Analysis Overview

score

10^/10

SHA256

cce8b1d06912ef6819863db08f7fea5b99bca5ff7caf6b4197564b866780f60e

Threat Level: Known bad

The file 817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

miner upx xmrig

XMRig Miner payload

Xmrig family

xmrig

XMRig Miner payload

Executes dropped EXE

UPX packed file

Loads dropped DLL

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 13:49

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Xmrig family

xmrig

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 13:49

Reported

2024-06-13 13:52

Platform

win7-20240611-en

Max time kernel

150s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\tPndvGN.exe	N/A
N/A	N/A	C:\Windows\System\eBYtkXF.exe	N/A
N/A	N/A	C:\Windows\System\kkmdsUF.exe	N/A
N/A	N/A	C:\Windows\System\FrSqlaB.exe	N/A
N/A	N/A	C:\Windows\System\Xykzvvh.exe	N/A
N/A	N/A	C:\Windows\System\UDmgSlD.exe	N/A
N/A	N/A	C:\Windows\System\bdSPuXH.exe	N/A
N/A	N/A	C:\Windows\System\KSIezgL.exe	N/A
N/A	N/A	C:\Windows\System\VZnQQYf.exe	N/A
N/A	N/A	C:\Windows\System\VsjjQEu.exe	N/A
N/A	N/A	C:\Windows\System\jhkGUGO.exe	N/A
N/A	N/A	C:\Windows\System\bClFRDy.exe	N/A
N/A	N/A	C:\Windows\System\fZJHzfe.exe	N/A
N/A	N/A	C:\Windows\System\gwAnxtV.exe	N/A
N/A	N/A	C:\Windows\System\aPhUWsg.exe	N/A
N/A	N/A	C:\Windows\System\vBkRxGG.exe	N/A
N/A	N/A	C:\Windows\System\wbJcfNr.exe	N/A
N/A	N/A	C:\Windows\System\yxfpFEd.exe	N/A
N/A	N/A	C:\Windows\System\wfSsWHn.exe	N/A
N/A	N/A	C:\Windows\System\WTWwdXh.exe	N/A
N/A	N/A	C:\Windows\System\aTJseQO.exe	N/A
N/A	N/A	C:\Windows\System\KbyqSMs.exe	N/A
N/A	N/A	C:\Windows\System\AAxaHRY.exe	N/A
N/A	N/A	C:\Windows\System\LlnknQt.exe	N/A
N/A	N/A	C:\Windows\System\OPftCNK.exe	N/A
N/A	N/A	C:\Windows\System\ooikGph.exe	N/A
N/A	N/A	C:\Windows\System\PMzsiYH.exe	N/A
N/A	N/A	C:\Windows\System\cLYrbAf.exe	N/A
N/A	N/A	C:\Windows\System\xtNZSjK.exe	N/A
N/A	N/A	C:\Windows\System\LjIfHJL.exe	N/A
N/A	N/A	C:\Windows\System\SYlhXqa.exe	N/A
N/A	N/A	C:\Windows\System\NvZiSkD.exe	N/A
N/A	N/A	C:\Windows\System\stitDXp.exe	N/A
N/A	N/A	C:\Windows\System\GkEsXHC.exe	N/A
N/A	N/A	C:\Windows\System\mUlnvyF.exe	N/A
N/A	N/A	C:\Windows\System\GMOLSHk.exe	N/A
N/A	N/A	C:\Windows\System\Ymtkqjr.exe	N/A
N/A	N/A	C:\Windows\System\XtJpoeE.exe	N/A
N/A	N/A	C:\Windows\System\HaDgrKE.exe	N/A
N/A	N/A	C:\Windows\System\VfvqnJU.exe	N/A
N/A	N/A	C:\Windows\System\xcyKSlX.exe	N/A
N/A	N/A	C:\Windows\System\xonnvMV.exe	N/A
N/A	N/A	C:\Windows\System\zxqzmcW.exe	N/A
N/A	N/A	C:\Windows\System\LagEDGa.exe	N/A
N/A	N/A	C:\Windows\System\flhMprF.exe	N/A
N/A	N/A	C:\Windows\System\jDPiHUG.exe	N/A
N/A	N/A	C:\Windows\System\hGxsMaZ.exe	N/A
N/A	N/A	C:\Windows\System\XCygqQV.exe	N/A
N/A	N/A	C:\Windows\System\IosonoR.exe	N/A
N/A	N/A	C:\Windows\System\UTybPcJ.exe	N/A
N/A	N/A	C:\Windows\System\QOZYQIg.exe	N/A
N/A	N/A	C:\Windows\System\LTCeKgi.exe	N/A
N/A	N/A	C:\Windows\System\lHxWqPR.exe	N/A
N/A	N/A	C:\Windows\System\LdOzuRK.exe	N/A
N/A	N/A	C:\Windows\System\VaJqSVo.exe	N/A
N/A	N/A	C:\Windows\System\inHDGdG.exe	N/A
N/A	N/A	C:\Windows\System\KJUjxho.exe	N/A
N/A	N/A	C:\Windows\System\VYGgQrh.exe	N/A
N/A	N/A	C:\Windows\System\pmqejGh.exe	N/A
N/A	N/A	C:\Windows\System\OANhTdO.exe	N/A
N/A	N/A	C:\Windows\System\DEXqsAW.exe	N/A
N/A	N/A	C:\Windows\System\nqDazeD.exe	N/A
N/A	N/A	C:\Windows\System\BhSSqFm.exe	N/A
N/A	N/A	C:\Windows\System\JrbJLqL.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\ylZxBgn.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TiIbiYJ.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MkDrEdE.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dkEBgAV.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jaRmjgw.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VRtOBwm.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EaQpNlr.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sFaOwdr.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\giiwtIt.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EhxoNqm.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oOyAsdd.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JaPJynW.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zvRQKVH.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AiNWMAY.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\grtLrMo.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cXpVacs.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QyHZKXm.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\urqpLVq.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KsysRrA.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OzbWafG.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Ozipcbr.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QGBBCXc.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MpTyYRf.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hKOYxvi.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yVLkZIP.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pzTlzre.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KUoiINx.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NgUmaOI.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RsVzfpi.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZPKTlmX.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZiBfueH.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HdViKZL.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qupFrYr.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sbyVKiM.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DjMsPmZ.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mKPEgXq.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xjLHxSK.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VDSxFRE.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DqYpnNh.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ompLZey.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KsscocA.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lxiPsCn.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mXfCDaq.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZEZGFru.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GbzPBYT.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cqyucCi.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GUFPIem.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fICLykg.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mCIcaPk.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RVHueAS.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\spyacVr.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FMuBwUl.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sUcgRWa.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UOAgtCw.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oOaCNLC.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\exaapUh.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GayGxbm.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DqvVZxQ.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aKBWfyw.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FvjtVBH.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VUqBtYn.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QtXImCh.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IXlBxPp.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\snlrthR.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1704 wrote to memory of 1188	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\tPndvGN.exe
PID 1704 wrote to memory of 1188	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\tPndvGN.exe
PID 1704 wrote to memory of 1188	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\tPndvGN.exe
PID 1704 wrote to memory of 2332	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\eBYtkXF.exe
PID 1704 wrote to memory of 2332	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\eBYtkXF.exe
PID 1704 wrote to memory of 2332	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\eBYtkXF.exe
PID 1704 wrote to memory of 2340	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\kkmdsUF.exe
PID 1704 wrote to memory of 2340	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\kkmdsUF.exe
PID 1704 wrote to memory of 2340	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\kkmdsUF.exe
PID 1704 wrote to memory of 2648	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\FrSqlaB.exe
PID 1704 wrote to memory of 2648	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\FrSqlaB.exe
PID 1704 wrote to memory of 2648	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\FrSqlaB.exe
PID 1704 wrote to memory of 2880	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\Xykzvvh.exe
PID 1704 wrote to memory of 2880	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\Xykzvvh.exe
PID 1704 wrote to memory of 2880	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\Xykzvvh.exe
PID 1704 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\VZnQQYf.exe
PID 1704 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\VZnQQYf.exe
PID 1704 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\VZnQQYf.exe
PID 1704 wrote to memory of 2448	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\UDmgSlD.exe
PID 1704 wrote to memory of 2448	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\UDmgSlD.exe
PID 1704 wrote to memory of 2448	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\UDmgSlD.exe
PID 1704 wrote to memory of 2460	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\jhkGUGO.exe
PID 1704 wrote to memory of 2460	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\jhkGUGO.exe
PID 1704 wrote to memory of 2460	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\jhkGUGO.exe
PID 1704 wrote to memory of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\bdSPuXH.exe
PID 1704 wrote to memory of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\bdSPuXH.exe
PID 1704 wrote to memory of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\bdSPuXH.exe
PID 1704 wrote to memory of 2432	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\bClFRDy.exe
PID 1704 wrote to memory of 2432	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\bClFRDy.exe
PID 1704 wrote to memory of 2432	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\bClFRDy.exe
PID 1704 wrote to memory of 2496	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\KSIezgL.exe
PID 1704 wrote to memory of 2496	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\KSIezgL.exe
PID 1704 wrote to memory of 2496	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\KSIezgL.exe
PID 1704 wrote to memory of 1948	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\fZJHzfe.exe
PID 1704 wrote to memory of 1948	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\fZJHzfe.exe
PID 1704 wrote to memory of 1948	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\fZJHzfe.exe
PID 1704 wrote to memory of 648	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\VsjjQEu.exe
PID 1704 wrote to memory of 648	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\VsjjQEu.exe
PID 1704 wrote to memory of 648	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\VsjjQEu.exe
PID 1704 wrote to memory of 1636	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\vBkRxGG.exe
PID 1704 wrote to memory of 1636	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\vBkRxGG.exe
PID 1704 wrote to memory of 1636	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\vBkRxGG.exe
PID 1704 wrote to memory of 2752	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\gwAnxtV.exe
PID 1704 wrote to memory of 2752	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\gwAnxtV.exe
PID 1704 wrote to memory of 2752	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\gwAnxtV.exe
PID 1704 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\yxfpFEd.exe
PID 1704 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\yxfpFEd.exe
PID 1704 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\yxfpFEd.exe
PID 1704 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\aPhUWsg.exe
PID 1704 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\aPhUWsg.exe
PID 1704 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\aPhUWsg.exe
PID 1704 wrote to memory of 2780	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\WTWwdXh.exe
PID 1704 wrote to memory of 2780	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\WTWwdXh.exe
PID 1704 wrote to memory of 2780	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\WTWwdXh.exe
PID 1704 wrote to memory of 1700	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\wbJcfNr.exe
PID 1704 wrote to memory of 1700	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\wbJcfNr.exe
PID 1704 wrote to memory of 1700	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\wbJcfNr.exe
PID 1704 wrote to memory of 1552	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\aTJseQO.exe
PID 1704 wrote to memory of 1552	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\aTJseQO.exe
PID 1704 wrote to memory of 1552	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\aTJseQO.exe
PID 1704 wrote to memory of 1060	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\wfSsWHn.exe
PID 1704 wrote to memory of 1060	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\wfSsWHn.exe
PID 1704 wrote to memory of 1060	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\wfSsWHn.exe
PID 1704 wrote to memory of 1716	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\AAxaHRY.exe

Processes

C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe"

