Analysis Overview

score

10^/10

SHA256

fc20ca5d82ffc143f287a0670217c9eb8c819f2945cf02b729e14ee72d373de7

Threat Level: Known bad

The file 802e261edffca764e8990de2feec7550_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

upx miner xmrig

XMRig Miner payload

Xmrig family

xmrig

XMRig Miner payload

Executes dropped EXE

UPX packed file

Loads dropped DLL

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 13:28

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Xmrig family

xmrig

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 13:28

Reported

2024-06-13 13:31

Platform

win7-20240611-en

Max time kernel

149s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\WCPtRRz.exe	N/A
N/A	N/A	C:\Windows\System\oWdryEu.exe	N/A
N/A	N/A	C:\Windows\System\nVMcnqJ.exe	N/A
N/A	N/A	C:\Windows\System\bfcCtwG.exe	N/A
N/A	N/A	C:\Windows\System\EgeBjev.exe	N/A
N/A	N/A	C:\Windows\System\BuLAuOD.exe	N/A
N/A	N/A	C:\Windows\System\Rndzhmj.exe	N/A
N/A	N/A	C:\Windows\System\DWFfDpi.exe	N/A
N/A	N/A	C:\Windows\System\wYfgwQK.exe	N/A
N/A	N/A	C:\Windows\System\eTiFDxi.exe	N/A
N/A	N/A	C:\Windows\System\IFRDFbm.exe	N/A
N/A	N/A	C:\Windows\System\fEdRJyR.exe	N/A
N/A	N/A	C:\Windows\System\uGKiOPy.exe	N/A
N/A	N/A	C:\Windows\System\eczZBVi.exe	N/A
N/A	N/A	C:\Windows\System\yBhFPSE.exe	N/A
N/A	N/A	C:\Windows\System\MuPqhAt.exe	N/A
N/A	N/A	C:\Windows\System\pyLlyFF.exe	N/A
N/A	N/A	C:\Windows\System\HWIesDa.exe	N/A
N/A	N/A	C:\Windows\System\udOkeIK.exe	N/A
N/A	N/A	C:\Windows\System\yKARvgh.exe	N/A
N/A	N/A	C:\Windows\System\VITjNMy.exe	N/A
N/A	N/A	C:\Windows\System\qvDFcZA.exe	N/A
N/A	N/A	C:\Windows\System\QANSJxx.exe	N/A
N/A	N/A	C:\Windows\System\vWCeALB.exe	N/A
N/A	N/A	C:\Windows\System\FNEhOjL.exe	N/A
N/A	N/A	C:\Windows\System\CfSfDxj.exe	N/A
N/A	N/A	C:\Windows\System\twTSXRm.exe	N/A
N/A	N/A	C:\Windows\System\fTBCPCx.exe	N/A
N/A	N/A	C:\Windows\System\WXdTpxo.exe	N/A
N/A	N/A	C:\Windows\System\LUnXUTg.exe	N/A
N/A	N/A	C:\Windows\System\cjrDurY.exe	N/A
N/A	N/A	C:\Windows\System\PjPhYfI.exe	N/A
N/A	N/A	C:\Windows\System\Vmenqlp.exe	N/A
N/A	N/A	C:\Windows\System\jvCnmMz.exe	N/A
N/A	N/A	C:\Windows\System\ifGhHhf.exe	N/A
N/A	N/A	C:\Windows\System\cRErGiE.exe	N/A
N/A	N/A	C:\Windows\System\WinzbhS.exe	N/A
N/A	N/A	C:\Windows\System\ilsEQoy.exe	N/A
N/A	N/A	C:\Windows\System\JWrgHNK.exe	N/A
N/A	N/A	C:\Windows\System\XFgcxFH.exe	N/A
N/A	N/A	C:\Windows\System\sqxRnUe.exe	N/A
N/A	N/A	C:\Windows\System\mYWvIGq.exe	N/A
N/A	N/A	C:\Windows\System\odkerTX.exe	N/A
N/A	N/A	C:\Windows\System\hQfZdLs.exe	N/A
N/A	N/A	C:\Windows\System\wZrosIt.exe	N/A
N/A	N/A	C:\Windows\System\HjLdZhd.exe	N/A
N/A	N/A	C:\Windows\System\bWouVWc.exe	N/A
N/A	N/A	C:\Windows\System\MFGGCyz.exe	N/A
N/A	N/A	C:\Windows\System\MyaVXBN.exe	N/A
N/A	N/A	C:\Windows\System\EccmQGX.exe	N/A
N/A	N/A	C:\Windows\System\zOKaFZX.exe	N/A
N/A	N/A	C:\Windows\System\udAAeqp.exe	N/A
N/A	N/A	C:\Windows\System\UVxmqiD.exe	N/A
N/A	N/A	C:\Windows\System\ZvViMBU.exe	N/A
N/A	N/A	C:\Windows\System\YmnLptP.exe	N/A
N/A	N/A	C:\Windows\System\WrNnogF.exe	N/A
N/A	N/A	C:\Windows\System\cIeLSCj.exe	N/A
N/A	N/A	C:\Windows\System\RCsovVk.exe	N/A
N/A	N/A	C:\Windows\System\vCZIIaM.exe	N/A
N/A	N/A	C:\Windows\System\FKOWQli.exe	N/A
N/A	N/A	C:\Windows\System\kxOxWmT.exe	N/A
N/A	N/A	C:\Windows\System\KGRyjOt.exe	N/A
N/A	N/A	C:\Windows\System\QvHZbuV.exe	N/A
N/A	N/A	C:\Windows\System\GrnIeXn.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\WXdTpxo.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GEmZxet.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JbkvEqq.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oqnIKpW.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nLhWsAH.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ANnMxGa.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RkzdYdY.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\deDZCHq.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fEdRJyR.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UcTWnJD.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pRjPFtq.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Imkstrh.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\srSRvFQ.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CosmlRt.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qSxpGFQ.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FsWOjMI.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\znqMtjc.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sDuDxPt.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JfFeQHr.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eXENkMM.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vDYBudR.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EbIOOMh.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lpLjgJW.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RzGTfdi.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HxgZjBV.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ECGndti.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mZHLjkP.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lXinEml.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PEAqGbf.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RkXUVAH.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kzjPveE.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CcSvPeF.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WRpdXft.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SnqaTyd.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CjasBPv.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FwkIoEY.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VfMYdLT.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tJJnyEH.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ynwutfk.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AjxTXKW.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CDayqvz.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vhQQCfp.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WeHaiXG.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TGgwhrx.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EzUvXyd.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wxchHGo.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AHAKiSf.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XtPHtLX.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\glvswKp.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SoTApfK.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IcgHTVF.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ttHPzgQ.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WDgZmDl.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aDPKVgl.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rbRaIaD.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TiNvvdI.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YnhOKtz.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WysGYMJ.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nLCKTSv.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kZniaWN.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IJbZlCS.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JqTlMYa.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EhhzFgs.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OlfawbT.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2360 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\WCPtRRz.exe
PID 2360 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\WCPtRRz.exe
PID 2360 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\WCPtRRz.exe
PID 2360 wrote to memory of 2260	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\oWdryEu.exe
PID 2360 wrote to memory of 2260	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\oWdryEu.exe
PID 2360 wrote to memory of 2260	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\oWdryEu.exe
PID 2360 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\nVMcnqJ.exe
PID 2360 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\nVMcnqJ.exe
PID 2360 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\nVMcnqJ.exe
PID 2360 wrote to memory of 2780	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\bfcCtwG.exe
PID 2360 wrote to memory of 2780	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\bfcCtwG.exe
PID 2360 wrote to memory of 2780	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\bfcCtwG.exe
PID 2360 wrote to memory of 3004	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\EgeBjev.exe
PID 2360 wrote to memory of 3004	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\EgeBjev.exe
PID 2360 wrote to memory of 3004	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\EgeBjev.exe
PID 2360 wrote to memory of 2688	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\BuLAuOD.exe
PID 2360 wrote to memory of 2688	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\BuLAuOD.exe
PID 2360 wrote to memory of 2688	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\BuLAuOD.exe
PID 2360 wrote to memory of 2736	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\Rndzhmj.exe
PID 2360 wrote to memory of 2736	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\Rndzhmj.exe
PID 2360 wrote to memory of 2736	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\Rndzhmj.exe
PID 2360 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\DWFfDpi.exe
PID 2360 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\DWFfDpi.exe
PID 2360 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\DWFfDpi.exe
PID 2360 wrote to memory of 2692	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\eTiFDxi.exe
PID 2360 wrote to memory of 2692	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\eTiFDxi.exe
PID 2360 wrote to memory of 2692	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\eTiFDxi.exe
PID 2360 wrote to memory of 1420	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\wYfgwQK.exe
PID 2360 wrote to memory of 1420	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\wYfgwQK.exe
PID 2360 wrote to memory of 1420	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\wYfgwQK.exe
PID 2360 wrote to memory of 2104	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\uGKiOPy.exe
PID 2360 wrote to memory of 2104	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\uGKiOPy.exe
PID 2360 wrote to memory of 2104	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\uGKiOPy.exe
PID 2360 wrote to memory of 952	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\IFRDFbm.exe
PID 2360 wrote to memory of 952	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\IFRDFbm.exe
PID 2360 wrote to memory of 952	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\IFRDFbm.exe
PID 2360 wrote to memory of 3064	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\MuPqhAt.exe
PID 2360 wrote to memory of 3064	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\MuPqhAt.exe
PID 2360 wrote to memory of 3064	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\MuPqhAt.exe
PID 2360 wrote to memory of 2364	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\fEdRJyR.exe
PID 2360 wrote to memory of 2364	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\fEdRJyR.exe
PID 2360 wrote to memory of 2364	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\fEdRJyR.exe
PID 2360 wrote to memory of 2132	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\pyLlyFF.exe
PID 2360 wrote to memory of 2132	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\pyLlyFF.exe
PID 2360 wrote to memory of 2132	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\pyLlyFF.exe
PID 2360 wrote to memory of 2256	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\eczZBVi.exe
PID 2360 wrote to memory of 2256	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\eczZBVi.exe
PID 2360 wrote to memory of 2256	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\eczZBVi.exe
PID 2360 wrote to memory of 2136	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\HWIesDa.exe
PID 2360 wrote to memory of 2136	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\HWIesDa.exe
PID 2360 wrote to memory of 2136	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\HWIesDa.exe
PID 2360 wrote to memory of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\yBhFPSE.exe
PID 2360 wrote to memory of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\yBhFPSE.exe
PID 2360 wrote to memory of 2832	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\yBhFPSE.exe
PID 2360 wrote to memory of 316	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\udOkeIK.exe
PID 2360 wrote to memory of 316	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\udOkeIK.exe
PID 2360 wrote to memory of 316	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\udOkeIK.exe
PID 2360 wrote to memory of 2936	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\yKARvgh.exe
PID 2360 wrote to memory of 2936	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\yKARvgh.exe
PID 2360 wrote to memory of 2936	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\yKARvgh.exe
PID 2360 wrote to memory of 2144	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\VITjNMy.exe
PID 2360 wrote to memory of 2144	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\VITjNMy.exe
PID 2360 wrote to memory of 2144	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\VITjNMy.exe
PID 2360 wrote to memory of 2268	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\qvDFcZA.exe

Processes

C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe"

