exe
PID 2264 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\VcqbdEO.exe
PID 2264 wrote to memory of 2668	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\JeRWwke.exe
PID 2264 wrote to memory of 2668	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\JeRWwke.exe
PID 2264 wrote to memory of 2668	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\JeRWwke.exe
PID 2264 wrote to memory of 2648	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\cZmXroi.exe
PID 2264 wrote to memory of 2648	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\cZmXroi.exe
PID 2264 wrote to memory of 2648	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\cZmXroi.exe
PID 2264 wrote to memory of 2812	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\DunWGVd.exe
PID 2264 wrote to memory of 2812	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\DunWGVd.exe
PID 2264 wrote to memory of 2812	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\DunWGVd.exe
PID 2264 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\gZUGDSa.exe
PID 2264 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\gZUGDSa.exe
PID 2264 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\gZUGDSa.exe
PID 2264 wrote to memory of 2608	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\qejdoFC.exe
PID 2264 wrote to memory of 2608	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\qejdoFC.exe
PID 2264 wrote to memory of 2608	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\qejdoFC.exe
PID 2264 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\EEKSuxy.exe
PID 2264 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\EEKSuxy.exe
PID 2264 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\EEKSuxy.exe
PID 2264 wrote to memory of 2404	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\PVrrPJh.exe
PID 2264 wrote to memory of 2404	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\PVrrPJh.exe
PID 2264 wrote to memory of 2404	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\PVrrPJh.exe
PID 2264 wrote to memory of 2448	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\VkaFmBR.exe
PID 2264 wrote to memory of 2448	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\VkaFmBR.exe
PID 2264 wrote to memory of 2448	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\VkaFmBR.exe
PID 2264 wrote to memory of 2480	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\xszfSsR.exe
PID 2264 wrote to memory of 2480	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\xszfSsR.exe
PID 2264 wrote to memory of 2480	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\xszfSsR.exe
PID 2264 wrote to memory of 1716	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\esNZPuY.exe
PID 2264 wrote to memory of 1716	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\esNZPuY.exe
PID 2264 wrote to memory of 1716	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\esNZPuY.exe
PID 2264 wrote to memory of 684	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\zBXZERf.exe
PID 2264 wrote to memory of 684	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\zBXZERf.exe
PID 2264 wrote to memory of 684	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\zBXZERf.exe
PID 2264 wrote to memory of 1848	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\scaHoTu.exe
PID 2264 wrote to memory of 1848	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\scaHoTu.exe
PID 2264 wrote to memory of 1848	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\scaHoTu.exe
PID 2264 wrote to memory of 300	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\MIdWDGr.exe
PID 2264 wrote to memory of 300	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\MIdWDGr.exe
PID 2264 wrote to memory of 300	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\MIdWDGr.exe
PID 2264 wrote to memory of 1960	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\BfCxhGW.exe
PID 2264 wrote to memory of 1960	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\BfCxhGW.exe
PID 2264 wrote to memory of 1960	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\BfCxhGW.exe
PID 2264 wrote to memory of 836	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\plXHVkW.exe
PID 2264 wrote to memory of 836	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\plXHVkW.exe
PID 2264 wrote to memory of 836	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\plXHVkW.exe
PID 2264 wrote to memory of 1876	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\InzrZHW.exe
PID 2264 wrote to memory of 1876	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\InzrZHW.exe
PID 2264 wrote to memory of 1876	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\InzrZHW.exe
PID 2264 wrote to memory of 1852	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\clbFDVd.exe
PID 2264 wrote to memory of 1852	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\clbFDVd.exe
PID 2264 wrote to memory of 1852	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\clbFDVd.exe
PID 2264 wrote to memory of 1220	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\NQJxJnh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe"