C:\Windows\System\tPndvGN.exe

C:\Windows\System\tPndvGN.exe

C:\Windows\System\eBYtkXF.exe

C:\Windows\System\eBYtkXF.exe

C:\Windows\System\kkmdsUF.exe

C:\Windows\System\kkmdsUF.exe

C:\Windows\System\FrSqlaB.exe

C:\Windows\System\FrSqlaB.exe

C:\Windows\System\Xykzvvh.exe

C:\Windows\System\Xykzvvh.exe

C:\Windows\System\VZnQQYf.exe

C:\Windows\System\VZnQQYf.exe

C:\Windows\System\UDmgSlD.exe

C:\Windows\System\UDmgSlD.exe

C:\Windows\System\jhkGUGO.exe

C:\Windows\System\jhkGUGO.exe

C:\Windows\System\bdSPuXH.exe

C:\Windows\System\bdSPuXH.exe

C:\Windows\System\bClFRDy.exe

C:\Windows\System\bClFRDy.exe

C:\Windows\System\KSIezgL.exe

C:\Windows\System\KSIezgL.exe

C:\Windows\System\fZJHzfe.exe

C:\Windows\System\fZJHzfe.exe

C:\Windows\System\VsjjQEu.exe

C:\Windows\System\VsjjQEu.exe

C:\Windows\System\vBkRxGG.exe

C:\Windows\System\vBkRxGG.exe

C:\Windows\System\gwAnxtV.exe

C:\Windows\System\gwAnxtV.exe

C:\Windows\System\yxfpFEd.exe

C:\Windows\System\yxfpFEd.exe

C:\Windows\System\aPhUWsg.exe

C:\Windows\System\aPhUWsg.exe

C:\Windows\System\WTWwdXh.exe

C:\Windows\System\WTWwdXh.exe

C:\Windows\System\wbJcfNr.exe

C:\Windows\System\wbJcfNr.exe

C:\Windows\System\aTJseQO.exe

C:\Windows\System\aTJseQO.exe

C:\Windows\System\wfSsWHn.exe

C:\Windows\System\wfSsWHn.exe

C:\Windows\System\AAxaHRY.exe

C:\Windows\System\AAxaHRY.exe

C:\Windows\System\KbyqSMs.exe

C:\Windows\System\KbyqSMs.exe

C:\Windows\System\ooikGph.exe

C:\Windows\System\ooikGph.exe

C:\Windows\System\LlnknQt.exe

C:\Windows\System\LlnknQt.exe

C:\Windows\System\cLYrbAf.exe

C:\Windows\System\cLYrbAf.exe

C:\Windows\System\OPftCNK.exe

C:\Windows\System\OPftCNK.exe

C:\Windows\System\LjIfHJL.exe

C:\Windows\System\LjIfHJL.exe

C:\Windows\System\PMzsiYH.exe

C:\Windows\System\PMzsiYH.exe

C:\Windows\System\stitDXp.exe

C:\Windows\System\stitDXp.exe

C:\Windows\System\xtNZSjK.exe

C:\Windows\System\xtNZSjK.exe

C:\Windows\System\mUlnvyF.exe

C:\Windows\System\mUlnvyF.exe

C:\Windows\System\SYlhXqa.exe

C:\Windows\System\SYlhXqa.exe

C:\Windows\System\XtJpoeE.exe

C:\Windows\System\XtJpoeE.exe

C:\Windows\System\NvZiSkD.exe

C:\Windows\System\NvZiSkD.exe

C:\Windows\System\VfvqnJU.exe

C:\Windows\System\VfvqnJU.exe

C:\Windows\System\GkEsXHC.exe

C:\Windows\System\GkEsXHC.exe

C:\Windows\System\xcyKSlX.exe

C:\Windows\System\xcyKSlX.exe

C:\Windows\System\GMOLSHk.exe

C:\Windows\System\GMOLSHk.exe

C:\Windows\System\zxqzmcW.exe

C:\Windows\System\zxqzmcW.exe

C:\Windows\System\Ymtkqjr.exe

C:\Windows\System\Ymtkqjr.exe

C:\Windows\System\LagEDGa.exe

C:\Windows\System\LagEDGa.exe

C:\Windows\System\HaDgrKE.exe

C:\Windows\System\HaDgrKE.exe

C:\Windows\System\flhMprF.exe

C:\Windows\System\flhMprF.exe

C:\Windows\System\xonnvMV.exe

C:\Windows\System\xonnvMV.exe

C:\Windows\System\hGxsMaZ.exe

C:\Windows\System\hGxsMaZ.exe

C:\Windows\System\jDPiHUG.exe

C:\Windows\System\jDPiHUG.exe

C:\Windows\System\XCygqQV.exe

C:\Windows\System\XCygqQV.exe

C:\Windows\System\IosonoR.exe

C:\Windows\System\IosonoR.exe

C:\Windows\System\UTybPcJ.exe

C:\Windows\System\UTybPcJ.exe

C:\Windows\System\QOZYQIg.exe

C:\Windows\System\QOZYQIg.exe

C:\Windows\System\lHxWqPR.exe

C:\Windows\System\lHxWqPR.exe

C:\Windows\System\LTCeKgi.exe

C:\Windows\System\LTCeKgi.exe

C:\Windows\System\VaJqSVo.exe

C:\Windows\System\VaJqSVo.exe

C:\Windows\System\LdOzuRK.exe

C:\Windows\System\LdOzuRK.exe

C:\Windows\System\inHDGdG.exe

C:\Windows\System\inHDGdG.exe

C:\Windows\System\KJUjxho.exe

C:\Windows\System\KJUjxho.exe

C:\Windows\System\DEXqsAW.exe

C:\Windows\System\DEXqsAW.exe

C:\Windows\System\VYGgQrh.exe

C:\Windows\System\VYGgQrh.exe

C:\Windows\System\BhSSqFm.exe

C:\Windows\System\BhSSqFm.exe

C:\Windows\System\pmqejGh.exe

C:\Windows\System\pmqejGh.exe

C:\Windows\System\JrbJLqL.exe

C:\Windows\System\JrbJLqL.exe

C:\Windows\System\OANhTdO.exe

C:\Windows\System\OANhTdO.exe

C:\Windows\System\WXAQAYg.exe

C:\Windows\System\WXAQAYg.exe

C:\Windows\System\nqDazeD.exe

C:\Windows\System\nqDazeD.exe

C:\Windows\System\DkGiVBf.exe

C:\Windows\System\DkGiVBf.exe

C:\Windows\System\CVcVZFO.exe

C:\Windows\System\CVcVZFO.exe

C:\Windows\System\JHMlRDr.exe

C:\Windows\System\JHMlRDr.exe

C:\Windows\System\VXSgPTx.exe

C:\Windows\System\VXSgPTx.exe

C:\Windows\System\tToLwor.exe

C:\Windows\System\tToLwor.exe

C:\Windows\System\SRNheiz.exe

C:\Windows\System\SRNheiz.exe

C:\Windows\System\hRdMjJU.exe

C:\Windows\System\hRdMjJU.exe

C:\Windows\System\WFxPcTD.exe

C:\Windows\System\WFxPcTD.exe

C:\Windows\System\RmkUXMg.exe

C:\Windows\System\RmkUXMg.exe

C:\Windows\System\wXBLzfo.exe

C:\Windows\System\wXBLzfo.exe

C:\Windows\System\GMgilwr.exe

C:\Windows\System\GMgilwr.exe

C:\Windows\System\hGinbVK.exe

C:\Windows\System\hGinbVK.exe

C:\Windows\System\rBjTRRm.exe

C:\Windows\System\rBjTRRm.exe

C:\Windows\System\ZVfxsgp.exe

C:\Windows\System\ZVfxsgp.exe

C:\Windows\System\FXgitri.exe

C:\Windows\System\FXgitri.exe

C:\Windows\System\FXZIrIE.exe

C:\Windows\System\FXZIrIE.exe

C:\Windows\System\YPYAYQg.exe

C:\Windows\System\YPYAYQg.exe

C:\Windows\System\KSmMEGL.exe

C:\Windows\System\KSmMEGL.exe

C:\Windows\System\hKOYxvi.exe

C:\Windows\System\hKOYxvi.exe

C:\Windows\System\bCDegYr.exe

C:\Windows\System\bCDegYr.exe

C:\Windows\System\AbnFoFJ.exe

C:\Windows\System\AbnFoFJ.exe

C:\Windows\System\CQuHYiu.exe

C:\Windows\System\CQuHYiu.exe

C:\Windows\System\IEncHuU.exe

C:\Windows\System\IEncHuU.exe

C:\Windows\System\Yrbcroa.exe

C:\Windows\System\Yrbcroa.exe

C:\Windows\System\hnxZsUz.exe

C:\Windows\System\hnxZsUz.exe

C:\Windows\System\OZOFFby.exe

C:\Windows\System\OZOFFby.exe

C:\Windows\System\EFctLKN.exe

C:\Windows\System\EFctLKN.exe

C:\Windows\System\pCjWavQ.exe

C:\Windows\System\pCjWavQ.exe

C:\Windows\System\BIGrCbr.exe

C:\Windows\System\BIGrCbr.exe

C:\Windows\System\rDQjzJy.exe

C:\Windows\System\rDQjzJy.exe

C:\Windows\System\eQygIWm.exe

C:\Windows\System\eQygIWm.exe

C:\Windows\System\AcgqIMo.exe

C:\Windows\System\AcgqIMo.exe

C:\Windows\System\JaPJynW.exe

C:\Windows\System\JaPJynW.exe

C:\Windows\System\oKPhlvo.exe

C:\Windows\System\oKPhlvo.exe

C:\Windows\System\prEvnwR.exe

C:\Windows\System\prEvnwR.exe

C:\Windows\System\QIaAzjc.exe

C:\Windows\System\QIaAzjc.exe

C:\Windows\System\ASuvyzu.exe

C:\Windows\System\ASuvyzu.exe

C:\Windows\System\xtRzBXR.exe

C:\Windows\System\xtRzBXR.exe

C:\Windows\System\CKqMvBg.exe

C:\Windows\System\CKqMvBg.exe

C:\Windows\System\ExAbHyw.exe

C:\Windows\System\ExAbHyw.exe

C:\Windows\System\VRtOBwm.exe

C:\Windows\System\VRtOBwm.exe

C:\Windows\System\QiRFjhz.exe

C:\Windows\System\QiRFjhz.exe

C:\Windows\System\gzttCrv.exe

C:\Windows\System\gzttCrv.exe

C:\Windows\System\mYJVDsW.exe

C:\Windows\System\mYJVDsW.exe

C:\Windows\System\qupFrYr.exe

C:\Windows\System\qupFrYr.exe

C:\Windows\System\INZhDIl.exe

C:\Windows\System\INZhDIl.exe

C:\Windows\System\hXwRiMA.exe

C:\Windows\System\hXwRiMA.exe

C:\Windows\System\nFSdWBs.exe

C:\Windows\System\nFSdWBs.exe

C:\Windows\System\zYUJvnl.exe

C:\Windows\System\zYUJvnl.exe

C:\Windows\System\yGlTrcE.exe

C:\Windows\System\yGlTrcE.exe

C:\Windows\System\POwUSEl.exe

C:\Windows\System\POwUSEl.exe

C:\Windows\System\BFMjjmV.exe

C:\Windows\System\BFMjjmV.exe

C:\Windows\System\RqhpQHf.exe

C:\Windows\System\RqhpQHf.exe

C:\Windows\System\lwaPUCa.exe

C:\Windows\System\lwaPUCa.exe

C:\Windows\System\jtjRhsR.exe

C:\Windows\System\jtjRhsR.exe

C:\Windows\System\FlAfMtL.exe

C:\Windows\System\FlAfMtL.exe

C:\Windows\System\TMtQdxM.exe

C:\Windows\System\TMtQdxM.exe

C:\Windows\System\UxCwfer.exe

C:\Windows\System\UxCwfer.exe

C:\Windows\System\HSzEeqB.exe

C:\Windows\System\HSzEeqB.exe

C:\Windows\System\YCVOxEG.exe

C:\Windows\System\YCVOxEG.exe

C:\Windows\System\dcfrkJS.exe

C:\Windows\System\dcfrkJS.exe

C:\Windows\System\cbLUgpp.exe

C:\Windows\System\cbLUgpp.exe

C:\Windows\System\pnmFBtD.exe

C:\Windows\System\pnmFBtD.exe

C:\Windows\System\onIZNtl.exe

C:\Windows\System\onIZNtl.exe

C:\Windows\System\GLPYlVK.exe

C:\Windows\System\GLPYlVK.exe

C:\Windows\System\ueCuijb.exe

C:\Windows\System\ueCuijb.exe

C:\Windows\System\dLgLuTv.exe

C:\Windows\System\dLgLuTv.exe

C:\Windows\System\yGGlbXC.exe

C:\Windows\System\yGGlbXC.exe

C:\Windows\System\UFOYxAd.exe

C:\Windows\System\UFOYxAd.exe

C:\Windows\System\IJUYrOm.exe

C:\Windows\System\IJUYrOm.exe

C:\Windows\System\lRwaOxu.exe

C:\Windows\System\lRwaOxu.exe

C:\Windows\System\wmMGDpV.exe

C:\Windows\System\wmMGDpV.exe

C:\Windows\System\WIiaxXC.exe

C:\Windows\System\WIiaxXC.exe

C:\Windows\System\nGVcfDC.exe

C:\Windows\System\nGVcfDC.exe

C:\Windows\System\AdIeaDC.exe

C:\Windows\System\AdIeaDC.exe

C:\Windows\System\QgnkZrq.exe

C:\Windows\System\QgnkZrq.exe

C:\Windows\System\GzrbanE.exe

C:\Windows\System\GzrbanE.exe

C:\Windows\System\SffChZj.exe

C:\Windows\System\SffChZj.exe

C:\Windows\System\KIgWJzj.exe

C:\Windows\System\KIgWJzj.exe

C:\Windows\System\flVDDHW.exe

C:\Windows\System\flVDDHW.exe

C:\Windows\System\keaQihM.exe

C:\Windows\System\keaQihM.exe

C:\Windows\System\VUqBtYn.exe

C:\Windows\System\VUqBtYn.exe

C:\Windows\System\XmcvpRJ.exe

C:\Windows\System\XmcvpRJ.exe

C:\Windows\System\kFKLxeY.exe

C:\Windows\System\kFKLxeY.exe

C:\Windows\System\MPtSupQ.exe

C:\Windows\System\MPtSupQ.exe

C:\Windows\System\FyincXG.exe

C:\Windows\System\FyincXG.exe

C:\Windows\System\mcXwAoj.exe

C:\Windows\System\mcXwAoj.exe

C:\Windows\System\YrbPFsm.exe

C:\Windows\System\YrbPFsm.exe

C:\Windows\System\MjcbROj.exe

C:\Windows\System\MjcbROj.exe

C:\Windows\System\rpXVwWF.exe

C:\Windows\System\rpXVwWF.exe

C:\Windows\System\EQhmSaC.exe

C:\Windows\System\EQhmSaC.exe

C:\Windows\System\ZHFMvcq.exe

C:\Windows\System\ZHFMvcq.exe

C:\Windows\System\vEvQOSz.exe

C:\Windows\System\vEvQOSz.exe

C:\Windows\System\BfNnufY.exe

C:\Windows\System\BfNnufY.exe

C:\Windows\System\XrpaZwD.exe

C:\Windows\System\XrpaZwD.exe

C:\Windows\System\RajyKwN.exe

C:\Windows\System\RajyKwN.exe

C:\Windows\System\MLHlIBG.exe

C:\Windows\System\MLHlIBG.exe

C:\Windows\System\xswUUUF.exe

C:\Windows\System\xswUUUF.exe

C:\Windows\System\kEiNtJZ.exe

C:\Windows\System\kEiNtJZ.exe

C:\Windows\System\njklrMX.exe

C:\Windows\System\njklrMX.exe

C:\Windows\System\nxOBQwA.exe

C:\Windows\System\nxOBQwA.exe

C:\Windows\System\RUZVtKu.exe

C:\Windows\System\RUZVtKu.exe

C:\Windows\System\jEAwDLf.exe

C:\Windows\System\jEAwDLf.exe

C:\Windows\System\FsoodkQ.exe

C:\Windows\System\FsoodkQ.exe

C:\Windows\System\YXIRHvP.exe

C:\Windows\System\YXIRHvP.exe

C:\Windows\System\tNrWXWr.exe

C:\Windows\System\tNrWXWr.exe

C:\Windows\System\wSJVBCH.exe

C:\Windows\System\wSJVBCH.exe

C:\Windows\System\RPtTDUf.exe

C:\Windows\System\RPtTDUf.exe

C:\Windows\System\HaFIbKL.exe

C:\Windows\System\HaFIbKL.exe

C:\Windows\System\dPLzlnO.exe

C:\Windows\System\dPLzlnO.exe

C:\Windows\System\dQdqVVn.exe

C:\Windows\System\dQdqVVn.exe

C:\Windows\System\xoJtKFR.exe

C:\Windows\System\xoJtKFR.exe

C:\Windows\System\QEdujbt.exe

C:\Windows\System\QEdujbt.exe

C:\Windows\System\WSMyWcQ.exe

C:\Windows\System\WSMyWcQ.exe

C:\Windows\System\qrksDLn.exe

C:\Windows\System\qrksDLn.exe

C:\Windows\System\QvJdAEk.exe

C:\Windows\System\QvJdAEk.exe

C:\Windows\System\ZOaHvAu.exe

C:\Windows\System\ZOaHvAu.exe

C:\Windows\System\iBPWGzM.exe

C:\Windows\System\iBPWGzM.exe

C:\Windows\System\FZmYfpl.exe

C:\Windows\System\FZmYfpl.exe

C:\Windows\System\rPJFpEI.exe

C:\Windows\System\rPJFpEI.exe

C:\Windows\System\AHalZby.exe

C:\Windows\System\AHalZby.exe

C:\Windows\System\gNJAqil.exe

C:\Windows\System\gNJAqil.exe

C:\Windows\System\FvIMvSL.exe

C:\Windows\System\FvIMvSL.exe

C:\Windows\System\pROinXs.exe

C:\Windows\System\pROinXs.exe

C:\Windows\System\DLliLMD.exe

C:\Windows\System\DLliLMD.exe

C:\Windows\System\VzFxzPD.exe

C:\Windows\System\VzFxzPD.exe

C:\Windows\System\tuPbNvi.exe

C:\Windows\System\tuPbNvi.exe

C:\Windows\System\JFJysTV.exe

C:\Windows\System\JFJysTV.exe

C:\Windows\System\XtueAmR.exe

C:\Windows\System\XtueAmR.exe

C:\Windows\System\QlGeviw.exe

C:\Windows\System\QlGeviw.exe

C:\Windows\System\IxketnO.exe

C:\Windows\System\IxketnO.exe

C:\Windows\System\YlAaDhY.exe

C:\Windows\System\YlAaDhY.exe

C:\Windows\System\GhtMIXe.exe

C:\Windows\System\GhtMIXe.exe

C:\Windows\System\ZaEtHNI.exe

C:\Windows\System\ZaEtHNI.exe

C:\Windows\System\zrWlcxB.exe

C:\Windows\System\zrWlcxB.exe

C:\Windows\System\WYUqYnn.exe

C:\Windows\System\WYUqYnn.exe

C:\Windows\System\UeilyOp.exe

C:\Windows\System\UeilyOp.exe

C:\Windows\System\fJbtHhs.exe

C:\Windows\System\fJbtHhs.exe

C:\Windows\System\KDYFHmE.exe

C:\Windows\System\KDYFHmE.exe

C:\Windows\System\bdfYnaQ.exe

C:\Windows\System\bdfYnaQ.exe

C:\Windows\System\dyXBCtF.exe

C:\Windows\System\dyXBCtF.exe

C:\Windows\System\uyQkUev.exe

C:\Windows\System\uyQkUev.exe

C:\Windows\System\lzyHokZ.exe

C:\Windows\System\lzyHokZ.exe

C:\Windows\System\xkvjYhS.exe

C:\Windows\System\xkvjYhS.exe

C:\Windows\System\KPtUXwV.exe

C:\Windows\System\KPtUXwV.exe

C:\Windows\System\ylZxBgn.exe

C:\Windows\System\ylZxBgn.exe

C:\Windows\System\SDCVHiX.exe

C:\Windows\System\SDCVHiX.exe

C:\Windows\System\KyNpFlK.exe

C:\Windows\System\KyNpFlK.exe

C:\Windows\System\UgAdLDG.exe

C:\Windows\System\UgAdLDG.exe

C:\Windows\System\MlDQGiq.exe

C:\Windows\System\MlDQGiq.exe

C:\Windows\System\ZGtVkfP.exe

C:\Windows\System\ZGtVkfP.exe

C:\Windows\System\ILwsAKZ.exe

C:\Windows\System\ILwsAKZ.exe

C:\Windows\System\QxekZBg.exe

C:\Windows\System\QxekZBg.exe

C:\Windows\System\OwXxnLm.exe

C:\Windows\System\OwXxnLm.exe

C:\Windows\System\AwPCOZd.exe

C:\Windows\System\AwPCOZd.exe

C:\Windows\System\uEtDqFd.exe

C:\Windows\System\uEtDqFd.exe

C:\Windows\System\jBluIom.exe

C:\Windows\System\jBluIom.exe

C:\Windows\System\KvNOCXC.exe

C:\Windows\System\KvNOCXC.exe

C:\Windows\System\KGvYVSx.exe

C:\Windows\System\KGvYVSx.exe

C:\Windows\System\aYKEfMU.exe

C:\Windows\System\aYKEfMU.exe

C:\Windows\System\WHNZSYl.exe

C:\Windows\System\WHNZSYl.exe

C:\Windows\System\DFTeCFH.exe

C:\Windows\System\DFTeCFH.exe

C:\Windows\System\rDYWxKX.exe

C:\Windows\System\rDYWxKX.exe

C:\Windows\System\spfibuf.exe

C:\Windows\System\spfibuf.exe

C:\Windows\System\SlPWgMA.exe

C:\Windows\System\SlPWgMA.exe

C:\Windows\System\snxWDpd.exe

C:\Windows\System\snxWDpd.exe