C:\Windows\System\WCPtRRz.exe

C:\Windows\System\WCPtRRz.exe

C:\Windows\System\oWdryEu.exe

C:\Windows\System\oWdryEu.exe

C:\Windows\System\nVMcnqJ.exe

C:\Windows\System\nVMcnqJ.exe

C:\Windows\System\bfcCtwG.exe

C:\Windows\System\bfcCtwG.exe

C:\Windows\System\EgeBjev.exe

C:\Windows\System\EgeBjev.exe

C:\Windows\System\BuLAuOD.exe

C:\Windows\System\BuLAuOD.exe

C:\Windows\System\Rndzhmj.exe

C:\Windows\System\Rndzhmj.exe

C:\Windows\System\DWFfDpi.exe

C:\Windows\System\DWFfDpi.exe

C:\Windows\System\eTiFDxi.exe

C:\Windows\System\eTiFDxi.exe

C:\Windows\System\wYfgwQK.exe

C:\Windows\System\wYfgwQK.exe

C:\Windows\System\uGKiOPy.exe

C:\Windows\System\uGKiOPy.exe

C:\Windows\System\IFRDFbm.exe

C:\Windows\System\IFRDFbm.exe

C:\Windows\System\MuPqhAt.exe

C:\Windows\System\MuPqhAt.exe

C:\Windows\System\fEdRJyR.exe

C:\Windows\System\fEdRJyR.exe

C:\Windows\System\pyLlyFF.exe

C:\Windows\System\pyLlyFF.exe

C:\Windows\System\eczZBVi.exe

C:\Windows\System\eczZBVi.exe

C:\Windows\System\HWIesDa.exe

C:\Windows\System\HWIesDa.exe

C:\Windows\System\yBhFPSE.exe

C:\Windows\System\yBhFPSE.exe

C:\Windows\System\udOkeIK.exe

C:\Windows\System\udOkeIK.exe

C:\Windows\System\yKARvgh.exe

C:\Windows\System\yKARvgh.exe

C:\Windows\System\VITjNMy.exe

C:\Windows\System\VITjNMy.exe

C:\Windows\System\qvDFcZA.exe

C:\Windows\System\qvDFcZA.exe

C:\Windows\System\QANSJxx.exe

C:\Windows\System\QANSJxx.exe

C:\Windows\System\vWCeALB.exe

C:\Windows\System\vWCeALB.exe

C:\Windows\System\FNEhOjL.exe

C:\Windows\System\FNEhOjL.exe

C:\Windows\System\CfSfDxj.exe

C:\Windows\System\CfSfDxj.exe

C:\Windows\System\twTSXRm.exe

C:\Windows\System\twTSXRm.exe

C:\Windows\System\fTBCPCx.exe

C:\Windows\System\fTBCPCx.exe

C:\Windows\System\WXdTpxo.exe

C:\Windows\System\WXdTpxo.exe

C:\Windows\System\LUnXUTg.exe

C:\Windows\System\LUnXUTg.exe

C:\Windows\System\cjrDurY.exe

C:\Windows\System\cjrDurY.exe

C:\Windows\System\PjPhYfI.exe

C:\Windows\System\PjPhYfI.exe

C:\Windows\System\Vmenqlp.exe

C:\Windows\System\Vmenqlp.exe

C:\Windows\System\jvCnmMz.exe

C:\Windows\System\jvCnmMz.exe

C:\Windows\System\ifGhHhf.exe

C:\Windows\System\ifGhHhf.exe

C:\Windows\System\cRErGiE.exe

C:\Windows\System\cRErGiE.exe

C:\Windows\System\WinzbhS.exe

C:\Windows\System\WinzbhS.exe

C:\Windows\System\ilsEQoy.exe

C:\Windows\System\ilsEQoy.exe

C:\Windows\System\JWrgHNK.exe

C:\Windows\System\JWrgHNK.exe

C:\Windows\System\XFgcxFH.exe

C:\Windows\System\XFgcxFH.exe

C:\Windows\System\sqxRnUe.exe

C:\Windows\System\sqxRnUe.exe

C:\Windows\System\mYWvIGq.exe

C:\Windows\System\mYWvIGq.exe

C:\Windows\System\odkerTX.exe

C:\Windows\System\odkerTX.exe

C:\Windows\System\hQfZdLs.exe

C:\Windows\System\hQfZdLs.exe

C:\Windows\System\wZrosIt.exe

C:\Windows\System\wZrosIt.exe

C:\Windows\System\HjLdZhd.exe

C:\Windows\System\HjLdZhd.exe

C:\Windows\System\bWouVWc.exe

C:\Windows\System\bWouVWc.exe

C:\Windows\System\MFGGCyz.exe

C:\Windows\System\MFGGCyz.exe

C:\Windows\System\MyaVXBN.exe

C:\Windows\System\MyaVXBN.exe

C:\Windows\System\EccmQGX.exe

C:\Windows\System\EccmQGX.exe

C:\Windows\System\zOKaFZX.exe

C:\Windows\System\zOKaFZX.exe

C:\Windows\System\udAAeqp.exe

C:\Windows\System\udAAeqp.exe

C:\Windows\System\UVxmqiD.exe

C:\Windows\System\UVxmqiD.exe

C:\Windows\System\ZvViMBU.exe

C:\Windows\System\ZvViMBU.exe

C:\Windows\System\YmnLptP.exe

C:\Windows\System\YmnLptP.exe

C:\Windows\System\WrNnogF.exe

C:\Windows\System\WrNnogF.exe

C:\Windows\System\cIeLSCj.exe

C:\Windows\System\cIeLSCj.exe

C:\Windows\System\RCsovVk.exe

C:\Windows\System\RCsovVk.exe

C:\Windows\System\vCZIIaM.exe

C:\Windows\System\vCZIIaM.exe

C:\Windows\System\FKOWQli.exe

C:\Windows\System\FKOWQli.exe

C:\Windows\System\kxOxWmT.exe

C:\Windows\System\kxOxWmT.exe

C:\Windows\System\KGRyjOt.exe

C:\Windows\System\KGRyjOt.exe

C:\Windows\System\QvHZbuV.exe

C:\Windows\System\QvHZbuV.exe

C:\Windows\System\GrnIeXn.exe

C:\Windows\System\GrnIeXn.exe

C:\Windows\System\FLZsMmX.exe

C:\Windows\System\FLZsMmX.exe

C:\Windows\System\ERrhdex.exe

C:\Windows\System\ERrhdex.exe

C:\Windows\System\RfYknzr.exe

C:\Windows\System\RfYknzr.exe

C:\Windows\System\jlHivzs.exe

C:\Windows\System\jlHivzs.exe

C:\Windows\System\nkCiJeO.exe

C:\Windows\System\nkCiJeO.exe

C:\Windows\System\OGyeKnz.exe

C:\Windows\System\OGyeKnz.exe

C:\Windows\System\rmNjhos.exe

C:\Windows\System\rmNjhos.exe

C:\Windows\System\DPnxyOg.exe

C:\Windows\System\DPnxyOg.exe

C:\Windows\System\hWCIpqy.exe

C:\Windows\System\hWCIpqy.exe

C:\Windows\System\KjlWgoV.exe

C:\Windows\System\KjlWgoV.exe

C:\Windows\System\mlBoMsB.exe

C:\Windows\System\mlBoMsB.exe

C:\Windows\System\rueFdws.exe

C:\Windows\System\rueFdws.exe

C:\Windows\System\xaGczfP.exe

C:\Windows\System\xaGczfP.exe

C:\Windows\System\OkmnHCE.exe

C:\Windows\System\OkmnHCE.exe

C:\Windows\System\RFnEvaw.exe

C:\Windows\System\RFnEvaw.exe

C:\Windows\System\nVWjwvT.exe

C:\Windows\System\nVWjwvT.exe

C:\Windows\System\hhChJXu.exe

C:\Windows\System\hhChJXu.exe

C:\Windows\System\cugvOTF.exe

C:\Windows\System\cugvOTF.exe

C:\Windows\System\TvzBBmk.exe

C:\Windows\System\TvzBBmk.exe

C:\Windows\System\TcWzhHJ.exe

C:\Windows\System\TcWzhHJ.exe

C:\Windows\System\pCzuDHv.exe

C:\Windows\System\pCzuDHv.exe

C:\Windows\System\CCcHKtt.exe

C:\Windows\System\CCcHKtt.exe

C:\Windows\System\buqHMDQ.exe

C:\Windows\System\buqHMDQ.exe

C:\Windows\System\dxTwjLS.exe

C:\Windows\System\dxTwjLS.exe

C:\Windows\System\srSRvFQ.exe

C:\Windows\System\srSRvFQ.exe

C:\Windows\System\vqVThCO.exe

C:\Windows\System\vqVThCO.exe

C:\Windows\System\HPLBKOR.exe

C:\Windows\System\HPLBKOR.exe

C:\Windows\System\ijNRyew.exe

C:\Windows\System\ijNRyew.exe

C:\Windows\System\tCIpAvJ.exe

C:\Windows\System\tCIpAvJ.exe

C:\Windows\System\ucOqJqg.exe

C:\Windows\System\ucOqJqg.exe

C:\Windows\System\PYQpVSc.exe

C:\Windows\System\PYQpVSc.exe

C:\Windows\System\EldZODu.exe

C:\Windows\System\EldZODu.exe

C:\Windows\System\QZQHPpD.exe

C:\Windows\System\QZQHPpD.exe

C:\Windows\System\xZHCDmk.exe

C:\Windows\System\xZHCDmk.exe

C:\Windows\System\RsEDzXE.exe

C:\Windows\System\RsEDzXE.exe

C:\Windows\System\BRIQWZE.exe

C:\Windows\System\BRIQWZE.exe

C:\Windows\System\Bbwrdwq.exe

C:\Windows\System\Bbwrdwq.exe

C:\Windows\System\DTFnGgo.exe

C:\Windows\System\DTFnGgo.exe

C:\Windows\System\yOuXLIk.exe

C:\Windows\System\yOuXLIk.exe

C:\Windows\System\htbLDOs.exe

C:\Windows\System\htbLDOs.exe

C:\Windows\System\JZcfIve.exe

C:\Windows\System\JZcfIve.exe

C:\Windows\System\QAlVNZT.exe

C:\Windows\System\QAlVNZT.exe

C:\Windows\System\HtbQqCP.exe

C:\Windows\System\HtbQqCP.exe

C:\Windows\System\yJbjtFZ.exe

C:\Windows\System\yJbjtFZ.exe

C:\Windows\System\eZoXpwD.exe

C:\Windows\System\eZoXpwD.exe

C:\Windows\System\YIPprGM.exe

C:\Windows\System\YIPprGM.exe

C:\Windows\System\HnFynmF.exe

C:\Windows\System\HnFynmF.exe

C:\Windows\System\cPlkVfZ.exe

C:\Windows\System\cPlkVfZ.exe

C:\Windows\System\njSBpoM.exe

C:\Windows\System\njSBpoM.exe

C:\Windows\System\PpFpVHi.exe

C:\Windows\System\PpFpVHi.exe

C:\Windows\System\SIeuTfB.exe

C:\Windows\System\SIeuTfB.exe

C:\Windows\System\AZHDqRn.exe

C:\Windows\System\AZHDqRn.exe

C:\Windows\System\koUyofR.exe

C:\Windows\System\koUyofR.exe

C:\Windows\System\yDHMPAj.exe

C:\Windows\System\yDHMPAj.exe

C:\Windows\System\SMgSYEB.exe

C:\Windows\System\SMgSYEB.exe

C:\Windows\System\NBwHqAI.exe

C:\Windows\System\NBwHqAI.exe

C:\Windows\System\dyDteEc.exe

C:\Windows\System\dyDteEc.exe

C:\Windows\System\xWkzFfw.exe

C:\Windows\System\xWkzFfw.exe

C:\Windows\System\pSJnoNz.exe

C:\Windows\System\pSJnoNz.exe

C:\Windows\System\aelfOmB.exe

C:\Windows\System\aelfOmB.exe

C:\Windows\System\snTBvJT.exe

C:\Windows\System\snTBvJT.exe

C:\Windows\System\TCLzfjq.exe

C:\Windows\System\TCLzfjq.exe

C:\Windows\System\UaOwTkW.exe

C:\Windows\System\UaOwTkW.exe

C:\Windows\System\HnoRsJK.exe

C:\Windows\System\HnoRsJK.exe

C:\Windows\System\uNARyin.exe

C:\Windows\System\uNARyin.exe

C:\Windows\System\KbiikUF.exe

C:\Windows\System\KbiikUF.exe

C:\Windows\System\GfPsRYv.exe

C:\Windows\System\GfPsRYv.exe

C:\Windows\System\UvVUpBm.exe

C:\Windows\System\UvVUpBm.exe

C:\Windows\System\eqbfMLD.exe

C:\Windows\System\eqbfMLD.exe

C:\Windows\System\zmgaGjI.exe

C:\Windows\System\zmgaGjI.exe

C:\Windows\System\rVucYhe.exe

C:\Windows\System\rVucYhe.exe

C:\Windows\System\GaEeuLg.exe

C:\Windows\System\GaEeuLg.exe

C:\Windows\System\xKbKuTG.exe

C:\Windows\System\xKbKuTG.exe

C:\Windows\System\ghggudL.exe

C:\Windows\System\ghggudL.exe

C:\Windows\System\IHsCbth.exe

C:\Windows\System\IHsCbth.exe

C:\Windows\System\TkxlVrd.exe

C:\Windows\System\TkxlVrd.exe

C:\Windows\System\QGdefTM.exe

C:\Windows\System\QGdefTM.exe

C:\Windows\System\yGiXMlw.exe

C:\Windows\System\yGiXMlw.exe

C:\Windows\System\ypRwfFY.exe

C:\Windows\System\ypRwfFY.exe

C:\Windows\System\ycgAnqp.exe

C:\Windows\System\ycgAnqp.exe

C:\Windows\System\ttvhtuG.exe

C:\Windows\System\ttvhtuG.exe

C:\Windows\System\sjbkSQg.exe

C:\Windows\System\sjbkSQg.exe

C:\Windows\System\LwFrVEt.exe

C:\Windows\System\LwFrVEt.exe

C:\Windows\System\FyLHiCu.exe

C:\Windows\System\FyLHiCu.exe

C:\Windows\System\NeWOVSS.exe

C:\Windows\System\NeWOVSS.exe

C:\Windows\System\CcYyfLS.exe

C:\Windows\System\CcYyfLS.exe

C:\Windows\System\PZzViTv.exe

C:\Windows\System\PZzViTv.exe

C:\Windows\System\qXIdkDA.exe

C:\Windows\System\qXIdkDA.exe

C:\Windows\System\MuPbStV.exe

C:\Windows\System\MuPbStV.exe

C:\Windows\System\rbRaIaD.exe

C:\Windows\System\rbRaIaD.exe

C:\Windows\System\JIrAWLp.exe

C:\Windows\System\JIrAWLp.exe

C:\Windows\System\GXblIhS.exe

C:\Windows\System\GXblIhS.exe

C:\Windows\System\OovCjLh.exe

C:\Windows\System\OovCjLh.exe

C:\Windows\System\CosmlRt.exe

C:\Windows\System\CosmlRt.exe

C:\Windows\System\fKoxSQn.exe

C:\Windows\System\fKoxSQn.exe

C:\Windows\System\RNSOtJX.exe

C:\Windows\System\RNSOtJX.exe

C:\Windows\System\pGYxyRK.exe

C:\Windows\System\pGYxyRK.exe

C:\Windows\System\JqAxNdn.exe

C:\Windows\System\JqAxNdn.exe

C:\Windows\System\LkWwnQz.exe

C:\Windows\System\LkWwnQz.exe

C:\Windows\System\elGrUCM.exe

C:\Windows\System\elGrUCM.exe

C:\Windows\System\rHUsBPA.exe

C:\Windows\System\rHUsBPA.exe

C:\Windows\System\yakAfvn.exe

C:\Windows\System\yakAfvn.exe

C:\Windows\System\wWabSfW.exe

C:\Windows\System\wWabSfW.exe

C:\Windows\System\CDayqvz.exe

C:\Windows\System\CDayqvz.exe

C:\Windows\System\rlhXFhq.exe

C:\Windows\System\rlhXFhq.exe

C:\Windows\System\pLXjjEN.exe

C:\Windows\System\pLXjjEN.exe

C:\Windows\System\iRmGmNV.exe

C:\Windows\System\iRmGmNV.exe

C:\Windows\System\ZDKpwuj.exe

C:\Windows\System\ZDKpwuj.exe

C:\Windows\System\MsNbPAb.exe

C:\Windows\System\MsNbPAb.exe

C:\Windows\System\XWqYXSs.exe

C:\Windows\System\XWqYXSs.exe

C:\Windows\System\JVIDBoP.exe

C:\Windows\System\JVIDBoP.exe

C:\Windows\System\Pfgthwc.exe

C:\Windows\System\Pfgthwc.exe

C:\Windows\System\zBDKLzi.exe

C:\Windows\System\zBDKLzi.exe

C:\Windows\System\FQmAopk.exe

C:\Windows\System\FQmAopk.exe

C:\Windows\System\UAhVxeh.exe

C:\Windows\System\UAhVxeh.exe

C:\Windows\System\DOxXIOd.exe

C:\Windows\System\DOxXIOd.exe

C:\Windows\System\TqIRjQJ.exe

C:\Windows\System\TqIRjQJ.exe

C:\Windows\System\XcnFGmu.exe

C:\Windows\System\XcnFGmu.exe

C:\Windows\System\oLnPBeY.exe

C:\Windows\System\oLnPBeY.exe

C:\Windows\System\UnEWVUS.exe

C:\Windows\System\UnEWVUS.exe

C:\Windows\System\wdmmCZR.exe

C:\Windows\System\wdmmCZR.exe

C:\Windows\System\JQbKhrW.exe

C:\Windows\System\JQbKhrW.exe

C:\Windows\System\CJJRNxR.exe

C:\Windows\System\CJJRNxR.exe

C:\Windows\System\NLOvEHj.exe

C:\Windows\System\NLOvEHj.exe

C:\Windows\System\HVIcxEu.exe

C:\Windows\System\HVIcxEu.exe

C:\Windows\System\GDoOebf.exe

C:\Windows\System\GDoOebf.exe

C:\Windows\System\dSCUuVo.exe

C:\Windows\System\dSCUuVo.exe

C:\Windows\System\mpWRbRM.exe

C:\Windows\System\mpWRbRM.exe

C:\Windows\System\fnpPvdL.exe

C:\Windows\System\fnpPvdL.exe

C:\Windows\System\QTpHdMr.exe

C:\Windows\System\QTpHdMr.exe

C:\Windows\System\NOnDoHd.exe

C:\Windows\System\NOnDoHd.exe

C:\Windows\System\bBcwFZx.exe

C:\Windows\System\bBcwFZx.exe

C:\Windows\System\kAIDQVi.exe

C:\Windows\System\kAIDQVi.exe

C:\Windows\System\GTEIMZZ.exe

C:\Windows\System\GTEIMZZ.exe

C:\Windows\System\PmywflA.exe

C:\Windows\System\PmywflA.exe

C:\Windows\System\lgmLXMG.exe

C:\Windows\System\lgmLXMG.exe

C:\Windows\System\xyTFpNu.exe

C:\Windows\System\xyTFpNu.exe

C:\Windows\System\sFmBxyu.exe

C:\Windows\System\sFmBxyu.exe

C:\Windows\System\iPXjHLE.exe

C:\Windows\System\iPXjHLE.exe

C:\Windows\System\oKmjzND.exe

C:\Windows\System\oKmjzND.exe

C:\Windows\System\LDMrzXz.exe

C:\Windows\System\LDMrzXz.exe

C:\Windows\System\PMroIKU.exe

C:\Windows\System\PMroIKU.exe

C:\Windows\System\IpFCRuj.exe

C:\Windows\System\IpFCRuj.exe

C:\Windows\System\ZhzJcGq.exe

C:\Windows\System\ZhzJcGq.exe

C:\Windows\System\xZWPsPb.exe

C:\Windows\System\xZWPsPb.exe

C:\Windows\System\MhiJjaQ.exe

C:\Windows\System\MhiJjaQ.exe

C:\Windows\System\rXnkqQs.exe

C:\Windows\System\rXnkqQs.exe

C:\Windows\System\dZyoSHS.exe

C:\Windows\System\dZyoSHS.exe

C:\Windows\System\HxiFdSH.exe

C:\Windows\System\HxiFdSH.exe

C:\Windows\System\hIBvQYT.exe

C:\Windows\System\hIBvQYT.exe

C:\Windows\System\YEFBfrS.exe

C:\Windows\System\YEFBfrS.exe

C:\Windows\System\PIixxgR.exe

C:\Windows\System\PIixxgR.exe

C:\Windows\System\JlRCpDq.exe

C:\Windows\System\JlRCpDq.exe

C:\Windows\System\WLUEYIW.exe

C:\Windows\System\WLUEYIW.exe

C:\Windows\System\KIjWwxz.exe

C:\Windows\System\KIjWwxz.exe

C:\Windows\System\AVGviDZ.exe

C:\Windows\System\AVGviDZ.exe

C:\Windows\System\fdebcmm.exe

C:\Windows\System\fdebcmm.exe

C:\Windows\System\PtwHoRC.exe

C:\Windows\System\PtwHoRC.exe

C:\Windows\System\ZMOCHoj.exe

C:\Windows\System\ZMOCHoj.exe

C:\Windows\System\ARcKlmF.exe

C:\Windows\System\ARcKlmF.exe

C:\Windows\System\bSrIJzw.exe

C:\Windows\System\bSrIJzw.exe

C:\Windows\System\EaZQVUp.exe

C:\Windows\System\EaZQVUp.exe

C:\Windows\System\AukpMPx.exe

C:\Windows\System\AukpMPx.exe

C:\Windows\System\xHmweSA.exe

C:\Windows\System\xHmweSA.exe

C:\Windows\System\ctNYSIB.exe

C:\Windows\System\ctNYSIB.exe

C:\Windows\System\diNPXkf.exe

C:\Windows\System\diNPXkf.exe

C:\Windows\System\QSpirfE.exe

C:\Windows\System\QSpirfE.exe

C:\Windows\System\GJKplCF.exe

C:\Windows\System\GJKplCF.exe

C:\Windows\System\DtolYlC.exe

C:\Windows\System\DtolYlC.exe

C:\Windows\System\RJmwarB.exe

C:\Windows\System\RJmwarB.exe

C:\Windows\System\LGVXOqw.exe

C:\Windows\System\LGVXOqw.exe

C:\Windows\System\MBSGilR.exe

C:\Windows\System\MBSGilR.exe

C:\Windows\System\glWeXFh.exe

C:\Windows\System\glWeXFh.exe

C:\Windows\System\ecmwLdg.exe

C:\Windows\System\ecmwLdg.exe

C:\Windows\System\EvFlRll.exe

C:\Windows\System\EvFlRll.exe

C:\Windows\System\hOzBvuC.exe

C:\Windows\System\hOzBvuC.exe

C:\Windows\System\Ekfssns.exe

C:\Windows\System\Ekfssns.exe

C:\Windows\System\aqzrbME.exe

C:\Windows\System\aqzrbME.exe

C:\Windows\System\BfpgVhv.exe

C:\Windows\System\BfpgVhv.exe

C:\Windows\System\XLddGfY.exe

C:\Windows\System\XLddGfY.exe

C:\Windows\System\RiEEDSz.exe

C:\Windows\System\RiEEDSz.exe

C:\Windows\System\KeuOYmV.exe

C:\Windows\System\KeuOYmV.exe

C:\Windows\System\AHAKiSf.exe

C:\Windows\System\AHAKiSf.exe

C:\Windows\System\CHnMdZC.exe

C:\Windows\System\CHnMdZC.exe

C:\Windows\System\zhscIxW.exe

C:\Windows\System\zhscIxW.exe

C:\Windows\System\MarcJua.exe

C:\Windows\System\MarcJua.exe

C:\Windows\System\TiNvvdI.exe

C:\Windows\System\TiNvvdI.exe

C:\Windows\System\xsVwhuG.exe

C:\Windows\System\xsVwhuG.exe

C:\Windows\System\NsNDhUy.exe

C:\Windows\System\NsNDhUy.exe

C:\Windows\System\qcDOtxQ.exe

C:\Windows\System\qcDOtxQ.exe

C:\Windows\System\HjxKRNt.exe

C:\Windows\System\HjxKRNt.exe

C:\Windows\System\RZEIkZj.exe

C:\Windows\System\RZEIkZj.exe

C:\Windows\System\xWJXICE.exe

C:\Windows\System\xWJXICE.exe

C:\Windows\System\hmYUbDU.exe

C:\Windows\System\hmYUbDU.exe

C:\Windows\System\APniQhu.exe

C:\Windows\System\APniQhu.exe

C:\Windows\System\uBtZAYb.exe

C:\Windows\System\uBtZAYb.exe

C:\Windows\System\tYxeiXI.exe

C:\Windows\System\tYxeiXI.exe

C:\Windows\System\SFaHiVf.exe

C:\Windows\System\SFaHiVf.exe

C:\Windows\System\VnQdYzS.exe

C:\Windows\System\VnQdYzS.exe

C:\Windows\System\XtPHtLX.exe

C:\Windows\System\XtPHtLX.exe

C:\Windows\System\HbFRQTW.exe

C:\Windows\System\HbFRQTW.exe

C:\Windows\System\AQhrkUv.exe

C:\Windows\System\AQhrkUv.exe

C:\Windows\System\oyKtoVN.exe

C:\Windows\System\oyKtoVN.exe

C:\Windows\System\ScRedax.exe

C:\Windows\System\ScRedax.exe

C:\Windows\System\JkHcRxU.exe

C:\Windows\System\JkHcRxU.exe

C:\Windows\System\teLHfOM.exe

C:\Windows\System\teLHfOM.exe

C:\Windows\System\rRMNcjz.exe

C:\Windows\System\rRMNcjz.exe

C:\Windows\System\jReyuap.exe

C:\Windows\System\jReyuap.exe

C:\Windows\System\DbniKPr.exe

C:\Windows\System\DbniKPr.exe

C:\Windows\System\inBdRxg.exe

C:\Windows\System\inBdRxg.exe

C:\Windows\System\yalxVfF.exe

C:\Windows\System\yalxVfF.exe

C:\Windows\System\xNDepPW.exe

C:\Windows\System\xNDepPW.exe

C:\Windows\System\hqCzJOq.exe

C:\Windows\System\hqCzJOq.exe

C:\Windows\System\IQBqPfF.exe

C:\Windows\System\IQBqPfF.exe

C:\Windows\System\SwFyLZR.exe

C:\Windows\System\SwFyLZR.exe

C:\Windows\System\yPomsVY.exe

C:\Windows\System\yPomsVY.exe

C:\Windows\System\jNKHLkX.exe

C:\Windows\System\jNKHLkX.exe

C:\Windows\System\VJcaZCL.exe

C:\Windows\System\VJcaZCL.exe

C:\Windows\System\pfbASwL.exe

C:\Windows\System\pfbASwL.exe

C:\Windows\System\yzArCrX.exe

C:\Windows\System\yzArCrX.exe

C:\Windows\System\rAxECXK.exe

C:\Windows\System\rAxECXK.exe

C:\Windows\System\WDKyCtT.exe

C:\Windows\System\WDKyCtT.exe

C:\Windows\System\jbqRLHb.exe

C:\Windows\System\jbqRLHb.exe

C:\Windows\System\vGeZSJl.exe

C:\Windows\System\vGeZSJl.exe

C:\Windows\System\uwnRngP.exe

C:\Windows\System\uwnRngP.exe

C:\Windows\System\vIKuJoI.exe

C:\Windows\System\vIKuJoI.exe

C:\Windows\System\FDVenCA.exe

C:\Windows\System\FDVenCA.exe

C:\Windows\System\xItaTcF.exe

C:\Windows\System\xItaTcF.exe

C:\Windows\System\ZymPUcD.exe

C:\Windows\System\ZymPUcD.exe

C:\Windows\System\lmgPiUK.exe

C:\Windows\System\lmgPiUK.exe

C:\Windows\System\ILSFYXm.exe

C:\Windows\System\ILSFYXm.exe

C:\Windows\System\OBKHCYU.exe

C:\Windows\System\OBKHCYU.exe

C:\Windows\System\bHNgfIS.exe

C:\Windows\System\bHNgfIS.exe

C:\Windows\System\ohptvMU.exe

C:\Windows\System\ohptvMU.exe

C:\Windows\System\QvossOa.exe

C:\Windows\System\QvossOa.exe

C:\Windows\System\JQkAXTC.exe

C:\Windows\System\JQkAXTC.exe

C:\Windows\System\IBgZfyJ.exe

C:\Windows\System\IBgZfyJ.exe

C:\Windows\System\njplGWk.exe

C:\Windows\System\njplGWk.exe

C:\Windows\System\MKZCtES.exe

C:\Windows\System\MKZCtES.exe

C:\Windows\System\ivqmdZS.exe

C:\Windows\System\ivqmdZS.exe

C:\Windows\System\LspFTHb.exe

C:\Windows\System\LspFTHb.exe

C:\Windows\System\CjMpIfS.exe

C:\Windows\System\CjMpIfS.exe

C:\Windows\System\BcBjiuH.exe

C:\Windows\System\BcBjiuH.exe

C:\Windows\System\MhvEjim.exe

C:\Windows\System\MhvEjim.exe

C:\Windows\System\qdQKkRn.exe

C:\Windows\System\qdQKkRn.exe

C:\Windows\System\eAyedRZ.exe

C:\Windows\System\eAyedRZ.exe

C:\Windows\System\UjouiRy.exe

C:\Windows\System\UjouiRy.exe

C:\Windows\System\TtLiKvY.exe

C:\Windows\System\TtLiKvY.exe

C:\Windows\System\QJLApAP.exe

C:\Windows\System\QJLApAP.exe

C:\Windows\System\mGjOLjM.exe

C:\Windows\System\mGjOLjM.exe

C:\Windows\System\yXZNGSR.exe

C:\Windows\System\yXZNGSR.exe

C:\Windows\System\STiSVzt.exe

C:\Windows\System\STiSVzt.exe

C:\Windows\System\TvOmZNB.exe

C:\Windows\System\TvOmZNB.exe

C:\Windows\System\nSdEOKl.exe

C:\Windows\System\nSdEOKl.exe

C:\Windows\System\mYyiuDX.exe

C:\Windows\System\mYyiuDX.exe

C:\Windows\System\MoqoSas.exe

C:\Windows\System\MoqoSas.exe

C:\Windows\System\JiutXiY.exe

C:\Windows\System\JiutXiY.exe

C:\Windows\System\FzbYaPq.exe

C:\Windows\System\FzbYaPq.exe

C:\Windows\System\GcLlldw.exe

C:\Windows\System\GcLlldw.exe

C:\Windows\System\KhhsjKa.exe

C:\Windows\System\KhhsjKa.exe

C:\Windows\System\xquKUun.exe

C:\Windows\System\xquKUun.exe

C:\Windows\System\jEekORQ.exe

C:\Windows\System\jEekORQ.exe

C:\Windows\System\ooIgBkk.exe

C:\Windows\System\ooIgBkk.exe

C:\Windows\System\PsNzhad.exe

C:\Windows\System\PsNzhad.exe

C:\Windows\System\qoinvHK.exe

C:\Windows\System\qoinvHK.exe

C:\Windows\System\KBkUJbT.exe

C:\Windows\System\KBkUJbT.exe

C:\Windows\System\cMhZDtI.exe

C:\Windows\System\cMhZDtI.exe

C:\Windows\System\ZknjCZu.exe

C:\Windows\System\ZknjCZu.exe

C:\Windows\System\vHnUkef.exe

C:\Windows\System\vHnUkef.exe

C:\Windows\System\xywfutQ.exe

C:\Windows\System\xywfutQ.exe

C:\Windows\System\UfwKNWH.exe

C:\Windows\System\UfwKNWH.exe

C:\Windows\System\QEhqpXe.exe

C:\Windows\System\QEhqpXe.exe

C:\Windows\System\mMGvrWM.exe

C:\Windows\System\mMGvrWM.exe

C:\Windows\System\UHkVMxR.exe

C:\Windows\System\UHkVMxR.exe

C:\Windows\System\wWDBsMc.exe

C:\Windows\System\wWDBsMc.exe

C:\Windows\System\TlqbTNv.exe

C:\Windows\System\TlqbTNv.exe

C:\Windows\System\iOaBbjD.exe

C:\Windows\System\iOaBbjD.exe

C:\Windows\System\AMXaBVK.exe

C:\Windows\System\AMXaBVK.exe

C:\Windows\System\etkxypE.exe

C:\Windows\System\etkxypE.exe

C:\Windows\System\AJeNAvl.exe

C:\Windows\System\AJeNAvl.exe

C:\Windows\System\KeQmwgJ.exe

C:\Windows\System\KeQmwgJ.exe

C:\Windows\System\GnkMzRe.exe

C:\Windows\System\GnkMzRe.exe

C:\Windows\System\spvmqfW.exe

C:\Windows\System\spvmqfW.exe

C:\Windows\System\uxsMyGm.exe

C:\Windows\System\uxsMyGm.exe

C:\Windows\System\WhgtWHz.exe

C:\Windows\System\WhgtWHz.exe

C:\Windows\System\ihujLLs.exe

C:\Windows\System\ihujLLs.exe

C:\Windows\System\jOLKuAv.exe

C:\Windows\System\jOLKuAv.exe

C:\Windows\System\sPYIcwg.exe

C:\Windows\System\sPYIcwg.exe

C:\Windows\System\Whevkrd.exe

C:\Windows\System\Whevkrd.exe

C:\Windows\System\wxnEfVW.exe

C:\Windows\System\wxnEfVW.exe

C:\Windows\System\hywiapu.exe

C:\Windows\System\hywiapu.exe

C:\Windows\System\OCxlsFq.exe

C:\Windows\System\OCxlsFq.exe

C:\Windows\System\kWfWnhM.exe

C:\Windows\System\kWfWnhM.exe

C:\Windows\System\fHZsAfR.exe

C:\Windows\System\fHZsAfR.exe

C:\Windows\System\aZtDhlA.exe

C:\Windows\System\aZtDhlA.exe

C:\Windows\System\oripAAi.exe

C:\Windows\System\oripAAi.exe

C:\Windows\System\JgIZEtn.exe

C:\Windows\System\JgIZEtn.exe

C:\Windows\System\CUYOAth.exe

C:\Windows\System\CUYOAth.exe

C:\Windows\System\oWAEvsC.exe

C:\Windows\System\oWAEvsC.exe

C:\Windows\System\vEtgMfg.exe

C:\Windows\System\vEtgMfg.exe

C:\Windows\System\ejpvVFL.exe

C:\Windows\System\ejpvVFL.exe

C:\Windows\System\NmtggmE.exe

C:\Windows\System\NmtggmE.exe

C:\Windows\System\kySUEDg.exe

C:\Windows\System\kySUEDg.exe

C:\Windows\System\TcVqwUA.exe

C:\Windows\System\TcVqwUA.exe

C:\Windows\System\uwGuykx.exe

C:\Windows\System\uwGuykx.exe

C:\Windows\System\ZXRvevz.exe

C:\Windows\System\ZXRvevz.exe