C:\Windows\System\kgRNGFr.exe

C:\Windows\System\kgRNGFr.exe

C:\Windows\System\tLWKlVW.exe

C:\Windows\System\tLWKlVW.exe

C:\Windows\System\MVHnbRK.exe

C:\Windows\System\MVHnbRK.exe

C:\Windows\System\VcqbdEO.exe

C:\Windows\System\VcqbdEO.exe

C:\Windows\System\JeRWwke.exe

C:\Windows\System\JeRWwke.exe

C:\Windows\System\cZmXroi.exe

C:\Windows\System\cZmXroi.exe

C:\Windows\System\DunWGVd.exe

C:\Windows\System\DunWGVd.exe

C:\Windows\System\gZUGDSa.exe

C:\Windows\System\gZUGDSa.exe

C:\Windows\System\qejdoFC.exe

C:\Windows\System\qejdoFC.exe

C:\Windows\System\EEKSuxy.exe

C:\Windows\System\EEKSuxy.exe

C:\Windows\System\PVrrPJh.exe

C:\Windows\System\PVrrPJh.exe

C:\Windows\System\VkaFmBR.exe

C:\Windows\System\VkaFmBR.exe

C:\Windows\System\xszfSsR.exe

C:\Windows\System\xszfSsR.exe

C:\Windows\System\esNZPuY.exe

C:\Windows\System\esNZPuY.exe

C:\Windows\System\zBXZERf.exe

C:\Windows\System\zBXZERf.exe

C:\Windows\System\scaHoTu.exe

C:\Windows\System\scaHoTu.exe

C:\Windows\System\MIdWDGr.exe

C:\Windows\System\MIdWDGr.exe

C:\Windows\System\BfCxhGW.exe

C:\Windows\System\BfCxhGW.exe

C:\Windows\System\plXHVkW.exe

C:\Windows\System\plXHVkW.exe

C:\Windows\System\InzrZHW.exe

C:\Windows\System\InzrZHW.exe

C:\Windows\System\clbFDVd.exe

C:\Windows\System\clbFDVd.exe

C:\Windows\System\NQJxJnh.exe

C:\Windows\System\NQJxJnh.exe

C:\Windows\System\lvyaHUG.exe

C:\Windows\System\lvyaHUG.exe

C:\Windows\System\IIDkpUW.exe

C:\Windows\System\IIDkpUW.exe

C:\Windows\System\HrlMqbK.exe

C:\Windows\System\HrlMqbK.exe

C:\Windows\System\JaayroQ.exe

C:\Windows\System\JaayroQ.exe

C:\Windows\System\WmZxWEL.exe

C:\Windows\System\WmZxWEL.exe

C:\Windows\System\NrffVCj.exe

C:\Windows\System\NrffVCj.exe

C:\Windows\System\AmdJtic.exe

C:\Windows\System\AmdJtic.exe

C:\Windows\System\LiXwUsD.exe

C:\Windows\System\LiXwUsD.exe

C:\Windows\System\VAPuWyZ.exe

C:\Windows\System\VAPuWyZ.exe

C:\Windows\System\uBvgyZs.exe

C:\Windows\System\uBvgyZs.exe

C:\Windows\System\NvTpLql.exe

C:\Windows\System\NvTpLql.exe

C:\Windows\System\pWRlncC.exe

C:\Windows\System\pWRlncC.exe

C:\Windows\System\ZhYkNrB.exe

C:\Windows\System\ZhYkNrB.exe

C:\Windows\System\cZDxcjb.exe

C:\Windows\System\cZDxcjb.exe

C:\Windows\System\GDtlZAu.exe

C:\Windows\System\GDtlZAu.exe

C:\Windows\System\rGaEFAt.exe

C:\Windows\System\rGaEFAt.exe

C:\Windows\System\rrpzvFa.exe

C:\Windows\System\rrpzvFa.exe

C:\Windows\System\vvUNtFd.exe

C:\Windows\System\vvUNtFd.exe

C:\Windows\System\lgpfHbe.exe

C:\Windows\System\lgpfHbe.exe

C:\Windows\System\BdzwYok.exe

C:\Windows\System\BdzwYok.exe

C:\Windows\System\uEctaHD.exe

C:\Windows\System\uEctaHD.exe

C:\Windows\System\WgVovyu.exe

C:\Windows\System\WgVovyu.exe

C:\Windows\System\cizpMnY.exe

C:\Windows\System\cizpMnY.exe

C:\Windows\System\NjbkJbi.exe

C:\Windows\System\NjbkJbi.exe

C:\Windows\System\GSwetlD.exe

C:\Windows\System\GSwetlD.exe

C:\Windows\System\eemtmHZ.exe

C:\Windows\System\eemtmHZ.exe

C:\Windows\System\NgXghTA.exe

C:\Windows\System\NgXghTA.exe

C:\Windows\System\eOIEopE.exe

C:\Windows\System\eOIEopE.exe

C:\Windows\System\EavdmOE.exe

C:\Windows\System\EavdmOE.exe

C:\Windows\System\yCqBKjX.exe

C:\Windows\System\yCqBKjX.exe

C:\Windows\System\gyjHzsA.exe

C:\Windows\System\gyjHzsA.exe

C:\Windows\System\depowob.exe

C:\Windows\System\depowob.exe

C:\Windows\System\cdgCsVB.exe

C:\Windows\System\cdgCsVB.exe

C:\Windows\System\FOBzUPe.exe

C:\Windows\System\FOBzUPe.exe

C:\Windows\System\bRlfLFF.exe

C:\Windows\System\bRlfLFF.exe

C:\Windows\System\seuGTZH.exe

C:\Windows\System\seuGTZH.exe

C:\Windows\System\OEFGfpf.exe

C:\Windows\System\OEFGfpf.exe

C:\Windows\System\PvjDzeY.exe

C:\Windows\System\PvjDzeY.exe

C:\Windows\System\ENUDUUU.exe

C:\Windows\System\ENUDUUU.exe

C:\Windows\System\peseZzC.exe

C:\Windows\System\peseZzC.exe

C:\Windows\System\hGhVQLV.exe

C:\Windows\System\hGhVQLV.exe

C:\Windows\System\HnPMzlh.exe

C:\Windows\System\HnPMzlh.exe

C:\Windows\System\cmnrUIy.exe

C:\Windows\System\cmnrUIy.exe

C:\Windows\System\cKupdwW.exe

C:\Windows\System\cKupdwW.exe

C:\Windows\System\JnrqkFY.exe

C:\Windows\System\JnrqkFY.exe

C:\Windows\System\eyGGebc.exe

C:\Windows\System\eyGGebc.exe

C:\Windows\System\ZtHmWbk.exe

C:\Windows\System\ZtHmWbk.exe

C:\Windows\System\ducefOC.exe

C:\Windows\System\ducefOC.exe

C:\Windows\System\cKRAGaN.exe

C:\Windows\System\cKRAGaN.exe

C:\Windows\System\gAYqQfp.exe

C:\Windows\System\gAYqQfp.exe

C:\Windows\System\zOfczAm.exe

C:\Windows\System\zOfczAm.exe

C:\Windows\System\DMjrvsF.exe

C:\Windows\System\DMjrvsF.exe

C:\Windows\System\SHSbHVc.exe

C:\Windows\System\SHSbHVc.exe

C:\Windows\System\hLWkygF.exe

C:\Windows\System\hLWkygF.exe

C:\Windows\System\qfJMyWm.exe

C:\Windows\System\qfJMyWm.exe

C:\Windows\System\baURKEY.exe

C:\Windows\System\baURKEY.exe

C:\Windows\System\OdpGnRh.exe

C:\Windows\System\OdpGnRh.exe

C:\Windows\System\NCCfBFM.exe

C:\Windows\System\NCCfBFM.exe

C:\Windows\System\UpqOlUK.exe

C:\Windows\System\UpqOlUK.exe

C:\Windows\System\kFexmir.exe

C:\Windows\System\kFexmir.exe

C:\Windows\System\MIRhpzW.exe

C:\Windows\System\MIRhpzW.exe

C:\Windows\System\kHpeZLJ.exe

C:\Windows\System\kHpeZLJ.exe

C:\Windows\System\sKbiNwX.exe

C:\Windows\System\sKbiNwX.exe

C:\Windows\System\GhqDpIF.exe

C:\Windows\System\GhqDpIF.exe

C:\Windows\System\WYgUIZf.exe

C:\Windows\System\WYgUIZf.exe

C:\Windows\System\hmWJqex.exe

C:\Windows\System\hmWJqex.exe

C:\Windows\System\QYCuuXq.exe

C:\Windows\System\QYCuuXq.exe

C:\Windows\System\yGrVWhd.exe

C:\Windows\System\yGrVWhd.exe

C:\Windows\System\bxkAwTj.exe

C:\Windows\System\bxkAwTj.exe

C:\Windows\System\GDviudI.exe

C:\Windows\System\GDviudI.exe

C:\Windows\System\azvbRNu.exe

C:\Windows\System\azvbRNu.exe

C:\Windows\System\gJGPlSH.exe

C:\Windows\System\gJGPlSH.exe

C:\Windows\System\oIkipBD.exe

C:\Windows\System\oIkipBD.exe

C:\Windows\System\SZNAIUQ.exe

C:\Windows\System\SZNAIUQ.exe

C:\Windows\System\aPyGUAy.exe

C:\Windows\System\aPyGUAy.exe

C:\Windows\System\ecukfcB.exe

C:\Windows\System\ecukfcB.exe

C:\Windows\System\obKvbMt.exe

C:\Windows\System\obKvbMt.exe

C:\Windows\System\QmojEpa.exe

C:\Windows\System\QmojEpa.exe

C:\Windows\System\rXCvlCU.exe

C:\Windows\System\rXCvlCU.exe

C:\Windows\System\qagivJW.exe

C:\Windows\System\qagivJW.exe

C:\Windows\System\qEWqjcF.exe

C:\Windows\System\qEWqjcF.exe

C:\Windows\System\SSBNqmn.exe

C:\Windows\System\SSBNqmn.exe

C:\Windows\System\xYELDwB.exe

C:\Windows\System\xYELDwB.exe

C:\Windows\System\abHkXhP.exe

C:\Windows\System\abHkXhP.exe

C:\Windows\System\SUakMqi.exe

C:\Windows\System\SUakMqi.exe

C:\Windows\System\qQgJUHp.exe

C:\Windows\System\qQgJUHp.exe

C:\Windows\System\RZXKvhA.exe

C:\Windows\System\RZXKvhA.exe

C:\Windows\System\taIMdLN.exe

C:\Windows\System\taIMdLN.exe

C:\Windows\System\vBiCeYj.exe

C:\Windows\System\vBiCeYj.exe

C:\Windows\System\jlNbCgj.exe

C:\Windows\System\jlNbCgj.exe

C:\Windows\System\vgJHmkQ.exe

C:\Windows\System\vgJHmkQ.exe

C:\Windows\System\gExAlOj.exe

C:\Windows\System\gExAlOj.exe

C:\Windows\System\axjHSeu.exe

C:\Windows\System\axjHSeu.exe

C:\Windows\System\HtULRuE.exe

C:\Windows\System\HtULRuE.exe

C:\Windows\System\QALVvKG.exe

C:\Windows\System\QALVvKG.exe

C:\Windows\System\wSCJTIc.exe

C:\Windows\System\wSCJTIc.exe

C:\Windows\System\MLklSzs.exe

C:\Windows\System\MLklSzs.exe

C:\Windows\System\YcGARts.exe

C:\Windows\System\YcGARts.exe

C:\Windows\System\MmoyMGV.exe

C:\Windows\System\MmoyMGV.exe

C:\Windows\System\inDvYVM.exe

C:\Windows\System\inDvYVM.exe

C:\Windows\System\kUXffen.exe

C:\Windows\System\kUXffen.exe

C:\Windows\System\EgePVLb.exe

C:\Windows\System\EgePVLb.exe

C:\Windows\System\GabJQEM.exe

C:\Windows\System\GabJQEM.exe

C:\Windows\System\KqFunay.exe

C:\Windows\System\KqFunay.exe

C:\Windows\System\WRygahk.exe

C:\Windows\System\WRygahk.exe

C:\Windows\System\cUZizPq.exe

C:\Windows\System\cUZizPq.exe

C:\Windows\System\jAiabxo.exe

C:\Windows\System\jAiabxo.exe

C:\Windows\System\AEpgFEU.exe

C:\Windows\System\AEpgFEU.exe

C:\Windows\System\bYGRBfW.exe

C:\Windows\System\bYGRBfW.exe

C:\Windows\System\oFfOqRU.exe

C:\Windows\System\oFfOqRU.exe

C:\Windows\System\svPvTjf.exe

C:\Windows\System\svPvTjf.exe

C:\Windows\System\RtKAfTN.exe

C:\Windows\System\RtKAfTN.exe

C:\Windows\System\DgURDef.exe

C:\Windows\System\DgURDef.exe

C:\Windows\System\KLeGJUV.exe

C:\Windows\System\KLeGJUV.exe

C:\Windows\System\bOVdbjA.exe

C:\Windows\System\bOVdbjA.exe

C:\Windows\System\BUCFswe.exe

C:\Windows\System\BUCFswe.exe

C:\Windows\System\bdfUfuq.exe

C:\Windows\System\bdfUfuq.exe

C:\Windows\System\xTLhwnH.exe

C:\Windows\System\xTLhwnH.exe

C:\Windows\System\CsflZBY.exe

C:\Windows\System\CsflZBY.exe

C:\Windows\System\zerSzJO.exe

C:\Windows\System\zerSzJO.exe

C:\Windows\System\ACklbIu.exe

C:\Windows\System\ACklbIu.exe

C:\Windows\System\rHkDPRu.exe

C:\Windows\System\rHkDPRu.exe

C:\Windows\System\nQgItIT.exe

C:\Windows\System\nQgItIT.exe

C:\Windows\System\RSkVCDB.exe

C:\Windows\System\RSkVCDB.exe

C:\Windows\System\VCKTZsj.exe

C:\Windows\System\VCKTZsj.exe

C:\Windows\System\PcHMnBX.exe

C:\Windows\System\PcHMnBX.exe

C:\Windows\System\hummCAp.exe

C:\Windows\System\hummCAp.exe

C:\Windows\System\OgnvKgz.exe

C:\Windows\System\OgnvKgz.exe

C:\Windows\System\LnXcPdK.exe

C:\Windows\System\LnXcPdK.exe

C:\Windows\System\vzoXENC.exe

C:\Windows\System\vzoXENC.exe

C:\Windows\System\NaULIBx.exe

C:\Windows\System\NaULIBx.exe

C:\Windows\System\NNbRFge.exe

C:\Windows\System\NNbRFge.exe

C:\Windows\System\leuDWSn.exe

C:\Windows\System\leuDWSn.exe

C:\Windows\System\jJMPBHj.exe

C:\Windows\System\jJMPBHj.exe

C:\Windows\System\mQkNRlU.exe

C:\Windows\System\mQkNRlU.exe

C:\Windows\System\BOyMnXy.exe

C:\Windows\System\BOyMnXy.exe

C:\Windows\System\OxzMSjk.exe

C:\Windows\System\OxzMSjk.exe

C:\Windows\System\EYOcRge.exe

C:\Windows\System\EYOcRge.exe

C:\Windows\System\DUxMShM.exe

C:\Windows\System\DUxMShM.exe

C:\Windows\System\pGSMzUB.exe

C:\Windows\System\pGSMzUB.exe

C:\Windows\System\mYqKHuK.exe

C:\Windows\System\mYqKHuK.exe

C:\Windows\System\nLFjqug.exe

C:\Windows\System\nLFjqug.exe

C:\Windows\System\KbVlMAz.exe

C:\Windows\System\KbVlMAz.exe

C:\Windows\System\gLmzfiu.exe

C:\Windows\System\gLmzfiu.exe

C:\Windows\System\uyHUNZr.exe

C:\Windows\System\uyHUNZr.exe

C:\Windows\System\zPUiuVt.exe

C:\Windows\System\zPUiuVt.exe

C:\Windows\System\plkZwpK.exe

C:\Windows\System\plkZwpK.exe

C:\Windows\System\YQdHqMc.exe

C:\Windows\System\YQdHqMc.exe

C:\Windows\System\bHinBKJ.exe

C:\Windows\System\bHinBKJ.exe

C:\Windows\System\WtbfuXj.exe

C:\Windows\System\WtbfuXj.exe

C:\Windows\System\LKpPWkc.exe

C:\Windows\System\LKpPWkc.exe

C:\Windows\System\BqFnyOi.exe

C:\Windows\System\BqFnyOi.exe

C:\Windows\System\ngaMCbl.exe

C:\Windows\System\ngaMCbl.exe

C:\Windows\System\KQvdFnx.exe

C:\Windows\System\KQvdFnx.exe

C:\Windows\System\cycgBUz.exe

C:\Windows\System\cycgBUz.exe

C:\Windows\System\gUwYuwL.exe

C:\Windows\System\gUwYuwL.exe

C:\Windows\System\CSZhWMt.exe

C:\Windows\System\CSZhWMt.exe

C:\Windows\System\tBiYukP.exe

C:\Windows\System\tBiYukP.exe

C:\Windows\System\HyFkqMc.exe

C:\Windows\System\HyFkqMc.exe

C:\Windows\System\KPYkrXL.exe

C:\Windows\System\KPYkrXL.exe

C:\Windows\System\teNylZD.exe

C:\Windows\System\teNylZD.exe

C:\Windows\System\RlddHli.exe

C:\Windows\System\RlddHli.exe

C:\Windows\System\kQgnKGL.exe

C:\Windows\System\kQgnKGL.exe

C:\Windows\System\iouplGG.exe

C:\Windows\System\iouplGG.exe

C:\Windows\System\jjYsScv.exe

C:\Windows\System\jjYsScv.exe

C:\Windows\System\JWhZFGC.exe

C:\Windows\System\JWhZFGC.exe

C:\Windows\System\IOqzwxp.exe

C:\Windows\System\IOqzwxp.exe

C:\Windows\System\mkjkagU.exe

C:\Windows\System\mkjkagU.exe

C:\Windows\System\ipNZODe.exe

C:\Windows\System\ipNZODe.exe

C:\Windows\System\OsRQOdc.exe

C:\Windows\System\OsRQOdc.exe

C:\Windows\System\SEKkJGk.exe

C:\Windows\System\SEKkJGk.exe

C:\Windows\System\KCGzVxS.exe

C:\Windows\System\KCGzVxS.exe

C:\Windows\System\HlsEKBV.exe

C:\Windows\System\HlsEKBV.exe

C:\Windows\System\ltRpHOX.exe

C:\Windows\System\ltRpHOX.exe

C:\Windows\System\jQhLUAO.exe

C:\Windows\System\jQhLUAO.exe

C:\Windows\System\VMIEabi.exe

C:\Windows\System\VMIEabi.exe

C:\Windows\System\veDTmhY.exe

C:\Windows\System\veDTmhY.exe

C:\Windows\System\xIPLhne.exe

C:\Windows\System\xIPLhne.exe

C:\Windows\System\rkiLFVM.exe

C:\Windows\System\rkiLFVM.exe

C:\Windows\System\QeEqZCy.exe

C:\Windows\System\QeEqZCy.exe

C:\Windows\System\WaXhudK.exe

C:\Windows\System\WaXhudK.exe

C:\Windows\System\ZokRHYI.exe

C:\Windows\System\ZokRHYI.exe

C:\Windows\System\XNyuwwj.exe

C:\Windows\System\XNyuwwj.exe

C:\Windows\System\PqniyFD.exe

C:\Windows\System\PqniyFD.exe

C:\Windows\System\ucsbVip.exe

C:\Windows\System\ucsbVip.exe

C:\Windows\System\DvFkgOt.exe

C:\Windows\System\DvFkgOt.exe

C:\Windows\System\ukLcnoD.exe

C:\Windows\System\ukLcnoD.exe

C:\Windows\System\bmFxTSP.exe

C:\Windows\System\bmFxTSP.exe

C:\Windows\System\kzhCxuc.exe

C:\Windows\System\kzhCxuc.exe

C:\Windows\System\Damzevs.exe

C:\Windows\System\Damzevs.exe

C:\Windows\System\ttTivSD.exe

C:\Windows\System\ttTivSD.exe

C:\Windows\System\mcRVRXM.exe

C:\Windows\System\mcRVRXM.exe

C:\Windows\System\LuLioML.exe

C:\Windows\System\LuLioML.exe

C:\Windows\System\HkNAxxm.exe

C:\Windows\System\HkNAxxm.exe

C:\Windows\System\yNudbve.exe

C:\Windows\System\yNudbve.exe

C:\Windows\System\pzqIoEA.exe

C:\Windows\System\pzqIoEA.exe

C:\Windows\System\FjGiXDX.exe

C:\Windows\System\FjGiXDX.exe

C:\Windows\System\DrFSiAw.exe

C:\Windows\System\DrFSiAw.exe

C:\Windows\System\crgvNmj.exe

C:\Windows\System\crgvNmj.exe

C:\Windows\System\yQKUXTs.exe

C:\Windows\System\yQKUXTs.exe

C:\Windows\System\UgpMNMT.exe

C:\Windows\System\UgpMNMT.exe

C:\Windows\System\Paicuek.exe

C:\Windows\System\Paicuek.exe

C:\Windows\System\gjhNmde.exe

C:\Windows\System\gjhNmde.exe

C:\Windows\System\WrJrWGp.exe

C:\Windows\System\WrJrWGp.exe

C:\Windows\System\lHxWAhY.exe

C:\Windows\System\lHxWAhY.exe

C:\Windows\System\WuXxiTc.exe

C:\Windows\System\WuXxiTc.exe

C:\Windows\System\zOrsDcH.exe

C:\Windows\System\zOrsDcH.exe

C:\Windows\System\JVticZF.exe

C:\Windows\System\JVticZF.exe

C:\Windows\System\BJMHNyD.exe

C:\Windows\System\BJMHNyD.exe

C:\Windows\System\RZTOGwA.exe

C:\Windows\System\RZTOGwA.exe

C:\Windows\System\YvwwnEa.exe

C:\Windows\System\YvwwnEa.exe

C:\Windows\System\EoCzkpN.exe

C:\Windows\System\EoCzkpN.exe

C:\Windows\System\rqJGCnl.exe

C:\Windows\System\rqJGCnl.exe

C:\Windows\System\paKvnaT.exe

C:\Windows\System\paKvnaT.exe

C:\Windows\System\zWWUxNF.exe

C:\Windows\System\zWWUxNF.exe

C:\Windows\System\EfAMtXX.exe

C:\Windows\System\EfAMtXX.exe

C:\Windows\System\DFKNXNS.exe

C:\Windows\System\DFKNXNS.exe

C:\Windows\System\XhjLjuU.exe

C:\Windows\System\XhjLjuU.exe

C:\Windows\System\RoTMWbE.exe

C:\Windows\System\RoTMWbE.exe

C:\Windows\System\tIvtqLA.exe

C:\Windows\System\tIvtqLA.exe

C:\Windows\System\PfCAlep.exe

C:\Windows\System\PfCAlep.exe

C:\Windows\System\ZuhaIhx.exe

C:\Windows\System\ZuhaIhx.exe

C:\Windows\System\ryVKlIH.exe

C:\Windows\System\ryVKlIH.exe

C:\Windows\System\DKuhsSO.exe

C:\Windows\System\DKuhsSO.exe

C:\Windows\System\JHbFnFP.exe

C:\Windows\System\JHbFnFP.exe

C:\Windows\System\cAHDPKV.exe

C:\Windows\System\cAHDPKV.exe

C:\Windows\System\hHYjzdj.exe

C:\Windows\System\hHYjzdj.exe

C:\Windows\System\fYQTVdQ.exe

C:\Windows\System\fYQTVdQ.exe

C:\Windows\System\wFolhbA.exe

C:\Windows\System\wFolhbA.exe

C:\Windows\System\VhBFbdr.exe

C:\Windows\System\VhBFbdr.exe

C:\Windows\System\JBSBwSK.exe

C:\Windows\System\JBSBwSK.exe

C:\Windows\System\fqxAyuJ.exe

C:\Windows\System\fqxAyuJ.exe

C:\Windows\System\SucQbbC.exe

C:\Windows\System\SucQbbC.exe

C:\Windows\System\WEUrEFq.exe

C:\Windows\System\WEUrEFq.exe

C:\Windows\System\tliAwCH.exe

C:\Windows\System\tliAwCH.exe

C:\Windows\System\SOWjQsE.exe

C:\Windows\System\SOWjQsE.exe

C:\Windows\System\xIlHSBJ.exe

C:\Windows\System\xIlHSBJ.exe

C:\Windows\System\uSraRaQ.exe

C:\Windows\System\uSraRaQ.exe

C:\Windows\System\xgXANWi.exe

C:\Windows\System\xgXANWi.exe

C:\Windows\System\JJUGmKW.exe

C:\Windows\System\JJUGmKW.exe

C:\Windows\System\yKPUfIY.exe

C:\Windows\System\yKPUfIY.exe

C:\Windows\System\ilDvJwn.exe

C:\Windows\System\ilDvJwn.exe

C:\Windows\System\yeNktKA.exe

C:\Windows\System\yeNktKA.exe

C:\Windows\System\cYNIRNg.exe

C:\Windows\System\cYNIRNg.exe

C:\Windows\System\mKZbtMi.exe

C:\Windows\System\mKZbtMi.exe

C:\Windows\System\IvquIdk.exe

C:\Windows\System\IvquIdk.exe

C:\Windows\System\KBJvOuK.exe

C:\Windows\System\KBJvOuK.exe

C:\Windows\System\CIMsWgW.exe

C:\Windows\System\CIMsWgW.exe

C:\Windows\System\wIUWNIz.exe

C:\Windows\System\wIUWNIz.exe

C:\Windows\System\UaFoQMA.exe

C:\Windows\System\UaFoQMA.exe

C:\Windows\System\QFuXGud.exe

C:\Windows\System\QFuXGud.exe

C:\Windows\System\IuZKDey.exe

C:\Windows\System\IuZKDey.exe

C:\Windows\System\EjXEMcy.exe

C:\Windows\System\EjXEMcy.exe

C:\Windows\System\NOdtrXP.exe

C:\Windows\System\NOdtrXP.exe

C:\Windows\System\ljDDwce.exe

C:\Windows\System\ljDDwce.exe

C:\Windows\System\CRDFZVs.exe

C:\Windows\System\CRDFZVs.exe

C:\Windows\System\HnnqaWX.exe

C:\Windows\System\HnnqaWX.exe

C:\Windows\System\UDUGOHQ.exe

C:\Windows\System\UDUGOHQ.exe

C:\Windows\System\iEslhcK.exe

C:\Windows\System\iEslhcK.exe

C:\Windows\System\jhDcGJH.exe

C:\Windows\System\jhDcGJH.exe

C:\Windows\System\HHupstp.exe

C:\Windows\System\HHupstp.exe

C:\Windows\System\jfDLcVN.exe

C:\Windows\System\jfDLcVN.exe

C:\Windows\System\LiWtFpv.exe

C:\Windows\System\LiWtFpv.exe

C:\Windows\System\iXqJcik.exe

C:\Windows\System\iXqJcik.exe

C:\Windows\System\yApiRsk.exe

C:\Windows\System\yApiRsk.exe

C:\Windows\System\EfosOoy.exe

C:\Windows\System\EfosOoy.exe

C:\Windows\System\NWqYcxG.exe

C:\Windows\System\NWqYcxG.exe

C:\Windows\System\dDGbNZO.exe

C:\Windows\System\dDGbNZO.exe

C:\Windows\System\lGDBIdy.exe

C:\Windows\System\lGDBIdy.exe

C:\Windows\System\lZJBnmH.exe

C:\Windows\System\lZJBnmH.exe

C:\Windows\System\FEwLSIk.exe

C:\Windows\System\FEwLSIk.exe

C:\Windows\System\vcgrXca.exe

C:\Windows\System\vcgrXca.exe

C:\Windows\System\EtHhPmG.exe

C:\Windows\System\EtHhPmG.exe

C:\Windows\System\VtQrGFz.exe

C:\Windows\System\VtQrGFz.exe

C:\Windows\System\vKVmwHF.exe

C:\Windows\System\vKVmwHF.exe

C:\Windows\System\FHujKar.exe

C:\Windows\System\FHujKar.exe

C:\Windows\System\wTbirJt.exe

C:\Windows\System\wTbirJt.exe

C:\Windows\System\sqbegUW.exe

C:\Windows\System\sqbegUW.exe

C:\Windows\System\JCyKnuL.exe

C:\Windows\System\JCyKnuL.exe

C:\Windows\System\HlbuOAC.exe

C:\Windows\System\HlbuOAC.exe

C:\Windows\System\iruLdCV.exe

C:\Windows\System\iruLdCV.exe

C:\Windows\System\ZOeWuHI.exe

C:\Windows\System\ZOeWuHI.exe

C:\Windows\System\lwqZcBs.exe

C:\Windows\System\lwqZcBs.exe

C:\Windows\System\QzgZSPZ.exe

C:\Windows\System\QzgZSPZ.exe

C:\Windows\System\qTtewtl.exe

C:\Windows\System\qTtewtl.exe

C:\Windows\System\GkZnkxm.exe

C:\Windows\System\GkZnkxm.exe

C:\Windows\System\MWRZoJK.exe

C:\Windows\System\MWRZoJK.exe

C:\Windows\System\FxElsbq.exe

C:\Windows\System\FxElsbq.exe

C:\Windows\System\Vciaixn.exe

C:\Windows\System\Vciaixn.exe

C:\Windows\System\ozIsIkV.exe

C:\Windows\System\ozIsIkV.exe

C:\Windows\System\FABEhLP.exe

C:\Windows\System\FABEhLP.exe

C:\Windows\System\anccxkT.exe

C:\Windows\System\anccxkT.exe

C:\Windows\System\SbzDQfi.exe

C:\Windows\System\SbzDQfi.exe

C:\Windows\System\BlprKfi.exe

C:\Windows\System\BlprKfi.exe

C:\Windows\System\bXmkHRQ.exe

C:\Windows\System\bXmkHRQ.exe

C:\Windows\System\LOEmoyY.exe

C:\Windows\System\LOEmoyY.exe

C:\Windows\System\ZoApCnR.exe

C:\Windows\System\ZoApCnR.exe

C:\Windows\System\UmmVLSV.exe

C:\Windows\System\UmmVLSV.exe

C:\Windows\System\LLrqYRY.exe

C:\Windows\System\LLrqYRY.exe

C:\Windows\System\DedemfL.exe

C:\Windows\System\DedemfL.exe

C:\Windows\System\oPMLCNC.exe

C:\Windows\System\oPMLCNC.exe

C:\Windows\System\yAiRxZV.exe

C:\Windows\System\yAiRxZV.exe

C:\Windows\System\cYPciqb.exe

C:\Windows\System\cYPciqb.exe

C:\Windows\System\UPHxggh.exe

C:\Windows\System\UPHxggh.exe

C:\Windows\System\QynjxlO.exe

C:\Windows\System\QynjxlO.exe

C:\Windows\System\NQBEEBp.exe

C:\Windows\System\NQBEEBp.exe

C:\Windows\System\VWkPPue.exe

C:\Windows\System\VWkPPue.exe

C:\Windows\System\PlImlIG.exe

C:\Windows\System\PlImlIG.exe

C:\Windows\System\oNmkQRD.exe

C:\Windows\System\oNmkQRD.exe

C:\Windows\System\mCJuzZm.exe

C:\Windows\System\mCJuzZm.exe

C:\Windows\System\DZmZQAO.exe

C:\Windows\System\DZmZQAO.exe

C:\Windows\System\FzdwjXM.exe

C:\Windows\System\FzdwjXM.exe

C:\Windows\System\JUBQucg.exe

C:\Windows\System\JUBQucg.exe

C:\Windows\System\DdLskHw.exe

C:\Windows\System\DdLskHw.exe

C:\Windows\System\iLGfHcK.exe

C:\Windows\System\iLGfHcK.exe

C:\Windows\System\pEjTmSZ.exe

C:\Windows\System\pEjTmSZ.exe

C:\Windows\System\aawzjkt.exe

C:\Windows\System\aawzjkt.exe

C:\Windows\System\IKpwCjB.exe

C:\Windows\System\IKpwCjB.exe

C:\Windows\System\UEqowIe.exe

C:\Windows\System\UEqowIe.exe

C:\Windows\System\BLGcsmO.exe

C:\Windows\System\BLGcsmO.exe

C:\Windows\System\ypcIObm.exe

C:\Windows\System\ypcIObm.exe

C:\Windows\System\fmyzaBe.exe

C:\Windows\System\fmyzaBe.exe

C:\Windows\System\GCMwQUd.exe

C:\Windows\System\GCMwQUd.exe

C:\Windows\System\vtncEDW.exe

C:\Windows\System\vtncEDW.exe

C:\Windows\System\KenptUH.exe

C:\Windows\System\KenptUH.exe

C:\Windows\System\mcOeAcc.exe

C:\Windows\System\mcOeAcc.exe

C:\Windows\System\kgWckkf.exe

C:\Windows\System\kgWckkf.exe

C:\Windows\System\SHIgzQj.exe

C:\Windows\System\SHIgzQj.exe

C:\Windows\System\zEhuOYN.exe

C:\Windows\System\zEhuOYN.exe

C:\Windows\System\yzdJazO.exe

C:\Windows\System\yzdJazO.exe

C:\Windows\System\tOTZHHp.exe

C:\Windows\System\tOTZHHp.exe

C:\Windows\System\tyyOkFM.exe

C:\Windows\System\tyyOkFM.exe

C:\Windows\System\HUnhQGZ.exe

C:\Windows\System\HUnhQGZ.exe

C:\Windows\System\vaQDqFt.exe

C:\Windows\System\vaQDqFt.exe

C:\Windows\System\xhHJcmB.exe

C:\Windows\System\xhHJcmB.exe

C:\Windows\System\sVVKMOa.exe

C:\Windows\System\sVVKMOa.exe

C:\Windows\System\CiNVSln.exe

C:\Windows\System\CiNVSln.exe

C:\Windows\System\KUzIhHb.exe

C:\Windows\System\KUzIhHb.exe

C:\Windows\System\OyCrCYG.exe

C:\Windows\System\OyCrCYG.exe

C:\Windows\System\cllyQUZ.exe

C:\Windows\System\cllyQUZ.exe

C:\Windows\System\CMTtsce.exe

C:\Windows\System\CMTtsce.exe

C:\Windows\System\eygfgOY.exe

C:\Windows\System\eygfgOY.exe

C:\Windows\System\gpcLZZZ.exe

C:\Windows\System\gpcLZZZ.exe

C:\Windows\System\ewGThgb.exe

C:\Windows\System\ewGThgb.exe

C:\Windows\System\piEItCv.exe

C:\Windows\System\piEItCv.exe

C:\Windows\System\ViUoMch.exe

C:\Windows\System\ViUoMch.exe

C:\Windows\System\FErFEby.exe

C:\Windows\System\FErFEby.exe

C:\Windows\System\MlTaVMq.exe

C:\Windows\System\MlTaVMq.exe

C:\Windows\System\vVTNbOW.exe

C:\Windows\System\vVTNbOW.exe

C:\Windows\System\ubhhVBV.exe