C:\Windows\System\lURBfvq.exe

C:\Windows\System\lURBfvq.exe

C:\Windows\System\VNMAACa.exe

C:\Windows\System\VNMAACa.exe

C:\Windows\System\JVNwMrw.exe

C:\Windows\System\JVNwMrw.exe

C:\Windows\System\NjmTrAU.exe

C:\Windows\System\NjmTrAU.exe

C:\Windows\System\YKxOZYy.exe

C:\Windows\System\YKxOZYy.exe

C:\Windows\System\GxFpfWs.exe

C:\Windows\System\GxFpfWs.exe

C:\Windows\System\QIylCfh.exe

C:\Windows\System\QIylCfh.exe

C:\Windows\System\VHSCFJi.exe

C:\Windows\System\VHSCFJi.exe

C:\Windows\System\inxWZmH.exe

C:\Windows\System\inxWZmH.exe

C:\Windows\System\uTpyIRV.exe

C:\Windows\System\uTpyIRV.exe

C:\Windows\System\zkMZexm.exe

C:\Windows\System\zkMZexm.exe

C:\Windows\System\QlCcwOp.exe

C:\Windows\System\QlCcwOp.exe

C:\Windows\System\LdBeqCZ.exe

C:\Windows\System\LdBeqCZ.exe

C:\Windows\System\JMRHoEU.exe

C:\Windows\System\JMRHoEU.exe

C:\Windows\System\MHzsZYX.exe

C:\Windows\System\MHzsZYX.exe

C:\Windows\System\TGsiraI.exe

C:\Windows\System\TGsiraI.exe

C:\Windows\System\txMqJWW.exe

C:\Windows\System\txMqJWW.exe

C:\Windows\System\daGtzas.exe

C:\Windows\System\daGtzas.exe

C:\Windows\System\YFhrVjK.exe

C:\Windows\System\YFhrVjK.exe

C:\Windows\System\KsysRrA.exe

C:\Windows\System\KsysRrA.exe

C:\Windows\System\nmyyiVs.exe

C:\Windows\System\nmyyiVs.exe

C:\Windows\System\TDiaEbP.exe

C:\Windows\System\TDiaEbP.exe

C:\Windows\System\WnHYAqv.exe

C:\Windows\System\WnHYAqv.exe

C:\Windows\System\HsAkMZA.exe

C:\Windows\System\HsAkMZA.exe

C:\Windows\System\HMKJROD.exe

C:\Windows\System\HMKJROD.exe

C:\Windows\System\CrGhRYz.exe

C:\Windows\System\CrGhRYz.exe

C:\Windows\System\xjMoQrq.exe

C:\Windows\System\xjMoQrq.exe

C:\Windows\System\jEknbOW.exe

C:\Windows\System\jEknbOW.exe

C:\Windows\System\HUIQJtE.exe

C:\Windows\System\HUIQJtE.exe

C:\Windows\System\XHtDqsa.exe

C:\Windows\System\XHtDqsa.exe

C:\Windows\System\dpMeltW.exe

C:\Windows\System\dpMeltW.exe

C:\Windows\System\usIcnzA.exe

C:\Windows\System\usIcnzA.exe

C:\Windows\System\iBWfKjN.exe

C:\Windows\System\iBWfKjN.exe

C:\Windows\System\crBtyMK.exe

C:\Windows\System\crBtyMK.exe

C:\Windows\System\HPZknDk.exe

C:\Windows\System\HPZknDk.exe

C:\Windows\System\aDYOyXD.exe

C:\Windows\System\aDYOyXD.exe

C:\Windows\System\QJBpKEs.exe

C:\Windows\System\QJBpKEs.exe

C:\Windows\System\FpKckiO.exe

C:\Windows\System\FpKckiO.exe

C:\Windows\System\DqYpnNh.exe

C:\Windows\System\DqYpnNh.exe

C:\Windows\System\qnhBshz.exe

C:\Windows\System\qnhBshz.exe

C:\Windows\System\ViHcnDz.exe

C:\Windows\System\ViHcnDz.exe

C:\Windows\System\mtluqee.exe

C:\Windows\System\mtluqee.exe

C:\Windows\System\igAEgka.exe

C:\Windows\System\igAEgka.exe

C:\Windows\System\dqiGlkd.exe

C:\Windows\System\dqiGlkd.exe

C:\Windows\System\bFBErjA.exe

C:\Windows\System\bFBErjA.exe

C:\Windows\System\WrZYFdA.exe

C:\Windows\System\WrZYFdA.exe

C:\Windows\System\HuLGFpu.exe

C:\Windows\System\HuLGFpu.exe

C:\Windows\System\bxhYtlv.exe

C:\Windows\System\bxhYtlv.exe

C:\Windows\System\dYmJAzE.exe

C:\Windows\System\dYmJAzE.exe

C:\Windows\System\UJSMBEW.exe

C:\Windows\System\UJSMBEW.exe

C:\Windows\System\ibLOFhy.exe

C:\Windows\System\ibLOFhy.exe

C:\Windows\System\XHuJZBP.exe

C:\Windows\System\XHuJZBP.exe

C:\Windows\System\jNVLQcr.exe

C:\Windows\System\jNVLQcr.exe

C:\Windows\System\dwtZWbU.exe

C:\Windows\System\dwtZWbU.exe

C:\Windows\System\ssPrvFz.exe

C:\Windows\System\ssPrvFz.exe

C:\Windows\System\HRbuXTu.exe

C:\Windows\System\HRbuXTu.exe

C:\Windows\System\PEwBNWA.exe

C:\Windows\System\PEwBNWA.exe

C:\Windows\System\eHaFMnO.exe

C:\Windows\System\eHaFMnO.exe

C:\Windows\System\QpChrsu.exe

C:\Windows\System\QpChrsu.exe

C:\Windows\System\LthBowa.exe

C:\Windows\System\LthBowa.exe

C:\Windows\System\qGDlCno.exe

C:\Windows\System\qGDlCno.exe

C:\Windows\System\eaaIatU.exe

C:\Windows\System\eaaIatU.exe

C:\Windows\System\MKAcNwD.exe

C:\Windows\System\MKAcNwD.exe

C:\Windows\System\rgRoPSy.exe

C:\Windows\System\rgRoPSy.exe

C:\Windows\System\hnNFrLe.exe

C:\Windows\System\hnNFrLe.exe

C:\Windows\System\gLVqKyz.exe

C:\Windows\System\gLVqKyz.exe

C:\Windows\System\TVFXpVO.exe

C:\Windows\System\TVFXpVO.exe

C:\Windows\System\uAtsmDW.exe

C:\Windows\System\uAtsmDW.exe

C:\Windows\System\TUXmXpY.exe

C:\Windows\System\TUXmXpY.exe

C:\Windows\System\EnfAScb.exe

C:\Windows\System\EnfAScb.exe

C:\Windows\System\AuXYJPa.exe

C:\Windows\System\AuXYJPa.exe

C:\Windows\System\dsBYump.exe

C:\Windows\System\dsBYump.exe

C:\Windows\System\lJLPPRk.exe

C:\Windows\System\lJLPPRk.exe

C:\Windows\System\UMNGnQA.exe

C:\Windows\System\UMNGnQA.exe

C:\Windows\System\TOWrtHM.exe

C:\Windows\System\TOWrtHM.exe

C:\Windows\System\kDzfqJr.exe

C:\Windows\System\kDzfqJr.exe

C:\Windows\System\dTeGGUQ.exe

C:\Windows\System\dTeGGUQ.exe

C:\Windows\System\AhLacIl.exe

C:\Windows\System\AhLacIl.exe

C:\Windows\System\XadqfnD.exe

C:\Windows\System\XadqfnD.exe

C:\Windows\System\gladlIb.exe

C:\Windows\System\gladlIb.exe

C:\Windows\System\qZYZzFr.exe

C:\Windows\System\qZYZzFr.exe

C:\Windows\System\OOIMvzH.exe

C:\Windows\System\OOIMvzH.exe

C:\Windows\System\EOnBhLm.exe

C:\Windows\System\EOnBhLm.exe

C:\Windows\System\xeCUzFM.exe

C:\Windows\System\xeCUzFM.exe

C:\Windows\System\oZETfvj.exe

C:\Windows\System\oZETfvj.exe

C:\Windows\System\GJBzWoz.exe

C:\Windows\System\GJBzWoz.exe

C:\Windows\System\QgNkWjK.exe

C:\Windows\System\QgNkWjK.exe

C:\Windows\System\vuQCPWz.exe

C:\Windows\System\vuQCPWz.exe

C:\Windows\System\CVgChqo.exe

C:\Windows\System\CVgChqo.exe

C:\Windows\System\CjZjodh.exe

C:\Windows\System\CjZjodh.exe

C:\Windows\System\JjgGbyu.exe

C:\Windows\System\JjgGbyu.exe

C:\Windows\System\oylMnzh.exe

C:\Windows\System\oylMnzh.exe

C:\Windows\System\BERcnfg.exe

C:\Windows\System\BERcnfg.exe

C:\Windows\System\MopIREZ.exe

C:\Windows\System\MopIREZ.exe

C:\Windows\System\TzAxvSk.exe

C:\Windows\System\TzAxvSk.exe

C:\Windows\System\unttWgH.exe

C:\Windows\System\unttWgH.exe

C:\Windows\System\XaRqjaV.exe

C:\Windows\System\XaRqjaV.exe

C:\Windows\System\VkKSaEx.exe

C:\Windows\System\VkKSaEx.exe

C:\Windows\System\AzuHoBI.exe

C:\Windows\System\AzuHoBI.exe

C:\Windows\System\CQQrFvD.exe

C:\Windows\System\CQQrFvD.exe

C:\Windows\System\JVmkPYz.exe

C:\Windows\System\JVmkPYz.exe

C:\Windows\System\wMnhZQc.exe

C:\Windows\System\wMnhZQc.exe

C:\Windows\System\FUuzRRQ.exe

C:\Windows\System\FUuzRRQ.exe

C:\Windows\System\iIPQOcM.exe

C:\Windows\System\iIPQOcM.exe

C:\Windows\System\DEHhSmy.exe

C:\Windows\System\DEHhSmy.exe

C:\Windows\System\zKvHeiT.exe

C:\Windows\System\zKvHeiT.exe

C:\Windows\System\HxNEdCA.exe

C:\Windows\System\HxNEdCA.exe

C:\Windows\System\xJGTlpP.exe

C:\Windows\System\xJGTlpP.exe

C:\Windows\System\ZgAlEOL.exe

C:\Windows\System\ZgAlEOL.exe

C:\Windows\System\EWBuduD.exe

C:\Windows\System\EWBuduD.exe

C:\Windows\System\uZLygOl.exe

C:\Windows\System\uZLygOl.exe

C:\Windows\System\pbXSKHM.exe

C:\Windows\System\pbXSKHM.exe

C:\Windows\System\EUyKThN.exe

C:\Windows\System\EUyKThN.exe

C:\Windows\System\jDBJcBW.exe

C:\Windows\System\jDBJcBW.exe

C:\Windows\System\OQuoNWg.exe

C:\Windows\System\OQuoNWg.exe

C:\Windows\System\pBLtTsd.exe

C:\Windows\System\pBLtTsd.exe

C:\Windows\System\CnXqreY.exe

C:\Windows\System\CnXqreY.exe

C:\Windows\System\qLrIZPk.exe

C:\Windows\System\qLrIZPk.exe

C:\Windows\System\AbiSoyf.exe

C:\Windows\System\AbiSoyf.exe

C:\Windows\System\EwNUjhI.exe

C:\Windows\System\EwNUjhI.exe

C:\Windows\System\ZkHHRfr.exe

C:\Windows\System\ZkHHRfr.exe

C:\Windows\System\iUDrEhH.exe

C:\Windows\System\iUDrEhH.exe

C:\Windows\System\tHuJrmn.exe

C:\Windows\System\tHuJrmn.exe

C:\Windows\System\VBVQqEp.exe

C:\Windows\System\VBVQqEp.exe

C:\Windows\System\EbvKYWA.exe

C:\Windows\System\EbvKYWA.exe

C:\Windows\System\WDPtMyd.exe

C:\Windows\System\WDPtMyd.exe

C:\Windows\System\xlPBYGx.exe

C:\Windows\System\xlPBYGx.exe

C:\Windows\System\tmDosLm.exe

C:\Windows\System\tmDosLm.exe

C:\Windows\System\bNfqupn.exe

C:\Windows\System\bNfqupn.exe

C:\Windows\System\PKfChCv.exe

C:\Windows\System\PKfChCv.exe

C:\Windows\System\TxQKhrg.exe

C:\Windows\System\TxQKhrg.exe

C:\Windows\System\BtOVtzE.exe

C:\Windows\System\BtOVtzE.exe

C:\Windows\System\CygEfec.exe

C:\Windows\System\CygEfec.exe

C:\Windows\System\EMUiZIe.exe

C:\Windows\System\EMUiZIe.exe

C:\Windows\System\oiRKbjy.exe

C:\Windows\System\oiRKbjy.exe

C:\Windows\System\MGiMELq.exe

C:\Windows\System\MGiMELq.exe

C:\Windows\System\Ofwoahx.exe

C:\Windows\System\Ofwoahx.exe

C:\Windows\System\RiqQIBp.exe

C:\Windows\System\RiqQIBp.exe

C:\Windows\System\ZweJszO.exe

C:\Windows\System\ZweJszO.exe

C:\Windows\System\lEmuPVF.exe

C:\Windows\System\lEmuPVF.exe

C:\Windows\System\mvThhpD.exe

C:\Windows\System\mvThhpD.exe

C:\Windows\System\pEwMkWy.exe

C:\Windows\System\pEwMkWy.exe

C:\Windows\System\SuPyAWF.exe

C:\Windows\System\SuPyAWF.exe

C:\Windows\System\UtQmYih.exe

C:\Windows\System\UtQmYih.exe

C:\Windows\System\pDzUEtA.exe

C:\Windows\System\pDzUEtA.exe

C:\Windows\System\DEHccYI.exe

C:\Windows\System\DEHccYI.exe

C:\Windows\System\DvjzoBq.exe

C:\Windows\System\DvjzoBq.exe

C:\Windows\System\yjVcUBE.exe

C:\Windows\System\yjVcUBE.exe

C:\Windows\System\xOjFtEB.exe

C:\Windows\System\xOjFtEB.exe

C:\Windows\System\IpKriCP.exe

C:\Windows\System\IpKriCP.exe

C:\Windows\System\OaEuOfY.exe

C:\Windows\System\OaEuOfY.exe

C:\Windows\System\cShNvzx.exe

C:\Windows\System\cShNvzx.exe

C:\Windows\System\TpsZtgl.exe

C:\Windows\System\TpsZtgl.exe

C:\Windows\System\mZQeIso.exe

C:\Windows\System\mZQeIso.exe

C:\Windows\System\ebTtZmE.exe

C:\Windows\System\ebTtZmE.exe

C:\Windows\System\rDxteZB.exe

C:\Windows\System\rDxteZB.exe

C:\Windows\System\nGTmeor.exe

C:\Windows\System\nGTmeor.exe

C:\Windows\System\PULeIVg.exe

C:\Windows\System\PULeIVg.exe

C:\Windows\System\sqNbDmZ.exe

C:\Windows\System\sqNbDmZ.exe

C:\Windows\System\mLvpOwA.exe

C:\Windows\System\mLvpOwA.exe

C:\Windows\System\aWehYfu.exe

C:\Windows\System\aWehYfu.exe

C:\Windows\System\WVAFwPe.exe

C:\Windows\System\WVAFwPe.exe

C:\Windows\System\vuKaoEl.exe

C:\Windows\System\vuKaoEl.exe

C:\Windows\System\vIjcwET.exe

C:\Windows\System\vIjcwET.exe

C:\Windows\System\uudVmoA.exe

C:\Windows\System\uudVmoA.exe

C:\Windows\System\luLdWKr.exe

C:\Windows\System\luLdWKr.exe

C:\Windows\System\XGgISQZ.exe

C:\Windows\System\XGgISQZ.exe

C:\Windows\System\pDRVxGt.exe

C:\Windows\System\pDRVxGt.exe

C:\Windows\System\aZJeUjq.exe

C:\Windows\System\aZJeUjq.exe

C:\Windows\System\wICGIpU.exe

C:\Windows\System\wICGIpU.exe

C:\Windows\System\KYlRtMy.exe

C:\Windows\System\KYlRtMy.exe

C:\Windows\System\rEQsAkF.exe

C:\Windows\System\rEQsAkF.exe

C:\Windows\System\mNIRLNE.exe

C:\Windows\System\mNIRLNE.exe

C:\Windows\System\PZnoMMP.exe

C:\Windows\System\PZnoMMP.exe

C:\Windows\System\AFYbtOv.exe

C:\Windows\System\AFYbtOv.exe

C:\Windows\System\HdWiQEn.exe

C:\Windows\System\HdWiQEn.exe

C:\Windows\System\vUkTKjX.exe

C:\Windows\System\vUkTKjX.exe

C:\Windows\System\qfQcYNh.exe

C:\Windows\System\qfQcYNh.exe

C:\Windows\System\nzYCcQv.exe

C:\Windows\System\nzYCcQv.exe

C:\Windows\System\lVgVkwc.exe

C:\Windows\System\lVgVkwc.exe

C:\Windows\System\tvrQEqL.exe

C:\Windows\System\tvrQEqL.exe

C:\Windows\System\ENjCnYU.exe

C:\Windows\System\ENjCnYU.exe

C:\Windows\System\vcxnjdS.exe

C:\Windows\System\vcxnjdS.exe

C:\Windows\System\oMPhcTp.exe

C:\Windows\System\oMPhcTp.exe

C:\Windows\System\dgVCcNr.exe

C:\Windows\System\dgVCcNr.exe

C:\Windows\System\duEvpmi.exe

C:\Windows\System\duEvpmi.exe

C:\Windows\System\nQktAgp.exe

C:\Windows\System\nQktAgp.exe

C:\Windows\System\MDNbvAh.exe

C:\Windows\System\MDNbvAh.exe

C:\Windows\System\KJnBxQO.exe

C:\Windows\System\KJnBxQO.exe

C:\Windows\System\kWrSTEy.exe

C:\Windows\System\kWrSTEy.exe

C:\Windows\System\rMuURoZ.exe

C:\Windows\System\rMuURoZ.exe

C:\Windows\System\HgFTHrJ.exe

C:\Windows\System\HgFTHrJ.exe

C:\Windows\System\WbYXtYw.exe

C:\Windows\System\WbYXtYw.exe

C:\Windows\System\qaxrFVR.exe

C:\Windows\System\qaxrFVR.exe

C:\Windows\System\ljKhFeX.exe

C:\Windows\System\ljKhFeX.exe

C:\Windows\System\hgWvTEG.exe

C:\Windows\System\hgWvTEG.exe

C:\Windows\System\lSHEcZf.exe

C:\Windows\System\lSHEcZf.exe

C:\Windows\System\KTrpfdF.exe

C:\Windows\System\KTrpfdF.exe

C:\Windows\System\XPkBOVw.exe

C:\Windows\System\XPkBOVw.exe

C:\Windows\System\zyiCNiS.exe

C:\Windows\System\zyiCNiS.exe

C:\Windows\System\kEPpsnL.exe

C:\Windows\System\kEPpsnL.exe

C:\Windows\System\dZQQeaZ.exe

C:\Windows\System\dZQQeaZ.exe

C:\Windows\System\tVtDGUh.exe

C:\Windows\System\tVtDGUh.exe

C:\Windows\System\oMApcKE.exe

C:\Windows\System\oMApcKE.exe

C:\Windows\System\LwWhYxw.exe

C:\Windows\System\LwWhYxw.exe

C:\Windows\System\rGvGLlQ.exe

C:\Windows\System\rGvGLlQ.exe

C:\Windows\System\YXCBGHK.exe

C:\Windows\System\YXCBGHK.exe

C:\Windows\System\QyHZKXm.exe

C:\Windows\System\QyHZKXm.exe

C:\Windows\System\OwtXlWX.exe

C:\Windows\System\OwtXlWX.exe

C:\Windows\System\USqqfXM.exe

C:\Windows\System\USqqfXM.exe

C:\Windows\System\fWfmbrz.exe

C:\Windows\System\fWfmbrz.exe

C:\Windows\System\xvbkehp.exe

C:\Windows\System\xvbkehp.exe

C:\Windows\System\eYDOYsG.exe

C:\Windows\System\eYDOYsG.exe

C:\Windows\System\XBWMfpb.exe

C:\Windows\System\XBWMfpb.exe

C:\Windows\System\zpcyXys.exe

C:\Windows\System\zpcyXys.exe

C:\Windows\System\oeSLleN.exe

C:\Windows\System\oeSLleN.exe

C:\Windows\System\adIXIaL.exe

C:\Windows\System\adIXIaL.exe

C:\Windows\System\BnsLSPT.exe

C:\Windows\System\BnsLSPT.exe

C:\Windows\System\VJRrjIK.exe

C:\Windows\System\VJRrjIK.exe

C:\Windows\System\PfcyxBJ.exe

C:\Windows\System\PfcyxBJ.exe

C:\Windows\System\pUSOUEx.exe

C:\Windows\System\pUSOUEx.exe

C:\Windows\System\UTkvWLc.exe

C:\Windows\System\UTkvWLc.exe

C:\Windows\System\dmObItx.exe

C:\Windows\System\dmObItx.exe

C:\Windows\System\iBlOsUA.exe

C:\Windows\System\iBlOsUA.exe

C:\Windows\System\yVLkZIP.exe

C:\Windows\System\yVLkZIP.exe

C:\Windows\System\jkWCoOR.exe

C:\Windows\System\jkWCoOR.exe

C:\Windows\System\cYBdwke.exe

C:\Windows\System\cYBdwke.exe

C:\Windows\System\mDIGyxM.exe

C:\Windows\System\mDIGyxM.exe

C:\Windows\System\SFzQCUR.exe

C:\Windows\System\SFzQCUR.exe

C:\Windows\System\zLeSGKn.exe

C:\Windows\System\zLeSGKn.exe

C:\Windows\System\UpTuHKw.exe

C:\Windows\System\UpTuHKw.exe

C:\Windows\System\gXIMjjM.exe