C:\Windows\System\pghxQKl.exe

C:\Windows\System\pghxQKl.exe

C:\Windows\System\rIjSHzZ.exe

C:\Windows\System\rIjSHzZ.exe

C:\Windows\System\fOssSll.exe

C:\Windows\System\fOssSll.exe

C:\Windows\System\PPtDxuM.exe

C:\Windows\System\PPtDxuM.exe

C:\Windows\System\yAxEhvh.exe

C:\Windows\System\yAxEhvh.exe

C:\Windows\System\PCLEROc.exe

C:\Windows\System\PCLEROc.exe

C:\Windows\System\qSxpGFQ.exe

C:\Windows\System\qSxpGFQ.exe

C:\Windows\System\bYPMKcA.exe

C:\Windows\System\bYPMKcA.exe

C:\Windows\System\ZRWCqkd.exe

C:\Windows\System\ZRWCqkd.exe

C:\Windows\System\dVBWsDE.exe

C:\Windows\System\dVBWsDE.exe

C:\Windows\System\jQrAfSZ.exe

C:\Windows\System\jQrAfSZ.exe

C:\Windows\System\WxoQbNG.exe

C:\Windows\System\WxoQbNG.exe

C:\Windows\System\WaJnHwt.exe

C:\Windows\System\WaJnHwt.exe

C:\Windows\System\hGcvUng.exe

C:\Windows\System\hGcvUng.exe

C:\Windows\System\ieGAexp.exe

C:\Windows\System\ieGAexp.exe

C:\Windows\System\ALqEiQz.exe

C:\Windows\System\ALqEiQz.exe

C:\Windows\System\waLLPVd.exe

C:\Windows\System\waLLPVd.exe

C:\Windows\System\AVilNaY.exe

C:\Windows\System\AVilNaY.exe

C:\Windows\System\cDHJQqV.exe

C:\Windows\System\cDHJQqV.exe

C:\Windows\System\dLdfGPd.exe

C:\Windows\System\dLdfGPd.exe

C:\Windows\System\YCGMorS.exe

C:\Windows\System\YCGMorS.exe

C:\Windows\System\vODbZla.exe

C:\Windows\System\vODbZla.exe

C:\Windows\System\GWkXIin.exe

C:\Windows\System\GWkXIin.exe

C:\Windows\System\glvswKp.exe

C:\Windows\System\glvswKp.exe

C:\Windows\System\fcwmWwp.exe

C:\Windows\System\fcwmWwp.exe

C:\Windows\System\CMDSaHU.exe

C:\Windows\System\CMDSaHU.exe

C:\Windows\System\XpmNEVR.exe

C:\Windows\System\XpmNEVR.exe

C:\Windows\System\tdkdfeQ.exe

C:\Windows\System\tdkdfeQ.exe

C:\Windows\System\JxrlZfr.exe

C:\Windows\System\JxrlZfr.exe

C:\Windows\System\gewGdcN.exe

C:\Windows\System\gewGdcN.exe

C:\Windows\System\GHbKcTQ.exe

C:\Windows\System\GHbKcTQ.exe

C:\Windows\System\lOnZNJw.exe

C:\Windows\System\lOnZNJw.exe

C:\Windows\System\pqJhExN.exe

C:\Windows\System\pqJhExN.exe

C:\Windows\System\CqXtBiI.exe

C:\Windows\System\CqXtBiI.exe

C:\Windows\System\KZqnGRW.exe

C:\Windows\System\KZqnGRW.exe

C:\Windows\System\RNqsXWf.exe

C:\Windows\System\RNqsXWf.exe

C:\Windows\System\SqkyxkT.exe

C:\Windows\System\SqkyxkT.exe

C:\Windows\System\GZsFhOo.exe

C:\Windows\System\GZsFhOo.exe

C:\Windows\System\nLxagGu.exe

C:\Windows\System\nLxagGu.exe

C:\Windows\System\DKcpawr.exe

C:\Windows\System\DKcpawr.exe

C:\Windows\System\ntEzDPj.exe

C:\Windows\System\ntEzDPj.exe

C:\Windows\System\XUXzszZ.exe

C:\Windows\System\XUXzszZ.exe

C:\Windows\System\MuwZqVz.exe

C:\Windows\System\MuwZqVz.exe

C:\Windows\System\btRJXop.exe

C:\Windows\System\btRJXop.exe

C:\Windows\System\AyQUEhb.exe

C:\Windows\System\AyQUEhb.exe

C:\Windows\System\hyDbLPR.exe

C:\Windows\System\hyDbLPR.exe

C:\Windows\System\ckzLkVg.exe

C:\Windows\System\ckzLkVg.exe

C:\Windows\System\RYcKFSO.exe

C:\Windows\System\RYcKFSO.exe

C:\Windows\System\gEqaXOF.exe

C:\Windows\System\gEqaXOF.exe

C:\Windows\System\QJcXDwK.exe

C:\Windows\System\QJcXDwK.exe

C:\Windows\System\TFpdjPX.exe

C:\Windows\System\TFpdjPX.exe

C:\Windows\System\qQZsFkd.exe

C:\Windows\System\qQZsFkd.exe

C:\Windows\System\QAuikqC.exe

C:\Windows\System\QAuikqC.exe

C:\Windows\System\lwuycLF.exe

C:\Windows\System\lwuycLF.exe

C:\Windows\System\TzZYNhX.exe

C:\Windows\System\TzZYNhX.exe

C:\Windows\System\wBvqnaU.exe

C:\Windows\System\wBvqnaU.exe

C:\Windows\System\bQLVHqh.exe

C:\Windows\System\bQLVHqh.exe

C:\Windows\System\uQEZnzK.exe

C:\Windows\System\uQEZnzK.exe

C:\Windows\System\scqBTPb.exe

C:\Windows\System\scqBTPb.exe

C:\Windows\System\AvQBZIk.exe

C:\Windows\System\AvQBZIk.exe

C:\Windows\System\bqCTJjy.exe

C:\Windows\System\bqCTJjy.exe

C:\Windows\System\qSYtxMM.exe

C:\Windows\System\qSYtxMM.exe

C:\Windows\System\HlMaIVc.exe

C:\Windows\System\HlMaIVc.exe

C:\Windows\System\YJmctjF.exe

C:\Windows\System\YJmctjF.exe

C:\Windows\System\rzFXnkl.exe

C:\Windows\System\rzFXnkl.exe

C:\Windows\System\yzZYagc.exe

C:\Windows\System\yzZYagc.exe

C:\Windows\System\mqdiile.exe

C:\Windows\System\mqdiile.exe

C:\Windows\System\ZXiCoWU.exe

C:\Windows\System\ZXiCoWU.exe

C:\Windows\System\tidXzAp.exe

C:\Windows\System\tidXzAp.exe

C:\Windows\System\qyjBsFS.exe

C:\Windows\System\qyjBsFS.exe

C:\Windows\System\tMlUpkq.exe

C:\Windows\System\tMlUpkq.exe

C:\Windows\System\rljRSCT.exe

C:\Windows\System\rljRSCT.exe

C:\Windows\System\CrmvQqX.exe

C:\Windows\System\CrmvQqX.exe

C:\Windows\System\kZuoWCH.exe

C:\Windows\System\kZuoWCH.exe

C:\Windows\System\TnViSEQ.exe

C:\Windows\System\TnViSEQ.exe

C:\Windows\System\VAxVDnD.exe

C:\Windows\System\VAxVDnD.exe

C:\Windows\System\XoaaSjX.exe

C:\Windows\System\XoaaSjX.exe

C:\Windows\System\tKLNkJa.exe

C:\Windows\System\tKLNkJa.exe

C:\Windows\System\gjQdYCu.exe

C:\Windows\System\gjQdYCu.exe

C:\Windows\System\CyqPUau.exe

C:\Windows\System\CyqPUau.exe

C:\Windows\System\ognoWVn.exe

C:\Windows\System\ognoWVn.exe

C:\Windows\System\jnufudH.exe

C:\Windows\System\jnufudH.exe

C:\Windows\System\SnMPdaB.exe

C:\Windows\System\SnMPdaB.exe

C:\Windows\System\YatPJQz.exe

C:\Windows\System\YatPJQz.exe

C:\Windows\System\WdKmXtk.exe

C:\Windows\System\WdKmXtk.exe

C:\Windows\System\yalOfuV.exe

C:\Windows\System\yalOfuV.exe

C:\Windows\System\MBUIErj.exe

C:\Windows\System\MBUIErj.exe

C:\Windows\System\BQWIjaB.exe

C:\Windows\System\BQWIjaB.exe

C:\Windows\System\iTMRXlZ.exe

C:\Windows\System\iTMRXlZ.exe

C:\Windows\System\cAMmlPy.exe

C:\Windows\System\cAMmlPy.exe

C:\Windows\System\SFGcVwc.exe

C:\Windows\System\SFGcVwc.exe

C:\Windows\System\rCexkBA.exe

C:\Windows\System\rCexkBA.exe

C:\Windows\System\UDvxVvn.exe

C:\Windows\System\UDvxVvn.exe

C:\Windows\System\LuUFuKC.exe

C:\Windows\System\LuUFuKC.exe

C:\Windows\System\nOLGnPx.exe

C:\Windows\System\nOLGnPx.exe

C:\Windows\System\pHXIuRB.exe

C:\Windows\System\pHXIuRB.exe

C:\Windows\System\pIvdmbw.exe

C:\Windows\System\pIvdmbw.exe

C:\Windows\System\evGQqtZ.exe

C:\Windows\System\evGQqtZ.exe

C:\Windows\System\lWvlWkI.exe

C:\Windows\System\lWvlWkI.exe

C:\Windows\System\IPocYVx.exe

C:\Windows\System\IPocYVx.exe

C:\Windows\System\wYfMKaC.exe

C:\Windows\System\wYfMKaC.exe

C:\Windows\System\XRKEDma.exe

C:\Windows\System\XRKEDma.exe

C:\Windows\System\gJMIrPI.exe

C:\Windows\System\gJMIrPI.exe

C:\Windows\System\KVEaPAD.exe

C:\Windows\System\KVEaPAD.exe

C:\Windows\System\ErQoxAZ.exe

C:\Windows\System\ErQoxAZ.exe

C:\Windows\System\JsPAuLI.exe

C:\Windows\System\JsPAuLI.exe

C:\Windows\System\lRXAXrB.exe

C:\Windows\System\lRXAXrB.exe

C:\Windows\System\JsJqSrz.exe

C:\Windows\System\JsJqSrz.exe

C:\Windows\System\CjasBPv.exe

C:\Windows\System\CjasBPv.exe

C:\Windows\System\hcJJrbj.exe

C:\Windows\System\hcJJrbj.exe

C:\Windows\System\yjqZIlf.exe

C:\Windows\System\yjqZIlf.exe

C:\Windows\System\RWOfJIQ.exe

C:\Windows\System\RWOfJIQ.exe

C:\Windows\System\NdsCBbz.exe

C:\Windows\System\NdsCBbz.exe

C:\Windows\System\Qdpehff.exe

C:\Windows\System\Qdpehff.exe

C:\Windows\System\dKCbgWQ.exe

C:\Windows\System\dKCbgWQ.exe

C:\Windows\System\GamhSsU.exe

C:\Windows\System\GamhSsU.exe

C:\Windows\System\UvBDiBw.exe

C:\Windows\System\UvBDiBw.exe

C:\Windows\System\GgSDscb.exe

C:\Windows\System\GgSDscb.exe

C:\Windows\System\DOJgVsI.exe

C:\Windows\System\DOJgVsI.exe

C:\Windows\System\wKmqvIk.exe

C:\Windows\System\wKmqvIk.exe

C:\Windows\System\RAvoFZp.exe

C:\Windows\System\RAvoFZp.exe

C:\Windows\System\CZpAyAc.exe

C:\Windows\System\CZpAyAc.exe

C:\Windows\System\dIkXjbe.exe

C:\Windows\System\dIkXjbe.exe

C:\Windows\System\pnxsxJJ.exe

C:\Windows\System\pnxsxJJ.exe

C:\Windows\System\yPEMOzs.exe

C:\Windows\System\yPEMOzs.exe

C:\Windows\System\dYsNXgP.exe

C:\Windows\System\dYsNXgP.exe

C:\Windows\System\QWgrZYH.exe

C:\Windows\System\QWgrZYH.exe

C:\Windows\System\JFEVtwp.exe

C:\Windows\System\JFEVtwp.exe

C:\Windows\System\hNaMLqH.exe

C:\Windows\System\hNaMLqH.exe

C:\Windows\System\XaClgzj.exe

C:\Windows\System\XaClgzj.exe

C:\Windows\System\ddpjLNM.exe

C:\Windows\System\ddpjLNM.exe

C:\Windows\System\YnhOKtz.exe

C:\Windows\System\YnhOKtz.exe

C:\Windows\System\loHNErE.exe

C:\Windows\System\loHNErE.exe

C:\Windows\System\khvqJZT.exe

C:\Windows\System\khvqJZT.exe

C:\Windows\System\FmHFcns.exe

C:\Windows\System\FmHFcns.exe

C:\Windows\System\eljGncX.exe

C:\Windows\System\eljGncX.exe

C:\Windows\System\nXnUGpX.exe

C:\Windows\System\nXnUGpX.exe

C:\Windows\System\VBNDIQC.exe

C:\Windows\System\VBNDIQC.exe

C:\Windows\System\CizganF.exe

C:\Windows\System\CizganF.exe

C:\Windows\System\xQlsycI.exe

C:\Windows\System\xQlsycI.exe

C:\Windows\System\qnqvlpR.exe

C:\Windows\System\qnqvlpR.exe

C:\Windows\System\dFVblnS.exe

C:\Windows\System\dFVblnS.exe

C:\Windows\System\HlQfMGT.exe

C:\Windows\System\HlQfMGT.exe

C:\Windows\System\AHNiuoP.exe

C:\Windows\System\AHNiuoP.exe

C:\Windows\System\YwAOTys.exe

C:\Windows\System\YwAOTys.exe

C:\Windows\System\nwQPOqG.exe

C:\Windows\System\nwQPOqG.exe

C:\Windows\System\bhuZvzL.exe

C:\Windows\System\bhuZvzL.exe

C:\Windows\System\hXEVnjd.exe

C:\Windows\System\hXEVnjd.exe

C:\Windows\System\oEgpBiz.exe

C:\Windows\System\oEgpBiz.exe

C:\Windows\System\oBcxCbh.exe

C:\Windows\System\oBcxCbh.exe

C:\Windows\System\qIXnILM.exe

C:\Windows\System\qIXnILM.exe

C:\Windows\System\JyJYnqD.exe

C:\Windows\System\JyJYnqD.exe

C:\Windows\System\vRgttWG.exe

C:\Windows\System\vRgttWG.exe

C:\Windows\System\aOgkPip.exe

C:\Windows\System\aOgkPip.exe

C:\Windows\System\dUlwUoZ.exe

C:\Windows\System\dUlwUoZ.exe

C:\Windows\System\qXmiccd.exe

C:\Windows\System\qXmiccd.exe

C:\Windows\System\QveXPij.exe

C:\Windows\System\QveXPij.exe

C:\Windows\System\BYvwERS.exe

C:\Windows\System\BYvwERS.exe

C:\Windows\System\KJkgOhe.exe

C:\Windows\System\KJkgOhe.exe

C:\Windows\System\sDuDxPt.exe

C:\Windows\System\sDuDxPt.exe

C:\Windows\System\wddAZlW.exe

C:\Windows\System\wddAZlW.exe

C:\Windows\System\vdoyRPO.exe

C:\Windows\System\vdoyRPO.exe

C:\Windows\System\LCDSHzX.exe

C:\Windows\System\LCDSHzX.exe

C:\Windows\System\UShpgXv.exe

C:\Windows\System\UShpgXv.exe

C:\Windows\System\yXkQnia.exe

C:\Windows\System\yXkQnia.exe

C:\Windows\System\TOMbKCt.exe

C:\Windows\System\TOMbKCt.exe

C:\Windows\System\TnNXdve.exe

C:\Windows\System\TnNXdve.exe

C:\Windows\System\FSZPFlQ.exe

C:\Windows\System\FSZPFlQ.exe

C:\Windows\System\kVpsktu.exe

C:\Windows\System\kVpsktu.exe

C:\Windows\System\QItKLiI.exe

C:\Windows\System\QItKLiI.exe

C:\Windows\System\xiLkKmZ.exe

C:\Windows\System\xiLkKmZ.exe

C:\Windows\System\oVArBpQ.exe

C:\Windows\System\oVArBpQ.exe

C:\Windows\System\xlihWFb.exe

C:\Windows\System\xlihWFb.exe

C:\Windows\System\QgbvZUM.exe

C:\Windows\System\QgbvZUM.exe

C:\Windows\System\yjPomBu.exe

C:\Windows\System\yjPomBu.exe

C:\Windows\System\cPfYamA.exe

C:\Windows\System\cPfYamA.exe

C:\Windows\System\CAWtYoH.exe

C:\Windows\System\CAWtYoH.exe

C:\Windows\System\oZwWrQo.exe

C:\Windows\System\oZwWrQo.exe

C:\Windows\System\yJshrZn.exe

C:\Windows\System\yJshrZn.exe

C:\Windows\System\usivOPQ.exe

C:\Windows\System\usivOPQ.exe

C:\Windows\System\RmPNkPX.exe

C:\Windows\System\RmPNkPX.exe

C:\Windows\System\CzmwVRT.exe

C:\Windows\System\CzmwVRT.exe

C:\Windows\System\ABKmURp.exe

C:\Windows\System\ABKmURp.exe

C:\Windows\System\YIdqQPs.exe

C:\Windows\System\YIdqQPs.exe

C:\Windows\System\uzyobkr.exe

C:\Windows\System\uzyobkr.exe

C:\Windows\System\MqMRYBT.exe

C:\Windows\System\MqMRYBT.exe

C:\Windows\System\ZOGEcTH.exe

C:\Windows\System\ZOGEcTH.exe

C:\Windows\System\WtVsUBZ.exe

C:\Windows\System\WtVsUBZ.exe

C:\Windows\System\SVrnDlj.exe

C:\Windows\System\SVrnDlj.exe

C:\Windows\System\LkLIKxL.exe

C:\Windows\System\LkLIKxL.exe

C:\Windows\System\zgLKZey.exe

C:\Windows\System\zgLKZey.exe

C:\Windows\System\CBVOGKQ.exe

C:\Windows\System\CBVOGKQ.exe

C:\Windows\System\uVKJIZI.exe

C:\Windows\System\uVKJIZI.exe

C:\Windows\System\IfgzKku.exe

C:\Windows\System\IfgzKku.exe

C:\Windows\System\zWVQQrF.exe

C:\Windows\System\zWVQQrF.exe

C:\Windows\System\QgqMACj.exe

C:\Windows\System\QgqMACj.exe

C:\Windows\System\ePXHwkg.exe

C:\Windows\System\ePXHwkg.exe

C:\Windows\System\SycnmBZ.exe

C:\Windows\System\SycnmBZ.exe

C:\Windows\System\mVnPunN.exe

C:\Windows\System\mVnPunN.exe

C:\Windows\System\YPoKlze.exe

C:\Windows\System\YPoKlze.exe

C:\Windows\System\jRnoKkx.exe

C:\Windows\System\jRnoKkx.exe

C:\Windows\System\GOvsYcd.exe

C:\Windows\System\GOvsYcd.exe

C:\Windows\System\rfIlPCQ.exe

C:\Windows\System\rfIlPCQ.exe

C:\Windows\System\nxDwALm.exe

C:\Windows\System\nxDwALm.exe

C:\Windows\System\iHnRPGo.exe

C:\Windows\System\iHnRPGo.exe

C:\Windows\System\jHwtHuk.exe

C:\Windows\System\jHwtHuk.exe

C:\Windows\System\HnewkxM.exe

C:\Windows\System\HnewkxM.exe

C:\Windows\System\IjVpSby.exe

C:\Windows\System\IjVpSby.exe

C:\Windows\System\ezEPEAX.exe

C:\Windows\System\ezEPEAX.exe

C:\Windows\System\IXMgxCp.exe

C:\Windows\System\IXMgxCp.exe

C:\Windows\System\YufPmAn.exe

C:\Windows\System\YufPmAn.exe

C:\Windows\System\essUpNa.exe

C:\Windows\System\essUpNa.exe

C:\Windows\System\UYJeypZ.exe

C:\Windows\System\UYJeypZ.exe

C:\Windows\System\mHSbKME.exe

C:\Windows\System\mHSbKME.exe

C:\Windows\System\BArYCxd.exe

C:\Windows\System\BArYCxd.exe

C:\Windows\System\wyNbtTT.exe

C:\Windows\System\wyNbtTT.exe

C:\Windows\System\slHwQrq.exe

C:\Windows\System\slHwQrq.exe

C:\Windows\System\ufKPAcv.exe

C:\Windows\System\ufKPAcv.exe

C:\Windows\System\eBxvXMt.exe

C:\Windows\System\eBxvXMt.exe

C:\Windows\System\epARqlh.exe

C:\Windows\System\epARqlh.exe

C:\Windows\System\lOnDVDn.exe

C:\Windows\System\lOnDVDn.exe

C:\Windows\System\KCjnLUn.exe

C:\Windows\System\KCjnLUn.exe

C:\Windows\System\pewUMSf.exe

C:\Windows\System\pewUMSf.exe

C:\Windows\System\beGWVVq.exe

C:\Windows\System\beGWVVq.exe

C:\Windows\System\DMgPVAJ.exe

C:\Windows\System\DMgPVAJ.exe

C:\Windows\System\qETFcEj.exe

C:\Windows\System\qETFcEj.exe

C:\Windows\System\sxEHWWN.exe

C:\Windows\System\sxEHWWN.exe

C:\Windows\System\wRnQDIV.exe

C:\Windows\System\wRnQDIV.exe

C:\Windows\System\GOjefRR.exe

C:\Windows\System\GOjefRR.exe

C:\Windows\System\mDWBCSP.exe

C:\Windows\System\mDWBCSP.exe

C:\Windows\System\HnIcCpj.exe

C:\Windows\System\HnIcCpj.exe

C:\Windows\System\LuRPnaY.exe

C:\Windows\System\LuRPnaY.exe

C:\Windows\System\QcWwEnt.exe

C:\Windows\System\QcWwEnt.exe

C:\Windows\System\MRmeHAD.exe

C:\Windows\System\MRmeHAD.exe

C:\Windows\System\dPLTqin.exe

C:\Windows\System\dPLTqin.exe

C:\Windows\System\MZNmbKa.exe

C:\Windows\System\MZNmbKa.exe

C:\Windows\System\BrlEFJT.exe

C:\Windows\System\BrlEFJT.exe

C:\Windows\System\ubiNsST.exe

C:\Windows\System\ubiNsST.exe

C:\Windows\System\WvONseh.exe

C:\Windows\System\WvONseh.exe

C:\Windows\System\GeBcsCe.exe

C:\Windows\System\GeBcsCe.exe

C:\Windows\System\HOFgIyZ.exe

C:\Windows\System\HOFgIyZ.exe

C:\Windows\System\ieNBwbt.exe

C:\Windows\System\ieNBwbt.exe

C:\Windows\System\SohbHZE.exe

C:\Windows\System\SohbHZE.exe

C:\Windows\System\lgQwAsI.exe

C:\Windows\System\lgQwAsI.exe

C:\Windows\System\bjCpcoe.exe

C:\Windows\System\bjCpcoe.exe

C:\Windows\System\AoLIInV.exe

C:\Windows\System\AoLIInV.exe

C:\Windows\System\GiChSNl.exe

C:\Windows\System\GiChSNl.exe

C:\Windows\System\yGpxCnZ.exe

C:\Windows\System\yGpxCnZ.exe

C:\Windows\System\eUyDHQw.exe

C:\Windows\System\eUyDHQw.exe

C:\Windows\System\CUVfsQN.exe

C:\Windows\System\CUVfsQN.exe

C:\Windows\System\gvYRyjR.exe

C:\Windows\System\gvYRyjR.exe

C:\Windows\System\QzehrHu.exe

C:\Windows\System\QzehrHu.exe

C:\Windows\System\wbZLyeJ.exe

C:\Windows\System\wbZLyeJ.exe

C:\Windows\System\QerGCPq.exe

C:\Windows\System\QerGCPq.exe

C:\Windows\System\bPgqNvd.exe

C:\Windows\System\bPgqNvd.exe

C:\Windows\System\CyHPdsR.exe

C:\Windows\System\CyHPdsR.exe

C:\Windows\System\OnDuOsK.exe

C:\Windows\System\OnDuOsK.exe

C:\Windows\System\XkhXuIZ.exe

C:\Windows\System\XkhXuIZ.exe

C:\Windows\System\zeiFXFD.exe

C:\Windows\System\zeiFXFD.exe

C:\Windows\System\NReMMmz.exe

C:\Windows\System\NReMMmz.exe

C:\Windows\System\lLxMkBj.exe

C:\Windows\System\lLxMkBj.exe

C:\Windows\System\TlIvVOS.exe

C:\Windows\System\TlIvVOS.exe

C:\Windows\System\EElnLPH.exe

C:\Windows\System\EElnLPH.exe

C:\Windows\System\KQAGofq.exe

C:\Windows\System\KQAGofq.exe

C:\Windows\System\aCAIPQJ.exe

C:\Windows\System\aCAIPQJ.exe

C:\Windows\System\lXinEml.exe

C:\Windows\System\lXinEml.exe

C:\Windows\System\MOapBRO.exe

C:\Windows\System\MOapBRO.exe

C:\Windows\System\aKuqlJg.exe

C:\Windows\System\aKuqlJg.exe

C:\Windows\System\OLrpIxi.exe

C:\Windows\System\OLrpIxi.exe

C:\Windows\System\BXSuGiw.exe

C:\Windows\System\BXSuGiw.exe

C:\Windows\System\cRKBsux.exe

C:\Windows\System\cRKBsux.exe

C:\Windows\System\caYLeaz.exe

C:\Windows\System\caYLeaz.exe

C:\Windows\System\kkNDfXx.exe

C:\Windows\System\kkNDfXx.exe

C:\Windows\System\yCSYnZY.exe

C:\Windows\System\yCSYnZY.exe

C:\Windows\System\XuxliSx.exe

C:\Windows\System\XuxliSx.exe

C:\Windows\System\JBTVZZY.exe

C:\Windows\System\JBTVZZY.exe

C:\Windows\System\sRzZSbw.exe

C:\Windows\System\sRzZSbw.exe

C:\Windows\System\GwIarSG.exe

C:\Windows\System\GwIarSG.exe

C:\Windows\System\OxqKoTm.exe

C:\Windows\System\OxqKoTm.exe

C:\Windows\System\SgsuvFJ.exe

C:\Windows\System\SgsuvFJ.exe

C:\Windows\System\gULvQmD.exe

C:\Windows\System\gULvQmD.exe

C:\Windows\System\LKXAQkh.exe

C:\Windows\System\LKXAQkh.exe

C:\Windows\System\XqZdQtv.exe

C:\Windows\System\XqZdQtv.exe

C:\Windows\System\DHhlkMK.exe

C:\Windows\System\DHhlkMK.exe

C:\Windows\System\rzOYqPc.exe

C:\Windows\System\rzOYqPc.exe

C:\Windows\System\jqXBgET.exe

C:\Windows\System\jqXBgET.exe

C:\Windows\System\yXWhFaY.exe

C:\Windows\System\yXWhFaY.exe

C:\Windows\System\ErBMGDm.exe

C:\Windows\System\ErBMGDm.exe

C:\Windows\System\wWHaysH.exe

C:\Windows\System\wWHaysH.exe

C:\Windows\System\dfdtmMg.exe

C:\Windows\System\dfdtmMg.exe

C:\Windows\System\RyMrhSp.exe

C:\Windows\System\RyMrhSp.exe

C:\Windows\System\SoTApfK.exe

C:\Windows\System\SoTApfK.exe

C:\Windows\System\TOQFKzt.exe

C:\Windows\System\TOQFKzt.exe

C:\Windows\System\YuFrcMO.exe

C:\Windows\System\YuFrcMO.exe

C:\Windows\System\ICdrrqZ.exe

C:\Windows\System\ICdrrqZ.exe

C:\Windows\System\ActXjER.exe

C:\Windows\System\ActXjER.exe

C:\Windows\System\jrPwNZb.exe

C:\Windows\System\jrPwNZb.exe

C:\Windows\System\BPtLKcz.exe

C:\Windows\System\BPtLKcz.exe

C:\Windows\System\XpnBOKU.exe

C:\Windows\System\XpnBOKU.exe

C:\Windows\System\hfwTrVw.exe

C:\Windows\System\hfwTrVw.exe

C:\Windows\System\utFFkPs.exe

C:\Windows\System\utFFkPs.exe

C:\Windows\System\kgxmzoh.exe

C:\Windows\System\kgxmzoh.exe

C:\Windows\System\ANbQUXo.exe

C:\Windows\System\ANbQUXo.exe

C:\Windows\System\PIHssFO.exe

C:\Windows\System\PIHssFO.exe

C:\Windows\System\eTIONBN.exe

C:\Windows\System\eTIONBN.exe

C:\Windows\System\AncVbdL.exe

C:\Windows\System\AncVbdL.exe

C:\Windows\System\NRnEnRv.exe

C:\Windows\System\NRnEnRv.exe

C:\Windows\System\cYAmmgg.exe

C:\Windows\System\cYAmmgg.exe

C:\Windows\System\aoETYLs.exe

C:\Windows\System\aoETYLs.exe

C:\Windows\System\izXwUFF.exe

C:\Windows\System\izXwUFF.exe

C:\Windows\System\lnMuIvu.exe

C:\Windows\System\lnMuIvu.exe

C:\Windows\System\YSEYBjo.exe

C:\Windows\System\YSEYBjo.exe

C:\Windows\System\CMWdfBr.exe

C:\Windows\System\CMWdfBr.exe

C:\Windows\System\SDMnIig.exe

C:\Windows\System\SDMnIig.exe

C:\Windows\System\vmOlBkq.exe

C:\Windows\System\vmOlBkq.exe

C:\Windows\System\wSBBcYq.exe

C:\Windows\System\wSBBcYq.exe

C:\Windows\System\miCVIRc.exe

C:\Windows\System\miCVIRc.exe

C:\Windows\System\YMbAXNz.exe

C:\Windows\System\YMbAXNz.exe

C:\Windows\System\QmXEPeJ.exe

C:\Windows\System\QmXEPeJ.exe

C:\Windows\System\JfFeQHr.exe

C:\Windows\System\JfFeQHr.exe

C:\Windows\System\FAECGcT.exe

C:\Windows\System\FAECGcT.exe

C:\Windows\System\DFLQGnA.exe

C:\Windows\System\DFLQGnA.exe

C:\Windows\System\blvRXrw.exe

C:\Windows\System\blvRXrw.exe

C:\Windows\System\szLNQYX.exe

C:\Windows\System\szLNQYX.exe

C:\Windows\System\oPJmynz.exe

C:\Windows\System\oPJmynz.exe

C:\Windows\System\GohbtnE.exe

C:\Windows\System\GohbtnE.exe

C:\Windows\System\EMdwnZB.exe

C:\Windows\System\EMdwnZB.exe

C:\Windows\System\aIRCtXN.exe

C:\Windows\System\aIRCtXN.exe

C:\Windows\System\FydkpVz.exe

C:\Windows\System\FydkpVz.exe

C:\Windows\System\hVInyUE.exe

C:\Windows\System\hVInyUE.exe

C:\Windows\System\pcQCxGV.exe

C:\Windows\System\pcQCxGV.exe

C:\Windows\System\aQQaNmd.exe

C:\Windows\System\aQQaNmd.exe

C:\Windows\System\oUYasbt.exe

C:\Windows\System\oUYasbt.exe

C:\Windows\System\OylUDLG.exe

C:\Windows\System\OylUDLG.exe

C:\Windows\System\qhphGRu.exe

C:\Windows\System\qhphGRu.exe

C:\Windows\System\DLoxcaD.exe

C:\Windows\System\DLoxcaD.exe

C:\Windows\System\dAWEbKk.exe

C:\Windows\System\dAWEbKk.exe

C:\Windows\System\NyqMEzU.exe

C:\Windows\System\NyqMEzU.exe

C:\Windows\System\WkrmDlO.exe

C:\Windows\System\WkrmDlO.exe

C:\Windows\System\VbgoMYe.exe

C:\Windows\System\VbgoMYe.exe

C:\Windows\System\qKYSOQb.exe

C:\Windows\System\qKYSOQb.exe

C:\Windows\System\BPbvRNN.exe

C:\Windows\System\BPbvRNN.exe

C:\Windows\System\MuDyJun.exe

C:\Windows\System\MuDyJun.exe

C:\Windows\System\UGAJLDV.exe

C:\Windows\System\UGAJLDV.exe

C:\Windows\System\XirFFBD.exe

C:\Windows\System\XirFFBD.exe

C:\Windows\System\VxdzMDg.exe

C:\Windows\System\VxdzMDg.exe

C:\Windows\System\rAlwNmr.exe

C:\Windows\System\rAlwNmr.exe

C:\Windows\System\hSDQheb.exe

C:\Windows\System\hSDQheb.exe

C:\Windows\System\CErvKeo.exe

C:\Windows\System\CErvKeo.exe

C:\Windows\System\PUSHCRx.exe

C:\Windows\System\PUSHCRx.exe

C:\Windows\System\fUaItpO.exe

C:\Windows\System\fUaItpO.exe

C:\Windows\System\pTNmcao.exe

C:\Windows\System\pTNmcao.exe

C:\Windows\System\JfJoIcD.exe

C:\Windows\System\JfJoIcD.exe

C:\Windows\System\qvBDkqx.exe

C:\Windows\System\qvBDkqx.exe

C:\Windows\System\galzhXi.exe

C:\Windows\System\galzhXi.exe

C:\Windows\System\ZZSHehJ.exe

C:\Windows\System\ZZSHehJ.exe

C:\Windows\System\FavyQHR.exe

C:\Windows\System\FavyQHR.exe

C:\Windows\System\VbTRSdE.exe

C:\Windows\System\VbTRSdE.exe

C:\Windows\System\OLJbzFM.exe

C:\Windows\System\OLJbzFM.exe

C:\Windows\System\klSXYPV.exe

C:\Windows\System\klSXYPV.exe

C:\Windows\System\oooDgoW.exe

C:\Windows\System\oooDgoW.exe

C:\Windows\System\ohZDcmu.exe

C:\Windows\System\ohZDcmu.exe

C:\Windows\System\hbTPoyO.exe

C:\Windows\System\hbTPoyO.exe

C:\Windows\System\UNMmrzJ.exe

C:\Windows\System\UNMmrzJ.exe

C:\Windows\System\hgAjqJt.exe

C:\Windows\System\hgAjqJt.exe

C:\Windows\System\YBojYfw.exe

C:\Windows\System\YBojYfw.exe

C:\Windows\System\XinIwiY.exe

C:\Windows\System\XinIwiY.exe

C:\Windows\System\rsRQAex.exe

C:\Windows\System\rsRQAex.exe

C:\Windows\System\QGnggsI.exe

C:\Windows\System\QGnggsI.exe

C:\Windows\System\oVZuGKo.exe

C:\Windows\System\oVZuGKo.exe

