Analysis Overview

score

10^/10

SHA256

b8b3784ea46ab9f42817e49b6a2d5acc8eb0f73e5f6b189d901149121ec844ed

Threat Level: Known bad

The file 8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

upx miner xmrig

xmrig

XMRig Miner payload

Xmrig family

XMRig Miner payload

Loads dropped DLL

UPX packed file

Executes dropped EXE

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 22:31

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Xmrig family

xmrig

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 22:31

Reported

2024-06-13 22:33

Platform

win7-20240508-en

Max time kernel

141s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\VopbbYB.exe	N/A
N/A	N/A	C:\Windows\System\BeAQUWD.exe	N/A
N/A	N/A	C:\Windows\System\jhVhfPg.exe	N/A
N/A	N/A	C:\Windows\System\curPUUc.exe	N/A
N/A	N/A	C:\Windows\System\LNOCmYA.exe	N/A
N/A	N/A	C:\Windows\System\zGVGrne.exe	N/A
N/A	N/A	C:\Windows\System\aopkAGq.exe	N/A
N/A	N/A	C:\Windows\System\sDZPfaI.exe	N/A
N/A	N/A	C:\Windows\System\ngqpKZK.exe	N/A
N/A	N/A	C:\Windows\System\TfIAACh.exe	N/A
N/A	N/A	C:\Windows\System\uUiQaWn.exe	N/A
N/A	N/A	C:\Windows\System\caoahvS.exe	N/A
N/A	N/A	C:\Windows\System\vLTtWKq.exe	N/A
N/A	N/A	C:\Windows\System\DyaTanT.exe	N/A
N/A	N/A	C:\Windows\System\rwjlnRp.exe	N/A
N/A	N/A	C:\Windows\System\SvAmQqS.exe	N/A
N/A	N/A	C:\Windows\System\oLfnlYc.exe	N/A
N/A	N/A	C:\Windows\System\WQKMtuR.exe	N/A
N/A	N/A	C:\Windows\System\Amuwder.exe	N/A
N/A	N/A	C:\Windows\System\YXMDwDX.exe	N/A
N/A	N/A	C:\Windows\System\HDbQwLK.exe	N/A
N/A	N/A	C:\Windows\System\NNEVSbr.exe	N/A
N/A	N/A	C:\Windows\System\eVIcaKu.exe	N/A
N/A	N/A	C:\Windows\System\yVngxbx.exe	N/A
N/A	N/A	C:\Windows\System\fqWQSmo.exe	N/A
N/A	N/A	C:\Windows\System\xjaWnaV.exe	N/A
N/A	N/A	C:\Windows\System\ZGQDulq.exe	N/A
N/A	N/A	C:\Windows\System\qBgeVkH.exe	N/A
N/A	N/A	C:\Windows\System\WgEXSdM.exe	N/A
N/A	N/A	C:\Windows\System\srpXkLR.exe	N/A
N/A	N/A	C:\Windows\System\fCXeRwj.exe	N/A
N/A	N/A	C:\Windows\System\wbvGfbB.exe	N/A
N/A	N/A	C:\Windows\System\XEhTWiA.exe	N/A
N/A	N/A	C:\Windows\System\FbpsUaR.exe	N/A
N/A	N/A	C:\Windows\System\RfXppvd.exe	N/A
N/A	N/A	C:\Windows\System\weFnbpr.exe	N/A
N/A	N/A	C:\Windows\System\QehVrqj.exe	N/A
N/A	N/A	C:\Windows\System\qOPdrfj.exe	N/A
N/A	N/A	C:\Windows\System\QmmmrlC.exe	N/A
N/A	N/A	C:\Windows\System\OOpggoB.exe	N/A
N/A	N/A	C:\Windows\System\vOerQVf.exe	N/A
N/A	N/A	C:\Windows\System\FjFaYnb.exe	N/A
N/A	N/A	C:\Windows\System\HGjUTvj.exe	N/A
N/A	N/A	C:\Windows\System\TmVhZZD.exe	N/A
N/A	N/A	C:\Windows\System\hLkLMqe.exe	N/A
N/A	N/A	C:\Windows\System\XkZYfBr.exe	N/A
N/A	N/A	C:\Windows\System\ZGhzPTM.exe	N/A
N/A	N/A	C:\Windows\System\LzqAPJh.exe	N/A
N/A	N/A	C:\Windows\System\hhbmJRs.exe	N/A
N/A	N/A	C:\Windows\System\iceCSRn.exe	N/A
N/A	N/A	C:\Windows\System\uPzAnZT.exe	N/A
N/A	N/A	C:\Windows\System\gWYgSbN.exe	N/A
N/A	N/A	C:\Windows\System\TaceWUv.exe	N/A
N/A	N/A	C:\Windows\System\UTysIlc.exe	N/A
N/A	N/A	C:\Windows\System\eZnmdbB.exe	N/A
N/A	N/A	C:\Windows\System\GCzQOJq.exe	N/A
N/A	N/A	C:\Windows\System\TjiDaDq.exe	N/A
N/A	N/A	C:\Windows\System\FPufDAC.exe	N/A
N/A	N/A	C:\Windows\System\MiDLZpS.exe	N/A
N/A	N/A	C:\Windows\System\NBmKgDV.exe	N/A
N/A	N/A	C:\Windows\System\GzxfYVJ.exe	N/A
N/A	N/A	C:\Windows\System\pXHUlfU.exe	N/A
N/A	N/A	C:\Windows\System\cxkXHtn.exe	N/A
N/A	N/A	C:\Windows\System\odHGnhe.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\tBMvqvZ.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cHXrFFK.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AnYlyKZ.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OLyTGQI.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VBhnmQi.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tFnawxl.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ifNMGlf.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GtyCDxB.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ejpsRPO.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UkdVyUM.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kwGTPJL.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YZWriMR.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DceStaM.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SAxZUxK.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QeMaiFQ.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VeQszRS.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\svxFhMM.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ExogVKK.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YexjVMA.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KXmFQMj.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sShXgVI.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zqeAOtm.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WLbahYs.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mYSByjF.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fPFaula.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oBwnZtp.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KXrRgPv.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NAeBPJq.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LyniSlK.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bgJpZfy.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vXYZkCJ.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eANsXow.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MuGxseE.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dmInSnp.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xaTDuCS.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NhfNmCt.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WavkyYh.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BogLKRv.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kyTkzyo.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JXLqylY.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OjDtZoS.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CmlhTRw.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ycGAKRB.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yAAfkon.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dyRcgip.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PdNnJTy.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HnnqJrd.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QLGSWjR.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gocjaqQ.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rueycwv.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vdQJhUu.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BZokGTd.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WvkdirA.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QAXBdJp.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qTmTNHS.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qXFkIQU.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZRrpmXs.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vpGRUeZ.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IbfLKWv.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TMcBMbT.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MVvQkhP.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VopbbYB.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TaICAyl.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dHEPQUD.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2020 wrote to memory of 2904	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\VopbbYB.exe
PID 2020 wrote to memory of 2904	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\VopbbYB.exe
PID 2020 wrote to memory of 2904	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\VopbbYB.exe
PID 2020 wrote to memory of 2428	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\jhVhfPg.exe
PID 2020 wrote to memory of 2428	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\jhVhfPg.exe
PID 2020 wrote to memory of 2428	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\jhVhfPg.exe
PID 2020 wrote to memory of 2716	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\BeAQUWD.exe
PID 2020 wrote to memory of 2716	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\BeAQUWD.exe
PID 2020 wrote to memory of 2716	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\BeAQUWD.exe
PID 2020 wrote to memory of 3044	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\curPUUc.exe
PID 2020 wrote to memory of 3044	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\curPUUc.exe
PID 2020 wrote to memory of 3044	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\curPUUc.exe
PID 2020 wrote to memory of 2668	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\LNOCmYA.exe
PID 2020 wrote to memory of 2668	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\LNOCmYA.exe
PID 2020 wrote to memory of 2668	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\LNOCmYA.exe
PID 2020 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\zGVGrne.exe
PID 2020 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\zGVGrne.exe
PID 2020 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\zGVGrne.exe
PID 2020 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\aopkAGq.exe
PID 2020 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\aopkAGq.exe
PID 2020 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\aopkAGq.exe
PID 2020 wrote to memory of 3048	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\sDZPfaI.exe
PID 2020 wrote to memory of 3048	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\sDZPfaI.exe
PID 2020 wrote to memory of 3048	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\sDZPfaI.exe
PID 2020 wrote to memory of 2680	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\ngqpKZK.exe
PID 2020 wrote to memory of 2680	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\ngqpKZK.exe
PID 2020 wrote to memory of 2680	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\ngqpKZK.exe
PID 2020 wrote to memory of 2556	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\TfIAACh.exe
PID 2020 wrote to memory of 2556	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\TfIAACh.exe
PID 2020 wrote to memory of 2556	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\TfIAACh.exe
PID 2020 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\uUiQaWn.exe
PID 2020 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\uUiQaWn.exe
PID 2020 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\uUiQaWn.exe
PID 2020 wrote to memory of 2692	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\caoahvS.exe
PID 2020 wrote to memory of 2692	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\caoahvS.exe
PID 2020 wrote to memory of 2692	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\caoahvS.exe
PID 2020 wrote to memory of 2780	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\vLTtWKq.exe
PID 2020 wrote to memory of 2780	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\vLTtWKq.exe
PID 2020 wrote to memory of 2780	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\vLTtWKq.exe
PID 2020 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\DyaTanT.exe
PID 2020 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\DyaTanT.exe
PID 2020 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\DyaTanT.exe
PID 2020 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\rwjlnRp.exe
PID 2020 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\rwjlnRp.exe
PID 2020 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\rwjlnRp.exe
PID 2020 wrote to memory of 2972	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\SvAmQqS.exe
PID 2020 wrote to memory of 2972	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\SvAmQqS.exe
PID 2020 wrote to memory of 2972	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\SvAmQqS.exe
PID 2020 wrote to memory of 1812	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\oLfnlYc.exe
PID 2020 wrote to memory of 1812	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\oLfnlYc.exe
PID 2020 wrote to memory of 1812	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\oLfnlYc.exe
PID 2020 wrote to memory of 780	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\WQKMtuR.exe
PID 2020 wrote to memory of 780	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\WQKMtuR.exe
PID 2020 wrote to memory of 780	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\WQKMtuR.exe
PID 2020 wrote to memory of 1576	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\Amuwder.exe
PID 2020 wrote to memory of 1576	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\Amuwder.exe
PID 2020 wrote to memory of 1576	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\Amuwder.exe
PID 2020 wrote to memory of 1924	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\YXMDwDX.exe
PID 2020 wrote to memory of 1924	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\YXMDwDX.exe
PID 2020 wrote to memory of 1924	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\YXMDwDX.exe
PID 2020 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\HDbQwLK.exe
PID 2020 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\HDbQwLK.exe
PID 2020 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\HDbQwLK.exe
PID 2020 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\NNEVSbr.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe"