C:\Windows\System\ubhhVBV.exe

C:\Windows\System\DhTYmHC.exe

C:\Windows\System\DhTYmHC.exe

C:\Windows\System\yGEqBQy.exe

C:\Windows\System\yGEqBQy.exe

C:\Windows\System\ISVlucp.exe

C:\Windows\System\ISVlucp.exe

C:\Windows\System\qtPCAPZ.exe

C:\Windows\System\qtPCAPZ.exe

C:\Windows\System\UJPUpNF.exe

C:\Windows\System\UJPUpNF.exe

C:\Windows\System\ixUeRVL.exe

C:\Windows\System\ixUeRVL.exe

C:\Windows\System\aHcYiFY.exe

C:\Windows\System\aHcYiFY.exe

C:\Windows\System\gHCrDQY.exe

C:\Windows\System\gHCrDQY.exe

C:\Windows\System\TtsuKxS.exe

C:\Windows\System\TtsuKxS.exe

C:\Windows\System\eCYTcKG.exe

C:\Windows\System\eCYTcKG.exe

C:\Windows\System\EgcIWmf.exe

C:\Windows\System\EgcIWmf.exe

C:\Windows\System\zIisgUp.exe

C:\Windows\System\zIisgUp.exe

C:\Windows\System\ZeMemvM.exe

C:\Windows\System\ZeMemvM.exe

C:\Windows\System\WNuOFPj.exe

C:\Windows\System\WNuOFPj.exe

C:\Windows\System\FcZzmzP.exe

C:\Windows\System\FcZzmzP.exe

C:\Windows\System\KXxbjLL.exe

C:\Windows\System\KXxbjLL.exe

C:\Windows\System\IDBtOuk.exe

C:\Windows\System\IDBtOuk.exe

C:\Windows\System\XyMHXuy.exe

C:\Windows\System\XyMHXuy.exe

C:\Windows\System\XYNLFeb.exe

C:\Windows\System\XYNLFeb.exe

C:\Windows\System\VjmVfzv.exe

C:\Windows\System\VjmVfzv.exe

C:\Windows\System\zrIkWhW.exe

C:\Windows\System\zrIkWhW.exe

C:\Windows\System\SVGIIhZ.exe

C:\Windows\System\SVGIIhZ.exe

C:\Windows\System\DjCJKmw.exe

C:\Windows\System\DjCJKmw.exe

C:\Windows\System\ETQIfrD.exe

C:\Windows\System\ETQIfrD.exe

C:\Windows\System\pbVWqbL.exe

C:\Windows\System\pbVWqbL.exe

C:\Windows\System\vzbGfEx.exe

C:\Windows\System\vzbGfEx.exe

C:\Windows\System\KGektwz.exe

C:\Windows\System\KGektwz.exe

C:\Windows\System\QKEFMzF.exe

C:\Windows\System\QKEFMzF.exe

C:\Windows\System\MnjOCVS.exe

C:\Windows\System\MnjOCVS.exe

C:\Windows\System\BmEHqsl.exe

C:\Windows\System\BmEHqsl.exe

C:\Windows\System\pobpJNs.exe

C:\Windows\System\pobpJNs.exe

C:\Windows\System\yMRmaud.exe

C:\Windows\System\yMRmaud.exe

C:\Windows\System\cojxYYz.exe

C:\Windows\System\cojxYYz.exe

C:\Windows\System\vumArab.exe

C:\Windows\System\vumArab.exe

C:\Windows\System\WEptzTk.exe

C:\Windows\System\WEptzTk.exe

C:\Windows\System\ovftyxM.exe

C:\Windows\System\ovftyxM.exe

C:\Windows\System\hgUQovW.exe

C:\Windows\System\hgUQovW.exe

C:\Windows\System\chGsByu.exe

C:\Windows\System\chGsByu.exe

C:\Windows\System\rkUMhEZ.exe

C:\Windows\System\rkUMhEZ.exe

C:\Windows\System\FCuLeTl.exe

C:\Windows\System\FCuLeTl.exe

C:\Windows\System\mZKyqpT.exe

C:\Windows\System\mZKyqpT.exe

C:\Windows\System\FASqwxk.exe

C:\Windows\System\FASqwxk.exe

C:\Windows\System\QiikiGY.exe

C:\Windows\System\QiikiGY.exe

C:\Windows\System\GiBhqEa.exe

C:\Windows\System\GiBhqEa.exe

C:\Windows\System\AMkAYRK.exe

C:\Windows\System\AMkAYRK.exe

C:\Windows\System\HdBCuqy.exe

C:\Windows\System\HdBCuqy.exe

C:\Windows\System\rOKgLYk.exe

C:\Windows\System\rOKgLYk.exe

C:\Windows\System\lsQrfjR.exe

C:\Windows\System\lsQrfjR.exe

C:\Windows\System\CdJkupm.exe

C:\Windows\System\CdJkupm.exe

C:\Windows\System\pKZbOzl.exe

C:\Windows\System\pKZbOzl.exe

C:\Windows\System\QgVvvPz.exe

C:\Windows\System\QgVvvPz.exe

C:\Windows\System\pSdwoic.exe

C:\Windows\System\pSdwoic.exe

C:\Windows\System\oENROFS.exe

C:\Windows\System\oENROFS.exe

C:\Windows\System\BjijZAQ.exe

C:\Windows\System\BjijZAQ.exe

C:\Windows\System\nAuEAIQ.exe

C:\Windows\System\nAuEAIQ.exe

C:\Windows\System\ATxFZuw.exe

C:\Windows\System\ATxFZuw.exe

C:\Windows\System\RDdZbhM.exe

C:\Windows\System\RDdZbhM.exe

C:\Windows\System\YtCjhHv.exe

C:\Windows\System\YtCjhHv.exe

C:\Windows\System\kfdHPOw.exe

C:\Windows\System\kfdHPOw.exe

C:\Windows\System\nlcLdfC.exe

C:\Windows\System\nlcLdfC.exe

C:\Windows\System\wGzOxnv.exe

C:\Windows\System\wGzOxnv.exe

C:\Windows\System\eOyjkil.exe

C:\Windows\System\eOyjkil.exe

C:\Windows\System\pDoYBnj.exe

C:\Windows\System\pDoYBnj.exe

C:\Windows\System\anKOYfn.exe

C:\Windows\System\anKOYfn.exe

C:\Windows\System\ELXLkzL.exe

C:\Windows\System\ELXLkzL.exe

C:\Windows\System\CcAyXYs.exe

C:\Windows\System\CcAyXYs.exe

C:\Windows\System\vmwnUuW.exe

C:\Windows\System\vmwnUuW.exe

C:\Windows\System\FDZkoTK.exe

C:\Windows\System\FDZkoTK.exe

C:\Windows\System\cgtaWxR.exe

C:\Windows\System\cgtaWxR.exe

C:\Windows\System\gmlIoXD.exe

C:\Windows\System\gmlIoXD.exe

C:\Windows\System\AXvBEzL.exe

C:\Windows\System\AXvBEzL.exe

C:\Windows\System\DmYSVgJ.exe

C:\Windows\System\DmYSVgJ.exe

C:\Windows\System\AZABUuq.exe

C:\Windows\System\AZABUuq.exe

C:\Windows\System\msEmmBz.exe

C:\Windows\System\msEmmBz.exe

C:\Windows\System\rQBuYwX.exe

C:\Windows\System\rQBuYwX.exe

C:\Windows\System\cBJuKTx.exe

C:\Windows\System\cBJuKTx.exe

C:\Windows\System\eOXcKFD.exe

C:\Windows\System\eOXcKFD.exe

C:\Windows\System\vqqezdo.exe

C:\Windows\System\vqqezdo.exe

C:\Windows\System\QhtCJyw.exe

C:\Windows\System\QhtCJyw.exe

C:\Windows\System\KYZiysZ.exe

C:\Windows\System\KYZiysZ.exe

C:\Windows\System\jkKyNEm.exe

C:\Windows\System\jkKyNEm.exe

C:\Windows\System\xGRIMyS.exe

C:\Windows\System\xGRIMyS.exe

C:\Windows\System\EzXWLdW.exe

C:\Windows\System\EzXWLdW.exe

C:\Windows\System\rFqOybe.exe

C:\Windows\System\rFqOybe.exe

C:\Windows\System\xdEMCsa.exe

C:\Windows\System\xdEMCsa.exe

C:\Windows\System\QYeyzDs.exe

C:\Windows\System\QYeyzDs.exe

C:\Windows\System\gBUnAZq.exe

C:\Windows\System\gBUnAZq.exe

C:\Windows\System\WJwgVFP.exe

C:\Windows\System\WJwgVFP.exe

C:\Windows\System\wQUIPPA.exe

C:\Windows\System\wQUIPPA.exe

C:\Windows\System\RIpCYtV.exe

C:\Windows\System\RIpCYtV.exe

C:\Windows\System\DpJaubF.exe

C:\Windows\System\DpJaubF.exe

C:\Windows\System\yfsmPVC.exe

C:\Windows\System\yfsmPVC.exe

C:\Windows\System\VbwDuto.exe

C:\Windows\System\VbwDuto.exe

C:\Windows\System\OmEMUHq.exe

C:\Windows\System\OmEMUHq.exe

C:\Windows\System\eSNEXkk.exe

C:\Windows\System\eSNEXkk.exe

C:\Windows\System\zXPCcEF.exe

C:\Windows\System\zXPCcEF.exe

C:\Windows\System\FMfesCo.exe

C:\Windows\System\FMfesCo.exe

C:\Windows\System\GTmjJBe.exe

C:\Windows\System\GTmjJBe.exe

C:\Windows\System\AkzjOzI.exe

C:\Windows\System\AkzjOzI.exe

C:\Windows\System\WYiruaL.exe

C:\Windows\System\WYiruaL.exe

C:\Windows\System\gTsPaFi.exe

C:\Windows\System\gTsPaFi.exe

C:\Windows\System\fcnIeai.exe

C:\Windows\System\fcnIeai.exe

C:\Windows\System\VtnMhJw.exe

C:\Windows\System\VtnMhJw.exe

C:\Windows\System\gBqrZhJ.exe

C:\Windows\System\gBqrZhJ.exe

C:\Windows\System\DFgNUGl.exe

C:\Windows\System\DFgNUGl.exe

C:\Windows\System\AWUCyCI.exe

C:\Windows\System\AWUCyCI.exe

C:\Windows\System\gZDVzkl.exe

C:\Windows\System\gZDVzkl.exe

C:\Windows\System\kdbaxRW.exe

C:\Windows\System\kdbaxRW.exe

C:\Windows\System\MPrqbeC.exe

C:\Windows\System\MPrqbeC.exe

C:\Windows\System\CuemgkF.exe

C:\Windows\System\CuemgkF.exe

C:\Windows\System\AqkEesE.exe

C:\Windows\System\AqkEesE.exe

C:\Windows\System\SroadMw.exe

C:\Windows\System\SroadMw.exe

C:\Windows\System\tsxbYJs.exe

C:\Windows\System\tsxbYJs.exe

C:\Windows\System\hhHWafu.exe

C:\Windows\System\hhHWafu.exe

C:\Windows\System\mAtHxIm.exe

C:\Windows\System\mAtHxIm.exe

C:\Windows\System\yMWdKmJ.exe

C:\Windows\System\yMWdKmJ.exe

C:\Windows\System\SfbBrll.exe

C:\Windows\System\SfbBrll.exe

C:\Windows\System\DvKfucU.exe

C:\Windows\System\DvKfucU.exe

C:\Windows\System\orgMgKS.exe

C:\Windows\System\orgMgKS.exe

C:\Windows\System\mpXivev.exe

C:\Windows\System\mpXivev.exe

C:\Windows\System\vIFLEmI.exe

C:\Windows\System\vIFLEmI.exe

C:\Windows\System\eCfIXKG.exe

C:\Windows\System\eCfIXKG.exe

C:\Windows\System\nUkYyYn.exe

C:\Windows\System\nUkYyYn.exe

C:\Windows\System\invKKbb.exe

C:\Windows\System\invKKbb.exe

C:\Windows\System\jdJmwLj.exe

C:\Windows\System\jdJmwLj.exe

C:\Windows\System\KeKEzmY.exe

C:\Windows\System\KeKEzmY.exe

C:\Windows\System\hsHSfWq.exe

C:\Windows\System\hsHSfWq.exe

C:\Windows\System\JsMxtxz.exe

C:\Windows\System\JsMxtxz.exe

C:\Windows\System\fQSSBbZ.exe

C:\Windows\System\fQSSBbZ.exe

C:\Windows\System\WTkIDvV.exe

C:\Windows\System\WTkIDvV.exe

C:\Windows\System\ertmoPt.exe

C:\Windows\System\ertmoPt.exe

C:\Windows\System\CHCmTUs.exe

C:\Windows\System\CHCmTUs.exe

C:\Windows\System\ngcxhZd.exe

C:\Windows\System\ngcxhZd.exe

C:\Windows\System\cSCXzOA.exe

C:\Windows\System\cSCXzOA.exe

C:\Windows\System\vOOjCTK.exe

C:\Windows\System\vOOjCTK.exe

C:\Windows\System\mhCaNQh.exe

C:\Windows\System\mhCaNQh.exe

C:\Windows\System\nZDAOxZ.exe

C:\Windows\System\nZDAOxZ.exe

C:\Windows\System\hHtKhbf.exe

C:\Windows\System\hHtKhbf.exe

C:\Windows\System\NqLpQxm.exe

C:\Windows\System\NqLpQxm.exe

C:\Windows\System\SZLtDDq.exe

C:\Windows\System\SZLtDDq.exe

C:\Windows\System\UHNVzhM.exe

C:\Windows\System\UHNVzhM.exe

C:\Windows\System\NDkigEp.exe

C:\Windows\System\NDkigEp.exe

C:\Windows\System\sJgmkCP.exe

C:\Windows\System\sJgmkCP.exe

C:\Windows\System\ZJuHrNp.exe

C:\Windows\System\ZJuHrNp.exe

C:\Windows\System\aZWjFyx.exe

C:\Windows\System\aZWjFyx.exe

C:\Windows\System\bvLyzuQ.exe

C:\Windows\System\bvLyzuQ.exe

C:\Windows\System\mzhnWMI.exe

C:\Windows\System\mzhnWMI.exe

C:\Windows\System\yqkLITy.exe

C:\Windows\System\yqkLITy.exe

C:\Windows\System\fgdVhRs.exe

C:\Windows\System\fgdVhRs.exe

C:\Windows\System\zeVcGDE.exe

C:\Windows\System\zeVcGDE.exe

C:\Windows\System\jBRsONF.exe

C:\Windows\System\jBRsONF.exe

C:\Windows\System\UQsGkPh.exe

C:\Windows\System\UQsGkPh.exe

C:\Windows\System\CZICQdm.exe

C:\Windows\System\CZICQdm.exe

C:\Windows\System\LGAAqVn.exe

C:\Windows\System\LGAAqVn.exe

C:\Windows\System\HBvuIRG.exe

C:\Windows\System\HBvuIRG.exe

C:\Windows\System\SnuXyDs.exe

C:\Windows\System\SnuXyDs.exe

C:\Windows\System\qhGKbYZ.exe

C:\Windows\System\qhGKbYZ.exe

C:\Windows\System\gWmFXHP.exe

C:\Windows\System\gWmFXHP.exe

C:\Windows\System\dvNTNrk.exe

C:\Windows\System\dvNTNrk.exe

C:\Windows\System\wfAULyC.exe

C:\Windows\System\wfAULyC.exe

C:\Windows\System\lbVTrlh.exe

C:\Windows\System\lbVTrlh.exe

C:\Windows\System\swToAIQ.exe

C:\Windows\System\swToAIQ.exe

C:\Windows\System\XSKMfGO.exe

C:\Windows\System\XSKMfGO.exe

C:\Windows\System\KgMhZAr.exe

C:\Windows\System\KgMhZAr.exe

C:\Windows\System\zThkiGp.exe

C:\Windows\System\zThkiGp.exe

C:\Windows\System\bOPgzsn.exe

C:\Windows\System\bOPgzsn.exe

C:\Windows\System\hlQPsnI.exe

C:\Windows\System\hlQPsnI.exe

C:\Windows\System\TeOAKGw.exe

C:\Windows\System\TeOAKGw.exe

C:\Windows\System\QpIIatz.exe

C:\Windows\System\QpIIatz.exe

C:\Windows\System\byzYexr.exe

C:\Windows\System\byzYexr.exe

C:\Windows\System\ZqJcpsC.exe

C:\Windows\System\ZqJcpsC.exe

C:\Windows\System\nKAPgQn.exe

C:\Windows\System\nKAPgQn.exe

C:\Windows\System\GfmVreB.exe

C:\Windows\System\GfmVreB.exe

C:\Windows\System\DnqedUo.exe

C:\Windows\System\DnqedUo.exe

C:\Windows\System\DpEIltY.exe

C:\Windows\System\DpEIltY.exe

C:\Windows\System\XfhaVkl.exe

C:\Windows\System\XfhaVkl.exe

C:\Windows\System\mrxexif.exe

C:\Windows\System\mrxexif.exe

C:\Windows\System\JdZPraa.exe

C:\Windows\System\JdZPraa.exe

C:\Windows\System\bgeZZhj.exe

C:\Windows\System\bgeZZhj.exe

C:\Windows\System\UBqXwbP.exe

C:\Windows\System\UBqXwbP.exe

C:\Windows\System\YKLorcm.exe

C:\Windows\System\YKLorcm.exe

C:\Windows\System\PbIPjSg.exe

C:\Windows\System\PbIPjSg.exe

C:\Windows\System\cFcEPkR.exe

C:\Windows\System\cFcEPkR.exe

C:\Windows\System\TRSdQQo.exe

C:\Windows\System\TRSdQQo.exe

C:\Windows\System\XgzxJMs.exe

C:\Windows\System\XgzxJMs.exe

C:\Windows\System\sBkfeDH.exe

C:\Windows\System\sBkfeDH.exe

C:\Windows\System\lizXTmJ.exe

C:\Windows\System\lizXTmJ.exe

C:\Windows\System\OltQnYy.exe

C:\Windows\System\OltQnYy.exe

C:\Windows\System\mhnMcKZ.exe

C:\Windows\System\mhnMcKZ.exe

C:\Windows\System\cKmVhzf.exe

C:\Windows\System\cKmVhzf.exe

C:\Windows\System\atlJZmc.exe

C:\Windows\System\atlJZmc.exe

C:\Windows\System\wvWWTaa.exe

C:\Windows\System\wvWWTaa.exe

C:\Windows\System\rkYxeFr.exe

C:\Windows\System\rkYxeFr.exe

C:\Windows\System\aLRHpJY.exe

C:\Windows\System\aLRHpJY.exe

C:\Windows\System\QlmgSbr.exe

C:\Windows\System\QlmgSbr.exe

C:\Windows\System\JahMinm.exe

C:\Windows\System\JahMinm.exe

C:\Windows\System\ZRULJku.exe

C:\Windows\System\ZRULJku.exe

C:\Windows\System\hOxdtex.exe

C:\Windows\System\hOxdtex.exe

C:\Windows\System\kHnNXse.exe

C:\Windows\System\kHnNXse.exe

C:\Windows\System\UmxNTGr.exe

C:\Windows\System\UmxNTGr.exe

C:\Windows\System\jgpWwgq.exe

C:\Windows\System\jgpWwgq.exe

C:\Windows\System\rbbNWwh.exe

C:\Windows\System\rbbNWwh.exe

C:\Windows\System\DphHWCE.exe

C:\Windows\System\DphHWCE.exe

C:\Windows\System\joLMQZH.exe

C:\Windows\System\joLMQZH.exe

C:\Windows\System\MBBbukk.exe

C:\Windows\System\MBBbukk.exe

C:\Windows\System\QQhGZMv.exe

C:\Windows\System\QQhGZMv.exe

C:\Windows\System\yoaWunt.exe

C:\Windows\System\yoaWunt.exe

C:\Windows\System\gwbzqMg.exe

C:\Windows\System\gwbzqMg.exe

C:\Windows\System\QVtckqg.exe

C:\Windows\System\QVtckqg.exe

C:\Windows\System\FSdGTFR.exe

C:\Windows\System\FSdGTFR.exe

C:\Windows\System\rMUbXCx.exe

C:\Windows\System\rMUbXCx.exe

C:\Windows\System\PzgYKFW.exe

C:\Windows\System\PzgYKFW.exe

C:\Windows\System\FhrFVSQ.exe

C:\Windows\System\FhrFVSQ.exe

C:\Windows\System\IHfLlnQ.exe

C:\Windows\System\IHfLlnQ.exe

C:\Windows\System\DdlCPys.exe

C:\Windows\System\DdlCPys.exe

C:\Windows\System\NglWZrp.exe

C:\Windows\System\NglWZrp.exe

C:\Windows\System\VscgtsJ.exe

C:\Windows\System\VscgtsJ.exe

C:\Windows\System\NZsNSYL.exe

C:\Windows\System\NZsNSYL.exe

C:\Windows\System\DufUEid.exe

C:\Windows\System\DufUEid.exe

C:\Windows\System\viXnVnr.exe

C:\Windows\System\viXnVnr.exe

C:\Windows\System\vnVrrfZ.exe

C:\Windows\System\vnVrrfZ.exe

C:\Windows\System\ERPaNsB.exe

C:\Windows\System\ERPaNsB.exe

C:\Windows\System\BulqOER.exe

C:\Windows\System\BulqOER.exe

C:\Windows\System\tQjUYSD.exe

C:\Windows\System\tQjUYSD.exe

C:\Windows\System\mxqAStU.exe

C:\Windows\System\mxqAStU.exe

C:\Windows\System\RTADIhd.exe

C:\Windows\System\RTADIhd.exe

C:\Windows\System\pAdTFTY.exe

C:\Windows\System\pAdTFTY.exe

C:\Windows\System\rLoDgDw.exe

C:\Windows\System\rLoDgDw.exe

C:\Windows\System\tBDPXrG.exe

C:\Windows\System\tBDPXrG.exe

C:\Windows\System\CDBtTDB.exe

C:\Windows\System\CDBtTDB.exe

C:\Windows\System\HxEHnqM.exe

C:\Windows\System\HxEHnqM.exe

C:\Windows\System\hXkINex.exe

C:\Windows\System\hXkINex.exe

C:\Windows\System\kLbnANF.exe

C:\Windows\System\kLbnANF.exe

C:\Windows\System\lWPQYEM.exe

C:\Windows\System\lWPQYEM.exe

C:\Windows\System\UXoABwh.exe

C:\Windows\System\UXoABwh.exe

C:\Windows\System\ULYkqAl.exe

C:\Windows\System\ULYkqAl.exe

C:\Windows\System\truHZdO.exe

C:\Windows\System\truHZdO.exe

C:\Windows\System\VGAmqsQ.exe

C:\Windows\System\VGAmqsQ.exe

C:\Windows\System\EMbArae.exe

C:\Windows\System\EMbArae.exe

C:\Windows\System\AhntSjB.exe

C:\Windows\System\AhntSjB.exe

C:\Windows\System\UAyahFv.exe

C:\Windows\System\UAyahFv.exe

C:\Windows\System\kOYTCVQ.exe

C:\Windows\System\kOYTCVQ.exe

C:\Windows\System\ESvlLsH.exe

C:\Windows\System\ESvlLsH.exe

C:\Windows\System\gAcgGxy.exe

C:\Windows\System\gAcgGxy.exe

C:\Windows\System\RjnILPW.exe

C:\Windows\System\RjnILPW.exe

C:\Windows\System\pCdDTFx.exe

C:\Windows\System\pCdDTFx.exe

C:\Windows\System\ZevIKQF.exe

C:\Windows\System\ZevIKQF.exe

C:\Windows\System\YeKvOOU.exe

C:\Windows\System\YeKvOOU.exe

C:\Windows\System\tPEvFLp.exe

C:\Windows\System\tPEvFLp.exe

C:\Windows\System\lpaBnQP.exe

C:\Windows\System\lpaBnQP.exe

C:\Windows\System\iiXBiWu.exe

C:\Windows\System\iiXBiWu.exe

C:\Windows\System\lNlnQSN.exe

C:\Windows\System\lNlnQSN.exe

C:\Windows\System\BvCYbAW.exe

C:\Windows\System\BvCYbAW.exe

C:\Windows\System\XoUKPsj.exe

C:\Windows\System\XoUKPsj.exe

C:\Windows\System\NcFRajw.exe

C:\Windows\System\NcFRajw.exe

C:\Windows\System\vSElfSY.exe

C:\Windows\System\vSElfSY.exe

C:\Windows\System\RoAYbLN.exe

C:\Windows\System\RoAYbLN.exe

C:\Windows\System\Kszddya.exe

C:\Windows\System\Kszddya.exe

C:\Windows\System\OYHINaM.exe

C:\Windows\System\OYHINaM.exe

C:\Windows\System\JhTbRfF.exe

C:\Windows\System\JhTbRfF.exe

C:\Windows\System\vvwkMer.exe

C:\Windows\System\vvwkMer.exe

C:\Windows\System\EJvfsPb.exe

C:\Windows\System\EJvfsPb.exe

C:\Windows\System\WcSfYOj.exe

C:\Windows\System\WcSfYOj.exe

C:\Windows\System\CkFVacE.exe

C:\Windows\System\CkFVacE.exe

C:\Windows\System\ZuyOZVT.exe

C:\Windows\System\ZuyOZVT.exe

C:\Windows\System\JMxmUxJ.exe

C:\Windows\System\JMxmUxJ.exe

C:\Windows\System\hoobplA.exe

C:\Windows\System\hoobplA.exe

C:\Windows\System\cmSXsDp.exe

C:\Windows\System\cmSXsDp.exe

C:\Windows\System\pphQzfz.exe

C:\Windows\System\pphQzfz.exe

C:\Windows\System\KTlCihd.exe

C:\Windows\System\KTlCihd.exe

C:\Windows\System\qyeSoml.exe

C:\Windows\System\qyeSoml.exe

C:\Windows\System\LsFdaTB.exe

C:\Windows\System\LsFdaTB.exe

C:\Windows\System\HECOOnQ.exe

C:\Windows\System\HECOOnQ.exe

C:\Windows\System\GtcFNbF.exe

C:\Windows\System\GtcFNbF.exe

C:\Windows\System\UOcwNng.exe

C:\Windows\System\UOcwNng.exe

C:\Windows\System\miAFkAX.exe

C:\Windows\System\miAFkAX.exe

C:\Windows\System\iOdaGWn.exe

C:\Windows\System\iOdaGWn.exe

C:\Windows\System\qvPFTcy.exe

C:\Windows\System\qvPFTcy.exe

C:\Windows\System\lYnkYoY.exe

C:\Windows\System\lYnkYoY.exe

C:\Windows\System\OpXwQWh.exe

C:\Windows\System\OpXwQWh.exe

C:\Windows\System\RvqqdvQ.exe

C:\Windows\System\RvqqdvQ.exe

C:\Windows\System\yZgbwWr.exe

C:\Windows\System\yZgbwWr.exe

C:\Windows\System\Cofxdyf.exe

C:\Windows\System\Cofxdyf.exe

C:\Windows\System\fkSpfbq.exe

C:\Windows\System\fkSpfbq.exe

C:\Windows\System\LzEukYD.exe

C:\Windows\System\LzEukYD.exe

C:\Windows\System\CTiMXrj.exe

C:\Windows\System\CTiMXrj.exe

C:\Windows\System\bRGBzlv.exe

C:\Windows\System\bRGBzlv.exe

C:\Windows\System\WaGyPqS.exe

C:\Windows\System\WaGyPqS.exe

C:\Windows\System\sdeJgCX.exe

C:\Windows\System\sdeJgCX.exe

C:\Windows\System\LnWsLWc.exe

C:\Windows\System\LnWsLWc.exe

C:\Windows\System\OstXVIH.exe

C:\Windows\System\OstXVIH.exe

C:\Windows\System\GtHmOTV.exe

C:\Windows\System\GtHmOTV.exe

C:\Windows\System\zMCMqCO.exe

C:\Windows\System\zMCMqCO.exe

C:\Windows\System\lTeFzKr.exe

C:\Windows\System\lTeFzKr.exe

C:\Windows\System\OLvvuLF.exe

C:\Windows\System\OLvvuLF.exe

C:\Windows\System\ONBWJRu.exe

C:\Windows\System\ONBWJRu.exe

C:\Windows\System\xVxStGl.exe

C:\Windows\System\xVxStGl.exe

C:\Windows\System\vIMKDWk.exe

C:\Windows\System\vIMKDWk.exe

C:\Windows\System\gNzzvrK.exe

C:\Windows\System\gNzzvrK.exe

C:\Windows\System\rHmZlpD.exe

C:\Windows\System\rHmZlpD.exe

C:\Windows\System\juaCYnO.exe

C:\Windows\System\juaCYnO.exe

C:\Windows\System\WNtCfal.exe

C:\Windows\System\WNtCfal.exe

C:\Windows\System\GScENZL.exe

C:\Windows\System\GScENZL.exe

C:\Windows\System\MfZmlxk.exe

C:\Windows\System\MfZmlxk.exe

C:\Windows\System\UdHtuwn.exe

C:\Windows\System\UdHtuwn.exe

C:\Windows\System\rkvMnWB.exe

C:\Windows\System\rkvMnWB.exe

C:\Windows\System\hpxjGvi.exe

C:\Windows\System\hpxjGvi.exe

C:\Windows\System\yDZRrtR.exe

C:\Windows\System\yDZRrtR.exe

C:\Windows\System\SVvXuIg.exe

C:\Windows\System\SVvXuIg.exe

C:\Windows\System\AQFcPti.exe

C:\Windows\System\AQFcPti.exe

C:\Windows\System\AmFIoIx.exe

C:\Windows\System\AmFIoIx.exe

C:\Windows\System\NYGapPv.exe

C:\Windows\System\NYGapPv.exe

C:\Windows\System\JVPBZAi.exe

C:\Windows\System\JVPBZAi.exe

C:\Windows\System\yqpwaHW.exe

C:\Windows\System\yqpwaHW.exe

C:\Windows\System\cLfoyWh.exe

C:\Windows\System\cLfoyWh.exe

C:\Windows\System\lBYrMuA.exe

C:\Windows\System\lBYrMuA.exe

C:\Windows\System\rNhfzhJ.exe

C:\Windows\System\rNhfzhJ.exe

C:\Windows\System\DyBDIrU.exe

C:\Windows\System\DyBDIrU.exe

C:\Windows\System\iWMIvZU.exe

C:\Windows\System\iWMIvZU.exe

C:\Windows\System\BzUXUpI.exe

C:\Windows\System\BzUXUpI.exe

C:\Windows\System\oGgLPbc.exe

C:\Windows\System\oGgLPbc.exe

C:\Windows\System\VjqOiWL.exe

C:\Windows\System\VjqOiWL.exe

C:\Windows\System\vYJCxpX.exe

C:\Windows\System\vYJCxpX.exe

C:\Windows\System\bfrRzzc.exe

C:\Windows\System\bfrRzzc.exe

C:\Windows\System\xaRKHrq.exe

C:\Windows\System\xaRKHrq.exe

C:\Windows\System\heLahBa.exe

C:\Windows\System\heLahBa.exe

C:\Windows\System\zhEJtJg.exe

C:\Windows\System\zhEJtJg.exe

C:\Windows\System\DTVoTsH.exe

C:\Windows\System\DTVoTsH.exe

C:\Windows\System\dDxFyiA.exe

C:\Windows\System\dDxFyiA.exe

C:\Windows\System\DqUKUsw.exe

C:\Windows\System\DqUKUsw.exe

C:\Windows\System\CNAxlkr.exe

C:\Windows\System\CNAxlkr.exe

C:\Windows\System\AYraEjA.exe

C:\Windows\System\AYraEjA.exe

C:\Windows\System\ZGJjpZg.exe

C:\Windows\System\ZGJjpZg.exe

C:\Windows\System\VBkjzHY.exe

C:\Windows\System\VBkjzHY.exe

C:\Windows\System\PzRLqFR.exe

C:\Windows\System\PzRLqFR.exe

C:\Windows\System\xpXVMJV.exe

C:\Windows\System\xpXVMJV.exe

C:\Windows\System\MbdTctg.exe

C:\Windows\System\MbdTctg.exe

C:\Windows\System\necSIUX.exe

C:\Windows\System\necSIUX.exe

C:\Windows\System\saYfWPO.exe

C:\Windows\System\saYfWPO.exe

C:\Windows\System\qliTdYY.exe

C:\Windows\System\qliTdYY.exe

C:\Windows\System\uAgiWhh.exe

C:\Windows\System\uAgiWhh.exe

C:\Windows\System\eDCAELj.exe

C:\Windows\System\eDCAELj.exe

C:\Windows\System\JSsqgUs.exe

C:\Windows\System\JSsqgUs.exe

C:\Windows\System\KkxMhNf.exe

C:\Windows\System\KkxMhNf.exe

C:\Windows\System\nRjAJQb.exe

C:\Windows\System\nRjAJQb.exe

C:\Windows\System\urdIgzo.exe

C:\Windows\System\urdIgzo.exe

C:\Windows\System\ebsrsKH.exe

C:\Windows\System\ebsrsKH.exe

C:\Windows\System\ftYeRtC.exe

C:\Windows\System\ftYeRtC.exe

C:\Windows\System\jcvTPtI.exe

C:\Windows\System\jcvTPtI.exe

C:\Windows\System\CIoxkyi.exe

C:\Windows\System\CIoxkyi.exe

C:\Windows\System\unbwgEV.exe

C:\Windows\System\unbwgEV.exe

C:\Windows\System\GROfTAP.exe

C:\Windows\System\GROfTAP.exe

C:\Windows\System\wOlHSJS.exe

C:\Windows\System\wOlHSJS.exe

C:\Windows\System\koJTquO.exe

C:\Windows\System\koJTquO.exe

C:\Windows\System\IwFySIy.exe

C:\Windows\System\IwFySIy.exe

C:\Windows\System\nOdEEMm.exe

C:\Windows\System\nOdEEMm.exe

C:\Windows\System\dLhkfZQ.exe

C:\Windows\System\dLhkfZQ.exe

C:\Windows\System\rKpWbXK.exe

C:\Windows\System\rKpWbXK.exe

C:\Windows\System\rJhLUAz.exe

C:\Windows\System\rJhLUAz.exe

C:\Windows\System\UpguGjg.exe

C:\Windows\System\UpguGjg.exe

C:\Windows\System\rlllWEJ.exe

C:\Windows\System\rlllWEJ.exe

C:\Windows\System\dnFGMHG.exe

C:\Windows\System\dnFGMHG.exe

C:\Windows\System\TlXQTRq.exe

C:\Windows\System\TlXQTRq.exe

C:\Windows\System\TOmCCbj.exe

C:\Windows\System\TOmCCbj.exe

C:\Windows\System\ZxbYhwo.exe

C:\Windows\System\ZxbYhwo.exe

C:\Windows\System\IvVzbpq.exe

C:\Windows\System\IvVzbpq.exe

C:\Windows\System\yDAhCVy.exe

C:\Windows\System\yDAhCVy.exe

C:\Windows\System\oqYhSzZ.exe

C:\Windows\System\oqYhSzZ.exe

C:\Windows\System\yduteBr.exe

C:\Windows\System\yduteBr.exe

C:\Windows\System\mnnYdvd.exe

C:\Windows\System\mnnYdvd.exe

C:\Windows\System\FlwEfBT.exe

C:\Windows\System\FlwEfBT.exe

C:\Windows\System\tBkbsJV.exe