C:\Windows\System\PQZtNqd.exe

C:\Windows\System\PQZtNqd.exe

C:\Windows\System\IQGlTOI.exe

C:\Windows\System\IQGlTOI.exe

C:\Windows\System\ftcabRD.exe

C:\Windows\System\ftcabRD.exe

C:\Windows\System\rRAolQo.exe

C:\Windows\System\rRAolQo.exe

C:\Windows\System\eYUFQUM.exe

C:\Windows\System\eYUFQUM.exe

C:\Windows\System\JkQCVvR.exe

C:\Windows\System\JkQCVvR.exe

C:\Windows\System\EjaAdig.exe

C:\Windows\System\EjaAdig.exe

C:\Windows\System\OjVcHeC.exe

C:\Windows\System\OjVcHeC.exe

C:\Windows\System\AUoVVuV.exe

C:\Windows\System\AUoVVuV.exe

C:\Windows\System\tNzGRAn.exe

C:\Windows\System\tNzGRAn.exe

C:\Windows\System\alkhWLm.exe

C:\Windows\System\alkhWLm.exe

C:\Windows\System\fXKqpMJ.exe

C:\Windows\System\fXKqpMJ.exe

C:\Windows\System\GmrAdjA.exe

C:\Windows\System\GmrAdjA.exe

C:\Windows\System\TiPuxOQ.exe

C:\Windows\System\TiPuxOQ.exe

C:\Windows\System\jQAyzcm.exe

C:\Windows\System\jQAyzcm.exe

C:\Windows\System\IDQrMQn.exe

C:\Windows\System\IDQrMQn.exe

C:\Windows\System\GeUZgin.exe

C:\Windows\System\GeUZgin.exe

C:\Windows\System\LevYTtT.exe

C:\Windows\System\LevYTtT.exe

C:\Windows\System\FDvdslD.exe

C:\Windows\System\FDvdslD.exe

C:\Windows\System\pRVGqqB.exe

C:\Windows\System\pRVGqqB.exe

C:\Windows\System\tJYLuqc.exe

C:\Windows\System\tJYLuqc.exe

C:\Windows\System\eamZeAW.exe

C:\Windows\System\eamZeAW.exe

C:\Windows\System\uxGXwfj.exe

C:\Windows\System\uxGXwfj.exe

C:\Windows\System\eXENkMM.exe

C:\Windows\System\eXENkMM.exe

C:\Windows\System\ElzCtbm.exe

C:\Windows\System\ElzCtbm.exe

C:\Windows\System\bGArhFD.exe

C:\Windows\System\bGArhFD.exe

C:\Windows\System\TaECUAv.exe

C:\Windows\System\TaECUAv.exe

C:\Windows\System\eYYcwEi.exe

C:\Windows\System\eYYcwEi.exe

C:\Windows\System\ehNKLIc.exe

C:\Windows\System\ehNKLIc.exe

C:\Windows\System\BXQabPQ.exe

C:\Windows\System\BXQabPQ.exe

C:\Windows\System\xaPTotl.exe

C:\Windows\System\xaPTotl.exe

C:\Windows\System\pmRXJLT.exe

C:\Windows\System\pmRXJLT.exe

C:\Windows\System\EhhzFgs.exe

C:\Windows\System\EhhzFgs.exe

C:\Windows\System\CSHQDiV.exe

C:\Windows\System\CSHQDiV.exe

C:\Windows\System\hcbcMLm.exe

C:\Windows\System\hcbcMLm.exe

C:\Windows\System\IUydRIe.exe

C:\Windows\System\IUydRIe.exe

C:\Windows\System\XAqIppU.exe

C:\Windows\System\XAqIppU.exe

C:\Windows\System\AGsfYmw.exe

C:\Windows\System\AGsfYmw.exe

C:\Windows\System\xSPnzIx.exe

C:\Windows\System\xSPnzIx.exe

C:\Windows\System\NVtPLBr.exe

C:\Windows\System\NVtPLBr.exe

C:\Windows\System\eKlOUst.exe

C:\Windows\System\eKlOUst.exe

C:\Windows\System\QCATePY.exe

C:\Windows\System\QCATePY.exe

C:\Windows\System\SSTolXF.exe

C:\Windows\System\SSTolXF.exe

C:\Windows\System\phmJYmx.exe

C:\Windows\System\phmJYmx.exe

C:\Windows\System\GKkgUKz.exe

C:\Windows\System\GKkgUKz.exe

C:\Windows\System\cdZfXGc.exe

C:\Windows\System\cdZfXGc.exe

C:\Windows\System\RygCTVh.exe

C:\Windows\System\RygCTVh.exe

C:\Windows\System\bbCXMmf.exe

C:\Windows\System\bbCXMmf.exe

C:\Windows\System\zBaHrpj.exe

C:\Windows\System\zBaHrpj.exe

C:\Windows\System\SiimaRT.exe

C:\Windows\System\SiimaRT.exe

C:\Windows\System\UPREJOh.exe

C:\Windows\System\UPREJOh.exe

C:\Windows\System\SsOSycE.exe

C:\Windows\System\SsOSycE.exe

C:\Windows\System\tEeZmXK.exe

C:\Windows\System\tEeZmXK.exe

C:\Windows\System\UMfuOGP.exe

C:\Windows\System\UMfuOGP.exe

C:\Windows\System\RotyEAP.exe

C:\Windows\System\RotyEAP.exe

C:\Windows\System\LEYLerC.exe

C:\Windows\System\LEYLerC.exe

C:\Windows\System\ujDpzcr.exe

C:\Windows\System\ujDpzcr.exe

C:\Windows\System\PEAqGbf.exe

C:\Windows\System\PEAqGbf.exe

C:\Windows\System\ooRXiVV.exe

C:\Windows\System\ooRXiVV.exe

C:\Windows\System\csLbuGZ.exe

C:\Windows\System\csLbuGZ.exe

C:\Windows\System\DpkGDrH.exe

C:\Windows\System\DpkGDrH.exe

C:\Windows\System\LvjHmvB.exe

C:\Windows\System\LvjHmvB.exe

C:\Windows\System\aUqSPwY.exe

C:\Windows\System\aUqSPwY.exe

C:\Windows\System\dUJpsZt.exe

C:\Windows\System\dUJpsZt.exe

C:\Windows\System\lmrmcwA.exe

C:\Windows\System\lmrmcwA.exe

C:\Windows\System\uluarXw.exe

C:\Windows\System\uluarXw.exe

C:\Windows\System\onynltS.exe

C:\Windows\System\onynltS.exe

C:\Windows\System\cWdfOAU.exe

C:\Windows\System\cWdfOAU.exe

C:\Windows\System\zCWlkoR.exe

C:\Windows\System\zCWlkoR.exe

C:\Windows\System\BBEoOJh.exe

C:\Windows\System\BBEoOJh.exe

C:\Windows\System\ONrFQoz.exe

C:\Windows\System\ONrFQoz.exe

C:\Windows\System\crtraRR.exe

C:\Windows\System\crtraRR.exe

C:\Windows\System\VZKtmdO.exe

C:\Windows\System\VZKtmdO.exe

C:\Windows\System\vpCcwqg.exe

C:\Windows\System\vpCcwqg.exe

C:\Windows\System\bdwKOjV.exe

C:\Windows\System\bdwKOjV.exe

C:\Windows\System\COGHMnS.exe

C:\Windows\System\COGHMnS.exe

C:\Windows\System\CKfNqIk.exe

C:\Windows\System\CKfNqIk.exe

C:\Windows\System\UQhRjib.exe

C:\Windows\System\UQhRjib.exe

C:\Windows\System\VvRKsSH.exe

C:\Windows\System\VvRKsSH.exe

C:\Windows\System\CqvriIz.exe

C:\Windows\System\CqvriIz.exe

C:\Windows\System\VatYiWs.exe

C:\Windows\System\VatYiWs.exe

C:\Windows\System\cJstNJn.exe

C:\Windows\System\cJstNJn.exe

C:\Windows\System\zRwaltD.exe

C:\Windows\System\zRwaltD.exe

C:\Windows\System\XAaloUg.exe

C:\Windows\System\XAaloUg.exe

C:\Windows\System\CyIklBK.exe

C:\Windows\System\CyIklBK.exe

C:\Windows\System\FfmIhJJ.exe

C:\Windows\System\FfmIhJJ.exe

C:\Windows\System\auAyQJm.exe

C:\Windows\System\auAyQJm.exe

C:\Windows\System\cveJFig.exe

C:\Windows\System\cveJFig.exe

C:\Windows\System\CNhJngO.exe

C:\Windows\System\CNhJngO.exe

C:\Windows\System\hWiifXp.exe

C:\Windows\System\hWiifXp.exe

C:\Windows\System\vweOCfe.exe

C:\Windows\System\vweOCfe.exe

C:\Windows\System\hofVzRR.exe

C:\Windows\System\hofVzRR.exe

C:\Windows\System\XFgcQhF.exe

C:\Windows\System\XFgcQhF.exe

C:\Windows\System\misnjIo.exe

C:\Windows\System\misnjIo.exe

C:\Windows\System\UHAPmOB.exe

C:\Windows\System\UHAPmOB.exe

C:\Windows\System\LLdXVhb.exe

C:\Windows\System\LLdXVhb.exe

C:\Windows\System\ZMPTBUt.exe

C:\Windows\System\ZMPTBUt.exe

C:\Windows\System\AmduVzT.exe

C:\Windows\System\AmduVzT.exe

C:\Windows\System\tXQPWVV.exe

C:\Windows\System\tXQPWVV.exe

C:\Windows\System\eoIWtwS.exe

C:\Windows\System\eoIWtwS.exe

C:\Windows\System\rzfbQWR.exe

C:\Windows\System\rzfbQWR.exe

C:\Windows\System\YgApCCt.exe

C:\Windows\System\YgApCCt.exe

C:\Windows\System\OIMtHgR.exe

C:\Windows\System\OIMtHgR.exe

C:\Windows\System\ppgdUVm.exe

C:\Windows\System\ppgdUVm.exe

C:\Windows\System\oOmTAvx.exe

C:\Windows\System\oOmTAvx.exe

C:\Windows\System\wmqVlrx.exe

C:\Windows\System\wmqVlrx.exe

C:\Windows\System\nkIObHC.exe

C:\Windows\System\nkIObHC.exe

C:\Windows\System\fxnycIH.exe

C:\Windows\System\fxnycIH.exe

C:\Windows\System\GVAmyBl.exe

C:\Windows\System\GVAmyBl.exe

C:\Windows\System\bGOoMby.exe

C:\Windows\System\bGOoMby.exe

C:\Windows\System\XkfHDGd.exe

C:\Windows\System\XkfHDGd.exe

C:\Windows\System\KcKAzWE.exe

C:\Windows\System\KcKAzWE.exe

C:\Windows\System\MinOerV.exe

C:\Windows\System\MinOerV.exe

C:\Windows\System\bfVgqcd.exe

C:\Windows\System\bfVgqcd.exe

C:\Windows\System\wdgUSXF.exe

C:\Windows\System\wdgUSXF.exe

C:\Windows\System\hKxvvrS.exe

C:\Windows\System\hKxvvrS.exe

C:\Windows\System\thKsroA.exe

C:\Windows\System\thKsroA.exe

C:\Windows\System\CvoQaGU.exe

C:\Windows\System\CvoQaGU.exe

C:\Windows\System\Fumlgkj.exe

C:\Windows\System\Fumlgkj.exe

C:\Windows\System\QHlGqDO.exe

C:\Windows\System\QHlGqDO.exe

C:\Windows\System\BCEvMiZ.exe

C:\Windows\System\BCEvMiZ.exe

C:\Windows\System\kPRIQfN.exe

C:\Windows\System\kPRIQfN.exe

C:\Windows\System\JhsUajC.exe

C:\Windows\System\JhsUajC.exe

C:\Windows\System\SpSwiCV.exe

C:\Windows\System\SpSwiCV.exe

C:\Windows\System\YLYllsj.exe

C:\Windows\System\YLYllsj.exe

C:\Windows\System\hBROQsk.exe

C:\Windows\System\hBROQsk.exe

C:\Windows\System\LlVnotT.exe

C:\Windows\System\LlVnotT.exe

C:\Windows\System\zziKCHn.exe

C:\Windows\System\zziKCHn.exe

C:\Windows\System\pzpasmO.exe

C:\Windows\System\pzpasmO.exe

C:\Windows\System\EPgRzjZ.exe

C:\Windows\System\EPgRzjZ.exe

C:\Windows\System\HWOJSEV.exe

C:\Windows\System\HWOJSEV.exe

C:\Windows\System\PWZeeIH.exe

C:\Windows\System\PWZeeIH.exe

C:\Windows\System\GVqrTmG.exe

C:\Windows\System\GVqrTmG.exe

C:\Windows\System\ARAalrT.exe

C:\Windows\System\ARAalrT.exe

C:\Windows\System\TxrPMWY.exe

C:\Windows\System\TxrPMWY.exe

C:\Windows\System\HPysbKw.exe

C:\Windows\System\HPysbKw.exe

C:\Windows\System\ocpsdoN.exe

C:\Windows\System\ocpsdoN.exe

C:\Windows\System\WGEQDXa.exe

C:\Windows\System\WGEQDXa.exe

C:\Windows\System\xynNOzA.exe

C:\Windows\System\xynNOzA.exe

C:\Windows\System\bXLEBHh.exe

C:\Windows\System\bXLEBHh.exe

C:\Windows\System\GjMEFrX.exe

C:\Windows\System\GjMEFrX.exe

C:\Windows\System\FIfYanV.exe

C:\Windows\System\FIfYanV.exe

C:\Windows\System\BwetHXe.exe

C:\Windows\System\BwetHXe.exe

C:\Windows\System\eCoSXvj.exe

C:\Windows\System\eCoSXvj.exe

C:\Windows\System\mQeTmLA.exe

C:\Windows\System\mQeTmLA.exe

C:\Windows\System\mRAPmjI.exe

C:\Windows\System\mRAPmjI.exe

C:\Windows\System\ZPmZVsH.exe

C:\Windows\System\ZPmZVsH.exe

C:\Windows\System\MyXgAwd.exe

C:\Windows\System\MyXgAwd.exe

C:\Windows\System\pIjqqbQ.exe

C:\Windows\System\pIjqqbQ.exe

C:\Windows\System\jbzPFfy.exe

C:\Windows\System\jbzPFfy.exe

C:\Windows\System\SJRQhfT.exe

C:\Windows\System\SJRQhfT.exe

C:\Windows\System\DiKadDg.exe

C:\Windows\System\DiKadDg.exe

C:\Windows\System\QTTdWTs.exe

C:\Windows\System\QTTdWTs.exe

C:\Windows\System\MRnrNjA.exe

C:\Windows\System\MRnrNjA.exe

C:\Windows\System\ETOhgRB.exe

C:\Windows\System\ETOhgRB.exe

C:\Windows\System\XPOgvYS.exe

C:\Windows\System\XPOgvYS.exe

C:\Windows\System\kPgdDUX.exe

C:\Windows\System\kPgdDUX.exe

C:\Windows\System\yzRowuh.exe

C:\Windows\System\yzRowuh.exe

C:\Windows\System\yTlWpja.exe

C:\Windows\System\yTlWpja.exe

C:\Windows\System\GBwYrLi.exe

C:\Windows\System\GBwYrLi.exe

C:\Windows\System\JmlXqJQ.exe

C:\Windows\System\JmlXqJQ.exe

C:\Windows\System\jikatOx.exe

C:\Windows\System\jikatOx.exe

C:\Windows\System\SCbAGZo.exe

C:\Windows\System\SCbAGZo.exe

C:\Windows\System\zLbKzlX.exe

C:\Windows\System\zLbKzlX.exe

C:\Windows\System\weKTzaL.exe

C:\Windows\System\weKTzaL.exe

C:\Windows\System\bJMqNWT.exe

C:\Windows\System\bJMqNWT.exe

C:\Windows\System\rykSflX.exe

C:\Windows\System\rykSflX.exe

C:\Windows\System\TWYwZUA.exe

C:\Windows\System\TWYwZUA.exe

C:\Windows\System\VliABPj.exe

C:\Windows\System\VliABPj.exe

C:\Windows\System\GDPMgxW.exe

C:\Windows\System\GDPMgxW.exe

C:\Windows\System\KfgZkub.exe

C:\Windows\System\KfgZkub.exe

C:\Windows\System\QwLbxqb.exe

C:\Windows\System\QwLbxqb.exe

C:\Windows\System\bUiGAEH.exe

C:\Windows\System\bUiGAEH.exe

C:\Windows\System\NOmxxwf.exe

C:\Windows\System\NOmxxwf.exe

C:\Windows\System\RkXUVAH.exe

C:\Windows\System\RkXUVAH.exe

C:\Windows\System\iOZzqsC.exe

C:\Windows\System\iOZzqsC.exe

C:\Windows\System\ZiZBqeJ.exe

C:\Windows\System\ZiZBqeJ.exe

C:\Windows\System\FmmbYuw.exe

C:\Windows\System\FmmbYuw.exe

C:\Windows\System\mHySpzN.exe

C:\Windows\System\mHySpzN.exe

C:\Windows\System\wUEgYbi.exe

C:\Windows\System\wUEgYbi.exe

C:\Windows\System\rbYVcfb.exe

C:\Windows\System\rbYVcfb.exe

C:\Windows\System\ULZLKqu.exe

C:\Windows\System\ULZLKqu.exe

C:\Windows\System\cTAfyNt.exe

C:\Windows\System\cTAfyNt.exe

C:\Windows\System\arohyOK.exe

C:\Windows\System\arohyOK.exe

C:\Windows\System\lvEIlEa.exe

C:\Windows\System\lvEIlEa.exe

C:\Windows\System\KDgfxgM.exe

C:\Windows\System\KDgfxgM.exe

C:\Windows\System\HedjaAj.exe

C:\Windows\System\HedjaAj.exe

C:\Windows\System\gpNTKXP.exe

C:\Windows\System\gpNTKXP.exe

C:\Windows\System\rbiTqTa.exe

C:\Windows\System\rbiTqTa.exe

C:\Windows\System\LGHpgWB.exe

C:\Windows\System\LGHpgWB.exe

C:\Windows\System\igEUuGv.exe

C:\Windows\System\igEUuGv.exe

C:\Windows\System\aTulast.exe

C:\Windows\System\aTulast.exe

C:\Windows\System\ZzLyFJi.exe

C:\Windows\System\ZzLyFJi.exe

C:\Windows\System\QVAZROl.exe

C:\Windows\System\QVAZROl.exe

C:\Windows\System\eKoBeWB.exe

C:\Windows\System\eKoBeWB.exe

C:\Windows\System\NACkGRH.exe

C:\Windows\System\NACkGRH.exe

C:\Windows\System\FcYbAPg.exe

C:\Windows\System\FcYbAPg.exe

C:\Windows\System\bsIbtln.exe

C:\Windows\System\bsIbtln.exe

C:\Windows\System\bXDsVBj.exe

C:\Windows\System\bXDsVBj.exe

C:\Windows\System\PRSavKn.exe

C:\Windows\System\PRSavKn.exe

C:\Windows\System\HaPnQYT.exe

C:\Windows\System\HaPnQYT.exe

C:\Windows\System\OHgeVab.exe

C:\Windows\System\OHgeVab.exe

C:\Windows\System\kHbiFML.exe

C:\Windows\System\kHbiFML.exe

C:\Windows\System\UXbBOUb.exe

C:\Windows\System\UXbBOUb.exe

C:\Windows\System\sBLpEMv.exe

C:\Windows\System\sBLpEMv.exe

C:\Windows\System\cctzWpg.exe

C:\Windows\System\cctzWpg.exe

C:\Windows\System\tQYEfKT.exe

C:\Windows\System\tQYEfKT.exe

C:\Windows\System\CCgNbom.exe

C:\Windows\System\CCgNbom.exe

C:\Windows\System\fyPuuYR.exe

C:\Windows\System\fyPuuYR.exe

C:\Windows\System\lhSHuYA.exe

C:\Windows\System\lhSHuYA.exe

C:\Windows\System\dVXyERU.exe

C:\Windows\System\dVXyERU.exe

C:\Windows\System\wfUmAAt.exe

C:\Windows\System\wfUmAAt.exe

C:\Windows\System\xXgGXsP.exe

C:\Windows\System\xXgGXsP.exe

C:\Windows\System\ohEVdWe.exe

C:\Windows\System\ohEVdWe.exe

C:\Windows\System\ZwCmPCh.exe

C:\Windows\System\ZwCmPCh.exe

C:\Windows\System\rPoFZPM.exe

C:\Windows\System\rPoFZPM.exe

C:\Windows\System\YzmASeI.exe

C:\Windows\System\YzmASeI.exe

C:\Windows\System\ICldqiy.exe

C:\Windows\System\ICldqiy.exe

C:\Windows\System\jeAAshE.exe

C:\Windows\System\jeAAshE.exe

C:\Windows\System\FoKsXzI.exe

C:\Windows\System\FoKsXzI.exe

C:\Windows\System\TVPbKTp.exe

C:\Windows\System\TVPbKTp.exe

C:\Windows\System\hCFFDZd.exe

C:\Windows\System\hCFFDZd.exe

C:\Windows\System\XaKxdUG.exe

C:\Windows\System\XaKxdUG.exe

C:\Windows\System\pfxrNiO.exe

C:\Windows\System\pfxrNiO.exe

C:\Windows\System\hPbmTSB.exe

C:\Windows\System\hPbmTSB.exe

C:\Windows\System\fuVjVfc.exe

C:\Windows\System\fuVjVfc.exe

C:\Windows\System\UeEfGgX.exe

C:\Windows\System\UeEfGgX.exe

C:\Windows\System\rtyTuGr.exe

C:\Windows\System\rtyTuGr.exe

C:\Windows\System\iVkWIYd.exe

C:\Windows\System\iVkWIYd.exe

C:\Windows\System\ZZwbxLU.exe

C:\Windows\System\ZZwbxLU.exe

C:\Windows\System\ayxDtWb.exe

C:\Windows\System\ayxDtWb.exe

C:\Windows\System\tXjiRds.exe

C:\Windows\System\tXjiRds.exe

C:\Windows\System\GCfdHHI.exe

C:\Windows\System\GCfdHHI.exe

C:\Windows\System\pVGANGv.exe

C:\Windows\System\pVGANGv.exe

C:\Windows\System\WjGTJXI.exe

C:\Windows\System\WjGTJXI.exe

C:\Windows\System\BdrnHJV.exe

C:\Windows\System\BdrnHJV.exe

C:\Windows\System\xRjnIUs.exe

C:\Windows\System\xRjnIUs.exe

C:\Windows\System\qxadEyp.exe

C:\Windows\System\qxadEyp.exe

C:\Windows\System\jPupnfH.exe

C:\Windows\System\jPupnfH.exe

C:\Windows\System\ntNAbAc.exe

C:\Windows\System\ntNAbAc.exe

C:\Windows\System\VoCHLFf.exe

C:\Windows\System\VoCHLFf.exe

C:\Windows\System\RAhDami.exe

C:\Windows\System\RAhDami.exe

C:\Windows\System\UqZlsiC.exe

C:\Windows\System\UqZlsiC.exe

C:\Windows\System\OUTcvnF.exe

C:\Windows\System\OUTcvnF.exe

C:\Windows\System\hqggRhZ.exe

C:\Windows\System\hqggRhZ.exe

C:\Windows\System\YHipLPy.exe

C:\Windows\System\YHipLPy.exe

C:\Windows\System\LPldtfQ.exe

C:\Windows\System\LPldtfQ.exe

C:\Windows\System\VoeHFfa.exe

C:\Windows\System\VoeHFfa.exe

C:\Windows\System\PjZkXTZ.exe

C:\Windows\System\PjZkXTZ.exe

C:\Windows\System\lYqUOti.exe

C:\Windows\System\lYqUOti.exe

C:\Windows\System\FwkIoEY.exe

C:\Windows\System\FwkIoEY.exe

C:\Windows\System\xYUXfgC.exe

C:\Windows\System\xYUXfgC.exe

C:\Windows\System\GDJJjcC.exe

C:\Windows\System\GDJJjcC.exe

C:\Windows\System\EdCzJNU.exe

C:\Windows\System\EdCzJNU.exe

C:\Windows\System\BZzdAkC.exe

C:\Windows\System\BZzdAkC.exe

C:\Windows\System\nooRVLH.exe

C:\Windows\System\nooRVLH.exe

C:\Windows\System\wVitEFc.exe

C:\Windows\System\wVitEFc.exe

C:\Windows\System\VUPnLXq.exe

C:\Windows\System\VUPnLXq.exe

C:\Windows\System\reITqPg.exe

C:\Windows\System\reITqPg.exe

C:\Windows\System\LFYWTzy.exe

C:\Windows\System\LFYWTzy.exe

C:\Windows\System\GQVMlvt.exe

C:\Windows\System\GQVMlvt.exe

C:\Windows\System\YVEcNww.exe

C:\Windows\System\YVEcNww.exe

C:\Windows\System\GtEJHpw.exe

C:\Windows\System\GtEJHpw.exe

C:\Windows\System\tWwqbVS.exe

C:\Windows\System\tWwqbVS.exe

C:\Windows\System\traqVoy.exe

C:\Windows\System\traqVoy.exe

C:\Windows\System\XVyKHcE.exe

C:\Windows\System\XVyKHcE.exe

C:\Windows\System\ABucTNO.exe

C:\Windows\System\ABucTNO.exe

C:\Windows\System\vxrRxmy.exe

C:\Windows\System\vxrRxmy.exe

C:\Windows\System\rTFLKAj.exe

C:\Windows\System\rTFLKAj.exe

C:\Windows\System\TNANTLJ.exe

C:\Windows\System\TNANTLJ.exe

C:\Windows\System\HmpqMxP.exe

C:\Windows\System\HmpqMxP.exe

C:\Windows\System\IHBvisK.exe

C:\Windows\System\IHBvisK.exe

C:\Windows\System\CtZAIBQ.exe

C:\Windows\System\CtZAIBQ.exe

C:\Windows\System\RjOMpUZ.exe

C:\Windows\System\RjOMpUZ.exe

C:\Windows\System\CpicChc.exe

C:\Windows\System\CpicChc.exe

C:\Windows\System\UjlAepS.exe

C:\Windows\System\UjlAepS.exe

C:\Windows\System\qqzsury.exe

C:\Windows\System\qqzsury.exe

C:\Windows\System\EmOfwNv.exe

C:\Windows\System\EmOfwNv.exe

C:\Windows\System\LBMsDiO.exe

C:\Windows\System\LBMsDiO.exe

C:\Windows\System\NIldvyc.exe

C:\Windows\System\NIldvyc.exe

C:\Windows\System\sWEqTxC.exe

C:\Windows\System\sWEqTxC.exe

C:\Windows\System\WLydGAs.exe

C:\Windows\System\WLydGAs.exe

C:\Windows\System\GWdSYdb.exe

C:\Windows\System\GWdSYdb.exe

Network

N/A

Files

memory/2360-0-0x000000013F6C0000-0x000000013FA11000-memory.dmp

memory/2360-1-0x00000000000F0000-0x0000000000100000-memory.dmp

\Windows\system\WCPtRRz.exe

MD5	e92e06af72f1a5e7e729489be5d8393f
SHA1	3578e86641a3e85c1968670bc11b2acad5a30d0a
SHA256	b3d7639d2bcf4594dc3888d39c9aae032693e5cf397cf0c083b21813c0fbdd72
SHA512	220cc28a0d5ab7a52076877b5ac92d2d78abc8559ab326183be8e2bd06edcd3a71844127bb19be71a041adb45ce3e74314b7a3c20c0bada721f4d14afa9293db

memory/2360-6-0x000000013F290000-0x000000013F5E1000-memory.dmp

memory/2756-9-0x000000013F290000-0x000000013F5E1000-memory.dmp

\Windows\system\oWdryEu.exe

MD5	1493ad5b0a4a91e076bd5765fdba6a09
SHA1	b3738fb87cac710a2619a81cc3c62356214790c4
SHA256	c9bd13a87ba97fe6bda9c2bec40f7336fc1b4e646ceae11468d51963a1429545
SHA512	b83729f2aacde0432b50c17c50a9e0d46064b43bb735f3919c9c803ce5346a780cb5351e2636a91ec73bb9e1092600fccdec983a655f6f5487bbc63716ae3c6e

memory/2360-13-0x0000000002000000-0x0000000002351000-memory.dmp

memory/2260-15-0x000000013F480000-0x000000013F7D1000-memory.dmp

\Windows\system\nVMcnqJ.exe

MD5	84b13728ae9b76517c885e17ac681c03
SHA1	a86750f9fe971ae9c6f8e758397007dec0af40fc
SHA256	fa0eb2caef49f9c8f980efa49b7f793bbb6ed46350a9db194d374b51e36818f1
SHA512	944436ac0903fe11a5b941f4f22d4efa8d203edb29aa9bc197814d83333af700c639518140ea7a9c1f69aeab97085a9b619969d6ba75553e37b4750ad8d5a8af

\Windows\system\EgeBjev.exe

MD5	0496951fda5823b3f4a8606b65e033b4
SHA1	44c287900bf17a0a9afb8dc601917d1d79faf1ee
SHA256	bee387220281afde79158f07e18d36d86d79f4a157f2e4a001fa5197a296f43b
SHA512	d6b41c95698f7976ca6588c4e60c82aef9ee4881bf8a033af84fb52bc2ccd7f74bf2aeecbb2adc4d65ccc37cd01de406e573b0ae1b1d8bbe39136b5fa68886a9

\Windows\system\bfcCtwG.exe

MD5	66abf021d4d22ed5487b79053d774bf6
SHA1	964b7e67d98a53b4cdef186dc367084d2340317c
SHA256	0da01f9520e9f6c587360fbef4507b3039e63c7ae97911af9d697941272102ea
SHA512	eb50f19ad6386b804d9df2aa15bc37664102e632cd9bc2f3aca14d233e67216aeaedecd229fb79f8c48c65d241a9cf82ba9cdcd3be477d6065d6bffd9b828ad6

memory/3004-37-0x000000013F3E0000-0x000000013F731000-memory.dmp

memory/2780-36-0x000000013F370000-0x000000013F6C1000-memory.dmp

memory/2720-34-0x000000013F320000-0x000000013F671000-memory.dmp

memory/2360-31-0x0000000002000000-0x0000000002351000-memory.dmp

memory/2360-28-0x0000000002000000-0x0000000002351000-memory.dmp

memory/2360-26-0x000000013F320000-0x000000013F671000-memory.dmp

C:\Windows\system\BuLAuOD.exe

MD5	33bb4f62cd7e44414243a3646f01ddb2
SHA1	86d6d3c6bcbb62be0b67488699b035f975e94164
SHA256	d9b3d438b71b62769517e4eeaa84d699c03147af9b44fa11af04bc0e8e6eb7e4
SHA512	1878b229a1d0c0dc6d36cd90fc0cf392df6142cf76d84c9da623eafbfd21d728ffd04ca9e0ba119431b129afaabb91e152dc46e585d170cdbd948f5986f10e13

memory/2688-44-0x000000013F460000-0x000000013F7B1000-memory.dmp

memory/2360-43-0x0000000002000000-0x0000000002351000-memory.dmp

C:\Windows\system\Rndzhmj.exe

MD5	1bf927e8240881b25c04aeb998497221
SHA1	2cb71a140bbc6714ad4efa312f565742c4d90253
SHA256	3ecfa7af101735040e0fa5f4c36a6e110349978cc40091727ab19a55985b786f
SHA512	f93e5d760d02f6326aac5c84cefb52a5505f5f255006769ff163acf9878613b939ef9f532068dcad1caec8a2b377b2e0c1a88b1e0b42585aaf119c9eafca214c

memory/2736-51-0x000000013F9A0000-0x000000013FCF1000-memory.dmp

memory/2360-49-0x000000013F6C0000-0x000000013FA11000-memory.dmp

memory/2360-46-0x0000000002000000-0x0000000002351000-memory.dmp

\Windows\system\DWFfDpi.exe

MD5	14c11cfed217d67d5977b83296ab87fd
SHA1	10d9216d133d5a7e1a80984b51d65aae5457e45f
SHA256	6187b501d0eb052a15c4a5e315048bde8a30713af8a0a8404a099d57d04192e8
SHA512	902bef88b518c2bd21ca197062f6ba4354c14c5bfd2c51b3678cee41171a0f6db704a85417f4eee06669e34aa874bce0f2301d60c292f5f05a938b86f05a8eac

\Windows\system\wYfgwQK.exe

MD5	1a6819c788cff08cffcc603d92f0e31a
SHA1	10f73f10ec7e6d7ecb4a8db4e56803ce3dc04cd9
SHA256	7f99c7e8f2737f8aee836cd4858d0974a0c6610eb41796ccb3e090653d62a5a7
SHA512	65f40d92fece3c236e423fa28c05c7fbb42631dad6039d23a74bec70ff56e72d07face478e2ba2b98d44478baa9f31499ad3053246129a97f06dcab127fe1990

\Windows\system\eczZBVi.exe

MD5	4409148ea4c56e3fa01970095f3294cb
SHA1	fa107a91355c46449d5f6dfe3b9658edd79c1d56
SHA256	f99e9233afca05e75f63a1c800fc0c4e44aca723b33b533072f1cc1e82603007
SHA512	89c47afdbf30ccca58aab930d886114be7e2ba864d58faba47a66a43a7ef92ae3495397b3eabdf73ebb67e84db4989c5c0dbf29f43d8765cd8cf2695e9b98108

memory/1420-102-0x000000013FB10000-0x000000013FE61000-memory.dmp

memory/2360-105-0x000000013F260000-0x000000013F5B1000-memory.dmp

memory/2360-108-0x0000000002000000-0x0000000002351000-memory.dmp

memory/2360-111-0x000000013FE20000-0x0000000140171000-memory.dmp

memory/2260-114-0x000000013F480000-0x000000013F7D1000-memory.dmp

memory/2360-113-0x0000000002000000-0x0000000002351000-memory.dmp

C:\Windows\system\udOkeIK.exe

MD5	b052cb485f8deb43ac5d9cc9e0312886
SHA1	a91384f4b3fc2946cdec7f2ab95de31c0dd70639
SHA256	e37badb5849c49b452d3eb99f98f5fb786b1f74ac2d93f4389d06a4d476d2738
SHA512	266de500f0c7430e208fd7128c7027bf556dc58951d0eaa8c285ee00f0c94be02a2118af64d94720ef75a87791e80283594087e902d28d5b36cb09eacd9f38d0

C:\Windows\system\QANSJxx.exe

MD5	a9c26b0464ab83bcf5a6624659484569
SHA1	160cf71248b3be65ccc20176ab0d8581d415929d
SHA256	8a21e092097ad8b970e81420d26deb139ef6b7c7b892e5c2403ffa65348298a0
SHA512	f4d48c32b29aa5192ea143616217faf3321d090f8a7daec5dadbc74b0af5d9b42141ee76042c6900d48b0f545ab6f650cfd8b887397e7b55db89d7c2658aab15