C:\Windows\System\VopbbYB.exe

C:\Windows\System\VopbbYB.exe

C:\Windows\System\jhVhfPg.exe

C:\Windows\System\jhVhfPg.exe

C:\Windows\System\BeAQUWD.exe

C:\Windows\System\BeAQUWD.exe

C:\Windows\System\curPUUc.exe

C:\Windows\System\curPUUc.exe

C:\Windows\System\LNOCmYA.exe

C:\Windows\System\LNOCmYA.exe

C:\Windows\System\zGVGrne.exe

C:\Windows\System\zGVGrne.exe

C:\Windows\System\aopkAGq.exe

C:\Windows\System\aopkAGq.exe

C:\Windows\System\sDZPfaI.exe

C:\Windows\System\sDZPfaI.exe

C:\Windows\System\ngqpKZK.exe

C:\Windows\System\ngqpKZK.exe

C:\Windows\System\TfIAACh.exe

C:\Windows\System\TfIAACh.exe

C:\Windows\System\uUiQaWn.exe

C:\Windows\System\uUiQaWn.exe

C:\Windows\System\caoahvS.exe

C:\Windows\System\caoahvS.exe

C:\Windows\System\vLTtWKq.exe

C:\Windows\System\vLTtWKq.exe

C:\Windows\System\DyaTanT.exe

C:\Windows\System\DyaTanT.exe

C:\Windows\System\rwjlnRp.exe

C:\Windows\System\rwjlnRp.exe

C:\Windows\System\SvAmQqS.exe

C:\Windows\System\SvAmQqS.exe

C:\Windows\System\oLfnlYc.exe

C:\Windows\System\oLfnlYc.exe

C:\Windows\System\WQKMtuR.exe

C:\Windows\System\WQKMtuR.exe

C:\Windows\System\Amuwder.exe

C:\Windows\System\Amuwder.exe

C:\Windows\System\YXMDwDX.exe

C:\Windows\System\YXMDwDX.exe

C:\Windows\System\HDbQwLK.exe

C:\Windows\System\HDbQwLK.exe

C:\Windows\System\NNEVSbr.exe

C:\Windows\System\NNEVSbr.exe

C:\Windows\System\eVIcaKu.exe

C:\Windows\System\eVIcaKu.exe

C:\Windows\System\yVngxbx.exe

C:\Windows\System\yVngxbx.exe

C:\Windows\System\fqWQSmo.exe

C:\Windows\System\fqWQSmo.exe

C:\Windows\System\ZGQDulq.exe

C:\Windows\System\ZGQDulq.exe

C:\Windows\System\xjaWnaV.exe

C:\Windows\System\xjaWnaV.exe

C:\Windows\System\qBgeVkH.exe

C:\Windows\System\qBgeVkH.exe

C:\Windows\System\WgEXSdM.exe

C:\Windows\System\WgEXSdM.exe

C:\Windows\System\srpXkLR.exe

C:\Windows\System\srpXkLR.exe

C:\Windows\System\fCXeRwj.exe

C:\Windows\System\fCXeRwj.exe

C:\Windows\System\wbvGfbB.exe

C:\Windows\System\wbvGfbB.exe

C:\Windows\System\XEhTWiA.exe

C:\Windows\System\XEhTWiA.exe

C:\Windows\System\FbpsUaR.exe

C:\Windows\System\FbpsUaR.exe

C:\Windows\System\RfXppvd.exe

C:\Windows\System\RfXppvd.exe

C:\Windows\System\weFnbpr.exe

C:\Windows\System\weFnbpr.exe

C:\Windows\System\QehVrqj.exe

C:\Windows\System\QehVrqj.exe

C:\Windows\System\qOPdrfj.exe

C:\Windows\System\qOPdrfj.exe

C:\Windows\System\QmmmrlC.exe

C:\Windows\System\QmmmrlC.exe

C:\Windows\System\OOpggoB.exe

C:\Windows\System\OOpggoB.exe

C:\Windows\System\vOerQVf.exe

C:\Windows\System\vOerQVf.exe

C:\Windows\System\FjFaYnb.exe

C:\Windows\System\FjFaYnb.exe

C:\Windows\System\HGjUTvj.exe

C:\Windows\System\HGjUTvj.exe

C:\Windows\System\TmVhZZD.exe

C:\Windows\System\TmVhZZD.exe

C:\Windows\System\hLkLMqe.exe

C:\Windows\System\hLkLMqe.exe

C:\Windows\System\XkZYfBr.exe

C:\Windows\System\XkZYfBr.exe

C:\Windows\System\ZGhzPTM.exe

C:\Windows\System\ZGhzPTM.exe

C:\Windows\System\LzqAPJh.exe

C:\Windows\System\LzqAPJh.exe

C:\Windows\System\hhbmJRs.exe

C:\Windows\System\hhbmJRs.exe

C:\Windows\System\iceCSRn.exe

C:\Windows\System\iceCSRn.exe

C:\Windows\System\uPzAnZT.exe

C:\Windows\System\uPzAnZT.exe

C:\Windows\System\gWYgSbN.exe

C:\Windows\System\gWYgSbN.exe

C:\Windows\System\TaceWUv.exe

C:\Windows\System\TaceWUv.exe

C:\Windows\System\UTysIlc.exe

C:\Windows\System\UTysIlc.exe

C:\Windows\System\eZnmdbB.exe

C:\Windows\System\eZnmdbB.exe

C:\Windows\System\GCzQOJq.exe

C:\Windows\System\GCzQOJq.exe

C:\Windows\System\TjiDaDq.exe

C:\Windows\System\TjiDaDq.exe

C:\Windows\System\FPufDAC.exe

C:\Windows\System\FPufDAC.exe

C:\Windows\System\MiDLZpS.exe

C:\Windows\System\MiDLZpS.exe

C:\Windows\System\NBmKgDV.exe

C:\Windows\System\NBmKgDV.exe

C:\Windows\System\GzxfYVJ.exe

C:\Windows\System\GzxfYVJ.exe

C:\Windows\System\pXHUlfU.exe

C:\Windows\System\pXHUlfU.exe

C:\Windows\System\cxkXHtn.exe

C:\Windows\System\cxkXHtn.exe

C:\Windows\System\odHGnhe.exe

C:\Windows\System\odHGnhe.exe

C:\Windows\System\xYnvhuO.exe

C:\Windows\System\xYnvhuO.exe

C:\Windows\System\fDGeKnV.exe

C:\Windows\System\fDGeKnV.exe

C:\Windows\System\xSRzPRi.exe

C:\Windows\System\xSRzPRi.exe

C:\Windows\System\PKVgPoF.exe

C:\Windows\System\PKVgPoF.exe

C:\Windows\System\AXlNdkL.exe

C:\Windows\System\AXlNdkL.exe

C:\Windows\System\OTqFkJO.exe

C:\Windows\System\OTqFkJO.exe

C:\Windows\System\lbaiWEy.exe

C:\Windows\System\lbaiWEy.exe

C:\Windows\System\foAJktZ.exe

C:\Windows\System\foAJktZ.exe

C:\Windows\System\MFAJggX.exe

C:\Windows\System\MFAJggX.exe

C:\Windows\System\oKpMOJe.exe

C:\Windows\System\oKpMOJe.exe

C:\Windows\System\zhJREsw.exe

C:\Windows\System\zhJREsw.exe

C:\Windows\System\dhHuIUo.exe

C:\Windows\System\dhHuIUo.exe

C:\Windows\System\wtiLTHx.exe

C:\Windows\System\wtiLTHx.exe

C:\Windows\System\zCShaxT.exe

C:\Windows\System\zCShaxT.exe

C:\Windows\System\ZFKWPuT.exe

C:\Windows\System\ZFKWPuT.exe

C:\Windows\System\tOyBbhH.exe

C:\Windows\System\tOyBbhH.exe

C:\Windows\System\xYDkcRk.exe

C:\Windows\System\xYDkcRk.exe

C:\Windows\System\wUGczzx.exe

C:\Windows\System\wUGczzx.exe

C:\Windows\System\XAngcZP.exe

C:\Windows\System\XAngcZP.exe

C:\Windows\System\eaLXCci.exe

C:\Windows\System\eaLXCci.exe

C:\Windows\System\MEwCoTL.exe

C:\Windows\System\MEwCoTL.exe

C:\Windows\System\ZzAZcwa.exe

C:\Windows\System\ZzAZcwa.exe

C:\Windows\System\MKsBeYu.exe

C:\Windows\System\MKsBeYu.exe

C:\Windows\System\vZVehkq.exe

C:\Windows\System\vZVehkq.exe

C:\Windows\System\jXWyGxs.exe

C:\Windows\System\jXWyGxs.exe

C:\Windows\System\IRBPrjs.exe

C:\Windows\System\IRBPrjs.exe

C:\Windows\System\xYAMMSq.exe

C:\Windows\System\xYAMMSq.exe

C:\Windows\System\VyzAkty.exe

C:\Windows\System\VyzAkty.exe

C:\Windows\System\gxbACLD.exe

C:\Windows\System\gxbACLD.exe

C:\Windows\System\RdhPqZU.exe

C:\Windows\System\RdhPqZU.exe

C:\Windows\System\usMvaUk.exe

C:\Windows\System\usMvaUk.exe

C:\Windows\System\IckfDzs.exe

C:\Windows\System\IckfDzs.exe

C:\Windows\System\TsaDNUF.exe

C:\Windows\System\TsaDNUF.exe

C:\Windows\System\mFmBugj.exe

C:\Windows\System\mFmBugj.exe

C:\Windows\System\WMsESsN.exe

C:\Windows\System\WMsESsN.exe

C:\Windows\System\WBWojes.exe

C:\Windows\System\WBWojes.exe

C:\Windows\System\kOlvXdI.exe

C:\Windows\System\kOlvXdI.exe

C:\Windows\System\qXjERJP.exe

C:\Windows\System\qXjERJP.exe

C:\Windows\System\hPPqpRL.exe

C:\Windows\System\hPPqpRL.exe

C:\Windows\System\DbALQgL.exe

C:\Windows\System\DbALQgL.exe

C:\Windows\System\KcgVRmd.exe

C:\Windows\System\KcgVRmd.exe

C:\Windows\System\EMsxedz.exe

C:\Windows\System\EMsxedz.exe

C:\Windows\System\LtXYCse.exe

C:\Windows\System\LtXYCse.exe

C:\Windows\System\SDWngYX.exe

C:\Windows\System\SDWngYX.exe

C:\Windows\System\nVztwEn.exe

C:\Windows\System\nVztwEn.exe

C:\Windows\System\txKMOZZ.exe

C:\Windows\System\txKMOZZ.exe

C:\Windows\System\weqUkVy.exe

C:\Windows\System\weqUkVy.exe

C:\Windows\System\phOiCPx.exe

C:\Windows\System\phOiCPx.exe

C:\Windows\System\vFGzSSH.exe

C:\Windows\System\vFGzSSH.exe

C:\Windows\System\pAKOfMM.exe

C:\Windows\System\pAKOfMM.exe

C:\Windows\System\XVIFYJs.exe

C:\Windows\System\XVIFYJs.exe

C:\Windows\System\GDJflFD.exe

C:\Windows\System\GDJflFD.exe

C:\Windows\System\rRiijIL.exe

C:\Windows\System\rRiijIL.exe

C:\Windows\System\xsBEzuX.exe

C:\Windows\System\xsBEzuX.exe

C:\Windows\System\qnrUlES.exe

C:\Windows\System\qnrUlES.exe

C:\Windows\System\wSciYLw.exe

C:\Windows\System\wSciYLw.exe

C:\Windows\System\xCzjaEM.exe

C:\Windows\System\xCzjaEM.exe

C:\Windows\System\bsRBQYz.exe

C:\Windows\System\bsRBQYz.exe

C:\Windows\System\LpDEOFy.exe

C:\Windows\System\LpDEOFy.exe

C:\Windows\System\zzuudGe.exe

C:\Windows\System\zzuudGe.exe

C:\Windows\System\FUgluYR.exe

C:\Windows\System\FUgluYR.exe

C:\Windows\System\ZWfJGbR.exe

C:\Windows\System\ZWfJGbR.exe

C:\Windows\System\cCcgets.exe

C:\Windows\System\cCcgets.exe

C:\Windows\System\PNFWzUM.exe

C:\Windows\System\PNFWzUM.exe

C:\Windows\System\uHCreQC.exe

C:\Windows\System\uHCreQC.exe

C:\Windows\System\mkHrvFz.exe

C:\Windows\System\mkHrvFz.exe

C:\Windows\System\ETpbfTq.exe

C:\Windows\System\ETpbfTq.exe

C:\Windows\System\ykRswdC.exe

C:\Windows\System\ykRswdC.exe

C:\Windows\System\DiHSBeb.exe

C:\Windows\System\DiHSBeb.exe

C:\Windows\System\uCxLzbq.exe

C:\Windows\System\uCxLzbq.exe

C:\Windows\System\BZAUDKq.exe

C:\Windows\System\BZAUDKq.exe

C:\Windows\System\Gxbpqhs.exe

C:\Windows\System\Gxbpqhs.exe

C:\Windows\System\KXrRgPv.exe

C:\Windows\System\KXrRgPv.exe

C:\Windows\System\vpGRUeZ.exe

C:\Windows\System\vpGRUeZ.exe

C:\Windows\System\LPDMroa.exe

C:\Windows\System\LPDMroa.exe

C:\Windows\System\frgOaxj.exe

C:\Windows\System\frgOaxj.exe

C:\Windows\System\bARFBuv.exe

C:\Windows\System\bARFBuv.exe

C:\Windows\System\nZoDDrG.exe

C:\Windows\System\nZoDDrG.exe

C:\Windows\System\cZmWdYB.exe

C:\Windows\System\cZmWdYB.exe

C:\Windows\System\iSpOzmC.exe

C:\Windows\System\iSpOzmC.exe

C:\Windows\System\rjYkTHf.exe

C:\Windows\System\rjYkTHf.exe

C:\Windows\System\xFmRRnn.exe

C:\Windows\System\xFmRRnn.exe

C:\Windows\System\pmUFwPR.exe

C:\Windows\System\pmUFwPR.exe

C:\Windows\System\oWbqztf.exe

C:\Windows\System\oWbqztf.exe

C:\Windows\System\AJEGway.exe

C:\Windows\System\AJEGway.exe

C:\Windows\System\fzNMpFp.exe

C:\Windows\System\fzNMpFp.exe

C:\Windows\System\tRhsGGx.exe

C:\Windows\System\tRhsGGx.exe

C:\Windows\System\jletZKc.exe

C:\Windows\System\jletZKc.exe

C:\Windows\System\PflLFIQ.exe

C:\Windows\System\PflLFIQ.exe

C:\Windows\System\SQKpkeP.exe

C:\Windows\System\SQKpkeP.exe

C:\Windows\System\TSermFx.exe

C:\Windows\System\TSermFx.exe

C:\Windows\System\hVLGxOV.exe

C:\Windows\System\hVLGxOV.exe

C:\Windows\System\djFaqUg.exe

C:\Windows\System\djFaqUg.exe

C:\Windows\System\UJGOurn.exe

C:\Windows\System\UJGOurn.exe

C:\Windows\System\ycGAKRB.exe

C:\Windows\System\ycGAKRB.exe

C:\Windows\System\WGYuQQJ.exe

C:\Windows\System\WGYuQQJ.exe

C:\Windows\System\Ihoqnuw.exe

C:\Windows\System\Ihoqnuw.exe

C:\Windows\System\TamcNHu.exe

C:\Windows\System\TamcNHu.exe

C:\Windows\System\WMUIczu.exe

C:\Windows\System\WMUIczu.exe

C:\Windows\System\qGVYJKF.exe

C:\Windows\System\qGVYJKF.exe

C:\Windows\System\mjOHniI.exe

C:\Windows\System\mjOHniI.exe

C:\Windows\System\GhlKqTv.exe

C:\Windows\System\GhlKqTv.exe

C:\Windows\System\HdqlNVN.exe

C:\Windows\System\HdqlNVN.exe

C:\Windows\System\fkmsAmS.exe

C:\Windows\System\fkmsAmS.exe

C:\Windows\System\vfUmZkr.exe

C:\Windows\System\vfUmZkr.exe

C:\Windows\System\HRfBAlF.exe

C:\Windows\System\HRfBAlF.exe

C:\Windows\System\CNHdZLT.exe

C:\Windows\System\CNHdZLT.exe

C:\Windows\System\zRIMFzY.exe

C:\Windows\System\zRIMFzY.exe

C:\Windows\System\QIKEcAd.exe

C:\Windows\System\QIKEcAd.exe

C:\Windows\System\HldGLFy.exe

C:\Windows\System\HldGLFy.exe

C:\Windows\System\LRFbEyE.exe

C:\Windows\System\LRFbEyE.exe

C:\Windows\System\taOFGTS.exe

C:\Windows\System\taOFGTS.exe

C:\Windows\System\lTOumba.exe

C:\Windows\System\lTOumba.exe

C:\Windows\System\XNpIrVG.exe

C:\Windows\System\XNpIrVG.exe

C:\Windows\System\XXxKmkn.exe

C:\Windows\System\XXxKmkn.exe

C:\Windows\System\VXQqYWw.exe

C:\Windows\System\VXQqYWw.exe

C:\Windows\System\uDhUMxF.exe

C:\Windows\System\uDhUMxF.exe

C:\Windows\System\WTdyyDe.exe

C:\Windows\System\WTdyyDe.exe

C:\Windows\System\KXmFQMj.exe

C:\Windows\System\KXmFQMj.exe

C:\Windows\System\ZaSmDmH.exe

C:\Windows\System\ZaSmDmH.exe

C:\Windows\System\wHDmcuK.exe

C:\Windows\System\wHDmcuK.exe

C:\Windows\System\YhEllXJ.exe

C:\Windows\System\YhEllXJ.exe

C:\Windows\System\FJTFsjv.exe

C:\Windows\System\FJTFsjv.exe

C:\Windows\System\JzTKhNu.exe

C:\Windows\System\JzTKhNu.exe

C:\Windows\System\oiGzMuv.exe

C:\Windows\System\oiGzMuv.exe

C:\Windows\System\GjimeMy.exe

C:\Windows\System\GjimeMy.exe

C:\Windows\System\ldesHuM.exe

C:\Windows\System\ldesHuM.exe

C:\Windows\System\QwTkkoc.exe

C:\Windows\System\QwTkkoc.exe

C:\Windows\System\HvnltKp.exe

C:\Windows\System\HvnltKp.exe

C:\Windows\System\QiLmsSz.exe

C:\Windows\System\QiLmsSz.exe

C:\Windows\System\BgpnroE.exe

C:\Windows\System\BgpnroE.exe

C:\Windows\System\OsaLTtK.exe

C:\Windows\System\OsaLTtK.exe

C:\Windows\System\ZVxJZqu.exe

C:\Windows\System\ZVxJZqu.exe

C:\Windows\System\TYCoRJC.exe

C:\Windows\System\TYCoRJC.exe

C:\Windows\System\FAMxWpV.exe

C:\Windows\System\FAMxWpV.exe

C:\Windows\System\GOZSFZl.exe

C:\Windows\System\GOZSFZl.exe

C:\Windows\System\tggPDnX.exe

C:\Windows\System\tggPDnX.exe

C:\Windows\System\UgHfrxp.exe

C:\Windows\System\UgHfrxp.exe

C:\Windows\System\BAIHXie.exe

C:\Windows\System\BAIHXie.exe

C:\Windows\System\aujFnCF.exe

C:\Windows\System\aujFnCF.exe

C:\Windows\System\pmoGYjm.exe

C:\Windows\System\pmoGYjm.exe

C:\Windows\System\shwfAdJ.exe

C:\Windows\System\shwfAdJ.exe

C:\Windows\System\kSUOChK.exe

C:\Windows\System\kSUOChK.exe

C:\Windows\System\yCTkPtq.exe

C:\Windows\System\yCTkPtq.exe

C:\Windows\System\BsDfEEd.exe

C:\Windows\System\BsDfEEd.exe

C:\Windows\System\NKxHpVu.exe

C:\Windows\System\NKxHpVu.exe

C:\Windows\System\uQxvczx.exe

C:\Windows\System\uQxvczx.exe

C:\Windows\System\bdRMPvh.exe

C:\Windows\System\bdRMPvh.exe

C:\Windows\System\LdkKmav.exe

C:\Windows\System\LdkKmav.exe

C:\Windows\System\sZwOluv.exe

C:\Windows\System\sZwOluv.exe

C:\Windows\System\sShXgVI.exe

C:\Windows\System\sShXgVI.exe

C:\Windows\System\ZRrpmXs.exe

C:\Windows\System\ZRrpmXs.exe

C:\Windows\System\gKdXHoE.exe

C:\Windows\System\gKdXHoE.exe

C:\Windows\System\OLyTGQI.exe

C:\Windows\System\OLyTGQI.exe

C:\Windows\System\IPTnhKN.exe

C:\Windows\System\IPTnhKN.exe

C:\Windows\System\eyGSsTL.exe

C:\Windows\System\eyGSsTL.exe

C:\Windows\System\NYmlCDn.exe

C:\Windows\System\NYmlCDn.exe

C:\Windows\System\rnBABZq.exe

C:\Windows\System\rnBABZq.exe

C:\Windows\System\PqikVOB.exe

C:\Windows\System\PqikVOB.exe

C:\Windows\System\SYQmVMQ.exe

C:\Windows\System\SYQmVMQ.exe

C:\Windows\System\KZLQIEY.exe

C:\Windows\System\KZLQIEY.exe

C:\Windows\System\GwSfIpG.exe

C:\Windows\System\GwSfIpG.exe

C:\Windows\System\sRUtDAl.exe

C:\Windows\System\sRUtDAl.exe

C:\Windows\System\uNZjiOl.exe

C:\Windows\System\uNZjiOl.exe

C:\Windows\System\HEekDxt.exe

C:\Windows\System\HEekDxt.exe

C:\Windows\System\ruMOxBr.exe

C:\Windows\System\ruMOxBr.exe

C:\Windows\System\GCDUHqW.exe

C:\Windows\System\GCDUHqW.exe

C:\Windows\System\dhoFJyr.exe

C:\Windows\System\dhoFJyr.exe

C:\Windows\System\INyeXZZ.exe

C:\Windows\System\INyeXZZ.exe

C:\Windows\System\ziVtPHo.exe

C:\Windows\System\ziVtPHo.exe

C:\Windows\System\ExGTZVW.exe

C:\Windows\System\ExGTZVW.exe

C:\Windows\System\gezFJms.exe

C:\Windows\System\gezFJms.exe

C:\Windows\System\PnBFlfB.exe

C:\Windows\System\PnBFlfB.exe

C:\Windows\System\zqeAOtm.exe

C:\Windows\System\zqeAOtm.exe

C:\Windows\System\nRGSSYd.exe

C:\Windows\System\nRGSSYd.exe

C:\Windows\System\MwqJmJa.exe

C:\Windows\System\MwqJmJa.exe

C:\Windows\System\ADUNIBA.exe

C:\Windows\System\ADUNIBA.exe

C:\Windows\System\oWwqxMG.exe

C:\Windows\System\oWwqxMG.exe

C:\Windows\System\hlGJFQn.exe

C:\Windows\System\hlGJFQn.exe

C:\Windows\System\McBLAjV.exe

C:\Windows\System\McBLAjV.exe

C:\Windows\System\AKCDBtA.exe

C:\Windows\System\AKCDBtA.exe

C:\Windows\System\FBvEGQR.exe

C:\Windows\System\FBvEGQR.exe

C:\Windows\System\LdaWFNs.exe

C:\Windows\System\LdaWFNs.exe

C:\Windows\System\FmbLion.exe

C:\Windows\System\FmbLion.exe

C:\Windows\System\jyoIFrz.exe

C:\Windows\System\jyoIFrz.exe

C:\Windows\System\XqaKkIN.exe

C:\Windows\System\XqaKkIN.exe

C:\Windows\System\ZhqUPSP.exe

C:\Windows\System\ZhqUPSP.exe

C:\Windows\System\INyUAgK.exe

C:\Windows\System\INyUAgK.exe

C:\Windows\System\lPrfXeG.exe

C:\Windows\System\lPrfXeG.exe

C:\Windows\System\rueycwv.exe

C:\Windows\System\rueycwv.exe

C:\Windows\System\WeFwHLw.exe

C:\Windows\System\WeFwHLw.exe

C:\Windows\System\sQxOKzy.exe

C:\Windows\System\sQxOKzy.exe

C:\Windows\System\dCJKzNc.exe

C:\Windows\System\dCJKzNc.exe

C:\Windows\System\xIjOJId.exe

C:\Windows\System\xIjOJId.exe

C:\Windows\System\VBwRciE.exe

C:\Windows\System\VBwRciE.exe

C:\Windows\System\aelKKpq.exe

C:\Windows\System\aelKKpq.exe

C:\Windows\System\aUjwBoh.exe

C:\Windows\System\aUjwBoh.exe

C:\Windows\System\gIAkuDh.exe

C:\Windows\System\gIAkuDh.exe

C:\Windows\System\GaWWcbk.exe

C:\Windows\System\GaWWcbk.exe

C:\Windows\System\avbsdaj.exe

C:\Windows\System\avbsdaj.exe

C:\Windows\System\gbSdhfi.exe

C:\Windows\System\gbSdhfi.exe

C:\Windows\System\IbfLKWv.exe

C:\Windows\System\IbfLKWv.exe

C:\Windows\System\OSVQvyA.exe

C:\Windows\System\OSVQvyA.exe

C:\Windows\System\BYYLXvb.exe

C:\Windows\System\BYYLXvb.exe

C:\Windows\System\iNrzHPj.exe

C:\Windows\System\iNrzHPj.exe

C:\Windows\System\WQZPrcv.exe

C:\Windows\System\WQZPrcv.exe

C:\Windows\System\AObMNXn.exe

C:\Windows\System\AObMNXn.exe

C:\Windows\System\EGoPICU.exe

C:\Windows\System\EGoPICU.exe

C:\Windows\System\EzopoRH.exe

C:\Windows\System\EzopoRH.exe

C:\Windows\System\fTomkif.exe

C:\Windows\System\fTomkif.exe

C:\Windows\System\yOaiVAe.exe

C:\Windows\System\yOaiVAe.exe

C:\Windows\System\vdQJhUu.exe

C:\Windows\System\vdQJhUu.exe

C:\Windows\System\IqYczpx.exe

C:\Windows\System\IqYczpx.exe

C:\Windows\System\TmNTbHO.exe

C:\Windows\System\TmNTbHO.exe

C:\Windows\System\DBRpccf.exe

C:\Windows\System\DBRpccf.exe

C:\Windows\System\OtgvUpV.exe

C:\Windows\System\OtgvUpV.exe

C:\Windows\System\VSbnzkQ.exe

C:\Windows\System\VSbnzkQ.exe

C:\Windows\System\RKWHtHa.exe

C:\Windows\System\RKWHtHa.exe

C:\Windows\System\gpggwcP.exe

C:\Windows\System\gpggwcP.exe

C:\Windows\System\wBRaesw.exe

C:\Windows\System\wBRaesw.exe

C:\Windows\System\LCsqcDD.exe

C:\Windows\System\LCsqcDD.exe

C:\Windows\System\HnSGvcw.exe

C:\Windows\System\HnSGvcw.exe

C:\Windows\System\hWoPayN.exe

C:\Windows\System\hWoPayN.exe

C:\Windows\System\ZSnAPlB.exe

C:\Windows\System\ZSnAPlB.exe

C:\Windows\System\QrAprjP.exe

C:\Windows\System\QrAprjP.exe

C:\Windows\System\cGCrwsx.exe

C:\Windows\System\cGCrwsx.exe

C:\Windows\System\GuPEywe.exe

C:\Windows\System\GuPEywe.exe

C:\Windows\System\PSrNmDt.exe

C:\Windows\System\PSrNmDt.exe

C:\Windows\System\vxVxgrr.exe

C:\Windows\System\vxVxgrr.exe

C:\Windows\System\VdmSfrW.exe

C:\Windows\System\VdmSfrW.exe

C:\Windows\System\tUxatuO.exe

C:\Windows\System\tUxatuO.exe

C:\Windows\System\eumULUi.exe

C:\Windows\System\eumULUi.exe

C:\Windows\System\lRplEry.exe

C:\Windows\System\lRplEry.exe

C:\Windows\System\fvfDHLd.exe

C:\Windows\System\fvfDHLd.exe

C:\Windows\System\AplypUD.exe

C:\Windows\System\AplypUD.exe

C:\Windows\System\xANQsaX.exe

C:\Windows\System\xANQsaX.exe

C:\Windows\System\FBXXejf.exe

C:\Windows\System\FBXXejf.exe

C:\Windows\System\LiwRlBz.exe

C:\Windows\System\LiwRlBz.exe

C:\Windows\System\zAAUTie.exe

C:\Windows\System\zAAUTie.exe

C:\Windows\System\mWZTblm.exe

C:\Windows\System\mWZTblm.exe

C:\Windows\System\PRgTVyG.exe

C:\Windows\System\PRgTVyG.exe

C:\Windows\System\QHfqPls.exe

C:\Windows\System\QHfqPls.exe

C:\Windows\System\KHSUkjl.exe

C:\Windows\System\KHSUkjl.exe

C:\Windows\System\kIbUYxy.exe

C:\Windows\System\kIbUYxy.exe

C:\Windows\System\RJsvkrR.exe

C:\Windows\System\RJsvkrR.exe

C:\Windows\System\jkDcahn.exe

C:\Windows\System\jkDcahn.exe

C:\Windows\System\MyjZFtt.exe

C:\Windows\System\MyjZFtt.exe

C:\Windows\System\IXTByDC.exe

C:\Windows\System\IXTByDC.exe

C:\Windows\System\vsWJhpp.exe

C:\Windows\System\vsWJhpp.exe

C:\Windows\System\dHwFnGe.exe

C:\Windows\System\dHwFnGe.exe

C:\Windows\System\AolDDAo.exe

C:\Windows\System\AolDDAo.exe

C:\Windows\System\kRPNGzK.exe

C:\Windows\System\kRPNGzK.exe

C:\Windows\System\MlYwrIT.exe

C:\Windows\System\MlYwrIT.exe

C:\Windows\System\NfrYFEP.exe

C:\Windows\System\NfrYFEP.exe

C:\Windows\System\YexjVMA.exe

C:\Windows\System\YexjVMA.exe

C:\Windows\System\GdmasUV.exe

C:\Windows\System\GdmasUV.exe

C:\Windows\System\IrRnMXL.exe

C:\Windows\System\IrRnMXL.exe

C:\Windows\System\UmOHYRY.exe

C:\Windows\System\UmOHYRY.exe

C:\Windows\System\bCQcpCJ.exe

C:\Windows\System\bCQcpCJ.exe

C:\Windows\System\YKSTjCu.exe

C:\Windows\System\YKSTjCu.exe

C:\Windows\System\xbQgjBb.exe

C:\Windows\System\xbQgjBb.exe

C:\Windows\System\aRwoxJY.exe

C:\Windows\System\aRwoxJY.exe

C:\Windows\System\YOJpRaW.exe

C:\Windows\System\YOJpRaW.exe

C:\Windows\System\oNcLdRq.exe

C:\Windows\System\oNcLdRq.exe

C:\Windows\System\Ynyuhul.exe

C:\Windows\System\Ynyuhul.exe

C:\Windows\System\jauvypz.exe

C:\Windows\System\jauvypz.exe

C:\Windows\System\NYiifFL.exe

C:\Windows\System\NYiifFL.exe

C:\Windows\System\pMKwldh.exe

C:\Windows\System\pMKwldh.exe

C:\Windows\System\pcZFnYV.exe

C:\Windows\System\pcZFnYV.exe

C:\Windows\System\ERYdlil.exe

C:\Windows\System\ERYdlil.exe

C:\Windows\System\BAMxUNs.exe

C:\Windows\System\BAMxUNs.exe

C:\Windows\System\eiBHFmY.exe

C:\Windows\System\eiBHFmY.exe

C:\Windows\System\MZviOjN.exe

C:\Windows\System\MZviOjN.exe

C:\Windows\System\EQSXRYu.exe

C:\Windows\System\EQSXRYu.exe

C:\Windows\System\coCTKIx.exe

C:\Windows\System\coCTKIx.exe

C:\Windows\System\zYtdBue.exe

C:\Windows\System\zYtdBue.exe

C:\Windows\System\MHTSiyh.exe

C:\Windows\System\MHTSiyh.exe

C:\Windows\System\yAAfkon.exe

C:\Windows\System\yAAfkon.exe

C:\Windows\System\TaICAyl.exe

C:\Windows\System\TaICAyl.exe

C:\Windows\System\iOcByiU.exe

C:\Windows\System\iOcByiU.exe

C:\Windows\System\fYaBWQb.exe

C:\Windows\System\fYaBWQb.exe

C:\Windows\System\WJycEtL.exe

C:\Windows\System\WJycEtL.exe

C:\Windows\System\SHReAdT.exe

C:\Windows\System\SHReAdT.exe

C:\Windows\System\amHtnti.exe

C:\Windows\System\amHtnti.exe

C:\Windows\System\UYFvNOI.exe

C:\Windows\System\UYFvNOI.exe

C:\Windows\System\bSkqzOS.exe

C:\Windows\System\bSkqzOS.exe

C:\Windows\System\rskmKvN.exe

C:\Windows\System\rskmKvN.exe

C:\Windows\System\vcSGFJL.exe

C:\Windows\System\vcSGFJL.exe

C:\Windows\System\bLbxReO.exe

C:\Windows\System\bLbxReO.exe

C:\Windows\System\hcBdFqR.exe

C:\Windows\System\hcBdFqR.exe

C:\Windows\System\VMybhJU.exe

C:\Windows\System\VMybhJU.exe

C:\Windows\System\oyqmwHR.exe

C:\Windows\System\oyqmwHR.exe

C:\Windows\System\SeIcaiE.exe

C:\Windows\System\SeIcaiE.exe

C:\Windows\System\nWllHVd.exe

C:\Windows\System\nWllHVd.exe

C:\Windows\System\ddNnBXr.exe

C:\Windows\System\ddNnBXr.exe

C:\Windows\System\pPzzCUH.exe

C:\Windows\System\pPzzCUH.exe

C:\Windows\System\jndfrZX.exe

C:\Windows\System\jndfrZX.exe

C:\Windows\System\FlFSvxU.exe

C:\Windows\System\FlFSvxU.exe

C:\Windows\System\zwQzChB.exe

C:\Windows\System\zwQzChB.exe

C:\Windows\System\kpMDxZz.exe

C:\Windows\System\kpMDxZz.exe

C:\Windows\System\SAxZUxK.exe

C:\Windows\System\SAxZUxK.exe

C:\Windows\System\LAouuCP.exe

C:\Windows\System\LAouuCP.exe

C:\Windows\System\lpgZfci.exe

C:\Windows\System\lpgZfci.exe

C:\Windows\System\nlEuZIp.exe

C:\Windows\System\nlEuZIp.exe

C:\Windows\System\HaxkxwU.exe

C:\Windows\System\HaxkxwU.exe

C:\Windows\System\ugtvytU.exe

C:\Windows\System\ugtvytU.exe

C:\Windows\System\dxihwkB.exe

C:\Windows\System\dxihwkB.exe

C:\Windows\System\AyvsuTf.exe

C:\Windows\System\AyvsuTf.exe

C:\Windows\System\oBNFmnY.exe

C:\Windows\System\oBNFmnY.exe

C:\Windows\System\PFsskvw.exe

C:\Windows\System\PFsskvw.exe

C:\Windows\System\mUbooON.exe

C:\Windows\System\mUbooON.exe

C:\Windows\System\lbrkTZB.exe

C:\Windows\System\lbrkTZB.exe

C:\Windows\System\DHelTrh.exe

C:\Windows\System\DHelTrh.exe

C:\Windows\System\mNlsWDh.exe

C:\Windows\System\mNlsWDh.exe

C:\Windows\System\xcgYnMW.exe

C:\Windows\System\xcgYnMW.exe

C:\Windows\System\kQRGWDZ.exe