C:\Windows\System\tBkbsJV.exe

C:\Windows\System\aIoMWMx.exe

C:\Windows\System\aIoMWMx.exe

C:\Windows\System\tpfZiGc.exe

C:\Windows\System\tpfZiGc.exe

C:\Windows\System\EqhMfKu.exe

C:\Windows\System\EqhMfKu.exe

C:\Windows\System\JOWPGbo.exe

C:\Windows\System\JOWPGbo.exe

C:\Windows\System\SjxbNZU.exe

C:\Windows\System\SjxbNZU.exe

C:\Windows\System\vkMWSez.exe

C:\Windows\System\vkMWSez.exe

C:\Windows\System\gJACIdz.exe

C:\Windows\System\gJACIdz.exe

C:\Windows\System\qkRiDGE.exe

C:\Windows\System\qkRiDGE.exe

C:\Windows\System\soJPMVf.exe

C:\Windows\System\soJPMVf.exe

C:\Windows\System\xegROPG.exe

C:\Windows\System\xegROPG.exe

C:\Windows\System\EouzLpg.exe

C:\Windows\System\EouzLpg.exe

C:\Windows\System\DxMWrPL.exe

C:\Windows\System\DxMWrPL.exe

C:\Windows\System\ZIFrzoA.exe

C:\Windows\System\ZIFrzoA.exe

C:\Windows\System\valIlBu.exe

C:\Windows\System\valIlBu.exe

C:\Windows\System\EtQyYSN.exe

C:\Windows\System\EtQyYSN.exe

C:\Windows\System\jUuIxFc.exe

C:\Windows\System\jUuIxFc.exe

C:\Windows\System\ireOdIU.exe

C:\Windows\System\ireOdIU.exe

C:\Windows\System\HzuxjgJ.exe

C:\Windows\System\HzuxjgJ.exe

C:\Windows\System\UohnZBy.exe

C:\Windows\System\UohnZBy.exe

C:\Windows\System\cHetScN.exe

C:\Windows\System\cHetScN.exe

C:\Windows\System\LrPUHVW.exe

C:\Windows\System\LrPUHVW.exe

C:\Windows\System\AxfLOra.exe

C:\Windows\System\AxfLOra.exe

C:\Windows\System\ikYhwVw.exe

C:\Windows\System\ikYhwVw.exe

C:\Windows\System\lgPeAfb.exe

C:\Windows\System\lgPeAfb.exe

C:\Windows\System\ULCItKo.exe

C:\Windows\System\ULCItKo.exe

C:\Windows\System\OvZjbWY.exe

C:\Windows\System\OvZjbWY.exe

C:\Windows\System\FQiXbOO.exe

C:\Windows\System\FQiXbOO.exe

C:\Windows\System\jnLnUCn.exe

C:\Windows\System\jnLnUCn.exe

C:\Windows\System\mAwFiAt.exe

C:\Windows\System\mAwFiAt.exe

C:\Windows\System\QjkMhUo.exe

C:\Windows\System\QjkMhUo.exe

C:\Windows\System\wKtJPDW.exe

C:\Windows\System\wKtJPDW.exe

C:\Windows\System\MmfAupn.exe

C:\Windows\System\MmfAupn.exe

C:\Windows\System\rUgAqDl.exe

C:\Windows\System\rUgAqDl.exe

C:\Windows\System\sqUHSvK.exe

C:\Windows\System\sqUHSvK.exe

C:\Windows\System\SbTksAp.exe

C:\Windows\System\SbTksAp.exe

C:\Windows\System\STwXeyQ.exe

C:\Windows\System\STwXeyQ.exe

C:\Windows\System\nGKqpaQ.exe

C:\Windows\System\nGKqpaQ.exe

C:\Windows\System\fSqjxAp.exe

C:\Windows\System\fSqjxAp.exe

C:\Windows\System\UXdwdsa.exe

C:\Windows\System\UXdwdsa.exe

C:\Windows\System\aVlTLAr.exe

C:\Windows\System\aVlTLAr.exe

C:\Windows\System\nKsCPIk.exe

C:\Windows\System\nKsCPIk.exe

C:\Windows\System\zUVThPK.exe

C:\Windows\System\zUVThPK.exe

C:\Windows\System\TxGggMk.exe

C:\Windows\System\TxGggMk.exe

C:\Windows\System\ZGuBhKv.exe

C:\Windows\System\ZGuBhKv.exe

C:\Windows\System\exBEAEC.exe

C:\Windows\System\exBEAEC.exe

C:\Windows\System\MGdcUlb.exe

C:\Windows\System\MGdcUlb.exe

C:\Windows\System\RCmwxbL.exe

C:\Windows\System\RCmwxbL.exe

C:\Windows\System\eDRfyKx.exe

C:\Windows\System\eDRfyKx.exe

C:\Windows\System\moMZZjZ.exe

C:\Windows\System\moMZZjZ.exe

C:\Windows\System\ipIjKBK.exe

C:\Windows\System\ipIjKBK.exe

C:\Windows\System\myFziTh.exe

C:\Windows\System\myFziTh.exe

C:\Windows\System\VSvsOEd.exe

C:\Windows\System\VSvsOEd.exe

C:\Windows\System\fJtJest.exe

C:\Windows\System\fJtJest.exe

C:\Windows\System\GPjYarA.exe

C:\Windows\System\GPjYarA.exe

C:\Windows\System\dmzDYHJ.exe

C:\Windows\System\dmzDYHJ.exe

C:\Windows\System\tsqYwHu.exe

C:\Windows\System\tsqYwHu.exe

C:\Windows\System\etwQERS.exe

C:\Windows\System\etwQERS.exe

C:\Windows\System\XEHnrtY.exe

C:\Windows\System\XEHnrtY.exe

C:\Windows\System\saflEWJ.exe

C:\Windows\System\saflEWJ.exe

C:\Windows\System\orzCgvZ.exe

C:\Windows\System\orzCgvZ.exe

C:\Windows\System\VQTopTx.exe

C:\Windows\System\VQTopTx.exe

C:\Windows\System\szTWpfX.exe

C:\Windows\System\szTWpfX.exe

C:\Windows\System\dSXjKer.exe

C:\Windows\System\dSXjKer.exe

C:\Windows\System\dfaElXV.exe

C:\Windows\System\dfaElXV.exe

C:\Windows\System\rsKXXgh.exe

C:\Windows\System\rsKXXgh.exe

C:\Windows\System\TpgOSsD.exe

C:\Windows\System\TpgOSsD.exe

C:\Windows\System\isfAEZX.exe

C:\Windows\System\isfAEZX.exe

C:\Windows\System\NjoPRSw.exe

C:\Windows\System\NjoPRSw.exe

C:\Windows\System\czeKwcn.exe

C:\Windows\System\czeKwcn.exe

C:\Windows\System\jjYaMoD.exe

C:\Windows\System\jjYaMoD.exe

C:\Windows\System\tzmBDnL.exe

C:\Windows\System\tzmBDnL.exe

C:\Windows\System\utNxPQd.exe

C:\Windows\System\utNxPQd.exe

C:\Windows\System\CdKdjAI.exe

C:\Windows\System\CdKdjAI.exe

C:\Windows\System\FSeKqQE.exe

C:\Windows\System\FSeKqQE.exe

C:\Windows\System\YBKPLdq.exe

C:\Windows\System\YBKPLdq.exe

C:\Windows\System\lcssUJl.exe

C:\Windows\System\lcssUJl.exe

C:\Windows\System\DIdXqWZ.exe

C:\Windows\System\DIdXqWZ.exe

C:\Windows\System\SDdsJkw.exe

C:\Windows\System\SDdsJkw.exe

C:\Windows\System\hzgMgDt.exe

C:\Windows\System\hzgMgDt.exe

C:\Windows\System\swfOXUR.exe

C:\Windows\System\swfOXUR.exe

C:\Windows\System\Dsghovo.exe

C:\Windows\System\Dsghovo.exe

C:\Windows\System\LTDoERB.exe

C:\Windows\System\LTDoERB.exe

C:\Windows\System\UeUVEGt.exe

C:\Windows\System\UeUVEGt.exe

C:\Windows\System\RVPAuni.exe

C:\Windows\System\RVPAuni.exe

C:\Windows\System\CTPPvBF.exe

C:\Windows\System\CTPPvBF.exe

C:\Windows\System\Fybylof.exe

C:\Windows\System\Fybylof.exe

C:\Windows\System\PHNbDSQ.exe

C:\Windows\System\PHNbDSQ.exe

C:\Windows\System\XsehnFT.exe

C:\Windows\System\XsehnFT.exe

C:\Windows\System\fqEDyem.exe

C:\Windows\System\fqEDyem.exe

C:\Windows\System\YjcEyzU.exe

C:\Windows\System\YjcEyzU.exe

C:\Windows\System\KfuMUPv.exe

C:\Windows\System\KfuMUPv.exe

C:\Windows\System\keyHBSx.exe

C:\Windows\System\keyHBSx.exe

C:\Windows\System\aVZjnMf.exe

C:\Windows\System\aVZjnMf.exe

C:\Windows\System\EmFdETw.exe

C:\Windows\System\EmFdETw.exe

C:\Windows\System\gcrlftl.exe

C:\Windows\System\gcrlftl.exe

C:\Windows\System\AnuqanJ.exe

C:\Windows\System\AnuqanJ.exe

C:\Windows\System\yFIcFow.exe

C:\Windows\System\yFIcFow.exe

C:\Windows\System\DLAtiHd.exe

C:\Windows\System\DLAtiHd.exe

C:\Windows\System\RrNPIqL.exe

C:\Windows\System\RrNPIqL.exe

C:\Windows\System\OkMsmHz.exe

C:\Windows\System\OkMsmHz.exe

C:\Windows\System\RikJEuF.exe

C:\Windows\System\RikJEuF.exe

C:\Windows\System\zZZAzLo.exe

C:\Windows\System\zZZAzLo.exe

C:\Windows\System\rBDOnaI.exe

C:\Windows\System\rBDOnaI.exe

C:\Windows\System\mIUFwoQ.exe

C:\Windows\System\mIUFwoQ.exe

C:\Windows\System\ytVYxra.exe

C:\Windows\System\ytVYxra.exe

C:\Windows\System\dIAgygb.exe

C:\Windows\System\dIAgygb.exe

C:\Windows\System\GBfvoxw.exe

C:\Windows\System\GBfvoxw.exe

C:\Windows\System\BPbewfa.exe

C:\Windows\System\BPbewfa.exe

C:\Windows\System\dPRWlxH.exe

C:\Windows\System\dPRWlxH.exe

C:\Windows\System\YxpkzvG.exe

C:\Windows\System\YxpkzvG.exe

C:\Windows\System\dtYrKNj.exe

C:\Windows\System\dtYrKNj.exe

C:\Windows\System\mOYWrmw.exe

C:\Windows\System\mOYWrmw.exe

C:\Windows\System\TSlpNAZ.exe

C:\Windows\System\TSlpNAZ.exe

C:\Windows\System\OuRsUAK.exe

C:\Windows\System\OuRsUAK.exe

C:\Windows\System\eqcgkHs.exe

C:\Windows\System\eqcgkHs.exe

C:\Windows\System\JUPEzVV.exe

C:\Windows\System\JUPEzVV.exe

C:\Windows\System\NceAesy.exe

C:\Windows\System\NceAesy.exe

C:\Windows\System\nIZJueD.exe

C:\Windows\System\nIZJueD.exe

C:\Windows\System\XLoVine.exe

C:\Windows\System\XLoVine.exe

C:\Windows\System\MBgRdXa.exe

C:\Windows\System\MBgRdXa.exe

C:\Windows\System\TfeWEdR.exe

C:\Windows\System\TfeWEdR.exe

C:\Windows\System\MYoQiFT.exe

C:\Windows\System\MYoQiFT.exe

C:\Windows\System\nOUSMNV.exe

C:\Windows\System\nOUSMNV.exe

C:\Windows\System\nZAlADD.exe

C:\Windows\System\nZAlADD.exe

C:\Windows\System\uejwMZL.exe

C:\Windows\System\uejwMZL.exe

C:\Windows\System\vFMents.exe

C:\Windows\System\vFMents.exe

C:\Windows\System\gMXnGCl.exe

C:\Windows\System\gMXnGCl.exe

C:\Windows\System\AXeiNGj.exe

C:\Windows\System\AXeiNGj.exe

C:\Windows\System\SyBcbDf.exe

C:\Windows\System\SyBcbDf.exe

C:\Windows\System\PscmcQT.exe

C:\Windows\System\PscmcQT.exe

C:\Windows\System\uKxMaKZ.exe

C:\Windows\System\uKxMaKZ.exe

C:\Windows\System\UoapVZn.exe

C:\Windows\System\UoapVZn.exe

C:\Windows\System\svdoDoG.exe

C:\Windows\System\svdoDoG.exe

C:\Windows\System\mQtsbJx.exe

C:\Windows\System\mQtsbJx.exe

C:\Windows\System\VQgbVoe.exe

C:\Windows\System\VQgbVoe.exe

C:\Windows\System\SaEtCKD.exe

C:\Windows\System\SaEtCKD.exe

C:\Windows\System\jLDaoOY.exe

C:\Windows\System\jLDaoOY.exe

C:\Windows\System\nBnobvS.exe

C:\Windows\System\nBnobvS.exe

C:\Windows\System\uJxqPTn.exe

C:\Windows\System\uJxqPTn.exe

C:\Windows\System\SEiMKdR.exe

C:\Windows\System\SEiMKdR.exe

C:\Windows\System\QMwCZVu.exe

C:\Windows\System\QMwCZVu.exe

C:\Windows\System\QMFbLqZ.exe

C:\Windows\System\QMFbLqZ.exe

C:\Windows\System\dPEIFrg.exe

C:\Windows\System\dPEIFrg.exe

C:\Windows\System\PLolAsq.exe

C:\Windows\System\PLolAsq.exe

C:\Windows\System\UzbBYZH.exe

C:\Windows\System\UzbBYZH.exe

C:\Windows\System\cygPwfR.exe

C:\Windows\System\cygPwfR.exe

C:\Windows\System\VcKcElk.exe

C:\Windows\System\VcKcElk.exe

C:\Windows\System\VTtuIZh.exe

C:\Windows\System\VTtuIZh.exe

C:\Windows\System\iRGPbKZ.exe

C:\Windows\System\iRGPbKZ.exe

C:\Windows\System\WgosexS.exe

C:\Windows\System\WgosexS.exe

C:\Windows\System\rrSgJev.exe

C:\Windows\System\rrSgJev.exe

C:\Windows\System\szLVGYE.exe

C:\Windows\System\szLVGYE.exe

C:\Windows\System\WynoGZf.exe

C:\Windows\System\WynoGZf.exe

C:\Windows\System\IXTYqEx.exe

C:\Windows\System\IXTYqEx.exe

C:\Windows\System\wGZwZSh.exe

C:\Windows\System\wGZwZSh.exe

C:\Windows\System\ZjzBQJs.exe

C:\Windows\System\ZjzBQJs.exe

C:\Windows\System\IkYIoyl.exe

C:\Windows\System\IkYIoyl.exe

C:\Windows\System\omeoUyq.exe

C:\Windows\System\omeoUyq.exe

C:\Windows\System\fPtPUDj.exe

C:\Windows\System\fPtPUDj.exe

C:\Windows\System\tDscWbx.exe

C:\Windows\System\tDscWbx.exe

C:\Windows\System\yHhetUy.exe

C:\Windows\System\yHhetUy.exe

C:\Windows\System\YQPMTBA.exe

C:\Windows\System\YQPMTBA.exe

C:\Windows\System\dCeRHpd.exe

C:\Windows\System\dCeRHpd.exe

C:\Windows\System\lWYarPB.exe

C:\Windows\System\lWYarPB.exe

C:\Windows\System\AytruOO.exe

C:\Windows\System\AytruOO.exe

C:\Windows\System\OmbXAGG.exe

C:\Windows\System\OmbXAGG.exe

C:\Windows\System\RQlLvWF.exe

C:\Windows\System\RQlLvWF.exe

C:\Windows\System\PfSKAOm.exe

C:\Windows\System\PfSKAOm.exe

C:\Windows\System\UReMchW.exe

C:\Windows\System\UReMchW.exe

C:\Windows\System\yuKSins.exe

C:\Windows\System\yuKSins.exe

C:\Windows\System\ecUjLLo.exe

C:\Windows\System\ecUjLLo.exe

C:\Windows\System\kuldOPk.exe

C:\Windows\System\kuldOPk.exe

C:\Windows\System\qwnEeWR.exe

C:\Windows\System\qwnEeWR.exe

C:\Windows\System\sJJRIEc.exe

C:\Windows\System\sJJRIEc.exe

C:\Windows\System\hNeQpXt.exe

C:\Windows\System\hNeQpXt.exe

C:\Windows\System\jNSskfP.exe

C:\Windows\System\jNSskfP.exe

C:\Windows\System\buSyKAX.exe

C:\Windows\System\buSyKAX.exe

C:\Windows\System\lbYdnkX.exe

C:\Windows\System\lbYdnkX.exe

C:\Windows\System\AppgVcE.exe

C:\Windows\System\AppgVcE.exe

C:\Windows\System\NvrOlhI.exe

C:\Windows\System\NvrOlhI.exe

C:\Windows\System\ZqaMiiY.exe

C:\Windows\System\ZqaMiiY.exe

C:\Windows\System\XSQLgpK.exe

C:\Windows\System\XSQLgpK.exe

C:\Windows\System\puiQfje.exe

C:\Windows\System\puiQfje.exe

C:\Windows\System\NlMfxpj.exe

C:\Windows\System\NlMfxpj.exe

C:\Windows\System\whxeaTw.exe

C:\Windows\System\whxeaTw.exe

C:\Windows\System\TksZNgC.exe

C:\Windows\System\TksZNgC.exe

C:\Windows\System\wEwbFgd.exe

C:\Windows\System\wEwbFgd.exe

C:\Windows\System\aIAqaeg.exe

C:\Windows\System\aIAqaeg.exe

C:\Windows\System\QDeInVZ.exe

C:\Windows\System\QDeInVZ.exe

C:\Windows\System\AbmweHX.exe

C:\Windows\System\AbmweHX.exe

C:\Windows\System\LTUmoNy.exe

C:\Windows\System\LTUmoNy.exe

C:\Windows\System\AiKspWI.exe

C:\Windows\System\AiKspWI.exe

C:\Windows\System\WMcPjZs.exe

C:\Windows\System\WMcPjZs.exe

C:\Windows\System\Znenrwf.exe

C:\Windows\System\Znenrwf.exe

C:\Windows\System\TjlRPbc.exe

C:\Windows\System\TjlRPbc.exe

C:\Windows\System\bmAQnOo.exe

C:\Windows\System\bmAQnOo.exe

C:\Windows\System\SKDvysu.exe

C:\Windows\System\SKDvysu.exe

C:\Windows\System\qVmcIJm.exe

C:\Windows\System\qVmcIJm.exe

C:\Windows\System\lRHjrsU.exe

C:\Windows\System\lRHjrsU.exe

C:\Windows\System\dCJocud.exe

C:\Windows\System\dCJocud.exe

C:\Windows\System\vSFNygm.exe

C:\Windows\System\vSFNygm.exe

C:\Windows\System\mfSCXuC.exe

C:\Windows\System\mfSCXuC.exe

C:\Windows\System\hQHiCxC.exe

C:\Windows\System\hQHiCxC.exe

C:\Windows\System\eVglahf.exe

C:\Windows\System\eVglahf.exe

C:\Windows\System\mTuqANs.exe

C:\Windows\System\mTuqANs.exe

C:\Windows\System\FbmLqCY.exe

C:\Windows\System\FbmLqCY.exe

C:\Windows\System\NzYzwWm.exe

C:\Windows\System\NzYzwWm.exe

C:\Windows\System\zdLoQFY.exe

C:\Windows\System\zdLoQFY.exe

C:\Windows\System\kDaQPHZ.exe

C:\Windows\System\kDaQPHZ.exe

C:\Windows\System\XkSGUVG.exe

C:\Windows\System\XkSGUVG.exe

C:\Windows\System\zAXOnkI.exe

C:\Windows\System\zAXOnkI.exe

C:\Windows\System\VHoRLfD.exe

C:\Windows\System\VHoRLfD.exe

C:\Windows\System\ZvsLyAp.exe

C:\Windows\System\ZvsLyAp.exe

C:\Windows\System\KaxnxtQ.exe

C:\Windows\System\KaxnxtQ.exe

C:\Windows\System\LhkWgZk.exe

C:\Windows\System\LhkWgZk.exe

C:\Windows\System\OAHUkgV.exe

C:\Windows\System\OAHUkgV.exe

C:\Windows\System\VvSXifP.exe

C:\Windows\System\VvSXifP.exe

C:\Windows\System\dybhlPS.exe

C:\Windows\System\dybhlPS.exe

C:\Windows\System\DfeRFyc.exe

C:\Windows\System\DfeRFyc.exe

C:\Windows\System\OcgxEgH.exe

C:\Windows\System\OcgxEgH.exe

C:\Windows\System\nPCSpwc.exe

C:\Windows\System\nPCSpwc.exe

C:\Windows\System\bPwWyfX.exe

C:\Windows\System\bPwWyfX.exe

C:\Windows\System\migTuvf.exe

C:\Windows\System\migTuvf.exe

C:\Windows\System\YCYiyrl.exe

C:\Windows\System\YCYiyrl.exe

C:\Windows\System\NeOirsi.exe

C:\Windows\System\NeOirsi.exe

C:\Windows\System\CoQUjkp.exe

C:\Windows\System\CoQUjkp.exe

C:\Windows\System\XoFcaAY.exe

C:\Windows\System\XoFcaAY.exe

C:\Windows\System\IxxXCqN.exe

C:\Windows\System\IxxXCqN.exe

C:\Windows\System\MwEWlDh.exe

C:\Windows\System\MwEWlDh.exe

C:\Windows\System\VYXklvW.exe

C:\Windows\System\VYXklvW.exe

C:\Windows\System\CTNehyn.exe

C:\Windows\System\CTNehyn.exe

C:\Windows\System\HljgZAc.exe

C:\Windows\System\HljgZAc.exe

C:\Windows\System\rLNlpSq.exe

C:\Windows\System\rLNlpSq.exe

C:\Windows\System\AgPYGHx.exe

C:\Windows\System\AgPYGHx.exe

C:\Windows\System\gfbLumh.exe

C:\Windows\System\gfbLumh.exe

C:\Windows\System\mlnGcaU.exe

C:\Windows\System\mlnGcaU.exe

C:\Windows\System\BFYGrtr.exe

C:\Windows\System\BFYGrtr.exe

C:\Windows\System\jfbViAR.exe

C:\Windows\System\jfbViAR.exe

C:\Windows\System\JaZkVHW.exe

C:\Windows\System\JaZkVHW.exe

C:\Windows\System\iLenNEL.exe

C:\Windows\System\iLenNEL.exe

C:\Windows\System\javKtXk.exe

C:\Windows\System\javKtXk.exe

C:\Windows\System\lLyehqI.exe

C:\Windows\System\lLyehqI.exe

C:\Windows\System\HLxJiCo.exe

C:\Windows\System\HLxJiCo.exe

C:\Windows\System\FDcCivN.exe

C:\Windows\System\FDcCivN.exe

C:\Windows\System\CfZIFVm.exe

C:\Windows\System\CfZIFVm.exe

C:\Windows\System\LlkITOH.exe

C:\Windows\System\LlkITOH.exe

C:\Windows\System\DegBBRZ.exe

C:\Windows\System\DegBBRZ.exe

C:\Windows\System\YoAlGHx.exe

C:\Windows\System\YoAlGHx.exe

C:\Windows\System\UxpROFd.exe

C:\Windows\System\UxpROFd.exe

C:\Windows\System\PKeOQTu.exe

C:\Windows\System\PKeOQTu.exe

C:\Windows\System\CVObVAC.exe

C:\Windows\System\CVObVAC.exe

C:\Windows\System\BUeWRPo.exe

C:\Windows\System\BUeWRPo.exe

C:\Windows\System\gcEYqCd.exe

C:\Windows\System\gcEYqCd.exe

C:\Windows\System\tnJsOVV.exe

C:\Windows\System\tnJsOVV.exe

C:\Windows\System\qEBrDPe.exe

C:\Windows\System\qEBrDPe.exe

C:\Windows\System\mFnGpjP.exe

C:\Windows\System\mFnGpjP.exe

C:\Windows\System\BIcceSM.exe

C:\Windows\System\BIcceSM.exe

C:\Windows\System\MoHxxuv.exe

C:\Windows\System\MoHxxuv.exe

C:\Windows\System\qLbpEVz.exe

C:\Windows\System\qLbpEVz.exe

C:\Windows\System\SlHaXHA.exe

C:\Windows\System\SlHaXHA.exe

C:\Windows\System\WoMKEWb.exe

C:\Windows\System\WoMKEWb.exe

C:\Windows\System\JQXuvkO.exe

C:\Windows\System\JQXuvkO.exe

C:\Windows\System\ofqBgkc.exe

C:\Windows\System\ofqBgkc.exe

C:\Windows\System\leZcurX.exe

C:\Windows\System\leZcurX.exe

C:\Windows\System\jmQWisa.exe

C:\Windows\System\jmQWisa.exe

C:\Windows\System\rxoAqTC.exe

C:\Windows\System\rxoAqTC.exe

C:\Windows\System\qCLalRJ.exe

C:\Windows\System\qCLalRJ.exe

C:\Windows\System\XbCdELt.exe

C:\Windows\System\XbCdELt.exe

C:\Windows\System\BZGWyDK.exe

C:\Windows\System\BZGWyDK.exe

C:\Windows\System\uHLeQOu.exe

C:\Windows\System\uHLeQOu.exe

C:\Windows\System\NZinRMC.exe

C:\Windows\System\NZinRMC.exe

C:\Windows\System\pqYPdUq.exe

C:\Windows\System\pqYPdUq.exe

C:\Windows\System\IQexjEl.exe

C:\Windows\System\IQexjEl.exe

C:\Windows\System\QmsRMJc.exe

C:\Windows\System\QmsRMJc.exe

C:\Windows\System\gwCZhNg.exe

C:\Windows\System\gwCZhNg.exe

C:\Windows\System\pvwnADj.exe

C:\Windows\System\pvwnADj.exe

C:\Windows\System\JAMLGrF.exe

C:\Windows\System\JAMLGrF.exe

C:\Windows\System\KSTtZcQ.exe

C:\Windows\System\KSTtZcQ.exe

C:\Windows\System\ujrnhnQ.exe

C:\Windows\System\ujrnhnQ.exe

Network

N/A

Files

memory/2264-0-0x000000013FE70000-0x00000001401C1000-memory.dmp

memory/2264-1-0x00000000001F0000-0x0000000000200000-memory.dmp

\Windows\system\kgRNGFr.exe

MD5	9ea8932e5a28eba68581652a50b96152
SHA1	ce82c086711190d5b1dbb743714b7f5eb9a8a141
SHA256	2c118c8f5429cf7a8270f8e3ed90064f5526b2554f14e95a671615001d59c9c7
SHA512	088eb8dca66b14cb7bc6df62e61d68952ab91e6c6f99cb078f7d712c632e70e3f507e0c695b740f0ac233830f0887ab61e1b847f8cdd7134bac3c2e844895556

memory/2264-7-0x000000013FA30000-0x000000013FD81000-memory.dmp

\Windows\system\tLWKlVW.exe

MD5	5fb80705559b8f232393e2be5fed9212
SHA1	635c49375dc83afca14c2b36fa453f1ca04e69e9
SHA256	6b76695e1b6045ee75e4ec3a382022af010bf7be1a5ed526725249ee239400a6
SHA512	167e6698066051dda6d4bd83e36ccae21053f372b25507f276a337a0d760528e7e5211dd703933ac62caca188b6e0af47b5b7aa91134b2e7cc5a6d4d611f3aad

C:\Windows\system\MVHnbRK.exe

MD5	bbf472c01806cd94fa9b90c1dbb7b9a0
SHA1	56d8bb409c5cd7fbf8d724cb6fe2c3761e177d7e
SHA256	da5fe648a816b19492334a02ca57d087f7cdaa742034560c099abe428e92409e
SHA512	cea284dedb598da70cf8129a5db589d08de80fd1536a9304e45c50e66d2a94d7487873d3e3c98502b19cd19cc680b9f1cb28253f3dd69b9e31bfc589fe9ce9eb

\Windows\system\VcqbdEO.exe

MD5	3d9b713a8d87079a32b8d674947db850
SHA1	f77869d99800c8cc1416a5bb3b18dc6b13d94c82
SHA256	5020b7838f3bfefb01feadc4c907217dbdf07df25ac649b77ae9440e50e10c6e
SHA512	358435ae3baf8d10df5c3933396a7978b35bdefbc374f9557091378efeb78d8bd76fe4c979744e295f185eda133a0efbf184cf3cc8d8a4cb6f3e3ee35a8aa115

C:\Windows\system\InzrZHW.exe

MD5	dfb0da3e19f9a58235f61f4e78b96787
SHA1	0fb5247eb17b70c6400555958eae4f542d194ff3
SHA256	630e94aff81110ec2a16cde6eba540957a3df0245ed9edcb01903069dd4d91ac
SHA512	8f8a5cd30ca34786881002b406f87953856868f77d34b14314796e28d472bf99d7cf334cbe6794da5173a3f3124ca211b649eb7e141e8393ecb37f6ea8cd6cbb

C:\Windows\system\IIDkpUW.exe

MD5	b578787ec9a7170d3d8643a2e0ea65e7
SHA1	cd5c3e5d30b713061cf06cc7e53891186f8c03cf
SHA256	7487b3ee1ad2bf84deed6396eefe2e6fe82ab71f367cb2bece65dc9a7a38f7be
SHA512	ac68de45cfc8ed9793ddfdc186a24252e34f0191aa2db9b004904f15bf78836d016ff2284c4c47b290b0df294c46e1b7f157b824410b8499f0931caafa519f59

C:\Windows\system\uBvgyZs.exe

MD5	15910fa086c91a7f684307afcf72d64f
SHA1	4a421ce458062a1c46ae94e6a09db85b7d79abd9
SHA256	26150f63800da29df0556fc003f22754e8466d301d2ca1da61addb664e82b645
SHA512	2a9d2f190f13f2522e4ec4ec1f841142636bb7bb642f45e4fb3891ed083f7a867def450c890867c7f7a1d3ed21dda3073974ce893d8425bb33ad1556a8a6ba9a

C:\Windows\system\VAPuWyZ.exe

MD5	fc2f725c2001a8c3530596078ab4d800
SHA1	ed6821f701e4a54cc8b8dccf0da0435a9983bc12
SHA256	cbb893f1a784b79c0cd638a8f905a3aa9cf060f01a36d58c2d419652c908cc41
SHA512	bf3e7a15ea2c21dba96c8c34d93424c2e5857bdb06fccba49b5440ada683d847fa0c76545fb3081c8c0cf963e6bf12c7a5887dcb13ddcacf3be98b3e59b26254

C:\Windows\system\LiXwUsD.exe

MD5	25f00856875c7c47fc415b8181e8d0ae
SHA1	15ca7b212ccea97220c31c4f976e7e0de733db1b
SHA256	dfc355e50b100bbed555ba2c06c993363b592400badd9bbb88cad043fd1cddd4
SHA512	7edad69738ef05f09afe291a665319df976f48e7383cc02aba89cf1d8ac9bcd14652c84cdda01e5f6f05d0b17c88a7971fce9591e8b4cd738b775961748eb241

C:\Windows\system\AmdJtic.exe

MD5	21469fb7e56f28840339d89607605ac0
SHA1	2820ba21f9b896e7e41324a34e4b57b26bdc6707
SHA256	62f86a8ff4741dfbe240f3d5556848a8c59310f7bab872ecadbc0d80966fe573
SHA512	29085f5aefb328f03f4df0b5dd4bda287da2ed697ab3db6de7629befa7c59acf05590aabae098682616f82fc36e81a9b4ce34b9e2464b918e20205c450b7b1b4

C:\Windows\system\NrffVCj.exe

MD5	9f64e5603a3fe269ad771b77791fbe01
SHA1	a7b93069b662cb43febcbe63b7ea472ddb9a6107
SHA256	ae93fef112e18bdf121a0fb2398e8f0337c8393b51c40e6b0cdc34e75684bf1a
SHA512	fb6d46a2f6a6eee6d6264cdf711f20193fa64e586441a92881e91c28b4805c0fd0894358b3625aaa4e0afef163c8a202937a02f9d85d0b7fc2da58a5dcaa8fb1

C:\Windows\system\WmZxWEL.exe

MD5	48237d761a583caec0291ca028c86756
SHA1	e2bb8210f9f23a4131bff321d24313a76c6e3f9d
SHA256	d12ac9e6cd3cbda7a1bb6fbca2c1402da0b26be47e1ae809d20e6d480346347f
SHA512	72055e187ee639f78f0b75bd0af7bb7179a7892efa30c1f525f4bc59e83606b86268271885b1dedcc51a4bb77bbe705ba016986a1bbf89614a09229bf3ccfd1b

C:\Windows\system\JaayroQ.exe

MD5	a726a3e164fc27cefe0e300a1ec1eb99
SHA1	00ae0ac249d3c0720fbe2fda6429c0f460b28179
SHA256	cd0ed3b4f1bea7f7cf9b5530fe8ca8a5ae900e4512d04b0a1ff466639cfe132d
SHA512	17ff9b900877c531d678e845fa9691c7a0f2958dce2cfb4319e38b2e5413b7a49b3730f983c46be2029beaa10d13a47dab3a53446b7b79ef82819abfec7785f3

C:\Windows\system\HrlMqbK.exe

MD5	b1e58a26b88d93b2bdc92be229f81f6a
SHA1	e3363ead79a43994bba3529e9b4be3832bbf2b46
SHA256	095a2b62910a11cc674b6ddad3a44cb9118f50a8d6ae9969051ed76b3efeec87
SHA512	725ebcac425e9c74a992b269336db241b5bd6e2757f175b7cf6256033cc9600898bc0d0f01afc1c72259f276dff6c7e93b0f45a29e64bd806801bf314ad94fba

C:\Windows\system\lvyaHUG.exe

MD5	714b6ee6cccf6054380080f605271f73
SHA1	4e11c4911c416ea3f9f6946945359a72995b6e1e
SHA256	84d246dcabed8e150557d34da4ebf3594f7c24b967bcdd24311306d62793c6ea
SHA512	ad168f62730b8f1b4e9458e23ae5029df2a7e9278c1224200c1277d2bbdaa0c9fefb0003c5d73cff77d97c59cfd7e08fe821d9a62d0d030b476d76a820ca0188

C:\Windows\system\NQJxJnh.exe

MD5	724fe1b9bae80ffd8c5b4ba88c6fce02
SHA1	3a525721fe3eeaaf1cf2ab7dc436d46ec2d867ab
SHA256	985b69fadd38d63b366bc0c05aa1646cc5bf461a562ea0d0732a96afc9826a7c
SHA512	e339a301061f679d1e2c8b0aa9540708ba7af6a72de78a1f2644ad2993404371d0abafc16cd14d4abf04cc1ee25933917152dd4a4f8b06bc921b6cfd0a451cb4

C:\Windows\system\clbFDVd.exe

MD5	2f8a29fa96c8df41add0a108cfa424e3
SHA1	014afab0092743ea48d25be4bc2f53c532072d36
SHA256	2d5c8073cf6d4ac0bc3e829633027500085a32817262b647559c665459fa2ba8
SHA512	c7f596f1b56313bc24d03353d7413487b7a6f7ff317e7eeff96f2c36c639f9ce737b855026843bdb5751241d0a689630f83faedadadddf6433ebe4bbd05d4186