C:\Windows\System\gXIMjjM.exe

C:\Windows\System\PiCLKVK.exe

C:\Windows\System\PiCLKVK.exe

C:\Windows\System\AoGznwb.exe

C:\Windows\System\AoGznwb.exe

C:\Windows\System\WKXVFPC.exe

C:\Windows\System\WKXVFPC.exe

C:\Windows\System\jyBlDUt.exe

C:\Windows\System\jyBlDUt.exe

C:\Windows\System\qexawvx.exe

C:\Windows\System\qexawvx.exe

C:\Windows\System\cfszDMn.exe

C:\Windows\System\cfszDMn.exe

C:\Windows\System\CCRTEdL.exe

C:\Windows\System\CCRTEdL.exe

C:\Windows\System\pdRQYBx.exe

C:\Windows\System\pdRQYBx.exe

C:\Windows\System\prxoBji.exe

C:\Windows\System\prxoBji.exe

C:\Windows\System\FADqOsy.exe

C:\Windows\System\FADqOsy.exe

C:\Windows\System\iOwNmvr.exe

C:\Windows\System\iOwNmvr.exe

C:\Windows\System\SdKSdlz.exe

C:\Windows\System\SdKSdlz.exe

C:\Windows\System\zbDnaKJ.exe

C:\Windows\System\zbDnaKJ.exe

C:\Windows\System\IePhhuR.exe

C:\Windows\System\IePhhuR.exe

C:\Windows\System\vyteTIw.exe

C:\Windows\System\vyteTIw.exe

C:\Windows\System\IpfHmwp.exe

C:\Windows\System\IpfHmwp.exe

C:\Windows\System\TjhgHsD.exe

C:\Windows\System\TjhgHsD.exe

C:\Windows\System\tAGCwSs.exe

C:\Windows\System\tAGCwSs.exe

C:\Windows\System\vJlaEAz.exe

C:\Windows\System\vJlaEAz.exe

C:\Windows\System\lxiSQfZ.exe

C:\Windows\System\lxiSQfZ.exe

C:\Windows\System\MPUOreD.exe

C:\Windows\System\MPUOreD.exe

C:\Windows\System\nNpYdiR.exe

C:\Windows\System\nNpYdiR.exe

C:\Windows\System\MtZdnFI.exe

C:\Windows\System\MtZdnFI.exe

C:\Windows\System\okroIOC.exe

C:\Windows\System\okroIOC.exe

C:\Windows\System\LYfIckl.exe

C:\Windows\System\LYfIckl.exe

C:\Windows\System\YncYnOa.exe

C:\Windows\System\YncYnOa.exe

C:\Windows\System\ktSklbn.exe

C:\Windows\System\ktSklbn.exe

C:\Windows\System\jjEYxbd.exe

C:\Windows\System\jjEYxbd.exe

C:\Windows\System\bXOCXoZ.exe

C:\Windows\System\bXOCXoZ.exe

C:\Windows\System\BWdwirV.exe

C:\Windows\System\BWdwirV.exe

C:\Windows\System\yZjjHjV.exe

C:\Windows\System\yZjjHjV.exe

C:\Windows\System\CSkivho.exe

C:\Windows\System\CSkivho.exe

C:\Windows\System\QXZPmpa.exe

C:\Windows\System\QXZPmpa.exe

C:\Windows\System\ZteGiuL.exe

C:\Windows\System\ZteGiuL.exe

C:\Windows\System\ClHqAyg.exe

C:\Windows\System\ClHqAyg.exe

C:\Windows\System\cAAtxRY.exe

C:\Windows\System\cAAtxRY.exe

C:\Windows\System\zvRQKVH.exe

C:\Windows\System\zvRQKVH.exe

C:\Windows\System\mgBheNq.exe

C:\Windows\System\mgBheNq.exe

C:\Windows\System\uhuZpMm.exe

C:\Windows\System\uhuZpMm.exe

C:\Windows\System\LtnixyF.exe

C:\Windows\System\LtnixyF.exe

C:\Windows\System\kwVWtkZ.exe

C:\Windows\System\kwVWtkZ.exe

C:\Windows\System\MeOHImP.exe

C:\Windows\System\MeOHImP.exe

C:\Windows\System\kRIAazJ.exe

C:\Windows\System\kRIAazJ.exe

C:\Windows\System\pzTlzre.exe

C:\Windows\System\pzTlzre.exe

C:\Windows\System\SzzNKIR.exe

C:\Windows\System\SzzNKIR.exe

C:\Windows\System\zLZZLNd.exe

C:\Windows\System\zLZZLNd.exe

C:\Windows\System\UipcCIW.exe

C:\Windows\System\UipcCIW.exe

C:\Windows\System\bgnzIcx.exe

C:\Windows\System\bgnzIcx.exe

C:\Windows\System\ynFhqWO.exe

C:\Windows\System\ynFhqWO.exe

C:\Windows\System\wmgjOho.exe

C:\Windows\System\wmgjOho.exe

C:\Windows\System\FLpKxOc.exe

C:\Windows\System\FLpKxOc.exe

C:\Windows\System\MCNQsBW.exe

C:\Windows\System\MCNQsBW.exe

C:\Windows\System\iHJoenh.exe

C:\Windows\System\iHJoenh.exe

C:\Windows\System\utgpXel.exe

C:\Windows\System\utgpXel.exe

C:\Windows\System\ScPmvwX.exe

C:\Windows\System\ScPmvwX.exe

C:\Windows\System\lfsuraX.exe

C:\Windows\System\lfsuraX.exe

C:\Windows\System\DHFHFKi.exe

C:\Windows\System\DHFHFKi.exe

C:\Windows\System\HoRlpjf.exe

C:\Windows\System\HoRlpjf.exe

C:\Windows\System\imjNrNs.exe

C:\Windows\System\imjNrNs.exe

C:\Windows\System\nlTHIMC.exe

C:\Windows\System\nlTHIMC.exe

C:\Windows\System\GkvmsaL.exe

C:\Windows\System\GkvmsaL.exe

C:\Windows\System\vgLbymg.exe

C:\Windows\System\vgLbymg.exe

C:\Windows\System\FanjzHn.exe

C:\Windows\System\FanjzHn.exe

C:\Windows\System\SwMltkK.exe

C:\Windows\System\SwMltkK.exe

C:\Windows\System\uplUwLP.exe

C:\Windows\System\uplUwLP.exe

C:\Windows\System\clHycFJ.exe

C:\Windows\System\clHycFJ.exe

C:\Windows\System\MAcmVIZ.exe

C:\Windows\System\MAcmVIZ.exe

C:\Windows\System\sidLWNV.exe

C:\Windows\System\sidLWNV.exe

C:\Windows\System\vxGGesT.exe

C:\Windows\System\vxGGesT.exe

C:\Windows\System\eYjluwz.exe

C:\Windows\System\eYjluwz.exe

C:\Windows\System\opPctjK.exe

C:\Windows\System\opPctjK.exe

C:\Windows\System\iWNYukJ.exe

C:\Windows\System\iWNYukJ.exe

C:\Windows\System\cBoljvF.exe

C:\Windows\System\cBoljvF.exe

C:\Windows\System\DqQSRuS.exe

C:\Windows\System\DqQSRuS.exe

C:\Windows\System\OhrXBMj.exe

C:\Windows\System\OhrXBMj.exe

C:\Windows\System\xMIqGLe.exe

C:\Windows\System\xMIqGLe.exe

C:\Windows\System\pxPJaRS.exe

C:\Windows\System\pxPJaRS.exe

C:\Windows\System\VSBEzRS.exe

C:\Windows\System\VSBEzRS.exe

C:\Windows\System\xleLZmo.exe

C:\Windows\System\xleLZmo.exe

C:\Windows\System\jfjASQw.exe

C:\Windows\System\jfjASQw.exe

C:\Windows\System\OJIihYI.exe

C:\Windows\System\OJIihYI.exe

C:\Windows\System\gIJjECQ.exe

C:\Windows\System\gIJjECQ.exe

C:\Windows\System\AglXTBK.exe

C:\Windows\System\AglXTBK.exe

C:\Windows\System\QpDqYua.exe

C:\Windows\System\QpDqYua.exe

C:\Windows\System\ZcJZWiz.exe

C:\Windows\System\ZcJZWiz.exe

C:\Windows\System\sbyVKiM.exe

C:\Windows\System\sbyVKiM.exe

C:\Windows\System\sblsjZa.exe

C:\Windows\System\sblsjZa.exe

C:\Windows\System\hxzyGMC.exe

C:\Windows\System\hxzyGMC.exe

C:\Windows\System\eDtVmBs.exe

C:\Windows\System\eDtVmBs.exe

C:\Windows\System\XGfSzTx.exe

C:\Windows\System\XGfSzTx.exe

C:\Windows\System\NOofgJz.exe

C:\Windows\System\NOofgJz.exe

C:\Windows\System\yZlmfKd.exe

C:\Windows\System\yZlmfKd.exe

C:\Windows\System\JZOfIqZ.exe

C:\Windows\System\JZOfIqZ.exe

C:\Windows\System\yMBfrPS.exe

C:\Windows\System\yMBfrPS.exe

C:\Windows\System\lsTnBnt.exe

C:\Windows\System\lsTnBnt.exe

C:\Windows\System\QTCFOrl.exe

C:\Windows\System\QTCFOrl.exe

C:\Windows\System\ViKsrct.exe

C:\Windows\System\ViKsrct.exe

C:\Windows\System\liVCclY.exe

C:\Windows\System\liVCclY.exe

C:\Windows\System\NETtplB.exe

C:\Windows\System\NETtplB.exe

C:\Windows\System\yuPMRoo.exe

C:\Windows\System\yuPMRoo.exe

C:\Windows\System\HyIldbt.exe

C:\Windows\System\HyIldbt.exe

C:\Windows\System\ggaUceW.exe

C:\Windows\System\ggaUceW.exe

C:\Windows\System\kwaInHA.exe

C:\Windows\System\kwaInHA.exe

C:\Windows\System\yUkKhZS.exe

C:\Windows\System\yUkKhZS.exe

C:\Windows\System\YcoxVMd.exe

C:\Windows\System\YcoxVMd.exe

C:\Windows\System\smvaSUU.exe

C:\Windows\System\smvaSUU.exe

C:\Windows\System\AiNWMAY.exe

C:\Windows\System\AiNWMAY.exe

C:\Windows\System\nWxmzmc.exe

C:\Windows\System\nWxmzmc.exe

C:\Windows\System\KnkhZmb.exe

C:\Windows\System\KnkhZmb.exe

C:\Windows\System\GZKODvX.exe

C:\Windows\System\GZKODvX.exe

C:\Windows\System\BbGQTRL.exe

C:\Windows\System\BbGQTRL.exe

C:\Windows\System\HnFIlqa.exe

C:\Windows\System\HnFIlqa.exe

C:\Windows\System\wVCvYmh.exe

C:\Windows\System\wVCvYmh.exe

C:\Windows\System\HHxpTxU.exe

C:\Windows\System\HHxpTxU.exe

C:\Windows\System\YwQdeJA.exe

C:\Windows\System\YwQdeJA.exe

C:\Windows\System\ccUxmjv.exe

C:\Windows\System\ccUxmjv.exe

C:\Windows\System\XAlRrJw.exe

C:\Windows\System\XAlRrJw.exe

C:\Windows\System\SPOaRfS.exe

C:\Windows\System\SPOaRfS.exe

C:\Windows\System\emSGQpk.exe

C:\Windows\System\emSGQpk.exe

C:\Windows\System\kbvMgsU.exe

C:\Windows\System\kbvMgsU.exe

C:\Windows\System\foLyJaY.exe

C:\Windows\System\foLyJaY.exe

C:\Windows\System\jlRCPwE.exe

C:\Windows\System\jlRCPwE.exe

C:\Windows\System\xuPwKrf.exe

C:\Windows\System\xuPwKrf.exe

C:\Windows\System\VSpNRBk.exe

C:\Windows\System\VSpNRBk.exe

C:\Windows\System\CBfBnTt.exe

C:\Windows\System\CBfBnTt.exe

C:\Windows\System\NjvYScx.exe

C:\Windows\System\NjvYScx.exe

C:\Windows\System\CoHCwfM.exe

C:\Windows\System\CoHCwfM.exe

C:\Windows\System\pWFVmTi.exe

C:\Windows\System\pWFVmTi.exe

C:\Windows\System\uDfqhbU.exe

C:\Windows\System\uDfqhbU.exe

C:\Windows\System\wyADbyB.exe

C:\Windows\System\wyADbyB.exe

C:\Windows\System\wEXjsey.exe

C:\Windows\System\wEXjsey.exe

C:\Windows\System\jfDMcDN.exe

C:\Windows\System\jfDMcDN.exe

C:\Windows\System\yhoYiMh.exe

C:\Windows\System\yhoYiMh.exe

C:\Windows\System\qMJcUqV.exe

C:\Windows\System\qMJcUqV.exe

C:\Windows\System\dNWUzZv.exe

C:\Windows\System\dNWUzZv.exe

C:\Windows\System\jcSzJaE.exe

C:\Windows\System\jcSzJaE.exe

C:\Windows\System\RSbGZJt.exe

C:\Windows\System\RSbGZJt.exe

C:\Windows\System\hpoouHB.exe

C:\Windows\System\hpoouHB.exe

C:\Windows\System\ASBOXZY.exe

C:\Windows\System\ASBOXZY.exe

C:\Windows\System\SPzzyjr.exe

C:\Windows\System\SPzzyjr.exe

C:\Windows\System\LrkpQHV.exe

C:\Windows\System\LrkpQHV.exe

C:\Windows\System\UhRLphN.exe

C:\Windows\System\UhRLphN.exe

C:\Windows\System\chYqwXO.exe

C:\Windows\System\chYqwXO.exe

C:\Windows\System\qWPLwLd.exe

C:\Windows\System\qWPLwLd.exe

C:\Windows\System\urqpLVq.exe

C:\Windows\System\urqpLVq.exe

C:\Windows\System\qeEuOor.exe

C:\Windows\System\qeEuOor.exe

C:\Windows\System\bGPbavW.exe

C:\Windows\System\bGPbavW.exe

C:\Windows\System\URitQqk.exe

C:\Windows\System\URitQqk.exe

C:\Windows\System\qxHfoCN.exe

C:\Windows\System\qxHfoCN.exe

C:\Windows\System\qkZfPLH.exe

C:\Windows\System\qkZfPLH.exe

C:\Windows\System\UCqWloy.exe

C:\Windows\System\UCqWloy.exe

C:\Windows\System\mAOTlGp.exe

C:\Windows\System\mAOTlGp.exe

C:\Windows\System\yWiCQXT.exe

C:\Windows\System\yWiCQXT.exe

C:\Windows\System\EdzOtok.exe

C:\Windows\System\EdzOtok.exe

C:\Windows\System\TeqvvAs.exe

C:\Windows\System\TeqvvAs.exe

C:\Windows\System\YuhocLO.exe

C:\Windows\System\YuhocLO.exe

C:\Windows\System\eEidWaU.exe

C:\Windows\System\eEidWaU.exe

C:\Windows\System\AdYaBjP.exe

C:\Windows\System\AdYaBjP.exe

C:\Windows\System\wtosBXH.exe

C:\Windows\System\wtosBXH.exe

C:\Windows\System\CqJJwcV.exe

C:\Windows\System\CqJJwcV.exe

C:\Windows\System\gwhWQtF.exe

C:\Windows\System\gwhWQtF.exe

C:\Windows\System\cdMxYAI.exe

C:\Windows\System\cdMxYAI.exe

C:\Windows\System\BWGkSdx.exe

C:\Windows\System\BWGkSdx.exe

C:\Windows\System\ekxDRFt.exe

C:\Windows\System\ekxDRFt.exe

C:\Windows\System\XWQcBdW.exe

C:\Windows\System\XWQcBdW.exe

C:\Windows\System\ikxSCYp.exe

C:\Windows\System\ikxSCYp.exe

C:\Windows\System\pkbJhyp.exe

C:\Windows\System\pkbJhyp.exe

C:\Windows\System\lJlLbLT.exe

C:\Windows\System\lJlLbLT.exe

C:\Windows\System\qflYxgp.exe

C:\Windows\System\qflYxgp.exe

C:\Windows\System\kIMTKJU.exe

C:\Windows\System\kIMTKJU.exe

C:\Windows\System\ZTUNtHv.exe

C:\Windows\System\ZTUNtHv.exe

C:\Windows\System\fryaDyf.exe

C:\Windows\System\fryaDyf.exe

C:\Windows\System\ltlAREr.exe

C:\Windows\System\ltlAREr.exe

C:\Windows\System\mKynmqx.exe

C:\Windows\System\mKynmqx.exe

C:\Windows\System\pKcaJyz.exe

C:\Windows\System\pKcaJyz.exe

C:\Windows\System\ReMgUvr.exe

C:\Windows\System\ReMgUvr.exe

C:\Windows\System\cOJqaEF.exe

C:\Windows\System\cOJqaEF.exe

C:\Windows\System\dlGRSlS.exe

C:\Windows\System\dlGRSlS.exe

C:\Windows\System\nwebzeM.exe

C:\Windows\System\nwebzeM.exe

C:\Windows\System\VBrWQCp.exe

C:\Windows\System\VBrWQCp.exe

C:\Windows\System\ompLZey.exe

C:\Windows\System\ompLZey.exe

C:\Windows\System\fPrMGsU.exe

C:\Windows\System\fPrMGsU.exe

C:\Windows\System\qKBMuOY.exe

C:\Windows\System\qKBMuOY.exe

C:\Windows\System\bAsoWNA.exe

C:\Windows\System\bAsoWNA.exe

C:\Windows\System\UBbJVnc.exe

C:\Windows\System\UBbJVnc.exe

C:\Windows\System\KXSWsLw.exe

C:\Windows\System\KXSWsLw.exe

C:\Windows\System\fetghmm.exe

C:\Windows\System\fetghmm.exe

C:\Windows\System\hferyWz.exe

C:\Windows\System\hferyWz.exe

C:\Windows\System\VWsTIEJ.exe

C:\Windows\System\VWsTIEJ.exe

C:\Windows\System\gaFlNfa.exe

C:\Windows\System\gaFlNfa.exe

C:\Windows\System\ufkvDyP.exe

C:\Windows\System\ufkvDyP.exe

C:\Windows\System\GBuicFZ.exe

C:\Windows\System\GBuicFZ.exe

C:\Windows\System\EVgHdpn.exe

C:\Windows\System\EVgHdpn.exe

C:\Windows\System\nFZbfOM.exe

C:\Windows\System\nFZbfOM.exe

C:\Windows\System\lgGbnUf.exe

C:\Windows\System\lgGbnUf.exe

C:\Windows\System\DKsaqqO.exe

C:\Windows\System\DKsaqqO.exe

C:\Windows\System\eqewHTN.exe

C:\Windows\System\eqewHTN.exe

C:\Windows\System\YQZjKpv.exe

C:\Windows\System\YQZjKpv.exe

C:\Windows\System\KptuSFn.exe

C:\Windows\System\KptuSFn.exe

C:\Windows\System\oXbvOsu.exe

C:\Windows\System\oXbvOsu.exe

C:\Windows\System\vaHHCoy.exe

C:\Windows\System\vaHHCoy.exe

C:\Windows\System\GKWrVUy.exe

C:\Windows\System\GKWrVUy.exe

C:\Windows\System\AyJMcgJ.exe

C:\Windows\System\AyJMcgJ.exe

C:\Windows\System\ZUmgOzM.exe

C:\Windows\System\ZUmgOzM.exe

C:\Windows\System\wvCHcxy.exe

C:\Windows\System\wvCHcxy.exe

C:\Windows\System\NgUmaOI.exe

C:\Windows\System\NgUmaOI.exe

C:\Windows\System\aeSUuvv.exe

C:\Windows\System\aeSUuvv.exe

C:\Windows\System\JnsYbdY.exe

C:\Windows\System\JnsYbdY.exe

C:\Windows\System\dnqnBPM.exe

C:\Windows\System\dnqnBPM.exe

C:\Windows\System\IYozKGh.exe

C:\Windows\System\IYozKGh.exe

C:\Windows\System\sUcgRWa.exe

C:\Windows\System\sUcgRWa.exe

C:\Windows\System\eQTZsLS.exe

C:\Windows\System\eQTZsLS.exe

C:\Windows\System\GrOGKde.exe

C:\Windows\System\GrOGKde.exe

C:\Windows\System\rIMVYpP.exe

C:\Windows\System\rIMVYpP.exe

C:\Windows\System\wyLBYGx.exe

C:\Windows\System\wyLBYGx.exe

C:\Windows\System\mXfCDaq.exe

C:\Windows\System\mXfCDaq.exe

C:\Windows\System\IMVEVan.exe

C:\Windows\System\IMVEVan.exe

C:\Windows\System\lOcNkrQ.exe

C:\Windows\System\lOcNkrQ.exe

C:\Windows\System\PRWndQR.exe

C:\Windows\System\PRWndQR.exe

C:\Windows\System\SGHqpNT.exe

C:\Windows\System\SGHqpNT.exe

C:\Windows\System\TAHGeHp.exe

C:\Windows\System\TAHGeHp.exe

C:\Windows\System\ANqdSlt.exe

C:\Windows\System\ANqdSlt.exe

C:\Windows\System\SmRcCqk.exe

C:\Windows\System\SmRcCqk.exe

C:\Windows\System\sKEcmUP.exe

C:\Windows\System\sKEcmUP.exe

C:\Windows\System\RKXHZTR.exe

C:\Windows\System\RKXHZTR.exe

C:\Windows\System\LEgFhFi.exe

C:\Windows\System\LEgFhFi.exe

C:\Windows\System\HvDizPf.exe

C:\Windows\System\HvDizPf.exe

C:\Windows\System\HkBPxKO.exe

C:\Windows\System\HkBPxKO.exe

C:\Windows\System\eYhtIlG.exe

C:\Windows\System\eYhtIlG.exe

C:\Windows\System\vvDBoQi.exe

C:\Windows\System\vvDBoQi.exe

C:\Windows\System\NJQoKEU.exe