C:\Windows\System\kQRGWDZ.exe

C:\Windows\System\uPliTcq.exe

C:\Windows\System\uPliTcq.exe

C:\Windows\System\UzeqNtX.exe

C:\Windows\System\UzeqNtX.exe

C:\Windows\System\CzXgGBz.exe

C:\Windows\System\CzXgGBz.exe

C:\Windows\System\EJbPPqG.exe

C:\Windows\System\EJbPPqG.exe

C:\Windows\System\DmPzrKe.exe

C:\Windows\System\DmPzrKe.exe

C:\Windows\System\ekdpbQx.exe

C:\Windows\System\ekdpbQx.exe

C:\Windows\System\cTKxrVk.exe

C:\Windows\System\cTKxrVk.exe

C:\Windows\System\BZokGTd.exe

C:\Windows\System\BZokGTd.exe

C:\Windows\System\qSRCFvi.exe

C:\Windows\System\qSRCFvi.exe

C:\Windows\System\JBmqCvD.exe

C:\Windows\System\JBmqCvD.exe

C:\Windows\System\GsxvgJU.exe

C:\Windows\System\GsxvgJU.exe

C:\Windows\System\tqxIeGU.exe

C:\Windows\System\tqxIeGU.exe

C:\Windows\System\kWDekyY.exe

C:\Windows\System\kWDekyY.exe

C:\Windows\System\kSqZfHE.exe

C:\Windows\System\kSqZfHE.exe

C:\Windows\System\UqLZFNo.exe

C:\Windows\System\UqLZFNo.exe

C:\Windows\System\BRaxlua.exe

C:\Windows\System\BRaxlua.exe

C:\Windows\System\vPjgTzx.exe

C:\Windows\System\vPjgTzx.exe

C:\Windows\System\DMdjJVj.exe

C:\Windows\System\DMdjJVj.exe

C:\Windows\System\SIfaQjs.exe

C:\Windows\System\SIfaQjs.exe

C:\Windows\System\pGyoXft.exe

C:\Windows\System\pGyoXft.exe

C:\Windows\System\ogjnfFi.exe

C:\Windows\System\ogjnfFi.exe

C:\Windows\System\zJUoCQK.exe

C:\Windows\System\zJUoCQK.exe

C:\Windows\System\dyRcgip.exe

C:\Windows\System\dyRcgip.exe

C:\Windows\System\QZYtUjL.exe

C:\Windows\System\QZYtUjL.exe

C:\Windows\System\axCOJxS.exe

C:\Windows\System\axCOJxS.exe

C:\Windows\System\WAwjfFp.exe

C:\Windows\System\WAwjfFp.exe

C:\Windows\System\jiAyxVX.exe

C:\Windows\System\jiAyxVX.exe

C:\Windows\System\AecddxN.exe

C:\Windows\System\AecddxN.exe

C:\Windows\System\exrTcnx.exe

C:\Windows\System\exrTcnx.exe

C:\Windows\System\iFhdMVI.exe

C:\Windows\System\iFhdMVI.exe

C:\Windows\System\rlOJcYl.exe

C:\Windows\System\rlOJcYl.exe

C:\Windows\System\gayDObj.exe

C:\Windows\System\gayDObj.exe

C:\Windows\System\DOpCoLI.exe

C:\Windows\System\DOpCoLI.exe

C:\Windows\System\QeMaiFQ.exe

C:\Windows\System\QeMaiFQ.exe

C:\Windows\System\xhZnURM.exe

C:\Windows\System\xhZnURM.exe

C:\Windows\System\MiVpFXe.exe

C:\Windows\System\MiVpFXe.exe

C:\Windows\System\fFrsyQg.exe

C:\Windows\System\fFrsyQg.exe

C:\Windows\System\ouoISCb.exe

C:\Windows\System\ouoISCb.exe

C:\Windows\System\AhtUCVk.exe

C:\Windows\System\AhtUCVk.exe

C:\Windows\System\WLbahYs.exe

C:\Windows\System\WLbahYs.exe

C:\Windows\System\bzTUscd.exe

C:\Windows\System\bzTUscd.exe

C:\Windows\System\uRBHOvf.exe

C:\Windows\System\uRBHOvf.exe

C:\Windows\System\KQeXboW.exe

C:\Windows\System\KQeXboW.exe

C:\Windows\System\fNwQpDl.exe

C:\Windows\System\fNwQpDl.exe

C:\Windows\System\WvkdirA.exe

C:\Windows\System\WvkdirA.exe

C:\Windows\System\VauvkKY.exe

C:\Windows\System\VauvkKY.exe

C:\Windows\System\cReEchh.exe

C:\Windows\System\cReEchh.exe

C:\Windows\System\eUQJVYC.exe

C:\Windows\System\eUQJVYC.exe

C:\Windows\System\JLGhLGD.exe

C:\Windows\System\JLGhLGD.exe

C:\Windows\System\ksRdlDS.exe

C:\Windows\System\ksRdlDS.exe

C:\Windows\System\KsNZday.exe

C:\Windows\System\KsNZday.exe

C:\Windows\System\SfrBjQp.exe

C:\Windows\System\SfrBjQp.exe

C:\Windows\System\AcocPRt.exe

C:\Windows\System\AcocPRt.exe

C:\Windows\System\DxfdBOR.exe

C:\Windows\System\DxfdBOR.exe

C:\Windows\System\njlLYnS.exe

C:\Windows\System\njlLYnS.exe

C:\Windows\System\KeIHOkb.exe

C:\Windows\System\KeIHOkb.exe

C:\Windows\System\GAyTOFU.exe

C:\Windows\System\GAyTOFU.exe

C:\Windows\System\DFzfdsx.exe

C:\Windows\System\DFzfdsx.exe

C:\Windows\System\xIwKhrd.exe

C:\Windows\System\xIwKhrd.exe

C:\Windows\System\MEzcYRf.exe

C:\Windows\System\MEzcYRf.exe

C:\Windows\System\gRYscZK.exe

C:\Windows\System\gRYscZK.exe

C:\Windows\System\BiusyWh.exe

C:\Windows\System\BiusyWh.exe

C:\Windows\System\aAiSsiq.exe

C:\Windows\System\aAiSsiq.exe

C:\Windows\System\lUJVIeE.exe

C:\Windows\System\lUJVIeE.exe

C:\Windows\System\fVSKIKm.exe

C:\Windows\System\fVSKIKm.exe

C:\Windows\System\zQzjvRS.exe

C:\Windows\System\zQzjvRS.exe

C:\Windows\System\RfXVSmy.exe

C:\Windows\System\RfXVSmy.exe

C:\Windows\System\rdjhzTo.exe

C:\Windows\System\rdjhzTo.exe

C:\Windows\System\LvqmtRQ.exe

C:\Windows\System\LvqmtRQ.exe

C:\Windows\System\qaYdKhn.exe

C:\Windows\System\qaYdKhn.exe

C:\Windows\System\odVemxt.exe

C:\Windows\System\odVemxt.exe

C:\Windows\System\gVYIZYE.exe

C:\Windows\System\gVYIZYE.exe

C:\Windows\System\vpasDci.exe

C:\Windows\System\vpasDci.exe

C:\Windows\System\QTtcjSh.exe

C:\Windows\System\QTtcjSh.exe

C:\Windows\System\BocFKMC.exe

C:\Windows\System\BocFKMC.exe

C:\Windows\System\wIedXmT.exe

C:\Windows\System\wIedXmT.exe

C:\Windows\System\pcaFleq.exe

C:\Windows\System\pcaFleq.exe

C:\Windows\System\UpdwMaD.exe

C:\Windows\System\UpdwMaD.exe

C:\Windows\System\oInBngH.exe

C:\Windows\System\oInBngH.exe

C:\Windows\System\PRjEVwe.exe

C:\Windows\System\PRjEVwe.exe

C:\Windows\System\fKAxYRn.exe

C:\Windows\System\fKAxYRn.exe

C:\Windows\System\HpPkMIk.exe

C:\Windows\System\HpPkMIk.exe

C:\Windows\System\VGbGMBo.exe

C:\Windows\System\VGbGMBo.exe

C:\Windows\System\EzKyizg.exe

C:\Windows\System\EzKyizg.exe

C:\Windows\System\lSQHKan.exe

C:\Windows\System\lSQHKan.exe

C:\Windows\System\peSrnrk.exe

C:\Windows\System\peSrnrk.exe

C:\Windows\System\MwVHDvD.exe

C:\Windows\System\MwVHDvD.exe

C:\Windows\System\BogLKRv.exe

C:\Windows\System\BogLKRv.exe

C:\Windows\System\PqErNKd.exe

C:\Windows\System\PqErNKd.exe

C:\Windows\System\OjplNrq.exe

C:\Windows\System\OjplNrq.exe

C:\Windows\System\cMqSaEN.exe

C:\Windows\System\cMqSaEN.exe

C:\Windows\System\VfABQCv.exe

C:\Windows\System\VfABQCv.exe

C:\Windows\System\BrakAgf.exe

C:\Windows\System\BrakAgf.exe

C:\Windows\System\xgAgZXw.exe

C:\Windows\System\xgAgZXw.exe

C:\Windows\System\uvySqWY.exe

C:\Windows\System\uvySqWY.exe

C:\Windows\System\wzrEUxH.exe

C:\Windows\System\wzrEUxH.exe

C:\Windows\System\ikWCjPl.exe

C:\Windows\System\ikWCjPl.exe

C:\Windows\System\mFqIcDl.exe

C:\Windows\System\mFqIcDl.exe

C:\Windows\System\VkvDhWP.exe

C:\Windows\System\VkvDhWP.exe

C:\Windows\System\HBTKYnk.exe

C:\Windows\System\HBTKYnk.exe

C:\Windows\System\PdNnJTy.exe

C:\Windows\System\PdNnJTy.exe

C:\Windows\System\RduMMYC.exe

C:\Windows\System\RduMMYC.exe

C:\Windows\System\xCjiLqN.exe

C:\Windows\System\xCjiLqN.exe

C:\Windows\System\FjyFBBH.exe

C:\Windows\System\FjyFBBH.exe

C:\Windows\System\LYCyTrV.exe

C:\Windows\System\LYCyTrV.exe

C:\Windows\System\tGTdwux.exe

C:\Windows\System\tGTdwux.exe

C:\Windows\System\XJNKsFy.exe

C:\Windows\System\XJNKsFy.exe

C:\Windows\System\vHcSYPR.exe

C:\Windows\System\vHcSYPR.exe

C:\Windows\System\yVgBeZU.exe

C:\Windows\System\yVgBeZU.exe

C:\Windows\System\VcmcusW.exe

C:\Windows\System\VcmcusW.exe

C:\Windows\System\klobefa.exe

C:\Windows\System\klobefa.exe

C:\Windows\System\yxGCsco.exe

C:\Windows\System\yxGCsco.exe

C:\Windows\System\ySLiCdt.exe

C:\Windows\System\ySLiCdt.exe

C:\Windows\System\muIDwHZ.exe

C:\Windows\System\muIDwHZ.exe

C:\Windows\System\NVYQuRm.exe

C:\Windows\System\NVYQuRm.exe

C:\Windows\System\bRVuKTv.exe

C:\Windows\System\bRVuKTv.exe

C:\Windows\System\BhcvAHK.exe

C:\Windows\System\BhcvAHK.exe

C:\Windows\System\CrkQtCg.exe

C:\Windows\System\CrkQtCg.exe

C:\Windows\System\wKUjlkZ.exe

C:\Windows\System\wKUjlkZ.exe

C:\Windows\System\LcAZhqi.exe

C:\Windows\System\LcAZhqi.exe

C:\Windows\System\aHGuuhG.exe

C:\Windows\System\aHGuuhG.exe

C:\Windows\System\LHzBcGm.exe

C:\Windows\System\LHzBcGm.exe

C:\Windows\System\AzqrBQY.exe

C:\Windows\System\AzqrBQY.exe

C:\Windows\System\XkTFOfu.exe

C:\Windows\System\XkTFOfu.exe

C:\Windows\System\RhTKHje.exe

C:\Windows\System\RhTKHje.exe

C:\Windows\System\DwjKPrf.exe

C:\Windows\System\DwjKPrf.exe

C:\Windows\System\wBEZRbU.exe

C:\Windows\System\wBEZRbU.exe

C:\Windows\System\nTXAByq.exe

C:\Windows\System\nTXAByq.exe

C:\Windows\System\jziCpWg.exe

C:\Windows\System\jziCpWg.exe

C:\Windows\System\PsBEwGt.exe

C:\Windows\System\PsBEwGt.exe

C:\Windows\System\VgpRdvB.exe

C:\Windows\System\VgpRdvB.exe

C:\Windows\System\yOwQPnM.exe

C:\Windows\System\yOwQPnM.exe

C:\Windows\System\bynYKoy.exe

C:\Windows\System\bynYKoy.exe

C:\Windows\System\dxSxecH.exe

C:\Windows\System\dxSxecH.exe

C:\Windows\System\CWvwNwb.exe

C:\Windows\System\CWvwNwb.exe

C:\Windows\System\ugWKhhn.exe

C:\Windows\System\ugWKhhn.exe

C:\Windows\System\apucDqJ.exe

C:\Windows\System\apucDqJ.exe

C:\Windows\System\DQyNCYn.exe

C:\Windows\System\DQyNCYn.exe

C:\Windows\System\ASMWmvr.exe

C:\Windows\System\ASMWmvr.exe

C:\Windows\System\aZmrlQv.exe

C:\Windows\System\aZmrlQv.exe

C:\Windows\System\zzbfNnE.exe

C:\Windows\System\zzbfNnE.exe

C:\Windows\System\LxPPCoA.exe

C:\Windows\System\LxPPCoA.exe

C:\Windows\System\kmfTxJj.exe

C:\Windows\System\kmfTxJj.exe

C:\Windows\System\cMyCjOn.exe

C:\Windows\System\cMyCjOn.exe

C:\Windows\System\CpBuBxe.exe

C:\Windows\System\CpBuBxe.exe

C:\Windows\System\TQDQhGB.exe

C:\Windows\System\TQDQhGB.exe

C:\Windows\System\fOhYusI.exe

C:\Windows\System\fOhYusI.exe

C:\Windows\System\NjaFhUg.exe

C:\Windows\System\NjaFhUg.exe

C:\Windows\System\zZztlIw.exe

C:\Windows\System\zZztlIw.exe

C:\Windows\System\GXHuWTc.exe

C:\Windows\System\GXHuWTc.exe

C:\Windows\System\aXUPnBT.exe

C:\Windows\System\aXUPnBT.exe

C:\Windows\System\YNCFrrK.exe

C:\Windows\System\YNCFrrK.exe

C:\Windows\System\HHLJxSe.exe

C:\Windows\System\HHLJxSe.exe

C:\Windows\System\zwNnesD.exe

C:\Windows\System\zwNnesD.exe

C:\Windows\System\ejpsRPO.exe

C:\Windows\System\ejpsRPO.exe

C:\Windows\System\RUnTEdn.exe

C:\Windows\System\RUnTEdn.exe

C:\Windows\System\NsWYrsJ.exe

C:\Windows\System\NsWYrsJ.exe

C:\Windows\System\mYSByjF.exe

C:\Windows\System\mYSByjF.exe

C:\Windows\System\kVRLHlc.exe

C:\Windows\System\kVRLHlc.exe

C:\Windows\System\QPpFFCA.exe

C:\Windows\System\QPpFFCA.exe

C:\Windows\System\SSBfXIc.exe

C:\Windows\System\SSBfXIc.exe

C:\Windows\System\gBdGcii.exe

C:\Windows\System\gBdGcii.exe

C:\Windows\System\pooLlTR.exe

C:\Windows\System\pooLlTR.exe

C:\Windows\System\ALJsNJy.exe

C:\Windows\System\ALJsNJy.exe

C:\Windows\System\znRsnyP.exe

C:\Windows\System\znRsnyP.exe

C:\Windows\System\CrlFOEz.exe

C:\Windows\System\CrlFOEz.exe

C:\Windows\System\IsVNEqY.exe

C:\Windows\System\IsVNEqY.exe

C:\Windows\System\gIrYLCV.exe

C:\Windows\System\gIrYLCV.exe

C:\Windows\System\VeQszRS.exe

C:\Windows\System\VeQszRS.exe

C:\Windows\System\GFPRoVq.exe

C:\Windows\System\GFPRoVq.exe

C:\Windows\System\hdmEwaZ.exe

C:\Windows\System\hdmEwaZ.exe

C:\Windows\System\LAQJsSi.exe

C:\Windows\System\LAQJsSi.exe

C:\Windows\System\WhJtSjn.exe

C:\Windows\System\WhJtSjn.exe

C:\Windows\System\bJTKUdZ.exe

C:\Windows\System\bJTKUdZ.exe

C:\Windows\System\jhWDZmR.exe

C:\Windows\System\jhWDZmR.exe

C:\Windows\System\SxyaZsu.exe

C:\Windows\System\SxyaZsu.exe

C:\Windows\System\jGgFWhR.exe

C:\Windows\System\jGgFWhR.exe

C:\Windows\System\svxFhMM.exe

C:\Windows\System\svxFhMM.exe

C:\Windows\System\cUxfhPZ.exe

C:\Windows\System\cUxfhPZ.exe

C:\Windows\System\AQrYurK.exe

C:\Windows\System\AQrYurK.exe

C:\Windows\System\XQWxEhC.exe

C:\Windows\System\XQWxEhC.exe

C:\Windows\System\UkdVyUM.exe

C:\Windows\System\UkdVyUM.exe

C:\Windows\System\vwDfDUV.exe

C:\Windows\System\vwDfDUV.exe

C:\Windows\System\uIQGXQC.exe

C:\Windows\System\uIQGXQC.exe

C:\Windows\System\BzKHPrl.exe

C:\Windows\System\BzKHPrl.exe

C:\Windows\System\oadiubn.exe

C:\Windows\System\oadiubn.exe

C:\Windows\System\kwGTPJL.exe

C:\Windows\System\kwGTPJL.exe

C:\Windows\System\TJGbAAT.exe

C:\Windows\System\TJGbAAT.exe

C:\Windows\System\oCIUBxJ.exe

C:\Windows\System\oCIUBxJ.exe

C:\Windows\System\YBnJZLf.exe

C:\Windows\System\YBnJZLf.exe

C:\Windows\System\GVltjJs.exe

C:\Windows\System\GVltjJs.exe

C:\Windows\System\pQOKdaQ.exe

C:\Windows\System\pQOKdaQ.exe

C:\Windows\System\pxtHzsj.exe

C:\Windows\System\pxtHzsj.exe

C:\Windows\System\ESePojA.exe

C:\Windows\System\ESePojA.exe

C:\Windows\System\NwAhipD.exe

C:\Windows\System\NwAhipD.exe

C:\Windows\System\TibAHAG.exe

C:\Windows\System\TibAHAG.exe

C:\Windows\System\kQRtpTH.exe

C:\Windows\System\kQRtpTH.exe

C:\Windows\System\zLcfTBV.exe

C:\Windows\System\zLcfTBV.exe

C:\Windows\System\LgYcJtf.exe

C:\Windows\System\LgYcJtf.exe

C:\Windows\System\ShlARWl.exe

C:\Windows\System\ShlARWl.exe

C:\Windows\System\QUKZnzd.exe

C:\Windows\System\QUKZnzd.exe

C:\Windows\System\kWpdPzY.exe

C:\Windows\System\kWpdPzY.exe

C:\Windows\System\sWRxeqE.exe

C:\Windows\System\sWRxeqE.exe

C:\Windows\System\avePHbh.exe

C:\Windows\System\avePHbh.exe

C:\Windows\System\hguMATG.exe

C:\Windows\System\hguMATG.exe

C:\Windows\System\ApFUtwW.exe

C:\Windows\System\ApFUtwW.exe

C:\Windows\System\qFGhpkV.exe

C:\Windows\System\qFGhpkV.exe

C:\Windows\System\HUXEDXT.exe

C:\Windows\System\HUXEDXT.exe

C:\Windows\System\ogNVQHj.exe

C:\Windows\System\ogNVQHj.exe

C:\Windows\System\nJNjlhG.exe

C:\Windows\System\nJNjlhG.exe

C:\Windows\System\vwsuzmD.exe

C:\Windows\System\vwsuzmD.exe

C:\Windows\System\kUyyhcj.exe

C:\Windows\System\kUyyhcj.exe

C:\Windows\System\Zrcvhyg.exe

C:\Windows\System\Zrcvhyg.exe

C:\Windows\System\FBMjxKN.exe

C:\Windows\System\FBMjxKN.exe

C:\Windows\System\PSGbLJo.exe

C:\Windows\System\PSGbLJo.exe

C:\Windows\System\KhCSGVt.exe

C:\Windows\System\KhCSGVt.exe

C:\Windows\System\VdYcCzA.exe

C:\Windows\System\VdYcCzA.exe

C:\Windows\System\EHdkVyr.exe

C:\Windows\System\EHdkVyr.exe

C:\Windows\System\QtOKTSH.exe

C:\Windows\System\QtOKTSH.exe

C:\Windows\System\fFqOxfJ.exe

C:\Windows\System\fFqOxfJ.exe

C:\Windows\System\dHEPQUD.exe

C:\Windows\System\dHEPQUD.exe

C:\Windows\System\qoNKTND.exe

C:\Windows\System\qoNKTND.exe

C:\Windows\System\VUZaSGy.exe

C:\Windows\System\VUZaSGy.exe

C:\Windows\System\YNxMEkr.exe

C:\Windows\System\YNxMEkr.exe

C:\Windows\System\ShllfnE.exe

C:\Windows\System\ShllfnE.exe

C:\Windows\System\noCrrdf.exe

C:\Windows\System\noCrrdf.exe

C:\Windows\System\hXairBX.exe

C:\Windows\System\hXairBX.exe

C:\Windows\System\JWLeGOv.exe

C:\Windows\System\JWLeGOv.exe

C:\Windows\System\VgGpLNJ.exe

C:\Windows\System\VgGpLNJ.exe

C:\Windows\System\hmyXlvB.exe

C:\Windows\System\hmyXlvB.exe

C:\Windows\System\XWWZGch.exe

C:\Windows\System\XWWZGch.exe

C:\Windows\System\IwJxIvX.exe

C:\Windows\System\IwJxIvX.exe

C:\Windows\System\aQFTHpx.exe

C:\Windows\System\aQFTHpx.exe

C:\Windows\System\SCIZXXQ.exe

C:\Windows\System\SCIZXXQ.exe

C:\Windows\System\jCQRfHM.exe

C:\Windows\System\jCQRfHM.exe

C:\Windows\System\tysZVbN.exe

C:\Windows\System\tysZVbN.exe

C:\Windows\System\WgEUomT.exe

C:\Windows\System\WgEUomT.exe

C:\Windows\System\vPTCPki.exe

C:\Windows\System\vPTCPki.exe

C:\Windows\System\AqXUEEm.exe

C:\Windows\System\AqXUEEm.exe

C:\Windows\System\zmMxRQQ.exe

C:\Windows\System\zmMxRQQ.exe

C:\Windows\System\WlZEOYv.exe

C:\Windows\System\WlZEOYv.exe

C:\Windows\System\rJfyMRf.exe

C:\Windows\System\rJfyMRf.exe

C:\Windows\System\kyTkzyo.exe

C:\Windows\System\kyTkzyo.exe

C:\Windows\System\bncbOWf.exe

C:\Windows\System\bncbOWf.exe

C:\Windows\System\Sdabqgq.exe

C:\Windows\System\Sdabqgq.exe

C:\Windows\System\JmGyTzy.exe

C:\Windows\System\JmGyTzy.exe

C:\Windows\System\VjNgdVX.exe

C:\Windows\System\VjNgdVX.exe

C:\Windows\System\xjPzQmJ.exe

C:\Windows\System\xjPzQmJ.exe

C:\Windows\System\niixsAr.exe

C:\Windows\System\niixsAr.exe

C:\Windows\System\SoxTKtf.exe

C:\Windows\System\SoxTKtf.exe

C:\Windows\System\JXQigrC.exe

C:\Windows\System\JXQigrC.exe

C:\Windows\System\bGUnnKp.exe

C:\Windows\System\bGUnnKp.exe

C:\Windows\System\WavkyYh.exe

C:\Windows\System\WavkyYh.exe

C:\Windows\System\zfDQfoZ.exe

C:\Windows\System\zfDQfoZ.exe

C:\Windows\System\uareupJ.exe

C:\Windows\System\uareupJ.exe

C:\Windows\System\YjvrUmu.exe

C:\Windows\System\YjvrUmu.exe

C:\Windows\System\tMduyRZ.exe

C:\Windows\System\tMduyRZ.exe

C:\Windows\System\dqPdGEO.exe

C:\Windows\System\dqPdGEO.exe

C:\Windows\System\iChbRiJ.exe

C:\Windows\System\iChbRiJ.exe

C:\Windows\System\KrjaBLB.exe

C:\Windows\System\KrjaBLB.exe

C:\Windows\System\ebhpHeA.exe

C:\Windows\System\ebhpHeA.exe

C:\Windows\System\TmWxgdY.exe

C:\Windows\System\TmWxgdY.exe

C:\Windows\System\ztqgNEF.exe

C:\Windows\System\ztqgNEF.exe

C:\Windows\System\GoOebzD.exe

C:\Windows\System\GoOebzD.exe

C:\Windows\System\cwyPDaa.exe

C:\Windows\System\cwyPDaa.exe

C:\Windows\System\ReRUcyt.exe

C:\Windows\System\ReRUcyt.exe

C:\Windows\System\xdAEDqx.exe

C:\Windows\System\xdAEDqx.exe

C:\Windows\System\OZSYnFR.exe

C:\Windows\System\OZSYnFR.exe

C:\Windows\System\YEWsxrr.exe

C:\Windows\System\YEWsxrr.exe

C:\Windows\System\wtPScmy.exe

C:\Windows\System\wtPScmy.exe

C:\Windows\System\bTJtIFM.exe

C:\Windows\System\bTJtIFM.exe

C:\Windows\System\aSxtWFm.exe

C:\Windows\System\aSxtWFm.exe

C:\Windows\System\kEuRmvV.exe

C:\Windows\System\kEuRmvV.exe

C:\Windows\System\lZExoUm.exe

C:\Windows\System\lZExoUm.exe

C:\Windows\System\XxRbGBJ.exe

C:\Windows\System\XxRbGBJ.exe

C:\Windows\System\DcNYZGG.exe

C:\Windows\System\DcNYZGG.exe

C:\Windows\System\oDnAFtk.exe

C:\Windows\System\oDnAFtk.exe

C:\Windows\System\fHMNEXP.exe

C:\Windows\System\fHMNEXP.exe

C:\Windows\System\CQopTIH.exe

C:\Windows\System\CQopTIH.exe

C:\Windows\System\aanNowo.exe

C:\Windows\System\aanNowo.exe

C:\Windows\System\ObSxUyU.exe

C:\Windows\System\ObSxUyU.exe

C:\Windows\System\msEfjkn.exe

C:\Windows\System\msEfjkn.exe

C:\Windows\System\vBJSzKr.exe

C:\Windows\System\vBJSzKr.exe

C:\Windows\System\IihCTWY.exe

C:\Windows\System\IihCTWY.exe

C:\Windows\System\nUPhMxc.exe

C:\Windows\System\nUPhMxc.exe

C:\Windows\System\gQaEuiP.exe

C:\Windows\System\gQaEuiP.exe

C:\Windows\System\cezOZmS.exe

C:\Windows\System\cezOZmS.exe

C:\Windows\System\xZzDyar.exe

C:\Windows\System\xZzDyar.exe

C:\Windows\System\gzIYEZq.exe

C:\Windows\System\gzIYEZq.exe

C:\Windows\System\GFFTYsX.exe

C:\Windows\System\GFFTYsX.exe

C:\Windows\System\yElsYON.exe

C:\Windows\System\yElsYON.exe

C:\Windows\System\nhIiAgN.exe

C:\Windows\System\nhIiAgN.exe

C:\Windows\System\TOxhHgB.exe

C:\Windows\System\TOxhHgB.exe

C:\Windows\System\SQMCpba.exe

C:\Windows\System\SQMCpba.exe

C:\Windows\System\cvnSFAH.exe

C:\Windows\System\cvnSFAH.exe

C:\Windows\System\hqIKnkN.exe

C:\Windows\System\hqIKnkN.exe

C:\Windows\System\VRbskPt.exe

C:\Windows\System\VRbskPt.exe

C:\Windows\System\ICLHZCZ.exe

C:\Windows\System\ICLHZCZ.exe

C:\Windows\System\misiolW.exe

C:\Windows\System\misiolW.exe

C:\Windows\System\xMULHmG.exe

C:\Windows\System\xMULHmG.exe

C:\Windows\System\ochWJcy.exe

C:\Windows\System\ochWJcy.exe

C:\Windows\System\GtyCDxB.exe

C:\Windows\System\GtyCDxB.exe

C:\Windows\System\EaEKkoM.exe

C:\Windows\System\EaEKkoM.exe

C:\Windows\System\sxrfLEJ.exe

C:\Windows\System\sxrfLEJ.exe

C:\Windows\System\wUpsEVa.exe

C:\Windows\System\wUpsEVa.exe

C:\Windows\System\vNbNuzx.exe

C:\Windows\System\vNbNuzx.exe

C:\Windows\System\MZPRAEr.exe

C:\Windows\System\MZPRAEr.exe

C:\Windows\System\UlRnPbp.exe

C:\Windows\System\UlRnPbp.exe

C:\Windows\System\NgrPzuq.exe

C:\Windows\System\NgrPzuq.exe

C:\Windows\System\QAXBdJp.exe

C:\Windows\System\QAXBdJp.exe

C:\Windows\System\xKvHQdH.exe

C:\Windows\System\xKvHQdH.exe

C:\Windows\System\hLvGnVj.exe

C:\Windows\System\hLvGnVj.exe

C:\Windows\System\beBYCPF.exe

C:\Windows\System\beBYCPF.exe

C:\Windows\System\hsSeWDv.exe

C:\Windows\System\hsSeWDv.exe

C:\Windows\System\uMIIwQs.exe

C:\Windows\System\uMIIwQs.exe

C:\Windows\System\dzrnTDV.exe

C:\Windows\System\dzrnTDV.exe

C:\Windows\System\SsLotmM.exe

C:\Windows\System\SsLotmM.exe

C:\Windows\System\xFGBFjs.exe

C:\Windows\System\xFGBFjs.exe

C:\Windows\System\MCnlhUf.exe

C:\Windows\System\MCnlhUf.exe

C:\Windows\System\AMxfpSL.exe

C:\Windows\System\AMxfpSL.exe

C:\Windows\System\debmhHj.exe

C:\Windows\System\debmhHj.exe

C:\Windows\System\nonjONM.exe

C:\Windows\System\nonjONM.exe

C:\Windows\System\XuTscMj.exe

C:\Windows\System\XuTscMj.exe

C:\Windows\System\IsWsPZC.exe

C:\Windows\System\IsWsPZC.exe

C:\Windows\System\ItTMHNp.exe

C:\Windows\System\ItTMHNp.exe

C:\Windows\System\epzlWmR.exe

C:\Windows\System\epzlWmR.exe

C:\Windows\System\JXLqylY.exe

C:\Windows\System\JXLqylY.exe

C:\Windows\System\PlwmUUl.exe

C:\Windows\System\PlwmUUl.exe

C:\Windows\System\jQxugHt.exe

C:\Windows\System\jQxugHt.exe

C:\Windows\System\eBvGWlm.exe

C:\Windows\System\eBvGWlm.exe

C:\Windows\System\uBNykNd.exe

C:\Windows\System\uBNykNd.exe

C:\Windows\System\fPFaula.exe

C:\Windows\System\fPFaula.exe

C:\Windows\System\gtrYdgk.exe

C:\Windows\System\gtrYdgk.exe

C:\Windows\System\rxRWwiz.exe

C:\Windows\System\rxRWwiz.exe

C:\Windows\System\umzhBwJ.exe

C:\Windows\System\umzhBwJ.exe

C:\Windows\System\JLZhEXJ.exe

C:\Windows\System\JLZhEXJ.exe

C:\Windows\System\HDJWaNp.exe

C:\Windows\System\HDJWaNp.exe

C:\Windows\System\nTYKioa.exe

C:\Windows\System\nTYKioa.exe

C:\Windows\System\PTcQsUY.exe

C:\Windows\System\PTcQsUY.exe

C:\Windows\System\PtUunas.exe

C:\Windows\System\PtUunas.exe

C:\Windows\System\jpTETXc.exe

C:\Windows\System\jpTETXc.exe

C:\Windows\System\wgJMIOo.exe

C:\Windows\System\wgJMIOo.exe

C:\Windows\System\kjecJkb.exe

C:\Windows\System\kjecJkb.exe

C:\Windows\System\ueedcOv.exe

C:\Windows\System\ueedcOv.exe

C:\Windows\System\ewzOSgO.exe

C:\Windows\System\ewzOSgO.exe

C:\Windows\System\JbEufOG.exe

C:\Windows\System\JbEufOG.exe

C:\Windows\System\WPpyilc.exe

C:\Windows\System\WPpyilc.exe

C:\Windows\System\vDHTtsx.exe

C:\Windows\System\vDHTtsx.exe

C:\Windows\System\YvYqbdR.exe

C:\Windows\System\YvYqbdR.exe

C:\Windows\System\RAkwtEl.exe

C:\Windows\System\RAkwtEl.exe

C:\Windows\System\GpyrgoM.exe

C:\Windows\System\GpyrgoM.exe

C:\Windows\System\vTWcaIK.exe

C:\Windows\System\vTWcaIK.exe

C:\Windows\System\wKbcKEh.exe

C:\Windows\System\wKbcKEh.exe

C:\Windows\System\LJFOQIT.exe

C:\Windows\System\LJFOQIT.exe

C:\Windows\System\Izudsga.exe

C:\Windows\System\Izudsga.exe

C:\Windows\System\JstvSZl.exe

C:\Windows\System\JstvSZl.exe

C:\Windows\System\ZLikQoK.exe

C:\Windows\System\ZLikQoK.exe

C:\Windows\System\PbFTVmv.exe

C:\Windows\System\PbFTVmv.exe

C:\Windows\System\vZYxRqz.exe

C:\Windows\System\vZYxRqz.exe

C:\Windows\System\GWZWlaC.exe

C:\Windows\System\GWZWlaC.exe

C:\Windows\System\AvoOdHX.exe

C:\Windows\System\AvoOdHX.exe

C:\Windows\System\iQcxtFN.exe

C:\Windows\System\iQcxtFN.exe

C:\Windows\System\efaRHGI.exe

C:\Windows\System\efaRHGI.exe

C:\Windows\System\wWHBpPA.exe

C:\Windows\System\wWHBpPA.exe

C:\Windows\System\GXAjIHB.exe

C:\Windows\System\GXAjIHB.exe

C:\Windows\System\YriQfQd.exe

C:\Windows\System\YriQfQd.exe

C:\Windows\System\rDEFlPI.exe

C:\Windows\System\rDEFlPI.exe

C:\Windows\System\OjDtZoS.exe

C:\Windows\System\OjDtZoS.exe

C:\Windows\System\wMIuRFD.exe

C:\Windows\System\wMIuRFD.exe

C:\Windows\System\TMgErwy.exe

C:\Windows\System\TMgErwy.exe

C:\Windows\System\ZvpgjHV.exe

C:\Windows\System\ZvpgjHV.exe

C:\Windows\System\YIGxwih.exe

C:\Windows\System\YIGxwih.exe

C:\Windows\System\YZWriMR.exe

C:\Windows\System\YZWriMR.exe

C:\Windows\System\ulqYHFL.exe

C:\Windows\System\ulqYHFL.exe

C:\Windows\System\VJlSMLo.exe

C:\Windows\System\VJlSMLo.exe

C:\Windows\System\pewJIbC.exe

C:\Windows\System\pewJIbC.exe

C:\Windows\System\CGsMtjG.exe

C:\Windows\System\CGsMtjG.exe

C:\Windows\System\UDBpbhy.exe

C:\Windows\System\UDBpbhy.exe

C:\Windows\System\cjFZCGu.exe

C:\Windows\System\cjFZCGu.exe