C:\Windows\system\CfSfDxj.exe

MD5	93c39155da13da4a3af0634576696747
SHA1	6dfc135e28440906ca5bc1cc0d0e2b6f24fb8bea
SHA256	baeb892afa774d802d100bec2189c460160de4c477fab7bf83641857dd829231
SHA512	93083c342e45998c8ef1928e516c8af58e20c9fec3e5957f481005b041e2611b35b3b0554a02252aa181e6e8de98650b3f89e705f2cd2ad222ee8b0e4d337a07

C:\Windows\system\WXdTpxo.exe

MD5	e6d00d7b210703c1262d37a255fbe225
SHA1	d8cd39f5427f42e707e19167de22f0fb6f752c0d
SHA256	ef27b525be069718f506b5aca7159be819c74f6da27d8d3cbf56e1948ed2fdb0
SHA512	9e6589b8195157526cc5583ce1e9990ebea0c09d79daddbcf5556f01799e2a664d872795c8844358861e66f98d5ea22323c660002d422f2be7a23d13acabbd0f

C:\Windows\system\PjPhYfI.exe

MD5	31e68ebe2eb67daad622f74d7efdfc4c
SHA1	322419aad859e251ec992c2faa854a890ce7cf57
SHA256	a2d0db54978eb6783779c73e7dd08c21c80e03db212a72a45585af3b2acac8b6
SHA512	3abcaa4dbe9f0733ce534fda0d604567c523959546cfd98d6a285d025c3432f42b3915b6d1d46e97833f7fe845d7a72f383eb23650debb5e74a2e636fa5b55d3

C:\Windows\system\cjrDurY.exe

MD5	14c820b4b9d6fcb2fb7e241fbfb81f76
SHA1	13db7b6f5f79b00a281f82f4cd43cbdb93824819
SHA256	8a74dff1cd95069480f44318c3e6b2fe24a8d3ab60cbe535d699d1b1371be0ea
SHA512	510eab4463d3046d8b7145eb99c9904659f669bd7b1eb1c756ccc98c9c0e789b0d305777fb9c31155ac5ffcb6febe92851edceb28021e2a53d3ffe11ab4de6d5

C:\Windows\system\LUnXUTg.exe

MD5	40a6d083400ab81aaa35c9fb86a1060b
SHA1	a3cab4bf31cd1bcc777da249eeeaa0a714333f4e
SHA256	d67c337301c3740522ec97c3b5ebfb4f849277d9c39d0a6e7005a25e673e83b5
SHA512	c0388e5dabbdfbdfa48708f4b488380d7404dd59d5808c8799ec0985e9774c779d3caf887fa745498e5d43628ec902daa25829f3b611a1772bddcd0bab3da026

C:\Windows\system\fTBCPCx.exe

MD5	900413896a9d7e270ce45abf7f325d89
SHA1	705d2b77bcf9e936af0195faf46c39ea14c7de6c
SHA256	3c08f9a0228543611b422936b76aafef2c7c53d48d980a342895660acb3bd6e7
SHA512	024b38ea40607445b0831d0f7ad8acb5859944256d6bd1d5f0530ba8b582217b077b647c5df66673f24460097700f9d1c646caea6c1bf39a5612abd2b1daf1ea

C:\Windows\system\twTSXRm.exe

MD5	ee51b78d77299d0350478664e8a87983
SHA1	855d1d62cb123b70093b8488a60aad0ecbceb6d8
SHA256	83f4bbe358e50ddbfe605aaafc8f8d2b3c0f283561587f3876ef84f0e64f54fe
SHA512	8bf66c09d465b4e2c1a5d491517c6ea57411f28568780727628c9e338cb35a5f60b14a9c4769683fe02af06fdb299eddf202aa63ba4e3bc1204fbc8a02202c7c

C:\Windows\system\FNEhOjL.exe

MD5	59f5189e807454435e8cde3d29599e27
SHA1	a3a89ac7d6a1efec1a060db3d9cbeba0ff25bd95
SHA256	008a0ed8d9ea37f3ab35632dee91a4a8db5f600020d6f96cff0b2601f05db345
SHA512	460388052e068436fb052eb9b07cb44067ea0678460ba1184621ef1dd0fcfb8cad09401fd497c0422bd94a16e9c23d92cb6da9fb5222bb583784bf58ee21d7a2

C:\Windows\system\vWCeALB.exe

MD5	d27b1db76f4699be93eb6b2015a3dd05
SHA1	4aaa0f4608c157ae04d432bf1cd8e63228266483
SHA256	dd1974eaa49dd8b83061f034359dc3b1a1a9e7871ac7b9530af1dc58a4d2369d
SHA512	30195374c20f3e906ce3b24d6d9f38cace9b8b2c25003c87874654f7a97cdd46d18a42681969ffbd549312b5cec1099f02730401e830f85fcf1a62312e4fd3c1

C:\Windows\system\qvDFcZA.exe

MD5	c0b41abb31238bc08e7cd575f760c68a
SHA1	6dec4a23f3b391eb16dd406e2403419c699afc54
SHA256	fab30932dc5cb87a947094a15a5e857d9e402f75e81815a4e849eb4b3c3bfacd
SHA512	cb9d2705e670b10df7cefa51adbec946e97c12982da3101de1642c74bcc853af06c2feceeac4f990294bdef659b2309b736f3977c5b1ea94c144183534641d98

C:\Windows\system\VITjNMy.exe

MD5	a3f03d2b69869e9e5cda587fd5e14854
SHA1	7a0611a02ecbdabb54e3e36a17b131be0c9ae8e8
SHA256	4866c916ee8c8050eac9e34e26dd167e1f37522d8f7fb1c5bd153a5e5bd84c4d
SHA512	b1eaf973103c6ad03dd32e19e83fb46faf7ead9a0bc005b4d0afc1f02438423f1dc01247269c7330a8de82d6d2e44c40eccbd206c44d7f41e7cf900c6dc2e0a4

C:\Windows\system\yKARvgh.exe

MD5	a3561238ae779d550f312eea3186e95e
SHA1	7b12ca5631d56e8550af1b8f845960c73d8b679c
SHA256	29054b005d58545db6b2e7ca6f198ba18d3ce3082f72740541b36ec372a2ed84
SHA512	80ddbc2765982a389c8da339bb61c49b4c348a50865289378d6e7239dab5dccdf5da73498108cecc5101ce5bb7b75b346fb22e9b20b8f4ab35794da21bfe1a8c

memory/2360-112-0x000000013FFF0000-0x0000000140341000-memory.dmp

memory/2756-110-0x000000013F290000-0x000000013F5E1000-memory.dmp

memory/952-109-0x000000013F630000-0x000000013F981000-memory.dmp

memory/2360-631-0x0000000002000000-0x0000000002351000-memory.dmp

memory/2360-107-0x0000000002000000-0x0000000002351000-memory.dmp

memory/2360-106-0x000000013FFC0000-0x0000000140311000-memory.dmp

memory/2360-104-0x0000000002000000-0x0000000002351000-memory.dmp

memory/2692-103-0x000000013FE20000-0x0000000140171000-memory.dmp

C:\Windows\system\HWIesDa.exe

MD5	754ec6fa36f68c340f2a9c0de620de57
SHA1	8c0dfa2d083edda64b80525de51d96656e40b672
SHA256	89226600008336edfcda4bda45026d2a3ef0196289caf21b2d2c115b41b96f06
SHA512	ae583e215f9d1553effbada15835b376b9d016cfeea4ab7bf10ac6e0c7f8ff3eb322fcb424dd94c71938f7e3f97abbd6228de8e6cbd85b89d19702ea04b83ba0

C:\Windows\system\pyLlyFF.exe

MD5	ea1bc35065d65878881f057e9fd190c9
SHA1	cbde9378bc8cbb5c781eb23fad4ea5df0a019e24
SHA256	68225f9d8d1b01f2689cdd6f50fac1a0cb1a5df9220fbcb29415b56a5dca2db3
SHA512	5d3282d68500d5c9b81224097170a3f4fcbcf652493b32712e8749d0486bd90dc1b64e0f9fb4b306ce28cb15baef2af5a905802f0be7875edb36d5f2d82f93b8

C:\Windows\system\MuPqhAt.exe

MD5	2becf76c5f5cfd4c32dbae55fc733241
SHA1	546d497de0b2388ca1367078b31e9fd460eb33b0
SHA256	fbde779eff9bcbc03d17e4ea8535f3ef3c3756102e7c579c9b2276c5a4df29a6
SHA512	8c0caccb0b23ddf07bee8e3f3f12eddf8ff330631a3102cdd3c43d12729f685a1351beaae363409525f4f5bf640a59604b9dd56dd4fd73270326f795d55e7705

memory/2360-98-0x0000000002000000-0x0000000002351000-memory.dmp

C:\Windows\system\yBhFPSE.exe

MD5	85d44b6c16dc5420fd972e01e2d17426
SHA1	97720c2bfc03c1be52a088313a9797ec87d396af
SHA256	9fd84349022b077df57d19d780dcd23029dce26d4c4342425db3771fed376a13
SHA512	90446bf4ecd7d6a841df5cd94f6d9384c78fe8b690dd49762c9699ff83a2a60681f61e4b0545db4fef7aa699bdcd4bbcb0afdd7d2968800eb74ae642b2c0bda2

C:\Windows\system\uGKiOPy.exe

MD5	872f4ec3074f992dd2077d4b8cfdac70
SHA1	604806d1e9bd06b0a89293d58a88c6c45eb44dd0
SHA256	5575bd54fe63e8743a1a313e61effc25039032e728bd6e1e509cbda34c573dc4
SHA512	d6d52b8c6d4c06410d2867abe3dbe498b453bafcb6bb6a8e38d9f1fc5dab28b3a1429c1b7a0cc6bb6bd1fe96df50e1e3939ced560ee5623fe6d866b69cb00d89

C:\Windows\system\fEdRJyR.exe

MD5	76024209751386807f8d7c8f3968021e
SHA1	e87b823aaea54ec5aed2547043e74fa9b9aef559
SHA256	90ffa852b16d29e3964cd80772dfd8cbbc182fffa7a3a2f7c3d91f43f5e9a007
SHA512	37b646c0cc00bae947e34cc9fd753344a1a6782a687f6b897449080b685cbb6421274694aabae1c028e00ce6b224d34d581c8b91c984e271f64303fbdeb11376

C:\Windows\system\IFRDFbm.exe

MD5	f69e1f67e0d16eedca295ac59747ee06
SHA1	fa1a233f33cbb4eef84c920f057db684d9113aa8
SHA256	336382a22b9995cb373be727e08d40fbd4062bfd34d39a18faf1c4d6fb90d882
SHA512	fc45795fbabb672a604ae1c0921a0246877b33d96442dbc30b07d988f2c8e51d761913da0a1d5b2e8d60112913cc1ed2678fe9439ce60bfff72e2b39cbd48e6b

memory/2360-79-0x000000013FF50000-0x00000001402A1000-memory.dmp

memory/2580-90-0x000000013FF50000-0x00000001402A1000-memory.dmp

C:\Windows\system\eTiFDxi.exe

MD5	fe5c0849212b6c47813107851072b6a6
SHA1	2476a3d82b9050bffee04cb9c7dfa163b2ea28e1
SHA256	156b59874c7c575a328489e350056dbd63550f3e632df0cacceaef00931e94fd
SHA512	66a8a67c29560b105838da51fa76d68a13d9b3e9418d58d543f93b6564d1e733f34ef473d684e91fc371c7c67a340090f495803ccf2ff7fe5b97a3fed75f626e

memory/2360-1097-0x0000000002000000-0x0000000002351000-memory.dmp

memory/2360-1713-0x0000000002000000-0x0000000002351000-memory.dmp

memory/2360-3731-0x0000000002000000-0x0000000002351000-memory.dmp

memory/2756-3783-0x000000013F290000-0x000000013F5E1000-memory.dmp

memory/2260-3801-0x000000013F480000-0x000000013F7D1000-memory.dmp

memory/3004-3821-0x000000013F3E0000-0x000000013F731000-memory.dmp

memory/2780-3818-0x000000013F370000-0x000000013F6C1000-memory.dmp

memory/2720-3842-0x000000013F320000-0x000000013F671000-memory.dmp

memory/2688-3867-0x000000013F460000-0x000000013F7B1000-memory.dmp

memory/1420-4033-0x000000013FB10000-0x000000013FE61000-memory.dmp

memory/2580-4048-0x000000013FF50000-0x00000001402A1000-memory.dmp

memory/2692-4042-0x000000013FE20000-0x0000000140171000-memory.dmp

memory/2736-4066-0x000000013F9A0000-0x000000013FCF1000-memory.dmp

memory/952-4045-0x000000013F630000-0x000000013F981000-memory.dmp

memory/2360-8241-0x0000000002000000-0x0000000002351000-memory.dmp

memory/2360-8330-0x0000000002000000-0x0000000002351000-memory.dmp

memory/2360-9288-0x0000000002000000-0x0000000002351000-memory.dmp

memory/2360-9338-0x0000000002000000-0x0000000002351000-memory.dmp

memory/2360-9483-0x000000013FE20000-0x0000000140171000-memory.dmp

memory/2360-9496-0x0000000002000000-0x0000000002351000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 13:28

Reported

2024-06-13 13:31

Platform

win10v2004-20240508-en

Max time kernel

62s

Max time network

58s

Command Line

"C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\jkAWfMN.exe	N/A
N/A	N/A	C:\Windows\System\CGDzHhD.exe	N/A
N/A	N/A	C:\Windows\System\HohwvoV.exe	N/A
N/A	N/A	C:\Windows\System\YsKZQsh.exe	N/A
N/A	N/A	C:\Windows\System\svzARKI.exe	N/A
N/A	N/A	C:\Windows\System\EPKfBhD.exe	N/A
N/A	N/A	C:\Windows\System\ZHGXzOg.exe	N/A
N/A	N/A	C:\Windows\System\ftJWkhi.exe	N/A
N/A	N/A	C:\Windows\System\SvdLGlA.exe	N/A
N/A	N/A	C:\Windows\System\IioWYgW.exe	N/A
N/A	N/A	C:\Windows\System\nJiNWfe.exe	N/A
N/A	N/A	C:\Windows\System\IyzBlAd.exe	N/A
N/A	N/A	C:\Windows\System\eTklRWx.exe	N/A
N/A	N/A	C:\Windows\System\ohzkqLm.exe	N/A
N/A	N/A	C:\Windows\System\dHuTvEc.exe	N/A
N/A	N/A	C:\Windows\System\Xjxymyd.exe	N/A
N/A	N/A	C:\Windows\System\Ogneksv.exe	N/A
N/A	N/A	C:\Windows\System\nmsNDFr.exe	N/A
N/A	N/A	C:\Windows\System\urGaJnj.exe	N/A
N/A	N/A	C:\Windows\System\yQfhZZt.exe	N/A
N/A	N/A	C:\Windows\System\PiyGkwW.exe	N/A
N/A	N/A	C:\Windows\System\CyUvZMG.exe	N/A
N/A	N/A	C:\Windows\System\ZAGHbko.exe	N/A
N/A	N/A	C:\Windows\System\pLvWGQZ.exe	N/A
N/A	N/A	C:\Windows\System\rEfutvC.exe	N/A
N/A	N/A	C:\Windows\System\hhnnRne.exe	N/A
N/A	N/A	C:\Windows\System\peAIQyI.exe	N/A
N/A	N/A	C:\Windows\System\wkFsQpm.exe	N/A
N/A	N/A	C:\Windows\System\gayCjxn.exe	N/A
N/A	N/A	C:\Windows\System\GvZOyhx.exe	N/A
N/A	N/A	C:\Windows\System\ZeHJXpE.exe	N/A
N/A	N/A	C:\Windows\System\iRCuatu.exe	N/A
N/A	N/A	C:\Windows\System\jfnXkxb.exe	N/A
N/A	N/A	C:\Windows\System\SYmvecJ.exe	N/A
N/A	N/A	C:\Windows\System\sjmFNqg.exe	N/A
N/A	N/A	C:\Windows\System\UxtXCrl.exe	N/A
N/A	N/A	C:\Windows\System\fYqatck.exe	N/A
N/A	N/A	C:\Windows\System\LesFjBy.exe	N/A
N/A	N/A	C:\Windows\System\wDSKflU.exe	N/A
N/A	N/A	C:\Windows\System\FSwusNo.exe	N/A
N/A	N/A	C:\Windows\System\tiMalQL.exe	N/A
N/A	N/A	C:\Windows\System\ATfdMAa.exe	N/A
N/A	N/A	C:\Windows\System\TevNFcS.exe	N/A
N/A	N/A	C:\Windows\System\aACwfWY.exe	N/A
N/A	N/A	C:\Windows\System\pEWlNOS.exe	N/A
N/A	N/A	C:\Windows\System\fzhYsXf.exe	N/A
N/A	N/A	C:\Windows\System\JIbfvJd.exe	N/A
N/A	N/A	C:\Windows\System\cVBBNse.exe	N/A
N/A	N/A	C:\Windows\System\rQBsgSb.exe	N/A
N/A	N/A	C:\Windows\System\NozaxIP.exe	N/A
N/A	N/A	C:\Windows\System\AvYtkWg.exe	N/A
N/A	N/A	C:\Windows\System\nsHOssN.exe	N/A
N/A	N/A	C:\Windows\System\zjYJgDM.exe	N/A
N/A	N/A	C:\Windows\System\UeyrExt.exe	N/A
N/A	N/A	C:\Windows\System\OsBEKXp.exe	N/A
N/A	N/A	C:\Windows\System\tYGOPuV.exe	N/A
N/A	N/A	C:\Windows\System\lIukckc.exe	N/A
N/A	N/A	C:\Windows\System\qGQdZSZ.exe	N/A
N/A	N/A	C:\Windows\System\SOuuOjf.exe	N/A
N/A	N/A	C:\Windows\System\rFHdaQP.exe	N/A
N/A	N/A	C:\Windows\System\NDqDHZI.exe	N/A
N/A	N/A	C:\Windows\System\AiwmWQs.exe	N/A
N/A	N/A	C:\Windows\System\ewXXTdk.exe	N/A
N/A	N/A	C:\Windows\System\raUXJHw.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\YlVskdd.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TKZaRrX.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZoGOxGr.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hxxNayo.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rvMwRxp.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WTyHOon.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QjppxjL.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CGDzHhD.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kpljjbu.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CznDZnI.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wkqKBBr.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fzLeyTF.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ftJWkhi.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nsHOssN.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GhMDtXF.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HBXydsp.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dptNFDt.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TnZHeUa.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DNiIBRI.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\izHNnRH.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rQBsgSb.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jIiJxRp.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OBfLGdp.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xgPBbVk.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jRoOoLH.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DNLhPwh.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KIxsUbG.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QvQmrZK.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sovVGhp.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hfJrmfb.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DaggqTU.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jbBdIgc.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gKmQcNV.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AnKtSGB.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AWSaewo.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BYLuzYL.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\woTyxqF.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WyXOJEO.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KexrQAe.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ApnkskT.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fjPGmQB.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uvtbmTy.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mHzlGmy.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qzWRnvh.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rBVWvKt.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gApsFGf.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\svzARKI.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jwpFWov.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WllPFFe.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\herISKX.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IkNAxdL.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KXIPmKf.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EIwQkCZ.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zYeNEij.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LuUtJAa.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lOLGtNc.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XbLtjrG.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pLvWGQZ.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aDpqcfe.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rlMhUAi.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zVcdpKP.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vOAwgDM.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\raUXJHw.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CTWrSHH.exe	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 5104 wrote to memory of 2440	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\jkAWfMN.exe
PID 5104 wrote to memory of 2440	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\jkAWfMN.exe
PID 5104 wrote to memory of 1172	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\CGDzHhD.exe
PID 5104 wrote to memory of 1172	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\CGDzHhD.exe
PID 5104 wrote to memory of 2308	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\HohwvoV.exe
PID 5104 wrote to memory of 2308	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\HohwvoV.exe
PID 5104 wrote to memory of 4156	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\svzARKI.exe
PID 5104 wrote to memory of 4156	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\svzARKI.exe
PID 5104 wrote to memory of 2084	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\YsKZQsh.exe
PID 5104 wrote to memory of 2084	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\YsKZQsh.exe
PID 5104 wrote to memory of 1572	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\SvdLGlA.exe
PID 5104 wrote to memory of 1572	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\SvdLGlA.exe
PID 5104 wrote to memory of 3560	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\EPKfBhD.exe
PID 5104 wrote to memory of 3560	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\EPKfBhD.exe
PID 5104 wrote to memory of 5056	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\ZHGXzOg.exe
PID 5104 wrote to memory of 5056	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\ZHGXzOg.exe
PID 5104 wrote to memory of 4208	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\ftJWkhi.exe
PID 5104 wrote to memory of 4208	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\ftJWkhi.exe
PID 5104 wrote to memory of 1476	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\IioWYgW.exe
PID 5104 wrote to memory of 1476	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\IioWYgW.exe
PID 5104 wrote to memory of 720	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\nJiNWfe.exe
PID 5104 wrote to memory of 720	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\nJiNWfe.exe
PID 5104 wrote to memory of 1176	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\IyzBlAd.exe
PID 5104 wrote to memory of 1176	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\IyzBlAd.exe
PID 5104 wrote to memory of 4420	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\eTklRWx.exe
PID 5104 wrote to memory of 4420	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\eTklRWx.exe
PID 5104 wrote to memory of 116	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\ohzkqLm.exe
PID 5104 wrote to memory of 116	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\ohzkqLm.exe
PID 5104 wrote to memory of 404	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\dHuTvEc.exe
PID 5104 wrote to memory of 404	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\dHuTvEc.exe
PID 5104 wrote to memory of 3728	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\Xjxymyd.exe
PID 5104 wrote to memory of 3728	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\Xjxymyd.exe
PID 5104 wrote to memory of 4728	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\Ogneksv.exe
PID 5104 wrote to memory of 4728	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\Ogneksv.exe
PID 5104 wrote to memory of 1276	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\nmsNDFr.exe
PID 5104 wrote to memory of 1276	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\nmsNDFr.exe
PID 5104 wrote to memory of 980	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\urGaJnj.exe
PID 5104 wrote to memory of 980	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\urGaJnj.exe
PID 5104 wrote to memory of 3208	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\yQfhZZt.exe
PID 5104 wrote to memory of 3208	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\yQfhZZt.exe
PID 5104 wrote to memory of 3836	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\PiyGkwW.exe
PID 5104 wrote to memory of 3836	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\PiyGkwW.exe
PID 5104 wrote to memory of 3060	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\CyUvZMG.exe
PID 5104 wrote to memory of 3060	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\CyUvZMG.exe
PID 5104 wrote to memory of 4552	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\ZAGHbko.exe
PID 5104 wrote to memory of 4552	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\ZAGHbko.exe
PID 5104 wrote to memory of 3752	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\pLvWGQZ.exe
PID 5104 wrote to memory of 3752	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\pLvWGQZ.exe
PID 5104 wrote to memory of 3576	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\rEfutvC.exe
PID 5104 wrote to memory of 3576	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\rEfutvC.exe
PID 5104 wrote to memory of 4808	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\hhnnRne.exe
PID 5104 wrote to memory of 4808	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\hhnnRne.exe
PID 5104 wrote to memory of 4924	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\peAIQyI.exe
PID 5104 wrote to memory of 4924	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\peAIQyI.exe
PID 5104 wrote to memory of 232	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\wkFsQpm.exe
PID 5104 wrote to memory of 232	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\wkFsQpm.exe
PID 5104 wrote to memory of 3524	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\gayCjxn.exe
PID 5104 wrote to memory of 3524	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\gayCjxn.exe
PID 5104 wrote to memory of 4740	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\GvZOyhx.exe
PID 5104 wrote to memory of 4740	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\GvZOyhx.exe
PID 5104 wrote to memory of 868	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\UxtXCrl.exe
PID 5104 wrote to memory of 868	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\UxtXCrl.exe
PID 5104 wrote to memory of 2840	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\ZeHJXpE.exe
PID 5104 wrote to memory of 2840	N/A	C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe	C:\Windows\System\ZeHJXpE.exe

Processes

C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\802e261edffca764e8990de2feec7550_NeikiAnalytics.exe"