C:\Windows\System\NJQoKEU.exe

C:\Windows\System\zGKnvBK.exe

C:\Windows\System\zGKnvBK.exe

C:\Windows\System\ldBYMOK.exe

C:\Windows\System\ldBYMOK.exe

C:\Windows\System\DbeWXlG.exe

C:\Windows\System\DbeWXlG.exe

C:\Windows\System\ffxIraO.exe

C:\Windows\System\ffxIraO.exe

C:\Windows\System\McGjPzi.exe

C:\Windows\System\McGjPzi.exe

C:\Windows\System\YnvRkhC.exe

C:\Windows\System\YnvRkhC.exe

C:\Windows\System\DiUgdxE.exe

C:\Windows\System\DiUgdxE.exe

C:\Windows\System\hlSfhqW.exe

C:\Windows\System\hlSfhqW.exe

C:\Windows\System\IDEmQTq.exe

C:\Windows\System\IDEmQTq.exe

C:\Windows\System\lKWtYrS.exe

C:\Windows\System\lKWtYrS.exe

C:\Windows\System\TrozelH.exe

C:\Windows\System\TrozelH.exe

C:\Windows\System\hHOiQzE.exe

C:\Windows\System\hHOiQzE.exe

C:\Windows\System\UOAgtCw.exe

C:\Windows\System\UOAgtCw.exe

C:\Windows\System\IpuMhLq.exe

C:\Windows\System\IpuMhLq.exe

C:\Windows\System\OzbWafG.exe

C:\Windows\System\OzbWafG.exe

C:\Windows\System\WmJlKCm.exe

C:\Windows\System\WmJlKCm.exe

C:\Windows\System\xSwCrRL.exe

C:\Windows\System\xSwCrRL.exe

C:\Windows\System\HlOhkls.exe

C:\Windows\System\HlOhkls.exe

C:\Windows\System\tKPzRiC.exe

C:\Windows\System\tKPzRiC.exe

C:\Windows\System\OpfYbrK.exe

C:\Windows\System\OpfYbrK.exe

C:\Windows\System\fPuEPQG.exe

C:\Windows\System\fPuEPQG.exe

C:\Windows\System\kpVaPbU.exe

C:\Windows\System\kpVaPbU.exe

C:\Windows\System\dUDSkXp.exe

C:\Windows\System\dUDSkXp.exe

C:\Windows\System\qHyuHJp.exe

C:\Windows\System\qHyuHJp.exe

C:\Windows\System\AdjOXfX.exe

C:\Windows\System\AdjOXfX.exe

C:\Windows\System\AynpWnp.exe

C:\Windows\System\AynpWnp.exe

C:\Windows\System\KpQsVRO.exe

C:\Windows\System\KpQsVRO.exe

C:\Windows\System\ofzYusd.exe

C:\Windows\System\ofzYusd.exe

C:\Windows\System\RYwjLSc.exe

C:\Windows\System\RYwjLSc.exe

C:\Windows\System\BQdiOVo.exe

C:\Windows\System\BQdiOVo.exe

C:\Windows\System\rihCgth.exe

C:\Windows\System\rihCgth.exe

C:\Windows\System\PHVGItC.exe

C:\Windows\System\PHVGItC.exe

C:\Windows\System\UXhextm.exe

C:\Windows\System\UXhextm.exe

C:\Windows\System\TmvVnQv.exe

C:\Windows\System\TmvVnQv.exe

C:\Windows\System\LvYudDJ.exe

C:\Windows\System\LvYudDJ.exe

C:\Windows\System\ZGUTxgL.exe

C:\Windows\System\ZGUTxgL.exe

C:\Windows\System\BQDFSBp.exe

C:\Windows\System\BQDFSBp.exe

C:\Windows\System\hAVHBRj.exe

C:\Windows\System\hAVHBRj.exe

C:\Windows\System\HtehDon.exe

C:\Windows\System\HtehDon.exe

C:\Windows\System\ksIzwCf.exe

C:\Windows\System\ksIzwCf.exe

C:\Windows\System\vEqrErv.exe

C:\Windows\System\vEqrErv.exe

C:\Windows\System\RDheqHD.exe

C:\Windows\System\RDheqHD.exe

C:\Windows\System\mvIuXWN.exe

C:\Windows\System\mvIuXWN.exe

C:\Windows\System\OpYRXmr.exe

C:\Windows\System\OpYRXmr.exe

C:\Windows\System\qCYVHSR.exe

C:\Windows\System\qCYVHSR.exe

C:\Windows\System\KqBcLbp.exe

C:\Windows\System\KqBcLbp.exe

C:\Windows\System\gTonIUo.exe

C:\Windows\System\gTonIUo.exe

C:\Windows\System\svBPUYO.exe

C:\Windows\System\svBPUYO.exe

C:\Windows\System\KTcPKeO.exe

C:\Windows\System\KTcPKeO.exe

C:\Windows\System\TxfJiCr.exe

C:\Windows\System\TxfJiCr.exe

C:\Windows\System\ivlBlhI.exe

C:\Windows\System\ivlBlhI.exe

C:\Windows\System\VIQWbJA.exe

C:\Windows\System\VIQWbJA.exe

C:\Windows\System\PxMcNAl.exe

C:\Windows\System\PxMcNAl.exe

C:\Windows\System\EBtEPWN.exe

C:\Windows\System\EBtEPWN.exe

C:\Windows\System\WpbQyHE.exe

C:\Windows\System\WpbQyHE.exe

C:\Windows\System\DtDvJkw.exe

C:\Windows\System\DtDvJkw.exe

C:\Windows\System\hbMwrPQ.exe

C:\Windows\System\hbMwrPQ.exe

C:\Windows\System\EaQpNlr.exe

C:\Windows\System\EaQpNlr.exe

C:\Windows\System\ixxgnWj.exe

C:\Windows\System\ixxgnWj.exe

C:\Windows\System\zwnZLlF.exe

C:\Windows\System\zwnZLlF.exe

C:\Windows\System\uwgHoFE.exe

C:\Windows\System\uwgHoFE.exe

C:\Windows\System\NvrMspQ.exe

C:\Windows\System\NvrMspQ.exe

C:\Windows\System\JZbMdkn.exe

C:\Windows\System\JZbMdkn.exe

C:\Windows\System\ecaBgKW.exe

C:\Windows\System\ecaBgKW.exe

C:\Windows\System\RZYsktv.exe

C:\Windows\System\RZYsktv.exe

C:\Windows\System\SicDjQz.exe

C:\Windows\System\SicDjQz.exe

C:\Windows\System\KzUXugv.exe

C:\Windows\System\KzUXugv.exe

C:\Windows\System\vuRGwGT.exe

C:\Windows\System\vuRGwGT.exe

C:\Windows\System\HoFozhS.exe

C:\Windows\System\HoFozhS.exe

C:\Windows\System\jDWJPBo.exe

C:\Windows\System\jDWJPBo.exe

C:\Windows\System\aVplnGw.exe

C:\Windows\System\aVplnGw.exe

C:\Windows\System\RqxWTwH.exe

C:\Windows\System\RqxWTwH.exe

C:\Windows\System\CuYHiKX.exe

C:\Windows\System\CuYHiKX.exe

C:\Windows\System\kpyXRHv.exe

C:\Windows\System\kpyXRHv.exe

C:\Windows\System\dXXDUDT.exe

C:\Windows\System\dXXDUDT.exe

C:\Windows\System\oxxZYSF.exe

C:\Windows\System\oxxZYSF.exe

C:\Windows\System\EOfiyTP.exe

C:\Windows\System\EOfiyTP.exe

C:\Windows\System\AgXaWqN.exe

C:\Windows\System\AgXaWqN.exe

C:\Windows\System\GSxoLrN.exe

C:\Windows\System\GSxoLrN.exe

C:\Windows\System\RsVzfpi.exe

C:\Windows\System\RsVzfpi.exe

C:\Windows\System\PlOqcck.exe

C:\Windows\System\PlOqcck.exe

C:\Windows\System\PLTAjoM.exe

C:\Windows\System\PLTAjoM.exe

C:\Windows\System\ceAPFQu.exe

C:\Windows\System\ceAPFQu.exe

C:\Windows\System\qCyDJJO.exe

C:\Windows\System\qCyDJJO.exe

C:\Windows\System\KxsDvoW.exe

C:\Windows\System\KxsDvoW.exe

C:\Windows\System\HpjgPil.exe

C:\Windows\System\HpjgPil.exe

C:\Windows\System\gNGfWMY.exe

C:\Windows\System\gNGfWMY.exe

C:\Windows\System\hAwjxKq.exe

C:\Windows\System\hAwjxKq.exe

C:\Windows\System\BnhEJIn.exe

C:\Windows\System\BnhEJIn.exe

C:\Windows\System\RatHKeB.exe

C:\Windows\System\RatHKeB.exe

C:\Windows\System\oPrAgfu.exe

C:\Windows\System\oPrAgfu.exe

C:\Windows\System\sFaOwdr.exe

C:\Windows\System\sFaOwdr.exe

C:\Windows\System\FxydsXe.exe

C:\Windows\System\FxydsXe.exe

C:\Windows\System\gXlurCZ.exe

C:\Windows\System\gXlurCZ.exe

C:\Windows\System\EUKtBGt.exe

C:\Windows\System\EUKtBGt.exe

C:\Windows\System\fOJkrzA.exe

C:\Windows\System\fOJkrzA.exe

C:\Windows\System\zkQzplV.exe

C:\Windows\System\zkQzplV.exe

C:\Windows\System\FcVmkaY.exe

C:\Windows\System\FcVmkaY.exe

C:\Windows\System\ImXqXyY.exe

C:\Windows\System\ImXqXyY.exe

C:\Windows\System\AECaSle.exe

C:\Windows\System\AECaSle.exe

C:\Windows\System\mELatXM.exe

C:\Windows\System\mELatXM.exe

C:\Windows\System\FbISzYe.exe

C:\Windows\System\FbISzYe.exe

C:\Windows\System\zOqRjYP.exe

C:\Windows\System\zOqRjYP.exe

C:\Windows\System\xUwdFMa.exe

C:\Windows\System\xUwdFMa.exe

C:\Windows\System\BzNhrjI.exe

C:\Windows\System\BzNhrjI.exe

C:\Windows\System\WtPBrcz.exe

C:\Windows\System\WtPBrcz.exe

C:\Windows\System\zchnaGk.exe

C:\Windows\System\zchnaGk.exe

C:\Windows\System\CgqeWUw.exe

C:\Windows\System\CgqeWUw.exe

C:\Windows\System\TcrYmGJ.exe

C:\Windows\System\TcrYmGJ.exe

C:\Windows\System\eTREFoD.exe

C:\Windows\System\eTREFoD.exe

C:\Windows\System\sWoVpRC.exe

C:\Windows\System\sWoVpRC.exe

C:\Windows\System\TRULrUK.exe

C:\Windows\System\TRULrUK.exe

C:\Windows\System\yZajacl.exe

C:\Windows\System\yZajacl.exe

C:\Windows\System\AWYvPAs.exe

C:\Windows\System\AWYvPAs.exe

C:\Windows\System\HaPYXPm.exe

C:\Windows\System\HaPYXPm.exe

C:\Windows\System\gJRuZra.exe

C:\Windows\System\gJRuZra.exe

C:\Windows\System\hTnOZEr.exe

C:\Windows\System\hTnOZEr.exe

C:\Windows\System\MYfhqQY.exe

C:\Windows\System\MYfhqQY.exe

C:\Windows\System\KjGcrbH.exe

C:\Windows\System\KjGcrbH.exe

C:\Windows\System\cENbmhy.exe

C:\Windows\System\cENbmhy.exe

C:\Windows\System\uhsnFpQ.exe

C:\Windows\System\uhsnFpQ.exe

C:\Windows\System\kRXTtFQ.exe

C:\Windows\System\kRXTtFQ.exe

C:\Windows\System\ALKwkZL.exe

C:\Windows\System\ALKwkZL.exe

C:\Windows\System\ATWtDVP.exe

C:\Windows\System\ATWtDVP.exe

C:\Windows\System\OzarDhr.exe

C:\Windows\System\OzarDhr.exe

C:\Windows\System\ompFVkE.exe

C:\Windows\System\ompFVkE.exe

C:\Windows\System\NCiAeuE.exe

C:\Windows\System\NCiAeuE.exe

C:\Windows\System\SvJwQOn.exe

C:\Windows\System\SvJwQOn.exe

C:\Windows\System\PhXATcP.exe

C:\Windows\System\PhXATcP.exe

C:\Windows\System\JKhXqAi.exe

C:\Windows\System\JKhXqAi.exe

C:\Windows\System\kwgaTSb.exe

C:\Windows\System\kwgaTSb.exe

C:\Windows\System\lQwZVwY.exe

C:\Windows\System\lQwZVwY.exe

C:\Windows\System\LfGZmAW.exe

C:\Windows\System\LfGZmAW.exe

C:\Windows\System\pMSCtMc.exe

C:\Windows\System\pMSCtMc.exe

C:\Windows\System\LXlPtQU.exe

C:\Windows\System\LXlPtQU.exe

C:\Windows\System\oQgKSmb.exe

C:\Windows\System\oQgKSmb.exe

C:\Windows\System\sdIxFAM.exe

C:\Windows\System\sdIxFAM.exe

C:\Windows\System\kPZqGMx.exe

C:\Windows\System\kPZqGMx.exe

C:\Windows\System\uILFgEF.exe

C:\Windows\System\uILFgEF.exe

C:\Windows\System\pKiJYqb.exe

C:\Windows\System\pKiJYqb.exe

C:\Windows\System\SkRIftX.exe

C:\Windows\System\SkRIftX.exe

C:\Windows\System\oeejlRq.exe

C:\Windows\System\oeejlRq.exe

C:\Windows\System\xbOWqfl.exe

C:\Windows\System\xbOWqfl.exe

C:\Windows\System\oXOYarG.exe

C:\Windows\System\oXOYarG.exe

C:\Windows\System\IlklcOM.exe

C:\Windows\System\IlklcOM.exe

C:\Windows\System\hVrAdUR.exe

C:\Windows\System\hVrAdUR.exe

C:\Windows\System\XUaByFK.exe

C:\Windows\System\XUaByFK.exe

C:\Windows\System\grtLrMo.exe

C:\Windows\System\grtLrMo.exe

C:\Windows\System\HDRJnMb.exe

C:\Windows\System\HDRJnMb.exe

C:\Windows\System\hihIJEZ.exe

C:\Windows\System\hihIJEZ.exe

C:\Windows\System\oFRVcnX.exe

C:\Windows\System\oFRVcnX.exe

C:\Windows\System\oOaCNLC.exe

C:\Windows\System\oOaCNLC.exe

C:\Windows\System\pJcXrEu.exe

C:\Windows\System\pJcXrEu.exe

C:\Windows\System\EldVSLp.exe

C:\Windows\System\EldVSLp.exe

C:\Windows\System\exaapUh.exe

C:\Windows\System\exaapUh.exe

C:\Windows\System\qmAzacO.exe

C:\Windows\System\qmAzacO.exe

C:\Windows\System\KGzXlOZ.exe

C:\Windows\System\KGzXlOZ.exe

C:\Windows\System\egpZpPJ.exe

C:\Windows\System\egpZpPJ.exe

C:\Windows\System\zQjoawZ.exe

C:\Windows\System\zQjoawZ.exe

C:\Windows\System\niiRbdE.exe

C:\Windows\System\niiRbdE.exe

C:\Windows\System\LHTCHIC.exe

C:\Windows\System\LHTCHIC.exe

C:\Windows\System\guRYkwz.exe

C:\Windows\System\guRYkwz.exe

C:\Windows\System\MFqYrUV.exe

C:\Windows\System\MFqYrUV.exe

C:\Windows\System\hmSVDHZ.exe

C:\Windows\System\hmSVDHZ.exe

C:\Windows\System\CLlzQnu.exe

C:\Windows\System\CLlzQnu.exe

C:\Windows\System\hqQCwbT.exe

C:\Windows\System\hqQCwbT.exe

C:\Windows\System\tWNYvcw.exe

C:\Windows\System\tWNYvcw.exe

C:\Windows\System\qMDhbCT.exe

C:\Windows\System\qMDhbCT.exe

C:\Windows\System\iPQcLTH.exe

C:\Windows\System\iPQcLTH.exe

C:\Windows\System\mHrwQBj.exe

C:\Windows\System\mHrwQBj.exe

C:\Windows\System\QNnKmVG.exe

C:\Windows\System\QNnKmVG.exe

C:\Windows\System\IveYbOK.exe

C:\Windows\System\IveYbOK.exe

C:\Windows\System\BkoEVil.exe

C:\Windows\System\BkoEVil.exe

C:\Windows\System\xhdCxBQ.exe

C:\Windows\System\xhdCxBQ.exe

C:\Windows\System\BfugsOg.exe

C:\Windows\System\BfugsOg.exe

C:\Windows\System\NRDsDgV.exe

C:\Windows\System\NRDsDgV.exe

C:\Windows\System\xgoMZaG.exe

C:\Windows\System\xgoMZaG.exe

C:\Windows\System\vpnEbLV.exe

C:\Windows\System\vpnEbLV.exe

C:\Windows\System\LWSlvLO.exe

C:\Windows\System\LWSlvLO.exe

C:\Windows\System\JqJuvyO.exe

C:\Windows\System\JqJuvyO.exe

C:\Windows\System\dZtINpW.exe

C:\Windows\System\dZtINpW.exe

C:\Windows\System\InyAfFV.exe

C:\Windows\System\InyAfFV.exe

C:\Windows\System\iNjXOQr.exe

C:\Windows\System\iNjXOQr.exe

C:\Windows\System\ddQphNu.exe

C:\Windows\System\ddQphNu.exe

C:\Windows\System\LQeMRPS.exe

C:\Windows\System\LQeMRPS.exe

C:\Windows\System\ZohJkCH.exe

C:\Windows\System\ZohJkCH.exe

C:\Windows\System\yNcrSUl.exe

C:\Windows\System\yNcrSUl.exe

C:\Windows\System\XWYEfGK.exe

C:\Windows\System\XWYEfGK.exe

C:\Windows\System\dhOTNWW.exe

C:\Windows\System\dhOTNWW.exe

C:\Windows\System\ebPtsSg.exe

C:\Windows\System\ebPtsSg.exe

C:\Windows\System\CyozXtS.exe

C:\Windows\System\CyozXtS.exe

C:\Windows\System\BwgSZxy.exe

C:\Windows\System\BwgSZxy.exe

C:\Windows\System\EuXCEre.exe

C:\Windows\System\EuXCEre.exe

C:\Windows\System\VVpegRI.exe

C:\Windows\System\VVpegRI.exe

C:\Windows\System\CKPDxMt.exe

C:\Windows\System\CKPDxMt.exe

C:\Windows\System\UCaspaR.exe

C:\Windows\System\UCaspaR.exe

C:\Windows\System\ZKmjklU.exe

C:\Windows\System\ZKmjklU.exe

C:\Windows\System\jlOKwWv.exe

C:\Windows\System\jlOKwWv.exe

C:\Windows\System\ZtntXAR.exe

C:\Windows\System\ZtntXAR.exe

C:\Windows\System\PbZtfTJ.exe

C:\Windows\System\PbZtfTJ.exe

C:\Windows\System\dNeVaVr.exe

C:\Windows\System\dNeVaVr.exe

C:\Windows\System\uRDJeHw.exe

C:\Windows\System\uRDJeHw.exe

C:\Windows\System\yubOpFK.exe

C:\Windows\System\yubOpFK.exe

C:\Windows\System\TfysLvl.exe

C:\Windows\System\TfysLvl.exe

C:\Windows\System\RuKKsBv.exe

C:\Windows\System\RuKKsBv.exe

C:\Windows\System\XwwOdTi.exe

C:\Windows\System\XwwOdTi.exe

C:\Windows\System\cddxyxx.exe

C:\Windows\System\cddxyxx.exe

C:\Windows\System\jvvLrYM.exe

C:\Windows\System\jvvLrYM.exe

C:\Windows\System\terVBoT.exe

C:\Windows\System\terVBoT.exe

C:\Windows\System\wuJsvhf.exe

C:\Windows\System\wuJsvhf.exe

C:\Windows\System\tKxdtpQ.exe

C:\Windows\System\tKxdtpQ.exe

C:\Windows\System\coqPQrF.exe

C:\Windows\System\coqPQrF.exe

C:\Windows\System\BoAnzmI.exe

C:\Windows\System\BoAnzmI.exe

C:\Windows\System\jgIyANk.exe

C:\Windows\System\jgIyANk.exe

C:\Windows\System\acajWqL.exe

C:\Windows\System\acajWqL.exe

C:\Windows\System\vRWwaTg.exe

C:\Windows\System\vRWwaTg.exe

C:\Windows\System\qhERsXU.exe

C:\Windows\System\qhERsXU.exe

C:\Windows\System\sDRbRIm.exe

C:\Windows\System\sDRbRIm.exe

C:\Windows\System\oAqiMsn.exe

C:\Windows\System\oAqiMsn.exe

C:\Windows\System\WahIPXl.exe

C:\Windows\System\WahIPXl.exe

C:\Windows\System\NWbdVZR.exe

C:\Windows\System\NWbdVZR.exe

C:\Windows\System\khCRdig.exe

C:\Windows\System\khCRdig.exe

C:\Windows\System\fMCcKDp.exe

C:\Windows\System\fMCcKDp.exe

C:\Windows\System\CMUbdGC.exe

C:\Windows\System\CMUbdGC.exe

C:\Windows\System\SyPjGGP.exe

C:\Windows\System\SyPjGGP.exe

C:\Windows\System\VPcWEIy.exe

C:\Windows\System\VPcWEIy.exe

C:\Windows\System\QqeYcZU.exe

C:\Windows\System\QqeYcZU.exe

C:\Windows\System\DjMsPmZ.exe

C:\Windows\System\DjMsPmZ.exe

C:\Windows\System\KgysfUS.exe

C:\Windows\System\KgysfUS.exe

C:\Windows\System\hGIpqho.exe

C:\Windows\System\hGIpqho.exe

C:\Windows\System\QtXImCh.exe