C:\Windows\System\CEZhbxf.exe

C:\Windows\System\CEZhbxf.exe

C:\Windows\System\OtxvrpS.exe

C:\Windows\System\OtxvrpS.exe

C:\Windows\System\ZvWfphc.exe

C:\Windows\System\ZvWfphc.exe

C:\Windows\System\WXYwxtY.exe

C:\Windows\System\WXYwxtY.exe

C:\Windows\System\YPlSBmU.exe

C:\Windows\System\YPlSBmU.exe

C:\Windows\System\bZGDtIY.exe

C:\Windows\System\bZGDtIY.exe

C:\Windows\System\tIXYiTe.exe

C:\Windows\System\tIXYiTe.exe

C:\Windows\System\NgHhgmY.exe

C:\Windows\System\NgHhgmY.exe

C:\Windows\System\RhAkRUt.exe

C:\Windows\System\RhAkRUt.exe

C:\Windows\System\LgKfuVV.exe

C:\Windows\System\LgKfuVV.exe

C:\Windows\System\gcIitaE.exe

C:\Windows\System\gcIitaE.exe

C:\Windows\System\CdLhgsN.exe

C:\Windows\System\CdLhgsN.exe

C:\Windows\System\FQERbii.exe

C:\Windows\System\FQERbii.exe

C:\Windows\System\csPWOjG.exe

C:\Windows\System\csPWOjG.exe

C:\Windows\System\ZaiowwG.exe

C:\Windows\System\ZaiowwG.exe

C:\Windows\System\oQwnLxo.exe

C:\Windows\System\oQwnLxo.exe

C:\Windows\System\YqkRjfd.exe

C:\Windows\System\YqkRjfd.exe

C:\Windows\System\kRXXEVk.exe

C:\Windows\System\kRXXEVk.exe

C:\Windows\System\chKiUMq.exe

C:\Windows\System\chKiUMq.exe

C:\Windows\System\AFOnylA.exe

C:\Windows\System\AFOnylA.exe

C:\Windows\System\GaiQZqE.exe

C:\Windows\System\GaiQZqE.exe

C:\Windows\System\hrNMqRz.exe

C:\Windows\System\hrNMqRz.exe

C:\Windows\System\xibbqDm.exe

C:\Windows\System\xibbqDm.exe

C:\Windows\System\JAxnQmG.exe

C:\Windows\System\JAxnQmG.exe

C:\Windows\System\jSjSYoj.exe

C:\Windows\System\jSjSYoj.exe

C:\Windows\System\UOxYghn.exe

C:\Windows\System\UOxYghn.exe

C:\Windows\System\nygRxXq.exe

C:\Windows\System\nygRxXq.exe

C:\Windows\System\cCkZjba.exe

C:\Windows\System\cCkZjba.exe

C:\Windows\System\KPGDvAl.exe

C:\Windows\System\KPGDvAl.exe

C:\Windows\System\kyzMNER.exe

C:\Windows\System\kyzMNER.exe

C:\Windows\System\VQWdyYW.exe

C:\Windows\System\VQWdyYW.exe

C:\Windows\System\Cjnxopv.exe

C:\Windows\System\Cjnxopv.exe

C:\Windows\System\dwkNzHT.exe

C:\Windows\System\dwkNzHT.exe

C:\Windows\System\rYvykih.exe

C:\Windows\System\rYvykih.exe

C:\Windows\System\dEQcIhZ.exe

C:\Windows\System\dEQcIhZ.exe

C:\Windows\System\TMcBMbT.exe

C:\Windows\System\TMcBMbT.exe

C:\Windows\System\GbLFxzd.exe

C:\Windows\System\GbLFxzd.exe

C:\Windows\System\EkFBgiO.exe

C:\Windows\System\EkFBgiO.exe

C:\Windows\System\bafMrPG.exe

C:\Windows\System\bafMrPG.exe

C:\Windows\System\DItRqCb.exe

C:\Windows\System\DItRqCb.exe

C:\Windows\System\BDxytXi.exe

C:\Windows\System\BDxytXi.exe

C:\Windows\System\dGguNnC.exe

C:\Windows\System\dGguNnC.exe

C:\Windows\System\JCxwimX.exe

C:\Windows\System\JCxwimX.exe

C:\Windows\System\tDEkNLN.exe

C:\Windows\System\tDEkNLN.exe

C:\Windows\System\zhcFuLn.exe

C:\Windows\System\zhcFuLn.exe

C:\Windows\System\FdswLyP.exe

C:\Windows\System\FdswLyP.exe

C:\Windows\System\UzSaAwF.exe

C:\Windows\System\UzSaAwF.exe

C:\Windows\System\CbxkKsC.exe

C:\Windows\System\CbxkKsC.exe

C:\Windows\System\aRFFQik.exe

C:\Windows\System\aRFFQik.exe

C:\Windows\System\AMsjyNf.exe

C:\Windows\System\AMsjyNf.exe

C:\Windows\System\JphHMFv.exe

C:\Windows\System\JphHMFv.exe

C:\Windows\System\QUkGHbm.exe

C:\Windows\System\QUkGHbm.exe

C:\Windows\System\lviZAMf.exe

C:\Windows\System\lviZAMf.exe

C:\Windows\System\vQrpImG.exe

C:\Windows\System\vQrpImG.exe

C:\Windows\System\oVbamZw.exe

C:\Windows\System\oVbamZw.exe

C:\Windows\System\rbMfhiv.exe

C:\Windows\System\rbMfhiv.exe

C:\Windows\System\jzeXuwX.exe

C:\Windows\System\jzeXuwX.exe

C:\Windows\System\BojyMDg.exe

C:\Windows\System\BojyMDg.exe

C:\Windows\System\iPaFWkm.exe

C:\Windows\System\iPaFWkm.exe

C:\Windows\System\yYGfEuf.exe

C:\Windows\System\yYGfEuf.exe

C:\Windows\System\WDsCdWn.exe

C:\Windows\System\WDsCdWn.exe

C:\Windows\System\DyqVsSI.exe

C:\Windows\System\DyqVsSI.exe

C:\Windows\System\AvuCozp.exe

C:\Windows\System\AvuCozp.exe

C:\Windows\System\mMHmnfv.exe

C:\Windows\System\mMHmnfv.exe

C:\Windows\System\VWuoAGi.exe

C:\Windows\System\VWuoAGi.exe

C:\Windows\System\jvhxckw.exe

C:\Windows\System\jvhxckw.exe

C:\Windows\System\xeQvEdv.exe

C:\Windows\System\xeQvEdv.exe

C:\Windows\System\WoQxSAS.exe

C:\Windows\System\WoQxSAS.exe

C:\Windows\System\kgnZPWk.exe

C:\Windows\System\kgnZPWk.exe

C:\Windows\System\HcoBCDW.exe

C:\Windows\System\HcoBCDW.exe

C:\Windows\System\oqqoEwb.exe

C:\Windows\System\oqqoEwb.exe

C:\Windows\System\QwRgUgk.exe

C:\Windows\System\QwRgUgk.exe

C:\Windows\System\JyzFZmR.exe

C:\Windows\System\JyzFZmR.exe

C:\Windows\System\revVEcB.exe

C:\Windows\System\revVEcB.exe

C:\Windows\System\IfFUkUE.exe

C:\Windows\System\IfFUkUE.exe

C:\Windows\System\xbzpiev.exe

C:\Windows\System\xbzpiev.exe

C:\Windows\System\LpiwRjP.exe

C:\Windows\System\LpiwRjP.exe

C:\Windows\System\UsWswMB.exe

C:\Windows\System\UsWswMB.exe

C:\Windows\System\gtXAcji.exe

C:\Windows\System\gtXAcji.exe

C:\Windows\System\LRsEosY.exe

C:\Windows\System\LRsEosY.exe

C:\Windows\System\XEypEQi.exe

C:\Windows\System\XEypEQi.exe

C:\Windows\System\ZzkoVJE.exe

C:\Windows\System\ZzkoVJE.exe

C:\Windows\System\fBSvhsr.exe

C:\Windows\System\fBSvhsr.exe

C:\Windows\System\wMouwYU.exe

C:\Windows\System\wMouwYU.exe

C:\Windows\System\XqxGkEv.exe

C:\Windows\System\XqxGkEv.exe

C:\Windows\System\NPIwXrv.exe

C:\Windows\System\NPIwXrv.exe

C:\Windows\System\kYHWYWt.exe

C:\Windows\System\kYHWYWt.exe

C:\Windows\System\jrbFwdv.exe

C:\Windows\System\jrbFwdv.exe

C:\Windows\System\FrdjrZT.exe

C:\Windows\System\FrdjrZT.exe

C:\Windows\System\YosmXYS.exe

C:\Windows\System\YosmXYS.exe

C:\Windows\System\xMQmenC.exe

C:\Windows\System\xMQmenC.exe

C:\Windows\System\nZJiRQp.exe

C:\Windows\System\nZJiRQp.exe

C:\Windows\System\XnkQFvq.exe

C:\Windows\System\XnkQFvq.exe

C:\Windows\System\ExogVKK.exe

C:\Windows\System\ExogVKK.exe

C:\Windows\System\JXFeAGo.exe

C:\Windows\System\JXFeAGo.exe

C:\Windows\System\rmubQpr.exe

C:\Windows\System\rmubQpr.exe

C:\Windows\System\SNmFKhz.exe

C:\Windows\System\SNmFKhz.exe

C:\Windows\System\OUvGojN.exe

C:\Windows\System\OUvGojN.exe

C:\Windows\System\AcZatIa.exe

C:\Windows\System\AcZatIa.exe

C:\Windows\System\ynaoFls.exe

C:\Windows\System\ynaoFls.exe

C:\Windows\System\JBSVrJv.exe

C:\Windows\System\JBSVrJv.exe

C:\Windows\System\tzjIXiN.exe

C:\Windows\System\tzjIXiN.exe

C:\Windows\System\dtqOsSd.exe

C:\Windows\System\dtqOsSd.exe

C:\Windows\System\eANsXow.exe

C:\Windows\System\eANsXow.exe

C:\Windows\System\YyBZoAN.exe

C:\Windows\System\YyBZoAN.exe

C:\Windows\System\hWATszi.exe

C:\Windows\System\hWATszi.exe

C:\Windows\System\btOrIFY.exe

C:\Windows\System\btOrIFY.exe

C:\Windows\System\ulcpBdY.exe

C:\Windows\System\ulcpBdY.exe

C:\Windows\System\ytZrNhM.exe

C:\Windows\System\ytZrNhM.exe

C:\Windows\System\YjEMqCI.exe

C:\Windows\System\YjEMqCI.exe

C:\Windows\System\DFeaBcx.exe

C:\Windows\System\DFeaBcx.exe

C:\Windows\System\nlCiXWH.exe

C:\Windows\System\nlCiXWH.exe

C:\Windows\System\ubYFTIN.exe

C:\Windows\System\ubYFTIN.exe

C:\Windows\System\XXiOyoF.exe

C:\Windows\System\XXiOyoF.exe

C:\Windows\System\EIfjdVu.exe

C:\Windows\System\EIfjdVu.exe

C:\Windows\System\oBwnZtp.exe

C:\Windows\System\oBwnZtp.exe

C:\Windows\System\MtZlvhj.exe

C:\Windows\System\MtZlvhj.exe

C:\Windows\System\ccCVzhS.exe

C:\Windows\System\ccCVzhS.exe

C:\Windows\System\ygYbkDt.exe

C:\Windows\System\ygYbkDt.exe

C:\Windows\System\NBlZdtw.exe

C:\Windows\System\NBlZdtw.exe

C:\Windows\System\ZqefNTz.exe

C:\Windows\System\ZqefNTz.exe

C:\Windows\System\yahospP.exe

C:\Windows\System\yahospP.exe

C:\Windows\System\VBhnmQi.exe

C:\Windows\System\VBhnmQi.exe

C:\Windows\System\nDjdhgY.exe

C:\Windows\System\nDjdhgY.exe

C:\Windows\System\rpgLEsp.exe

C:\Windows\System\rpgLEsp.exe

C:\Windows\System\DCUDYzj.exe

C:\Windows\System\DCUDYzj.exe

C:\Windows\System\ghsvbtk.exe

C:\Windows\System\ghsvbtk.exe

C:\Windows\System\dwvOvJV.exe

C:\Windows\System\dwvOvJV.exe

C:\Windows\System\jPvoGpv.exe

C:\Windows\System\jPvoGpv.exe

C:\Windows\System\ofeCHXG.exe

C:\Windows\System\ofeCHXG.exe

C:\Windows\System\OwPHZvX.exe

C:\Windows\System\OwPHZvX.exe

C:\Windows\System\IRnbbRF.exe

C:\Windows\System\IRnbbRF.exe

C:\Windows\System\ufiaYbB.exe

C:\Windows\System\ufiaYbB.exe

C:\Windows\System\evWsDkZ.exe

C:\Windows\System\evWsDkZ.exe

C:\Windows\System\MnuuxCA.exe

C:\Windows\System\MnuuxCA.exe

C:\Windows\System\LnsPCuB.exe

C:\Windows\System\LnsPCuB.exe

C:\Windows\System\LfQKUGf.exe

C:\Windows\System\LfQKUGf.exe

C:\Windows\System\DuqtcsQ.exe

C:\Windows\System\DuqtcsQ.exe

C:\Windows\System\vKNYkLO.exe

C:\Windows\System\vKNYkLO.exe

C:\Windows\System\XafWxdr.exe

C:\Windows\System\XafWxdr.exe

C:\Windows\System\ZIpJuBb.exe

C:\Windows\System\ZIpJuBb.exe

C:\Windows\System\jYcqTHZ.exe

C:\Windows\System\jYcqTHZ.exe

C:\Windows\System\baOovWi.exe

C:\Windows\System\baOovWi.exe

C:\Windows\System\yQlHQUH.exe

C:\Windows\System\yQlHQUH.exe

C:\Windows\System\EGNyyuU.exe

C:\Windows\System\EGNyyuU.exe

C:\Windows\System\brGdNKY.exe

C:\Windows\System\brGdNKY.exe

C:\Windows\System\WhTCviB.exe

C:\Windows\System\WhTCviB.exe

C:\Windows\System\frJyKGq.exe

C:\Windows\System\frJyKGq.exe

C:\Windows\System\QdKjxPp.exe

C:\Windows\System\QdKjxPp.exe

C:\Windows\System\QLPIkQY.exe

C:\Windows\System\QLPIkQY.exe

C:\Windows\System\gEgpGyv.exe

C:\Windows\System\gEgpGyv.exe

C:\Windows\System\ZEOThUh.exe

C:\Windows\System\ZEOThUh.exe

C:\Windows\System\WtXiaTe.exe

C:\Windows\System\WtXiaTe.exe

C:\Windows\System\uVdExjs.exe

C:\Windows\System\uVdExjs.exe

C:\Windows\System\tLjMUkn.exe

C:\Windows\System\tLjMUkn.exe

C:\Windows\System\pNdcELr.exe

C:\Windows\System\pNdcELr.exe

C:\Windows\System\dFskhKf.exe

C:\Windows\System\dFskhKf.exe

C:\Windows\System\oHcpJaY.exe

C:\Windows\System\oHcpJaY.exe

C:\Windows\System\RdGmBZD.exe

C:\Windows\System\RdGmBZD.exe

C:\Windows\System\IerVjgy.exe

C:\Windows\System\IerVjgy.exe

C:\Windows\System\BvLdaZB.exe

C:\Windows\System\BvLdaZB.exe

C:\Windows\System\qVtNmAA.exe

C:\Windows\System\qVtNmAA.exe

C:\Windows\System\pFllihh.exe

C:\Windows\System\pFllihh.exe

C:\Windows\System\IartjNy.exe

C:\Windows\System\IartjNy.exe

C:\Windows\System\gKSkzEx.exe

C:\Windows\System\gKSkzEx.exe

C:\Windows\System\WSZsOAe.exe

C:\Windows\System\WSZsOAe.exe

C:\Windows\System\LvzysOQ.exe

C:\Windows\System\LvzysOQ.exe

C:\Windows\System\lFgyWGs.exe

C:\Windows\System\lFgyWGs.exe

C:\Windows\System\lFRxVDG.exe

C:\Windows\System\lFRxVDG.exe

C:\Windows\System\VdxXBLB.exe

C:\Windows\System\VdxXBLB.exe

C:\Windows\System\LAGjiyr.exe

C:\Windows\System\LAGjiyr.exe

C:\Windows\System\FsMWrWl.exe

C:\Windows\System\FsMWrWl.exe

C:\Windows\System\ZTPEfTQ.exe

C:\Windows\System\ZTPEfTQ.exe

C:\Windows\System\eJoZVlX.exe

C:\Windows\System\eJoZVlX.exe

C:\Windows\System\DVjRlrM.exe

C:\Windows\System\DVjRlrM.exe

C:\Windows\System\MlRXuUo.exe

C:\Windows\System\MlRXuUo.exe

C:\Windows\System\daxDTnc.exe

C:\Windows\System\daxDTnc.exe

C:\Windows\System\DsBdtHi.exe

C:\Windows\System\DsBdtHi.exe

C:\Windows\System\Vmxsvyj.exe

C:\Windows\System\Vmxsvyj.exe

C:\Windows\System\aSrqzCd.exe

C:\Windows\System\aSrqzCd.exe

C:\Windows\System\MVvQkhP.exe

C:\Windows\System\MVvQkhP.exe

C:\Windows\System\pkZqinM.exe

C:\Windows\System\pkZqinM.exe

C:\Windows\System\sxnIFsJ.exe

C:\Windows\System\sxnIFsJ.exe

C:\Windows\System\kRzKwEV.exe

C:\Windows\System\kRzKwEV.exe

C:\Windows\System\lGWgJEA.exe

C:\Windows\System\lGWgJEA.exe

C:\Windows\System\UxRZUsR.exe

C:\Windows\System\UxRZUsR.exe

C:\Windows\System\XwAqKTU.exe

C:\Windows\System\XwAqKTU.exe

C:\Windows\System\GmcYTke.exe

C:\Windows\System\GmcYTke.exe

C:\Windows\System\FyTHpze.exe

C:\Windows\System\FyTHpze.exe

C:\Windows\System\WWKKsOh.exe

C:\Windows\System\WWKKsOh.exe

C:\Windows\System\hecvlQi.exe

C:\Windows\System\hecvlQi.exe

C:\Windows\System\hxFEpHN.exe

C:\Windows\System\hxFEpHN.exe

C:\Windows\System\EdURcCp.exe

C:\Windows\System\EdURcCp.exe

C:\Windows\System\OKFuxiw.exe

C:\Windows\System\OKFuxiw.exe

C:\Windows\System\LONoyTA.exe

C:\Windows\System\LONoyTA.exe

C:\Windows\System\JyCilki.exe

C:\Windows\System\JyCilki.exe

C:\Windows\System\IRvjkTM.exe

C:\Windows\System\IRvjkTM.exe

C:\Windows\System\ICXUpfK.exe

C:\Windows\System\ICXUpfK.exe

C:\Windows\System\wtEhErU.exe

C:\Windows\System\wtEhErU.exe

C:\Windows\System\vTpRvgN.exe

C:\Windows\System\vTpRvgN.exe

C:\Windows\System\sASpZAO.exe

C:\Windows\System\sASpZAO.exe

C:\Windows\System\EIOVnMv.exe

C:\Windows\System\EIOVnMv.exe

C:\Windows\System\UtYMhBu.exe

C:\Windows\System\UtYMhBu.exe

C:\Windows\System\IwStpbt.exe

C:\Windows\System\IwStpbt.exe

C:\Windows\System\dKuSJfT.exe

C:\Windows\System\dKuSJfT.exe

C:\Windows\System\dsROflC.exe

C:\Windows\System\dsROflC.exe

C:\Windows\System\jRiiMKl.exe

C:\Windows\System\jRiiMKl.exe

C:\Windows\System\uNxSTYi.exe

C:\Windows\System\uNxSTYi.exe

C:\Windows\System\pteVEXc.exe

C:\Windows\System\pteVEXc.exe

C:\Windows\System\JpaZgXr.exe

C:\Windows\System\JpaZgXr.exe

C:\Windows\System\babqVrJ.exe

C:\Windows\System\babqVrJ.exe

C:\Windows\System\ZeyvFGi.exe

C:\Windows\System\ZeyvFGi.exe

C:\Windows\System\KKIEyRW.exe

C:\Windows\System\KKIEyRW.exe

C:\Windows\System\qLppqPC.exe

C:\Windows\System\qLppqPC.exe

C:\Windows\System\NSvDqOu.exe

C:\Windows\System\NSvDqOu.exe

C:\Windows\System\wTDIWYC.exe

C:\Windows\System\wTDIWYC.exe

C:\Windows\System\ZycxVTh.exe

C:\Windows\System\ZycxVTh.exe

C:\Windows\System\sXEoZNu.exe

C:\Windows\System\sXEoZNu.exe

C:\Windows\System\MlFcLIO.exe

C:\Windows\System\MlFcLIO.exe

C:\Windows\System\ZIqsEsC.exe

C:\Windows\System\ZIqsEsC.exe

C:\Windows\System\QlJwUZQ.exe

C:\Windows\System\QlJwUZQ.exe

C:\Windows\System\qVPTasE.exe

C:\Windows\System\qVPTasE.exe

C:\Windows\System\TwtyEPN.exe

C:\Windows\System\TwtyEPN.exe

C:\Windows\System\GlGVlYk.exe

C:\Windows\System\GlGVlYk.exe

C:\Windows\System\fsnvzro.exe

C:\Windows\System\fsnvzro.exe

C:\Windows\System\aNFKTxI.exe

C:\Windows\System\aNFKTxI.exe

C:\Windows\System\ohhhXcZ.exe

C:\Windows\System\ohhhXcZ.exe

C:\Windows\System\AhQyFDq.exe

C:\Windows\System\AhQyFDq.exe

C:\Windows\System\toQKCmX.exe

C:\Windows\System\toQKCmX.exe

C:\Windows\System\ZpCIqIA.exe

C:\Windows\System\ZpCIqIA.exe

C:\Windows\System\xqCOvmu.exe

C:\Windows\System\xqCOvmu.exe

C:\Windows\System\yhvQcMX.exe

C:\Windows\System\yhvQcMX.exe

C:\Windows\System\BAcvlgk.exe

C:\Windows\System\BAcvlgk.exe

C:\Windows\System\mrcXZys.exe

C:\Windows\System\mrcXZys.exe

C:\Windows\System\eMZHhpX.exe

C:\Windows\System\eMZHhpX.exe

C:\Windows\System\bOnNZwT.exe

C:\Windows\System\bOnNZwT.exe

C:\Windows\System\BYLQzJo.exe

C:\Windows\System\BYLQzJo.exe

C:\Windows\System\rQIopxj.exe

C:\Windows\System\rQIopxj.exe

C:\Windows\System\wTWPwez.exe

C:\Windows\System\wTWPwez.exe

C:\Windows\System\qHJnwmc.exe

C:\Windows\System\qHJnwmc.exe

C:\Windows\System\LkLKEhV.exe

C:\Windows\System\LkLKEhV.exe

C:\Windows\System\YrKuzmr.exe

C:\Windows\System\YrKuzmr.exe

C:\Windows\System\mdDfGqy.exe

C:\Windows\System\mdDfGqy.exe

C:\Windows\System\YbWmLBo.exe

C:\Windows\System\YbWmLBo.exe

C:\Windows\System\UHuuTWT.exe

C:\Windows\System\UHuuTWT.exe

C:\Windows\System\TMXMHTL.exe

C:\Windows\System\TMXMHTL.exe

C:\Windows\System\XkrrcCh.exe

C:\Windows\System\XkrrcCh.exe

C:\Windows\System\HvHPOzi.exe

C:\Windows\System\HvHPOzi.exe

C:\Windows\System\XhdZZAK.exe

C:\Windows\System\XhdZZAK.exe

C:\Windows\System\qreZmTf.exe

C:\Windows\System\qreZmTf.exe

C:\Windows\System\MKOejzo.exe

C:\Windows\System\MKOejzo.exe

C:\Windows\System\IOwolni.exe

C:\Windows\System\IOwolni.exe

C:\Windows\System\AejGZOj.exe

C:\Windows\System\AejGZOj.exe

C:\Windows\System\MTPndnL.exe

C:\Windows\System\MTPndnL.exe

C:\Windows\System\DceStaM.exe

C:\Windows\System\DceStaM.exe

C:\Windows\System\dFlKqRq.exe

C:\Windows\System\dFlKqRq.exe

C:\Windows\System\buMfLxe.exe

C:\Windows\System\buMfLxe.exe

C:\Windows\System\JrdZtJx.exe

C:\Windows\System\JrdZtJx.exe

C:\Windows\System\uVSzAJH.exe

C:\Windows\System\uVSzAJH.exe

C:\Windows\System\dXRKPFN.exe

C:\Windows\System\dXRKPFN.exe

C:\Windows\System\mtuCOYQ.exe

C:\Windows\System\mtuCOYQ.exe

C:\Windows\System\xpkVDQx.exe

C:\Windows\System\xpkVDQx.exe

C:\Windows\System\ZSzCyJg.exe

C:\Windows\System\ZSzCyJg.exe

C:\Windows\System\kqnGues.exe

C:\Windows\System\kqnGues.exe

Network

N/A

Files

memory/2020-0-0x000000013F120000-0x000000013F471000-memory.dmp

memory/2020-1-0x00000000000F0000-0x0000000000100000-memory.dmp

C:\Windows\system\VopbbYB.exe

MD5	f0f6e7ddb867d04a1629e485e3d931be
SHA1	38faaf34be29f64ab95a124af1c68d040b054bcf
SHA256	85340c23bacc19d7e117b10f1b87a29bde777ef0c6e22accdfc8ee77f0f130de
SHA512	82c467eda2d645ed43f74b6107e4b3aa0df20447bd89f04b842f4408979a17dd7ae68d9e9a822f9d9775c9cbbce37c2275b553bcb3e6872c4728d28a4185c75d

C:\Windows\system\BeAQUWD.exe

MD5	3c248c16e84563cc569eee6937620cd6
SHA1	31eb6df854fc7972c4d0de23b349e5c5690a8108
SHA256	e163a9350947014a11a022d2a8e0dcbb53bc2dc7634c62e899abb42ce267adf1
SHA512	16a5dc9f31e27d9949d7c1fdb58409801665f6409b65524a06ebe536998a3dcc5357667ea7e0b240cb8cfb737f9c9743868c30e7e52b66f08bd801bc6d696bbf

\Windows\system\curPUUc.exe

MD5	3d053c71023d5a252f0f171d511ccbdb
SHA1	9c4a87753199e2386dd4a8b4bc9dde868c59b1c2
SHA256	c30388925032131eb35d98d06c506bccfd75c3ca50f2c603cb50c286b100c9d5
SHA512	94d9c5b53a56751a5261941e7b32872810ba1d9f0c1256c03d8b76dbfe5451eb39484af3b0926be3525d95579a9ca6f7bb1f0c1e7ee9e3c81f49fa975645b89f

\Windows\system\zGVGrne.exe

MD5	d2269ed8785d61a8aea1effad367321b
SHA1	cba6d3cb07538e6857efd26e0e57a2951ee5d905
SHA256	72c89cd30ff355b6a5585903b096ccb68688611521ffb94949b9839d60463402
SHA512	1b07e571b926108b45a8041566b523098d19cb672bbfcbe9dc43398a8af550b33d8653fd2d4e96152d3167e69fd6e074a840f6f2954b3211dee90f708641011d

C:\Windows\system\aopkAGq.exe

MD5	79a22a3b0c710e831bc9cfe2cca51771
SHA1	f7e607cacf2b3847dbc486002548960defabb41f
SHA256	bac03e468b5630a7a8c412dfd257d4371c44a00c4066661b304a131b01e38cf7
SHA512	583213d51c088993315760adba8b2916153f1c4cb36b86eaba19cb60595b5822a0c6606168b1950abdc622667e42ffe311ec3f1c0c29d069aef10abeb338c167

C:\Windows\system\sDZPfaI.exe

MD5	d3203a2d588fe0517ab4dc181da9f369
SHA1	2a690481cb02025f05019447d966078985753bb9
SHA256	ec8fe2dbd85f66c7c205d7bfc89da65425cf81473b8827a14899567bdb21dcd0
SHA512	666f4c4a706e4b8585ada0280e8d3a72bb5bf0dfbfe767786fdd3ea7a8a8acae2b8bc7879aa70c12dd4fce3d6086ee71c6399570aa26d7e7bc8a845617be14fe

C:\Windows\system\ngqpKZK.exe

MD5	cb79d4216ef74915cb5d326ef01efc08
SHA1	6eb9df56188eb7f6d477cc4d77cf7787faaf970d
SHA256	d43f5ad1d83872240eb8eabc28c2dea8b8f69a0692a978c35eea2445db858bf4
SHA512	11f3a93de8ecd55c8494b13eeb27904f7db1baa2fcee56f46e315c3b7bada0de4c9f2e1aebccc35b28e5d02e324a2729d22fe39735fae01e9254578e9158fca6

C:\Windows\system\caoahvS.exe

MD5	4e4deb66304d7486d80ed37ae20dbc7e
SHA1	d6dd02e75e31649a81a8d351abe2d13801cff30b
SHA256	8109d9449313c29cc6bb84012b7a2167df308d085cc69f0f4b4496ed1a620d6e
SHA512	6bc903954ab7444921f4169af8d44edf0d5de308845194517ea500b5b5a0c87ae951b66e5d0d6af9dab70d1483c755fab06a07667647c11b26ebec7872ecf12e

C:\Windows\system\rwjlnRp.exe

MD5	a0209d0c46a27207200f3341469855c1
SHA1	bf958822838348ae5cc7dfcc64938a3eb703f74b
SHA256	f2c479b28b73f4cb166362534dadce4c4f1af42dc21049f036136b31e1ae7794
SHA512	dafb1a8a7be7f634713f4a1db29729fb8a9e512aded0c98a8afe798229fbb08c851bcb688f8739b28be8afa57b8b6a220f62b4f0d725eb4b0ee21f48200cc431

C:\Windows\system\Amuwder.exe

MD5	345eb6eb772eb67a0ba133572c3b223c
SHA1	d95a83239a4345aa839afcef0ca595aeb7a8a070
SHA256	e730b61be1bf84aa65da1604ce67547ae83a3d1a4acb862c87bd1f85ec9b8d6a
SHA512	502f52630bc608c6ef7d1d130d66ce92bf8f76d5fb0ea1964af05ce7c541f48ae80a39f95b26f6a8f7f5d07851fc19e1567656eb179a9b3685f380e85a6ee3e7

C:\Windows\system\YXMDwDX.exe

MD5	0045f7bbfa88b0438a5872aa51ab8841
SHA1	8bd0e2a1e66d23cc8bc0e880e2816b032b4d8aee
SHA256	e992e82641120136fed7c545af5a2a761c471ec67bd3f5c5350112a4b80342bf
SHA512	5c83ee635c0e98a9f6d335a2140ae5516b5dd0a6397312058609a4dab07028f5bc1fd79b6c0034747e13dd72c367e8e287007911675a2ead795f218396b31840

C:\Windows\system\fqWQSmo.exe

MD5	23f6223f298aad19333fec76da10b805
SHA1	1aee3ebb9dc123ee02dc16d2e28fc6b54a5f7890
SHA256	82ab9ccc807e85b9332b8c2d61d3ae08e1749e519f6bc0bf4e0a7dde6661d2bb
SHA512	5dedc1534df2b97633a1d9d8274a2798bd1dd6c6e99f58e25a49c6864910583c3b4e33ec07a20b9f7d1905b30b4df749aefdf8dd03256b293144481fcea5fde4

C:\Windows\system\xjaWnaV.exe

MD5	f79cd27c54d36e897ded4c7c9110c41d
SHA1	59899ee3d4d619412ac308cc0ce05c3d2ff07add
SHA256	c427b49c94af8b414b51bce535800aaa17dfe85a56dc6eabdfd8fb4f81cce98f
SHA512	14fd0f3b031f3117dcafc42f66e3b9d8ddf889bebf7626a07935db7181fc15ae24546ef5ead6ecda959d4b130cfecdaaa13ec53e96645a7d9e34d6100b23caaf

C:\Windows\system\qBgeVkH.exe

MD5	4c9cb86bccb713d507d5d763d4ab3cbb
SHA1	0dfd065b9f32493d3e1d83f99f30e8fd1ce14968
SHA256	2a0748db44127912c1a73ad11b5f90f4ef17b95d0872b5340920e71695f48467
SHA512	bbf31fa6894c6c90150ec98429808813c546d1a59ba09be3ae7b5ab2a3d93179d582edb5dbccefa870f449463ef4c6d335a6f3e50387436030a5c382cc80c431

memory/2716-584-0x000000013FA30000-0x000000013FD81000-memory.dmp

memory/3044-589-0x000000013F3B0000-0x000000013F701000-memory.dmp

memory/2020-595-0x000000013F860000-0x000000013FBB1000-memory.dmp

memory/2020-612-0x000000013FC10000-0x000000013FF61000-memory.dmp

memory/2556-684-0x000000013F510000-0x000000013F861000-memory.dmp

memory/2692-693-0x000000013FA60000-0x000000013FDB1000-memory.dmp

memory/2020-697-0x000000013FA90000-0x000000013FDE1000-memory.dmp

memory/2020-702-0x000000013FDF0000-0x0000000140141000-memory.dmp

memory/2020-699-0x000000013F4A0000-0x000000013F7F1000-memory.dmp

memory/2540-698-0x000000013FA90000-0x000000013FDE1000-memory.dmp

memory/2780-696-0x000000013FEF0000-0x0000000140241000-memory.dmp

memory/2020-695-0x000000013FEF0000-0x0000000140241000-memory.dmp

memory/2020-692-0x000000013FA60000-0x000000013FDB1000-memory.dmp

memory/2836-691-0x000000013F7C0000-0x000000013FB11000-memory.dmp

memory/2020-686-0x000000013F7C0000-0x000000013FB11000-memory.dmp

memory/2020-683-0x000000013F510000-0x000000013F861000-memory.dmp

memory/2680-672-0x000000013FEA0000-0x00000001401F1000-memory.dmp

memory/2020-666-0x000000013FEA0000-0x00000001401F1000-memory.dmp

memory/3048-649-0x000000013FB90000-0x000000013FEE1000-memory.dmp

memory/2020-643-0x000000013FB90000-0x000000013FEE1000-memory.dmp

memory/2672-642-0x000000013FC10000-0x000000013FF61000-memory.dmp

memory/2792-597-0x000000013F860000-0x000000013FBB1000-memory.dmp

memory/2668-594-0x000000013F910000-0x000000013FC61000-memory.dmp

memory/2020-591-0x000000013F910000-0x000000013FC61000-memory.dmp

memory/2020-587-0x0000000001F30000-0x0000000002281000-memory.dmp

memory/2428-585-0x000000013FDF0000-0x0000000140141000-memory.dmp

memory/2020-583-0x000000013FA30000-0x000000013FD81000-memory.dmp

memory/2904-582-0x000000013F830000-0x000000013FB81000-memory.dmp

C:\Windows\system\wbvGfbB.exe

MD5	ed59828f50f25e7f40e8ec1d081c8b79
SHA1	37944cf0802cf815f8659b156b77e7d06ea8abc6
SHA256	437c9d38742dda094c50aa7b3cc7779ab24f8267c5ade9e3aa65678513d5a933
SHA512	551e09e42e34838774dbc639a91337587a1603b98ca4985f55d5c77d2a23f156fd7dee2fe41ef178350549a2e19132a20dae7fad2045b6c1d8b7ba5048d2125c

C:\Windows\system\fCXeRwj.exe

MD5	694592890d963b0aee69c3fc6b09f7c9
SHA1	c473374871b3eb354411faa9604e28e892069992
SHA256	1080fda1852fd01787bb4e27572ba5ed33da4b9e1bf4ddb99e3d9f69b214c46a
SHA512	84cab87e27591b9f002c3a63da912ffc4740ab8b75ba33bdc7c3e05cf1f4ea42d9d152d88f4d07646eb4f972b35c8c354ff3553934cb2ba794d9ddf1f21ba571