C:\Windows\System\jkAWfMN.exe

C:\Windows\System\jkAWfMN.exe

C:\Windows\System\CGDzHhD.exe

C:\Windows\System\CGDzHhD.exe

C:\Windows\System\HohwvoV.exe

C:\Windows\System\HohwvoV.exe

C:\Windows\System\svzARKI.exe

C:\Windows\System\svzARKI.exe

C:\Windows\System\YsKZQsh.exe

C:\Windows\System\YsKZQsh.exe

C:\Windows\System\SvdLGlA.exe

C:\Windows\System\SvdLGlA.exe

C:\Windows\System\EPKfBhD.exe

C:\Windows\System\EPKfBhD.exe

C:\Windows\System\ZHGXzOg.exe

C:\Windows\System\ZHGXzOg.exe

C:\Windows\System\ftJWkhi.exe

C:\Windows\System\ftJWkhi.exe

C:\Windows\System\IioWYgW.exe

C:\Windows\System\IioWYgW.exe

C:\Windows\System\nJiNWfe.exe

C:\Windows\System\nJiNWfe.exe

C:\Windows\System\IyzBlAd.exe

C:\Windows\System\IyzBlAd.exe

C:\Windows\System\eTklRWx.exe

C:\Windows\System\eTklRWx.exe

C:\Windows\System\ohzkqLm.exe

C:\Windows\System\ohzkqLm.exe

C:\Windows\System\dHuTvEc.exe

C:\Windows\System\dHuTvEc.exe

C:\Windows\System\Xjxymyd.exe

C:\Windows\System\Xjxymyd.exe

C:\Windows\System\Ogneksv.exe

C:\Windows\System\Ogneksv.exe

C:\Windows\System\nmsNDFr.exe

C:\Windows\System\nmsNDFr.exe

C:\Windows\System\urGaJnj.exe

C:\Windows\System\urGaJnj.exe

C:\Windows\System\yQfhZZt.exe

C:\Windows\System\yQfhZZt.exe

C:\Windows\System\PiyGkwW.exe

C:\Windows\System\PiyGkwW.exe

C:\Windows\System\CyUvZMG.exe

C:\Windows\System\CyUvZMG.exe

C:\Windows\System\ZAGHbko.exe

C:\Windows\System\ZAGHbko.exe

C:\Windows\System\pLvWGQZ.exe

C:\Windows\System\pLvWGQZ.exe

C:\Windows\System\rEfutvC.exe

C:\Windows\System\rEfutvC.exe

C:\Windows\System\hhnnRne.exe

C:\Windows\System\hhnnRne.exe

C:\Windows\System\peAIQyI.exe

C:\Windows\System\peAIQyI.exe

C:\Windows\System\wkFsQpm.exe

C:\Windows\System\wkFsQpm.exe

C:\Windows\System\gayCjxn.exe

C:\Windows\System\gayCjxn.exe

C:\Windows\System\GvZOyhx.exe

C:\Windows\System\GvZOyhx.exe

C:\Windows\System\UxtXCrl.exe

C:\Windows\System\UxtXCrl.exe

C:\Windows\System\ZeHJXpE.exe

C:\Windows\System\ZeHJXpE.exe

C:\Windows\System\iRCuatu.exe

C:\Windows\System\iRCuatu.exe

C:\Windows\System\jfnXkxb.exe

C:\Windows\System\jfnXkxb.exe

C:\Windows\System\TevNFcS.exe

C:\Windows\System\TevNFcS.exe

C:\Windows\System\SYmvecJ.exe

C:\Windows\System\SYmvecJ.exe

C:\Windows\System\sjmFNqg.exe

C:\Windows\System\sjmFNqg.exe

C:\Windows\System\fYqatck.exe

C:\Windows\System\fYqatck.exe

C:\Windows\System\LesFjBy.exe

C:\Windows\System\LesFjBy.exe

C:\Windows\System\wDSKflU.exe

C:\Windows\System\wDSKflU.exe

C:\Windows\System\FSwusNo.exe

C:\Windows\System\FSwusNo.exe

C:\Windows\System\tiMalQL.exe

C:\Windows\System\tiMalQL.exe

C:\Windows\System\ATfdMAa.exe

C:\Windows\System\ATfdMAa.exe

C:\Windows\System\aACwfWY.exe

C:\Windows\System\aACwfWY.exe

C:\Windows\System\pEWlNOS.exe

C:\Windows\System\pEWlNOS.exe

C:\Windows\System\fzhYsXf.exe

C:\Windows\System\fzhYsXf.exe

C:\Windows\System\JIbfvJd.exe

C:\Windows\System\JIbfvJd.exe

C:\Windows\System\cVBBNse.exe

C:\Windows\System\cVBBNse.exe

C:\Windows\System\rQBsgSb.exe

C:\Windows\System\rQBsgSb.exe

C:\Windows\System\NozaxIP.exe

C:\Windows\System\NozaxIP.exe

C:\Windows\System\AvYtkWg.exe

C:\Windows\System\AvYtkWg.exe

C:\Windows\System\nsHOssN.exe

C:\Windows\System\nsHOssN.exe

C:\Windows\System\zjYJgDM.exe

C:\Windows\System\zjYJgDM.exe

C:\Windows\System\UeyrExt.exe

C:\Windows\System\UeyrExt.exe

C:\Windows\System\OsBEKXp.exe

C:\Windows\System\OsBEKXp.exe

C:\Windows\System\tYGOPuV.exe

C:\Windows\System\tYGOPuV.exe

C:\Windows\System\lIukckc.exe

C:\Windows\System\lIukckc.exe

C:\Windows\System\qGQdZSZ.exe

C:\Windows\System\qGQdZSZ.exe

C:\Windows\System\SOuuOjf.exe

C:\Windows\System\SOuuOjf.exe

C:\Windows\System\rFHdaQP.exe

C:\Windows\System\rFHdaQP.exe

C:\Windows\System\NDqDHZI.exe

C:\Windows\System\NDqDHZI.exe

C:\Windows\System\AiwmWQs.exe

C:\Windows\System\AiwmWQs.exe

C:\Windows\System\ewXXTdk.exe

C:\Windows\System\ewXXTdk.exe

C:\Windows\System\raUXJHw.exe

C:\Windows\System\raUXJHw.exe

C:\Windows\System\jIiJxRp.exe

C:\Windows\System\jIiJxRp.exe

C:\Windows\System\qLlTfXb.exe

C:\Windows\System\qLlTfXb.exe

C:\Windows\System\eSbYdrj.exe

C:\Windows\System\eSbYdrj.exe

C:\Windows\System\hKDaqEM.exe

C:\Windows\System\hKDaqEM.exe

C:\Windows\System\iobvqaT.exe

C:\Windows\System\iobvqaT.exe

C:\Windows\System\QPqnCCH.exe

C:\Windows\System\QPqnCCH.exe

C:\Windows\System\yKQkfPq.exe

C:\Windows\System\yKQkfPq.exe

C:\Windows\System\MYiZsVm.exe

C:\Windows\System\MYiZsVm.exe

C:\Windows\System\IpDWIkM.exe

C:\Windows\System\IpDWIkM.exe

C:\Windows\System\GBbztDN.exe

C:\Windows\System\GBbztDN.exe

C:\Windows\System\rXdbEXN.exe

C:\Windows\System\rXdbEXN.exe

C:\Windows\System\kvLdQlU.exe

C:\Windows\System\kvLdQlU.exe

C:\Windows\System\EKlFqZr.exe

C:\Windows\System\EKlFqZr.exe

C:\Windows\System\vMCwPeN.exe

C:\Windows\System\vMCwPeN.exe

C:\Windows\System\starcSG.exe

C:\Windows\System\starcSG.exe

C:\Windows\System\pmLMqNk.exe

C:\Windows\System\pmLMqNk.exe

C:\Windows\System\DYhWSEy.exe

C:\Windows\System\DYhWSEy.exe

C:\Windows\System\sKtlWHd.exe

C:\Windows\System\sKtlWHd.exe

C:\Windows\System\HmRwTLH.exe

C:\Windows\System\HmRwTLH.exe

C:\Windows\System\EgppswZ.exe

C:\Windows\System\EgppswZ.exe

C:\Windows\System\IcBkTpT.exe

C:\Windows\System\IcBkTpT.exe

C:\Windows\System\ShofJZg.exe

C:\Windows\System\ShofJZg.exe

C:\Windows\System\Gjxpqyq.exe

C:\Windows\System\Gjxpqyq.exe

C:\Windows\System\AnKtSGB.exe

C:\Windows\System\AnKtSGB.exe

C:\Windows\System\zFHHirT.exe

C:\Windows\System\zFHHirT.exe

C:\Windows\System\FctBmef.exe

C:\Windows\System\FctBmef.exe

C:\Windows\System\nEzYaPe.exe

C:\Windows\System\nEzYaPe.exe

C:\Windows\System\rVNxYjB.exe

C:\Windows\System\rVNxYjB.exe

C:\Windows\System\rMNmStW.exe

C:\Windows\System\rMNmStW.exe

C:\Windows\System\NNmDIMo.exe

C:\Windows\System\NNmDIMo.exe

C:\Windows\System\sVpugId.exe

C:\Windows\System\sVpugId.exe

C:\Windows\System\DDmPoGD.exe

C:\Windows\System\DDmPoGD.exe

C:\Windows\System\blasDfy.exe

C:\Windows\System\blasDfy.exe

C:\Windows\System\OYoCrVc.exe

C:\Windows\System\OYoCrVc.exe

C:\Windows\System\YMFDKoE.exe

C:\Windows\System\YMFDKoE.exe

C:\Windows\System\KXIPmKf.exe

C:\Windows\System\KXIPmKf.exe

C:\Windows\System\LhtkAsk.exe

C:\Windows\System\LhtkAsk.exe

C:\Windows\System\fnYXTGe.exe

C:\Windows\System\fnYXTGe.exe

C:\Windows\System\VTyeRFC.exe

C:\Windows\System\VTyeRFC.exe

C:\Windows\System\FVdvUZr.exe

C:\Windows\System\FVdvUZr.exe

C:\Windows\System\Gsquwjn.exe

C:\Windows\System\Gsquwjn.exe

C:\Windows\System\DbIoQSY.exe

C:\Windows\System\DbIoQSY.exe

C:\Windows\System\toHEIIL.exe

C:\Windows\System\toHEIIL.exe

C:\Windows\System\tvNEDmt.exe

C:\Windows\System\tvNEDmt.exe

C:\Windows\System\rWmURTw.exe

C:\Windows\System\rWmURTw.exe

C:\Windows\System\CDMTBMb.exe

C:\Windows\System\CDMTBMb.exe

C:\Windows\System\ZRtEXne.exe

C:\Windows\System\ZRtEXne.exe

C:\Windows\System\CLMQOGy.exe

C:\Windows\System\CLMQOGy.exe

C:\Windows\System\dzaRpjB.exe

C:\Windows\System\dzaRpjB.exe

C:\Windows\System\oUKBfDJ.exe

C:\Windows\System\oUKBfDJ.exe

C:\Windows\System\AWSaewo.exe

C:\Windows\System\AWSaewo.exe

C:\Windows\System\TsrESLo.exe

C:\Windows\System\TsrESLo.exe

C:\Windows\System\pAowpvY.exe

C:\Windows\System\pAowpvY.exe

C:\Windows\System\yHcAPKe.exe

C:\Windows\System\yHcAPKe.exe

C:\Windows\System\bxoyagJ.exe

C:\Windows\System\bxoyagJ.exe

C:\Windows\System\OBfLGdp.exe

C:\Windows\System\OBfLGdp.exe

C:\Windows\System\FSdNOyr.exe

C:\Windows\System\FSdNOyr.exe

C:\Windows\System\eDzAfhM.exe

C:\Windows\System\eDzAfhM.exe

C:\Windows\System\wGGGhvy.exe

C:\Windows\System\wGGGhvy.exe

C:\Windows\System\BYLuzYL.exe

C:\Windows\System\BYLuzYL.exe

C:\Windows\System\ChkqOtL.exe

C:\Windows\System\ChkqOtL.exe

C:\Windows\System\etBiphA.exe

C:\Windows\System\etBiphA.exe

C:\Windows\System\sQxtHWb.exe

C:\Windows\System\sQxtHWb.exe

C:\Windows\System\FFRqcAE.exe

C:\Windows\System\FFRqcAE.exe

C:\Windows\System\xMBpkDE.exe

C:\Windows\System\xMBpkDE.exe

C:\Windows\System\IoltJsQ.exe

C:\Windows\System\IoltJsQ.exe

C:\Windows\System\edEptkc.exe

C:\Windows\System\edEptkc.exe

C:\Windows\System\elnYBil.exe

C:\Windows\System\elnYBil.exe

C:\Windows\System\GcHraTw.exe

C:\Windows\System\GcHraTw.exe

C:\Windows\System\mByHvEo.exe

C:\Windows\System\mByHvEo.exe

C:\Windows\System\kUmtBdP.exe

C:\Windows\System\kUmtBdP.exe

C:\Windows\System\kKQlQGR.exe

C:\Windows\System\kKQlQGR.exe

C:\Windows\System\RJdeRgE.exe

C:\Windows\System\RJdeRgE.exe

C:\Windows\System\BtcBhVc.exe

C:\Windows\System\BtcBhVc.exe

C:\Windows\System\wmKTBnV.exe

C:\Windows\System\wmKTBnV.exe

C:\Windows\System\fsyBIPW.exe

C:\Windows\System\fsyBIPW.exe

C:\Windows\System\YxEyynd.exe

C:\Windows\System\YxEyynd.exe

C:\Windows\System\GNCDJlr.exe

C:\Windows\System\GNCDJlr.exe

C:\Windows\System\itmujRi.exe

C:\Windows\System\itmujRi.exe

C:\Windows\System\sufdxzC.exe

C:\Windows\System\sufdxzC.exe

C:\Windows\System\vSMplRM.exe

C:\Windows\System\vSMplRM.exe

C:\Windows\System\CavTUDj.exe

C:\Windows\System\CavTUDj.exe

C:\Windows\System\ZquUklP.exe

C:\Windows\System\ZquUklP.exe

C:\Windows\System\ovfkxPO.exe

C:\Windows\System\ovfkxPO.exe

C:\Windows\System\vaKgOZJ.exe

C:\Windows\System\vaKgOZJ.exe

C:\Windows\System\lmFKyKL.exe

C:\Windows\System\lmFKyKL.exe

C:\Windows\System\SRIXWlu.exe

C:\Windows\System\SRIXWlu.exe

C:\Windows\System\gUOhJfx.exe

C:\Windows\System\gUOhJfx.exe

C:\Windows\System\LQyEwzL.exe

C:\Windows\System\LQyEwzL.exe

C:\Windows\System\lfeZmJc.exe

C:\Windows\System\lfeZmJc.exe

C:\Windows\System\KLztTjj.exe

C:\Windows\System\KLztTjj.exe

C:\Windows\System\dRFWVpH.exe

C:\Windows\System\dRFWVpH.exe

C:\Windows\System\neToNCm.exe

C:\Windows\System\neToNCm.exe

C:\Windows\System\SKirggx.exe

C:\Windows\System\SKirggx.exe

C:\Windows\System\EsAyynD.exe

C:\Windows\System\EsAyynD.exe

C:\Windows\System\FBYrJbN.exe

C:\Windows\System\FBYrJbN.exe

C:\Windows\System\XIbxgRI.exe

C:\Windows\System\XIbxgRI.exe

C:\Windows\System\OKvbKLd.exe

C:\Windows\System\OKvbKLd.exe

C:\Windows\System\zncXWyx.exe

C:\Windows\System\zncXWyx.exe

C:\Windows\System\oBSrDko.exe

C:\Windows\System\oBSrDko.exe

C:\Windows\System\nYxpSQs.exe

C:\Windows\System\nYxpSQs.exe

C:\Windows\System\ZxTxDoP.exe

C:\Windows\System\ZxTxDoP.exe

C:\Windows\System\GmceoCU.exe

C:\Windows\System\GmceoCU.exe

C:\Windows\System\EfutXAK.exe

C:\Windows\System\EfutXAK.exe

C:\Windows\System\vRUettI.exe

C:\Windows\System\vRUettI.exe

C:\Windows\System\TJiLRzJ.exe

C:\Windows\System\TJiLRzJ.exe

C:\Windows\System\jddhnLF.exe

C:\Windows\System\jddhnLF.exe

C:\Windows\System\IhEHXOw.exe

C:\Windows\System\IhEHXOw.exe

C:\Windows\System\NWkMZeb.exe

C:\Windows\System\NWkMZeb.exe

C:\Windows\System\MesOkSt.exe

C:\Windows\System\MesOkSt.exe

C:\Windows\System\VgLVAvB.exe

C:\Windows\System\VgLVAvB.exe

C:\Windows\System\iBlRufj.exe

C:\Windows\System\iBlRufj.exe

C:\Windows\System\vwimSUS.exe

C:\Windows\System\vwimSUS.exe

C:\Windows\System\YxkCApf.exe

C:\Windows\System\YxkCApf.exe

C:\Windows\System\EqeEmcF.exe

C:\Windows\System\EqeEmcF.exe

C:\Windows\System\JSPZabV.exe

C:\Windows\System\JSPZabV.exe

C:\Windows\System\VszktGP.exe

C:\Windows\System\VszktGP.exe

C:\Windows\System\OYvqfzM.exe

C:\Windows\System\OYvqfzM.exe

C:\Windows\System\TUjfaRe.exe

C:\Windows\System\TUjfaRe.exe

C:\Windows\System\hWGGhER.exe

C:\Windows\System\hWGGhER.exe

C:\Windows\System\pWkxZVf.exe

C:\Windows\System\pWkxZVf.exe

C:\Windows\System\PZlhByv.exe

C:\Windows\System\PZlhByv.exe

C:\Windows\System\jPTobGd.exe

C:\Windows\System\jPTobGd.exe

C:\Windows\System\rRHCEMF.exe

C:\Windows\System\rRHCEMF.exe

C:\Windows\System\BUNXNAT.exe

C:\Windows\System\BUNXNAT.exe

C:\Windows\System\zwhyhju.exe

C:\Windows\System\zwhyhju.exe

C:\Windows\System\lOLGtNc.exe

C:\Windows\System\lOLGtNc.exe

C:\Windows\System\MNgfyrx.exe

C:\Windows\System\MNgfyrx.exe

C:\Windows\System\aWnDERO.exe

C:\Windows\System\aWnDERO.exe

C:\Windows\System\zunkTYR.exe

C:\Windows\System\zunkTYR.exe

C:\Windows\System\LAiIdvS.exe

C:\Windows\System\LAiIdvS.exe

C:\Windows\System\DyrZkVw.exe

C:\Windows\System\DyrZkVw.exe

C:\Windows\System\CRgByvW.exe

C:\Windows\System\CRgByvW.exe

C:\Windows\System\GSDKKPf.exe

C:\Windows\System\GSDKKPf.exe

C:\Windows\System\QBUVJsm.exe

C:\Windows\System\QBUVJsm.exe

C:\Windows\System\VsozrCE.exe

C:\Windows\System\VsozrCE.exe

C:\Windows\System\OLLBmxm.exe

C:\Windows\System\OLLBmxm.exe

C:\Windows\System\CFDVQtf.exe

C:\Windows\System\CFDVQtf.exe

C:\Windows\System\rRVwhQQ.exe

C:\Windows\System\rRVwhQQ.exe

C:\Windows\System\JaRwNWW.exe

C:\Windows\System\JaRwNWW.exe

C:\Windows\System\tdBZmYY.exe

C:\Windows\System\tdBZmYY.exe

C:\Windows\System\cZFCclG.exe

C:\Windows\System\cZFCclG.exe

C:\Windows\System\jwpFWov.exe

C:\Windows\System\jwpFWov.exe

C:\Windows\System\kuunuPB.exe

C:\Windows\System\kuunuPB.exe

C:\Windows\System\OGmYVXU.exe

C:\Windows\System\OGmYVXU.exe

C:\Windows\System\wvAfoDN.exe

C:\Windows\System\wvAfoDN.exe

C:\Windows\System\FLtaIfk.exe

C:\Windows\System\FLtaIfk.exe

C:\Windows\System\kpljjbu.exe

C:\Windows\System\kpljjbu.exe

C:\Windows\System\rWdlXjn.exe

C:\Windows\System\rWdlXjn.exe

C:\Windows\System\DNaBxYJ.exe

C:\Windows\System\DNaBxYJ.exe

C:\Windows\System\NiPwncM.exe

C:\Windows\System\NiPwncM.exe

C:\Windows\System\JKMvfXR.exe

C:\Windows\System\JKMvfXR.exe

C:\Windows\System\mtRIHAs.exe

C:\Windows\System\mtRIHAs.exe

C:\Windows\System\HshTlBJ.exe

C:\Windows\System\HshTlBJ.exe

C:\Windows\System\ZiygzNM.exe

C:\Windows\System\ZiygzNM.exe

C:\Windows\System\aDpqcfe.exe

C:\Windows\System\aDpqcfe.exe

C:\Windows\System\AlagzSZ.exe

C:\Windows\System\AlagzSZ.exe

C:\Windows\System\XuvfYAA.exe

C:\Windows\System\XuvfYAA.exe

C:\Windows\System\ThIoupb.exe

C:\Windows\System\ThIoupb.exe

C:\Windows\System\pDAdcqM.exe

C:\Windows\System\pDAdcqM.exe

C:\Windows\System\aVvRXAI.exe

C:\Windows\System\aVvRXAI.exe

C:\Windows\System\TsIZfYm.exe

C:\Windows\System\TsIZfYm.exe

C:\Windows\System\eLyJJPL.exe

C:\Windows\System\eLyJJPL.exe

C:\Windows\System\OFIWBbi.exe

C:\Windows\System\OFIWBbi.exe

C:\Windows\System\YnYXDbw.exe

C:\Windows\System\YnYXDbw.exe

C:\Windows\System\vlWGMsJ.exe

C:\Windows\System\vlWGMsJ.exe

C:\Windows\System\eNaqVkA.exe

C:\Windows\System\eNaqVkA.exe

C:\Windows\System\XuxKmpt.exe

C:\Windows\System\XuxKmpt.exe

C:\Windows\System\GkmpsYz.exe

C:\Windows\System\GkmpsYz.exe

C:\Windows\System\oYagGWy.exe

C:\Windows\System\oYagGWy.exe

C:\Windows\System\KexrQAe.exe

C:\Windows\System\KexrQAe.exe

C:\Windows\System\iVAvBzt.exe

C:\Windows\System\iVAvBzt.exe

C:\Windows\System\MagiEod.exe

C:\Windows\System\MagiEod.exe

C:\Windows\System\ajfJQsp.exe

C:\Windows\System\ajfJQsp.exe

C:\Windows\System\sPNyCTa.exe

C:\Windows\System\sPNyCTa.exe

C:\Windows\System\nTVUVjI.exe

C:\Windows\System\nTVUVjI.exe

C:\Windows\System\woTyxqF.exe

C:\Windows\System\woTyxqF.exe

C:\Windows\System\uqMQUdl.exe

C:\Windows\System\uqMQUdl.exe

C:\Windows\System\mLUomCK.exe

C:\Windows\System\mLUomCK.exe

C:\Windows\System\WMAeKrQ.exe

C:\Windows\System\WMAeKrQ.exe

C:\Windows\System\VWbagvX.exe

C:\Windows\System\VWbagvX.exe

C:\Windows\System\CGqSMpR.exe

C:\Windows\System\CGqSMpR.exe

C:\Windows\System\mOqgkjl.exe

C:\Windows\System\mOqgkjl.exe

C:\Windows\System\BsITytZ.exe

C:\Windows\System\BsITytZ.exe

C:\Windows\System\rlMhUAi.exe

C:\Windows\System\rlMhUAi.exe

C:\Windows\System\dIRrdCP.exe

C:\Windows\System\dIRrdCP.exe

C:\Windows\System\ANHcxoJ.exe

C:\Windows\System\ANHcxoJ.exe

C:\Windows\System\ngYPHhy.exe

C:\Windows\System\ngYPHhy.exe

C:\Windows\System\JfgROGW.exe

C:\Windows\System\JfgROGW.exe

C:\Windows\System\bJGVaWO.exe

C:\Windows\System\bJGVaWO.exe

C:\Windows\System\KHFevow.exe

C:\Windows\System\KHFevow.exe

C:\Windows\System\kihFnty.exe

C:\Windows\System\kihFnty.exe

C:\Windows\System\jmKqJwl.exe

C:\Windows\System\jmKqJwl.exe

C:\Windows\System\CsrtRWq.exe

C:\Windows\System\CsrtRWq.exe

C:\Windows\System\xgPBbVk.exe

C:\Windows\System\xgPBbVk.exe

C:\Windows\System\WyXOJEO.exe

C:\Windows\System\WyXOJEO.exe

C:\Windows\System\oKIABpY.exe

C:\Windows\System\oKIABpY.exe

C:\Windows\System\RWggZak.exe

C:\Windows\System\RWggZak.exe

C:\Windows\System\kZCNigD.exe

C:\Windows\System\kZCNigD.exe

C:\Windows\System\rcGWphM.exe

C:\Windows\System\rcGWphM.exe

C:\Windows\System\RcGQpbi.exe

C:\Windows\System\RcGQpbi.exe

C:\Windows\System\zawTrjC.exe

C:\Windows\System\zawTrjC.exe

C:\Windows\System\PQiYltD.exe

C:\Windows\System\PQiYltD.exe

C:\Windows\System\WYtvnpd.exe

C:\Windows\System\WYtvnpd.exe

C:\Windows\System\jRoOoLH.exe

C:\Windows\System\jRoOoLH.exe

C:\Windows\System\NQFgwyT.exe

C:\Windows\System\NQFgwyT.exe

C:\Windows\System\DJlUntT.exe

C:\Windows\System\DJlUntT.exe

C:\Windows\System\ubbyLWQ.exe

C:\Windows\System\ubbyLWQ.exe

C:\Windows\System\siRGnBV.exe

C:\Windows\System\siRGnBV.exe

C:\Windows\System\ApnkskT.exe

C:\Windows\System\ApnkskT.exe

C:\Windows\System\BMipIyt.exe

C:\Windows\System\BMipIyt.exe

C:\Windows\System\ravWqHJ.exe

C:\Windows\System\ravWqHJ.exe

C:\Windows\System\cRnbcYl.exe

C:\Windows\System\cRnbcYl.exe

C:\Windows\System\IHDMRzp.exe

C:\Windows\System\IHDMRzp.exe

C:\Windows\System\opGhRUR.exe

C:\Windows\System\opGhRUR.exe

C:\Windows\System\gQhicmx.exe

C:\Windows\System\gQhicmx.exe

C:\Windows\System\ouVMYyM.exe

C:\Windows\System\ouVMYyM.exe

C:\Windows\System\SpRKXtv.exe

C:\Windows\System\SpRKXtv.exe

C:\Windows\System\eyOMOKq.exe

C:\Windows\System\eyOMOKq.exe

C:\Windows\System\isOKfbs.exe

C:\Windows\System\isOKfbs.exe

C:\Windows\System\GZwtxJl.exe

C:\Windows\System\GZwtxJl.exe

C:\Windows\System\zoPKSBB.exe

C:\Windows\System\zoPKSBB.exe

C:\Windows\System\FucffZK.exe

C:\Windows\System\FucffZK.exe

C:\Windows\System\OqzvXfT.exe

C:\Windows\System\OqzvXfT.exe

C:\Windows\System\pdYtOjH.exe

C:\Windows\System\pdYtOjH.exe

C:\Windows\System\pnTQwTL.exe

C:\Windows\System\pnTQwTL.exe

C:\Windows\System\jvhEnfl.exe

C:\Windows\System\jvhEnfl.exe

C:\Windows\System\HwmtoDv.exe

C:\Windows\System\HwmtoDv.exe

C:\Windows\System\qLlDbkw.exe

C:\Windows\System\qLlDbkw.exe

C:\Windows\System\McZaGLJ.exe

C:\Windows\System\McZaGLJ.exe

C:\Windows\System\apkSKqG.exe

C:\Windows\System\apkSKqG.exe

C:\Windows\System\MtfLoiM.exe

C:\Windows\System\MtfLoiM.exe

C:\Windows\System\JKREXss.exe

C:\Windows\System\JKREXss.exe

C:\Windows\System\qDJTKgg.exe

C:\Windows\System\qDJTKgg.exe

C:\Windows\System\mMzDNDE.exe

C:\Windows\System\mMzDNDE.exe

C:\Windows\System\bnLqjEs.exe

C:\Windows\System\bnLqjEs.exe

C:\Windows\System\NjayOJk.exe

C:\Windows\System\NjayOJk.exe

C:\Windows\System\CznDZnI.exe

C:\Windows\System\CznDZnI.exe

C:\Windows\System\uvvbZbt.exe

C:\Windows\System\uvvbZbt.exe

C:\Windows\System\ZangQtt.exe

C:\Windows\System\ZangQtt.exe

C:\Windows\System\cnwbtkG.exe

C:\Windows\System\cnwbtkG.exe

C:\Windows\System\MEVcIoz.exe

C:\Windows\System\MEVcIoz.exe

C:\Windows\System\xhYaZrq.exe

C:\Windows\System\xhYaZrq.exe

C:\Windows\System\TnszMAV.exe

C:\Windows\System\TnszMAV.exe

C:\Windows\System\KkBJuEn.exe

C:\Windows\System\KkBJuEn.exe

C:\Windows\System\cUFzeAA.exe

C:\Windows\System\cUFzeAA.exe

C:\Windows\System\IWyJztr.exe

C:\Windows\System\IWyJztr.exe

C:\Windows\System\WnsRjZa.exe

C:\Windows\System\WnsRjZa.exe

C:\Windows\System\ZHLRVwL.exe

C:\Windows\System\ZHLRVwL.exe

C:\Windows\System\xjbnxNu.exe

C:\Windows\System\xjbnxNu.exe

C:\Windows\System\JfsVGsw.exe

C:\Windows\System\JfsVGsw.exe

C:\Windows\System\jXgKrHt.exe

C:\Windows\System\jXgKrHt.exe

C:\Windows\System\VTwhTmW.exe

C:\Windows\System\VTwhTmW.exe

C:\Windows\System\yQPowhM.exe

C:\Windows\System\yQPowhM.exe

C:\Windows\System\WiDrjjV.exe

C:\Windows\System\WiDrjjV.exe

C:\Windows\System\GURNHen.exe

C:\Windows\System\GURNHen.exe

C:\Windows\System\HSdYnMG.exe

C:\Windows\System\HSdYnMG.exe

C:\Windows\System\vfNPxvP.exe

C:\Windows\System\vfNPxvP.exe

C:\Windows\System\gtOXNOq.exe

C:\Windows\System\gtOXNOq.exe

C:\Windows\System\wAkCfEC.exe

C:\Windows\System\wAkCfEC.exe

C:\Windows\System\bpeZfGy.exe

C:\Windows\System\bpeZfGy.exe

C:\Windows\System\jQVzCKU.exe

C:\Windows\System\jQVzCKU.exe

C:\Windows\System\jfcNUVy.exe

C:\Windows\System\jfcNUVy.exe

C:\Windows\System\CTWrSHH.exe

C:\Windows\System\CTWrSHH.exe

C:\Windows\System\LrwLeph.exe

C:\Windows\System\LrwLeph.exe

C:\Windows\System\yrAmYpy.exe

C:\Windows\System\yrAmYpy.exe

C:\Windows\System\HldYbDn.exe

C:\Windows\System\HldYbDn.exe

C:\Windows\System\jUQyaRF.exe

C:\Windows\System\jUQyaRF.exe

C:\Windows\System\uqykCll.exe

C:\Windows\System\uqykCll.exe

C:\Windows\System\RBFmtLv.exe

C:\Windows\System\RBFmtLv.exe

C:\Windows\System\zNZqVJN.exe

C:\Windows\System\zNZqVJN.exe

C:\Windows\System\RhxjDfP.exe

C:\Windows\System\RhxjDfP.exe

C:\Windows\System\qUwARIl.exe

C:\Windows\System\qUwARIl.exe

C:\Windows\System\qvMfTBl.exe

C:\Windows\System\qvMfTBl.exe

C:\Windows\System\DBOtHdG.exe

C:\Windows\System\DBOtHdG.exe

C:\Windows\System\iVlBGIF.exe

C:\Windows\System\iVlBGIF.exe

C:\Windows\System\KuKUXPz.exe

C:\Windows\System\KuKUXPz.exe

C:\Windows\System\UMcyxif.exe

C:\Windows\System\UMcyxif.exe

C:\Windows\System\lOpxQNr.exe

C:\Windows\System\lOpxQNr.exe

C:\Windows\System\zPMzsvm.exe

C:\Windows\System\zPMzsvm.exe

C:\Windows\System\VpwsRMS.exe

C:\Windows\System\VpwsRMS.exe

C:\Windows\System\uOMnMDM.exe

C:\Windows\System\uOMnMDM.exe

C:\Windows\System\gbxSwiM.exe

C:\Windows\System\gbxSwiM.exe

C:\Windows\System\WwLCcuY.exe

C:\Windows\System\WwLCcuY.exe

C:\Windows\System\GhMDtXF.exe

C:\Windows\System\GhMDtXF.exe

C:\Windows\System\lVkRImI.exe

C:\Windows\System\lVkRImI.exe

C:\Windows\System\rocFytG.exe

C:\Windows\System\rocFytG.exe