C:\Windows\System\QtXImCh.exe

C:\Windows\System\rqIvSnD.exe

C:\Windows\System\rqIvSnD.exe

C:\Windows\System\sYniJKJ.exe

C:\Windows\System\sYniJKJ.exe

C:\Windows\System\CcCXUMY.exe

C:\Windows\System\CcCXUMY.exe

C:\Windows\System\NspEFTW.exe

C:\Windows\System\NspEFTW.exe

C:\Windows\System\bBGZJmB.exe

C:\Windows\System\bBGZJmB.exe

C:\Windows\System\yrUcbMa.exe

C:\Windows\System\yrUcbMa.exe

C:\Windows\System\gnPSiwX.exe

C:\Windows\System\gnPSiwX.exe

C:\Windows\System\jsDiDNe.exe

C:\Windows\System\jsDiDNe.exe

C:\Windows\System\gNvAErq.exe

C:\Windows\System\gNvAErq.exe

C:\Windows\System\kwfYIPO.exe

C:\Windows\System\kwfYIPO.exe

C:\Windows\System\UQhyLOT.exe

C:\Windows\System\UQhyLOT.exe

C:\Windows\System\nLdgEby.exe

C:\Windows\System\nLdgEby.exe

C:\Windows\System\kxUPYfq.exe

C:\Windows\System\kxUPYfq.exe

C:\Windows\System\GayGxbm.exe

C:\Windows\System\GayGxbm.exe

C:\Windows\System\kMZBRml.exe

C:\Windows\System\kMZBRml.exe

C:\Windows\System\FmcjmmY.exe

C:\Windows\System\FmcjmmY.exe

C:\Windows\System\WvcWJJu.exe

C:\Windows\System\WvcWJJu.exe

C:\Windows\System\nYPjyDz.exe

C:\Windows\System\nYPjyDz.exe

C:\Windows\System\NhlDvUi.exe

C:\Windows\System\NhlDvUi.exe

C:\Windows\System\gJCYBCq.exe

C:\Windows\System\gJCYBCq.exe

C:\Windows\System\QwwDyca.exe

C:\Windows\System\QwwDyca.exe

C:\Windows\System\kflLgEy.exe

C:\Windows\System\kflLgEy.exe

C:\Windows\System\wxXyFLe.exe

C:\Windows\System\wxXyFLe.exe

C:\Windows\System\hGMCDlR.exe

C:\Windows\System\hGMCDlR.exe

C:\Windows\System\FagJEsY.exe

C:\Windows\System\FagJEsY.exe

C:\Windows\System\FULSOpw.exe

C:\Windows\System\FULSOpw.exe

C:\Windows\System\GHPaeLw.exe

C:\Windows\System\GHPaeLw.exe

C:\Windows\System\YKQLNMi.exe

C:\Windows\System\YKQLNMi.exe

C:\Windows\System\pmOYBuz.exe

C:\Windows\System\pmOYBuz.exe

C:\Windows\System\dvAwTeR.exe

C:\Windows\System\dvAwTeR.exe

C:\Windows\System\kcmXxfB.exe

C:\Windows\System\kcmXxfB.exe

C:\Windows\System\phUipsf.exe

C:\Windows\System\phUipsf.exe

C:\Windows\System\ZEZGFru.exe

C:\Windows\System\ZEZGFru.exe

C:\Windows\System\KnAgNpc.exe

C:\Windows\System\KnAgNpc.exe

C:\Windows\System\OFjIyev.exe

C:\Windows\System\OFjIyev.exe

C:\Windows\System\bGLoUFK.exe

C:\Windows\System\bGLoUFK.exe

C:\Windows\System\jKZXXlw.exe

C:\Windows\System\jKZXXlw.exe

C:\Windows\System\WPWAkFU.exe

C:\Windows\System\WPWAkFU.exe

C:\Windows\System\NbUDfkh.exe

C:\Windows\System\NbUDfkh.exe

C:\Windows\System\ilDzlRa.exe

C:\Windows\System\ilDzlRa.exe

C:\Windows\System\pYlcqoE.exe

C:\Windows\System\pYlcqoE.exe

C:\Windows\System\msasPAU.exe

C:\Windows\System\msasPAU.exe

C:\Windows\System\tqbMlje.exe

C:\Windows\System\tqbMlje.exe

C:\Windows\System\qKFXNJc.exe

C:\Windows\System\qKFXNJc.exe

C:\Windows\System\RvKIlNY.exe

C:\Windows\System\RvKIlNY.exe

C:\Windows\System\WguJaRK.exe

C:\Windows\System\WguJaRK.exe

C:\Windows\System\YDsSFpF.exe

C:\Windows\System\YDsSFpF.exe

C:\Windows\System\dGlQfTg.exe

C:\Windows\System\dGlQfTg.exe

C:\Windows\System\eCeHJuV.exe

C:\Windows\System\eCeHJuV.exe

C:\Windows\System\SKsmCZE.exe

C:\Windows\System\SKsmCZE.exe

C:\Windows\System\WEydcDP.exe

C:\Windows\System\WEydcDP.exe

C:\Windows\System\BVTsNsb.exe

C:\Windows\System\BVTsNsb.exe

C:\Windows\System\EiUqonu.exe

C:\Windows\System\EiUqonu.exe

C:\Windows\System\qEFXpKB.exe

C:\Windows\System\qEFXpKB.exe

C:\Windows\System\OwsQLtJ.exe

C:\Windows\System\OwsQLtJ.exe

C:\Windows\System\RrDvGwS.exe

C:\Windows\System\RrDvGwS.exe

C:\Windows\System\huywpyw.exe

C:\Windows\System\huywpyw.exe

C:\Windows\System\UfPWMXp.exe

C:\Windows\System\UfPWMXp.exe

C:\Windows\System\wuSQYQp.exe

C:\Windows\System\wuSQYQp.exe

C:\Windows\System\fIzbrNH.exe

C:\Windows\System\fIzbrNH.exe

C:\Windows\System\fjqDLSh.exe

C:\Windows\System\fjqDLSh.exe

C:\Windows\System\ZpmWRui.exe

C:\Windows\System\ZpmWRui.exe

C:\Windows\System\IkBlJiu.exe

C:\Windows\System\IkBlJiu.exe

C:\Windows\System\JnHoatL.exe

C:\Windows\System\JnHoatL.exe

C:\Windows\System\bxxzQaR.exe

C:\Windows\System\bxxzQaR.exe

C:\Windows\System\EGndBPu.exe

C:\Windows\System\EGndBPu.exe

C:\Windows\System\BkneEUZ.exe

C:\Windows\System\BkneEUZ.exe

C:\Windows\System\FgErIFd.exe

C:\Windows\System\FgErIFd.exe

C:\Windows\System\kWUjRGQ.exe

C:\Windows\System\kWUjRGQ.exe

C:\Windows\System\gGzZdDn.exe

C:\Windows\System\gGzZdDn.exe

C:\Windows\System\ffgAdDt.exe

C:\Windows\System\ffgAdDt.exe

C:\Windows\System\ArCQupW.exe

C:\Windows\System\ArCQupW.exe

C:\Windows\System\urbavAy.exe

C:\Windows\System\urbavAy.exe

C:\Windows\System\HBzBCvI.exe

C:\Windows\System\HBzBCvI.exe

C:\Windows\System\BNywavW.exe

C:\Windows\System\BNywavW.exe

C:\Windows\System\eWpJwig.exe

C:\Windows\System\eWpJwig.exe

C:\Windows\System\UgJnYQL.exe

C:\Windows\System\UgJnYQL.exe

C:\Windows\System\JFtVATy.exe

C:\Windows\System\JFtVATy.exe

C:\Windows\System\TmtwNKP.exe

C:\Windows\System\TmtwNKP.exe

C:\Windows\System\xGSrBxN.exe

C:\Windows\System\xGSrBxN.exe

C:\Windows\System\mCIcaPk.exe

C:\Windows\System\mCIcaPk.exe

C:\Windows\System\qZSEhfr.exe

C:\Windows\System\qZSEhfr.exe

C:\Windows\System\lCMJqcp.exe

C:\Windows\System\lCMJqcp.exe

C:\Windows\System\xDZPOju.exe

C:\Windows\System\xDZPOju.exe

C:\Windows\System\ipmfxjf.exe

C:\Windows\System\ipmfxjf.exe

C:\Windows\System\avyrNQL.exe

C:\Windows\System\avyrNQL.exe

C:\Windows\System\tVvinou.exe

C:\Windows\System\tVvinou.exe

C:\Windows\System\msrezWZ.exe

C:\Windows\System\msrezWZ.exe

C:\Windows\System\jBJvJZl.exe

C:\Windows\System\jBJvJZl.exe

C:\Windows\System\VDgVGVc.exe

C:\Windows\System\VDgVGVc.exe

C:\Windows\System\KRNuPab.exe

C:\Windows\System\KRNuPab.exe

C:\Windows\System\COZxPke.exe

C:\Windows\System\COZxPke.exe

C:\Windows\System\IiBjgHm.exe

C:\Windows\System\IiBjgHm.exe

C:\Windows\System\WIBuVlo.exe

C:\Windows\System\WIBuVlo.exe

C:\Windows\System\hsfHDgR.exe

C:\Windows\System\hsfHDgR.exe

C:\Windows\System\bVIEaBh.exe

C:\Windows\System\bVIEaBh.exe

C:\Windows\System\bJXhlvG.exe

C:\Windows\System\bJXhlvG.exe

C:\Windows\System\HhqVBlw.exe

C:\Windows\System\HhqVBlw.exe

Network

N/A

Files

memory/1704-0-0x000000013F9C0000-0x000000013FD14000-memory.dmp

C:\Windows\system\tPndvGN.exe

MD5	8a37189e5253a3de905d95ba147d3e69
SHA1	09906dfd74465ac9e5fbe0508b6437d62f8f786e
SHA256	f951b4c4aaddb42412fd2f0a82bc5e64ec279867910af8597afab2cefda7d4c4
SHA512	4961e510c61419de6b07a996c86c51800f50edf723e61188cbe1baed43f3a2a5d2b419e9ac73c0454fa6849e2339c1f60f377809e03d046fb52db23ab16b00d4

C:\Windows\system\eBYtkXF.exe

MD5	d21befa6161a3c6bb45c22ad57976ffe
SHA1	40bfb177c2ab2e3d9d10b15c5f71d5d45922a8da
SHA256	201159a15fb734b2f76520dc4829129933ac5ae32a2fa4f8e77000d677a55b37
SHA512	ccb388f7574f74a577effff62badaeeb22d75f8f34b01f29cd79c6305b04b21763466c7d09d948bc4ecf29e9acbff155f6ccecd472a6d97c9c1d3c6a649ccf87

memory/1704-12-0x000000013F240000-0x000000013F594000-memory.dmp

C:\Windows\system\kkmdsUF.exe

MD5	636447c6f136458f3f9bf125cd7df8ad
SHA1	5eedc820e132bd98ff75ed3f2bd374700a3bb715
SHA256	8a02329994b75f68a4bde43424cc2b25bf19a2ebcff49851888c5e85fc0ce861
SHA512	62222b9ceebd1867836f3da290c4e2f13cbb4d712ed334b1621746d1cdaa6170096560d754c00b946b61c90d2dd3e448c3197798e825fa406ca9603d256aa1b1

\Windows\system\FrSqlaB.exe

MD5	d9f70b6a8ce00bcba2c37983b410307a
SHA1	c4285996d4d38778b7dedbfa3dd29ff54b87e781
SHA256	57768b86cad2b7873b1827f23297ff59f7715f3cebdacac64c25e704ad8c3887
SHA512	1dae329ccb3dca2c92e382c0cce648911551a8af1bb5ccf6b348650635cc3aa60eb627c3778abb0dfda6beeb86a5d9ea89bcd2e0a1ed9d9b570b39ecfb65a5d0

memory/1188-17-0x000000013F240000-0x000000013F594000-memory.dmp

memory/1704-29-0x000000013F170000-0x000000013F4C4000-memory.dmp

memory/1704-28-0x000000013F270000-0x000000013F5C4000-memory.dmp

C:\Windows\system\VsjjQEu.exe

MD5	574b3f790e1f7917dffcdc71ac356db8
SHA1	483b982304db2df07806386cd8c2e71ac01effe7
SHA256	a91b4b8080ee02f2d2b178453953953124d5f2139fb4149f6f254208bbfacf9f
SHA512	72ebe67360a388266295dce0d079c884a61a6ee4427d6d6213792fc7d5ba9a18b28f4e7b241ba09d63bd14e442073467de06e820bc2c6ae76e1f6be9da1eea3b

C:\Windows\system\bdSPuXH.exe

MD5	803acd7b07855b4a8f713c2d2cc4333f
SHA1	28cc3f036e9e726988c7b5c9e839af5f739f9994
SHA256	8a162405a401e9c95d1ded34504d5fc526bd1205bf4f59abc20eec11cabbb3d0
SHA512	f32faa273d11ba9d1daebd784f20ccdbfe509ee08561a558d5d9d9290eb81fee5109f876422df5a2eb1a3a3a9c2f7444d8b6618d4915a568e1e2fe1da5d04bb6

C:\Windows\system\yxfpFEd.exe

MD5	bdd43139a02853cce29d371639944767
SHA1	374d1c61cb413f7e89188793c808e3597a7e3e3b
SHA256	f5c90f9eee4921c0b8fbad19b0930066774102ccb069999c0bbf1f3e144f9a10
SHA512	dcdeac58488a17a85308adfc83490d00ded9362ceef80de9c7868f8323ab56ac45e7d24171c47655ea2a183d67369d92398a35571516c359f3fd02ef7d00decf

\Windows\system\cLYrbAf.exe

MD5	ac2160213ff8ecb56253dc63645c1836
SHA1	74e33e98b7d917433a4d00ecf4e2e0b9629cb0e4
SHA256	82b9a5c94d3558ca367b740a279aba7157d8bb2bdd5d07d43b02f4f3aa57cd58
SHA512	93e247ce6f10a3d55a1ebbf72c864f68c6db98c2b25b848c69155a4040c406fcb6b07032e339df97e4132d97fc3d300a22bdd657f9be278dbeeda6c279b591c3

C:\Windows\system\LjIfHJL.exe

MD5	475fd16b8afa9b5ff143cc0fbacc3ba7
SHA1	87eb5e88d3938955e29b096a856010e431cec5bc
SHA256	7d25e42d8913f16b69a53f9b2defcef38aeba6a8d07e14804c30bc598c63100e
SHA512	5e18b7ff19fac675072d4fce4920f2cdc69b556e0ea9d47179b3e56b1a60e265e84107e1c3e89995213f8eefdbc13488b14e9de07c5c5a21f3ff162b6e07cc1f

memory/2448-691-0x000000013F730000-0x000000013FA84000-memory.dmp

memory/1704-1250-0x0000000001F60000-0x00000000022B4000-memory.dmp

memory/1704-1997-0x0000000001F60000-0x00000000022B4000-memory.dmp

\Windows\system\mUlnvyF.exe

MD5	814b0cdf555bde8e878f674cc2eb9ffb
SHA1	0da13f48d8083fac629e025c945e6246eaa848ad
SHA256	33fae97816495608682a9210c29a94fc0ac5b7c6f76a60ebc8f316b0c6a47b28
SHA512	af44ed02ff0b3a783258dd0ec84afc194baab9462cf521e7901f0ecd40ab98510e2d954bc85be07a456a94a7323b1e6ac3c390143546d6fc72667a6d801636a3

\Windows\system\stitDXp.exe

MD5	fe8f9a1207f683ad3936a0ac5652ccb8
SHA1	17ac89359fbdb817c668cb502356c7bab86a23fa
SHA256	5a3bebdd20d44b4a49049d7fcfa862bdc209b894487f26b5ffac948f0375bd21
SHA512	4794a0692ec97906d24f863cc3dabaed9f3f3870809503ceb78f3a78dae2ff50fdc1f7eca556195995d0e6cb4f0e13108867954c129637074a21088ab8b08616

\Windows\system\ooikGph.exe

MD5	2383b7fcd57cda141b76f7bb02828c57
SHA1	f905951e522d5abc80a4d78fd887915afc6cb66c
SHA256	ccc840a37589ba8754ba2fb540eb20c7175066b0e990e66213698417541c7aca
SHA512	0d8360552e8152cf8e08a44cc6640242a8e0d1523319af458d4b2c799eb6a52eada211dc9b0b89ade752316a863da6493c8495ff2a1841553be284cefcb43c5c

C:\Windows\system\SYlhXqa.exe

MD5	b171bc14ab65ea098b98dd0a639310bc
SHA1	57dfc87e0b044825366af89892fba18151aff3c9
SHA256	4a83e1ccc0027cc7801e3feaa5fb16e2d7c14f0eaad4c30e156a96540fc12ff3
SHA512	f0a0fc0ba87be3fdb7d7ba4ac873098d59fbf6df6718a6c84cf9800ebc001a08c1f45e269551337c59ca88e93d2c67effe739a5a37148c728fdcabe575de87e7

C:\Windows\system\xtNZSjK.exe

MD5	aa7a62b4a21e0c87b4ab1129bf92a1f4
SHA1	09b846ed0df747c067680760a40895d4a46b6a89
SHA256	7aee49634473ca1e01aed9e19b06cccc4a46d3ac761978be6fc2227474996d28
SHA512	c6d289041ea3a6f077df46b9eea19b91470ae6b554da52a75d2977db197c46891c1d4c16f40a6baab5cda999f3a96b85ec7303d251f0d2884aa07f183234727a

C:\Windows\system\aTJseQO.exe

MD5	8637ceaedb3b176912e5250624910abb
SHA1	a686ea47fb654b1410e77e570bbdf5e7a1e9dfa2
SHA256	e8ed4c824655b860c6b928cea5648314f4ea75c6da67397887a9ad3802a36fa0
SHA512	34b6f8e9a38bb99f3687d0feb2e092d443ef156c960c52b0989461a379f747d75785b7c81c5d46fe6a5a02c0cb773755827d505abff0cccbc193fb0ee10cc56c

C:\Windows\system\WTWwdXh.exe

MD5	2a8fa046e5f37156b2d5a1dbc695222a
SHA1	ab3d253621edd9ab157b2cf6915748fc1c824181
SHA256	04cde9d1512d3013534e1acced8b3f0ffc9ed012bdd09e5a7ec3a2f57b12f18f
SHA512	6d25f5ab6cb8f5a149bda03e3ada6db5dfb0055a7233d36b7da21b207e7e75d946cf691e59c661e4bb4ac596fab7fd7ade0da355aab1dc5bc7cec65b82c5a804

C:\Windows\system\PMzsiYH.exe

MD5	48433d62594b45d49554bd02f6d926e6
SHA1	ea7ed2d26ee3d607a1161221aab58335940dbef7
SHA256	eb45413853bb8b8c75af8ea735e70f2450cf7155953cd892347fbde4e804b022
SHA512	ff9b3f748c8149726b0da9f597be4bb1b9822148a7c55fabc1bf4fd66db6fa486795b5a4a155818ff32a5659fd916c615923891c7ed6f4f4e637090f74e911ff

\Windows\system\AAxaHRY.exe

MD5	d79efb33d731d658b18e9cc1193baf1c
SHA1	cf68260f860749d58498364be1f1b27bae9f6373
SHA256	bdf67546dc8dc1cee76d651e9b387abf15f7bc39fb8b91c40a38a47f52974fdb
SHA512	625f50d13feb71d408993684483f2d59005d6f89673ce995d745ba3f68529a277ac1f6bcc72ccda90438adeb02dc09330ad3a3162fae9c730f59fcf215631daf

C:\Windows\system\vBkRxGG.exe

MD5	18d92ce25124b6bb7a5ac11598a593fa
SHA1	5167b0f63894f13145668b05dfc3b31937158560
SHA256	738dbcc03226fc51f26bcf366b231cf311657df28c4f821793f60d26f8b76443
SHA512	6aa4673b3cc81e196c7bc0db8b26b846b14aa07ea6957dfd16d762af5699362588a9c05328ec5de19e4e778df6fbe8c0eb5c2a845d4aa9d12e21207dfe485539

memory/1704-102-0x000000013F9C0000-0x000000013FD14000-memory.dmp

C:\Windows\system\OPftCNK.exe

MD5	f1e7bb38bbf56f82786303e790f8ba44
SHA1	c456fa166be54328814804fec400a597ba646039
SHA256	35913ec6849c9b2e7ec327b8a092274ecd5915d22b0284dcc22edb24273a5c5c
SHA512	6fa336f4750a7f4e9073beb7729682adc6af16b5950207f64c4ec960e539c5c5aa30472b1a6746bca4bb0661036d4f1d82d0573e10b3a14c93f30e4a6ac10e93

memory/1948-93-0x000000013F5F0000-0x000000013F944000-memory.dmp

memory/2432-92-0x000000013FFC0000-0x0000000140314000-memory.dmp

memory/2460-91-0x000000013F4D0000-0x000000013F824000-memory.dmp

C:\Windows\system\LlnknQt.exe

MD5	9383e868e95b9b8a84d07fc973a7c9d2
SHA1	b6687ce7eebccd1dcc2378bbfc436a4378414667
SHA256	fcf0d814cfbcc86a205d8ac4e958031d577c891a8bd7f6251e3aacdbdbdc0dfd
SHA512	4369c054f64881cf71e3f056321f9433c09ee9dd3ca83962555ffdfe62988aeb993ac6f1cb1478f63ab61c8b55e06432054e4e28a75a3d4d4f2ccb432ff0493d

C:\Windows\system\KbyqSMs.exe

MD5	abfbb09e28a2ce030b09a460718469ec
SHA1	a475d5ab40dd8d9babf1eedae906aa051965a550
SHA256	820945f80024101b8b3d65137bbec390b56ce94f05684f63f31ccd640d7dd77a
SHA512	4177e364dba861afefb773231a72a822df6f1e500ebfb5f6432e95c730f357bed8b72741e3178d17b6a5d8c3f69896b4cf359f02f2aef2c6f5f89f8b401f542e

C:\Windows\system\wfSsWHn.exe

MD5	0f50fc38fcc26a6250c7699eb31831bd
SHA1	4e9dc4c327d66b72b839ecaa83cb89990d3df870
SHA256	506dbd7390af09f390d6664588aaaec997ff77d2f7e16b9fb2ffa12ea5a20369
SHA512	647ccdab12d779f72264b424a3bf482985afc7625840200d5bb0219aaf942f8bf2d0c8ab42d87d81192537cd3d4479db04c8e3bf746f75ed5ef19c7f05ad7921