C:\Windows\system\plXHVkW.exe

MD5	873e567ca008904131bc676f71ab1f55
SHA1	3c9cf05c85c3d686d478ba1d53319cbf2bdb241a
SHA256	5158b1892a845149b97c19c40467e9a2ab3b57f0d823ea281ac6bb0bc9bb0c87
SHA512	b590079dd4db53483d950d398f96e843776c790a4b382457a4c5f160fc71676c17256ce86ff099c59e8db3930004e863f9522239d1cf653143dd346200dc2514

C:\Windows\system\BfCxhGW.exe

MD5	9836a56c54838e6dae7e7eb036b20021
SHA1	199c244788064efe3a1183210734e8781a2f3616
SHA256	39430f90acbcd1e720153e785c6419e8051cb95c5b0fada0ce1e8a4d9e6bd3f8
SHA512	eaafac2a47988800dfd42a4d8ac67269154e6426dfe5ccba15e3a7f7c89a9d5b469015e1abbae9d2473356451360d4aa7f276311b5ad118027aa16bc36e63cf2

memory/2264-104-0x000000013F460000-0x000000013F7B1000-memory.dmp

memory/2580-103-0x000000013FC10000-0x000000013FF61000-memory.dmp

memory/2648-102-0x000000013FD70000-0x00000001400C1000-memory.dmp

memory/2588-101-0x000000013F810000-0x000000013FB61000-memory.dmp

C:\Windows\system\gZUGDSa.exe

MD5	b38ab33c6ab73a467f25d608423afbe6
SHA1	8b801e7d7bd52d32dedb912c4f562e4edef0efd5
SHA256	29a44ad6acf6d13427dd8664a9fd786d1c7c0b92c094c9af7b6430ddfd5279c1
SHA512	b48bc586a93d6e799363d1ecf11c9f4807e486e79e08e2511bb3979c62d11e172198aa5d16830388bec1a7cf67af171c0f4109052a55ea7d50d4f54a5a59d67c

C:\Windows\system\cZmXroi.exe

MD5	93a5cca2199238c3961fcb0e236302ad
SHA1	1b6b437f9124eec33472c017a32e7532dca6197e
SHA256	717fae46a3244064ebd1f4201dd8ac2281ebf6dbc8c384e2c3fa1f110de6eda0
SHA512	abe3657096777c305055d780068a76a177336e7fb1766a2067f87a1aadd8e873240ca6ae32350be5f35947f40027d4b21507964eff6c3ac2b69b1e3afa26a5f1

memory/2264-87-0x000000013F120000-0x000000013F471000-memory.dmp

memory/684-86-0x000000013F940000-0x000000013FC91000-memory.dmp

memory/2264-85-0x0000000001F80000-0x00000000022D1000-memory.dmp

\Windows\system\scaHoTu.exe

MD5	c2305ebec58200fe687f55b6c4f86b53
SHA1	438186d20d0ad8d47711327bb501d9ab6074e7d3
SHA256	a073be988dc4bffd1704dd20b3d01e42e1d43959086731bfc36349b50ae5a807
SHA512	98eda7419c860dcb78274c7c1d46b0466d1b814df3afb49fe2906607ed6edd2f579f0be704b02234f10240090a22977c17faea8e6286011ec9b6c0b61e244df5

\Windows\system\esNZPuY.exe

MD5	66038bc0cb71339627c2b58ea8e29830
SHA1	eef3fa100849e6e6cc58a9787b07af821907bf6e
SHA256	a01d650dd23547fa94b9918bdf4bff3c97fc327773cb29f2135678b1cc71a6a1
SHA512	0eb97781deddd0608366673351866f74186796eb5487833a7baa30d37a7afdda6271308d3cd1cb4ef0a26db83cfc78496e9a6fec4bd67a0385ddc5be5c6a7160

memory/3004-58-0x000000013FA30000-0x000000013FD81000-memory.dmp

\Windows\system\VkaFmBR.exe

MD5	b2f37f05ced90e73eff915f7cf7699ae
SHA1	b18cf153492d56e66a168ed8a237e81a6cac8fee
SHA256	ef13bf5a4e5e58375ab5d0c15ed87f387231f5b9c2f9a26330bfd62685083ea8
SHA512	c7eb14b4d15d5968cd1f62a4b31f2f2912d69aa5fcf5c3e771121fd45faeb36a8d529661965c21c320c8102daef43dd744743d2e3d21a9d6964216cc4a66bd61

memory/2812-48-0x000000013F980000-0x000000013FCD1000-memory.dmp

memory/2264-47-0x0000000001F80000-0x00000000022D1000-memory.dmp

C:\Windows\system\qejdoFC.exe

MD5	d8ead8f8594c1a9c49a9bf84be542657
SHA1	f99e16a207c9f0aba6849bfbc3c6e858d0b7cd80
SHA256	9ee6af4dd8f07f2fb4115b95d0b4e739d5ccde23a20b94fda5e26661ce6dbf3c
SHA512	a36709f02faf56a4c14e417937cbb6581772d00ef609ecf76eb3c24afb87d0fa9ec7316fcb77b79cc066cc657207694a24c315dd0daf477370388574b86cc0fc

\Windows\system\EEKSuxy.exe

MD5	91dcf9f6794deee08c9d332562cf86e8
SHA1	a22353cb15776822b7e5e4b9e6c6784a3b4cd1c8
SHA256	2f4cd7d1e29d491e13aa2e00c40b0697891d10cc17658a5458d2b55d3304870a
SHA512	dd19bee7c1a0a2a2e0fbc9aff961ccfaf844d4b9483adde962f84e8db8ee4722679cf12a1addc07f1b60e8acde9c2dc11be98d5a0323524d22d00601c368f37e

memory/2264-39-0x000000013F810000-0x000000013FB61000-memory.dmp

C:\Windows\system\DunWGVd.exe

MD5	6964d9c43e7d78b68f8bb95a97501feb
SHA1	db51c2766dd1e44688f50a99b1a793fd645c17c7
SHA256	167027f69c3125c522c27cac9e62c87b24ca68d601529f394e45021dd083c5c1
SHA512	a2fa3f0b92259f767f8c47f0f53ba08bf402686426bc43ffce1da53ee6615e8841896bc52d9b36d2721a26bd7e8905b90651561bc929b6a47a0eb6d4433b1f9d

memory/2308-28-0x000000013FF10000-0x0000000140261000-memory.dmp

C:\Windows\system\MIdWDGr.exe

MD5	b963f72541b7139959316f1922b6cfbd
SHA1	1ac31dacfd81edf021d19f8dacb5eb8000ec039e
SHA256	ad01265120726cb414539a75d3c97df1758bb0413fe24b293724989e6771ee36
SHA512	0207414be287bd393d514ec22d70521dfe0f9ca7aa636b9745bc5f1f361b2b61ee225e845c992391515be05ee5e56a5fb0dfc5f551580a2cd3c7cbad35e7c4b8

memory/2480-81-0x000000013FB80000-0x000000013FED1000-memory.dmp

C:\Windows\system\zBXZERf.exe

MD5	4efeeb9df5c5bd4dc7b0bcc349f592f8
SHA1	c514643e0bb54a1b31b260ff8b7b452aa8e79c43
SHA256	360638dfd6d1af8c2a9b19c441ffcbbf13a67f4dd9e75bccbf187adfc53f5962
SHA512	fd20bf887339b2e3027ee5b58d9818fd51b595e90e99da97d367e99027ec2f08e983b8e9df0f9b1209623ed657bc1ff253a56884924ae0b240c52c00acfd3c39

memory/2264-79-0x0000000001F80000-0x00000000022D1000-memory.dmp

memory/2264-72-0x000000013F110000-0x000000013F461000-memory.dmp

memory/2404-71-0x000000013F490000-0x000000013F7E1000-memory.dmp

memory/2264-70-0x000000013F490000-0x000000013F7E1000-memory.dmp

memory/2264-69-0x0000000001F80000-0x00000000022D1000-memory.dmp

memory/2264-68-0x000000013F980000-0x000000013FCD1000-memory.dmp

memory/2264-67-0x0000000001F80000-0x00000000022D1000-memory.dmp

memory/2668-66-0x000000013FE30000-0x0000000140181000-memory.dmp

memory/2264-65-0x0000000001F80000-0x00000000022D1000-memory.dmp

C:\Windows\system\xszfSsR.exe

MD5	2f28c70d11ef46654479cd4311470499
SHA1	5617afff0dba83a3636dc789d9344a23f539837b
SHA256	c285693004f656d52cda870ecdd1084fb937e033f729fc0a41dd33d26d002096
SHA512	8a71d0a46acd71d6f4d0bc5b3cbd962622579236474322ed7d793ed96ce40640037ce826a79b292dae4a12a6058043c4fa307fa856ab7f8afeb405936092a2c1

memory/2264-63-0x000000013F0D0000-0x000000013F421000-memory.dmp

memory/2608-54-0x000000013FF60000-0x00000001402B1000-memory.dmp

memory/2264-53-0x0000000001F80000-0x00000000022D1000-memory.dmp

C:\Windows\system\PVrrPJh.exe

MD5	e7785d7899027fce67a531f1d38d70e4
SHA1	2d537560f09a814867b0f91c3fa20474ff547e05
SHA256	52f7bae681750eb85d51acd1ec4b2022a26a95a2cbdb174701fc25a4295b9b0c
SHA512	4044de80857ec500fcb72823a66368eee35429ea6d5915f08b52389fcee6787efec9595bcf30008aa183f12961ab6631da0d292c3b63e3a14f75ec5ff2fd83e6

memory/2264-26-0x0000000001F80000-0x00000000022D1000-memory.dmp

C:\Windows\system\JeRWwke.exe

MD5	f4f9b779c32b8ad5ba0eb433d825b9bf
SHA1	131d3b5ba062d64b24799f7f6978594f6239fa42
SHA256	942d881d0731c96a487e1849e7e14f952eef712e0d7f5fddfb9571c7788e94a3
SHA512	da4714325d52a1f5c83579044b340f086adb0e9fbebb526194371e275ed5d34a199d76cb0a6b8b940303be5c16b555f0eb60c81be37609b24c0fbe07a5e72670

memory/1168-24-0x000000013F0D0000-0x000000013F421000-memory.dmp

memory/2264-1220-0x0000000001F80000-0x00000000022D1000-memory.dmp

memory/3004-3529-0x000000013FA30000-0x000000013FD81000-memory.dmp

memory/2812-3530-0x000000013F980000-0x000000013FCD1000-memory.dmp

memory/2588-3578-0x000000013F810000-0x000000013FB61000-memory.dmp

memory/2580-3580-0x000000013FC10000-0x000000013FF61000-memory.dmp

memory/1168-3573-0x000000013F0D0000-0x000000013F421000-memory.dmp

memory/2648-3571-0x000000013FD70000-0x00000001400C1000-memory.dmp

memory/2308-3836-0x000000013FF10000-0x0000000140261000-memory.dmp

memory/2404-4206-0x000000013F490000-0x000000013F7E1000-memory.dmp

memory/2668-4245-0x000000013FE30000-0x0000000140181000-memory.dmp

memory/2608-4638-0x000000013FF60000-0x00000001402B1000-memory.dmp

memory/684-4643-0x000000013F940000-0x000000013FC91000-memory.dmp

memory/2480-4640-0x000000013FB80000-0x000000013FED1000-memory.dmp

memory/2264-4874-0x000000013FE70000-0x00000001401C1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 21:58

Reported

2024-06-13 22:01

Platform

win10v2004-20240611-en

Max time kernel

141s

Max time network

116s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\RmcROBk.exe	N/A
N/A	N/A	C:\Windows\System\qBIuYik.exe	N/A
N/A	N/A	C:\Windows\System\bbkJkyj.exe	N/A
N/A	N/A	C:\Windows\System\ENLAHmh.exe	N/A
N/A	N/A	C:\Windows\System\IIrBYHu.exe	N/A
N/A	N/A	C:\Windows\System\GwLsDCN.exe	N/A
N/A	N/A	C:\Windows\System\EFMdJvy.exe	N/A
N/A	N/A	C:\Windows\System\YSpWFhl.exe	N/A
N/A	N/A	C:\Windows\System\mkRaudy.exe	N/A
N/A	N/A	C:\Windows\System\MsSKrXh.exe	N/A
N/A	N/A	C:\Windows\System\dlzOZDM.exe	N/A
N/A	N/A	C:\Windows\System\mrzamTK.exe	N/A
N/A	N/A	C:\Windows\System\KCqElDh.exe	N/A
N/A	N/A	C:\Windows\System\ZwYxXXS.exe	N/A
N/A	N/A	C:\Windows\System\WoSvRxv.exe	N/A
N/A	N/A	C:\Windows\System\iSHbYXt.exe	N/A
N/A	N/A	C:\Windows\System\QnWETbE.exe	N/A
N/A	N/A	C:\Windows\System\Ctpicdg.exe	N/A
N/A	N/A	C:\Windows\System\SPejKUP.exe	N/A
N/A	N/A	C:\Windows\System\dNEcCVB.exe	N/A
N/A	N/A	C:\Windows\System\TXonZPQ.exe	N/A
N/A	N/A	C:\Windows\System\dhOPkHz.exe	N/A
N/A	N/A	C:\Windows\System\ZYiJgor.exe	N/A
N/A	N/A	C:\Windows\System\KYEAxde.exe	N/A
N/A	N/A	C:\Windows\System\ufxLDsq.exe	N/A
N/A	N/A	C:\Windows\System\kFQEeZC.exe	N/A
N/A	N/A	C:\Windows\System\bUBByDe.exe	N/A
N/A	N/A	C:\Windows\System\RvrqHZe.exe	N/A
N/A	N/A	C:\Windows\System\lVGEglM.exe	N/A
N/A	N/A	C:\Windows\System\NprccEO.exe	N/A
N/A	N/A	C:\Windows\System\pjmndCl.exe	N/A
N/A	N/A	C:\Windows\System\xfDhMhc.exe	N/A
N/A	N/A	C:\Windows\System\WxFiiDI.exe	N/A
N/A	N/A	C:\Windows\System\UfgeyLY.exe	N/A
N/A	N/A	C:\Windows\System\nJklVHv.exe	N/A
N/A	N/A	C:\Windows\System\VQmISsx.exe	N/A
N/A	N/A	C:\Windows\System\KAuPvRq.exe	N/A
N/A	N/A	C:\Windows\System\WVitOFJ.exe	N/A
N/A	N/A	C:\Windows\System\VBsJFws.exe	N/A
N/A	N/A	C:\Windows\System\hXRYQBS.exe	N/A
N/A	N/A	C:\Windows\System\siWwAmT.exe	N/A
N/A	N/A	C:\Windows\System\wOvFGvf.exe	N/A
N/A	N/A	C:\Windows\System\BWFNVVh.exe	N/A
N/A	N/A	C:\Windows\System\pHJdoUY.exe	N/A
N/A	N/A	C:\Windows\System\ATnoDwj.exe	N/A
N/A	N/A	C:\Windows\System\HLYjlRJ.exe	N/A
N/A	N/A	C:\Windows\System\hJkbkAx.exe	N/A
N/A	N/A	C:\Windows\System\KOmFfNF.exe	N/A
N/A	N/A	C:\Windows\System\piUCuGc.exe	N/A
N/A	N/A	C:\Windows\System\mserqNm.exe	N/A
N/A	N/A	C:\Windows\System\yzEJkkZ.exe	N/A
N/A	N/A	C:\Windows\System\IpEcMJn.exe	N/A
N/A	N/A	C:\Windows\System\dlqDWvv.exe	N/A
N/A	N/A	C:\Windows\System\peCemvY.exe	N/A
N/A	N/A	C:\Windows\System\RpCMIjN.exe	N/A
N/A	N/A	C:\Windows\System\EquPNYo.exe	N/A
N/A	N/A	C:\Windows\System\FrjqDJh.exe	N/A
N/A	N/A	C:\Windows\System\KGHKihy.exe	N/A
N/A	N/A	C:\Windows\System\GEZfWFd.exe	N/A
N/A	N/A	C:\Windows\System\gyqFcIB.exe	N/A
N/A	N/A	C:\Windows\System\RLwpfhQ.exe	N/A
N/A	N/A	C:\Windows\System\doSwWoV.exe	N/A
N/A	N/A	C:\Windows\System\NIFYCOY.exe	N/A
N/A	N/A	C:\Windows\System\dsJUMFu.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\UYuhwtP.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ftJnisO.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dJDTUBv.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qXDQeWU.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qUbPtJL.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mgaDnQu.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HjUoilV.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mKIIAWO.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MBTfOTo.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gVdGRss.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lEzXsXp.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gAQGKgm.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ooLvzID.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gkKYIqh.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AbtPlrQ.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aPhUYLJ.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XcxvLGo.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lJvDWhd.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Spthvzh.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RvrqHZe.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pjmndCl.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iQzhKXe.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kTNxYje.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SbFUqUG.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AuqrHRI.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dCWVRDg.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lsrceDH.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iHwmfVW.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MTwMeEr.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HiLTNJl.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dprZpSz.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jdFnUOf.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zxWMLSl.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gAFAnba.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ufxLDsq.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uLnmZTo.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FTVVWyh.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cjbwkOC.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rmsiITb.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uRIwzWX.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cEPGwMw.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nNIKVwD.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\thoOqDj.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ijMwkMu.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OtKYXra.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XNexvDL.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zCTnnfk.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xWBtrtK.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LjObTjn.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iONwJwG.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rTDbXlA.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CxQTJmh.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jscLZGL.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\udAPUgL.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qJSehdy.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vXgOwNX.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gtQsWJv.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qRyxWOK.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PznONfn.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MrgHgia.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xrAVSio.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ctZcSht.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hJrwJyt.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qumOrja.exe	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	N/A

Checks SCSI registry key(s)

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	C:\Windows\system32\dwm.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	C:\Windows\system32\dwm.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	C:\Windows\system32\dwm.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	C:\Windows\system32\dwm.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	C:\Windows\system32\dwm.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	C:\Windows\system32\dwm.exe	N/A

Enumerates system info in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Windows\system32\dwm.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	C:\Windows\system32\dwm.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	C:\Windows\system32\dwm.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeCreateGlobalPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A
Token: SeChangeNotifyPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A
Token: 33	N/A	C:\Windows\system32\dwm.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\system32\dwm.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1572 wrote to memory of 2228	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\RmcROBk.exe
PID 1572 wrote to memory of 2228	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\RmcROBk.exe
PID 1572 wrote to memory of 916	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\qBIuYik.exe
PID 1572 wrote to memory of 916	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\qBIuYik.exe
PID 1572 wrote to memory of 1716	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\bbkJkyj.exe
PID 1572 wrote to memory of 1716	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\bbkJkyj.exe
PID 1572 wrote to memory of 464	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\ENLAHmh.exe
PID 1572 wrote to memory of 464	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\ENLAHmh.exe
PID 1572 wrote to memory of 1728	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\IIrBYHu.exe
PID 1572 wrote to memory of 1728	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\IIrBYHu.exe
PID 1572 wrote to memory of 4800	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\GwLsDCN.exe
PID 1572 wrote to memory of 4800	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\GwLsDCN.exe
PID 1572 wrote to memory of 4980	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\EFMdJvy.exe
PID 1572 wrote to memory of 4980	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\EFMdJvy.exe
PID 1572 wrote to memory of 1956	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\YSpWFhl.exe
PID 1572 wrote to memory of 1956	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\YSpWFhl.exe
PID 1572 wrote to memory of 3872	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\mkRaudy.exe
PID 1572 wrote to memory of 3872	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\mkRaudy.exe
PID 1572 wrote to memory of 3056	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\MsSKrXh.exe
PID 1572 wrote to memory of 3056	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\MsSKrXh.exe
PID 1572 wrote to memory of 1360	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\dlzOZDM.exe
PID 1572 wrote to memory of 1360	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\dlzOZDM.exe
PID 1572 wrote to memory of 1356	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\mrzamTK.exe
PID 1572 wrote to memory of 1356	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\mrzamTK.exe
PID 1572 wrote to memory of 864	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\KCqElDh.exe
PID 1572 wrote to memory of 864	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\KCqElDh.exe
PID 1572 wrote to memory of 1376	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\ZwYxXXS.exe
PID 1572 wrote to memory of 1376	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\ZwYxXXS.exe
PID 1572 wrote to memory of 3584	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\WoSvRxv.exe
PID 1572 wrote to memory of 3584	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\WoSvRxv.exe
PID 1572 wrote to memory of 3156	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\iSHbYXt.exe
PID 1572 wrote to memory of 3156	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\iSHbYXt.exe
PID 1572 wrote to memory of 968	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\QnWETbE.exe
PID 1572 wrote to memory of 968	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\QnWETbE.exe
PID 1572 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\Ctpicdg.exe
PID 1572 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\Ctpicdg.exe
PID 1572 wrote to memory of 4264	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\SPejKUP.exe
PID 1572 wrote to memory of 4264	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\SPejKUP.exe
PID 1572 wrote to memory of 436	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\dNEcCVB.exe
PID 1572 wrote to memory of 436	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\dNEcCVB.exe
PID 1572 wrote to memory of 3200	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\TXonZPQ.exe
PID 1572 wrote to memory of 3200	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\TXonZPQ.exe
PID 1572 wrote to memory of 5112	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\dhOPkHz.exe
PID 1572 wrote to memory of 5112	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\dhOPkHz.exe
PID 1572 wrote to memory of 2648	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\ZYiJgor.exe
PID 1572 wrote to memory of 2648	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\ZYiJgor.exe
PID 1572 wrote to memory of 3160	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\KYEAxde.exe
PID 1572 wrote to memory of 3160	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\KYEAxde.exe
PID 1572 wrote to memory of 1496	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\ufxLDsq.exe
PID 1572 wrote to memory of 1496	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\ufxLDsq.exe
PID 1572 wrote to memory of 1604	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\kFQEeZC.exe
PID 1572 wrote to memory of 1604	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\kFQEeZC.exe
PID 1572 wrote to memory of 4884	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\bUBByDe.exe
PID 1572 wrote to memory of 4884	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\bUBByDe.exe
PID 1572 wrote to memory of 2612	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\RvrqHZe.exe
PID 1572 wrote to memory of 2612	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\RvrqHZe.exe
PID 1572 wrote to memory of 4056	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\lVGEglM.exe
PID 1572 wrote to memory of 4056	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\lVGEglM.exe
PID 1572 wrote to memory of 3096	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\NprccEO.exe
PID 1572 wrote to memory of 3096	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\NprccEO.exe
PID 1572 wrote to memory of 904	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\pjmndCl.exe
PID 1572 wrote to memory of 904	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\pjmndCl.exe
PID 1572 wrote to memory of 1524	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\xfDhMhc.exe
PID 1572 wrote to memory of 1524	N/A	C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe	C:\Windows\System\xfDhMhc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe"