C:\Windows\system\srpXkLR.exe

MD5	893355bd09b2b136b91a45b4b754c00c
SHA1	8fd50ef2c41ed5b7f144cf61b74303e1cf8b1702
SHA256	87089b622fc978c4820ccfa90bb709e682a13624ad6f32c5cbb63828ee096622
SHA512	2ed318ea0dd92433a775b0a6088df9896a16dd5e25222bbf359cfecf9541f3a57583af05152f822ef6285dd02b6e1b069e7f121622fb152d407cdb11159a7590

C:\Windows\system\WgEXSdM.exe

MD5	c090651ee90e58772bf1027896f4574e
SHA1	0788342ae5b0507a74b62e1244d3543bbe7e4927
SHA256	ee68ac5e36e9117dce11f078770ba5ae65c36de60e756b3ab4b6760c534e8554
SHA512	09266ea1c87cd7b7d190d78b8bfd51ba5e3242f39ae344035f14caddd76d7ad6ef2ca4da9526001bbdf51fdb45898dc88ffe91dceb58dad166f19e82d14a33d4

C:\Windows\system\ZGQDulq.exe

MD5	94dcc7b98ce793c1f3df35892039abab
SHA1	fd2d7678f5c810e6ba7a27150eb040485e97f392
SHA256	10d235428570b1d62ae7ed2fae09768be61beebfe2fc814dab682698e91c0080
SHA512	8170f348dea43b96dabad2b99775521360f3876464d602cecc7ee4a75c4d6b5c61bf2892fb04258bc5dcb7e8d4036048746fc68713fdc13545b06edb0457b688

C:\Windows\system\yVngxbx.exe

MD5	d63c843320f4c0d06abfe43f6201369e
SHA1	adc1f814946f6fb2bd006347c78fef6431846e8f
SHA256	a4dfc2133b2e32be779d0dfdccd94479874a33115b3c900242ca3e4c35cffeb4
SHA512	4b8488323ff482c0a0b6ccc8c56075000094d681335c61b422e798742362d11c8ac9290c11f8ff65074d92b49b6fe03d16022d0eaa1a9a6279015315ab899e84

C:\Windows\system\eVIcaKu.exe

MD5	88238ac1417671962e5322b50a743416
SHA1	c4145bd2dd83829f7e9b9d717ebbf2da8ec23fd7
SHA256	1e6c26d63c25d634fc68b49c7c01c71d46e7fc2a69e8b45bfe4dd1f310209932
SHA512	8a2d7bb1fc72e52a89c6bde5cc0d919fab4bc1564bdd8d7d71576aa8aeb64d1123fa1888b1e6b43bbaf2dd35bc9a49ea86d1d48e1762fd1b3835b5d4da5d6c89

C:\Windows\system\NNEVSbr.exe

MD5	f7f4c5aa48cda01e0f6e1c09fe52cb7f
SHA1	74d99e840889b91809a23a3558953bd96e26fd75
SHA256	d702a1b8f6c22fde48f12562500df69986be701f473956b290d9a53194d66576
SHA512	fd85802574eae4e5762ad7655d9348c2f4d5b103a57d46ac44a456ddb6a3b10012dcf3f4162990bc0bf89fd7ba54cd0786c958b43f3aa7b2cd477635778d0d1b

C:\Windows\system\HDbQwLK.exe

MD5	db36d47a536be4d1abb24f4ab5e948a4
SHA1	7aa61eafb517b99ea42ed8e2f4c8dc96ffe3cd1e
SHA256	166a8c443e08c2e7924a4aba833e3600f88826e33f27190372a571fea8790afb
SHA512	c20770ab3ee17dc17753dd7ed461deb65834f1df1fead32ea52969264b8c79de525c0ad04268111fe81436ca5af1b3c5c2ccc2e44ae295e3775cd5de07fe6cf0

C:\Windows\system\WQKMtuR.exe

MD5	05f61d9d0e40826d2fcc26e4b08b41cf
SHA1	3cf98deb0f44f96662f2167e236c2d1ef6084557
SHA256	9ef430db215ba2582e86fbbe34b613be484da55c8db78efcbc4bdd5dd1cd58d8
SHA512	30a603f193f62c13ad52c8a151d6d4d14bf1ce363379691cc638ac9e2ff9782353176fd97bef0844304687cb46bffc840d5169a613cf79af42ed0fc5f83bd151

C:\Windows\system\oLfnlYc.exe

MD5	44628106aefbdeef1cee222f706492d4
SHA1	c604f0cad26490da3218ee278df4c50e947d60dd
SHA256	2745f6ac7cd2b42a9c57215fda93c0499874f6dee416230451bc390885731349
SHA512	c3c783e2105badcc22fa013c51277f2bcceb6102e31ac25915a5fda96690ec13113cb3435b6e4ad8b43ced664036d4ed7511691c8b4075013de3ed420386fda8

C:\Windows\system\SvAmQqS.exe

MD5	a96a99b0df52fa6168afc5178862240e
SHA1	b3951fcb444dfcc4c0489173fd3b615ffcf10d2e
SHA256	abb975e24ab812a7e02f94dd33f72ff33d0e7f45feaaaf34c10934972f633f07
SHA512	5d418ad00159f56ba585b2c1ad0d3c5913705c8d802cf4a407723c48e63fb396733b2d3c956a60fe7c00f6957233ec79fd06beeec0c1ee49c5311464a81d1c75

C:\Windows\system\DyaTanT.exe

MD5	49a86fc7defb1b4b039c640ba052a3d5
SHA1	93d5da1b8d29710324b385c17992fd031e55dbad
SHA256	292c69fff3aabadc6943481baa2f17d5129247f018ccbc02e5ed832a93d704e1
SHA512	cfdd845ff3233e446450b78692124977e469ccd89b9846c76fdfd65988f7891ba63c36a9a2fcc206ecb86dde0cc3fdc7289cee57a09c3fed8a29b3fa4a418838

C:\Windows\system\vLTtWKq.exe

MD5	fbcb90c9be632b6fe370dae729a85151
SHA1	1045f039d0daef256d993e33ff97cd211f403268
SHA256	98d5a448b6d6917f61a1244d249338e0d8537b83d05634a100f161e49b78fd0a
SHA512	e31653801af400519b722e7d1d0ff2d3593ebcac51e36ea84734f0ab8cd315f3705186548ede305fb833209275a57cff4f0feacaed865b83df0c56613de46505

C:\Windows\system\uUiQaWn.exe

MD5	8ecf8661f537c2664f06336c047a48d7
SHA1	35ca3509422b2793670064f9c5cb84b55c186151
SHA256	99d69f38c8e8a44dac11a0ea454c953773e8d574924a05b089dc2b8e436eb4cd
SHA512	a7ddaf6da622d198d40472052c4bec22df9853a3b84688ce0d32e266bd2929ead891dfd7f27c66dfcd06d31d1b68511e80abda7cb86e904e9bd8b57910fda1bf

C:\Windows\system\TfIAACh.exe

MD5	fea60c6ab9dcfd8fb05032c075184302
SHA1	076bcca4e8d31994d5c7cea6bdc9a1217e8803b9
SHA256	8b988215c4ad6601d451f7912a7d37d84b56aa3e541e19da88f53c7f940d6184
SHA512	001f13a38e51379e1512e3411f342048b93ec50c3211c29b4184079c19582136e5810fac1c23e68d418e5c497cc3eb5cde9c1ad26dbe98ddea8e5eb64af514e1

C:\Windows\system\LNOCmYA.exe

MD5	fcd8fbfccee870b6149e34c846150d99
SHA1	32095b02ff412d486505ef37aa3855a30034f504
SHA256	871bb27d6abc81bd3dcda8f4a0bf37f614ee08e14a3c33faf3ec36fb7a84cde3
SHA512	c075ba52d341f1bf3ca6d5ea40fe23fd524f819af08797b1389d7aa5276b4cb973af62e306e700aaca0167fc9bbc3bf5f87a4e5bc8dd99110802d151bc18ed26

C:\Windows\system\jhVhfPg.exe

MD5	7c7bb06aa1046b099aed8e6162bd99f4
SHA1	6ca313978290b5c07bbcd493336359b20925ced2
SHA256	41e7cfeb8d002d28d8f1e9a4b093672cf96e35b3f83ee0794eaa9b8ff6420f14
SHA512	8e35e15f3714e1af1649dec09d4db5b217ea2d79a092cf9072a86d571146e193777383ca1a3e24354f3a0cd6c1de15789649693fd90fbf6a9dcb3ade8001663b

memory/2020-13-0x000000013F830000-0x000000013FB81000-memory.dmp

memory/2904-4189-0x000000013F830000-0x000000013FB81000-memory.dmp

memory/2020-4281-0x000000013F120000-0x000000013F471000-memory.dmp

memory/2792-4813-0x000000013F860000-0x000000013FBB1000-memory.dmp

memory/2428-4829-0x000000013FDF0000-0x0000000140141000-memory.dmp

memory/2780-4812-0x000000013FEF0000-0x0000000140241000-memory.dmp

memory/2836-4819-0x000000013F7C0000-0x000000013FB11000-memory.dmp

memory/2668-4817-0x000000013F910000-0x000000013FC61000-memory.dmp

memory/2672-4858-0x000000013FC10000-0x000000013FF61000-memory.dmp

memory/2540-4857-0x000000013FA90000-0x000000013FDE1000-memory.dmp

memory/2680-4854-0x000000013FEA0000-0x00000001401F1000-memory.dmp

memory/2716-4860-0x000000013FA30000-0x000000013FD81000-memory.dmp

memory/3048-4863-0x000000013FB90000-0x000000013FEE1000-memory.dmp

memory/3044-4862-0x000000013F3B0000-0x000000013F701000-memory.dmp

memory/2692-4861-0x000000013FA60000-0x000000013FDB1000-memory.dmp

memory/2556-4864-0x000000013F510000-0x000000013F861000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 22:31

Reported

2024-06-13 22:33

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\VopbbYB.exe	N/A
N/A	N/A	C:\Windows\System\jhVhfPg.exe	N/A
N/A	N/A	C:\Windows\System\BeAQUWD.exe	N/A
N/A	N/A	C:\Windows\System\curPUUc.exe	N/A
N/A	N/A	C:\Windows\System\zGVGrne.exe	N/A
N/A	N/A	C:\Windows\System\LNOCmYA.exe	N/A
N/A	N/A	C:\Windows\System\ngqpKZK.exe	N/A
N/A	N/A	C:\Windows\System\uUiQaWn.exe	N/A
N/A	N/A	C:\Windows\System\aopkAGq.exe	N/A
N/A	N/A	C:\Windows\System\caoahvS.exe	N/A
N/A	N/A	C:\Windows\System\sDZPfaI.exe	N/A
N/A	N/A	C:\Windows\System\vLTtWKq.exe	N/A
N/A	N/A	C:\Windows\System\DyaTanT.exe	N/A
N/A	N/A	C:\Windows\System\TfIAACh.exe	N/A
N/A	N/A	C:\Windows\System\rwjlnRp.exe	N/A
N/A	N/A	C:\Windows\System\SvAmQqS.exe	N/A
N/A	N/A	C:\Windows\System\oLfnlYc.exe	N/A
N/A	N/A	C:\Windows\System\WQKMtuR.exe	N/A
N/A	N/A	C:\Windows\System\Amuwder.exe	N/A
N/A	N/A	C:\Windows\System\YXMDwDX.exe	N/A
N/A	N/A	C:\Windows\System\HDbQwLK.exe	N/A
N/A	N/A	C:\Windows\System\NNEVSbr.exe	N/A
N/A	N/A	C:\Windows\System\eVIcaKu.exe	N/A
N/A	N/A	C:\Windows\System\yVngxbx.exe	N/A
N/A	N/A	C:\Windows\System\ZGQDulq.exe	N/A
N/A	N/A	C:\Windows\System\xjaWnaV.exe	N/A
N/A	N/A	C:\Windows\System\qBgeVkH.exe	N/A
N/A	N/A	C:\Windows\System\WgEXSdM.exe	N/A
N/A	N/A	C:\Windows\System\srpXkLR.exe	N/A
N/A	N/A	C:\Windows\System\fCXeRwj.exe	N/A
N/A	N/A	C:\Windows\System\wbvGfbB.exe	N/A
N/A	N/A	C:\Windows\System\XEhTWiA.exe	N/A
N/A	N/A	C:\Windows\System\FbpsUaR.exe	N/A
N/A	N/A	C:\Windows\System\RfXppvd.exe	N/A
N/A	N/A	C:\Windows\System\fqWQSmo.exe	N/A
N/A	N/A	C:\Windows\System\weFnbpr.exe	N/A
N/A	N/A	C:\Windows\System\QehVrqj.exe	N/A
N/A	N/A	C:\Windows\System\qOPdrfj.exe	N/A
N/A	N/A	C:\Windows\System\OOpggoB.exe	N/A
N/A	N/A	C:\Windows\System\vOerQVf.exe	N/A
N/A	N/A	C:\Windows\System\FjFaYnb.exe	N/A
N/A	N/A	C:\Windows\System\HGjUTvj.exe	N/A
N/A	N/A	C:\Windows\System\TmVhZZD.exe	N/A
N/A	N/A	C:\Windows\System\hLkLMqe.exe	N/A
N/A	N/A	C:\Windows\System\QmmmrlC.exe	N/A
N/A	N/A	C:\Windows\System\XkZYfBr.exe	N/A
N/A	N/A	C:\Windows\System\ZGhzPTM.exe	N/A
N/A	N/A	C:\Windows\System\LzqAPJh.exe	N/A
N/A	N/A	C:\Windows\System\hhbmJRs.exe	N/A
N/A	N/A	C:\Windows\System\iceCSRn.exe	N/A
N/A	N/A	C:\Windows\System\uPzAnZT.exe	N/A
N/A	N/A	C:\Windows\System\gWYgSbN.exe	N/A
N/A	N/A	C:\Windows\System\TaceWUv.exe	N/A
N/A	N/A	C:\Windows\System\UTysIlc.exe	N/A
N/A	N/A	C:\Windows\System\eZnmdbB.exe	N/A
N/A	N/A	C:\Windows\System\GCzQOJq.exe	N/A
N/A	N/A	C:\Windows\System\TjiDaDq.exe	N/A
N/A	N/A	C:\Windows\System\FPufDAC.exe	N/A
N/A	N/A	C:\Windows\System\MiDLZpS.exe	N/A
N/A	N/A	C:\Windows\System\NBmKgDV.exe	N/A
N/A	N/A	C:\Windows\System\GzxfYVJ.exe	N/A
N/A	N/A	C:\Windows\System\pXHUlfU.exe	N/A
N/A	N/A	C:\Windows\System\cxkXHtn.exe	N/A
N/A	N/A	C:\Windows\System\odHGnhe.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\JQeaozR.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JZxvmAe.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ReRUcyt.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dWUjjfl.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SHReAdT.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SAxZUxK.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jGgFWhR.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ViMSGlR.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\waSaRRS.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fDGeKnV.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HldGLFy.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SxyaZsu.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\svxFhMM.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bfcFgiz.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VlLqkXv.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BYTmLQh.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bsRBQYz.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZraRQvS.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\axCOJxS.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sHbozIV.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kUyyhcj.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DbALQgL.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oNcLdRq.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wBRaesw.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PqErNKd.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ogNVQHj.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Xmxuexc.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xCzjaEM.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XNpIrVG.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VUZaSGy.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nhIiAgN.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TXOVZqd.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ShsHjVS.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PunsxTT.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MvzQfBB.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fvfDHLd.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UYFvNOI.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NmFtrDY.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CcYXAjP.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UZrLbpo.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DiHSBeb.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RJsvkrR.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WavkyYh.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\syEUSHu.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nNRpRFh.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QiLmsSz.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kVRLHlc.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lSQHKan.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AwzgDuk.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RdhPqZU.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZaSmDmH.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Sdabqgq.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AEkjIhW.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tByGTti.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IckfDzs.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pcaFleq.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tQQHuCs.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\klobefa.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tuGHGIW.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lUJVIeE.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PGadPxT.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VGtbanN.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yrZdUjK.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NNEVSbr.exe	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3144 wrote to memory of 1720	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\VopbbYB.exe
PID 3144 wrote to memory of 1720	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\VopbbYB.exe
PID 3144 wrote to memory of 4212	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\jhVhfPg.exe
PID 3144 wrote to memory of 4212	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\jhVhfPg.exe
PID 3144 wrote to memory of 2984	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\BeAQUWD.exe
PID 3144 wrote to memory of 2984	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\BeAQUWD.exe
PID 3144 wrote to memory of 1768	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\curPUUc.exe
PID 3144 wrote to memory of 1768	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\curPUUc.exe
PID 3144 wrote to memory of 1188	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\LNOCmYA.exe
PID 3144 wrote to memory of 1188	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\LNOCmYA.exe
PID 3144 wrote to memory of 5064	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\zGVGrne.exe
PID 3144 wrote to memory of 5064	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\zGVGrne.exe
PID 3144 wrote to memory of 5104	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\aopkAGq.exe
PID 3144 wrote to memory of 5104	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\aopkAGq.exe
PID 3144 wrote to memory of 1268	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\sDZPfaI.exe
PID 3144 wrote to memory of 1268	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\sDZPfaI.exe
PID 3144 wrote to memory of 3260	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\ngqpKZK.exe
PID 3144 wrote to memory of 3260	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\ngqpKZK.exe
PID 3144 wrote to memory of 3036	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\TfIAACh.exe
PID 3144 wrote to memory of 3036	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\TfIAACh.exe
PID 3144 wrote to memory of 1100	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\uUiQaWn.exe
PID 3144 wrote to memory of 1100	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\uUiQaWn.exe
PID 3144 wrote to memory of 4728	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\caoahvS.exe
PID 3144 wrote to memory of 4728	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\caoahvS.exe
PID 3144 wrote to memory of 4072	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\vLTtWKq.exe
PID 3144 wrote to memory of 4072	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\vLTtWKq.exe
PID 3144 wrote to memory of 3848	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\DyaTanT.exe
PID 3144 wrote to memory of 3848	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\DyaTanT.exe
PID 3144 wrote to memory of 4424	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\rwjlnRp.exe
PID 3144 wrote to memory of 4424	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\rwjlnRp.exe
PID 3144 wrote to memory of 4536	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\SvAmQqS.exe
PID 3144 wrote to memory of 4536	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\SvAmQqS.exe
PID 3144 wrote to memory of 4308	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\oLfnlYc.exe
PID 3144 wrote to memory of 4308	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\oLfnlYc.exe
PID 3144 wrote to memory of 2944	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\WQKMtuR.exe
PID 3144 wrote to memory of 2944	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\WQKMtuR.exe
PID 3144 wrote to memory of 4076	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\Amuwder.exe
PID 3144 wrote to memory of 4076	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\Amuwder.exe
PID 3144 wrote to memory of 2700	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\YXMDwDX.exe
PID 3144 wrote to memory of 2700	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\YXMDwDX.exe
PID 3144 wrote to memory of 4720	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\HDbQwLK.exe
PID 3144 wrote to memory of 4720	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\HDbQwLK.exe
PID 3144 wrote to memory of 2904	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\NNEVSbr.exe
PID 3144 wrote to memory of 2904	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\NNEVSbr.exe
PID 3144 wrote to memory of 3380	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\eVIcaKu.exe
PID 3144 wrote to memory of 3380	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\eVIcaKu.exe
PID 3144 wrote to memory of 1628	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\yVngxbx.exe
PID 3144 wrote to memory of 1628	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\yVngxbx.exe
PID 3144 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\fqWQSmo.exe
PID 3144 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\fqWQSmo.exe
PID 3144 wrote to memory of 1436	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\ZGQDulq.exe
PID 3144 wrote to memory of 1436	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\ZGQDulq.exe
PID 3144 wrote to memory of 4836	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\xjaWnaV.exe
PID 3144 wrote to memory of 4836	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\xjaWnaV.exe
PID 3144 wrote to memory of 4220	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\qBgeVkH.exe
PID 3144 wrote to memory of 4220	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\qBgeVkH.exe
PID 3144 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\WgEXSdM.exe
PID 3144 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\WgEXSdM.exe
PID 3144 wrote to memory of 2000	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\srpXkLR.exe
PID 3144 wrote to memory of 2000	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\srpXkLR.exe
PID 3144 wrote to memory of 1744	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\fCXeRwj.exe
PID 3144 wrote to memory of 1744	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\fCXeRwj.exe
PID 3144 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\wbvGfbB.exe
PID 3144 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe	C:\Windows\System\wbvGfbB.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe"

C:\Windows\System\VopbbYB.exe

C:\Windows\System\VopbbYB.exe

C:\Windows\System\jhVhfPg.exe

C:\Windows\System\jhVhfPg.exe

C:\Windows\System\BeAQUWD.exe

C:\Windows\System\BeAQUWD.exe

C:\Windows\System\curPUUc.exe

C:\Windows\System\curPUUc.exe

C:\Windows\System\LNOCmYA.exe

C:\Windows\System\LNOCmYA.exe

C:\Windows\System\zGVGrne.exe

C:\Windows\System\zGVGrne.exe

C:\Windows\System\aopkAGq.exe

C:\Windows\System\aopkAGq.exe

C:\Windows\System\sDZPfaI.exe

C:\Windows\System\sDZPfaI.exe

C:\Windows\System\ngqpKZK.exe

C:\Windows\System\ngqpKZK.exe

C:\Windows\System\TfIAACh.exe

C:\Windows\System\TfIAACh.exe

C:\Windows\System\uUiQaWn.exe

C:\Windows\System\uUiQaWn.exe

C:\Windows\System\caoahvS.exe

C:\Windows\System\caoahvS.exe

C:\Windows\System\vLTtWKq.exe

C:\Windows\System\vLTtWKq.exe

C:\Windows\System\DyaTanT.exe

C:\Windows\System\DyaTanT.exe

C:\Windows\System\rwjlnRp.exe

C:\Windows\System\rwjlnRp.exe

C:\Windows\System\SvAmQqS.exe

C:\Windows\System\SvAmQqS.exe

C:\Windows\System\oLfnlYc.exe

C:\Windows\System\oLfnlYc.exe

C:\Windows\System\WQKMtuR.exe

C:\Windows\System\WQKMtuR.exe

C:\Windows\System\Amuwder.exe

C:\Windows\System\Amuwder.exe

C:\Windows\System\YXMDwDX.exe

C:\Windows\System\YXMDwDX.exe

C:\Windows\System\HDbQwLK.exe

C:\Windows\System\HDbQwLK.exe

C:\Windows\System\NNEVSbr.exe

C:\Windows\System\NNEVSbr.exe

C:\Windows\System\eVIcaKu.exe

C:\Windows\System\eVIcaKu.exe

C:\Windows\System\yVngxbx.exe

C:\Windows\System\yVngxbx.exe

C:\Windows\System\fqWQSmo.exe

C:\Windows\System\fqWQSmo.exe

C:\Windows\System\ZGQDulq.exe

C:\Windows\System\ZGQDulq.exe

C:\Windows\System\xjaWnaV.exe

C:\Windows\System\xjaWnaV.exe

C:\Windows\System\qBgeVkH.exe

C:\Windows\System\qBgeVkH.exe

C:\Windows\System\WgEXSdM.exe

C:\Windows\System\WgEXSdM.exe

C:\Windows\System\srpXkLR.exe

C:\Windows\System\srpXkLR.exe

C:\Windows\System\fCXeRwj.exe

C:\Windows\System\fCXeRwj.exe

C:\Windows\system32\BackgroundTaskHost.exe

"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider

C:\Windows\System\wbvGfbB.exe

C:\Windows\System\wbvGfbB.exe

C:\Windows\System\XEhTWiA.exe

C:\Windows\System\XEhTWiA.exe

C:\Windows\System\FbpsUaR.exe

C:\Windows\System\FbpsUaR.exe

C:\Windows\System\RfXppvd.exe

C:\Windows\System\RfXppvd.exe

C:\Windows\System\weFnbpr.exe

C:\Windows\System\weFnbpr.exe

C:\Windows\System\QehVrqj.exe

C:\Windows\System\QehVrqj.exe

C:\Windows\System\qOPdrfj.exe

C:\Windows\System\qOPdrfj.exe

C:\Windows\System\QmmmrlC.exe

C:\Windows\System\QmmmrlC.exe

C:\Windows\System\OOpggoB.exe

C:\Windows\System\OOpggoB.exe

C:\Windows\System\vOerQVf.exe

C:\Windows\System\vOerQVf.exe

C:\Windows\System\FjFaYnb.exe

C:\Windows\System\FjFaYnb.exe

C:\Windows\System\HGjUTvj.exe

C:\Windows\System\HGjUTvj.exe

C:\Windows\System\TmVhZZD.exe

C:\Windows\System\TmVhZZD.exe

C:\Windows\System\hLkLMqe.exe

C:\Windows\System\hLkLMqe.exe

C:\Windows\System\XkZYfBr.exe

C:\Windows\System\XkZYfBr.exe

C:\Windows\System\ZGhzPTM.exe

C:\Windows\System\ZGhzPTM.exe

C:\Windows\System\LzqAPJh.exe

C:\Windows\System\LzqAPJh.exe

C:\Windows\System\hhbmJRs.exe

C:\Windows\System\hhbmJRs.exe

C:\Windows\System\iceCSRn.exe

C:\Windows\System\iceCSRn.exe

C:\Windows\System\uPzAnZT.exe

C:\Windows\System\uPzAnZT.exe

C:\Windows\System\gWYgSbN.exe

C:\Windows\System\gWYgSbN.exe

C:\Windows\System\TaceWUv.exe

C:\Windows\System\TaceWUv.exe

C:\Windows\System\UTysIlc.exe

C:\Windows\System\UTysIlc.exe

C:\Windows\System\eZnmdbB.exe

C:\Windows\System\eZnmdbB.exe

C:\Windows\System\GCzQOJq.exe

C:\Windows\System\GCzQOJq.exe

C:\Windows\System\TjiDaDq.exe

C:\Windows\System\TjiDaDq.exe

C:\Windows\System\FPufDAC.exe

C:\Windows\System\FPufDAC.exe

C:\Windows\System\MiDLZpS.exe

C:\Windows\System\MiDLZpS.exe

C:\Windows\System\NBmKgDV.exe

C:\Windows\System\NBmKgDV.exe

C:\Windows\System\GzxfYVJ.exe

C:\Windows\System\GzxfYVJ.exe

C:\Windows\System\pXHUlfU.exe

C:\Windows\System\pXHUlfU.exe

C:\Windows\System\cxkXHtn.exe

C:\Windows\System\cxkXHtn.exe

C:\Windows\System\odHGnhe.exe

C:\Windows\System\odHGnhe.exe

C:\Windows\System\xYnvhuO.exe

C:\Windows\System\xYnvhuO.exe

C:\Windows\System\fDGeKnV.exe

C:\Windows\System\fDGeKnV.exe

C:\Windows\System\xSRzPRi.exe

C:\Windows\System\xSRzPRi.exe

C:\Windows\System\PKVgPoF.exe

C:\Windows\System\PKVgPoF.exe

C:\Windows\System\AXlNdkL.exe

C:\Windows\System\AXlNdkL.exe

C:\Windows\System\OTqFkJO.exe

C:\Windows\System\OTqFkJO.exe

C:\Windows\System\lbaiWEy.exe

C:\Windows\System\lbaiWEy.exe

C:\Windows\System\foAJktZ.exe

C:\Windows\System\foAJktZ.exe

C:\Windows\System\MFAJggX.exe

C:\Windows\System\MFAJggX.exe

C:\Windows\System\oKpMOJe.exe

C:\Windows\System\oKpMOJe.exe

C:\Windows\System\zhJREsw.exe

C:\Windows\System\zhJREsw.exe

C:\Windows\System\dhHuIUo.exe

C:\Windows\System\dhHuIUo.exe

C:\Windows\System\wtiLTHx.exe

C:\Windows\System\wtiLTHx.exe

C:\Windows\System\zCShaxT.exe

C:\Windows\System\zCShaxT.exe

C:\Windows\System\ZFKWPuT.exe

C:\Windows\System\ZFKWPuT.exe

C:\Windows\System\tOyBbhH.exe

C:\Windows\System\tOyBbhH.exe

C:\Windows\System\xYDkcRk.exe

C:\Windows\System\xYDkcRk.exe

C:\Windows\System\wUGczzx.exe

C:\Windows\System\wUGczzx.exe

C:\Windows\System\XAngcZP.exe

C:\Windows\System\XAngcZP.exe

C:\Windows\System\eaLXCci.exe

C:\Windows\System\eaLXCci.exe

C:\Windows\System\MEwCoTL.exe

C:\Windows\System\MEwCoTL.exe

C:\Windows\System\ZzAZcwa.exe

C:\Windows\System\ZzAZcwa.exe

C:\Windows\System\MKsBeYu.exe

C:\Windows\System\MKsBeYu.exe

C:\Windows\System\vZVehkq.exe

C:\Windows\System\vZVehkq.exe

C:\Windows\System\jXWyGxs.exe

C:\Windows\System\jXWyGxs.exe

C:\Windows\System\IRBPrjs.exe

C:\Windows\System\IRBPrjs.exe

C:\Windows\System\xYAMMSq.exe

C:\Windows\System\xYAMMSq.exe

C:\Windows\System\VyzAkty.exe

C:\Windows\System\VyzAkty.exe

C:\Windows\System\gxbACLD.exe

C:\Windows\System\gxbACLD.exe

C:\Windows\System\RdhPqZU.exe

C:\Windows\System\RdhPqZU.exe

C:\Windows\System\usMvaUk.exe

C:\Windows\System\usMvaUk.exe

C:\Windows\System\IckfDzs.exe

C:\Windows\System\IckfDzs.exe

C:\Windows\System\TsaDNUF.exe

C:\Windows\System\TsaDNUF.exe

C:\Windows\System\mFmBugj.exe

C:\Windows\System\mFmBugj.exe

C:\Windows\System\WMsESsN.exe

C:\Windows\System\WMsESsN.exe

C:\Windows\System\WBWojes.exe

C:\Windows\System\WBWojes.exe

C:\Windows\System\kOlvXdI.exe

C:\Windows\System\kOlvXdI.exe

C:\Windows\System\qXjERJP.exe

C:\Windows\System\qXjERJP.exe

C:\Windows\System\hPPqpRL.exe

C:\Windows\System\hPPqpRL.exe

C:\Windows\System\DbALQgL.exe

C:\Windows\System\DbALQgL.exe

C:\Windows\System\KcgVRmd.exe

C:\Windows\System\KcgVRmd.exe

C:\Windows\System\EMsxedz.exe

C:\Windows\System\EMsxedz.exe

C:\Windows\System\LtXYCse.exe

C:\Windows\System\LtXYCse.exe

C:\Windows\System\SDWngYX.exe

C:\Windows\System\SDWngYX.exe

C:\Windows\System\nVztwEn.exe

C:\Windows\System\nVztwEn.exe

C:\Windows\System\txKMOZZ.exe

C:\Windows\System\txKMOZZ.exe

C:\Windows\System\weqUkVy.exe

C:\Windows\System\weqUkVy.exe

C:\Windows\System\phOiCPx.exe

C:\Windows\System\phOiCPx.exe

C:\Windows\System\vFGzSSH.exe

C:\Windows\System\vFGzSSH.exe

C:\Windows\System\pAKOfMM.exe

C:\Windows\System\pAKOfMM.exe

C:\Windows\System\XVIFYJs.exe

C:\Windows\System\XVIFYJs.exe

C:\Windows\System\GDJflFD.exe

C:\Windows\System\GDJflFD.exe

C:\Windows\System\rRiijIL.exe

C:\Windows\System\rRiijIL.exe

C:\Windows\System\xsBEzuX.exe

C:\Windows\System\xsBEzuX.exe

C:\Windows\System\qnrUlES.exe

C:\Windows\System\qnrUlES.exe

C:\Windows\System\wSciYLw.exe

C:\Windows\System\wSciYLw.exe

C:\Windows\System\xCzjaEM.exe

C:\Windows\System\xCzjaEM.exe

C:\Windows\System\bsRBQYz.exe

C:\Windows\System\bsRBQYz.exe

C:\Windows\System\LpDEOFy.exe

C:\Windows\System\LpDEOFy.exe

C:\Windows\System\zzuudGe.exe

C:\Windows\System\zzuudGe.exe

C:\Windows\System\FUgluYR.exe

C:\Windows\System\FUgluYR.exe

C:\Windows\System\ZWfJGbR.exe

C:\Windows\System\ZWfJGbR.exe

C:\Windows\System\cCcgets.exe

C:\Windows\System\cCcgets.exe

C:\Windows\System\PNFWzUM.exe

C:\Windows\System\PNFWzUM.exe

C:\Windows\System\uHCreQC.exe

C:\Windows\System\uHCreQC.exe

C:\Windows\System\mkHrvFz.exe

C:\Windows\System\mkHrvFz.exe

C:\Windows\System\ETpbfTq.exe

C:\Windows\System\ETpbfTq.exe

C:\Windows\System\ykRswdC.exe

C:\Windows\System\ykRswdC.exe

C:\Windows\System\DiHSBeb.exe

C:\Windows\System\DiHSBeb.exe

C:\Windows\System\uCxLzbq.exe

C:\Windows\System\uCxLzbq.exe

C:\Windows\System\BZAUDKq.exe

C:\Windows\System\BZAUDKq.exe

C:\Windows\System\Gxbpqhs.exe

C:\Windows\System\Gxbpqhs.exe

C:\Windows\System\KXrRgPv.exe

C:\Windows\System\KXrRgPv.exe

C:\Windows\System\vpGRUeZ.exe

C:\Windows\System\vpGRUeZ.exe

C:\Windows\System\LPDMroa.exe

C:\Windows\System\LPDMroa.exe

C:\Windows\System\frgOaxj.exe

C:\Windows\System\frgOaxj.exe

C:\Windows\System\bARFBuv.exe

C:\Windows\System\bARFBuv.exe

C:\Windows\System\nZoDDrG.exe

C:\Windows\System\nZoDDrG.exe

C:\Windows\System\cZmWdYB.exe

C:\Windows\System\cZmWdYB.exe

C:\Windows\System\iSpOzmC.exe

C:\Windows\System\iSpOzmC.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3608,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8