C:\Windows\system\wbJcfNr.exe

MD5	61b51da04adabc0c2f2581dce8063f36
SHA1	4266eb331c80349b42668d44e4d680d1ed145a16
SHA256	23c37123a3f01195286036e50735753844f5cc75ceb13f2422289c6c65b38c49
SHA512	6b1d0e4082c88c79e5883f34a6643846e7fb080daaeb8588ef614874c86913947a79b109f432d5caf9eefb74952c21b5577f5cab60a247f1748299dd4cfda470

memory/1704-73-0x000000013F2C0000-0x000000013F614000-memory.dmp

memory/1704-72-0x000000013FFC0000-0x0000000140314000-memory.dmp

\Windows\system\fZJHzfe.exe

MD5	9f00a8cffaf5119ace720f0873b61ff6
SHA1	36fa116782a67271d3a7ae64ae8fba89eaa9e6ac
SHA256	1f10552b5121d8b1fd47c777b35023e1485f5eb498a29e03739c58ce2ff1d92f
SHA512	ce3a15d4439eb867a2b6ef9da4e2e68c97e4e2ac915180cd006d9f9d90cc5e026be406f18af50d18d5054e27943b715ba9aa0692f380df703cd16d25d48f2cbb

memory/1704-58-0x000000013F4D0000-0x000000013F824000-memory.dmp

\Windows\system\bClFRDy.exe

MD5	63435f46175fea4435ab9b304bdd4d13
SHA1	4df2b8fa5ff6087cc9873f198b036dd59cca1053
SHA256	519de1caaf56a208dc0f72245b328770a61cc120904c2413b023546424940ca1
SHA512	27d9facc15c2afbb58828c53f02d26b83b13c2c7156e0a8f3e8eafc490f64831aa1b1dc31208a157f85259ed445bb7ba6e34a401fbaf2d59abae869e0f6d5468

memory/1704-49-0x0000000001F60000-0x00000000022B4000-memory.dmp

\Windows\system\jhkGUGO.exe

MD5	2078bf5866c450e0c346b7af0aab702e
SHA1	46d920baaae6e7b1153cc1e618958f751c46bce9
SHA256	86b306077ea6ceb3be58dd66dc0bee47b53723db5ee01175d49654a94c7d5150
SHA512	76d448bee0b8c52d0fcaecb5663ed00f797c0ededc092c253484ec2b9c8bbc33698b71144ec679107c6f7b954bd8e0fa00381df46bd36c1e910404ab09fba96f

memory/2880-40-0x000000013F060000-0x000000013F3B4000-memory.dmp

C:\Windows\system\aPhUWsg.exe

MD5	f6954677fb5b699d5dbc2d86c5ed5ce1
SHA1	dcc5710e2f8955e80a1022da100b6f5eed533fd5
SHA256	f0af47528a7f8596b1811bf5920440b77112acfea55826d4d006bfc3cbbb3269
SHA512	8950c7c012904ba262d795b6aeced68e17e6d4e79e238889759bc2a4aa0cc48088ff57d93ae61d4ecddd001653487fb35f143a55a673db9929b877c5c5752b4a

memory/2880-110-0x000000013F060000-0x000000013F3B4000-memory.dmp

memory/1704-107-0x000000013F260000-0x000000013F5B4000-memory.dmp

memory/1704-106-0x000000013F590000-0x000000013F8E4000-memory.dmp

C:\Windows\system\gwAnxtV.exe

MD5	1d1db99aa5bbcdbdaef8a47b65b45067
SHA1	904111da7271898f5ab893f59f0e287b395fbab5
SHA256	a45fb63b8911bd1eadf9955aea72781b16c4ea0f7acfc5110d8260b81941f63e
SHA512	316f6c9259007057216d7e19a1cff452b184061b6bfc313ad569dddd485c26eda172759c9da2753c581b9bd347f1be16ae427fef620cfb78c6a8ee67afba45d0

memory/648-89-0x000000013F610000-0x000000013F964000-memory.dmp

memory/1704-77-0x000000013F610000-0x000000013F964000-memory.dmp

memory/2628-76-0x000000013FEA0000-0x00000001401F4000-memory.dmp

memory/2496-75-0x000000013F2C0000-0x000000013F614000-memory.dmp

C:\Windows\system\VZnQQYf.exe

MD5	7c639e1b79ae7006f57bb8c401574f49
SHA1	b28321d84c6d594cc9d9bd6db9e529d416fc7344
SHA256	ba4f5a6f36564a0d7fefba8d6960adc35e24a6bf947749b4c7d8f6c43b070e60
SHA512	11182e2050f14c2a07cc66540026862d76209b96729848bb3707f6a4ae82eb511fce04b24cc7d34b27706839c4994d82be37bc7245f43d63b9e1cfc8e1c7d488

memory/2472-66-0x000000013F870000-0x000000013FBC4000-memory.dmp

C:\Windows\system\KSIezgL.exe

MD5	a3ba6616a30719b6974de1920faf9ec6
SHA1	5c0cd3b4e776cd1b39065414ccbf9a0654f2910b
SHA256	2413eec5a6dbc5b957a599d1256886465b4f4da07b7dab29df694f76ac3fa079
SHA512	8660f864e2baec0db290d482b85728c1ce8ed3ffaee30c2ac6a7b7b5dfb3f60e8c9b20d49a9b4843a661410de630d7b1bfe2bc27a8fd03fbe41d8fd10b23089a

memory/1704-64-0x0000000001F60000-0x00000000022B4000-memory.dmp

memory/2448-54-0x000000013F730000-0x000000013FA84000-memory.dmp

memory/1704-45-0x000000013FEA0000-0x00000001401F4000-memory.dmp

C:\Windows\system\UDmgSlD.exe

MD5	807aa196e7b398dc0efc4d27c9ed89b3
SHA1	72db8fa5b1565bf5055f1907d6c61b75ef982f65
SHA256	8997da4b11a7c8fa6c32af03a0048c5fafa7f77d864ecc32be2277371f4b1153
SHA512	209c39a88cf660569b6f0e510ff5d58ec7bccc4ef88a7481fe9e6d5e3fc0745a3d83f4193a080122989b1da488a58a810e7f81d24e6e6efa594f465af7f19625

memory/2340-30-0x000000013F170000-0x000000013F4C4000-memory.dmp

memory/2648-27-0x000000013FE40000-0x0000000140194000-memory.dmp

memory/1704-26-0x000000013FE40000-0x0000000140194000-memory.dmp

memory/2332-24-0x000000013F270000-0x000000013F5C4000-memory.dmp

memory/1704-35-0x000000013F060000-0x000000013F3B4000-memory.dmp

C:\Windows\system\Xykzvvh.exe

MD5	66780452e540fde85d583a57b7777559
SHA1	6cf8dae4af18821ceecd004588502c3a410fc65a
SHA256	4da5097428a42234a08a1aa471641dc80aedacd340e1fd32e2bdc6d2546dd8ca
SHA512	668db15a6018fe59a110aca793b1933ffb3480ee97bfa1e9c29def1af68944c49413d427b423c7eeb5f6f3a87af8ca503c4a80fd86b12cf1f5c06da4df9624c6

memory/1704-1-0x00000000001F0000-0x0000000000200000-memory.dmp

memory/2472-3024-0x000000013F870000-0x000000013FBC4000-memory.dmp

memory/1948-3044-0x000000013F5F0000-0x000000013F944000-memory.dmp

memory/1188-3079-0x000000013F240000-0x000000013F594000-memory.dmp

memory/2880-3085-0x000000013F060000-0x000000013F3B4000-memory.dmp

memory/2448-3062-0x000000013F730000-0x000000013FA84000-memory.dmp

memory/2340-3074-0x000000013F170000-0x000000013F4C4000-memory.dmp

memory/2460-3049-0x000000013F4D0000-0x000000013F824000-memory.dmp

memory/2496-3048-0x000000013F2C0000-0x000000013F614000-memory.dmp

memory/2332-3046-0x000000013F270000-0x000000013F5C4000-memory.dmp

memory/2648-3037-0x000000013FE40000-0x0000000140194000-memory.dmp

memory/2432-3031-0x000000013FFC0000-0x0000000140314000-memory.dmp

memory/2628-3023-0x000000013FEA0000-0x00000001401F4000-memory.dmp

memory/648-3015-0x000000013F610000-0x000000013F964000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 13:49

Reported

2024-06-13 13:52

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\kRXgzej.exe	N/A
N/A	N/A	C:\Windows\System\dsslWdm.exe	N/A
N/A	N/A	C:\Windows\System\rRsoBpw.exe	N/A
N/A	N/A	C:\Windows\System\XjYCjmk.exe	N/A
N/A	N/A	C:\Windows\System\SFBPjHp.exe	N/A
N/A	N/A	C:\Windows\System\GpzAabu.exe	N/A
N/A	N/A	C:\Windows\System\zEujyYj.exe	N/A
N/A	N/A	C:\Windows\System\fDVKVkm.exe	N/A
N/A	N/A	C:\Windows\System\dgjOBFB.exe	N/A
N/A	N/A	C:\Windows\System\jSlYqqP.exe	N/A
N/A	N/A	C:\Windows\System\obPYeDa.exe	N/A
N/A	N/A	C:\Windows\System\gyWszpf.exe	N/A
N/A	N/A	C:\Windows\System\JTfAAoc.exe	N/A
N/A	N/A	C:\Windows\System\OcLdeZH.exe	N/A
N/A	N/A	C:\Windows\System\PWWVbKd.exe	N/A
N/A	N/A	C:\Windows\System\cEHLAZi.exe	N/A
N/A	N/A	C:\Windows\System\WehpFIH.exe	N/A
N/A	N/A	C:\Windows\System\rTBCvJi.exe	N/A
N/A	N/A	C:\Windows\System\pGMGwbz.exe	N/A
N/A	N/A	C:\Windows\System\ejEKUfD.exe	N/A
N/A	N/A	C:\Windows\System\EMQDwak.exe	N/A
N/A	N/A	C:\Windows\System\TsNSlPh.exe	N/A
N/A	N/A	C:\Windows\System\omQqzJk.exe	N/A
N/A	N/A	C:\Windows\System\jFXJquj.exe	N/A
N/A	N/A	C:\Windows\System\MWtZnsU.exe	N/A
N/A	N/A	C:\Windows\System\OyvjHig.exe	N/A
N/A	N/A	C:\Windows\System\MHTVTmQ.exe	N/A
N/A	N/A	C:\Windows\System\NpXsEUJ.exe	N/A
N/A	N/A	C:\Windows\System\EljmcwV.exe	N/A
N/A	N/A	C:\Windows\System\XbonLZr.exe	N/A
N/A	N/A	C:\Windows\System\lhqsshq.exe	N/A
N/A	N/A	C:\Windows\System\Ojhjygt.exe	N/A
N/A	N/A	C:\Windows\System\xvaDiBl.exe	N/A
N/A	N/A	C:\Windows\System\MyvlURt.exe	N/A
N/A	N/A	C:\Windows\System\ufnjAOe.exe	N/A
N/A	N/A	C:\Windows\System\WaJaisJ.exe	N/A
N/A	N/A	C:\Windows\System\EIEhmPw.exe	N/A
N/A	N/A	C:\Windows\System\NnyjOrf.exe	N/A
N/A	N/A	C:\Windows\System\rJQVpgt.exe	N/A
N/A	N/A	C:\Windows\System\OLPFCAQ.exe	N/A
N/A	N/A	C:\Windows\System\bJjsRlL.exe	N/A
N/A	N/A	C:\Windows\System\jwxEUoQ.exe	N/A
N/A	N/A	C:\Windows\System\lJsQsiT.exe	N/A
N/A	N/A	C:\Windows\System\SYbkptU.exe	N/A
N/A	N/A	C:\Windows\System\JKhRUvj.exe	N/A
N/A	N/A	C:\Windows\System\ZUasSyj.exe	N/A
N/A	N/A	C:\Windows\System\bvNchYd.exe	N/A
N/A	N/A	C:\Windows\System\JqyeMtP.exe	N/A
N/A	N/A	C:\Windows\System\SPMDudB.exe	N/A
N/A	N/A	C:\Windows\System\UhFUmNW.exe	N/A
N/A	N/A	C:\Windows\System\nWhoTpm.exe	N/A
N/A	N/A	C:\Windows\System\lWejvCV.exe	N/A
N/A	N/A	C:\Windows\System\FMJCRiC.exe	N/A
N/A	N/A	C:\Windows\System\taQprUE.exe	N/A
N/A	N/A	C:\Windows\System\GJHEHyu.exe	N/A
N/A	N/A	C:\Windows\System\IJzMZZH.exe	N/A
N/A	N/A	C:\Windows\System\dAStyrc.exe	N/A
N/A	N/A	C:\Windows\System\QOIovMv.exe	N/A
N/A	N/A	C:\Windows\System\ryqoQvL.exe	N/A
N/A	N/A	C:\Windows\System\fJAtbyB.exe	N/A
N/A	N/A	C:\Windows\System\SiixwMI.exe	N/A
N/A	N/A	C:\Windows\System\EWooGKU.exe	N/A
N/A	N/A	C:\Windows\System\exvnMxp.exe	N/A
N/A	N/A	C:\Windows\System\mZxtCeu.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\kynHPwM.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DdYAsDq.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kAboqVe.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kjfniYK.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eZyJjxf.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aCLHrbL.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DZbwHvL.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fgiWeUy.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EwfDvUs.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BXbhUxc.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bypxPNx.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RjjzWPX.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ryqoQvL.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LIhuYbD.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TypXOiF.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KuQdXHK.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NzkOybi.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GpzAabu.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hzdUmAN.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cCQQCWA.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ayxurRx.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tdtGXND.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qpUzgIE.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VUestvC.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GMNDmlE.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QgPHvpu.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CNFQdyn.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hlQpABU.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zavMojd.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JtLwYTu.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HRfYzRs.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rOeOnvR.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PYsxZss.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BMvsldF.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CwJkRZB.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YYyjxtS.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OggllJj.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\osGOzin.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SYbkptU.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bgjtoXX.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lwNXWiP.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sRkDLYQ.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qOjbRBH.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ACmobyF.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\unCDxSb.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UpPLHiK.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wfPLeVV.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AkLEMBu.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dArCzwd.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uIUDIvt.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RKHeqlb.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fUlHINX.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ktcSKRL.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YJdRhqs.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CRUEWly.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JqyeMtP.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZfrdFWf.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\drDWQSp.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OyvjHig.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LAfBAVi.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yBmJWMm.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BSpWGke.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hDelNYm.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VCNKnKv.exe	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2136 wrote to memory of 4024	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\kRXgzej.exe
PID 2136 wrote to memory of 4024	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\kRXgzej.exe
PID 2136 wrote to memory of 1908	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\dsslWdm.exe
PID 2136 wrote to memory of 1908	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\dsslWdm.exe
PID 2136 wrote to memory of 4100	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\rRsoBpw.exe
PID 2136 wrote to memory of 4100	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\rRsoBpw.exe
PID 2136 wrote to memory of 1724	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\XjYCjmk.exe
PID 2136 wrote to memory of 1724	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\XjYCjmk.exe
PID 2136 wrote to memory of 4260	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\SFBPjHp.exe
PID 2136 wrote to memory of 4260	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\SFBPjHp.exe
PID 2136 wrote to memory of 1580	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\GpzAabu.exe
PID 2136 wrote to memory of 1580	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\GpzAabu.exe
PID 2136 wrote to memory of 2848	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\zEujyYj.exe
PID 2136 wrote to memory of 2848	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\zEujyYj.exe
PID 2136 wrote to memory of 2276	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\fDVKVkm.exe
PID 2136 wrote to memory of 2276	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\fDVKVkm.exe
PID 2136 wrote to memory of 2444	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\dgjOBFB.exe
PID 2136 wrote to memory of 2444	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\dgjOBFB.exe
PID 2136 wrote to memory of 796	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\jSlYqqP.exe
PID 2136 wrote to memory of 796	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\jSlYqqP.exe
PID 2136 wrote to memory of 1232	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\obPYeDa.exe
PID 2136 wrote to memory of 1232	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\obPYeDa.exe
PID 2136 wrote to memory of 724	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\gyWszpf.exe
PID 2136 wrote to memory of 724	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\gyWszpf.exe
PID 2136 wrote to memory of 2944	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\JTfAAoc.exe
PID 2136 wrote to memory of 2944	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\JTfAAoc.exe
PID 2136 wrote to memory of 4028	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\OcLdeZH.exe
PID 2136 wrote to memory of 4028	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\OcLdeZH.exe
PID 2136 wrote to memory of 4364	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\rTBCvJi.exe
PID 2136 wrote to memory of 4364	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\rTBCvJi.exe
PID 2136 wrote to memory of 1716	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\PWWVbKd.exe
PID 2136 wrote to memory of 1716	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\PWWVbKd.exe
PID 2136 wrote to memory of 5104	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\cEHLAZi.exe
PID 2136 wrote to memory of 5104	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\cEHLAZi.exe
PID 2136 wrote to memory of 3316	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\WehpFIH.exe
PID 2136 wrote to memory of 3316	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\WehpFIH.exe
PID 2136 wrote to memory of 3056	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\omQqzJk.exe
PID 2136 wrote to memory of 3056	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\omQqzJk.exe
PID 2136 wrote to memory of 2528	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\pGMGwbz.exe
PID 2136 wrote to memory of 2528	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\pGMGwbz.exe
PID 2136 wrote to memory of 4556	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\OyvjHig.exe
PID 2136 wrote to memory of 4556	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\OyvjHig.exe
PID 2136 wrote to memory of 5028	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\ejEKUfD.exe
PID 2136 wrote to memory of 5028	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\ejEKUfD.exe
PID 2136 wrote to memory of 1440	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\EMQDwak.exe
PID 2136 wrote to memory of 1440	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\EMQDwak.exe
PID 2136 wrote to memory of 3768	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\TsNSlPh.exe
PID 2136 wrote to memory of 3768	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\TsNSlPh.exe
PID 2136 wrote to memory of 2768	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\jFXJquj.exe
PID 2136 wrote to memory of 2768	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\jFXJquj.exe
PID 2136 wrote to memory of 4524	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\MWtZnsU.exe
PID 2136 wrote to memory of 4524	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\MWtZnsU.exe
PID 2136 wrote to memory of 3192	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\MHTVTmQ.exe
PID 2136 wrote to memory of 3192	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\MHTVTmQ.exe
PID 2136 wrote to memory of 1904	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\NpXsEUJ.exe
PID 2136 wrote to memory of 1904	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\NpXsEUJ.exe
PID 2136 wrote to memory of 2064	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\EljmcwV.exe
PID 2136 wrote to memory of 2064	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\EljmcwV.exe
PID 2136 wrote to memory of 1084	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\XbonLZr.exe
PID 2136 wrote to memory of 1084	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\XbonLZr.exe
PID 2136 wrote to memory of 3860	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\lhqsshq.exe
PID 2136 wrote to memory of 3860	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\lhqsshq.exe
PID 2136 wrote to memory of 5020	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\Ojhjygt.exe
PID 2136 wrote to memory of 5020	N/A	C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe	C:\Windows\System\Ojhjygt.exe

Processes

C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe"