C:\Windows\System\RmcROBk.exe

C:\Windows\System\RmcROBk.exe

C:\Windows\System\qBIuYik.exe

C:\Windows\System\qBIuYik.exe

C:\Windows\System\bbkJkyj.exe

C:\Windows\System\bbkJkyj.exe

C:\Windows\System\ENLAHmh.exe

C:\Windows\System\ENLAHmh.exe

C:\Windows\System\IIrBYHu.exe

C:\Windows\System\IIrBYHu.exe

C:\Windows\System\GwLsDCN.exe

C:\Windows\System\GwLsDCN.exe

C:\Windows\System\EFMdJvy.exe

C:\Windows\System\EFMdJvy.exe

C:\Windows\System\YSpWFhl.exe

C:\Windows\System\YSpWFhl.exe

C:\Windows\System\mkRaudy.exe

C:\Windows\System\mkRaudy.exe

C:\Windows\System\MsSKrXh.exe

C:\Windows\System\MsSKrXh.exe

C:\Windows\System\dlzOZDM.exe

C:\Windows\System\dlzOZDM.exe

C:\Windows\System\mrzamTK.exe

C:\Windows\System\mrzamTK.exe

C:\Windows\System\KCqElDh.exe

C:\Windows\System\KCqElDh.exe

C:\Windows\System\ZwYxXXS.exe

C:\Windows\System\ZwYxXXS.exe

C:\Windows\System\WoSvRxv.exe

C:\Windows\System\WoSvRxv.exe

C:\Windows\System\iSHbYXt.exe

C:\Windows\System\iSHbYXt.exe

C:\Windows\System\QnWETbE.exe

C:\Windows\System\QnWETbE.exe

C:\Windows\System\Ctpicdg.exe

C:\Windows\System\Ctpicdg.exe

C:\Windows\System\SPejKUP.exe

C:\Windows\System\SPejKUP.exe

C:\Windows\System\dNEcCVB.exe

C:\Windows\System\dNEcCVB.exe

C:\Windows\System\TXonZPQ.exe

C:\Windows\System\TXonZPQ.exe

C:\Windows\System\dhOPkHz.exe

C:\Windows\System\dhOPkHz.exe

C:\Windows\System\ZYiJgor.exe

C:\Windows\System\ZYiJgor.exe

C:\Windows\System\KYEAxde.exe

C:\Windows\System\KYEAxde.exe

C:\Windows\System\ufxLDsq.exe

C:\Windows\System\ufxLDsq.exe

C:\Windows\System\kFQEeZC.exe

C:\Windows\System\kFQEeZC.exe

C:\Windows\System\bUBByDe.exe

C:\Windows\System\bUBByDe.exe

C:\Windows\System\RvrqHZe.exe

C:\Windows\System\RvrqHZe.exe

C:\Windows\System\lVGEglM.exe

C:\Windows\System\lVGEglM.exe

C:\Windows\System\NprccEO.exe

C:\Windows\System\NprccEO.exe

C:\Windows\System\pjmndCl.exe

C:\Windows\System\pjmndCl.exe

C:\Windows\System\xfDhMhc.exe

C:\Windows\System\xfDhMhc.exe

C:\Windows\System\WxFiiDI.exe

C:\Windows\System\WxFiiDI.exe

C:\Windows\System\UfgeyLY.exe

C:\Windows\System\UfgeyLY.exe

C:\Windows\System\nJklVHv.exe

C:\Windows\System\nJklVHv.exe

C:\Windows\System\VQmISsx.exe

C:\Windows\System\VQmISsx.exe

C:\Windows\System\KAuPvRq.exe

C:\Windows\System\KAuPvRq.exe

C:\Windows\System\WVitOFJ.exe

C:\Windows\System\WVitOFJ.exe

C:\Windows\System\VBsJFws.exe

C:\Windows\System\VBsJFws.exe

C:\Windows\System\hXRYQBS.exe

C:\Windows\System\hXRYQBS.exe

C:\Windows\System\siWwAmT.exe

C:\Windows\System\siWwAmT.exe

C:\Windows\System\wOvFGvf.exe

C:\Windows\System\wOvFGvf.exe

C:\Windows\System\BWFNVVh.exe

C:\Windows\System\BWFNVVh.exe

C:\Windows\System\pHJdoUY.exe

C:\Windows\System\pHJdoUY.exe

C:\Windows\System\ATnoDwj.exe

C:\Windows\System\ATnoDwj.exe

C:\Windows\System\HLYjlRJ.exe

C:\Windows\System\HLYjlRJ.exe

C:\Windows\System\hJkbkAx.exe

C:\Windows\System\hJkbkAx.exe

C:\Windows\System\KOmFfNF.exe

C:\Windows\System\KOmFfNF.exe

C:\Windows\System\piUCuGc.exe

C:\Windows\System\piUCuGc.exe

C:\Windows\System\mserqNm.exe

C:\Windows\System\mserqNm.exe

C:\Windows\System\yzEJkkZ.exe

C:\Windows\System\yzEJkkZ.exe

C:\Windows\System\IpEcMJn.exe

C:\Windows\System\IpEcMJn.exe

C:\Windows\System\dlqDWvv.exe

C:\Windows\System\dlqDWvv.exe

C:\Windows\System\peCemvY.exe

C:\Windows\System\peCemvY.exe

C:\Windows\System\RpCMIjN.exe

C:\Windows\System\RpCMIjN.exe

C:\Windows\System\EquPNYo.exe

C:\Windows\System\EquPNYo.exe

C:\Windows\System\FrjqDJh.exe

C:\Windows\System\FrjqDJh.exe

C:\Windows\System\KGHKihy.exe

C:\Windows\System\KGHKihy.exe

C:\Windows\System\GEZfWFd.exe

C:\Windows\System\GEZfWFd.exe

C:\Windows\System\gyqFcIB.exe

C:\Windows\System\gyqFcIB.exe

C:\Windows\System\RLwpfhQ.exe

C:\Windows\System\RLwpfhQ.exe

C:\Windows\System\doSwWoV.exe

C:\Windows\System\doSwWoV.exe

C:\Windows\System\NIFYCOY.exe

C:\Windows\System\NIFYCOY.exe

C:\Windows\System\dsJUMFu.exe

C:\Windows\System\dsJUMFu.exe

C:\Windows\System\gQlcQAe.exe

C:\Windows\System\gQlcQAe.exe

C:\Windows\System\vYqSXCg.exe

C:\Windows\System\vYqSXCg.exe

C:\Windows\System\mKIIAWO.exe

C:\Windows\System\mKIIAWO.exe

C:\Windows\System\HTiSupU.exe

C:\Windows\System\HTiSupU.exe

C:\Windows\System\hrDoHLg.exe

C:\Windows\System\hrDoHLg.exe

C:\Windows\System\zCTnnfk.exe

C:\Windows\System\zCTnnfk.exe

C:\Windows\System\iamuFIU.exe

C:\Windows\System\iamuFIU.exe

C:\Windows\System\lQjzzub.exe

C:\Windows\System\lQjzzub.exe

C:\Windows\System\spaQAnR.exe

C:\Windows\System\spaQAnR.exe

C:\Windows\System\OTgscVe.exe

C:\Windows\System\OTgscVe.exe

C:\Windows\System\KcFrxrN.exe

C:\Windows\System\KcFrxrN.exe

C:\Windows\System\cncXTWg.exe

C:\Windows\System\cncXTWg.exe

C:\Windows\System\fzDQDit.exe

C:\Windows\System\fzDQDit.exe

C:\Windows\System\uLnmZTo.exe

C:\Windows\System\uLnmZTo.exe

C:\Windows\System\ASndTgk.exe

C:\Windows\System\ASndTgk.exe

C:\Windows\System\yyRnwaE.exe

C:\Windows\System\yyRnwaE.exe

C:\Windows\System\SHeMUOh.exe

C:\Windows\System\SHeMUOh.exe

C:\Windows\System\aQHmRAd.exe

C:\Windows\System\aQHmRAd.exe

C:\Windows\System\aRQpPAh.exe

C:\Windows\System\aRQpPAh.exe

C:\Windows\System\hbNqmCn.exe

C:\Windows\System\hbNqmCn.exe

C:\Windows\System\tejTKFe.exe

C:\Windows\System\tejTKFe.exe

C:\Windows\System\EIyoiUZ.exe

C:\Windows\System\EIyoiUZ.exe

C:\Windows\System\SkpVTKO.exe

C:\Windows\System\SkpVTKO.exe

C:\Windows\System\ZfLOfhx.exe

C:\Windows\System\ZfLOfhx.exe

C:\Windows\System\jeKkNDh.exe

C:\Windows\System\jeKkNDh.exe

C:\Windows\System\xJPvPid.exe

C:\Windows\System\xJPvPid.exe

C:\Windows\System\fIdXufp.exe

C:\Windows\System\fIdXufp.exe

C:\Windows\System\aKNmDwR.exe

C:\Windows\System\aKNmDwR.exe

C:\Windows\System\ZGrIpwx.exe

C:\Windows\System\ZGrIpwx.exe

C:\Windows\System\WnHEqte.exe

C:\Windows\System\WnHEqte.exe

C:\Windows\System\SuOaVhC.exe

C:\Windows\System\SuOaVhC.exe

C:\Windows\System\DqkpyyW.exe

C:\Windows\System\DqkpyyW.exe

C:\Windows\System\ogjvMcb.exe

C:\Windows\System\ogjvMcb.exe

C:\Windows\System\VMjYhys.exe

C:\Windows\System\VMjYhys.exe

C:\Windows\System\aWivGeQ.exe

C:\Windows\System\aWivGeQ.exe

C:\Windows\System\CDSoYiL.exe

C:\Windows\System\CDSoYiL.exe

C:\Windows\System\gkKYIqh.exe

C:\Windows\System\gkKYIqh.exe

C:\Windows\System\JAzOBsx.exe

C:\Windows\System\JAzOBsx.exe

C:\Windows\System\IeyGiGe.exe

C:\Windows\System\IeyGiGe.exe

C:\Windows\System\ETNEvOH.exe

C:\Windows\System\ETNEvOH.exe

C:\Windows\System\xWBtrtK.exe

C:\Windows\System\xWBtrtK.exe

C:\Windows\System\XMBHxVi.exe

C:\Windows\System\XMBHxVi.exe

C:\Windows\System\ncIHTGn.exe

C:\Windows\System\ncIHTGn.exe

C:\Windows\System\cOJhSSi.exe

C:\Windows\System\cOJhSSi.exe

C:\Windows\System\cDiXxCG.exe

C:\Windows\System\cDiXxCG.exe

C:\Windows\System\ApuTJZj.exe

C:\Windows\System\ApuTJZj.exe

C:\Windows\System\yIeSRec.exe

C:\Windows\System\yIeSRec.exe

C:\Windows\System\EWkeROo.exe

C:\Windows\System\EWkeROo.exe

C:\Windows\System\FfJNSPf.exe

C:\Windows\System\FfJNSPf.exe

C:\Windows\System\CNpiwyO.exe

C:\Windows\System\CNpiwyO.exe

C:\Windows\System\xfBxukJ.exe

C:\Windows\System\xfBxukJ.exe

C:\Windows\System\xnOrbYH.exe

C:\Windows\System\xnOrbYH.exe

C:\Windows\System\MbdDpha.exe

C:\Windows\System\MbdDpha.exe

C:\Windows\System\SmaBXug.exe

C:\Windows\System\SmaBXug.exe

C:\Windows\System\qUbPtJL.exe

C:\Windows\System\qUbPtJL.exe

C:\Windows\System\THGfSfJ.exe

C:\Windows\System\THGfSfJ.exe

C:\Windows\System\VJbRGsY.exe

C:\Windows\System\VJbRGsY.exe

C:\Windows\System\hlJmhLS.exe

C:\Windows\System\hlJmhLS.exe

C:\Windows\System\HMgGpet.exe

C:\Windows\System\HMgGpet.exe

C:\Windows\System\yYDQloM.exe

C:\Windows\System\yYDQloM.exe

C:\Windows\System\MnfQsGv.exe

C:\Windows\System\MnfQsGv.exe

C:\Windows\System\yZVXucQ.exe

C:\Windows\System\yZVXucQ.exe

C:\Windows\System\QlGhOjP.exe

C:\Windows\System\QlGhOjP.exe

C:\Windows\System\MSiwFzd.exe

C:\Windows\System\MSiwFzd.exe

C:\Windows\System\EUHixPo.exe

C:\Windows\System\EUHixPo.exe

C:\Windows\System\QHPuqQH.exe

C:\Windows\System\QHPuqQH.exe

C:\Windows\System\rGYRpkm.exe

C:\Windows\System\rGYRpkm.exe

C:\Windows\System\rTDbXlA.exe

C:\Windows\System\rTDbXlA.exe

C:\Windows\System\grLGCBw.exe

C:\Windows\System\grLGCBw.exe

C:\Windows\System\IeNeVUK.exe

C:\Windows\System\IeNeVUK.exe

C:\Windows\System\RpKWXOG.exe

C:\Windows\System\RpKWXOG.exe

C:\Windows\System\snMWGBr.exe

C:\Windows\System\snMWGBr.exe

C:\Windows\System\JMwYtWz.exe

C:\Windows\System\JMwYtWz.exe

C:\Windows\System\yFeHhUm.exe

C:\Windows\System\yFeHhUm.exe

C:\Windows\System\xrAVSio.exe

C:\Windows\System\xrAVSio.exe

C:\Windows\System\XlXyqca.exe

C:\Windows\System\XlXyqca.exe

C:\Windows\System\nNIKVwD.exe

C:\Windows\System\nNIKVwD.exe

C:\Windows\System\MpFeafa.exe

C:\Windows\System\MpFeafa.exe

C:\Windows\System\vixRrQF.exe

C:\Windows\System\vixRrQF.exe

C:\Windows\System\AOLJFwA.exe

C:\Windows\System\AOLJFwA.exe

C:\Windows\System\gxIgXhO.exe

C:\Windows\System\gxIgXhO.exe

C:\Windows\System\ZbfrEBw.exe

C:\Windows\System\ZbfrEBw.exe

C:\Windows\System\wKaTdjY.exe

C:\Windows\System\wKaTdjY.exe

C:\Windows\System\tKLPQLs.exe

C:\Windows\System\tKLPQLs.exe

C:\Windows\System\mgaDnQu.exe

C:\Windows\System\mgaDnQu.exe

C:\Windows\System\HOHcDlg.exe

C:\Windows\System\HOHcDlg.exe

C:\Windows\System\luFophl.exe

C:\Windows\System\luFophl.exe

C:\Windows\System\GWoMtSl.exe

C:\Windows\System\GWoMtSl.exe

C:\Windows\System\AbtPlrQ.exe

C:\Windows\System\AbtPlrQ.exe

C:\Windows\System\ZgevQdW.exe

C:\Windows\System\ZgevQdW.exe

C:\Windows\System\GwMCnNZ.exe

C:\Windows\System\GwMCnNZ.exe

C:\Windows\System\MTwMeEr.exe

C:\Windows\System\MTwMeEr.exe

C:\Windows\System\XEIeHQy.exe

C:\Windows\System\XEIeHQy.exe

C:\Windows\System\HzJerax.exe

C:\Windows\System\HzJerax.exe

C:\Windows\System\LgcdsFi.exe

C:\Windows\System\LgcdsFi.exe

C:\Windows\System\vNpGlNO.exe

C:\Windows\System\vNpGlNO.exe

C:\Windows\System\aRxeThL.exe

C:\Windows\System\aRxeThL.exe

C:\Windows\System\UZRMEAN.exe

C:\Windows\System\UZRMEAN.exe

C:\Windows\System\bkkSzzj.exe

C:\Windows\System\bkkSzzj.exe

C:\Windows\System\UonnNzQ.exe

C:\Windows\System\UonnNzQ.exe

C:\Windows\System\UTexGVq.exe

C:\Windows\System\UTexGVq.exe

C:\Windows\System\IddeurO.exe

C:\Windows\System\IddeurO.exe

C:\Windows\System\rUEqKYQ.exe

C:\Windows\System\rUEqKYQ.exe

C:\Windows\System\bERhOkd.exe

C:\Windows\System\bERhOkd.exe

C:\Windows\System\cLDpRAk.exe

C:\Windows\System\cLDpRAk.exe

C:\Windows\System\EPnnQue.exe

C:\Windows\System\EPnnQue.exe

C:\Windows\System\ALaZWWH.exe

C:\Windows\System\ALaZWWH.exe

C:\Windows\System\zwjECtP.exe

C:\Windows\System\zwjECtP.exe

C:\Windows\System\bvhPIHH.exe

C:\Windows\System\bvhPIHH.exe

C:\Windows\System\zeGbbsp.exe

C:\Windows\System\zeGbbsp.exe

C:\Windows\System\nhRkhjC.exe

C:\Windows\System\nhRkhjC.exe

C:\Windows\System\MGioENV.exe

C:\Windows\System\MGioENV.exe

C:\Windows\System\aBDqQAS.exe

C:\Windows\System\aBDqQAS.exe

C:\Windows\System\guzRfWU.exe

C:\Windows\System\guzRfWU.exe

C:\Windows\System\rDIPMxf.exe

C:\Windows\System\rDIPMxf.exe

C:\Windows\System\fYluUrK.exe

C:\Windows\System\fYluUrK.exe

C:\Windows\System\eyTwFGW.exe

C:\Windows\System\eyTwFGW.exe

C:\Windows\System\cAEHjhk.exe

C:\Windows\System\cAEHjhk.exe

C:\Windows\System\VNTaIwu.exe

C:\Windows\System\VNTaIwu.exe

C:\Windows\System\UnNApws.exe

C:\Windows\System\UnNApws.exe

C:\Windows\System\zJBAkQH.exe

C:\Windows\System\zJBAkQH.exe

C:\Windows\System\uJUypnY.exe

C:\Windows\System\uJUypnY.exe

C:\Windows\System\EwbKENG.exe

C:\Windows\System\EwbKENG.exe

C:\Windows\System\VfROFXr.exe

C:\Windows\System\VfROFXr.exe

C:\Windows\System\KHihdZA.exe

C:\Windows\System\KHihdZA.exe

C:\Windows\System\UYuhwtP.exe

C:\Windows\System\UYuhwtP.exe

C:\Windows\System\zvBdMlV.exe

C:\Windows\System\zvBdMlV.exe

C:\Windows\System\yluRGMx.exe

C:\Windows\System\yluRGMx.exe

C:\Windows\System\VinbwyY.exe

C:\Windows\System\VinbwyY.exe

C:\Windows\System\yWfQBNj.exe

C:\Windows\System\yWfQBNj.exe

C:\Windows\System\EFDSPwM.exe

C:\Windows\System\EFDSPwM.exe

C:\Windows\System\rCxcHQb.exe

C:\Windows\System\rCxcHQb.exe

C:\Windows\System\duPoeOG.exe

C:\Windows\System\duPoeOG.exe

C:\Windows\System\WocUipA.exe

C:\Windows\System\WocUipA.exe

C:\Windows\System\pHolsvL.exe

C:\Windows\System\pHolsvL.exe

C:\Windows\System\Nqmdhug.exe

C:\Windows\System\Nqmdhug.exe

C:\Windows\System\kcRUYpQ.exe

C:\Windows\System\kcRUYpQ.exe

C:\Windows\System\JQbfDCn.exe

C:\Windows\System\JQbfDCn.exe

C:\Windows\System\XmdcLzk.exe

C:\Windows\System\XmdcLzk.exe

C:\Windows\System\buXtnXb.exe

C:\Windows\System\buXtnXb.exe

C:\Windows\System\ZfhcUwu.exe

C:\Windows\System\ZfhcUwu.exe

C:\Windows\System\nonRiqY.exe

C:\Windows\System\nonRiqY.exe

C:\Windows\System\GAqVGjx.exe

C:\Windows\System\GAqVGjx.exe

C:\Windows\System\lmRziMy.exe

C:\Windows\System\lmRziMy.exe

C:\Windows\System\zQnLRcj.exe

C:\Windows\System\zQnLRcj.exe

C:\Windows\System\COANKQZ.exe

C:\Windows\System\COANKQZ.exe

C:\Windows\System\twfvoLs.exe

C:\Windows\System\twfvoLs.exe

C:\Windows\System\ZgjgANx.exe

C:\Windows\System\ZgjgANx.exe

C:\Windows\System\VHAUWOH.exe

C:\Windows\System\VHAUWOH.exe

C:\Windows\System\fqGMXiu.exe

C:\Windows\System\fqGMXiu.exe

C:\Windows\System\jGIhKLP.exe

C:\Windows\System\jGIhKLP.exe

C:\Windows\System\TcpEzOu.exe

C:\Windows\System\TcpEzOu.exe

C:\Windows\System\ySmyADb.exe

C:\Windows\System\ySmyADb.exe

C:\Windows\System\UckEuKo.exe

C:\Windows\System\UckEuKo.exe

C:\Windows\System\EsKysFD.exe

C:\Windows\System\EsKysFD.exe

C:\Windows\System\LONZnjO.exe

C:\Windows\System\LONZnjO.exe

C:\Windows\System\siopRiC.exe

C:\Windows\System\siopRiC.exe

C:\Windows\System\RdQoqPv.exe

C:\Windows\System\RdQoqPv.exe

C:\Windows\System\gAQGKgm.exe

C:\Windows\System\gAQGKgm.exe

C:\Windows\System\KEGwkDz.exe

C:\Windows\System\KEGwkDz.exe

C:\Windows\System\ZAWhOCt.exe

C:\Windows\System\ZAWhOCt.exe

C:\Windows\System\eyMEYbc.exe

C:\Windows\System\eyMEYbc.exe

C:\Windows\System\OmmaNKc.exe

C:\Windows\System\OmmaNKc.exe

C:\Windows\System\XouRMAh.exe

C:\Windows\System\XouRMAh.exe

C:\Windows\System\rnxsEHh.exe

C:\Windows\System\rnxsEHh.exe

C:\Windows\System\AYBNPSZ.exe

C:\Windows\System\AYBNPSZ.exe

C:\Windows\System\fNNUsRJ.exe

C:\Windows\System\fNNUsRJ.exe

C:\Windows\System\oVUbVwR.exe

C:\Windows\System\oVUbVwR.exe

C:\Windows\System\fnyNGTF.exe

C:\Windows\System\fnyNGTF.exe

C:\Windows\System\VOQPpQk.exe

C:\Windows\System\VOQPpQk.exe

C:\Windows\System\LuPldkI.exe

C:\Windows\System\LuPldkI.exe

C:\Windows\System\nTmqdko.exe

C:\Windows\System\nTmqdko.exe

C:\Windows\System\cjEkzuh.exe

C:\Windows\System\cjEkzuh.exe

C:\Windows\System\dYsWIIm.exe

C:\Windows\System\dYsWIIm.exe

C:\Windows\System\dRCxXpI.exe

C:\Windows\System\dRCxXpI.exe

C:\Windows\System\OacjzmP.exe

C:\Windows\System\OacjzmP.exe

C:\Windows\System\HiLTNJl.exe

C:\Windows\System\HiLTNJl.exe

C:\Windows\System\hfFOeoD.exe

C:\Windows\System\hfFOeoD.exe

C:\Windows\System\TmQNTZS.exe

C:\Windows\System\TmQNTZS.exe

C:\Windows\System\aPhUYLJ.exe

C:\Windows\System\aPhUYLJ.exe

C:\Windows\System\DRNhBRw.exe

C:\Windows\System\DRNhBRw.exe

C:\Windows\System\uxsYWIU.exe

C:\Windows\System\uxsYWIU.exe

C:\Windows\System\ExMbGPg.exe

C:\Windows\System\ExMbGPg.exe

C:\Windows\System\zogbgDI.exe

C:\Windows\System\zogbgDI.exe

C:\Windows\System\xbUXgUJ.exe

C:\Windows\System\xbUXgUJ.exe

C:\Windows\System\mdiwNRL.exe

C:\Windows\System\mdiwNRL.exe

C:\Windows\System\uQuLMLR.exe

C:\Windows\System\uQuLMLR.exe

C:\Windows\System\kdEHnjZ.exe

C:\Windows\System\kdEHnjZ.exe

C:\Windows\System\ivMGQOa.exe

C:\Windows\System\ivMGQOa.exe

C:\Windows\System\CxQTJmh.exe

C:\Windows\System\CxQTJmh.exe

C:\Windows\System\voZUdaG.exe

C:\Windows\System\voZUdaG.exe

C:\Windows\System\yMvEvaX.exe

C:\Windows\System\yMvEvaX.exe

C:\Windows\System\PnUUqtJ.exe

C:\Windows\System\PnUUqtJ.exe

C:\Windows\System\MBTfOTo.exe

C:\Windows\System\MBTfOTo.exe

C:\Windows\System\yJzRlOU.exe

C:\Windows\System\yJzRlOU.exe

C:\Windows\System\ASpDWwO.exe

C:\Windows\System\ASpDWwO.exe

C:\Windows\System\RaGPTwO.exe

C:\Windows\System\RaGPTwO.exe

C:\Windows\System\okZURDS.exe

C:\Windows\System\okZURDS.exe

C:\Windows\System\FfXvQBY.exe

C:\Windows\System\FfXvQBY.exe

C:\Windows\System\dprZpSz.exe

C:\Windows\System\dprZpSz.exe

C:\Windows\System\fDnHmQm.exe

C:\Windows\System\fDnHmQm.exe

C:\Windows\System\HjUoilV.exe

C:\Windows\System\HjUoilV.exe

C:\Windows\System\QJTgRdf.exe

C:\Windows\System\QJTgRdf.exe

C:\Windows\System\XcxvLGo.exe

C:\Windows\System\XcxvLGo.exe

C:\Windows\System\uptYcyj.exe

C:\Windows\System\uptYcyj.exe

C:\Windows\System\ueYYBfh.exe

C:\Windows\System\ueYYBfh.exe

C:\Windows\System\mYHMsbh.exe

C:\Windows\System\mYHMsbh.exe

C:\Windows\System\dWSrcKl.exe

C:\Windows\System\dWSrcKl.exe

C:\Windows\System\uuYFlTc.exe

C:\Windows\System\uuYFlTc.exe

C:\Windows\System\ORUAStv.exe

C:\Windows\System\ORUAStv.exe

C:\Windows\System\daBFjay.exe

C:\Windows\System\daBFjay.exe

C:\Windows\System\SUkjUiS.exe

C:\Windows\System\SUkjUiS.exe

C:\Windows\System\TqerhGm.exe

C:\Windows\System\TqerhGm.exe

C:\Windows\System\kzayxAP.exe

C:\Windows\System\kzayxAP.exe

C:\Windows\System\XUPfRKB.exe

C:\Windows\System\XUPfRKB.exe

C:\Windows\System\SfmduEe.exe

C:\Windows\System\SfmduEe.exe

C:\Windows\System\oMYzVHx.exe

C:\Windows\System\oMYzVHx.exe

C:\Windows\System\NIhONtI.exe

C:\Windows\System\NIhONtI.exe

C:\Windows\System\gENYCXr.exe

C:\Windows\System\gENYCXr.exe

C:\Windows\System\PLrqHPA.exe

C:\Windows\System\PLrqHPA.exe

C:\Windows\System\wwBdfef.exe

C:\Windows\System\wwBdfef.exe

C:\Windows\System\rhFSwod.exe

C:\Windows\System\rhFSwod.exe

C:\Windows\System\ftJnisO.exe

C:\Windows\System\ftJnisO.exe

C:\Windows\System\TzOHkKi.exe

C:\Windows\System\TzOHkKi.exe

C:\Windows\System\VGELrwg.exe

C:\Windows\System\VGELrwg.exe

C:\Windows\System\DfGqpNo.exe

C:\Windows\System\DfGqpNo.exe

C:\Windows\System\ooLvzID.exe

C:\Windows\System\ooLvzID.exe

C:\Windows\System\iNTyqqW.exe

C:\Windows\System\iNTyqqW.exe

C:\Windows\System\BLcgHSZ.exe

C:\Windows\System\BLcgHSZ.exe

C:\Windows\System\hJrwJyt.exe

C:\Windows\System\hJrwJyt.exe

C:\Windows\System\AAfKlbu.exe

C:\Windows\System\AAfKlbu.exe

C:\Windows\System\LizCGnH.exe

C:\Windows\System\LizCGnH.exe

C:\Windows\System\OFHzpiS.exe

C:\Windows\System\OFHzpiS.exe

C:\Windows\System\gtQsWJv.exe

C:\Windows\System\gtQsWJv.exe

C:\Windows\System\thoOqDj.exe

C:\Windows\System\thoOqDj.exe

C:\Windows\System\olqXLil.exe

C:\Windows\System\olqXLil.exe

C:\Windows\System\IHyzjjA.exe

C:\Windows\System\IHyzjjA.exe

C:\Windows\System\dJDTUBv.exe

C:\Windows\System\dJDTUBv.exe

C:\Windows\System\bGRacGe.exe

C:\Windows\System\bGRacGe.exe

C:\Windows\System\jyFwoZU.exe

C:\Windows\System\jyFwoZU.exe

C:\Windows\System\pZlSxrb.exe

C:\Windows\System\pZlSxrb.exe

C:\Windows\System\wcroSBk.exe

C:\Windows\System\wcroSBk.exe

C:\Windows\System\WeXRvXj.exe

C:\Windows\System\WeXRvXj.exe

C:\Windows\System\aszRTXH.exe

C:\Windows\System\aszRTXH.exe

C:\Windows\System\aTjtrmk.exe

C:\Windows\System\aTjtrmk.exe

C:\Windows\System\lQhkXAb.exe

C:\Windows\System\lQhkXAb.exe

C:\Windows\System\oSSMbiC.exe

C:\Windows\System\oSSMbiC.exe

C:\Windows\System\NRbWXwP.exe

C:\Windows\System\NRbWXwP.exe

C:\Windows\System\osxELQr.exe

C:\Windows\System\osxELQr.exe

C:\Windows\System\FVLraRQ.exe

C:\Windows\System\FVLraRQ.exe

C:\Windows\System\gssNQKN.exe

C:\Windows\System\gssNQKN.exe

C:\Windows\System\oGNDdLm.exe

C:\Windows\System\oGNDdLm.exe

C:\Windows\System\BrqUzCG.exe

C:\Windows\System\BrqUzCG.exe

C:\Windows\System\VJvoITr.exe

C:\Windows\System\VJvoITr.exe

C:\Windows\System\XrLCpQQ.exe

C:\Windows\System\XrLCpQQ.exe

C:\Windows\System\lsrceDH.exe

C:\Windows\System\lsrceDH.exe

C:\Windows\System\lJvDWhd.exe

C:\Windows\System\lJvDWhd.exe

C:\Windows\System\wMPsbsw.exe

C:\Windows\System\wMPsbsw.exe

C:\Windows\System\gxaFPjt.exe

C:\Windows\System\gxaFPjt.exe

C:\Windows\System\qxvqDDE.exe

C:\Windows\System\qxvqDDE.exe

C:\Windows\System\IWIfkVX.exe

C:\Windows\System\IWIfkVX.exe

C:\Windows\System\baogDIP.exe

C:\Windows\System\baogDIP.exe

C:\Windows\System\yMEZyDF.exe

C:\Windows\System\yMEZyDF.exe

C:\Windows\System\gcrvSws.exe

C:\Windows\System\gcrvSws.exe

C:\Windows\System\PASxOEb.exe

C:\Windows\System\PASxOEb.exe

C:\Windows\System\LSkylrq.exe

C:\Windows\System\LSkylrq.exe

C:\Windows\System\TUshwam.exe

C:\Windows\System\TUshwam.exe

C:\Windows\System\ctZcSht.exe

C:\Windows\System\ctZcSht.exe

C:\Windows\System\VXRBMqt.exe

C:\Windows\System\VXRBMqt.exe

C:\Windows\System\eyulGDS.exe

C:\Windows\System\eyulGDS.exe

C:\Windows\System\HyrCErk.exe

C:\Windows\System\HyrCErk.exe

C:\Windows\System\UqngKCS.exe

C:\Windows\System\UqngKCS.exe

C:\Windows\System\HaayYXY.exe