C:\Windows\System\rjYkTHf.exe

C:\Windows\System\rjYkTHf.exe

C:\Windows\System\xFmRRnn.exe

C:\Windows\System\xFmRRnn.exe

C:\Windows\System\pmUFwPR.exe

C:\Windows\System\pmUFwPR.exe

C:\Windows\System\oWbqztf.exe

C:\Windows\System\oWbqztf.exe

C:\Windows\System\AJEGway.exe

C:\Windows\System\AJEGway.exe

C:\Windows\System\fzNMpFp.exe

C:\Windows\System\fzNMpFp.exe

C:\Windows\System\tRhsGGx.exe

C:\Windows\System\tRhsGGx.exe

C:\Windows\System\jletZKc.exe

C:\Windows\System\jletZKc.exe

C:\Windows\System\PflLFIQ.exe

C:\Windows\System\PflLFIQ.exe

C:\Windows\System\SQKpkeP.exe

C:\Windows\System\SQKpkeP.exe

C:\Windows\System\TSermFx.exe

C:\Windows\System\TSermFx.exe

C:\Windows\System\hVLGxOV.exe

C:\Windows\System\hVLGxOV.exe

C:\Windows\System\djFaqUg.exe

C:\Windows\System\djFaqUg.exe

C:\Windows\System\UJGOurn.exe

C:\Windows\System\UJGOurn.exe

C:\Windows\System\ycGAKRB.exe

C:\Windows\System\ycGAKRB.exe

C:\Windows\System\WGYuQQJ.exe

C:\Windows\System\WGYuQQJ.exe

C:\Windows\System\Ihoqnuw.exe

C:\Windows\System\Ihoqnuw.exe

C:\Windows\System\TamcNHu.exe

C:\Windows\System\TamcNHu.exe

C:\Windows\System\WMUIczu.exe

C:\Windows\System\WMUIczu.exe

C:\Windows\System\qGVYJKF.exe

C:\Windows\System\qGVYJKF.exe

C:\Windows\System\mjOHniI.exe

C:\Windows\System\mjOHniI.exe

C:\Windows\System\GhlKqTv.exe

C:\Windows\System\GhlKqTv.exe

C:\Windows\System\HdqlNVN.exe

C:\Windows\System\HdqlNVN.exe

C:\Windows\System\fkmsAmS.exe

C:\Windows\System\fkmsAmS.exe

C:\Windows\System\vfUmZkr.exe

C:\Windows\System\vfUmZkr.exe

C:\Windows\System\HRfBAlF.exe

C:\Windows\System\HRfBAlF.exe

C:\Windows\System\CNHdZLT.exe

C:\Windows\System\CNHdZLT.exe

C:\Windows\System\zRIMFzY.exe

C:\Windows\System\zRIMFzY.exe

C:\Windows\System\QIKEcAd.exe

C:\Windows\System\QIKEcAd.exe

C:\Windows\System\HldGLFy.exe

C:\Windows\System\HldGLFy.exe

C:\Windows\System\LRFbEyE.exe

C:\Windows\System\LRFbEyE.exe

C:\Windows\System\taOFGTS.exe

C:\Windows\System\taOFGTS.exe

C:\Windows\System\lTOumba.exe

C:\Windows\System\lTOumba.exe

C:\Windows\System\XNpIrVG.exe

C:\Windows\System\XNpIrVG.exe

C:\Windows\System\XXxKmkn.exe

C:\Windows\System\XXxKmkn.exe

C:\Windows\System\VXQqYWw.exe

C:\Windows\System\VXQqYWw.exe

C:\Windows\System\uDhUMxF.exe

C:\Windows\System\uDhUMxF.exe

C:\Windows\System\WTdyyDe.exe

C:\Windows\System\WTdyyDe.exe

C:\Windows\System\KXmFQMj.exe

C:\Windows\System\KXmFQMj.exe

C:\Windows\System\ZaSmDmH.exe

C:\Windows\System\ZaSmDmH.exe

C:\Windows\System\wHDmcuK.exe

C:\Windows\System\wHDmcuK.exe

C:\Windows\System\YhEllXJ.exe

C:\Windows\System\YhEllXJ.exe

C:\Windows\System\FJTFsjv.exe

C:\Windows\System\FJTFsjv.exe

C:\Windows\System\JzTKhNu.exe

C:\Windows\System\JzTKhNu.exe

C:\Windows\System\oiGzMuv.exe

C:\Windows\System\oiGzMuv.exe

C:\Windows\System\GjimeMy.exe

C:\Windows\System\GjimeMy.exe

C:\Windows\System\ldesHuM.exe

C:\Windows\System\ldesHuM.exe

C:\Windows\System\QwTkkoc.exe

C:\Windows\System\QwTkkoc.exe

C:\Windows\System\HvnltKp.exe

C:\Windows\System\HvnltKp.exe

C:\Windows\System\QiLmsSz.exe

C:\Windows\System\QiLmsSz.exe

C:\Windows\System\BgpnroE.exe

C:\Windows\System\BgpnroE.exe

C:\Windows\System\OsaLTtK.exe

C:\Windows\System\OsaLTtK.exe

C:\Windows\System\ZVxJZqu.exe

C:\Windows\System\ZVxJZqu.exe

C:\Windows\System\TYCoRJC.exe

C:\Windows\System\TYCoRJC.exe

C:\Windows\System\FAMxWpV.exe

C:\Windows\System\FAMxWpV.exe

C:\Windows\System\GOZSFZl.exe

C:\Windows\System\GOZSFZl.exe

C:\Windows\System\tggPDnX.exe

C:\Windows\System\tggPDnX.exe

C:\Windows\System\UgHfrxp.exe

C:\Windows\System\UgHfrxp.exe

C:\Windows\System\BAIHXie.exe

C:\Windows\System\BAIHXie.exe

C:\Windows\System\aujFnCF.exe

C:\Windows\System\aujFnCF.exe

C:\Windows\System\pmoGYjm.exe

C:\Windows\System\pmoGYjm.exe

C:\Windows\System\shwfAdJ.exe

C:\Windows\System\shwfAdJ.exe

C:\Windows\System\kSUOChK.exe

C:\Windows\System\kSUOChK.exe

C:\Windows\System\yCTkPtq.exe

C:\Windows\System\yCTkPtq.exe

C:\Windows\System\BsDfEEd.exe

C:\Windows\System\BsDfEEd.exe

C:\Windows\System\NKxHpVu.exe

C:\Windows\System\NKxHpVu.exe

C:\Windows\System\uQxvczx.exe

C:\Windows\System\uQxvczx.exe

C:\Windows\System\bdRMPvh.exe

C:\Windows\System\bdRMPvh.exe

C:\Windows\System\LdkKmav.exe

C:\Windows\System\LdkKmav.exe

C:\Windows\System\sZwOluv.exe

C:\Windows\System\sZwOluv.exe

C:\Windows\System\sShXgVI.exe

C:\Windows\System\sShXgVI.exe

C:\Windows\System\ZRrpmXs.exe

C:\Windows\System\ZRrpmXs.exe

C:\Windows\System\gKdXHoE.exe

C:\Windows\System\gKdXHoE.exe

C:\Windows\System\OLyTGQI.exe

C:\Windows\System\OLyTGQI.exe

C:\Windows\System\IPTnhKN.exe

C:\Windows\System\IPTnhKN.exe

C:\Windows\System\eyGSsTL.exe

C:\Windows\System\eyGSsTL.exe

C:\Windows\System\NYmlCDn.exe

C:\Windows\System\NYmlCDn.exe

C:\Windows\System\rnBABZq.exe

C:\Windows\System\rnBABZq.exe

C:\Windows\System\PqikVOB.exe

C:\Windows\System\PqikVOB.exe

C:\Windows\System\SYQmVMQ.exe

C:\Windows\System\SYQmVMQ.exe

C:\Windows\System\KZLQIEY.exe

C:\Windows\System\KZLQIEY.exe

C:\Windows\System\GwSfIpG.exe

C:\Windows\System\GwSfIpG.exe

C:\Windows\System\sRUtDAl.exe

C:\Windows\System\sRUtDAl.exe

C:\Windows\System\uNZjiOl.exe

C:\Windows\System\uNZjiOl.exe

C:\Windows\System\HEekDxt.exe

C:\Windows\System\HEekDxt.exe

C:\Windows\System\ruMOxBr.exe

C:\Windows\System\ruMOxBr.exe

C:\Windows\System\GCDUHqW.exe

C:\Windows\System\GCDUHqW.exe

C:\Windows\System\dhoFJyr.exe

C:\Windows\System\dhoFJyr.exe

C:\Windows\System\INyeXZZ.exe

C:\Windows\System\INyeXZZ.exe

C:\Windows\System\ziVtPHo.exe

C:\Windows\System\ziVtPHo.exe

C:\Windows\System\ExGTZVW.exe

C:\Windows\System\ExGTZVW.exe

C:\Windows\System\gezFJms.exe

C:\Windows\System\gezFJms.exe

C:\Windows\System\PnBFlfB.exe

C:\Windows\System\PnBFlfB.exe

C:\Windows\System\zqeAOtm.exe

C:\Windows\System\zqeAOtm.exe

C:\Windows\System\nRGSSYd.exe

C:\Windows\System\nRGSSYd.exe

C:\Windows\System\MwqJmJa.exe

C:\Windows\System\MwqJmJa.exe

C:\Windows\System\ADUNIBA.exe

C:\Windows\System\ADUNIBA.exe

C:\Windows\System\oWwqxMG.exe

C:\Windows\System\oWwqxMG.exe

C:\Windows\System\hlGJFQn.exe

C:\Windows\System\hlGJFQn.exe

C:\Windows\System\McBLAjV.exe

C:\Windows\System\McBLAjV.exe

C:\Windows\System\AKCDBtA.exe

C:\Windows\System\AKCDBtA.exe

C:\Windows\System\FBvEGQR.exe

C:\Windows\System\FBvEGQR.exe

C:\Windows\System\LdaWFNs.exe

C:\Windows\System\LdaWFNs.exe

C:\Windows\System\FmbLion.exe

C:\Windows\System\FmbLion.exe

C:\Windows\System\jyoIFrz.exe

C:\Windows\System\jyoIFrz.exe

C:\Windows\System\XqaKkIN.exe

C:\Windows\System\XqaKkIN.exe

C:\Windows\System\ZhqUPSP.exe

C:\Windows\System\ZhqUPSP.exe

C:\Windows\System\INyUAgK.exe

C:\Windows\System\INyUAgK.exe

C:\Windows\System\lPrfXeG.exe

C:\Windows\System\lPrfXeG.exe

C:\Windows\System\rueycwv.exe

C:\Windows\System\rueycwv.exe

C:\Windows\System\WeFwHLw.exe

C:\Windows\System\WeFwHLw.exe

C:\Windows\System\sQxOKzy.exe

C:\Windows\System\sQxOKzy.exe

C:\Windows\System\dCJKzNc.exe

C:\Windows\System\dCJKzNc.exe

C:\Windows\System\xIjOJId.exe

C:\Windows\System\xIjOJId.exe

C:\Windows\System\VBwRciE.exe

C:\Windows\System\VBwRciE.exe

C:\Windows\System\aelKKpq.exe

C:\Windows\System\aelKKpq.exe

C:\Windows\System\aUjwBoh.exe

C:\Windows\System\aUjwBoh.exe

C:\Windows\System\gIAkuDh.exe

C:\Windows\System\gIAkuDh.exe

C:\Windows\System\GaWWcbk.exe

C:\Windows\System\GaWWcbk.exe

C:\Windows\System\avbsdaj.exe

C:\Windows\System\avbsdaj.exe

C:\Windows\System\gbSdhfi.exe

C:\Windows\System\gbSdhfi.exe

C:\Windows\System\IbfLKWv.exe

C:\Windows\System\IbfLKWv.exe

C:\Windows\System\OSVQvyA.exe

C:\Windows\System\OSVQvyA.exe

C:\Windows\System\BYYLXvb.exe

C:\Windows\System\BYYLXvb.exe

C:\Windows\System\iNrzHPj.exe

C:\Windows\System\iNrzHPj.exe

C:\Windows\System\WQZPrcv.exe

C:\Windows\System\WQZPrcv.exe

C:\Windows\System\AObMNXn.exe

C:\Windows\System\AObMNXn.exe

C:\Windows\System\EGoPICU.exe

C:\Windows\System\EGoPICU.exe

C:\Windows\System\EzopoRH.exe

C:\Windows\System\EzopoRH.exe

C:\Windows\System\fTomkif.exe

C:\Windows\System\fTomkif.exe

C:\Windows\System\yOaiVAe.exe

C:\Windows\System\yOaiVAe.exe

C:\Windows\System\vdQJhUu.exe

C:\Windows\System\vdQJhUu.exe

C:\Windows\System\IqYczpx.exe

C:\Windows\System\IqYczpx.exe

C:\Windows\System\TmNTbHO.exe

C:\Windows\System\TmNTbHO.exe

C:\Windows\System\DBRpccf.exe

C:\Windows\System\DBRpccf.exe

C:\Windows\System\OtgvUpV.exe

C:\Windows\System\OtgvUpV.exe

C:\Windows\System\VSbnzkQ.exe

C:\Windows\System\VSbnzkQ.exe

C:\Windows\System\RKWHtHa.exe

C:\Windows\System\RKWHtHa.exe

C:\Windows\System\gpggwcP.exe

C:\Windows\System\gpggwcP.exe

C:\Windows\System\wBRaesw.exe

C:\Windows\System\wBRaesw.exe

C:\Windows\System\LCsqcDD.exe

C:\Windows\System\LCsqcDD.exe

C:\Windows\System\HnSGvcw.exe

C:\Windows\System\HnSGvcw.exe

C:\Windows\System\hWoPayN.exe

C:\Windows\System\hWoPayN.exe

C:\Windows\System\ZSnAPlB.exe

C:\Windows\System\ZSnAPlB.exe

C:\Windows\System\QrAprjP.exe

C:\Windows\System\QrAprjP.exe

C:\Windows\System\cGCrwsx.exe

C:\Windows\System\cGCrwsx.exe

C:\Windows\System\GuPEywe.exe

C:\Windows\System\GuPEywe.exe

C:\Windows\System\PSrNmDt.exe

C:\Windows\System\PSrNmDt.exe

C:\Windows\System\vxVxgrr.exe

C:\Windows\System\vxVxgrr.exe

C:\Windows\System\VdmSfrW.exe

C:\Windows\System\VdmSfrW.exe

C:\Windows\System\tUxatuO.exe

C:\Windows\System\tUxatuO.exe

C:\Windows\System\eumULUi.exe

C:\Windows\System\eumULUi.exe

C:\Windows\System\lRplEry.exe

C:\Windows\System\lRplEry.exe

C:\Windows\System\fvfDHLd.exe

C:\Windows\System\fvfDHLd.exe

C:\Windows\System\AplypUD.exe

C:\Windows\System\AplypUD.exe

C:\Windows\System\xANQsaX.exe

C:\Windows\System\xANQsaX.exe

C:\Windows\System\FBXXejf.exe

C:\Windows\System\FBXXejf.exe

C:\Windows\System\LiwRlBz.exe

C:\Windows\System\LiwRlBz.exe

C:\Windows\System\zAAUTie.exe

C:\Windows\System\zAAUTie.exe

C:\Windows\System\mWZTblm.exe

C:\Windows\System\mWZTblm.exe

C:\Windows\System\PRgTVyG.exe

C:\Windows\System\PRgTVyG.exe

C:\Windows\System\QHfqPls.exe

C:\Windows\System\QHfqPls.exe

C:\Windows\System\KHSUkjl.exe

C:\Windows\System\KHSUkjl.exe

C:\Windows\System\kIbUYxy.exe

C:\Windows\System\kIbUYxy.exe

C:\Windows\System\RJsvkrR.exe

C:\Windows\System\RJsvkrR.exe

C:\Windows\System\jkDcahn.exe

C:\Windows\System\jkDcahn.exe

C:\Windows\System\MyjZFtt.exe

C:\Windows\System\MyjZFtt.exe

C:\Windows\System\IXTByDC.exe

C:\Windows\System\IXTByDC.exe

C:\Windows\System\vsWJhpp.exe

C:\Windows\System\vsWJhpp.exe

C:\Windows\System\dHwFnGe.exe

C:\Windows\System\dHwFnGe.exe

C:\Windows\System\AolDDAo.exe

C:\Windows\System\AolDDAo.exe

C:\Windows\System\kRPNGzK.exe

C:\Windows\System\kRPNGzK.exe

C:\Windows\System\MlYwrIT.exe

C:\Windows\System\MlYwrIT.exe

C:\Windows\System\NfrYFEP.exe

C:\Windows\System\NfrYFEP.exe

C:\Windows\System\YexjVMA.exe

C:\Windows\System\YexjVMA.exe

C:\Windows\System\GdmasUV.exe

C:\Windows\System\GdmasUV.exe

C:\Windows\System\IrRnMXL.exe

C:\Windows\System\IrRnMXL.exe

C:\Windows\System\UmOHYRY.exe

C:\Windows\System\UmOHYRY.exe

C:\Windows\System\bCQcpCJ.exe

C:\Windows\System\bCQcpCJ.exe

C:\Windows\System\YKSTjCu.exe

C:\Windows\System\YKSTjCu.exe

C:\Windows\System\xbQgjBb.exe

C:\Windows\System\xbQgjBb.exe

C:\Windows\System\aRwoxJY.exe

C:\Windows\System\aRwoxJY.exe

C:\Windows\System\YOJpRaW.exe

C:\Windows\System\YOJpRaW.exe

C:\Windows\System\oNcLdRq.exe

C:\Windows\System\oNcLdRq.exe

C:\Windows\System\Ynyuhul.exe

C:\Windows\System\Ynyuhul.exe

C:\Windows\System\jauvypz.exe

C:\Windows\System\jauvypz.exe

C:\Windows\System\NYiifFL.exe

C:\Windows\System\NYiifFL.exe

C:\Windows\System\pMKwldh.exe

C:\Windows\System\pMKwldh.exe

C:\Windows\System\pcZFnYV.exe

C:\Windows\System\pcZFnYV.exe

C:\Windows\System\ERYdlil.exe

C:\Windows\System\ERYdlil.exe

C:\Windows\System\BAMxUNs.exe

C:\Windows\System\BAMxUNs.exe

C:\Windows\System\eiBHFmY.exe

C:\Windows\System\eiBHFmY.exe

C:\Windows\System\MZviOjN.exe

C:\Windows\System\MZviOjN.exe

C:\Windows\System\EQSXRYu.exe

C:\Windows\System\EQSXRYu.exe

C:\Windows\System\coCTKIx.exe

C:\Windows\System\coCTKIx.exe

C:\Windows\System\zYtdBue.exe

C:\Windows\System\zYtdBue.exe

C:\Windows\System\MHTSiyh.exe

C:\Windows\System\MHTSiyh.exe

C:\Windows\System\yAAfkon.exe

C:\Windows\System\yAAfkon.exe

C:\Windows\System\TaICAyl.exe

C:\Windows\System\TaICAyl.exe

C:\Windows\System\iOcByiU.exe

C:\Windows\System\iOcByiU.exe

C:\Windows\System\fYaBWQb.exe

C:\Windows\System\fYaBWQb.exe

C:\Windows\System\WJycEtL.exe

C:\Windows\System\WJycEtL.exe

C:\Windows\System\SHReAdT.exe

C:\Windows\System\SHReAdT.exe

C:\Windows\System\amHtnti.exe

C:\Windows\System\amHtnti.exe

C:\Windows\System\UYFvNOI.exe

C:\Windows\System\UYFvNOI.exe

C:\Windows\System\bSkqzOS.exe

C:\Windows\System\bSkqzOS.exe

C:\Windows\System\rskmKvN.exe

C:\Windows\System\rskmKvN.exe

C:\Windows\System\vcSGFJL.exe

C:\Windows\System\vcSGFJL.exe

C:\Windows\System\bLbxReO.exe

C:\Windows\System\bLbxReO.exe

C:\Windows\System\hcBdFqR.exe

C:\Windows\System\hcBdFqR.exe

C:\Windows\System\VMybhJU.exe

C:\Windows\System\VMybhJU.exe

C:\Windows\System\oyqmwHR.exe

C:\Windows\System\oyqmwHR.exe

C:\Windows\System\SeIcaiE.exe

C:\Windows\System\SeIcaiE.exe

C:\Windows\System\nWllHVd.exe

C:\Windows\System\nWllHVd.exe

C:\Windows\System\ddNnBXr.exe

C:\Windows\System\ddNnBXr.exe

C:\Windows\System\pPzzCUH.exe

C:\Windows\System\pPzzCUH.exe

C:\Windows\System\jndfrZX.exe

C:\Windows\System\jndfrZX.exe

C:\Windows\System\FlFSvxU.exe

C:\Windows\System\FlFSvxU.exe

C:\Windows\System\zwQzChB.exe

C:\Windows\System\zwQzChB.exe

C:\Windows\System\kpMDxZz.exe

C:\Windows\System\kpMDxZz.exe

C:\Windows\System\SAxZUxK.exe

C:\Windows\System\SAxZUxK.exe

C:\Windows\System\LAouuCP.exe

C:\Windows\System\LAouuCP.exe

C:\Windows\System\lpgZfci.exe

C:\Windows\System\lpgZfci.exe

C:\Windows\System\nlEuZIp.exe

C:\Windows\System\nlEuZIp.exe

C:\Windows\System\HaxkxwU.exe

C:\Windows\System\HaxkxwU.exe

C:\Windows\System\ugtvytU.exe

C:\Windows\System\ugtvytU.exe

C:\Windows\System\dxihwkB.exe

C:\Windows\System\dxihwkB.exe

C:\Windows\System\AyvsuTf.exe

C:\Windows\System\AyvsuTf.exe

C:\Windows\System\oBNFmnY.exe

C:\Windows\System\oBNFmnY.exe

C:\Windows\System\PFsskvw.exe

C:\Windows\System\PFsskvw.exe

C:\Windows\System\mUbooON.exe

C:\Windows\System\mUbooON.exe

C:\Windows\System\lbrkTZB.exe

C:\Windows\System\lbrkTZB.exe

C:\Windows\System\DHelTrh.exe

C:\Windows\System\DHelTrh.exe

C:\Windows\System\mNlsWDh.exe

C:\Windows\System\mNlsWDh.exe

C:\Windows\System\xcgYnMW.exe

C:\Windows\System\xcgYnMW.exe

C:\Windows\System\kQRGWDZ.exe

C:\Windows\System\kQRGWDZ.exe

C:\Windows\System\uPliTcq.exe

C:\Windows\System\uPliTcq.exe

C:\Windows\System\UzeqNtX.exe

C:\Windows\System\UzeqNtX.exe

C:\Windows\System\CzXgGBz.exe

C:\Windows\System\CzXgGBz.exe

C:\Windows\System\EJbPPqG.exe

C:\Windows\System\EJbPPqG.exe

C:\Windows\System\DmPzrKe.exe

C:\Windows\System\DmPzrKe.exe

C:\Windows\System\ekdpbQx.exe

C:\Windows\System\ekdpbQx.exe

C:\Windows\System\cTKxrVk.exe

C:\Windows\System\cTKxrVk.exe

C:\Windows\System\BZokGTd.exe

C:\Windows\System\BZokGTd.exe

C:\Windows\System\qSRCFvi.exe

C:\Windows\System\qSRCFvi.exe

C:\Windows\System\JBmqCvD.exe

C:\Windows\System\JBmqCvD.exe

C:\Windows\System\GsxvgJU.exe

C:\Windows\System\GsxvgJU.exe

C:\Windows\System\tqxIeGU.exe

C:\Windows\System\tqxIeGU.exe

C:\Windows\System\kWDekyY.exe

C:\Windows\System\kWDekyY.exe

C:\Windows\System\kSqZfHE.exe

C:\Windows\System\kSqZfHE.exe

C:\Windows\System\UqLZFNo.exe

C:\Windows\System\UqLZFNo.exe

C:\Windows\System\BRaxlua.exe

C:\Windows\System\BRaxlua.exe

C:\Windows\System\vPjgTzx.exe

C:\Windows\System\vPjgTzx.exe

C:\Windows\System\DMdjJVj.exe

C:\Windows\System\DMdjJVj.exe

C:\Windows\System\SIfaQjs.exe

C:\Windows\System\SIfaQjs.exe

C:\Windows\System\pGyoXft.exe

C:\Windows\System\pGyoXft.exe

C:\Windows\System\ogjnfFi.exe

C:\Windows\System\ogjnfFi.exe

C:\Windows\System\zJUoCQK.exe

C:\Windows\System\zJUoCQK.exe

C:\Windows\System\dyRcgip.exe

C:\Windows\System\dyRcgip.exe

C:\Windows\System\QZYtUjL.exe

C:\Windows\System\QZYtUjL.exe

C:\Windows\System\axCOJxS.exe

C:\Windows\System\axCOJxS.exe

C:\Windows\System\WAwjfFp.exe

C:\Windows\System\WAwjfFp.exe

C:\Windows\System\jiAyxVX.exe

C:\Windows\System\jiAyxVX.exe

C:\Windows\System\AecddxN.exe

C:\Windows\System\AecddxN.exe

C:\Windows\System\exrTcnx.exe

C:\Windows\System\exrTcnx.exe

C:\Windows\System\iFhdMVI.exe

C:\Windows\System\iFhdMVI.exe

C:\Windows\System\rlOJcYl.exe

C:\Windows\System\rlOJcYl.exe

C:\Windows\System\gayDObj.exe

C:\Windows\System\gayDObj.exe

C:\Windows\System\DOpCoLI.exe

C:\Windows\System\DOpCoLI.exe

C:\Windows\System\QeMaiFQ.exe

C:\Windows\System\QeMaiFQ.exe

C:\Windows\System\xhZnURM.exe

C:\Windows\System\xhZnURM.exe

C:\Windows\System\MiVpFXe.exe

C:\Windows\System\MiVpFXe.exe

C:\Windows\System\fFrsyQg.exe

C:\Windows\System\fFrsyQg.exe

C:\Windows\System\ouoISCb.exe

C:\Windows\System\ouoISCb.exe

C:\Windows\System\AhtUCVk.exe

C:\Windows\System\AhtUCVk.exe

C:\Windows\System\WLbahYs.exe

C:\Windows\System\WLbahYs.exe

C:\Windows\System\bzTUscd.exe

C:\Windows\System\bzTUscd.exe

C:\Windows\System\uRBHOvf.exe

C:\Windows\System\uRBHOvf.exe

C:\Windows\System\KQeXboW.exe

C:\Windows\System\KQeXboW.exe

C:\Windows\System\fNwQpDl.exe

C:\Windows\System\fNwQpDl.exe

C:\Windows\System\WvkdirA.exe

C:\Windows\System\WvkdirA.exe

C:\Windows\System\VauvkKY.exe

C:\Windows\System\VauvkKY.exe

C:\Windows\System\cReEchh.exe

C:\Windows\System\cReEchh.exe

C:\Windows\System\eUQJVYC.exe

C:\Windows\System\eUQJVYC.exe

C:\Windows\System\JLGhLGD.exe

C:\Windows\System\JLGhLGD.exe

C:\Windows\System\ksRdlDS.exe

C:\Windows\System\ksRdlDS.exe

C:\Windows\System\KsNZday.exe

C:\Windows\System\KsNZday.exe

C:\Windows\System\SfrBjQp.exe

C:\Windows\System\SfrBjQp.exe

C:\Windows\System\AcocPRt.exe

C:\Windows\System\AcocPRt.exe

C:\Windows\System\DxfdBOR.exe

C:\Windows\System\DxfdBOR.exe

C:\Windows\System\njlLYnS.exe

C:\Windows\System\njlLYnS.exe

C:\Windows\System\KeIHOkb.exe

C:\Windows\System\KeIHOkb.exe

C:\Windows\System\GAyTOFU.exe

C:\Windows\System\GAyTOFU.exe

C:\Windows\System\DFzfdsx.exe

C:\Windows\System\DFzfdsx.exe

C:\Windows\System\xIwKhrd.exe

C:\Windows\System\xIwKhrd.exe

C:\Windows\System\MEzcYRf.exe

C:\Windows\System\MEzcYRf.exe

C:\Windows\System\gRYscZK.exe

C:\Windows\System\gRYscZK.exe

C:\Windows\System\BiusyWh.exe

C:\Windows\System\BiusyWh.exe

C:\Windows\System\aAiSsiq.exe

C:\Windows\System\aAiSsiq.exe

C:\Windows\System\lUJVIeE.exe

C:\Windows\System\lUJVIeE.exe

C:\Windows\System\fVSKIKm.exe

C:\Windows\System\fVSKIKm.exe

C:\Windows\System\zQzjvRS.exe

C:\Windows\System\zQzjvRS.exe

C:\Windows\System\RfXVSmy.exe

C:\Windows\System\RfXVSmy.exe

C:\Windows\System\rdjhzTo.exe

C:\Windows\System\rdjhzTo.exe

C:\Windows\System\LvqmtRQ.exe

C:\Windows\System\LvqmtRQ.exe

C:\Windows\System\qaYdKhn.exe

C:\Windows\System\qaYdKhn.exe