C:\Windows\System\MqnIhDC.exe

C:\Windows\System\MqnIhDC.exe

C:\Windows\System\KAtRDnn.exe

C:\Windows\System\KAtRDnn.exe

C:\Windows\System\IaZZwBw.exe

C:\Windows\System\IaZZwBw.exe

C:\Windows\System\VYnpZtn.exe

C:\Windows\System\VYnpZtn.exe

C:\Windows\System\LmozhjK.exe

C:\Windows\System\LmozhjK.exe

C:\Windows\System\aMUZDoM.exe

C:\Windows\System\aMUZDoM.exe

C:\Windows\System\cNMixvQ.exe

C:\Windows\System\cNMixvQ.exe

C:\Windows\System\QZzttda.exe

C:\Windows\System\QZzttda.exe

C:\Windows\System\KNGzJAU.exe

C:\Windows\System\KNGzJAU.exe

C:\Windows\System\vbMecMQ.exe

C:\Windows\System\vbMecMQ.exe

C:\Windows\System\GiBnhhR.exe

C:\Windows\System\GiBnhhR.exe

C:\Windows\System\rvMwRxp.exe

C:\Windows\System\rvMwRxp.exe

C:\Windows\System\nlfcDOG.exe

C:\Windows\System\nlfcDOG.exe

C:\Windows\System\rILHHUn.exe

C:\Windows\System\rILHHUn.exe

C:\Windows\System\OZTRHHA.exe

C:\Windows\System\OZTRHHA.exe

C:\Windows\System\TnZHeUa.exe

C:\Windows\System\TnZHeUa.exe

C:\Windows\System\MuLylpO.exe

C:\Windows\System\MuLylpO.exe

C:\Windows\System\bclaeIt.exe

C:\Windows\System\bclaeIt.exe

C:\Windows\System\kiRSGKJ.exe

C:\Windows\System\kiRSGKJ.exe

C:\Windows\System\yTqOYbT.exe

C:\Windows\System\yTqOYbT.exe

C:\Windows\System\LeILKBs.exe

C:\Windows\System\LeILKBs.exe

C:\Windows\System\NnOSPmo.exe

C:\Windows\System\NnOSPmo.exe

C:\Windows\System\WcAjioh.exe

C:\Windows\System\WcAjioh.exe

C:\Windows\System\RZxlWcb.exe

C:\Windows\System\RZxlWcb.exe

C:\Windows\System\oCCtLPq.exe

C:\Windows\System\oCCtLPq.exe

C:\Windows\System\ZvXhnhm.exe

C:\Windows\System\ZvXhnhm.exe

C:\Windows\System\pjfZoGe.exe

C:\Windows\System\pjfZoGe.exe

C:\Windows\System\DaggqTU.exe

C:\Windows\System\DaggqTU.exe

C:\Windows\System\qYBysRa.exe

C:\Windows\System\qYBysRa.exe

C:\Windows\System\XYvjHdC.exe

C:\Windows\System\XYvjHdC.exe

C:\Windows\System\NmMrLJI.exe

C:\Windows\System\NmMrLJI.exe

C:\Windows\System\IIdasIF.exe

C:\Windows\System\IIdasIF.exe

C:\Windows\System\YmWePyY.exe

C:\Windows\System\YmWePyY.exe

C:\Windows\System\mrsufwO.exe

C:\Windows\System\mrsufwO.exe

C:\Windows\System\pHyjIup.exe

C:\Windows\System\pHyjIup.exe

C:\Windows\System\RKDfGOo.exe

C:\Windows\System\RKDfGOo.exe

C:\Windows\System\iBMfGwQ.exe

C:\Windows\System\iBMfGwQ.exe

C:\Windows\System\HMSQsZN.exe

C:\Windows\System\HMSQsZN.exe

C:\Windows\System\pJexTva.exe

C:\Windows\System\pJexTva.exe

C:\Windows\System\lPHIXSz.exe

C:\Windows\System\lPHIXSz.exe

C:\Windows\System\LMpxPvC.exe

C:\Windows\System\LMpxPvC.exe

C:\Windows\System\JpHSPDx.exe

C:\Windows\System\JpHSPDx.exe

C:\Windows\System\WllPFFe.exe

C:\Windows\System\WllPFFe.exe

C:\Windows\System\RGDKRRD.exe

C:\Windows\System\RGDKRRD.exe

C:\Windows\System\eeMgCZv.exe

C:\Windows\System\eeMgCZv.exe

C:\Windows\System\mUpACSk.exe

C:\Windows\System\mUpACSk.exe

C:\Windows\System\YlVskdd.exe

C:\Windows\System\YlVskdd.exe

C:\Windows\System\ZsuIEfq.exe

C:\Windows\System\ZsuIEfq.exe

C:\Windows\System\cHiyyjK.exe

C:\Windows\System\cHiyyjK.exe

C:\Windows\System\rwLmBLP.exe

C:\Windows\System\rwLmBLP.exe

C:\Windows\System\cKrXJkP.exe

C:\Windows\System\cKrXJkP.exe

C:\Windows\System\CIzrMan.exe

C:\Windows\System\CIzrMan.exe

C:\Windows\System\zKwvMeL.exe

C:\Windows\System\zKwvMeL.exe

C:\Windows\System\VncJSBB.exe

C:\Windows\System\VncJSBB.exe

C:\Windows\System\nApMrCz.exe

C:\Windows\System\nApMrCz.exe

C:\Windows\System\qzBFtKQ.exe

C:\Windows\System\qzBFtKQ.exe

C:\Windows\System\oTNiXiG.exe

C:\Windows\System\oTNiXiG.exe

C:\Windows\System\OWoPgTq.exe

C:\Windows\System\OWoPgTq.exe

C:\Windows\System\jklVgHC.exe

C:\Windows\System\jklVgHC.exe

C:\Windows\System\zkqqSgh.exe

C:\Windows\System\zkqqSgh.exe

C:\Windows\System\IGjBFne.exe

C:\Windows\System\IGjBFne.exe

C:\Windows\System\aqiYszR.exe

C:\Windows\System\aqiYszR.exe

C:\Windows\System\DNVbQYF.exe

C:\Windows\System\DNVbQYF.exe

C:\Windows\System\LiFTphh.exe

C:\Windows\System\LiFTphh.exe

C:\Windows\System\zGpqaua.exe

C:\Windows\System\zGpqaua.exe

C:\Windows\System\KdeZVUK.exe

C:\Windows\System\KdeZVUK.exe

C:\Windows\System\JWMELax.exe

C:\Windows\System\JWMELax.exe

C:\Windows\System\wSLAdyx.exe

C:\Windows\System\wSLAdyx.exe

C:\Windows\System\yqHJeMz.exe

C:\Windows\System\yqHJeMz.exe

C:\Windows\System\ylhIJfc.exe

C:\Windows\System\ylhIJfc.exe

C:\Windows\System\HBXydsp.exe

C:\Windows\System\HBXydsp.exe

C:\Windows\System\aDNQIEQ.exe

C:\Windows\System\aDNQIEQ.exe

C:\Windows\System\luTQZWT.exe

C:\Windows\System\luTQZWT.exe

C:\Windows\System\MaWhWhp.exe

C:\Windows\System\MaWhWhp.exe

C:\Windows\System\ybgBvMj.exe

C:\Windows\System\ybgBvMj.exe

C:\Windows\System\NqOjtKP.exe

C:\Windows\System\NqOjtKP.exe

C:\Windows\System\KcTSEdp.exe

C:\Windows\System\KcTSEdp.exe

C:\Windows\System\WCdpzOK.exe

C:\Windows\System\WCdpzOK.exe

C:\Windows\System\BjPjizz.exe

C:\Windows\System\BjPjizz.exe

C:\Windows\System\rhzezKl.exe

C:\Windows\System\rhzezKl.exe

C:\Windows\System\BbFKWBM.exe

C:\Windows\System\BbFKWBM.exe

C:\Windows\System\hsuKNrC.exe

C:\Windows\System\hsuKNrC.exe

C:\Windows\System\FJbNQCk.exe

C:\Windows\System\FJbNQCk.exe

C:\Windows\System\jxDrRKl.exe

C:\Windows\System\jxDrRKl.exe

C:\Windows\System\uvtbmTy.exe

C:\Windows\System\uvtbmTy.exe

C:\Windows\System\RCcpUYA.exe

C:\Windows\System\RCcpUYA.exe

C:\Windows\System\fjPGmQB.exe

C:\Windows\System\fjPGmQB.exe

C:\Windows\System\NzBNfvg.exe

C:\Windows\System\NzBNfvg.exe

C:\Windows\System\famPZgK.exe

C:\Windows\System\famPZgK.exe

C:\Windows\System\herISKX.exe

C:\Windows\System\herISKX.exe

C:\Windows\System\PnZsZmZ.exe

C:\Windows\System\PnZsZmZ.exe

C:\Windows\System\DNiIBRI.exe

C:\Windows\System\DNiIBRI.exe

C:\Windows\System\kbiFDQh.exe

C:\Windows\System\kbiFDQh.exe

C:\Windows\System\vtVSWai.exe

C:\Windows\System\vtVSWai.exe

C:\Windows\System\uHNujZC.exe

C:\Windows\System\uHNujZC.exe

C:\Windows\System\aNzetlr.exe

C:\Windows\System\aNzetlr.exe

C:\Windows\System\cUBppMO.exe

C:\Windows\System\cUBppMO.exe

C:\Windows\System\IQHzXRr.exe

C:\Windows\System\IQHzXRr.exe

C:\Windows\System\YLspHMe.exe

C:\Windows\System\YLspHMe.exe

C:\Windows\System\awmdSIe.exe

C:\Windows\System\awmdSIe.exe

C:\Windows\System\Spluupo.exe

C:\Windows\System\Spluupo.exe

C:\Windows\System\UvsMMfD.exe

C:\Windows\System\UvsMMfD.exe

C:\Windows\System\CYkmSwx.exe

C:\Windows\System\CYkmSwx.exe

C:\Windows\System\WfVjsUC.exe

C:\Windows\System\WfVjsUC.exe

C:\Windows\System\UtFZmxu.exe

C:\Windows\System\UtFZmxu.exe

C:\Windows\System\ddOwBnU.exe

C:\Windows\System\ddOwBnU.exe

C:\Windows\System\TQBegLl.exe

C:\Windows\System\TQBegLl.exe

C:\Windows\System\wkqKBBr.exe

C:\Windows\System\wkqKBBr.exe

C:\Windows\System\JbwaMiQ.exe

C:\Windows\System\JbwaMiQ.exe

C:\Windows\System\oKnKyto.exe

C:\Windows\System\oKnKyto.exe

C:\Windows\System\jbBdIgc.exe

C:\Windows\System\jbBdIgc.exe

C:\Windows\System\beSJYlI.exe

C:\Windows\System\beSJYlI.exe

C:\Windows\System\JqpuxiO.exe

C:\Windows\System\JqpuxiO.exe

C:\Windows\System\WTyHOon.exe

C:\Windows\System\WTyHOon.exe

C:\Windows\System\bdEBjum.exe

C:\Windows\System\bdEBjum.exe

C:\Windows\System\hnGzBKs.exe

C:\Windows\System\hnGzBKs.exe

C:\Windows\System\zTnEeIk.exe

C:\Windows\System\zTnEeIk.exe

C:\Windows\System\lQvlQmI.exe

C:\Windows\System\lQvlQmI.exe

C:\Windows\System\WOTmemO.exe

C:\Windows\System\WOTmemO.exe

C:\Windows\System\aGlBuEL.exe

C:\Windows\System\aGlBuEL.exe

C:\Windows\System\SjQStNf.exe

C:\Windows\System\SjQStNf.exe

C:\Windows\System\VacuPiY.exe

C:\Windows\System\VacuPiY.exe

C:\Windows\System\tfYRUDo.exe

C:\Windows\System\tfYRUDo.exe

C:\Windows\System\vWhvWhb.exe

C:\Windows\System\vWhvWhb.exe

C:\Windows\System\GXMMgUW.exe

C:\Windows\System\GXMMgUW.exe

C:\Windows\System\IjSKvSx.exe

C:\Windows\System\IjSKvSx.exe

C:\Windows\System\dbCKJzo.exe

C:\Windows\System\dbCKJzo.exe

C:\Windows\System\nCZolmW.exe

C:\Windows\System\nCZolmW.exe

C:\Windows\System\fLCmSzp.exe

C:\Windows\System\fLCmSzp.exe

C:\Windows\System\edHAwta.exe

C:\Windows\System\edHAwta.exe

C:\Windows\System\KiuVRdr.exe

C:\Windows\System\KiuVRdr.exe

C:\Windows\System\IkNAxdL.exe

C:\Windows\System\IkNAxdL.exe

C:\Windows\System\wJKDhlq.exe

C:\Windows\System\wJKDhlq.exe

C:\Windows\System\YSIdDBF.exe

C:\Windows\System\YSIdDBF.exe

C:\Windows\System\BMPhquk.exe

C:\Windows\System\BMPhquk.exe

C:\Windows\System\qXknlMp.exe

C:\Windows\System\qXknlMp.exe

C:\Windows\System\FDLzAqX.exe

C:\Windows\System\FDLzAqX.exe

C:\Windows\System\kglXxLt.exe

C:\Windows\System\kglXxLt.exe

C:\Windows\System\EIwQkCZ.exe

C:\Windows\System\EIwQkCZ.exe

C:\Windows\System\ZKXYTuJ.exe

C:\Windows\System\ZKXYTuJ.exe

C:\Windows\System\kDLkCMb.exe

C:\Windows\System\kDLkCMb.exe

C:\Windows\System\NBGSPSt.exe

C:\Windows\System\NBGSPSt.exe

C:\Windows\System\WCLYugw.exe

C:\Windows\System\WCLYugw.exe

C:\Windows\System\CiSieEz.exe

C:\Windows\System\CiSieEz.exe

C:\Windows\System\eYVHiDJ.exe

C:\Windows\System\eYVHiDJ.exe

C:\Windows\System\SGrBsYp.exe

C:\Windows\System\SGrBsYp.exe

C:\Windows\System\TlAWhpC.exe

C:\Windows\System\TlAWhpC.exe

C:\Windows\System\FNqdRHi.exe

C:\Windows\System\FNqdRHi.exe

C:\Windows\System\QihTHql.exe

C:\Windows\System\QihTHql.exe

C:\Windows\System\meBdPIs.exe

C:\Windows\System\meBdPIs.exe

C:\Windows\System\XozSgQW.exe

C:\Windows\System\XozSgQW.exe

C:\Windows\System\kTgEZYc.exe

C:\Windows\System\kTgEZYc.exe

C:\Windows\System\zOoSjQr.exe

C:\Windows\System\zOoSjQr.exe

C:\Windows\System\sIbXzkK.exe

C:\Windows\System\sIbXzkK.exe

C:\Windows\System\mwFhqZx.exe

C:\Windows\System\mwFhqZx.exe

C:\Windows\System\oCiqHVs.exe

C:\Windows\System\oCiqHVs.exe

C:\Windows\System\dxvUqXy.exe

C:\Windows\System\dxvUqXy.exe

C:\Windows\System\PGwfAWy.exe

C:\Windows\System\PGwfAWy.exe

C:\Windows\System\PzaUVyv.exe

C:\Windows\System\PzaUVyv.exe

C:\Windows\System\zYeNEij.exe

C:\Windows\System\zYeNEij.exe

C:\Windows\System\AgXmbIH.exe

C:\Windows\System\AgXmbIH.exe

C:\Windows\System\xPOMhnf.exe

C:\Windows\System\xPOMhnf.exe

C:\Windows\System\gcZAwxQ.exe

C:\Windows\System\gcZAwxQ.exe

C:\Windows\System\ZSjIedc.exe

C:\Windows\System\ZSjIedc.exe

C:\Windows\System\GHhKXzi.exe

C:\Windows\System\GHhKXzi.exe

C:\Windows\System\OPEdPsd.exe

C:\Windows\System\OPEdPsd.exe

C:\Windows\System\aKZfWKb.exe

C:\Windows\System\aKZfWKb.exe

C:\Windows\System\uxUFNaI.exe

C:\Windows\System\uxUFNaI.exe

C:\Windows\System\PuIqZze.exe

C:\Windows\System\PuIqZze.exe

C:\Windows\System\hxhRdDp.exe

C:\Windows\System\hxhRdDp.exe

C:\Windows\System\BvqKjFd.exe

C:\Windows\System\BvqKjFd.exe

C:\Windows\System\YOcEFUb.exe

C:\Windows\System\YOcEFUb.exe

C:\Windows\System\HHowPUa.exe

C:\Windows\System\HHowPUa.exe

C:\Windows\System\uFfVZyL.exe

C:\Windows\System\uFfVZyL.exe

C:\Windows\System\MMJCAPS.exe

C:\Windows\System\MMJCAPS.exe

C:\Windows\System\oqnTloJ.exe

C:\Windows\System\oqnTloJ.exe

C:\Windows\System\XhjQuXV.exe

C:\Windows\System\XhjQuXV.exe

C:\Windows\System\JNloooO.exe

C:\Windows\System\JNloooO.exe

C:\Windows\System\ghHJnOp.exe

C:\Windows\System\ghHJnOp.exe

C:\Windows\System\aawNNQh.exe

C:\Windows\System\aawNNQh.exe

C:\Windows\System\TKZaRrX.exe

C:\Windows\System\TKZaRrX.exe

C:\Windows\System\nDpaBJi.exe

C:\Windows\System\nDpaBJi.exe

C:\Windows\System\jKAPHHO.exe

C:\Windows\System\jKAPHHO.exe

C:\Windows\System\dbQoRSk.exe

C:\Windows\System\dbQoRSk.exe

C:\Windows\System\dEZoXFn.exe

C:\Windows\System\dEZoXFn.exe

C:\Windows\System\IBotUmZ.exe

C:\Windows\System\IBotUmZ.exe

C:\Windows\System\BuyLyAK.exe

C:\Windows\System\BuyLyAK.exe

C:\Windows\System\dwKmClG.exe

C:\Windows\System\dwKmClG.exe

C:\Windows\System\qaJPkeA.exe

C:\Windows\System\qaJPkeA.exe

C:\Windows\System\PSVdVfZ.exe

C:\Windows\System\PSVdVfZ.exe

C:\Windows\System\BTArDOi.exe

C:\Windows\System\BTArDOi.exe

C:\Windows\System\tpWVTsd.exe

C:\Windows\System\tpWVTsd.exe

C:\Windows\System\MxFLVjI.exe

C:\Windows\System\MxFLVjI.exe

C:\Windows\System\pXkzFjd.exe

C:\Windows\System\pXkzFjd.exe

C:\Windows\System\lcODSzd.exe

C:\Windows\System\lcODSzd.exe

C:\Windows\System\JrWCoLF.exe

C:\Windows\System\JrWCoLF.exe

C:\Windows\System\xfwohvj.exe

C:\Windows\System\xfwohvj.exe

C:\Windows\System\GBpgYxN.exe

C:\Windows\System\GBpgYxN.exe

C:\Windows\System\rteEZQB.exe

C:\Windows\System\rteEZQB.exe

C:\Windows\System\izHNnRH.exe

C:\Windows\System\izHNnRH.exe

C:\Windows\System\uFJvygK.exe

C:\Windows\System\uFJvygK.exe

C:\Windows\System\MgEopVj.exe

C:\Windows\System\MgEopVj.exe

C:\Windows\System\ChXVNjL.exe

C:\Windows\System\ChXVNjL.exe

C:\Windows\System\CrxCgUf.exe

C:\Windows\System\CrxCgUf.exe

C:\Windows\System\qQvWVMy.exe

C:\Windows\System\qQvWVMy.exe

C:\Windows\System\rwdkJNg.exe

C:\Windows\System\rwdkJNg.exe

C:\Windows\System\HxvwzBv.exe

C:\Windows\System\HxvwzBv.exe

C:\Windows\System\ZpsgqjS.exe

C:\Windows\System\ZpsgqjS.exe

C:\Windows\System\piPSBky.exe

C:\Windows\System\piPSBky.exe

C:\Windows\System\PrMQERS.exe

C:\Windows\System\PrMQERS.exe

C:\Windows\System\GeCxlTN.exe

C:\Windows\System\GeCxlTN.exe

C:\Windows\System\ZoGOxGr.exe

C:\Windows\System\ZoGOxGr.exe

C:\Windows\System\NIOulVP.exe

C:\Windows\System\NIOulVP.exe

C:\Windows\System\UesTeyd.exe

C:\Windows\System\UesTeyd.exe

C:\Windows\System\igmtTmO.exe

C:\Windows\System\igmtTmO.exe

C:\Windows\System\XKMnVEC.exe

C:\Windows\System\XKMnVEC.exe

C:\Windows\System\JnkHseQ.exe

C:\Windows\System\JnkHseQ.exe

C:\Windows\System\eEfdkyM.exe

C:\Windows\System\eEfdkyM.exe

C:\Windows\System\KarjTOJ.exe

C:\Windows\System\KarjTOJ.exe

C:\Windows\System\KixOEIk.exe

C:\Windows\System\KixOEIk.exe

C:\Windows\System\RaQyawp.exe

C:\Windows\System\RaQyawp.exe

C:\Windows\System\EJJxFJC.exe

C:\Windows\System\EJJxFJC.exe

C:\Windows\System\DNLhPwh.exe

C:\Windows\System\DNLhPwh.exe

C:\Windows\System\QeQglot.exe

C:\Windows\System\QeQglot.exe

C:\Windows\System\KrPIMYN.exe

C:\Windows\System\KrPIMYN.exe

C:\Windows\System\RJlpgxh.exe

C:\Windows\System\RJlpgxh.exe

C:\Windows\System\qekxZMK.exe

C:\Windows\System\qekxZMK.exe

C:\Windows\System\JRmAYEy.exe

C:\Windows\System\JRmAYEy.exe

C:\Windows\System\loaVqOK.exe

C:\Windows\System\loaVqOK.exe

C:\Windows\System\VAfBhjw.exe

C:\Windows\System\VAfBhjw.exe

C:\Windows\System\JrfgDAv.exe

C:\Windows\System\JrfgDAv.exe

C:\Windows\System\pBPHHhr.exe

C:\Windows\System\pBPHHhr.exe

C:\Windows\System\rBVWvKt.exe

C:\Windows\System\rBVWvKt.exe

C:\Windows\System\IiQvZrv.exe

C:\Windows\System\IiQvZrv.exe

C:\Windows\System\szyUxsd.exe

C:\Windows\System\szyUxsd.exe

C:\Windows\System\ZBUTEan.exe

C:\Windows\System\ZBUTEan.exe

C:\Windows\System\AiwVmar.exe

C:\Windows\System\AiwVmar.exe

C:\Windows\System\iRgWnTe.exe

C:\Windows\System\iRgWnTe.exe

C:\Windows\System\psafafy.exe

C:\Windows\System\psafafy.exe

C:\Windows\System\wkPXYLv.exe

C:\Windows\System\wkPXYLv.exe

C:\Windows\System\atyUqLV.exe

C:\Windows\System\atyUqLV.exe

C:\Windows\System\XVwMjCO.exe

C:\Windows\System\XVwMjCO.exe

C:\Windows\System\tmQiXVb.exe

C:\Windows\System\tmQiXVb.exe

C:\Windows\System\gjgwxVj.exe

C:\Windows\System\gjgwxVj.exe

C:\Windows\System\hvMDyzX.exe

C:\Windows\System\hvMDyzX.exe

C:\Windows\System\dptNFDt.exe

C:\Windows\System\dptNFDt.exe

C:\Windows\System\gKmQcNV.exe

C:\Windows\System\gKmQcNV.exe

C:\Windows\System\DrUHter.exe

C:\Windows\System\DrUHter.exe

C:\Windows\System\ZhwMkNo.exe

C:\Windows\System\ZhwMkNo.exe

C:\Windows\System\xfozWLb.exe

C:\Windows\System\xfozWLb.exe

C:\Windows\System\JGpmEFM.exe

C:\Windows\System\JGpmEFM.exe

C:\Windows\System\nzuntTY.exe

C:\Windows\System\nzuntTY.exe

C:\Windows\System\uxCBhwM.exe

C:\Windows\System\uxCBhwM.exe

C:\Windows\System\XcxLJnC.exe

C:\Windows\System\XcxLJnC.exe

C:\Windows\System\onRdOyd.exe

C:\Windows\System\onRdOyd.exe

C:\Windows\System\jqqCyXS.exe

C:\Windows\System\jqqCyXS.exe

C:\Windows\System\rTNnzqM.exe

C:\Windows\System\rTNnzqM.exe

C:\Windows\System\OQSBKBe.exe

C:\Windows\System\OQSBKBe.exe

C:\Windows\System\tuMLmEO.exe

C:\Windows\System\tuMLmEO.exe

C:\Windows\System\bmcWWQA.exe

C:\Windows\System\bmcWWQA.exe

C:\Windows\System\mHzlGmy.exe

C:\Windows\System\mHzlGmy.exe

C:\Windows\System\KIxsUbG.exe

C:\Windows\System\KIxsUbG.exe

C:\Windows\System\fJyTArg.exe

C:\Windows\System\fJyTArg.exe

C:\Windows\System\lUhfyeM.exe

C:\Windows\System\lUhfyeM.exe

C:\Windows\System\MUERUdW.exe

C:\Windows\System\MUERUdW.exe

C:\Windows\System\mfzpqYP.exe

C:\Windows\System\mfzpqYP.exe

C:\Windows\System\aToIsWR.exe

C:\Windows\System\aToIsWR.exe

C:\Windows\System\zwumFhi.exe

C:\Windows\System\zwumFhi.exe

C:\Windows\System\CszfaRE.exe

C:\Windows\System\CszfaRE.exe

C:\Windows\System\lUGzHHQ.exe

C:\Windows\System\lUGzHHQ.exe

C:\Windows\System\omsROTk.exe

C:\Windows\System\omsROTk.exe

C:\Windows\System\Sbrzfzg.exe

C:\Windows\System\Sbrzfzg.exe

C:\Windows\System\MwvPvvQ.exe

C:\Windows\System\MwvPvvQ.exe

C:\Windows\System\XLKGGLu.exe

C:\Windows\System\XLKGGLu.exe

C:\Windows\System\SLGNMLo.exe

C:\Windows\System\SLGNMLo.exe

C:\Windows\System\BNtIAZB.exe

C:\Windows\System\BNtIAZB.exe

C:\Windows\System\JFXIglT.exe

C:\Windows\System\JFXIglT.exe

C:\Windows\System\rsJTMgB.exe

C:\Windows\System\rsJTMgB.exe

C:\Windows\System\NDKLKMX.exe

C:\Windows\System\NDKLKMX.exe

C:\Windows\System\lQwOpyz.exe

C:\Windows\System\lQwOpyz.exe

C:\Windows\System\XtKldDh.exe

C:\Windows\System\XtKldDh.exe

C:\Windows\System\ArnrqJD.exe

C:\Windows\System\ArnrqJD.exe

C:\Windows\System\PgkPuCN.exe

C:\Windows\System\PgkPuCN.exe

C:\Windows\System\dIhQsFE.exe

C:\Windows\System\dIhQsFE.exe

C:\Windows\System\NGpccca.exe

C:\Windows\System\NGpccca.exe

C:\Windows\System\bINVSaX.exe

C:\Windows\System\bINVSaX.exe

C:\Windows\System\SFtiLem.exe

C:\Windows\System\SFtiLem.exe

C:\Windows\System\fzLeyTF.exe

C:\Windows\System\fzLeyTF.exe

C:\Windows\System\poJcXqO.exe

C:\Windows\System\poJcXqO.exe

C:\Windows\System\AVRlbYd.exe

C:\Windows\System\AVRlbYd.exe

C:\Windows\System\gApsFGf.exe

C:\Windows\System\gApsFGf.exe

C:\Windows\System\SJDrWup.exe

C:\Windows\System\SJDrWup.exe

C:\Windows\System\XAbchlQ.exe

C:\Windows\System\XAbchlQ.exe

C:\Windows\System\JFvqjFH.exe

C:\Windows\System\JFvqjFH.exe

C:\Windows\System\LuUtJAa.exe

C:\Windows\System\LuUtJAa.exe

C:\Windows\System\sICgPQJ.exe

C:\Windows\System\sICgPQJ.exe

C:\Windows\System\TXYWoFV.exe

C:\Windows\System\TXYWoFV.exe

C:\Windows\System\KzXXfEI.exe

C:\Windows\System\KzXXfEI.exe

C:\Windows\System\sLAoqHZ.exe

C:\Windows\System\sLAoqHZ.exe

C:\Windows\System\ooqMuOf.exe

C:\Windows\System\ooqMuOf.exe

C:\Windows\System\QvQmrZK.exe

C:\Windows\System\QvQmrZK.exe

C:\Windows\System\bZQscim.exe

C:\Windows\System\bZQscim.exe

C:\Windows\System\kyqLhfh.exe

C:\Windows\System\kyqLhfh.exe

C:\Windows\System\fRggfzk.exe

C:\Windows\System\fRggfzk.exe

C:\Windows\System\XOrFSqQ.exe

C:\Windows\System\XOrFSqQ.exe

C:\Windows\System\hIkcbAJ.exe

C:\Windows\System\hIkcbAJ.exe

C:\Windows\System\wPsdNqi.exe

C:\Windows\System\wPsdNqi.exe

C:\Windows\System\kvuZntE.exe

C:\Windows\System\kvuZntE.exe

C:\Windows\System\jfHXYPi.exe

C:\Windows\System\jfHXYPi.exe

C:\Windows\System\hNXFNon.exe

C:\Windows\System\hNXFNon.exe

C:\Windows\System\QULYaXF.exe

C:\Windows\System\QULYaXF.exe

C:\Windows\System\UuItSRk.exe

C:\Windows\System\UuItSRk.exe

C:\Windows\System\qzWRnvh.exe

C:\Windows\System\qzWRnvh.exe

C:\Windows\System\WHEVFQo.exe

C:\Windows\System\WHEVFQo.exe

C:\Windows\System\bvvHhwe.exe

C:\Windows\System\bvvHhwe.exe

C:\Windows\System\XbLtjrG.exe

C:\Windows\System\XbLtjrG.exe

C:\Windows\System\VVzrfPr.exe

C:\Windows\System\VVzrfPr.exe

C:\Windows\System\UsQRtaq.exe

C:\Windows\System\UsQRtaq.exe

C:\Windows\System\fhCOevf.exe

C:\Windows\System\fhCOevf.exe

C:\Windows\System\UOzeBCq.exe

C:\Windows\System\UOzeBCq.exe

C:\Windows\System\CGsbkXo.exe

C:\Windows\System\CGsbkXo.exe

C:\Windows\System\DMDPUJx.exe

C:\Windows\System\DMDPUJx.exe

C:\Windows\System\CcUgaXg.exe

C:\Windows\System\CcUgaXg.exe

C:\Windows\System\nGMvrDS.exe

C:\Windows\System\nGMvrDS.exe

C:\Windows\System\pSSpgdc.exe

C:\Windows\System\pSSpgdc.exe

C:\Windows\System\TMyynQe.exe

C:\Windows\System\TMyynQe.exe

C:\Windows\System\nkKFxmF.exe

C:\Windows\System\nkKFxmF.exe

C:\Windows\System\HlcMSIv.exe

C:\Windows\System\HlcMSIv.exe

C:\Windows\System\ErCFIBm.exe

C:\Windows\System\ErCFIBm.exe

C:\Windows\System\QxzuVYd.exe

C:\Windows\System\QxzuVYd.exe

C:\Windows\System\ryHQjwL.exe

C:\Windows\System\ryHQjwL.exe

C:\Windows\System\qyVshcU.exe

C:\Windows\System\qyVshcU.exe

C:\Windows\System\qSvzfSE.exe

C:\Windows\System\qSvzfSE.exe

C:\Windows\System\MsJVkLX.exe

C:\Windows\System\MsJVkLX.exe

C:\Windows\System\zVcdpKP.exe

C:\Windows\System\zVcdpKP.exe

C:\Windows\System\LcCJlPE.exe

C:\Windows\System\LcCJlPE.exe

C:\Windows\System\ZjidQFC.exe

C:\Windows\System\ZjidQFC.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

memory/5104-0-0x00007FF6725E0000-0x00007FF672931000-memory.dmp

memory/5104-1-0x0000019B89D60000-0x0000019B89D70000-memory.dmp

C:\Windows\System\jkAWfMN.exe

MD5	1a369393fd4e7257b2b631d3ca600f06
SHA1	103737681419acbab62812950861f0683d797f83
SHA256	358de4d793c386f28cee6d1998d07a1fab93296fa6029dd6ab33f1a80fa9b7a5
SHA512	13a8861dee27db6bc9c710ea056fb7f6f84d493be2c33871656ea60dc9bfa0b3dc2c189fe2fb3b1c8de5c6480d80e377d0b37a9d8cf9e54d32117c84dfd07c95

memory/2440-18-0x00007FF617CB0000-0x00007FF618001000-memory.dmp

C:\Windows\System\YsKZQsh.exe

MD5	61bb9e5e899311463ffb8ca934db1f13
SHA1	181e662ea7aafb9afb7c9360d635f8d86cd325a8
SHA256	6bce3e477bad3a25c4f1fca3b6b5faec11608c0ad5f12dd1251f77d1cc83f6a7
SHA512	e61052ac741133a7ea2f9a0aea3ee5d86d2b0c5ab2cc504f562a7943af855eff32d9651cf6224f3b0335ba1627b599222e759362c3ff1f75682826893eeb5fe6