C:\Windows\System\HaayYXY.exe

C:\Windows\System\FwUBGQy.exe

C:\Windows\System\FwUBGQy.exe

C:\Windows\System\LcBHnze.exe

C:\Windows\System\LcBHnze.exe

C:\Windows\System\QjnGNYe.exe

C:\Windows\System\QjnGNYe.exe

C:\Windows\System\ABgfcIS.exe

C:\Windows\System\ABgfcIS.exe

C:\Windows\System\pPgsNlE.exe

C:\Windows\System\pPgsNlE.exe

C:\Windows\System\zNxnvJe.exe

C:\Windows\System\zNxnvJe.exe

C:\Windows\System\LCDzmgz.exe

C:\Windows\System\LCDzmgz.exe

C:\Windows\System\PDQINcL.exe

C:\Windows\System\PDQINcL.exe

C:\Windows\System\BAbOguW.exe

C:\Windows\System\BAbOguW.exe

C:\Windows\System\HULOZYA.exe

C:\Windows\System\HULOZYA.exe

C:\Windows\System\febBdTx.exe

C:\Windows\System\febBdTx.exe

C:\Windows\System\iHwmfVW.exe

C:\Windows\System\iHwmfVW.exe

C:\Windows\System\enfuNtP.exe

C:\Windows\System\enfuNtP.exe

C:\Windows\System\RREXFfV.exe

C:\Windows\System\RREXFfV.exe

C:\Windows\System\nKpvtwG.exe

C:\Windows\System\nKpvtwG.exe

C:\Windows\System\tNAojRS.exe

C:\Windows\System\tNAojRS.exe

C:\Windows\System\eoPFCBz.exe

C:\Windows\System\eoPFCBz.exe

C:\Windows\System\ZhDaOff.exe

C:\Windows\System\ZhDaOff.exe

C:\Windows\System\SVlnGMO.exe

C:\Windows\System\SVlnGMO.exe

C:\Windows\System\JPDBbof.exe

C:\Windows\System\JPDBbof.exe

C:\Windows\System\ScGZjtg.exe

C:\Windows\System\ScGZjtg.exe

C:\Windows\System\JJjjwBe.exe

C:\Windows\System\JJjjwBe.exe

C:\Windows\System\hbdezoe.exe

C:\Windows\System\hbdezoe.exe

C:\Windows\System\qppFWRP.exe

C:\Windows\System\qppFWRP.exe

C:\Windows\System\FUBfPMw.exe

C:\Windows\System\FUBfPMw.exe

C:\Windows\System\xsFXzlg.exe

C:\Windows\System\xsFXzlg.exe

C:\Windows\System\NExYHNm.exe

C:\Windows\System\NExYHNm.exe

C:\Windows\System\nvoCPKO.exe

C:\Windows\System\nvoCPKO.exe

C:\Windows\System\hUgQWBU.exe

C:\Windows\System\hUgQWBU.exe

C:\Windows\System\uhpqogb.exe

C:\Windows\System\uhpqogb.exe

C:\Windows\System\bCBJYWC.exe

C:\Windows\System\bCBJYWC.exe

C:\Windows\System\LmAFHAJ.exe

C:\Windows\System\LmAFHAJ.exe

C:\Windows\System\itFraDO.exe

C:\Windows\System\itFraDO.exe

C:\Windows\System\ImBSPPK.exe

C:\Windows\System\ImBSPPK.exe

C:\Windows\System\uTnNQqW.exe

C:\Windows\System\uTnNQqW.exe

C:\Windows\System\QXNlUBd.exe

C:\Windows\System\QXNlUBd.exe

C:\Windows\System\MNUrfvS.exe

C:\Windows\System\MNUrfvS.exe

C:\Windows\System\gpzoORD.exe

C:\Windows\System\gpzoORD.exe

C:\Windows\System\qumOrja.exe

C:\Windows\System\qumOrja.exe

C:\Windows\System\bakUUpd.exe

C:\Windows\System\bakUUpd.exe

C:\Windows\System\udAPUgL.exe

C:\Windows\System\udAPUgL.exe

C:\Windows\System\ogqgFwP.exe

C:\Windows\System\ogqgFwP.exe

C:\Windows\System\IwguQnw.exe

C:\Windows\System\IwguQnw.exe

C:\Windows\System\SPQUuIc.exe

C:\Windows\System\SPQUuIc.exe

C:\Windows\System\sOwIaNl.exe

C:\Windows\System\sOwIaNl.exe

C:\Windows\System\VkDgTuF.exe

C:\Windows\System\VkDgTuF.exe

C:\Windows\System\CrGRBeI.exe

C:\Windows\System\CrGRBeI.exe

C:\Windows\System\XOEahwJ.exe

C:\Windows\System\XOEahwJ.exe

C:\Windows\System\nUixgbR.exe

C:\Windows\System\nUixgbR.exe

C:\Windows\System\wBQqrJY.exe

C:\Windows\System\wBQqrJY.exe

C:\Windows\System\YCigXDu.exe

C:\Windows\System\YCigXDu.exe

C:\Windows\System\SqTFGTB.exe

C:\Windows\System\SqTFGTB.exe

C:\Windows\System\TfgDEyE.exe

C:\Windows\System\TfgDEyE.exe

C:\Windows\System\AwLZbtd.exe

C:\Windows\System\AwLZbtd.exe

C:\Windows\System\ynEOnPe.exe

C:\Windows\System\ynEOnPe.exe

C:\Windows\System\wTrWhTT.exe

C:\Windows\System\wTrWhTT.exe

C:\Windows\System\ahNZVTT.exe

C:\Windows\System\ahNZVTT.exe

C:\Windows\System\MnlgfZc.exe

C:\Windows\System\MnlgfZc.exe

C:\Windows\System\OsKMoQp.exe

C:\Windows\System\OsKMoQp.exe

C:\Windows\System\nKZHFYl.exe

C:\Windows\System\nKZHFYl.exe

C:\Windows\System\jwtKube.exe

C:\Windows\System\jwtKube.exe

C:\Windows\System\MbEozOb.exe

C:\Windows\System\MbEozOb.exe

C:\Windows\System\VSzrJkF.exe

C:\Windows\System\VSzrJkF.exe

C:\Windows\System\nouumOY.exe

C:\Windows\System\nouumOY.exe

C:\Windows\System\PovCzVE.exe

C:\Windows\System\PovCzVE.exe

C:\Windows\System\oGuiXOb.exe

C:\Windows\System\oGuiXOb.exe

C:\Windows\System\zDcjOmu.exe

C:\Windows\System\zDcjOmu.exe

C:\Windows\System\LQFPcEQ.exe

C:\Windows\System\LQFPcEQ.exe

C:\Windows\System\zlgENbF.exe

C:\Windows\System\zlgENbF.exe

C:\Windows\System\InIejYs.exe

C:\Windows\System\InIejYs.exe

C:\Windows\System\LBzyuPh.exe

C:\Windows\System\LBzyuPh.exe

C:\Windows\System\TldgggY.exe

C:\Windows\System\TldgggY.exe

C:\Windows\System\XMAawiZ.exe

C:\Windows\System\XMAawiZ.exe

C:\Windows\System\YAkekeX.exe

C:\Windows\System\YAkekeX.exe

C:\Windows\System\obsIKze.exe

C:\Windows\System\obsIKze.exe

C:\Windows\System\uRIwzWX.exe

C:\Windows\System\uRIwzWX.exe

C:\Windows\System\OAvtguJ.exe

C:\Windows\System\OAvtguJ.exe

C:\Windows\System\VzQiXfs.exe

C:\Windows\System\VzQiXfs.exe

C:\Windows\System\uWVsCgU.exe

C:\Windows\System\uWVsCgU.exe

C:\Windows\System\aPigRPn.exe

C:\Windows\System\aPigRPn.exe

C:\Windows\System\wCdgMfe.exe

C:\Windows\System\wCdgMfe.exe

C:\Windows\System\FMAlCpB.exe

C:\Windows\System\FMAlCpB.exe

C:\Windows\System\nzJiium.exe

C:\Windows\System\nzJiium.exe

C:\Windows\System\QTZTvna.exe

C:\Windows\System\QTZTvna.exe

C:\Windows\System\oyTSfFS.exe

C:\Windows\System\oyTSfFS.exe

C:\Windows\System\LcBDGTi.exe

C:\Windows\System\LcBDGTi.exe

C:\Windows\System\uAvzsPz.exe

C:\Windows\System\uAvzsPz.exe

C:\Windows\System\zXNaXFf.exe

C:\Windows\System\zXNaXFf.exe

C:\Windows\System\pXNTZdb.exe

C:\Windows\System\pXNTZdb.exe

C:\Windows\System\oMmawmi.exe

C:\Windows\System\oMmawmi.exe

C:\Windows\System\DWBPeBK.exe

C:\Windows\System\DWBPeBK.exe

C:\Windows\System\hXFmAbM.exe

C:\Windows\System\hXFmAbM.exe

C:\Windows\System\qtmpXdV.exe

C:\Windows\System\qtmpXdV.exe

C:\Windows\System\qXDQeWU.exe

C:\Windows\System\qXDQeWU.exe

C:\Windows\System\tOKEWRh.exe

C:\Windows\System\tOKEWRh.exe

C:\Windows\System\jdFnUOf.exe

C:\Windows\System\jdFnUOf.exe

C:\Windows\System\LjObTjn.exe

C:\Windows\System\LjObTjn.exe

C:\Windows\System\cKncAxG.exe

C:\Windows\System\cKncAxG.exe

C:\Windows\System\GthkkCT.exe

C:\Windows\System\GthkkCT.exe

C:\Windows\System\gqCifKs.exe

C:\Windows\System\gqCifKs.exe

C:\Windows\System\oggRSLV.exe

C:\Windows\System\oggRSLV.exe

C:\Windows\System\VrZvbAI.exe

C:\Windows\System\VrZvbAI.exe

C:\Windows\System\annEIEo.exe

C:\Windows\System\annEIEo.exe

C:\Windows\System\PbssElu.exe

C:\Windows\System\PbssElu.exe

C:\Windows\System\ORxQCYX.exe

C:\Windows\System\ORxQCYX.exe

C:\Windows\System\vlfQTLL.exe

C:\Windows\System\vlfQTLL.exe

C:\Windows\System\dEIgrLt.exe

C:\Windows\System\dEIgrLt.exe

C:\Windows\System\GwFVXrL.exe

C:\Windows\System\GwFVXrL.exe

C:\Windows\System\MpHmPaW.exe

C:\Windows\System\MpHmPaW.exe

C:\Windows\System\ijMwkMu.exe

C:\Windows\System\ijMwkMu.exe

C:\Windows\System\uqtjkGT.exe

C:\Windows\System\uqtjkGT.exe

C:\Windows\System\WMKvKMZ.exe

C:\Windows\System\WMKvKMZ.exe

C:\Windows\System\kbtvWQP.exe

C:\Windows\System\kbtvWQP.exe

C:\Windows\System\zxWMLSl.exe

C:\Windows\System\zxWMLSl.exe

C:\Windows\System\nMrtGzY.exe

C:\Windows\System\nMrtGzY.exe

C:\Windows\System\CGpDVwJ.exe

C:\Windows\System\CGpDVwJ.exe

C:\Windows\System\fBGZrTQ.exe

C:\Windows\System\fBGZrTQ.exe

C:\Windows\System\mSbtGMZ.exe

C:\Windows\System\mSbtGMZ.exe

C:\Windows\System\SWQGNdS.exe

C:\Windows\System\SWQGNdS.exe

C:\Windows\System\pNWbLyb.exe

C:\Windows\System\pNWbLyb.exe

C:\Windows\System\LYkVdZL.exe

C:\Windows\System\LYkVdZL.exe

C:\Windows\System\pOFPyaP.exe

C:\Windows\System\pOFPyaP.exe

C:\Windows\System\UINXkvp.exe

C:\Windows\System\UINXkvp.exe

C:\Windows\System\YQwCycX.exe

C:\Windows\System\YQwCycX.exe

C:\Windows\System\EIzNkMj.exe

C:\Windows\System\EIzNkMj.exe

C:\Windows\System\WpfMoqZ.exe

C:\Windows\System\WpfMoqZ.exe

C:\Windows\System\ELPClhp.exe

C:\Windows\System\ELPClhp.exe

C:\Windows\System\RxQGGuv.exe

C:\Windows\System\RxQGGuv.exe

C:\Windows\System\XbGxMNj.exe

C:\Windows\System\XbGxMNj.exe

C:\Windows\System\PQebEfm.exe

C:\Windows\System\PQebEfm.exe

C:\Windows\System\qNOctIW.exe

C:\Windows\System\qNOctIW.exe

C:\Windows\System\BnSdFnw.exe

C:\Windows\System\BnSdFnw.exe

C:\Windows\System\pZxMzQN.exe

C:\Windows\System\pZxMzQN.exe

C:\Windows\System\ZMJBugQ.exe

C:\Windows\System\ZMJBugQ.exe

C:\Windows\System\qBnSPPe.exe

C:\Windows\System\qBnSPPe.exe

C:\Windows\System\XpUjtUN.exe

C:\Windows\System\XpUjtUN.exe

C:\Windows\System\ARIkxTa.exe

C:\Windows\System\ARIkxTa.exe

C:\Windows\System\IZNfUDL.exe

C:\Windows\System\IZNfUDL.exe

C:\Windows\System\lHQKyQH.exe

C:\Windows\System\lHQKyQH.exe

C:\Windows\System\mzbrzoJ.exe

C:\Windows\System\mzbrzoJ.exe

C:\Windows\System\SbFUqUG.exe

C:\Windows\System\SbFUqUG.exe

C:\Windows\System\lbaITXO.exe

C:\Windows\System\lbaITXO.exe

C:\Windows\System\jlMjsig.exe

C:\Windows\System\jlMjsig.exe

C:\Windows\System\UzRnSsN.exe

C:\Windows\System\UzRnSsN.exe

C:\Windows\System\tbVJvfQ.exe

C:\Windows\System\tbVJvfQ.exe

C:\Windows\System\fGEOCkM.exe

C:\Windows\System\fGEOCkM.exe

C:\Windows\System\EzbZIYB.exe

C:\Windows\System\EzbZIYB.exe

C:\Windows\System\FjOGQdj.exe

C:\Windows\System\FjOGQdj.exe

C:\Windows\System\nueRlhB.exe

C:\Windows\System\nueRlhB.exe

C:\Windows\System\FNYnPSy.exe

C:\Windows\System\FNYnPSy.exe

C:\Windows\System\ZZhKGnm.exe

C:\Windows\System\ZZhKGnm.exe

C:\Windows\System\YQKpGMD.exe

C:\Windows\System\YQKpGMD.exe

C:\Windows\System\wGMwgUT.exe

C:\Windows\System\wGMwgUT.exe

C:\Windows\System\CfqTSAW.exe

C:\Windows\System\CfqTSAW.exe

C:\Windows\System\JWyGXEB.exe

C:\Windows\System\JWyGXEB.exe

C:\Windows\System\pwuAavl.exe

C:\Windows\System\pwuAavl.exe

C:\Windows\System\ggGQTud.exe

C:\Windows\System\ggGQTud.exe

C:\Windows\System\CKXibUM.exe

C:\Windows\System\CKXibUM.exe

C:\Windows\System\CnlsYHK.exe

C:\Windows\System\CnlsYHK.exe

C:\Windows\System\GnLYUMo.exe

C:\Windows\System\GnLYUMo.exe

C:\Windows\System\WArhFWw.exe

C:\Windows\System\WArhFWw.exe

C:\Windows\System\XWNTJxg.exe

C:\Windows\System\XWNTJxg.exe

C:\Windows\System\QcMvaOV.exe

C:\Windows\System\QcMvaOV.exe

C:\Windows\System\npeFyGQ.exe

C:\Windows\System\npeFyGQ.exe

C:\Windows\System\FRGGTPv.exe

C:\Windows\System\FRGGTPv.exe

C:\Windows\System\jTYdMnF.exe

C:\Windows\System\jTYdMnF.exe

C:\Windows\System\kFJTBQH.exe

C:\Windows\System\kFJTBQH.exe

C:\Windows\System\fWCWrab.exe

C:\Windows\System\fWCWrab.exe

C:\Windows\System\ICSWBLI.exe

C:\Windows\System\ICSWBLI.exe

C:\Windows\System\cFIOlFM.exe

C:\Windows\System\cFIOlFM.exe

C:\Windows\System\HjeykAN.exe

C:\Windows\System\HjeykAN.exe

C:\Windows\System\tgmbcRo.exe

C:\Windows\System\tgmbcRo.exe

C:\Windows\System\hzoZyUz.exe

C:\Windows\System\hzoZyUz.exe

C:\Windows\System\dQPkvmi.exe

C:\Windows\System\dQPkvmi.exe

C:\Windows\System\RqIWAxj.exe

C:\Windows\System\RqIWAxj.exe

C:\Windows\System\uNyUDoY.exe

C:\Windows\System\uNyUDoY.exe

C:\Windows\System\AvwHpzn.exe

C:\Windows\System\AvwHpzn.exe

C:\Windows\System\cNUzLJf.exe

C:\Windows\System\cNUzLJf.exe

C:\Windows\System\Spthvzh.exe

C:\Windows\System\Spthvzh.exe

C:\Windows\System\RbOvsfD.exe

C:\Windows\System\RbOvsfD.exe

C:\Windows\System\YOJqVBo.exe

C:\Windows\System\YOJqVBo.exe

C:\Windows\System\ZHdYAuY.exe

C:\Windows\System\ZHdYAuY.exe

C:\Windows\System\hxvvEFH.exe

C:\Windows\System\hxvvEFH.exe

C:\Windows\System\iYWyXmf.exe

C:\Windows\System\iYWyXmf.exe

C:\Windows\System\PwUjmpQ.exe

C:\Windows\System\PwUjmpQ.exe

C:\Windows\System\kGFYzmv.exe

C:\Windows\System\kGFYzmv.exe

C:\Windows\System\PzlJLHY.exe

C:\Windows\System\PzlJLHY.exe

C:\Windows\System\jzLuEnm.exe

C:\Windows\System\jzLuEnm.exe

C:\Windows\System\iONwJwG.exe

C:\Windows\System\iONwJwG.exe

C:\Windows\System\BmnXJeU.exe

C:\Windows\System\BmnXJeU.exe

C:\Windows\System\PznONfn.exe

C:\Windows\System\PznONfn.exe

C:\Windows\System\rfjclSu.exe

C:\Windows\System\rfjclSu.exe

C:\Windows\System\Rzwxmbr.exe

C:\Windows\System\Rzwxmbr.exe

C:\Windows\System\VytoiKX.exe

C:\Windows\System\VytoiKX.exe

C:\Windows\System\ZeeAPil.exe

C:\Windows\System\ZeeAPil.exe

C:\Windows\System\VXzkazN.exe

C:\Windows\System\VXzkazN.exe

C:\Windows\System\ULIfXOF.exe

C:\Windows\System\ULIfXOF.exe

C:\Windows\System\zTvGIDd.exe

C:\Windows\System\zTvGIDd.exe

C:\Windows\System\zASfFuv.exe

C:\Windows\System\zASfFuv.exe

C:\Windows\System\YzBhVxS.exe

C:\Windows\System\YzBhVxS.exe

C:\Windows\System\AtdmevF.exe

C:\Windows\System\AtdmevF.exe

C:\Windows\System\PZKVNOJ.exe

C:\Windows\System\PZKVNOJ.exe

C:\Windows\System\rcQbgUH.exe

C:\Windows\System\rcQbgUH.exe

C:\Windows\System\YKmwcpY.exe

C:\Windows\System\YKmwcpY.exe

C:\Windows\System\THEFTmm.exe

C:\Windows\System\THEFTmm.exe

C:\Windows\System\iSyBiHU.exe

C:\Windows\System\iSyBiHU.exe

C:\Windows\System\Phezmqt.exe

C:\Windows\System\Phezmqt.exe

C:\Windows\System\utFJtmW.exe

C:\Windows\System\utFJtmW.exe

C:\Windows\System\stqguNf.exe

C:\Windows\System\stqguNf.exe

C:\Windows\System\kwbMvCx.exe

C:\Windows\System\kwbMvCx.exe

C:\Windows\System\SBOakOw.exe

C:\Windows\System\SBOakOw.exe

C:\Windows\System\RIEHZdO.exe

C:\Windows\System\RIEHZdO.exe

C:\Windows\System\CXmYeVL.exe

C:\Windows\System\CXmYeVL.exe

C:\Windows\System\YsMVmEd.exe

C:\Windows\System\YsMVmEd.exe

C:\Windows\System\TqeBFbK.exe

C:\Windows\System\TqeBFbK.exe

C:\Windows\System\GqugHAr.exe

C:\Windows\System\GqugHAr.exe

C:\Windows\System\NijCgtp.exe

C:\Windows\System\NijCgtp.exe

C:\Windows\System\CniAhEn.exe

C:\Windows\System\CniAhEn.exe

C:\Windows\System\EASEXzt.exe

C:\Windows\System\EASEXzt.exe

C:\Windows\System\XhqbkMX.exe

C:\Windows\System\XhqbkMX.exe

C:\Windows\System\KZAuJGw.exe

C:\Windows\System\KZAuJGw.exe

C:\Windows\System\fEMDmOI.exe

C:\Windows\System\fEMDmOI.exe

C:\Windows\System\ekxFiGJ.exe

C:\Windows\System\ekxFiGJ.exe

C:\Windows\System\XyPEeVV.exe

C:\Windows\System\XyPEeVV.exe

C:\Windows\System\sWXrrHg.exe

C:\Windows\System\sWXrrHg.exe

C:\Windows\System\kTnHHjX.exe

C:\Windows\System\kTnHHjX.exe

C:\Windows\System\qOsEDnq.exe

C:\Windows\System\qOsEDnq.exe

C:\Windows\System\pUvoGXK.exe

C:\Windows\System\pUvoGXK.exe

C:\Windows\System\DcyPrLF.exe

C:\Windows\System\DcyPrLF.exe

C:\Windows\System\BAJOLTJ.exe

C:\Windows\System\BAJOLTJ.exe

C:\Windows\System\AuqrHRI.exe

C:\Windows\System\AuqrHRI.exe

C:\Windows\System\pnyQYmf.exe

C:\Windows\System\pnyQYmf.exe

C:\Windows\System\dCWVRDg.exe

C:\Windows\System\dCWVRDg.exe

C:\Windows\System\wihwoJb.exe

C:\Windows\System\wihwoJb.exe

C:\Windows\System\ZPSeIce.exe

C:\Windows\System\ZPSeIce.exe

C:\Windows\System\qJSehdy.exe

C:\Windows\System\qJSehdy.exe

C:\Windows\System\uHOKYpw.exe

C:\Windows\System\uHOKYpw.exe

C:\Windows\System\AbQLxYi.exe

C:\Windows\System\AbQLxYi.exe

C:\Windows\System\uyqyBHu.exe

C:\Windows\System\uyqyBHu.exe

C:\Windows\System\TUPAOsi.exe

C:\Windows\System\TUPAOsi.exe

C:\Windows\System\TCKUwEd.exe

C:\Windows\System\TCKUwEd.exe

C:\Windows\System\MqBoQhj.exe

C:\Windows\System\MqBoQhj.exe

C:\Windows\System\OtKYXra.exe

C:\Windows\System\OtKYXra.exe

C:\Windows\System\GjbgIQX.exe

C:\Windows\System\GjbgIQX.exe

C:\Windows\System\qluPxXM.exe

C:\Windows\System\qluPxXM.exe

C:\Windows\System\gVdGRss.exe

C:\Windows\System\gVdGRss.exe

C:\Windows\System\qBOlDzn.exe

C:\Windows\System\qBOlDzn.exe

C:\Windows\System\ZhkxaOW.exe

C:\Windows\System\ZhkxaOW.exe

C:\Windows\System\SjjNwjf.exe

C:\Windows\System\SjjNwjf.exe

C:\Windows\System\FusqgnW.exe

C:\Windows\System\FusqgnW.exe

C:\Windows\System\iVLmYuz.exe

C:\Windows\System\iVLmYuz.exe

C:\Windows\System\lRtnDLf.exe

C:\Windows\System\lRtnDLf.exe

C:\Windows\System\kmOSNhi.exe

C:\Windows\System\kmOSNhi.exe

C:\Windows\System\URhuvXV.exe

C:\Windows\System\URhuvXV.exe

C:\Windows\System\cMTQiwP.exe

C:\Windows\System\cMTQiwP.exe

C:\Windows\System\VAgGnid.exe

C:\Windows\System\VAgGnid.exe

C:\Windows\System\GevioKC.exe

C:\Windows\System\GevioKC.exe

C:\Windows\System\mMpTYMN.exe

C:\Windows\System\mMpTYMN.exe

C:\Windows\System\FcPbnwQ.exe

C:\Windows\System\FcPbnwQ.exe

C:\Windows\System\IeLRISc.exe

C:\Windows\System\IeLRISc.exe

C:\Windows\System\QMcZWwl.exe

C:\Windows\System\QMcZWwl.exe

C:\Windows\System\lEzXsXp.exe

C:\Windows\System\lEzXsXp.exe

C:\Windows\System\HrxNHOf.exe

C:\Windows\System\HrxNHOf.exe

C:\Windows\System\ZnELUWK.exe

C:\Windows\System\ZnELUWK.exe

C:\Windows\System\mOZOYFp.exe

C:\Windows\System\mOZOYFp.exe

C:\Windows\System\USvsiux.exe

C:\Windows\System\USvsiux.exe

C:\Windows\System\pcPrdEf.exe

C:\Windows\System\pcPrdEf.exe

C:\Windows\System\ENEVaIS.exe

C:\Windows\System\ENEVaIS.exe

C:\Windows\System\ZyReuDH.exe

C:\Windows\System\ZyReuDH.exe

C:\Windows\System\rmbqjcW.exe

C:\Windows\System\rmbqjcW.exe

C:\Windows\System\WodQNQE.exe

C:\Windows\System\WodQNQE.exe

C:\Windows\System\JVonTcW.exe

C:\Windows\System\JVonTcW.exe

C:\Windows\System\KjGfVxr.exe

C:\Windows\System\KjGfVxr.exe

C:\Windows\System\vCOLEeE.exe

C:\Windows\System\vCOLEeE.exe

C:\Windows\System\UZzfzsH.exe

C:\Windows\System\UZzfzsH.exe

C:\Windows\System\gAFAnba.exe

C:\Windows\System\gAFAnba.exe

C:\Windows\System\KDUSqJk.exe

C:\Windows\System\KDUSqJk.exe

C:\Windows\System\INfSIHA.exe

C:\Windows\System\INfSIHA.exe

C:\Windows\System\cEPGwMw.exe

C:\Windows\System\cEPGwMw.exe

C:\Windows\System\NvuOgbm.exe

C:\Windows\System\NvuOgbm.exe

C:\Windows\System\dtaVEAB.exe

C:\Windows\System\dtaVEAB.exe

C:\Windows\System\BWpGIri.exe

C:\Windows\System\BWpGIri.exe

C:\Windows\System\ccyReXM.exe

C:\Windows\System\ccyReXM.exe

C:\Windows\System\MVffvgz.exe

C:\Windows\System\MVffvgz.exe

C:\Windows\System\gNfIiPz.exe

C:\Windows\System\gNfIiPz.exe

C:\Windows\System\wEfTocM.exe

C:\Windows\System\wEfTocM.exe

C:\Windows\System\UIMfiwR.exe

C:\Windows\System\UIMfiwR.exe

C:\Windows\System\EAJfPPN.exe

C:\Windows\System\EAJfPPN.exe

C:\Windows\System\dwzqOhJ.exe

C:\Windows\System\dwzqOhJ.exe

C:\Windows\System\cLUoeIo.exe

C:\Windows\System\cLUoeIo.exe

C:\Windows\System\QiThrXO.exe

C:\Windows\System\QiThrXO.exe

C:\Windows\System\iQzhKXe.exe

C:\Windows\System\iQzhKXe.exe

C:\Windows\System\lGvjxHu.exe

C:\Windows\System\lGvjxHu.exe

C:\Windows\System\kIEeFil.exe

C:\Windows\System\kIEeFil.exe

C:\Windows\System\YAPUCZa.exe

C:\Windows\System\YAPUCZa.exe

C:\Windows\System\yuXZIjP.exe

C:\Windows\System\yuXZIjP.exe

C:\Windows\System\xPtOJOx.exe

C:\Windows\System\xPtOJOx.exe

C:\Windows\System\PqZYbjP.exe

C:\Windows\System\PqZYbjP.exe

C:\Windows\System\UKnmuNx.exe

C:\Windows\System\UKnmuNx.exe

C:\Windows\System\WuOSfPb.exe

C:\Windows\System\WuOSfPb.exe

C:\Windows\System\oxmupnw.exe

C:\Windows\System\oxmupnw.exe

C:\Windows\System\IhSVqWN.exe

C:\Windows\System\IhSVqWN.exe

C:\Windows\System\GNlrLOR.exe

C:\Windows\System\GNlrLOR.exe

C:\Windows\System\IRjLbUd.exe

C:\Windows\System\IRjLbUd.exe

C:\Windows\System\IGUFdQZ.exe

C:\Windows\System\IGUFdQZ.exe

C:\Windows\System\ruOhycw.exe

C:\Windows\System\ruOhycw.exe

C:\Windows\System\zajPRcr.exe

C:\Windows\System\zajPRcr.exe

C:\Windows\System\GwsOEzU.exe

C:\Windows\System\GwsOEzU.exe

C:\Windows\System\AmBWdBz.exe

C:\Windows\System\AmBWdBz.exe

C:\Windows\System\QBuPkDC.exe

C:\Windows\System\QBuPkDC.exe

C:\Windows\System\SkdsSYD.exe

C:\Windows\System\SkdsSYD.exe

C:\Windows\System\ohYKQNN.exe

C:\Windows\System\ohYKQNN.exe

C:\Windows\System\HndtbEn.exe

C:\Windows\System\HndtbEn.exe

C:\Windows\System\WpYdazu.exe

C:\Windows\System\WpYdazu.exe

C:\Windows\System\KUDrQOm.exe

C:\Windows\System\KUDrQOm.exe

C:\Windows\System\icDpKqi.exe

C:\Windows\System\icDpKqi.exe

C:\Windows\System\DFwHbuN.exe

C:\Windows\System\DFwHbuN.exe

C:\Windows\System\ceJItPL.exe

C:\Windows\System\ceJItPL.exe

C:\Windows\System\XVNiATY.exe

C:\Windows\System\XVNiATY.exe

C:\Windows\System\lqbfDeX.exe

C:\Windows\System\lqbfDeX.exe

C:\Windows\System\OmwMEgt.exe

C:\Windows\System\OmwMEgt.exe

C:\Windows\System\uXwHLrV.exe

C:\Windows\System\uXwHLrV.exe

C:\Windows\System\qRyxWOK.exe

C:\Windows\System\qRyxWOK.exe

C:\Windows\System\miOOzSY.exe

C:\Windows\System\miOOzSY.exe

C:\Windows\System\seabYak.exe

C:\Windows\System\seabYak.exe

C:\Windows\System\cyIHjGM.exe

C:\Windows\System\cyIHjGM.exe

C:\Windows\System\CLAhaNk.exe

C:\Windows\System\CLAhaNk.exe

C:\Windows\System\DJkTNPK.exe

C:\Windows\System\DJkTNPK.exe

C:\Windows\System\TmYHDsD.exe

C:\Windows\System\TmYHDsD.exe

C:\Windows\system32\dwm.exe

"dwm.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	98.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	57.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	76.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
NL	23.62.61.129:443	www.bing.com	tcp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	8.8.8.8:53	88.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp

Files

memory/1572-0-0x00007FF635A60000-0x00007FF635DB1000-memory.dmp

memory/1572-1-0x00000191B7960000-0x00000191B7970000-memory.dmp

memory/2228-7-0x00007FF7EE7F0000-0x00007FF7EEB41000-memory.dmp

C:\Windows\System\RmcROBk.exe

MD5	7a25057ade126737e96f757e70db26f0
SHA1	35d5dcbfbd32e2323b9017353006f74e66d96e72
SHA256	17e19b4d796026d35d1886edb6226b0e48fcd7454f31da9da08cc286b10b00ae
SHA512	8f5c3a8bf084506d72d31ed28ff1fb708fc57903f37db67c736b6aacd5d84e68906dcdc5ba2eb9905c82584a7e98627763571d43f5a3b8c3e158723a5c276691

C:\Windows\System\bbkJkyj.exe

MD5	ceacf4ceb5cc13967cde77c127cb94cc
SHA1	92226a47cdcff2a42faf19ce4b7f718ce215fe3c
SHA256	6d195a2067a9599dc03640d44689f2014e958baa87a995793a02d0ebe9cd9d7c
SHA512	b30fe2efba9a969e09f20e6586ae91a9b5af523e2c9055b0cd9e751513c470eb2d866b0bd40b9c32c5647e7af05a460514424a1889aa8903a5847dfa503f6b68

memory/916-14-0x00007FF60C310000-0x00007FF60C661000-memory.dmp

C:\Windows\System\qBIuYik.exe

MD5	3e3006b4fcb6d8b729f39dc9c18a6ac8
SHA1	c73a34b845f67117f64903df22515098fc4f96c2
SHA256	bf97a4fe7b3e814bdbac970e52ebfb42127aba4cebdd0df6c0fe184378b1b4cf
SHA512	afdf47ecbc7430f99c0fad3c7ccf8442990cf335964eece80f4ca654a72369a23db7338e27bf0323b172ef843cc8afd50fa1e103f712deff117643f50f1bf238

C:\Windows\System\IIrBYHu.exe

MD5	b4a0ece427ffa1aee91f4899155d0868
SHA1	d8d53f3be92ea31db2c2b39222301239f6cdb7e2
SHA256	7f43ac7350afbc69aa507dcf3b54f533c51cbfd072e6f5f4cbacdf028d5d2181
SHA512	b9a9d319e215d44d8c96d9810e71eb2aaf464a85f6486506dfbf788f26411a751b231dd799a3946b7b4a92f3e45a3b1b989dbe434697ce67eff3b2147660b5df

C:\Windows\System\GwLsDCN.exe

MD5	2681c75f9791ce56199f8618fb32872d
SHA1	be4ea37d13eb3d834c77a4f4c7bd8b7e084a0074
SHA256	482a70f46f64fbda1c3de2039c0ed7d9523c559011563856887eac96e2db6557
SHA512	25e1a8ccbd5fcd5728353d16e4da911e73bd8cbc1b9ba8c8484a763c26a5710c2612d78c700c2eb8aaec057a83592a45a71ba1a24f12372d784093d251364174

C:\Windows\System\YSpWFhl.exe

MD5	4df738803954e923006f21e833d62776
SHA1	5ef5f622836157a902ca8e2c40e4e6a0fcdbf6fa
SHA256	0268d3b3cfb322b5a0384b00bdc5e51aa66efeab09ca9151df1bda3bb074a415
SHA512	232724612c23f812ff5cdcad7c49970055a0d0e23aeff078487587d9d70399ca9b7f7e8a28d1d3d2489336c1c1b40a93a76fff106578ddb1189b1dfac3943217

C:\Windows\System\mkRaudy.exe

MD5	4624e9aab441e4502425f0a516adf8cc
SHA1	62ac77ac7dd09cce10a97b49aea1e2dd36952896
SHA256	b64a3e6e342b74f2b59d50ed511edd6ee29bda9b7ca3081a7ffab34793da14d1
SHA512	5913b4ac6389fbfb5b405e9c74357b99da24d4ea85df895a2f2896f6bb53138dcd195bbecac791df41dee0c97c60d1d1b6241e3bb29fd066117cc46117b947eb

C:\Windows\System\MsSKrXh.exe

MD5	84f99a5bdfe3c8e427fd45af3e194216
SHA1	af67f245d1fee895be0cf4525f3ea70c49405bfd
SHA256	e7bc661bb8ce585457b26c4044f7c18706d61d1f00545d988cbce44d4603a019
SHA512	853559123c5b08e85bdc581e5c00503f21b1b0569132fdcc15ed6729423685754f4aa89e401e8ad5e8b8c967d258fcbf46415378cf804b7a5f04222e99d4bddf

C:\Windows\System\KCqElDh.exe

MD5	1a8145fc39911f81cc3942453ed62ce8
SHA1	593bf460f210bf314af4473f3a067478b947686c
SHA256	02e5d21e8d698e880456ef5d131f0dd3dcdaa1d235e65d627078f8f59834af41
SHA512	3e213dacf900b69a7c325ced620b63a16073318fed4b74ccaf3ef8abbf7c245215c6a4c31f08a1c55ae11d4a78af7d564ea68207cdeb83310dae5cc3e0e29fb2

C:\Windows\System\WoSvRxv.exe

MD5	77f5307d4141e3c98a875951e47da69a
SHA1	ce773dec39f6c98a7f1755c0a08834fea71f94db
SHA256	a1962130d743c56ad852c8c7c23acdd8c789d5d7c1cb8512be7280fda4ebfd2d
SHA512	767199e649963037f93f0492749855cfecb7f9d9bef11a1301ee3cc4494204fefe0a9856c08a9f8e46a55195fce84f6aef770788088a2c7723c5f8bdb7a0d4fc

C:\Windows\System\dNEcCVB.exe

MD5	0f8a145197d67cacabf58707fdb6f127
SHA1	9b9f6f09594513325fc950289192f897624b2763
SHA256	3b0b9c9d83c87fe0ff10cbc1cf11cc48ba1e35434d6f786d5b3a4f205eb13e67
SHA512	6af752f4af88b75f075946f21ddf3c0a1bcad0eec8f9673e077006050792808653b4e066fa93827039ee4666f270902ed79b22224dcb9e02c4f04559b8c39bf5

C:\Windows\System\ZYiJgor.exe

MD5	34054f8a92ae77ff0dc3b2f892f2eed5
SHA1	7dba1565c6cda42524215a91871824804d5b28a5
SHA256	a39238b5b698a2c8d8cf539dae2b37a16eaf0ce14f82026aefe4c91e76a4c492
SHA512	b25a03393c264a2c53d43cc63c407a30eac37b433623db9f2f9e8885e4403803d0c3e624c4870644e6ced3e62cdc7933d83a53f944fa28b9b2b11715f0487279

C:\Windows\System\kFQEeZC.exe

MD5	c35e8c6751f63fcdfd8405d88ee91be3
SHA1	41f34b853181000887adcfe311ce8032d63eacc0
SHA256	482f339338318f7fdc06768ad4c63445cd805208051b81018617dccaa2ecb420
SHA512	5faa7870bc6457f89925c0cce7fe76c518ea041e8d6d3f85ca155651d19c7cc2adaa68766d29f6564f4bcbb8af66159cfc17cbb3e5ab3151e562f821f63ea0eb

C:\Windows\System\lVGEglM.exe

MD5	cebd005e5f3beb249e46ad8186eef3eb
SHA1	e7b3711f79cd5b834e23d9a72b1be209c6b3f144
SHA256	f9f38ddd8adb9f3b70b4886dd93f342733b1ef0f02b8ddd13ed7c57d085c86d2
SHA512	0e2919e6ab7a1abe4373e1456194f4c949e51174c0e57ea9959b116336aee06d4c3b9785157173c1d87608bb9089c09905584c944eb2c799112c017e9165e810

memory/3056-434-0x00007FF6D0560000-0x00007FF6D08B1000-memory.dmp

memory/1360-438-0x00007FF6DB800000-0x00007FF6DBB51000-memory.dmp

memory/864-446-0x00007FF6A1950000-0x00007FF6A1CA1000-memory.dmp

memory/1376-448-0x00007FF68DDF0000-0x00007FF68E141000-memory.dmp

memory/1356-443-0x00007FF7739E0000-0x00007FF773D31000-memory.dmp

memory/3872-433-0x00007FF6540E0000-0x00007FF654431000-memory.dmp

memory/3200-481-0x00007FF7DEAD0000-0x00007FF7DEE21000-memory.dmp

memory/5112-488-0x00007FF602070000-0x00007FF6023C1000-memory.dmp

memory/4056-517-0x00007FF7B5E00000-0x00007FF7B6151000-memory.dmp

memory/2612-512-0x00007FF700520000-0x00007FF700871000-memory.dmp

memory/4884-510-0x00007FF725850000-0x00007FF725BA1000-memory.dmp

memory/1604-506-0x00007FF601640000-0x00007FF601991000-memory.dmp

memory/1496-500-0x00007FF621850000-0x00007FF621BA1000-memory.dmp

memory/3160-499-0x00007FF7E6400000-0x00007FF7E6751000-memory.dmp

memory/2648-494-0x00007FF6F0530000-0x00007FF6F0881000-memory.dmp

memory/436-479-0x00007FF668580000-0x00007FF6688D1000-memory.dmp

memory/4264-473-0x00007FF69B8E0000-0x00007FF69BC31000-memory.dmp

memory/2672-470-0x00007FF6E7760000-0x00007FF6E7AB1000-memory.dmp

memory/968-463-0x00007FF639070000-0x00007FF6393C1000-memory.dmp

memory/3156-459-0x00007FF6161F0000-0x00007FF616541000-memory.dmp

memory/3584-452-0x00007FF62F880000-0x00007FF62FBD1000-memory.dmp

C:\Windows\System\WxFiiDI.exe

MD5	ff5d78fd258a786f25657fee6e63cc33
SHA1	5c59be651065df7e4769ce564a671566f3cffc38
SHA256	b98d7b30da1cfe947b516faa283f5f00280530443304443ddaa82cd19622a26c
SHA512	fe50e5dcff7a3aadccd86a00d574f755cb33dec5e84fb149f52b6621deca46ef76b09a74378416e5a77fc3aa73aa2a18987a18fbfe94dee404baf2cc62272ef6

C:\Windows\System\pjmndCl.exe

MD5	853586e7bb1782a012a84a510e9a2c30
SHA1	250450bd488145b9d532c926ed09a0e71bdbb67a
SHA256	f5ed0b061ca88da9ab3ed0ce0ce25545a36d642ba6610d2ed96059671060dfed
SHA512	dcdc3c83a275f2dfceb40d2903ceec85b61649138576668ff71f5ee481f7d72f2558ffb70294c8d203e094015a2fdda74539f93a71a69c4fd165604a970ae122

C:\Windows\System\xfDhMhc.exe

MD5	f241de1c70212450d0b0c4a2291bcdef
SHA1	e4db1f724dc6bff5fb5d4bc3bc295d61435725d3
SHA256	0bbe77a12412510cd95b68bda038a7751895c2a5ab6324e883c1c1e082b9a90b
SHA512	140c100b2f4d48573d99c2e61fb8e48caa2840223b71380ec0248f9cdc5fdf356a8e0d5aeeecfba20e379419532c2b3e3c7ac3c4fd6eea63c8e4d6d18da03c5d

C:\Windows\System\NprccEO.exe

MD5	a2e5e474177cfec4f1011edca40c79d5
SHA1	479a6fd41f121183dc20b3834f228242269b2db5
SHA256	0e589b15968b9718116d16806ab33e3959841066b28ae8f552c75c35c229bf34
SHA512	07fde007f3d1742eba9c364439ee71db1c09092e6db0a55944336543b15a8c0bc279d06fe64fef9118b6705eb216dfcf2e5b09e5428b2b4361d7b5808ba35dc1

C:\Windows\System\RvrqHZe.exe

MD5	edf81357117884f3fb38b0c05e707cb6
SHA1	39a6f5144b0fe705555dfc23955128febb9cf3d7
SHA256	c605744107126e7c00959c28aece20cc530a664fcdf10c0d95fcc3890610b767
SHA512	e48dce47936e0ef347bf82dce2cfc4757f6f07fbeabf83d1d326791f3561d86d63d46125d6b72a05ed40e584e63d6819a7a6fbac7a7c678085022395fef828e1

C:\Windows\System\bUBByDe.exe

MD5	1ac2de0d5bbbbcc642c8c57d0968185d
SHA1	b7f7db493433ba5bdaa9224e999c086588ff1d51
SHA256	f7df408e18b9c4dcd60bea6d8c060d86bb823cee839784b8cab73b6176a5aeb2
SHA512	e71c88314a21be6e7826a760d4d57688b28cf91025a9c41f3ece1b9f3ced28ba1305e8a05b844d304c4ad343b36c9317f0a6c53a00174165ba6042d96962f1f1

C:\Windows\System\ufxLDsq.exe

MD5	2a0fe605105cffa365492d5f06176e27
SHA1	96a037825bc7ee7aa53d51237052ad10e5081b82
SHA256	92a2c5f4b26d2f228ab07c46e22f8352f684e91dfb155644788f563743bf7cf2
SHA512	ccc62552ec6d12b56bf46f566696b6d5a8060baa8a0b304036503bc600bd99faa95ad8744b18d9be76ed5127e2d231f87aeb1ae94fc49d4a35f613861c612481

C:\Windows\System\KYEAxde.exe

MD5	1d0849402035cde5ddf2256c61ed1b09
SHA1	a4324c540e0b7bc250307a15c122b5f1833d3211
SHA256	1c3f2c3061ec5eaf7ddbedbc1b51e943dddf927f62f598ff580e4501f577ab3e
SHA512	79dc48c63210f8327f3dd20ebe62f00781dcf1c4bf2e232d81b34e47f7fed91da1d3883cfe276c9d7dcf9010db9cb9a915841651fce588a9bc5d3d84817cf49c

C:\Windows\System\dhOPkHz.exe

MD5	7c2983de289d45311dc6583f45d02d05
SHA1	0b7891109ce5aeb4ff2cbe8dd2ce30085c6c85f1
SHA256	543cd51739cc78d97a94d7850f47a03752cd9db24f12a2ea58f77bc00fda7c66
SHA512	2920a4efac311bcdc7d074af253dfa045848fd476e46d7f28c9a91d8e1d72f623d0494420795e97f7b3c4f480f1b8bee971d4270c84353ea271c7b7d0798a519

C:\Windows\System\TXonZPQ.exe

MD5	54bea7757da7cc77a11f7223afcf83ef
SHA1	077a44d90688e16fd5a17e30396bbe4736488ea7
SHA256	8e39f8b6a84ae16f458a59e0f85e7da42c5a424b60260d21e1beb20776942b0e
SHA512	71f0b4ac51953a8bd51a7dd159378ddd93dbe931450c7431e61beee1ae9be5c7811c9a393a8c260f1c347a07bf5c330a67f600a515cd6e8b58b32936ef2e56d6

C:\Windows\System\SPejKUP.exe

MD5	1829da432700422f94d769419209e0f2
SHA1	e453edc8ae94cbeb3d117dea0b831b28744113f4
SHA256	71f001e53c61b78499e3dda5859346ee5470a162a04fe50cc70310d5673a3c8f
SHA512	6713865bd4ce2ba5f387d8d19322adb90318d70a1114df3ace19d3c365e90f24d25a68e01c86ddbc411aee175eb70723562b0ea9d54147fe71be753bc9aa3519

C:\Windows\System\Ctpicdg.exe

MD5	597788a69c9f7faa008dfc57b2354682
SHA1	2cc28511c46fe59b97f3a46d29c066d362f9460c
SHA256	876ca6b9326111a98a06619c4de03f2a7fff0bb61e8516df4fe87e88aa85909c
SHA512	6191fb88ae14d3ac3be7545f4326c7504580cce1aeb2f574a27621531aafc1ee28ca12e2bc6e83dc3e7168c4f188f3e62c22fb77dc61426dee8e3253485e73f8

C:\Windows\System\QnWETbE.exe

MD5	a34924c72a13109eda8d0dc61510c821
SHA1	77802c90ae4d5415148115d5e0a2aa5354266e2d
SHA256	f81c462bf0e84e880668c9224ca7bb8ae2955c1d63978013355c287a04dcf591
SHA512	0cfa7f9d8860d170bd19f16f6879563a0cf9f9922ad31d4ff592b97bc5bc4b42ac88b3d86ca7c1f7f291de81b53e3d3b227f865ac28325290acc8348c0771c31

C:\Windows\System\iSHbYXt.exe

MD5	725203e4fcc568076252acac26d1c9da
SHA1	a517e7e0367b1c9e9974d55fb4776979171d364e
SHA256	9cfd9866716f989917b33ce3b718afcffd148e6adc529731be3f92b94881666c
SHA512	92b77b9a69b2e6a70846df68f2dc9926bdab8cb1b4ad0617e6e6bba3d8fdc4f17d751a61246b907ff952fb885bed30c5f6b0a8da00baf117b6dd7a131e4ac61d

C:\Windows\System\ZwYxXXS.exe

MD5	a4fe3495e0393aecaf1b413d77ffbfb8
SHA1	e822a5d8057bab8d80c4e58c84e2f0edfca61662
SHA256	e25c64448be9f8d14b4a440a4d33dca66bf542912d373ee0a49d590d7d781469
SHA512	cc3ba38239fdfec6b31fa6168313cc7a631936a67c50930426c73926ddcad8dc0eb3f1ff628aa8b7b5bc83f394161b7668b8a43ef24bd67bf84ac22fa745ac01

C:\Windows\System\mrzamTK.exe

MD5	14bfc7f418e29fefa627f01a7720d283
SHA1	eb4f09f07440f435d7e576548d20a3bef6db23b2
SHA256	ca209ef8620154165f0049351040cc50c2cab63a8c3e7c41295d41e4e6336564
SHA512	94c9889a73e50716b9cf688e94543d7bafacd3c2d5dd5aba376acb66b5ca2347520e0cd4d598c94433fa8982061395ad82f8ddae2332bfb3f211a74c9ed6be7e

C:\Windows\System\dlzOZDM.exe

MD5	653cc71c8d704bc97a5ceaa6c1555a9d
SHA1	a7619addc6df382aaad285f9d54fcad4d36dd7ea
SHA256	879cf630cb6d074ed8e9160a6f2be739ad6e6049c8ac6039ddda7fcfb333c5b0
SHA512	9d89b0467100465e24db6adf8e62a1f8665067cb72c6286b7258afc4974199d4b4842a61dd0148d4518037d5ceb2414906bdc95ae1c25e13b51c85c2dbe90ac0

C:\Windows\System\EFMdJvy.exe

MD5	8ade8ab8448287bd8312292f3d167594
SHA1	d27affab1686036b3128229b856a4732d5e057a9
SHA256	253a1efd29cfdaf89a94160d461eb6a0fa68e36a033b3d14a90fef5bb3018931
SHA512	0d7a7894e3c94d870228befe4df4313dda4b9dd22ea2306c15f71dcb9d5fe84f5124f1fe416e3ef0e4d4e4065b327ae041d3d72907c376fbb4c355fe45c696b0

memory/1956-45-0x00007FF7AEA10000-0x00007FF7AED61000-memory.dmp

memory/4980-44-0x00007FF7AFA30000-0x00007FF7AFD81000-memory.dmp

memory/1728-40-0x00007FF623FB0000-0x00007FF624301000-memory.dmp

memory/4800-39-0x00007FF716410000-0x00007FF716761000-memory.dmp

C:\Windows\System\ENLAHmh.exe

MD5	9f531791e3bb93a2c29dba49a8ad34fb
SHA1	0454aa69d9866e70338f07d8071efd04e0108ba1
SHA256	ed5960c10663de3d93d0c0616381addfabc074c3099ee0ba68a3d8801e951d42
SHA512	0b488f471e79ec26775c0747336c582cff0abf97da26af04a80062e7028d6aa70bab2535cabf6569f260062b27c3c3fbc64a058cb58775229271a827bc3e4599

memory/464-29-0x00007FF61C790000-0x00007FF61CAE1000-memory.dmp

memory/1716-20-0x00007FF6AD4E0000-0x00007FF6AD831000-memory.dmp

memory/1572-2165-0x00007FF635A60000-0x00007FF635DB1000-memory.dmp

memory/2228-2198-0x00007FF7EE7F0000-0x00007FF7EEB41000-memory.dmp

memory/916-2199-0x00007FF60C310000-0x00007FF60C661000-memory.dmp

memory/1716-2200-0x00007FF6AD4E0000-0x00007FF6AD831000-memory.dmp

memory/464-2201-0x00007FF61C790000-0x00007FF61CAE1000-memory.dmp

memory/4800-2202-0x00007FF716410000-0x00007FF716761000-memory.dmp

memory/1956-2237-0x00007FF7AEA10000-0x00007FF7AED61000-memory.dmp

memory/2228-2241-0x00007FF7EE7F0000-0x00007FF7EEB41000-memory.dmp

memory/916-2243-0x00007FF60C310000-0x00007FF60C661000-memory.dmp

memory/1716-2245-0x00007FF6AD4E0000-0x00007FF6AD831000-memory.dmp

memory/1728-2247-0x00007FF623FB0000-0x00007FF624301000-memory.dmp

memory/4800-2251-0x00007FF716410000-0x00007FF716761000-memory.dmp

memory/464-2249-0x00007FF61C790000-0x00007FF61CAE1000-memory.dmp

memory/1956-2253-0x00007FF7AEA10000-0x00007FF7AED61000-memory.dmp

memory/3872-2265-0x00007FF6540E0000-0x00007FF654431000-memory.dmp

memory/864-2263-0x00007FF6A1950000-0x00007FF6A1CA1000-memory.dmp

memory/3584-2267-0x00007FF62F880000-0x00007FF62FBD1000-memory.dmp

memory/968-2271-0x00007FF639070000-0x00007FF6393C1000-memory.dmp

memory/436-2277-0x00007FF668580000-0x00007FF6688D1000-memory.dmp

memory/3200-2281-0x00007FF7DEAD0000-0x00007FF7DEE21000-memory.dmp

memory/5112-2279-0x00007FF602070000-0x00007FF6023C1000-memory.dmp

memory/4264-2275-0x00007FF69B8E0000-0x00007FF69BC31000-memory.dmp

memory/2672-2273-0x00007FF6E7760000-0x00007FF6E7AB1000-memory.dmp

memory/3156-2269-0x00007FF6161F0000-0x00007FF616541000-memory.dmp

memory/1360-2261-0x00007FF6DB800000-0x00007FF6DBB51000-memory.dmp

memory/1356-2259-0x00007FF7739E0000-0x00007FF773D31000-memory.dmp

memory/1376-2257-0x00007FF68DDF0000-0x00007FF68E141000-memory.dmp

memory/3056-2255-0x00007FF6D0560000-0x00007FF6D08B1000-memory.dmp

memory/3160-2287-0x00007FF7E6400000-0x00007FF7E6751000-memory.dmp

memory/4056-2308-0x00007FF7B5E00000-0x00007FF7B6151000-memory.dmp

memory/2612-2310-0x00007FF700520000-0x00007FF700871000-memory.dmp

memory/1604-2289-0x00007FF601640000-0x00007FF601991000-memory.dmp

memory/4884-2291-0x00007FF725850000-0x00007FF725BA1000-memory.dmp

memory/2648-2285-0x00007FF6F0530000-0x00007FF6F0881000-memory.dmp

memory/1496-2283-0x00007FF621850000-0x00007FF621BA1000-memory.dmp

memory/4980-2385-0x00007FF7AFA30000-0x00007FF7AFD81000-memory.dmp

Sample ID	240613-1vr9ps1hqb
Target	8a3e90ddf4e204cfd781335910552130_NeikiAnalytics.exe
SHA256	3ea459d9651645fc03ca0c8bfbf7b99247bc458579211c2903cd3e3371e8dc8d
Tags	upx miner xmrig

Malware Analysis Report

2024-07-28 21:20

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files