C:\Windows\System\odVemxt.exe

C:\Windows\System\odVemxt.exe

C:\Windows\System\gVYIZYE.exe

C:\Windows\System\gVYIZYE.exe

C:\Windows\System\vpasDci.exe

C:\Windows\System\vpasDci.exe

C:\Windows\System\QTtcjSh.exe

C:\Windows\System\QTtcjSh.exe

C:\Windows\System\BocFKMC.exe

C:\Windows\System\BocFKMC.exe

C:\Windows\System\wIedXmT.exe

C:\Windows\System\wIedXmT.exe

C:\Windows\System\pcaFleq.exe

C:\Windows\System\pcaFleq.exe

C:\Windows\System\UpdwMaD.exe

C:\Windows\System\UpdwMaD.exe

C:\Windows\System\oInBngH.exe

C:\Windows\System\oInBngH.exe

C:\Windows\System\PRjEVwe.exe

C:\Windows\System\PRjEVwe.exe

C:\Windows\System\fKAxYRn.exe

C:\Windows\System\fKAxYRn.exe

C:\Windows\System\HpPkMIk.exe

C:\Windows\System\HpPkMIk.exe

C:\Windows\System\VGbGMBo.exe

C:\Windows\System\VGbGMBo.exe

C:\Windows\System\EzKyizg.exe

C:\Windows\System\EzKyizg.exe

C:\Windows\System\lSQHKan.exe

C:\Windows\System\lSQHKan.exe

C:\Windows\System\peSrnrk.exe

C:\Windows\System\peSrnrk.exe

C:\Windows\System\MwVHDvD.exe

C:\Windows\System\MwVHDvD.exe

C:\Windows\System\BogLKRv.exe

C:\Windows\System\BogLKRv.exe

C:\Windows\System\PqErNKd.exe

C:\Windows\System\PqErNKd.exe

C:\Windows\System\OjplNrq.exe

C:\Windows\System\OjplNrq.exe

C:\Windows\System\cMqSaEN.exe

C:\Windows\System\cMqSaEN.exe

C:\Windows\System\VfABQCv.exe

C:\Windows\System\VfABQCv.exe

C:\Windows\System\BrakAgf.exe

C:\Windows\System\BrakAgf.exe

C:\Windows\System\xgAgZXw.exe

C:\Windows\System\xgAgZXw.exe

C:\Windows\System\uvySqWY.exe

C:\Windows\System\uvySqWY.exe

C:\Windows\System\wzrEUxH.exe

C:\Windows\System\wzrEUxH.exe

C:\Windows\System\ikWCjPl.exe

C:\Windows\System\ikWCjPl.exe

C:\Windows\System\mFqIcDl.exe

C:\Windows\System\mFqIcDl.exe

C:\Windows\System\VkvDhWP.exe

C:\Windows\System\VkvDhWP.exe

C:\Windows\System\HBTKYnk.exe

C:\Windows\System\HBTKYnk.exe

C:\Windows\System\PdNnJTy.exe

C:\Windows\System\PdNnJTy.exe

C:\Windows\System\RduMMYC.exe

C:\Windows\System\RduMMYC.exe

C:\Windows\System\xCjiLqN.exe

C:\Windows\System\xCjiLqN.exe

C:\Windows\System\FjyFBBH.exe

C:\Windows\System\FjyFBBH.exe

C:\Windows\System\LYCyTrV.exe

C:\Windows\System\LYCyTrV.exe

C:\Windows\System\tGTdwux.exe

C:\Windows\System\tGTdwux.exe

C:\Windows\System\XJNKsFy.exe

C:\Windows\System\XJNKsFy.exe

C:\Windows\System\vHcSYPR.exe

C:\Windows\System\vHcSYPR.exe

C:\Windows\System\yVgBeZU.exe

C:\Windows\System\yVgBeZU.exe

C:\Windows\System\VcmcusW.exe

C:\Windows\System\VcmcusW.exe

C:\Windows\System\klobefa.exe

C:\Windows\System\klobefa.exe

C:\Windows\System\yxGCsco.exe

C:\Windows\System\yxGCsco.exe

C:\Windows\System\ySLiCdt.exe

C:\Windows\System\ySLiCdt.exe

C:\Windows\System\muIDwHZ.exe

C:\Windows\System\muIDwHZ.exe

C:\Windows\System\NVYQuRm.exe

C:\Windows\System\NVYQuRm.exe

C:\Windows\System\bRVuKTv.exe

C:\Windows\System\bRVuKTv.exe

C:\Windows\System\BhcvAHK.exe

C:\Windows\System\BhcvAHK.exe

C:\Windows\System\CrkQtCg.exe

C:\Windows\System\CrkQtCg.exe

C:\Windows\System\wKUjlkZ.exe

C:\Windows\System\wKUjlkZ.exe

C:\Windows\System\LcAZhqi.exe

C:\Windows\System\LcAZhqi.exe

C:\Windows\System\aHGuuhG.exe

C:\Windows\System\aHGuuhG.exe

C:\Windows\System\LHzBcGm.exe

C:\Windows\System\LHzBcGm.exe

C:\Windows\System\AzqrBQY.exe

C:\Windows\System\AzqrBQY.exe

C:\Windows\System\XkTFOfu.exe

C:\Windows\System\XkTFOfu.exe

C:\Windows\System\RhTKHje.exe

C:\Windows\System\RhTKHje.exe

C:\Windows\System\DwjKPrf.exe

C:\Windows\System\DwjKPrf.exe

C:\Windows\System\wBEZRbU.exe

C:\Windows\System\wBEZRbU.exe

C:\Windows\System\nTXAByq.exe

C:\Windows\System\nTXAByq.exe

C:\Windows\System\jziCpWg.exe

C:\Windows\System\jziCpWg.exe

C:\Windows\System\PsBEwGt.exe

C:\Windows\System\PsBEwGt.exe

C:\Windows\System\VgpRdvB.exe

C:\Windows\System\VgpRdvB.exe

C:\Windows\System\yOwQPnM.exe

C:\Windows\System\yOwQPnM.exe

C:\Windows\System\bynYKoy.exe

C:\Windows\System\bynYKoy.exe

C:\Windows\System\dxSxecH.exe

C:\Windows\System\dxSxecH.exe

C:\Windows\System\CWvwNwb.exe

C:\Windows\System\CWvwNwb.exe

C:\Windows\System\ugWKhhn.exe

C:\Windows\System\ugWKhhn.exe

C:\Windows\System\apucDqJ.exe

C:\Windows\System\apucDqJ.exe

C:\Windows\System\DQyNCYn.exe

C:\Windows\System\DQyNCYn.exe

C:\Windows\System\ASMWmvr.exe

C:\Windows\System\ASMWmvr.exe

C:\Windows\System\aZmrlQv.exe

C:\Windows\System\aZmrlQv.exe

C:\Windows\System\zzbfNnE.exe

C:\Windows\System\zzbfNnE.exe

C:\Windows\System\LxPPCoA.exe

C:\Windows\System\LxPPCoA.exe

C:\Windows\System\kmfTxJj.exe

C:\Windows\System\kmfTxJj.exe

C:\Windows\System\cMyCjOn.exe

C:\Windows\System\cMyCjOn.exe

C:\Windows\System\CpBuBxe.exe

C:\Windows\System\CpBuBxe.exe

C:\Windows\System\TQDQhGB.exe

C:\Windows\System\TQDQhGB.exe

C:\Windows\System\fOhYusI.exe

C:\Windows\System\fOhYusI.exe

C:\Windows\System\NjaFhUg.exe

C:\Windows\System\NjaFhUg.exe

C:\Windows\System\zZztlIw.exe

C:\Windows\System\zZztlIw.exe

C:\Windows\System\GXHuWTc.exe

C:\Windows\System\GXHuWTc.exe

C:\Windows\System\aXUPnBT.exe

C:\Windows\System\aXUPnBT.exe

C:\Windows\System\YNCFrrK.exe

C:\Windows\System\YNCFrrK.exe

C:\Windows\System\HHLJxSe.exe

C:\Windows\System\HHLJxSe.exe

C:\Windows\System\zwNnesD.exe

C:\Windows\System\zwNnesD.exe

C:\Windows\System\ejpsRPO.exe

C:\Windows\System\ejpsRPO.exe

C:\Windows\System\RUnTEdn.exe

C:\Windows\System\RUnTEdn.exe

C:\Windows\System\NsWYrsJ.exe

C:\Windows\System\NsWYrsJ.exe

C:\Windows\System\mYSByjF.exe

C:\Windows\System\mYSByjF.exe

C:\Windows\System\kVRLHlc.exe

C:\Windows\System\kVRLHlc.exe

C:\Windows\System\QPpFFCA.exe

C:\Windows\System\QPpFFCA.exe

C:\Windows\System\SSBfXIc.exe

C:\Windows\System\SSBfXIc.exe

C:\Windows\System\gBdGcii.exe

C:\Windows\System\gBdGcii.exe

C:\Windows\System\pooLlTR.exe

C:\Windows\System\pooLlTR.exe

C:\Windows\System\ALJsNJy.exe

C:\Windows\System\ALJsNJy.exe

C:\Windows\System\znRsnyP.exe

C:\Windows\System\znRsnyP.exe

C:\Windows\System\CrlFOEz.exe

C:\Windows\System\CrlFOEz.exe

C:\Windows\System\IsVNEqY.exe

C:\Windows\System\IsVNEqY.exe

C:\Windows\System\gIrYLCV.exe

C:\Windows\System\gIrYLCV.exe

C:\Windows\System\VeQszRS.exe

C:\Windows\System\VeQszRS.exe

C:\Windows\System\GFPRoVq.exe

C:\Windows\System\GFPRoVq.exe

C:\Windows\System\hdmEwaZ.exe

C:\Windows\System\hdmEwaZ.exe

C:\Windows\System\LAQJsSi.exe

C:\Windows\System\LAQJsSi.exe

C:\Windows\System\WhJtSjn.exe

C:\Windows\System\WhJtSjn.exe

C:\Windows\System\bJTKUdZ.exe

C:\Windows\System\bJTKUdZ.exe

C:\Windows\System\jhWDZmR.exe

C:\Windows\System\jhWDZmR.exe

C:\Windows\System\SxyaZsu.exe

C:\Windows\System\SxyaZsu.exe

C:\Windows\System\jGgFWhR.exe

C:\Windows\System\jGgFWhR.exe

C:\Windows\System\svxFhMM.exe

C:\Windows\System\svxFhMM.exe

C:\Windows\System\cUxfhPZ.exe

C:\Windows\System\cUxfhPZ.exe

C:\Windows\System\AQrYurK.exe

C:\Windows\System\AQrYurK.exe

C:\Windows\System\XQWxEhC.exe

C:\Windows\System\XQWxEhC.exe

C:\Windows\System\UkdVyUM.exe

C:\Windows\System\UkdVyUM.exe

C:\Windows\System\vwDfDUV.exe

C:\Windows\System\vwDfDUV.exe

C:\Windows\System\uIQGXQC.exe

C:\Windows\System\uIQGXQC.exe

C:\Windows\System\BzKHPrl.exe

C:\Windows\System\BzKHPrl.exe

C:\Windows\System\oadiubn.exe

C:\Windows\System\oadiubn.exe

C:\Windows\System\kwGTPJL.exe

C:\Windows\System\kwGTPJL.exe

C:\Windows\System\TJGbAAT.exe

C:\Windows\System\TJGbAAT.exe

C:\Windows\System\oCIUBxJ.exe

C:\Windows\System\oCIUBxJ.exe

C:\Windows\System\YBnJZLf.exe

C:\Windows\System\YBnJZLf.exe

C:\Windows\System\GVltjJs.exe

C:\Windows\System\GVltjJs.exe

C:\Windows\System\pQOKdaQ.exe

C:\Windows\System\pQOKdaQ.exe

C:\Windows\System\pxtHzsj.exe

C:\Windows\System\pxtHzsj.exe

C:\Windows\System\ESePojA.exe

C:\Windows\System\ESePojA.exe

C:\Windows\System\NwAhipD.exe

C:\Windows\System\NwAhipD.exe

C:\Windows\System\TibAHAG.exe

C:\Windows\System\TibAHAG.exe

C:\Windows\System\kQRtpTH.exe

C:\Windows\System\kQRtpTH.exe

C:\Windows\System\zLcfTBV.exe

C:\Windows\System\zLcfTBV.exe

C:\Windows\System\LgYcJtf.exe

C:\Windows\System\LgYcJtf.exe

C:\Windows\System\ShlARWl.exe

C:\Windows\System\ShlARWl.exe

C:\Windows\System\QUKZnzd.exe

C:\Windows\System\QUKZnzd.exe

C:\Windows\System\kWpdPzY.exe

C:\Windows\System\kWpdPzY.exe

C:\Windows\System\sWRxeqE.exe

C:\Windows\System\sWRxeqE.exe

C:\Windows\System\avePHbh.exe

C:\Windows\System\avePHbh.exe

C:\Windows\System\hguMATG.exe

C:\Windows\System\hguMATG.exe

C:\Windows\System\ApFUtwW.exe

C:\Windows\System\ApFUtwW.exe

C:\Windows\System\qFGhpkV.exe

C:\Windows\System\qFGhpkV.exe

C:\Windows\System\HUXEDXT.exe

C:\Windows\System\HUXEDXT.exe

C:\Windows\System\ogNVQHj.exe

C:\Windows\System\ogNVQHj.exe

C:\Windows\System\nJNjlhG.exe

C:\Windows\System\nJNjlhG.exe

C:\Windows\System\vwsuzmD.exe

C:\Windows\System\vwsuzmD.exe

C:\Windows\System\kUyyhcj.exe

C:\Windows\System\kUyyhcj.exe

C:\Windows\System\Zrcvhyg.exe

C:\Windows\System\Zrcvhyg.exe

C:\Windows\System\FBMjxKN.exe

C:\Windows\System\FBMjxKN.exe

C:\Windows\System\PSGbLJo.exe

C:\Windows\System\PSGbLJo.exe

C:\Windows\System\KhCSGVt.exe

C:\Windows\System\KhCSGVt.exe

C:\Windows\System\VdYcCzA.exe

C:\Windows\System\VdYcCzA.exe

C:\Windows\System\EHdkVyr.exe

C:\Windows\System\EHdkVyr.exe

C:\Windows\System\QtOKTSH.exe

C:\Windows\System\QtOKTSH.exe

C:\Windows\System\fFqOxfJ.exe

C:\Windows\System\fFqOxfJ.exe

C:\Windows\System\dHEPQUD.exe

C:\Windows\System\dHEPQUD.exe

C:\Windows\System\qoNKTND.exe

C:\Windows\System\qoNKTND.exe

C:\Windows\System\VUZaSGy.exe

C:\Windows\System\VUZaSGy.exe

C:\Windows\System\YNxMEkr.exe

C:\Windows\System\YNxMEkr.exe

C:\Windows\System\ShllfnE.exe

C:\Windows\System\ShllfnE.exe

C:\Windows\System\noCrrdf.exe

C:\Windows\System\noCrrdf.exe

C:\Windows\System\hXairBX.exe

C:\Windows\System\hXairBX.exe

C:\Windows\System\JWLeGOv.exe

C:\Windows\System\JWLeGOv.exe

C:\Windows\System\VgGpLNJ.exe

C:\Windows\System\VgGpLNJ.exe

C:\Windows\System\hmyXlvB.exe

C:\Windows\System\hmyXlvB.exe

C:\Windows\System\XWWZGch.exe

C:\Windows\System\XWWZGch.exe

C:\Windows\System\IwJxIvX.exe

C:\Windows\System\IwJxIvX.exe

C:\Windows\System\aQFTHpx.exe

C:\Windows\System\aQFTHpx.exe

C:\Windows\System\SCIZXXQ.exe

C:\Windows\System\SCIZXXQ.exe

C:\Windows\System\jCQRfHM.exe

C:\Windows\System\jCQRfHM.exe

C:\Windows\System\tysZVbN.exe

C:\Windows\System\tysZVbN.exe

C:\Windows\System\WgEUomT.exe

C:\Windows\System\WgEUomT.exe

C:\Windows\System\vPTCPki.exe

C:\Windows\System\vPTCPki.exe

C:\Windows\System\AqXUEEm.exe

C:\Windows\System\AqXUEEm.exe

C:\Windows\System\zmMxRQQ.exe

C:\Windows\System\zmMxRQQ.exe

C:\Windows\System\WlZEOYv.exe

C:\Windows\System\WlZEOYv.exe

C:\Windows\System\rJfyMRf.exe

C:\Windows\System\rJfyMRf.exe

C:\Windows\System\kyTkzyo.exe

C:\Windows\System\kyTkzyo.exe

C:\Windows\System\bncbOWf.exe

C:\Windows\System\bncbOWf.exe

C:\Windows\System\Sdabqgq.exe

C:\Windows\System\Sdabqgq.exe

C:\Windows\System\JmGyTzy.exe

C:\Windows\System\JmGyTzy.exe

C:\Windows\System\VjNgdVX.exe

C:\Windows\System\VjNgdVX.exe

C:\Windows\System\xjPzQmJ.exe

C:\Windows\System\xjPzQmJ.exe

C:\Windows\System\niixsAr.exe

C:\Windows\System\niixsAr.exe

C:\Windows\System\SoxTKtf.exe

C:\Windows\System\SoxTKtf.exe

C:\Windows\System\JXQigrC.exe

C:\Windows\System\JXQigrC.exe

C:\Windows\System\bGUnnKp.exe

C:\Windows\System\bGUnnKp.exe

C:\Windows\System\WavkyYh.exe

C:\Windows\System\WavkyYh.exe

C:\Windows\System\zfDQfoZ.exe

C:\Windows\System\zfDQfoZ.exe

C:\Windows\System\uareupJ.exe

C:\Windows\System\uareupJ.exe

C:\Windows\System\YjvrUmu.exe

C:\Windows\System\YjvrUmu.exe

C:\Windows\System\tMduyRZ.exe

C:\Windows\System\tMduyRZ.exe

C:\Windows\System\dqPdGEO.exe

C:\Windows\System\dqPdGEO.exe

C:\Windows\System\iChbRiJ.exe

C:\Windows\System\iChbRiJ.exe

C:\Windows\System\KrjaBLB.exe

C:\Windows\System\KrjaBLB.exe

C:\Windows\System\ebhpHeA.exe

C:\Windows\System\ebhpHeA.exe

C:\Windows\System\TmWxgdY.exe

C:\Windows\System\TmWxgdY.exe

C:\Windows\System\ztqgNEF.exe

C:\Windows\System\ztqgNEF.exe

C:\Windows\System\GoOebzD.exe

C:\Windows\System\GoOebzD.exe

C:\Windows\System\cwyPDaa.exe

C:\Windows\System\cwyPDaa.exe

C:\Windows\System\ReRUcyt.exe

C:\Windows\System\ReRUcyt.exe

C:\Windows\System\xdAEDqx.exe

C:\Windows\System\xdAEDqx.exe

C:\Windows\System\OZSYnFR.exe

C:\Windows\System\OZSYnFR.exe

C:\Windows\System\YEWsxrr.exe

C:\Windows\System\YEWsxrr.exe

C:\Windows\System\wtPScmy.exe

C:\Windows\System\wtPScmy.exe

C:\Windows\System\bTJtIFM.exe

C:\Windows\System\bTJtIFM.exe

C:\Windows\System\aSxtWFm.exe

C:\Windows\System\aSxtWFm.exe

C:\Windows\System\kEuRmvV.exe

C:\Windows\System\kEuRmvV.exe

C:\Windows\System\lZExoUm.exe

C:\Windows\System\lZExoUm.exe

C:\Windows\System\XxRbGBJ.exe

C:\Windows\System\XxRbGBJ.exe

C:\Windows\System\DcNYZGG.exe

C:\Windows\System\DcNYZGG.exe

C:\Windows\System\oDnAFtk.exe

C:\Windows\System\oDnAFtk.exe

C:\Windows\System\fHMNEXP.exe

C:\Windows\System\fHMNEXP.exe

C:\Windows\System\CQopTIH.exe

C:\Windows\System\CQopTIH.exe

C:\Windows\System\aanNowo.exe

C:\Windows\System\aanNowo.exe

C:\Windows\System\ObSxUyU.exe

C:\Windows\System\ObSxUyU.exe

C:\Windows\System\msEfjkn.exe

C:\Windows\System\msEfjkn.exe

C:\Windows\System\vBJSzKr.exe

C:\Windows\System\vBJSzKr.exe

C:\Windows\System\IihCTWY.exe

C:\Windows\System\IihCTWY.exe

C:\Windows\System\nUPhMxc.exe

C:\Windows\System\nUPhMxc.exe

C:\Windows\System\gQaEuiP.exe

C:\Windows\System\gQaEuiP.exe

C:\Windows\System\cezOZmS.exe

C:\Windows\System\cezOZmS.exe

C:\Windows\System\xZzDyar.exe

C:\Windows\System\xZzDyar.exe

C:\Windows\System\gzIYEZq.exe

C:\Windows\System\gzIYEZq.exe

C:\Windows\System\GFFTYsX.exe

C:\Windows\System\GFFTYsX.exe

C:\Windows\System\yElsYON.exe

C:\Windows\System\yElsYON.exe

C:\Windows\System\wQNkgvH.exe

C:\Windows\System\wQNkgvH.exe

C:\Windows\System\GOPtsfA.exe

C:\Windows\System\GOPtsfA.exe

C:\Windows\System\kmKEolC.exe

C:\Windows\System\kmKEolC.exe

C:\Windows\System\JRZzgEF.exe

C:\Windows\System\JRZzgEF.exe

C:\Windows\System\vPhlQMI.exe

C:\Windows\System\vPhlQMI.exe

C:\Windows\System\xpbEFvk.exe

C:\Windows\System\xpbEFvk.exe

C:\Windows\System\qkUJXxl.exe

C:\Windows\System\qkUJXxl.exe

C:\Windows\System\dtgEZlW.exe

C:\Windows\System\dtgEZlW.exe

C:\Windows\System\HMFcVjL.exe

C:\Windows\System\HMFcVjL.exe

C:\Windows\System\wkajCLi.exe

C:\Windows\System\wkajCLi.exe

C:\Windows\System\rKfZNes.exe

C:\Windows\System\rKfZNes.exe

C:\Windows\System\sPoulfU.exe

C:\Windows\System\sPoulfU.exe

C:\Windows\System\PunsxTT.exe

C:\Windows\System\PunsxTT.exe

C:\Windows\System\iRvkUvM.exe

C:\Windows\System\iRvkUvM.exe

C:\Windows\System\WTXcClS.exe

C:\Windows\System\WTXcClS.exe

C:\Windows\System\LKOCwTu.exe

C:\Windows\System\LKOCwTu.exe

C:\Windows\System\BHIKFuP.exe

C:\Windows\System\BHIKFuP.exe

C:\Windows\System\gEBBHGx.exe

C:\Windows\System\gEBBHGx.exe

C:\Windows\System\ilJgNYk.exe

C:\Windows\System\ilJgNYk.exe

C:\Windows\System\vnOBNzx.exe

C:\Windows\System\vnOBNzx.exe

C:\Windows\System\XElXcNs.exe

C:\Windows\System\XElXcNs.exe

C:\Windows\System\WPJhrbB.exe

C:\Windows\System\WPJhrbB.exe

C:\Windows\System\nmPibTj.exe

C:\Windows\System\nmPibTj.exe

C:\Windows\System\IqodpMJ.exe

C:\Windows\System\IqodpMJ.exe

C:\Windows\System\InSyBQt.exe

C:\Windows\System\InSyBQt.exe

C:\Windows\System\dOjICCt.exe

C:\Windows\System\dOjICCt.exe

C:\Windows\System\ReOjtvW.exe

C:\Windows\System\ReOjtvW.exe

C:\Windows\System\uwEFcde.exe

C:\Windows\System\uwEFcde.exe

C:\Windows\System\SXXScQv.exe

C:\Windows\System\SXXScQv.exe

C:\Windows\System\IPgYjXW.exe

C:\Windows\System\IPgYjXW.exe

C:\Windows\System\NmFtrDY.exe

C:\Windows\System\NmFtrDY.exe

C:\Windows\System\HwBdJUF.exe

C:\Windows\System\HwBdJUF.exe

C:\Windows\System\FCGxwvx.exe

C:\Windows\System\FCGxwvx.exe

C:\Windows\System\ZraRQvS.exe

C:\Windows\System\ZraRQvS.exe

C:\Windows\System\mAoyVgT.exe

C:\Windows\System\mAoyVgT.exe

C:\Windows\System\JghoTjk.exe

C:\Windows\System\JghoTjk.exe

C:\Windows\System\KWhWuQK.exe

C:\Windows\System\KWhWuQK.exe

C:\Windows\System\OALwovj.exe

C:\Windows\System\OALwovj.exe

C:\Windows\System\SLeVLLk.exe

C:\Windows\System\SLeVLLk.exe

C:\Windows\System\BAaOpkQ.exe

C:\Windows\System\BAaOpkQ.exe

C:\Windows\System\VGtbanN.exe

C:\Windows\System\VGtbanN.exe

C:\Windows\System\QuykrtW.exe

C:\Windows\System\QuykrtW.exe

C:\Windows\System\GUcMzov.exe

C:\Windows\System\GUcMzov.exe

C:\Windows\System\ZPIObsw.exe

C:\Windows\System\ZPIObsw.exe

C:\Windows\System\amudsJz.exe

C:\Windows\System\amudsJz.exe

C:\Windows\System\clqgyQA.exe

C:\Windows\System\clqgyQA.exe

C:\Windows\System\pVSfKLP.exe

C:\Windows\System\pVSfKLP.exe

C:\Windows\System\gqIvinI.exe

C:\Windows\System\gqIvinI.exe

C:\Windows\System\IFRJXbT.exe

C:\Windows\System\IFRJXbT.exe

C:\Windows\System\WJRfSHw.exe

C:\Windows\System\WJRfSHw.exe

C:\Windows\System\ollBgul.exe

C:\Windows\System\ollBgul.exe

C:\Windows\System\GoMNoBl.exe

C:\Windows\System\GoMNoBl.exe

C:\Windows\System\yQJgWeZ.exe

C:\Windows\System\yQJgWeZ.exe

C:\Windows\System\MvzQfBB.exe

C:\Windows\System\MvzQfBB.exe

C:\Windows\System\DiMuSnL.exe

C:\Windows\System\DiMuSnL.exe

C:\Windows\System\orWtVwY.exe

C:\Windows\System\orWtVwY.exe

C:\Windows\System\KtkOVba.exe

C:\Windows\System\KtkOVba.exe

C:\Windows\System\wnwiwQU.exe

C:\Windows\System\wnwiwQU.exe

C:\Windows\System\DkDXVyp.exe

C:\Windows\System\DkDXVyp.exe

C:\Windows\System\sXlmPeB.exe

C:\Windows\System\sXlmPeB.exe

C:\Windows\System\uwgUVxf.exe

C:\Windows\System\uwgUVxf.exe

C:\Windows\System\bmnJpsG.exe

C:\Windows\System\bmnJpsG.exe

C:\Windows\System\ZXmsSGq.exe

C:\Windows\System\ZXmsSGq.exe

C:\Windows\System\hCAtmQo.exe

C:\Windows\System\hCAtmQo.exe

C:\Windows\System\qAqzTgS.exe

C:\Windows\System\qAqzTgS.exe

C:\Windows\System\anYRRgr.exe

C:\Windows\System\anYRRgr.exe

C:\Windows\System\sHbozIV.exe

C:\Windows\System\sHbozIV.exe

C:\Windows\System\uoevoqs.exe

C:\Windows\System\uoevoqs.exe

C:\Windows\System\fwoZGrX.exe

C:\Windows\System\fwoZGrX.exe

C:\Windows\System\dRkedDe.exe

C:\Windows\System\dRkedDe.exe

C:\Windows\System\imrqSyA.exe

C:\Windows\System\imrqSyA.exe

C:\Windows\System\kYbipqj.exe

C:\Windows\System\kYbipqj.exe

C:\Windows\System\BlCurCO.exe

C:\Windows\System\BlCurCO.exe

C:\Windows\System\jDwPJeg.exe

C:\Windows\System\jDwPJeg.exe

C:\Windows\System\dICrzyL.exe

C:\Windows\System\dICrzyL.exe

C:\Windows\System\BFbIJYw.exe

C:\Windows\System\BFbIJYw.exe

C:\Windows\System\uafuwjy.exe

C:\Windows\System\uafuwjy.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

memory/3144-0-0x00007FF628FC0000-0x00007FF629311000-memory.dmp

memory/3144-1-0x0000025C636C0000-0x0000025C636D0000-memory.dmp

C:\Windows\System\VopbbYB.exe

MD5	f0f6e7ddb867d04a1629e485e3d931be
SHA1	38faaf34be29f64ab95a124af1c68d040b054bcf
SHA256	85340c23bacc19d7e117b10f1b87a29bde777ef0c6e22accdfc8ee77f0f130de
SHA512	82c467eda2d645ed43f74b6107e4b3aa0df20447bd89f04b842f4408979a17dd7ae68d9e9a822f9d9775c9cbbce37c2275b553bcb3e6872c4728d28a4185c75d