C:\Windows\System\SvdLGlA.exe

MD5	58d9d54a428855f23d14f7dde58481d7
SHA1	58330f5eaae31fe17731c022173d3bc26eb3015c
SHA256	4e5714477bea1b678c8eeda645c13e3b47808689c8ceb4c7e65c48abfd92a0c2
SHA512	a1d468106c90f458e1cf93d4dc0b03e865467ae662a4723c117d38f7b24ff8b80d5e7eeef2e315e416ea8365d24aed824f4ac8dc1c39bb05512eedcdd1af8bea

C:\Windows\System\svzARKI.exe

MD5	507b2c6bfe28f740f569f4449b6e43b1
SHA1	be563f9ef7dbdf86c7c3cd153213172219e77f30
SHA256	e1acd0f2fda51643c647038063f1c9f9b199bc892d8b712137606aa0cfcfb8cd
SHA512	1dc6a0d80c15e30411bf01605375a940f262b10fd1cdc0f50f8ab737169ae2e3dea24e49de45b0596bb59ad5cdfa50da9cae45d62981122e87ee4d067969207b

C:\Windows\System\IioWYgW.exe

MD5	035600119a6dfa25a539bf2841ff852c
SHA1	4ebf23a12b5ab20a4160f89f7c289e0e5f06b1b2
SHA256	a9ba3e912b49bd600ea19040f49e4260689a2628383c0ff3f150b7e904427ace
SHA512	e2afc611bf6b985faf4ede5c499a3b4157730edf5cc111d78e84a9b6e9cdfc2922b5f1641f66134c853124368e7b878824dbb6ba9654f26605d89130784d2e05

C:\Windows\System\iRCuatu.exe

MD5	9fa228dd3e98952e7c41b34dd167869d
SHA1	73e8c8d0eda8a73b00bbc6b269d8556a6510ae85
SHA256	170c5358b340b263d657398381321949a0dc86ff72ffd8355ab08e1cc2d91897
SHA512	ae4b73c65e93f247c75638a01574235d6611f6206f3e84da6daaff82a61d956ec1cdae12d0b645497bfbe62f86c6d97b131dafb0206e747fe72d1ae788c38966

C:\Windows\System\pLvWGQZ.exe

MD5	2a2620a740c0e7aadb5132a55e9ca4e1
SHA1	2078b00e16c69a57fd6b4393e9d7369829bb408a
SHA256	cd407059873eb8121013001c8291697861dd28f05230b7da59d05322d9af83ab
SHA512	ee26107c0ec484f35a4771d8a208de5696f7895c7b7400420d12ec36b5f3382470e862b924691d7e7c360bb7be463548e3b8e8e718c861f85a9cfc12cde0d644

memory/3728-204-0x00007FF77F240000-0x00007FF77F591000-memory.dmp

memory/3060-305-0x00007FF7CF090000-0x00007FF7CF3E1000-memory.dmp

memory/3576-347-0x00007FF65F2E0000-0x00007FF65F631000-memory.dmp

memory/3524-412-0x00007FF694E40000-0x00007FF695191000-memory.dmp

memory/2084-452-0x00007FF6544A0000-0x00007FF6547F1000-memory.dmp

memory/404-496-0x00007FF6FFDE0000-0x00007FF700131000-memory.dmp

memory/3208-504-0x00007FF62B0A0000-0x00007FF62B3F1000-memory.dmp

memory/4420-491-0x00007FF7D7920000-0x00007FF7D7C71000-memory.dmp

memory/5056-490-0x00007FF68BF90000-0x00007FF68C2E1000-memory.dmp

memory/1172-435-0x00007FF7600C0000-0x00007FF760411000-memory.dmp

memory/232-400-0x00007FF723590000-0x00007FF7238E1000-memory.dmp

memory/4924-378-0x00007FF7F13C0000-0x00007FF7F1711000-memory.dmp

memory/4808-377-0x00007FF6665C0000-0x00007FF666911000-memory.dmp

memory/3752-339-0x00007FF6ADBE0000-0x00007FF6ADF31000-memory.dmp

memory/4552-306-0x00007FF7E6FE0000-0x00007FF7E7331000-memory.dmp

memory/3836-276-0x00007FF6419C0000-0x00007FF641D11000-memory.dmp

memory/980-262-0x00007FF7E8350000-0x00007FF7E86A1000-memory.dmp

memory/1276-259-0x00007FF6074C0000-0x00007FF607811000-memory.dmp

memory/4728-227-0x00007FF752B30000-0x00007FF752E81000-memory.dmp

memory/116-203-0x00007FF62EFB0000-0x00007FF62F301000-memory.dmp

C:\Windows\System\wDSKflU.exe

MD5	2f35ad361a9e0734c081f3bd591b9840
SHA1	78ef35fc52498c655843ea6eddbd3ac32891693c
SHA256	e9287996071531f9d981b4dc4fd4b18da4fde0d4139a6232afe61737d62fa036
SHA512	4edc16dba9adef2c56a1500726ae50dc11b61b7ead66d476d681a0c7c5f5cb22103502a0d11a085687a157b14cee3ddae8460e15b799b0519be7f3a37aacd384

C:\Windows\System\ZeHJXpE.exe

MD5	70e65c32b7e31882583909d21f4246d0
SHA1	d2c7b8117d6824990061ec41723811cf82b40e81
SHA256	88f5182169e934319d9bf6e91b6be21d9b2c67e349ce3dd1028669058ec2b0c0
SHA512	aacdfea91dddfde68bcc034f0523d3030731444330d598b1bf0e7389d88c15af581f8de8ab11d605e6d2eb5e5146c3b49bbfab182e30553bda616cf2932c084b

C:\Windows\System\Ogneksv.exe

MD5	b736cda19786d0a8ecf3183c265576f4
SHA1	4943ed391486a22f10954b34907bdf999f813b81
SHA256	e290489ce9ff392a0d4f6d7b86adcd79d752c82c418558e00cbacf9799e88db7
SHA512	7e38ad1d43a7347bb490cd122585b610eb675922c0babe9c2fe452604586cd10f703f42fa1254178ac05c8cacb75dd85226877515fcca75b2ee62d85860508d2

memory/1176-188-0x00007FF637340000-0x00007FF637691000-memory.dmp

C:\Windows\System\LesFjBy.exe

MD5	43bb38d6b83235e6a6dd0a79bec5819c
SHA1	0c8ebbe390623acd4cf74d6c5ac4f105e732f723
SHA256	f8dcb57c47bb7ab24e99d469652292d5759212be832c3901a20571bd4d36ed4e
SHA512	108936dd7f10cff738a5eaad7f4d045a9b757940322c490f49b557a4afca7c7acb40fde8d57ff898684a9269927b724ca41652fcd90d41770ad69328c9f942e4

C:\Windows\System\CyUvZMG.exe

MD5	a64944dfac52915ef979cdb063cce78f
SHA1	c1795099659541fcf1aeb86258f0741ed8089d9f
SHA256	4ace459e7ad4b028098716c270ecb7a9db5fca34a0c64090c21570b4cd804e03
SHA512	0592a20d4968c9777bc457c5828e2763112eb2d902f0e9dc6fa9622903a5a7b3c37a969305fd8a2a2c32c9266de741fc79ae5e4d32ce971c74b00db55846d554

C:\Windows\System\PiyGkwW.exe

MD5	92c4d40a519a5265c0b6ca3b04d6d7ec
SHA1	281fcfe8fead6b16e3eb3a5ecf470e783c8e67ca
SHA256	71fabff0bb8159a225e23e3bea86e2368252b4a228c7f83df931ddc25193d0b9
SHA512	593f56641e3e388139544ed157bcebf8a279a646ea7759897de11e4bcf47b5e70b739ae176f0d5cb6a88c013d94b7bf24b78f8895fdbc43f8d063d06e164b3b3

C:\Windows\System\fYqatck.exe

MD5	712cdd8cbd0c41a155bd8f065f2cca34
SHA1	b3eaaf52266401bab7d0b1f0a4569c8f5f7c348a
SHA256	aac9c9b3d465e47537865ae77f8e6f41c9cd07a0df8a210a60af874355bb41e7
SHA512	620ca74278fe5764b2544b8a9bacc90a03106e2d6f8ec2313530c194f67382dc058539a2af36be0f857021312524365d7270578105114158fe5c060816fa4da5

C:\Windows\System\UxtXCrl.exe

MD5	b3a94e82230802be904d771dd53c04df
SHA1	b2749ec1efd41b6c1adb66abf256e01ecb2b81b2
SHA256	396f077e60149255fae411d978c9c4930383c0172b4b4c2232c16e6d07b880e7
SHA512	64c2462480b371b749c5103ec75182306739d2a114d576df0ace579d87a64ad768d27313ddc1980afc9ce2a288104383ba4daa8402a95e5af5fc0ff340ffb98b

C:\Windows\System\sjmFNqg.exe

MD5	63689a1e3a02a3da4cf05297549c2b08
SHA1	8268b78ea7b34da27c9e2cfaa61385c8aff28180
SHA256	c21bc94129d70adb8ad8e768ba6bea87c96ae8a1d95a148f54e9a9d2079a6d91
SHA512	642ce60db3f7aa879ea68f97bdd8c7c523f2878dc5cd18f4b428490dce8dd0a02509b70ab380145271d3bce948ee352ccc6bec7f95eb53225a01a787c4dd27bf

C:\Windows\System\yQfhZZt.exe

MD5	6f922e0d56904771e44100d51168a787
SHA1	a7272356100f508fc2e7ea77bea798f762e63aaf
SHA256	1edffe2d5609a3cc6a7ccb41ccdaa3e8f985cb0fa6eaf013d1afafdbea33010f
SHA512	933fe9268311c2d43388b69633600cd7ea86b30425cdd253f55b34a9c9afaae3d1197706fb4d8dfd9e40514205282bd62d8975c4fb59009cb649cf800f1107b6

C:\Windows\System\SYmvecJ.exe

MD5	7e972a1c3c829c6529276d74ca7c3e7d
SHA1	2c0e2495f41387f2f57996bc26ef854c9db35bc8
SHA256	2ae2a2ffa0f50d841207a59d978f8a2828f587ba68df7073b5af2a94d2cfb214
SHA512	320d1f3b63bd7c3bdf2138f6585823d70ec07216a07bae742b5fbd2f853b11300cb5417c0d477f4baf697e10f968a0acd3dee2048cb9334ddafaae1a9886c521

C:\Windows\System\wkFsQpm.exe

MD5	26cc45d1ec4c76b1c7992bf6c5c2aea7
SHA1	3d8b2b1437214b7fe98ee75a657ce2279f0402b0
SHA256	665ca1f7d1c75129511920ec71306bea5bcd927f0fbfbacbe6d8d49e2601259b
SHA512	e91c8cb235ebb423ed058d4a1d7fa48adeb1b45985fe527f4f6d9fa0bc7a13f2d167b6b3246b168cc4d4a912b3b1a24c4363cfe74f210c4e0aed2039b2c416f8

C:\Windows\System\urGaJnj.exe

MD5	bcae5b490c8c587092aa4df58ecc0e52
SHA1	a8e6673c579580a07ab36a0a5ee5c3ffb9f84ca5
SHA256	94792b107c161b8883e16beba43c35be353857811f60d61fe1d93aa9cd5dc14d
SHA512	e8d46daae2c7c9bf0f6133192c1b5ce7f2f9748c0ea51187ca4990f2f47934774c9ed9fb67dba9899c684e619174bf26463849e31af33045fcee4726d8be5265

C:\Windows\System\jfnXkxb.exe

MD5	a40f595297107f25bef6e989d269492c
SHA1	6f5410519c137aeb836357a19f1de5051f40f5bf
SHA256	39bebf054234ea91a72d64c3e97f309e7eabd3d84bd1cc2525492a02ee7b990c
SHA512	5eca7b416a36d0e17ce06a9d827a2d202ea3aa5ab810d08bff254eca4630c2a6597fa2b35d6724197bc73223e47ad4058ef56c0238ddb6f0c2456c72df57569b

C:\Windows\System\nmsNDFr.exe

MD5	94bdc3b4a7b058221640609b12936abe
SHA1	04609246ab296905bfd195d9036e0c9d4f49144c
SHA256	d8dd3c906dfffc113017a94b140eeaf5fdcb14c0838b844d28d55c960643da7f
SHA512	fda1e08d8cc4e57c4fc86dcb7ccce09635837799e917609599746a4c4e1fb20dbb0fda68b048db0017aeb7e8e45e089208c14ea1a7b87690561b40088227c249

C:\Windows\System\ZAGHbko.exe

MD5	68153327ab89ddb6e80021f52a405412
SHA1	c619217566263fb7bc6f289a728e4dbf296f6448
SHA256	00c5af68025920dd268549b941734a50090f8babe750d2d6ebffbdd7d6905524
SHA512	c56ed6c5ef7ecc31a1643ebf2a75ba4c50c08d9877a01eaab80d91aae0ccfbdca56e7d7802c9c2d64cda6bd80b02bf3b556123dc7d77eec53ea65260f8a61366

C:\Windows\System\Xjxymyd.exe

MD5	05b5b006a840b4dadbdef8a0fa7fc15b
SHA1	3e9e9b265671ad85e68b99bd94a8bc5d1d6c7e6d
SHA256	2b9ffa4783eb1f4e26f835582cfd6032d96a3eccd1e8268f6ac28a558398868d
SHA512	87705c5615be8717dcd3bbda1f52eaef57e65e31276be5998b387da234c80a29c437a65841a398508da723a074361c635d008f11df4d8bbf28e453fc80cb1650

memory/720-143-0x00007FF6FAB30000-0x00007FF6FAE81000-memory.dmp

C:\Windows\System\GvZOyhx.exe

MD5	d655564ecf8fdda07a8b8d8772239801
SHA1	94a02358b4e570123daa02cb89456ce45baf289a
SHA256	b716aee75b46d1ccc0da1ccb7fce60d4e6521efe77bc8dd08125a6f00e2f918e
SHA512	59ca44bff7ae2d120414c7a62a63ec977bacec1662a404d692b653495a710ce1efa99a1aeaff07b030f4423c723a8570998112d3329247b93c258d735d9adfcf

C:\Windows\System\peAIQyI.exe

MD5	e5a354658339276e27a161395c42d4cc
SHA1	ea9b72c2f84fcb9fbe0462fa058716c895954057
SHA256	7993731f8f494c0b3b18b3755e4f8ffb86728726debd4fbc2191b4ac188f5545
SHA512	4a8d796e195ed242e7d3957e344c7b13e094d78fedde926501382c3cf78632cd59c07406c83fa21b9b7e777b0c6d77aac43a6967fded9fceff915c0bf9f5e4ea

C:\Windows\System\hhnnRne.exe

MD5	8422065228aaacd3d815842208b811e8
SHA1	e86d79727d600fee45f6b1d13d9156387c3ee869
SHA256	ae0919d2896d54aee3c9b963ccbb5bf3aa5d18ce4f74e75c02a138b9957a7800
SHA512	bffaa7051f651f45c07c7697e4de9d7ab2a023519c9f63988585b2acc5652d91e9a147772c3c710429e69cbb2e1f4e2259c9e8928f7969b434c5ae10539dfe5d

C:\Windows\System\rEfutvC.exe

MD5	f3268bb45c0466b337c94e224401d6b0
SHA1	2eb59127441624f907480cb91b6e416be6283cb4
SHA256	f2bde01941b8832b723c56a4d929ac758b3ca0b9c0fdc8c99fb6ad1f31699187
SHA512	605802f5cc5e8f6a1824d04de1350c80056807a285378761271e844369a736d4932f5a7a2278124ffc3be556d4f63aed6768d9556c38dd875659cb6fc4b8c0b8

C:\Windows\System\ohzkqLm.exe

MD5	80a2fdc5508aadba3a1aaa949a0d22d5
SHA1	f7c96b16a076c14176231c79cc5b95fd1bebb642
SHA256	3f6a0d86f60b25ed46df88ea0dfffc23b2770abcc24921cb9a29d09e0e3fb430
SHA512	faf75c75d19d887f3fefd89725645709a7225f7f0f595893332652ee68af039bab1d6789007a14167802ae2de099909cf5478335fdb91fd013ffd4bf2aadf990

C:\Windows\System\nJiNWfe.exe

MD5	ae653408ff013b7354a8e813ee87954c
SHA1	21d1bd94c73afb0f2b5ff7e4427fc1a0c9a18aab
SHA256	f0a91845a99924972b864b71adf6ed5364e49a50bb2c4e5cea79c3f62d1a3788
SHA512	835365bbddc7215dc104343d70e46e6dd9c712fe0ff4a4e59cbf9430103ddac596032d38aee6f543b6f6e4c6399afeae39fc67c7776ea84ef91947af284da485

C:\Windows\System\dHuTvEc.exe

MD5	d1ba7e3c8a5f2b44f1fd269604c618db
SHA1	a309ae9aaf008c57b40b0f178cc45807d68bb698
SHA256	52701cd020d31c4ff5c1cb688dbd8a4c6daff2751f2a36edd66ae1697ee11511
SHA512	361a10b66acc8618e45bce4a380749c24da2a664d78c4f24bd852177ffa5b8ac5399dfdfccaa5dfa6cbd20479c96e613e091b108507611c5c554206f76538e31

memory/1476-103-0x00007FF63BCE0000-0x00007FF63C031000-memory.dmp

C:\Windows\System\gayCjxn.exe

MD5	bcf3903ea6ea961b6d9816600b011e41
SHA1	dd636a12486f83122687a4bae5890afe1b076248
SHA256	ed72d801e71e2acb842074897b689baa59800d029b9beae51f40d3642123d3aa
SHA512	c844cf326ef093b302726d8d151f40ed7011f9cb9f115ff6e4a61e3929794ea6f1c136552e24d6faa0c6395078cb12c73ee2d9969329f1e58bf8427b657cbcd7

C:\Windows\System\eTklRWx.exe

MD5	37161cef848eb9ff3ee7ebb72ccd76d1
SHA1	588b8fef3efbe1c9f9ab0b15aca9ef2a17b9135b
SHA256	5a8cd448e3fbf17c256bc5b4ad138133b11513f34465267f143303f398fa5d40
SHA512	7a40571508fec045e46b41db6c108a4b094dd020ea3a27929c501967707b7fa447092d68ccedd198728023616ae8ac33abc435e183c4cfbcb46c6df5fafbe38a

memory/4208-67-0x00007FF6BF130000-0x00007FF6BF481000-memory.dmp

C:\Windows\System\IyzBlAd.exe

MD5	52a1046d2718b04aeb852e10660fbc41
SHA1	d684f825b8b0264b93624408cd499abd486a8279
SHA256	674bdb007a851f50a26ae2eecb90207ffeb70bdfe7cbe8dc3b02f7e483af60d7
SHA512	215549709611c11fc265683b9e3701ffd6dc440b7223ff397d0c8d2cfb9f2864c5164f66b91a510f2313a9111865207e78781784a55621f747f19033d67b7c11

C:\Windows\System\EPKfBhD.exe

MD5	01c11357712c7fa68e996ea658c746ba
SHA1	8b564e717f183730bc2cabce707f8ab85e372ecd
SHA256	2932362802dfc3b490b75790466cd1a98dfe5ab84b96e1504eafa074a99c197c
SHA512	f0237d4b1c4b48543821f8afd6b9b418fca8ea15d8cfac6f690463ad5923d6c887051058cd311d0c2426f09c96b17fb5638760e28ced8663ef9f22a87e90afa3

C:\Windows\System\HohwvoV.exe

MD5	34050175be52251bfc7b7e0b19f12d6d
SHA1	6883a8d866973915a56c427f51bda07cb7fab8ee
SHA256	b65ea276f89c42c4753e9023647b7e8147234f432909f7704bc0cc5f76c9fd36
SHA512	1abd637507e1c05ed3d855b1c286c103888ce10a9f7bd55202779f3582f6e14ad9d46070c070e2fe8491bc8d777b7c857e29b400051973bb5c5afb43e2e96933

C:\Windows\System\ftJWkhi.exe

MD5	82bd04cb4ce1c0813dde490235d95cac
SHA1	d6147568b466fc9178134e34a290bd950fa1daa4
SHA256	97d15ede4c00884331af0e7181d4f4eaf155473d98a2077b3c152937e6892858
SHA512	9e4bcdcf10357491455f3088cb75aa0e22e54f8133b9ebbf588c623b374c80b06efdeca0ecb0de91e9d4a6c00fda644a7301c5654df2213cf0b2f155058b1f72

memory/1572-72-0x00007FF6EE330000-0x00007FF6EE681000-memory.dmp

C:\Windows\System\ZHGXzOg.exe

MD5	7d667c885eac862d8f52bd2a8c765053
SHA1	ddbdc56404eb9a93ad47a4948caac7b1412302ab
SHA256	4ea372d9f49a42a8bad4bcd08cbf4c3912178cb0e0a85529e868614688e1178c
SHA512	0ddd382e2ebb60f465f70b3aa09850cec81cd130e1a97e8a0d390971c6977e1292550dfcdf9559e941083dced08910ddd236609a84d8565d52792ce7302b7065

memory/3560-52-0x00007FF6A07B0000-0x00007FF6A0B01000-memory.dmp

memory/4156-38-0x00007FF7FD210000-0x00007FF7FD561000-memory.dmp

memory/2308-34-0x00007FF7DEEF0000-0x00007FF7DF241000-memory.dmp

C:\Windows\System\CGDzHhD.exe

MD5	84ebef0586576aa3bf1b0a7e938d64df
SHA1	4a31bd30795f56fa98ae2f87c109d75e67a8ec07
SHA256	5d59ee8d98dbd4a1ac7fa224cf2b5b68ed958ed153e854d177ae5548e73a0867
SHA512	f4983984997587bfa54ed0dc9643f0d1df08e5026561d4a494aa724d9fe0a826ea5ce2f79073c9336800ca71a8e683598803e7d6ab325f4af4237c7b828fe78e

memory/5104-2134-0x00007FF6725E0000-0x00007FF672931000-memory.dmp

memory/2440-2239-0x00007FF617CB0000-0x00007FF618001000-memory.dmp

memory/2308-2240-0x00007FF7DEEF0000-0x00007FF7DF241000-memory.dmp

memory/4156-2241-0x00007FF7FD210000-0x00007FF7FD561000-memory.dmp

memory/4208-2242-0x00007FF6BF130000-0x00007FF6BF481000-memory.dmp

memory/1572-2244-0x00007FF6EE330000-0x00007FF6EE681000-memory.dmp

memory/1476-2253-0x00007FF63BCE0000-0x00007FF63C031000-memory.dmp

memory/2440-2258-0x00007FF617CB0000-0x00007FF618001000-memory.dmp

memory/2084-2260-0x00007FF6544A0000-0x00007FF6547F1000-memory.dmp

memory/1172-2262-0x00007FF7600C0000-0x00007FF760411000-memory.dmp

memory/4156-2264-0x00007FF7FD210000-0x00007FF7FD561000-memory.dmp

memory/3560-2272-0x00007FF6A07B0000-0x00007FF6A0B01000-memory.dmp

memory/2308-2271-0x00007FF7DEEF0000-0x00007FF7DF241000-memory.dmp

memory/1176-2274-0x00007FF637340000-0x00007FF637691000-memory.dmp

memory/1572-2268-0x00007FF6EE330000-0x00007FF6EE681000-memory.dmp

memory/4208-2267-0x00007FF6BF130000-0x00007FF6BF481000-memory.dmp

memory/3524-2305-0x00007FF694E40000-0x00007FF695191000-memory.dmp

memory/3576-2311-0x00007FF65F2E0000-0x00007FF65F631000-memory.dmp

memory/3752-2313-0x00007FF6ADBE0000-0x00007FF6ADF31000-memory.dmp

memory/4808-2317-0x00007FF6665C0000-0x00007FF666911000-memory.dmp

memory/4924-2315-0x00007FF7F13C0000-0x00007FF7F1711000-memory.dmp

memory/4552-2308-0x00007FF7E6FE0000-0x00007FF7E7331000-memory.dmp

memory/4728-2304-0x00007FF752B30000-0x00007FF752E81000-memory.dmp

memory/1276-2300-0x00007FF6074C0000-0x00007FF607811000-memory.dmp

memory/4420-2298-0x00007FF7D7920000-0x00007FF7D7C71000-memory.dmp

memory/980-2294-0x00007FF7E8350000-0x00007FF7E86A1000-memory.dmp

memory/3060-2292-0x00007FF7CF090000-0x00007FF7CF3E1000-memory.dmp

memory/116-2297-0x00007FF62EFB0000-0x00007FF62F301000-memory.dmp

memory/1476-2289-0x00007FF63BCE0000-0x00007FF63C031000-memory.dmp

memory/720-2287-0x00007FF6FAB30000-0x00007FF6FAE81000-memory.dmp

memory/5056-2285-0x00007FF68BF90000-0x00007FF68C2E1000-memory.dmp

memory/3836-2281-0x00007FF6419C0000-0x00007FF641D11000-memory.dmp

memory/3208-2279-0x00007FF62B0A0000-0x00007FF62B3F1000-memory.dmp

memory/3728-2291-0x00007FF77F240000-0x00007FF77F591000-memory.dmp

memory/232-2283-0x00007FF723590000-0x00007FF7238E1000-memory.dmp

memory/404-2277-0x00007FF6FFDE0000-0x00007FF700131000-memory.dmp

Sample ID	240613-qqvh6a1bjf
Target	802e261edffca764e8990de2feec7550_NeikiAnalytics.exe
SHA256	fc20ca5d82ffc143f287a0670217c9eb8c819f2945cf02b729e14ee72d373de7
Tags	upx miner xmrig

Malware Analysis Report

2024-07-28 19:53

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files