C:\Windows\System\BeAQUWD.exe

MD5	3c248c16e84563cc569eee6937620cd6
SHA1	31eb6df854fc7972c4d0de23b349e5c5690a8108
SHA256	e163a9350947014a11a022d2a8e0dcbb53bc2dc7634c62e899abb42ce267adf1
SHA512	16a5dc9f31e27d9949d7c1fdb58409801665f6409b65524a06ebe536998a3dcc5357667ea7e0b240cb8cfb737f9c9743868c30e7e52b66f08bd801bc6d696bbf

C:\Windows\System\ngqpKZK.exe

MD5	cb79d4216ef74915cb5d326ef01efc08
SHA1	6eb9df56188eb7f6d477cc4d77cf7787faaf970d
SHA256	d43f5ad1d83872240eb8eabc28c2dea8b8f69a0692a978c35eea2445db858bf4
SHA512	11f3a93de8ecd55c8494b13eeb27904f7db1baa2fcee56f46e315c3b7bada0de4c9f2e1aebccc35b28e5d02e324a2729d22fe39735fae01e9254578e9158fca6

C:\Windows\System\SvAmQqS.exe

MD5	a96a99b0df52fa6168afc5178862240e
SHA1	b3951fcb444dfcc4c0489173fd3b615ffcf10d2e
SHA256	abb975e24ab812a7e02f94dd33f72ff33d0e7f45feaaaf34c10934972f633f07
SHA512	5d418ad00159f56ba585b2c1ad0d3c5913705c8d802cf4a407723c48e63fb396733b2d3c956a60fe7c00f6957233ec79fd06beeec0c1ee49c5311464a81d1c75

C:\Windows\System\HDbQwLK.exe

MD5	db36d47a536be4d1abb24f4ab5e948a4
SHA1	7aa61eafb517b99ea42ed8e2f4c8dc96ffe3cd1e
SHA256	166a8c443e08c2e7924a4aba833e3600f88826e33f27190372a571fea8790afb
SHA512	c20770ab3ee17dc17753dd7ed461deb65834f1df1fead32ea52969264b8c79de525c0ad04268111fe81436ca5af1b3c5c2ccc2e44ae295e3775cd5de07fe6cf0

memory/3848-233-0x00007FF788960000-0x00007FF788CB1000-memory.dmp

memory/1628-453-0x00007FF7767C0000-0x00007FF776B11000-memory.dmp

memory/4836-482-0x00007FF644990000-0x00007FF644CE1000-memory.dmp

memory/1188-489-0x00007FF787D70000-0x00007FF7880C1000-memory.dmp

memory/1436-492-0x00007FF7C3EB0000-0x00007FF7C4201000-memory.dmp

memory/2700-491-0x00007FF722DE0000-0x00007FF723131000-memory.dmp

memory/4536-490-0x00007FF781E20000-0x00007FF782171000-memory.dmp

memory/1768-488-0x00007FF666E60000-0x00007FF6671B1000-memory.dmp

memory/2000-487-0x00007FF7B6C80000-0x00007FF7B6FD1000-memory.dmp

memory/2476-486-0x00007FF6555E0000-0x00007FF655931000-memory.dmp

memory/4220-485-0x00007FF6B9F20000-0x00007FF6BA271000-memory.dmp

memory/3380-449-0x00007FF669BE0000-0x00007FF669F31000-memory.dmp

memory/2904-392-0x00007FF70E010000-0x00007FF70E361000-memory.dmp

memory/4720-368-0x00007FF627150000-0x00007FF6274A1000-memory.dmp

memory/4076-365-0x00007FF79A7A0000-0x00007FF79AAF1000-memory.dmp

memory/2944-333-0x00007FF65F9C0000-0x00007FF65FD11000-memory.dmp

memory/4308-283-0x00007FF6F69C0000-0x00007FF6F6D11000-memory.dmp

memory/4424-282-0x00007FF703B10000-0x00007FF703E61000-memory.dmp

memory/3036-266-0x00007FF7000D0000-0x00007FF700421000-memory.dmp

memory/4072-232-0x00007FF662150000-0x00007FF6624A1000-memory.dmp

memory/1268-194-0x00007FF657FF0000-0x00007FF658341000-memory.dmp

C:\Windows\System\FjFaYnb.exe

MD5	dd0ef0b3cf78da5997558128a742ae2c
SHA1	82dc856177639d10fcbbc539ab94bc7cfc616ad3
SHA256	4cd1753dc851dd37d1b642cf6f1e2723fdd49e977bb3b59072a8a950274153bc
SHA512	d5c53b5f71e18ea7dad95055c0886906fb1f26905d20368238459daff85ba69eefc3b405e1ceda5379a8535633780def35ea61de69fd271254107d12a0e96837

C:\Windows\System\vOerQVf.exe

MD5	dbe0a8ca741c4a9c6a7da30aba8665f6
SHA1	7e18ccedea4835f2d2fec1dc263f2de974f398dd
SHA256	5dcb055cc2479a6b5955ae8757b5c292172067b32d94d7390f848cde7d985ca1
SHA512	c6d9f73206e37a115a09ae42e33a6e49b6fda45b6315d9623b34dae5679d116fe6ee67202d0caf784fd8d44ddfb63dc1f6e9b4baabe3f5641d2f2192ceba7721

C:\Windows\System\OOpggoB.exe

MD5	43b0b951cdda95f140d74de80b7dac5d
SHA1	2052799f157202a659312490c67d47302e22031d
SHA256	9b4a5d1f2e76e7188fcc9391ba03f67d0268f994a15624ebb048a97bf37005d5
SHA512	a52d9adf5bb4fc3e6459cd93183ac970cf7b5b9a3c8f68b40a22ab95edc7ade042801cd19a9f07548c03e7ba21a23b23f61600b7c7c00938ef178a62eaf96307

C:\Windows\System\qOPdrfj.exe

MD5	b18e5c09219cd17d429397ce8ecb3928
SHA1	83c2df644f5ae4d3c5911b0c757a12123a1e7312
SHA256	e42e8bb1ec73d74ed94e5cfa9cf5d2181235c15bc1ca76f258980e20fcf2000c
SHA512	81c950a9dd73ed8b2460ec90d33809cdc6c61271b7307574d5838710cb455e78d7363e1c94c605f31edd337d89ee2994b4936d4d147789199736ac92b1b292e4

C:\Windows\System\qBgeVkH.exe

MD5	4c9cb86bccb713d507d5d763d4ab3cbb
SHA1	0dfd065b9f32493d3e1d83f99f30e8fd1ce14968
SHA256	2a0748db44127912c1a73ad11b5f90f4ef17b95d0872b5340920e71695f48467
SHA512	bbf31fa6894c6c90150ec98429808813c546d1a59ba09be3ae7b5ab2a3d93179d582edb5dbccefa870f449463ef4c6d335a6f3e50387436030a5c382cc80c431

C:\Windows\System\xjaWnaV.exe

MD5	f79cd27c54d36e897ded4c7c9110c41d
SHA1	59899ee3d4d619412ac308cc0ce05c3d2ff07add
SHA256	c427b49c94af8b414b51bce535800aaa17dfe85a56dc6eabdfd8fb4f81cce98f
SHA512	14fd0f3b031f3117dcafc42f66e3b9d8ddf889bebf7626a07935db7181fc15ae24546ef5ead6ecda959d4b130cfecdaaa13ec53e96645a7d9e34d6100b23caaf

C:\Windows\System\QehVrqj.exe

MD5	d69fd058c7e97260530ac4d774335a13
SHA1	ef2887979cba061da2ca341d08709b7109723cce
SHA256	03431e518661639f6a4e1e83aed6b96b28c0c030e720b1f18a1fad1ed6d8efe0
SHA512	d23a49a25bd878705b2c85dde2a1d8d2044108cd8a0fa5341decd50fd5bbb486db2ca056808319405c7a9d85e5088655811d29276284e04f0632a33ba60ac23b

C:\Windows\System\fqWQSmo.exe

MD5	23f6223f298aad19333fec76da10b805
SHA1	1aee3ebb9dc123ee02dc16d2e28fc6b54a5f7890
SHA256	82ab9ccc807e85b9332b8c2d61d3ae08e1749e519f6bc0bf4e0a7dde6661d2bb
SHA512	5dedc1534df2b97633a1d9d8274a2798bd1dd6c6e99f58e25a49c6864910583c3b4e33ec07a20b9f7d1905b30b4df749aefdf8dd03256b293144481fcea5fde4

memory/4728-170-0x00007FF7BE850000-0x00007FF7BEBA1000-memory.dmp

C:\Windows\System\RfXppvd.exe

MD5	00ffa6d2abc3b948ff01b710b8ecf64a
SHA1	eabc623f68bbe4cb5e9a00fcb7714d443ecf81f1
SHA256	20dd58187a862ed592195dedddda865d58118fe42a92a54f6a0be1d5277c003d
SHA512	3e810cb28caef2846f8d76b205fbc3ba5c258da5875f809a301a9aceca017325eaf3ef4b48a35c857d5b8e3416c01b699a6d7f90dba016a626a663d9f9d9d23d

C:\Windows\System\FbpsUaR.exe

MD5	cfe721dd3fec1af87c087e2ee53730ad
SHA1	d301a7096effef45682d2c07bf8363361388cbca
SHA256	44ba1ac3bbc3d339a506def6eb3f927bca78a3a6ebf1fc612dffa0a66dcf34e3
SHA512	e8ee304af8195ebcdf49f0f45292a42520beb541e4f85746de4a125f9c27def2b190011d7925c50462e95a630656dc228d7b72b77e17770736c5032685bf6084

C:\Windows\System\Amuwder.exe

MD5	345eb6eb772eb67a0ba133572c3b223c
SHA1	d95a83239a4345aa839afcef0ca595aeb7a8a070
SHA256	e730b61be1bf84aa65da1604ce67547ae83a3d1a4acb862c87bd1f85ec9b8d6a
SHA512	502f52630bc608c6ef7d1d130d66ce92bf8f76d5fb0ea1964af05ce7c541f48ae80a39f95b26f6a8f7f5d07851fc19e1567656eb179a9b3685f380e85a6ee3e7

C:\Windows\System\XEhTWiA.exe

MD5	24231bd8d7f2066162f2469e6c21b37a
SHA1	a19a048209d951affc979e3f5771a77a50abb6b7
SHA256	f7c0c1c4221d137c72590876e948391bd798c571c2a75df5dc2ba7f8c742a1a9
SHA512	060141d2ac43b4359e6482b39d75e6b9c540445c5c62260bb7ee8111a216585f201e386b79fa8d5a227ab917fbbeb86d0a095bf7068a40128d5ba5bec2e77ee3

C:\Windows\System\wbvGfbB.exe

MD5	ed59828f50f25e7f40e8ec1d081c8b79
SHA1	37944cf0802cf815f8659b156b77e7d06ea8abc6
SHA256	437c9d38742dda094c50aa7b3cc7779ab24f8267c5ade9e3aa65678513d5a933
SHA512	551e09e42e34838774dbc639a91337587a1603b98ca4985f55d5c77d2a23f156fd7dee2fe41ef178350549a2e19132a20dae7fad2045b6c1d8b7ba5048d2125c

C:\Windows\System\TfIAACh.exe

MD5	fea60c6ab9dcfd8fb05032c075184302
SHA1	076bcca4e8d31994d5c7cea6bdc9a1217e8803b9
SHA256	8b988215c4ad6601d451f7912a7d37d84b56aa3e541e19da88f53c7f940d6184
SHA512	001f13a38e51379e1512e3411f342048b93ec50c3211c29b4184079c19582136e5810fac1c23e68d418e5c497cc3eb5cde9c1ad26dbe98ddea8e5eb64af514e1

C:\Windows\System\eVIcaKu.exe

MD5	88238ac1417671962e5322b50a743416
SHA1	c4145bd2dd83829f7e9b9d717ebbf2da8ec23fd7
SHA256	1e6c26d63c25d634fc68b49c7c01c71d46e7fc2a69e8b45bfe4dd1f310209932
SHA512	8a2d7bb1fc72e52a89c6bde5cc0d919fab4bc1564bdd8d7d71576aa8aeb64d1123fa1888b1e6b43bbaf2dd35bc9a49ea86d1d48e1762fd1b3835b5d4da5d6c89

C:\Windows\System\fCXeRwj.exe

MD5	694592890d963b0aee69c3fc6b09f7c9
SHA1	c473374871b3eb354411faa9604e28e892069992
SHA256	1080fda1852fd01787bb4e27572ba5ed33da4b9e1bf4ddb99e3d9f69b214c46a
SHA512	84cab87e27591b9f002c3a63da912ffc4740ab8b75ba33bdc7c3e05cf1f4ea42d9d152d88f4d07646eb4f972b35c8c354ff3553934cb2ba794d9ddf1f21ba571

C:\Windows\System\srpXkLR.exe

MD5	893355bd09b2b136b91a45b4b754c00c
SHA1	8fd50ef2c41ed5b7f144cf61b74303e1cf8b1702
SHA256	87089b622fc978c4820ccfa90bb709e682a13624ad6f32c5cbb63828ee096622
SHA512	2ed318ea0dd92433a775b0a6088df9896a16dd5e25222bbf359cfecf9541f3a57583af05152f822ef6285dd02b6e1b069e7f121622fb152d407cdb11159a7590

C:\Windows\System\WgEXSdM.exe

MD5	c090651ee90e58772bf1027896f4574e
SHA1	0788342ae5b0507a74b62e1244d3543bbe7e4927
SHA256	ee68ac5e36e9117dce11f078770ba5ae65c36de60e756b3ab4b6760c534e8554
SHA512	09266ea1c87cd7b7d190d78b8bfd51ba5e3242f39ae344035f14caddd76d7ad6ef2ca4da9526001bbdf51fdb45898dc88ffe91dceb58dad166f19e82d14a33d4

C:\Windows\System\weFnbpr.exe

MD5	6ff6ed095fd1bd4f02e06321ce972b79
SHA1	c315394363ae2f4ca01e897e02783407e1d93d29
SHA256	3ad59eb5657de4d4084cf97c22f7facf9183f8f9a754bf24f8a868520c264da1
SHA512	dda2f9a60d5bd4d2bc7525ff65e8f07b8eb708e75f57d3ee76efdcff2cd3914d627c29ce48b182f810573d3cab69a2a856489708756fcd8305ed72cc1b7a3d69

C:\Windows\System\ZGQDulq.exe

MD5	94dcc7b98ce793c1f3df35892039abab
SHA1	fd2d7678f5c810e6ba7a27150eb040485e97f392
SHA256	10d235428570b1d62ae7ed2fae09768be61beebfe2fc814dab682698e91c0080
SHA512	8170f348dea43b96dabad2b99775521360f3876464d602cecc7ee4a75c4d6b5c61bf2892fb04258bc5dcb7e8d4036048746fc68713fdc13545b06edb0457b688

memory/5104-131-0x00007FF6591F0000-0x00007FF659541000-memory.dmp

memory/1100-130-0x00007FF65B6F0000-0x00007FF65BA41000-memory.dmp

C:\Windows\System\yVngxbx.exe

MD5	d63c843320f4c0d06abfe43f6201369e
SHA1	adc1f814946f6fb2bd006347c78fef6431846e8f
SHA256	a4dfc2133b2e32be779d0dfdccd94479874a33115b3c900242ca3e4c35cffeb4
SHA512	4b8488323ff482c0a0b6ccc8c56075000094d681335c61b422e798742362d11c8ac9290c11f8ff65074d92b49b6fe03d16022d0eaa1a9a6279015315ab899e84

C:\Windows\System\rwjlnRp.exe

MD5	a0209d0c46a27207200f3341469855c1
SHA1	bf958822838348ae5cc7dfcc64938a3eb703f74b
SHA256	f2c479b28b73f4cb166362534dadce4c4f1af42dc21049f036136b31e1ae7794
SHA512	dafb1a8a7be7f634713f4a1db29729fb8a9e512aded0c98a8afe798229fbb08c851bcb688f8739b28be8afa57b8b6a220f62b4f0d725eb4b0ee21f48200cc431

C:\Windows\System\DyaTanT.exe

MD5	49a86fc7defb1b4b039c640ba052a3d5
SHA1	93d5da1b8d29710324b385c17992fd031e55dbad
SHA256	292c69fff3aabadc6943481baa2f17d5129247f018ccbc02e5ed832a93d704e1
SHA512	cfdd845ff3233e446450b78692124977e469ccd89b9846c76fdfd65988f7891ba63c36a9a2fcc206ecb86dde0cc3fdc7289cee57a09c3fed8a29b3fa4a418838

C:\Windows\System\vLTtWKq.exe

MD5	fbcb90c9be632b6fe370dae729a85151
SHA1	1045f039d0daef256d993e33ff97cd211f403268
SHA256	98d5a448b6d6917f61a1244d249338e0d8537b83d05634a100f161e49b78fd0a
SHA512	e31653801af400519b722e7d1d0ff2d3593ebcac51e36ea84734f0ab8cd315f3705186548ede305fb833209275a57cff4f0feacaed865b83df0c56613de46505

C:\Windows\System\NNEVSbr.exe

MD5	f7f4c5aa48cda01e0f6e1c09fe52cb7f
SHA1	74d99e840889b91809a23a3558953bd96e26fd75
SHA256	d702a1b8f6c22fde48f12562500df69986be701f473956b290d9a53194d66576
SHA512	fd85802574eae4e5762ad7655d9348c2f4d5b103a57d46ac44a456ddb6a3b10012dcf3f4162990bc0bf89fd7ba54cd0786c958b43f3aa7b2cd477635778d0d1b

C:\Windows\System\oLfnlYc.exe

MD5	44628106aefbdeef1cee222f706492d4
SHA1	c604f0cad26490da3218ee278df4c50e947d60dd
SHA256	2745f6ac7cd2b42a9c57215fda93c0499874f6dee416230451bc390885731349
SHA512	c3c783e2105badcc22fa013c51277f2bcceb6102e31ac25915a5fda96690ec13113cb3435b6e4ad8b43ced664036d4ed7511691c8b4075013de3ed420386fda8

C:\Windows\System\sDZPfaI.exe

MD5	d3203a2d588fe0517ab4dc181da9f369
SHA1	2a690481cb02025f05019447d966078985753bb9
SHA256	ec8fe2dbd85f66c7c205d7bfc89da65425cf81473b8827a14899567bdb21dcd0
SHA512	666f4c4a706e4b8585ada0280e8d3a72bb5bf0dfbfe767786fdd3ea7a8a8acae2b8bc7879aa70c12dd4fce3d6086ee71c6399570aa26d7e7bc8a845617be14fe

C:\Windows\System\caoahvS.exe

MD5	4e4deb66304d7486d80ed37ae20dbc7e
SHA1	d6dd02e75e31649a81a8d351abe2d13801cff30b
SHA256	8109d9449313c29cc6bb84012b7a2167df308d085cc69f0f4b4496ed1a620d6e
SHA512	6bc903954ab7444921f4169af8d44edf0d5de308845194517ea500b5b5a0c87ae951b66e5d0d6af9dab70d1483c755fab06a07667647c11b26ebec7872ecf12e

C:\Windows\System\YXMDwDX.exe

MD5	0045f7bbfa88b0438a5872aa51ab8841
SHA1	8bd0e2a1e66d23cc8bc0e880e2816b032b4d8aee
SHA256	e992e82641120136fed7c545af5a2a761c471ec67bd3f5c5350112a4b80342bf
SHA512	5c83ee635c0e98a9f6d335a2140ae5516b5dd0a6397312058609a4dab07028f5bc1fd79b6c0034747e13dd72c367e8e287007911675a2ead795f218396b31840

memory/3260-89-0x00007FF748190000-0x00007FF7484E1000-memory.dmp

C:\Windows\System\uUiQaWn.exe

MD5	8ecf8661f537c2664f06336c047a48d7
SHA1	35ca3509422b2793670064f9c5cb84b55c186151
SHA256	99d69f38c8e8a44dac11a0ea454c953773e8d574924a05b089dc2b8e436eb4cd
SHA512	a7ddaf6da622d198d40472052c4bec22df9853a3b84688ce0d32e266bd2929ead891dfd7f27c66dfcd06d31d1b68511e80abda7cb86e904e9bd8b57910fda1bf

C:\Windows\System\WQKMtuR.exe

MD5	05f61d9d0e40826d2fcc26e4b08b41cf
SHA1	3cf98deb0f44f96662f2167e236c2d1ef6084557
SHA256	9ef430db215ba2582e86fbbe34b613be484da55c8db78efcbc4bdd5dd1cd58d8
SHA512	30a603f193f62c13ad52c8a151d6d4d14bf1ce363379691cc638ac9e2ff9782353176fd97bef0844304687cb46bffc840d5169a613cf79af42ed0fc5f83bd151

C:\Windows\System\zGVGrne.exe

MD5	d2269ed8785d61a8aea1effad367321b
SHA1	cba6d3cb07538e6857efd26e0e57a2951ee5d905
SHA256	72c89cd30ff355b6a5585903b096ccb68688611521ffb94949b9839d60463402
SHA512	1b07e571b926108b45a8041566b523098d19cb672bbfcbe9dc43398a8af550b33d8653fd2d4e96152d3167e69fd6e074a840f6f2954b3211dee90f708641011d

C:\Windows\System\aopkAGq.exe

MD5	79a22a3b0c710e831bc9cfe2cca51771
SHA1	f7e607cacf2b3847dbc486002548960defabb41f
SHA256	bac03e468b5630a7a8c412dfd257d4371c44a00c4066661b304a131b01e38cf7
SHA512	583213d51c088993315760adba8b2916153f1c4cb36b86eaba19cb60595b5822a0c6606168b1950abdc622667e42ffe311ec3f1c0c29d069aef10abeb338c167

memory/5064-61-0x00007FF6A63A0000-0x00007FF6A66F1000-memory.dmp

C:\Windows\System\LNOCmYA.exe

MD5	fcd8fbfccee870b6149e34c846150d99
SHA1	32095b02ff412d486505ef37aa3855a30034f504
SHA256	871bb27d6abc81bd3dcda8f4a0bf37f614ee08e14a3c33faf3ec36fb7a84cde3
SHA512	c075ba52d341f1bf3ca6d5ea40fe23fd524f819af08797b1389d7aa5276b4cb973af62e306e700aaca0167fc9bbc3bf5f87a4e5bc8dd99110802d151bc18ed26

C:\Windows\System\curPUUc.exe

MD5	3d053c71023d5a252f0f171d511ccbdb
SHA1	9c4a87753199e2386dd4a8b4bc9dde868c59b1c2
SHA256	c30388925032131eb35d98d06c506bccfd75c3ca50f2c603cb50c286b100c9d5
SHA512	94d9c5b53a56751a5261941e7b32872810ba1d9f0c1256c03d8b76dbfe5451eb39484af3b0926be3525d95579a9ca6f7bb1f0c1e7ee9e3c81f49fa975645b89f

memory/2984-36-0x00007FF622BF0000-0x00007FF622F41000-memory.dmp

memory/4212-23-0x00007FF79E040000-0x00007FF79E391000-memory.dmp

C:\Windows\System\jhVhfPg.exe

MD5	7c7bb06aa1046b099aed8e6162bd99f4
SHA1	6ca313978290b5c07bbcd493336359b20925ced2
SHA256	41e7cfeb8d002d28d8f1e9a4b093672cf96e35b3f83ee0794eaa9b8ff6420f14
SHA512	8e35e15f3714e1af1649dec09d4db5b217ea2d79a092cf9072a86d571146e193777383ca1a3e24354f3a0cd6c1de15789649693fd90fbf6a9dcb3ade8001663b

memory/1720-10-0x00007FF74F760000-0x00007FF74FAB1000-memory.dmp

memory/3144-2700-0x00007FF628FC0000-0x00007FF629311000-memory.dmp

memory/1720-2800-0x00007FF74F760000-0x00007FF74FAB1000-memory.dmp

memory/2984-2803-0x00007FF622BF0000-0x00007FF622F41000-memory.dmp

memory/4212-2804-0x00007FF79E040000-0x00007FF79E391000-memory.dmp

memory/1188-2808-0x00007FF787D70000-0x00007FF7880C1000-memory.dmp

memory/5064-2807-0x00007FF6A63A0000-0x00007FF6A66F1000-memory.dmp

memory/1768-2810-0x00007FF666E60000-0x00007FF6671B1000-memory.dmp

memory/3848-2813-0x00007FF788960000-0x00007FF788CB1000-memory.dmp

memory/3260-2824-0x00007FF748190000-0x00007FF7484E1000-memory.dmp

memory/4536-2828-0x00007FF781E20000-0x00007FF782171000-memory.dmp

memory/1268-2826-0x00007FF657FF0000-0x00007FF658341000-memory.dmp

memory/2904-2822-0x00007FF70E010000-0x00007FF70E361000-memory.dmp

memory/5104-2818-0x00007FF6591F0000-0x00007FF659541000-memory.dmp

memory/4308-2817-0x00007FF6F69C0000-0x00007FF6F6D11000-memory.dmp

memory/1100-2820-0x00007FF65B6F0000-0x00007FF65BA41000-memory.dmp

memory/4728-2815-0x00007FF7BE850000-0x00007FF7BEBA1000-memory.dmp

memory/4424-2833-0x00007FF703B10000-0x00007FF703E61000-memory.dmp

memory/3036-2840-0x00007FF7000D0000-0x00007FF700421000-memory.dmp

memory/2944-2842-0x00007FF65F9C0000-0x00007FF65FD11000-memory.dmp

memory/4076-2839-0x00007FF79A7A0000-0x00007FF79AAF1000-memory.dmp

memory/3380-2837-0x00007FF669BE0000-0x00007FF669F31000-memory.dmp

memory/4072-2835-0x00007FF662150000-0x00007FF6624A1000-memory.dmp

memory/4836-2831-0x00007FF644990000-0x00007FF644CE1000-memory.dmp

memory/2700-2860-0x00007FF722DE0000-0x00007FF723131000-memory.dmp

memory/2476-2849-0x00007FF6555E0000-0x00007FF655931000-memory.dmp

memory/4720-2851-0x00007FF627150000-0x00007FF6274A1000-memory.dmp

memory/1628-2868-0x00007FF7767C0000-0x00007FF776B11000-memory.dmp

memory/1436-2866-0x00007FF7C3EB0000-0x00007FF7C4201000-memory.dmp

memory/4220-2846-0x00007FF6B9F20000-0x00007FF6BA271000-memory.dmp

memory/2000-2845-0x00007FF7B6C80000-0x00007FF7B6FD1000-memory.dmp

Sample ID	240613-2fbtvashld
Target	8c60b6bff5c7eb5d3af5823223a74490_NeikiAnalytics.exe
SHA256	b8b3784ea46ab9f42817e49b6a2d5acc8eb0f73e5f6b189d901149121ec844ed
Tags	upx miner xmrig

Malware Analysis Report

2024-07-28 21:41

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files