C:\Windows\System\kRXgzej.exe

C:\Windows\System\kRXgzej.exe

C:\Windows\System\dsslWdm.exe

C:\Windows\System\dsslWdm.exe

C:\Windows\System\rRsoBpw.exe

C:\Windows\System\rRsoBpw.exe

C:\Windows\System\XjYCjmk.exe

C:\Windows\System\XjYCjmk.exe

C:\Windows\System\SFBPjHp.exe

C:\Windows\System\SFBPjHp.exe

C:\Windows\System\GpzAabu.exe

C:\Windows\System\GpzAabu.exe

C:\Windows\System\zEujyYj.exe

C:\Windows\System\zEujyYj.exe

C:\Windows\System\fDVKVkm.exe

C:\Windows\System\fDVKVkm.exe

C:\Windows\System\dgjOBFB.exe

C:\Windows\System\dgjOBFB.exe

C:\Windows\System\jSlYqqP.exe

C:\Windows\System\jSlYqqP.exe

C:\Windows\System\obPYeDa.exe

C:\Windows\System\obPYeDa.exe

C:\Windows\System\gyWszpf.exe

C:\Windows\System\gyWszpf.exe

C:\Windows\System\JTfAAoc.exe

C:\Windows\System\JTfAAoc.exe

C:\Windows\System\OcLdeZH.exe

C:\Windows\System\OcLdeZH.exe

C:\Windows\System\rTBCvJi.exe

C:\Windows\System\rTBCvJi.exe

C:\Windows\System\PWWVbKd.exe

C:\Windows\System\PWWVbKd.exe

C:\Windows\System\cEHLAZi.exe

C:\Windows\System\cEHLAZi.exe

C:\Windows\System\WehpFIH.exe

C:\Windows\System\WehpFIH.exe

C:\Windows\System\omQqzJk.exe

C:\Windows\System\omQqzJk.exe

C:\Windows\System\pGMGwbz.exe

C:\Windows\System\pGMGwbz.exe

C:\Windows\System\OyvjHig.exe

C:\Windows\System\OyvjHig.exe

C:\Windows\System\ejEKUfD.exe

C:\Windows\System\ejEKUfD.exe

C:\Windows\System\EMQDwak.exe

C:\Windows\System\EMQDwak.exe

C:\Windows\System\TsNSlPh.exe

C:\Windows\System\TsNSlPh.exe

C:\Windows\System\jFXJquj.exe

C:\Windows\System\jFXJquj.exe

C:\Windows\System\MWtZnsU.exe

C:\Windows\System\MWtZnsU.exe

C:\Windows\System\MHTVTmQ.exe

C:\Windows\System\MHTVTmQ.exe

C:\Windows\System\NpXsEUJ.exe

C:\Windows\System\NpXsEUJ.exe

C:\Windows\System\EljmcwV.exe

C:\Windows\System\EljmcwV.exe

C:\Windows\System\XbonLZr.exe

C:\Windows\System\XbonLZr.exe

C:\Windows\System\lhqsshq.exe

C:\Windows\System\lhqsshq.exe

C:\Windows\System\Ojhjygt.exe

C:\Windows\System\Ojhjygt.exe

C:\Windows\System\xvaDiBl.exe

C:\Windows\System\xvaDiBl.exe

C:\Windows\System\MyvlURt.exe

C:\Windows\System\MyvlURt.exe

C:\Windows\System\ufnjAOe.exe

C:\Windows\System\ufnjAOe.exe

C:\Windows\System\WaJaisJ.exe

C:\Windows\System\WaJaisJ.exe

C:\Windows\System\EIEhmPw.exe

C:\Windows\System\EIEhmPw.exe

C:\Windows\System\NnyjOrf.exe

C:\Windows\System\NnyjOrf.exe

C:\Windows\System\rJQVpgt.exe

C:\Windows\System\rJQVpgt.exe

C:\Windows\System\OLPFCAQ.exe

C:\Windows\System\OLPFCAQ.exe

C:\Windows\System\bJjsRlL.exe

C:\Windows\System\bJjsRlL.exe

C:\Windows\System\jwxEUoQ.exe

C:\Windows\System\jwxEUoQ.exe

C:\Windows\System\lJsQsiT.exe

C:\Windows\System\lJsQsiT.exe

C:\Windows\System\SYbkptU.exe

C:\Windows\System\SYbkptU.exe

C:\Windows\System\JKhRUvj.exe

C:\Windows\System\JKhRUvj.exe

C:\Windows\System\ZUasSyj.exe

C:\Windows\System\ZUasSyj.exe

C:\Windows\System\bvNchYd.exe

C:\Windows\System\bvNchYd.exe

C:\Windows\System\JqyeMtP.exe

C:\Windows\System\JqyeMtP.exe

C:\Windows\System\SPMDudB.exe

C:\Windows\System\SPMDudB.exe

C:\Windows\System\UhFUmNW.exe

C:\Windows\System\UhFUmNW.exe

C:\Windows\System\nWhoTpm.exe

C:\Windows\System\nWhoTpm.exe

C:\Windows\System\lWejvCV.exe

C:\Windows\System\lWejvCV.exe

C:\Windows\System\FMJCRiC.exe

C:\Windows\System\FMJCRiC.exe

C:\Windows\System\taQprUE.exe

C:\Windows\System\taQprUE.exe

C:\Windows\System\GJHEHyu.exe

C:\Windows\System\GJHEHyu.exe

C:\Windows\System\IJzMZZH.exe

C:\Windows\System\IJzMZZH.exe

C:\Windows\System\dAStyrc.exe

C:\Windows\System\dAStyrc.exe

C:\Windows\System\QOIovMv.exe

C:\Windows\System\QOIovMv.exe

C:\Windows\System\ryqoQvL.exe

C:\Windows\System\ryqoQvL.exe

C:\Windows\System\fJAtbyB.exe

C:\Windows\System\fJAtbyB.exe

C:\Windows\System\SiixwMI.exe

C:\Windows\System\SiixwMI.exe

C:\Windows\System\EWooGKU.exe

C:\Windows\System\EWooGKU.exe

C:\Windows\System\exvnMxp.exe

C:\Windows\System\exvnMxp.exe

C:\Windows\System\mZxtCeu.exe

C:\Windows\System\mZxtCeu.exe

C:\Windows\System\hnytTAx.exe

C:\Windows\System\hnytTAx.exe

C:\Windows\System\NvwtRIk.exe

C:\Windows\System\NvwtRIk.exe

C:\Windows\System\mhpIDnJ.exe

C:\Windows\System\mhpIDnJ.exe

C:\Windows\System\Tnwrrgj.exe

C:\Windows\System\Tnwrrgj.exe

C:\Windows\System\zWUhIDS.exe

C:\Windows\System\zWUhIDS.exe

C:\Windows\System\atkQEbl.exe

C:\Windows\System\atkQEbl.exe

C:\Windows\System\WRXDezz.exe

C:\Windows\System\WRXDezz.exe

C:\Windows\System\kDMREqR.exe

C:\Windows\System\kDMREqR.exe

C:\Windows\System\WSQJCMp.exe

C:\Windows\System\WSQJCMp.exe

C:\Windows\System\pLfUsbS.exe

C:\Windows\System\pLfUsbS.exe

C:\Windows\System\shVXyUz.exe

C:\Windows\System\shVXyUz.exe

C:\Windows\System\LAfBAVi.exe

C:\Windows\System\LAfBAVi.exe

C:\Windows\System\CNFQdyn.exe

C:\Windows\System\CNFQdyn.exe

C:\Windows\System\AUpaYVu.exe

C:\Windows\System\AUpaYVu.exe

C:\Windows\System\sPifefU.exe

C:\Windows\System\sPifefU.exe

C:\Windows\System\CDkUiCe.exe

C:\Windows\System\CDkUiCe.exe

C:\Windows\System\aCLHrbL.exe

C:\Windows\System\aCLHrbL.exe

C:\Windows\System\xuNVKYD.exe

C:\Windows\System\xuNVKYD.exe

C:\Windows\System\RwmQNHU.exe

C:\Windows\System\RwmQNHU.exe

C:\Windows\System\jTaEdrX.exe

C:\Windows\System\jTaEdrX.exe

C:\Windows\System\cmDwAuV.exe

C:\Windows\System\cmDwAuV.exe

C:\Windows\System\dPZchHx.exe

C:\Windows\System\dPZchHx.exe

C:\Windows\System\wSyLEaH.exe

C:\Windows\System\wSyLEaH.exe

C:\Windows\System\iFHABrt.exe

C:\Windows\System\iFHABrt.exe

C:\Windows\System\dUFxafa.exe

C:\Windows\System\dUFxafa.exe

C:\Windows\System\lpfmPuZ.exe

C:\Windows\System\lpfmPuZ.exe

C:\Windows\System\QekMmlb.exe

C:\Windows\System\QekMmlb.exe

C:\Windows\System\GMlRUxo.exe

C:\Windows\System\GMlRUxo.exe

C:\Windows\System\LkkJijO.exe

C:\Windows\System\LkkJijO.exe

C:\Windows\System\WPLDASy.exe

C:\Windows\System\WPLDASy.exe

C:\Windows\System\CpfkpAX.exe

C:\Windows\System\CpfkpAX.exe

C:\Windows\System\SyFBhLP.exe

C:\Windows\System\SyFBhLP.exe

C:\Windows\System\gKQldaH.exe

C:\Windows\System\gKQldaH.exe

C:\Windows\System\EwfDvUs.exe

C:\Windows\System\EwfDvUs.exe

C:\Windows\System\cigdfEv.exe

C:\Windows\System\cigdfEv.exe

C:\Windows\System\IwTXtsn.exe

C:\Windows\System\IwTXtsn.exe

C:\Windows\System\KOJXpZj.exe

C:\Windows\System\KOJXpZj.exe

C:\Windows\System\GBhCfqe.exe

C:\Windows\System\GBhCfqe.exe

C:\Windows\System\KGJLaEa.exe

C:\Windows\System\KGJLaEa.exe

C:\Windows\System\ZpWdxXU.exe

C:\Windows\System\ZpWdxXU.exe

C:\Windows\System\NsZSXwA.exe

C:\Windows\System\NsZSXwA.exe

C:\Windows\System\pOMwoiV.exe

C:\Windows\System\pOMwoiV.exe

C:\Windows\System\aQmqnpC.exe

C:\Windows\System\aQmqnpC.exe

C:\Windows\System\uudfXWR.exe

C:\Windows\System\uudfXWR.exe

C:\Windows\System\snPCagD.exe

C:\Windows\System\snPCagD.exe

C:\Windows\System\YbInhbk.exe

C:\Windows\System\YbInhbk.exe

C:\Windows\System\KNwpfgL.exe

C:\Windows\System\KNwpfgL.exe

C:\Windows\System\VUestvC.exe

C:\Windows\System\VUestvC.exe

C:\Windows\System\SeKgLqV.exe

C:\Windows\System\SeKgLqV.exe

C:\Windows\System\GUMRfFa.exe

C:\Windows\System\GUMRfFa.exe

C:\Windows\System\KXukBeH.exe

C:\Windows\System\KXukBeH.exe

C:\Windows\System\SpXKWtM.exe

C:\Windows\System\SpXKWtM.exe

C:\Windows\System\VBzigYB.exe

C:\Windows\System\VBzigYB.exe

C:\Windows\System\CwXPSAi.exe

C:\Windows\System\CwXPSAi.exe

C:\Windows\System\aTWWLDn.exe

C:\Windows\System\aTWWLDn.exe

C:\Windows\System\GMNDmlE.exe

C:\Windows\System\GMNDmlE.exe

C:\Windows\System\gXtLoMR.exe

C:\Windows\System\gXtLoMR.exe

C:\Windows\System\apTpdwL.exe

C:\Windows\System\apTpdwL.exe

C:\Windows\System\fTgnhEQ.exe

C:\Windows\System\fTgnhEQ.exe

C:\Windows\System\AkLEMBu.exe

C:\Windows\System\AkLEMBu.exe

C:\Windows\System\XjWaPft.exe

C:\Windows\System\XjWaPft.exe

C:\Windows\System\XurfokF.exe

C:\Windows\System\XurfokF.exe

C:\Windows\System\RLLDEie.exe

C:\Windows\System\RLLDEie.exe

C:\Windows\System\DmjeEHW.exe

C:\Windows\System\DmjeEHW.exe

C:\Windows\System\vxyzxfP.exe

C:\Windows\System\vxyzxfP.exe

C:\Windows\System\gJgbhbA.exe

C:\Windows\System\gJgbhbA.exe

C:\Windows\System\gqcQylm.exe

C:\Windows\System\gqcQylm.exe

C:\Windows\System\ETSVlDl.exe

C:\Windows\System\ETSVlDl.exe

C:\Windows\System\OEeqpKL.exe

C:\Windows\System\OEeqpKL.exe

C:\Windows\System\hUqnsBg.exe

C:\Windows\System\hUqnsBg.exe

C:\Windows\System\lKpAYga.exe

C:\Windows\System\lKpAYga.exe

C:\Windows\System\GJnaMRJ.exe

C:\Windows\System\GJnaMRJ.exe

C:\Windows\System\npaeiFv.exe

C:\Windows\System\npaeiFv.exe

C:\Windows\System\ZFwbOiG.exe

C:\Windows\System\ZFwbOiG.exe

C:\Windows\System\CJFYzxB.exe

C:\Windows\System\CJFYzxB.exe

C:\Windows\System\nqOrWuh.exe

C:\Windows\System\nqOrWuh.exe

C:\Windows\System\IQCabPn.exe

C:\Windows\System\IQCabPn.exe

C:\Windows\System\nfbDoys.exe

C:\Windows\System\nfbDoys.exe

C:\Windows\System\prMsLHO.exe

C:\Windows\System\prMsLHO.exe

C:\Windows\System\PpqZapM.exe

C:\Windows\System\PpqZapM.exe

C:\Windows\System\bgjtoXX.exe

C:\Windows\System\bgjtoXX.exe

C:\Windows\System\WQbbikg.exe

C:\Windows\System\WQbbikg.exe

C:\Windows\System\nUyFrYl.exe

C:\Windows\System\nUyFrYl.exe

C:\Windows\System\ehibEAq.exe

C:\Windows\System\ehibEAq.exe

C:\Windows\System\IYXUlqj.exe

C:\Windows\System\IYXUlqj.exe

C:\Windows\System\JCznrSG.exe

C:\Windows\System\JCznrSG.exe

C:\Windows\System\sbZApdq.exe

C:\Windows\System\sbZApdq.exe

C:\Windows\System\zrBRuqf.exe

C:\Windows\System\zrBRuqf.exe

C:\Windows\System\snsOpNw.exe

C:\Windows\System\snsOpNw.exe

C:\Windows\System\ssDuWMj.exe

C:\Windows\System\ssDuWMj.exe

C:\Windows\System\BYcuAYz.exe

C:\Windows\System\BYcuAYz.exe

C:\Windows\System\XvVPGYL.exe

C:\Windows\System\XvVPGYL.exe

C:\Windows\System\wYUvpVf.exe

C:\Windows\System\wYUvpVf.exe

C:\Windows\System\BXbhUxc.exe

C:\Windows\System\BXbhUxc.exe

C:\Windows\System\zwFslLU.exe

C:\Windows\System\zwFslLU.exe

C:\Windows\System\lQlpJmV.exe

C:\Windows\System\lQlpJmV.exe

C:\Windows\System\kynHPwM.exe

C:\Windows\System\kynHPwM.exe

C:\Windows\System\ucKLLmQ.exe

C:\Windows\System\ucKLLmQ.exe

C:\Windows\System\VyTxuOS.exe

C:\Windows\System\VyTxuOS.exe

C:\Windows\System\ftzpemN.exe

C:\Windows\System\ftzpemN.exe

C:\Windows\System\SNkjobT.exe

C:\Windows\System\SNkjobT.exe

C:\Windows\System\fGJrybj.exe

C:\Windows\System\fGJrybj.exe

C:\Windows\System\lfTGRCC.exe

C:\Windows\System\lfTGRCC.exe

C:\Windows\System\TucsNtx.exe

C:\Windows\System\TucsNtx.exe

C:\Windows\System\CxUxrug.exe

C:\Windows\System\CxUxrug.exe

C:\Windows\System\KBeLcQU.exe

C:\Windows\System\KBeLcQU.exe

C:\Windows\System\CpMPdYq.exe

C:\Windows\System\CpMPdYq.exe

C:\Windows\System\KUNHeRu.exe

C:\Windows\System\KUNHeRu.exe

C:\Windows\System\hlQpABU.exe

C:\Windows\System\hlQpABU.exe

C:\Windows\System\CqfCqio.exe

C:\Windows\System\CqfCqio.exe

C:\Windows\System\hulLfnx.exe

C:\Windows\System\hulLfnx.exe

C:\Windows\System\DKBRvQv.exe

C:\Windows\System\DKBRvQv.exe

C:\Windows\System\ayxurRx.exe

C:\Windows\System\ayxurRx.exe

C:\Windows\System\mNeVUtY.exe

C:\Windows\System\mNeVUtY.exe

C:\Windows\System\rOeOnvR.exe

C:\Windows\System\rOeOnvR.exe

C:\Windows\System\fZdhMtD.exe

C:\Windows\System\fZdhMtD.exe

C:\Windows\System\CzUNDxi.exe

C:\Windows\System\CzUNDxi.exe

C:\Windows\System\MlMXoFK.exe

C:\Windows\System\MlMXoFK.exe

C:\Windows\System\SsNOSKL.exe

C:\Windows\System\SsNOSKL.exe

C:\Windows\System\yBmJWMm.exe

C:\Windows\System\yBmJWMm.exe

C:\Windows\System\uitmbjg.exe

C:\Windows\System\uitmbjg.exe

C:\Windows\System\LONUbrD.exe

C:\Windows\System\LONUbrD.exe

C:\Windows\System\qpGEJEr.exe

C:\Windows\System\qpGEJEr.exe

C:\Windows\System\haAhzEC.exe

C:\Windows\System\haAhzEC.exe

C:\Windows\System\TWKZalU.exe

C:\Windows\System\TWKZalU.exe

C:\Windows\System\yJUzwwx.exe

C:\Windows\System\yJUzwwx.exe

C:\Windows\System\EczzvlD.exe

C:\Windows\System\EczzvlD.exe

C:\Windows\System\LIHFJQT.exe

C:\Windows\System\LIHFJQT.exe

C:\Windows\System\pyXyilP.exe

C:\Windows\System\pyXyilP.exe

C:\Windows\System\VDPNZpE.exe

C:\Windows\System\VDPNZpE.exe

C:\Windows\System\oaDhxbS.exe

C:\Windows\System\oaDhxbS.exe

C:\Windows\System\lCwQlov.exe

C:\Windows\System\lCwQlov.exe

C:\Windows\System\nEvSeOq.exe

C:\Windows\System\nEvSeOq.exe

C:\Windows\System\hzdUmAN.exe

C:\Windows\System\hzdUmAN.exe

C:\Windows\System\sKsyoub.exe

C:\Windows\System\sKsyoub.exe

C:\Windows\System\LIhuYbD.exe

C:\Windows\System\LIhuYbD.exe

C:\Windows\System\xqlvHXw.exe

C:\Windows\System\xqlvHXw.exe

C:\Windows\System\mxYJgWj.exe

C:\Windows\System\mxYJgWj.exe

C:\Windows\System\OTBQPOj.exe

C:\Windows\System\OTBQPOj.exe

C:\Windows\System\LbStXln.exe

C:\Windows\System\LbStXln.exe

C:\Windows\System\ciXXdAV.exe

C:\Windows\System\ciXXdAV.exe

C:\Windows\System\ttXpymu.exe

C:\Windows\System\ttXpymu.exe

C:\Windows\System\SGPiiED.exe

C:\Windows\System\SGPiiED.exe

C:\Windows\System\KVeppfb.exe

C:\Windows\System\KVeppfb.exe

C:\Windows\System\ZBFXnBm.exe

C:\Windows\System\ZBFXnBm.exe

C:\Windows\System\yHVkTra.exe

C:\Windows\System\yHVkTra.exe

C:\Windows\System\DOyMBwv.exe

C:\Windows\System\DOyMBwv.exe

C:\Windows\System\dGaPsrA.exe

C:\Windows\System\dGaPsrA.exe

C:\Windows\System\yfhiONi.exe

C:\Windows\System\yfhiONi.exe

C:\Windows\System\QQuzsJW.exe

C:\Windows\System\QQuzsJW.exe

C:\Windows\System\ZVuqVIw.exe

C:\Windows\System\ZVuqVIw.exe

C:\Windows\System\bypxPNx.exe

C:\Windows\System\bypxPNx.exe

C:\Windows\System\jWwzmox.exe

C:\Windows\System\jWwzmox.exe

C:\Windows\System\ChXMDaX.exe

C:\Windows\System\ChXMDaX.exe

C:\Windows\System\NXvfbqg.exe

C:\Windows\System\NXvfbqg.exe

C:\Windows\System\IdSFmVQ.exe

C:\Windows\System\IdSFmVQ.exe

C:\Windows\System\DdYAsDq.exe

C:\Windows\System\DdYAsDq.exe

C:\Windows\System\pmofSmS.exe

C:\Windows\System\pmofSmS.exe

C:\Windows\System\MbApahD.exe

C:\Windows\System\MbApahD.exe

C:\Windows\System\iDzHRJF.exe

C:\Windows\System\iDzHRJF.exe

C:\Windows\System\wljKWZc.exe

C:\Windows\System\wljKWZc.exe

C:\Windows\System\eKpJTIJ.exe

C:\Windows\System\eKpJTIJ.exe

C:\Windows\System\wURgJYK.exe

C:\Windows\System\wURgJYK.exe

C:\Windows\System\SikclBa.exe

C:\Windows\System\SikclBa.exe

C:\Windows\System\oyinfgs.exe

C:\Windows\System\oyinfgs.exe

C:\Windows\System\ViXLzJs.exe

C:\Windows\System\ViXLzJs.exe

C:\Windows\System\dLbCLdF.exe

C:\Windows\System\dLbCLdF.exe

C:\Windows\System\XwSlNvz.exe

C:\Windows\System\XwSlNvz.exe

C:\Windows\System\UnnAGNP.exe

C:\Windows\System\UnnAGNP.exe

C:\Windows\System\VmcEoFH.exe

C:\Windows\System\VmcEoFH.exe

C:\Windows\System\XPmaIug.exe

C:\Windows\System\XPmaIug.exe

C:\Windows\System\ThdQUhN.exe

C:\Windows\System\ThdQUhN.exe

C:\Windows\System\ZeAbGiC.exe

C:\Windows\System\ZeAbGiC.exe

C:\Windows\System\YIUmNuL.exe

C:\Windows\System\YIUmNuL.exe

C:\Windows\System\IjGRBTd.exe

C:\Windows\System\IjGRBTd.exe

C:\Windows\System\HjTElAB.exe

C:\Windows\System\HjTElAB.exe

C:\Windows\System\mUlcdmM.exe

C:\Windows\System\mUlcdmM.exe

C:\Windows\System\xvnnQIO.exe

C:\Windows\System\xvnnQIO.exe

C:\Windows\System\OPJrNII.exe

C:\Windows\System\OPJrNII.exe

C:\Windows\System\QnxJUzI.exe

C:\Windows\System\QnxJUzI.exe

C:\Windows\System\lwNXWiP.exe

C:\Windows\System\lwNXWiP.exe

C:\Windows\System\qxGnnXi.exe

C:\Windows\System\qxGnnXi.exe

C:\Windows\System\rtKyWfr.exe

C:\Windows\System\rtKyWfr.exe

C:\Windows\System\FryGvTp.exe

C:\Windows\System\FryGvTp.exe

C:\Windows\System\pkiJpwn.exe

C:\Windows\System\pkiJpwn.exe

C:\Windows\System\BIuCRzh.exe

C:\Windows\System\BIuCRzh.exe

C:\Windows\System\jtbIGJf.exe

C:\Windows\System\jtbIGJf.exe

C:\Windows\System\roVdkyJ.exe

C:\Windows\System\roVdkyJ.exe

C:\Windows\System\JaFDozX.exe

C:\Windows\System\JaFDozX.exe

C:\Windows\System\eRuHjuI.exe

C:\Windows\System\eRuHjuI.exe

C:\Windows\System\zlVNoZu.exe

C:\Windows\System\zlVNoZu.exe

C:\Windows\System\ZQXHnZt.exe

C:\Windows\System\ZQXHnZt.exe

C:\Windows\System\jSdRoYX.exe

C:\Windows\System\jSdRoYX.exe

C:\Windows\System\UckMtbi.exe

C:\Windows\System\UckMtbi.exe

C:\Windows\System\OeRSkVC.exe

C:\Windows\System\OeRSkVC.exe

C:\Windows\System\KUMjHaz.exe

C:\Windows\System\KUMjHaz.exe

C:\Windows\System\iePlTBt.exe

C:\Windows\System\iePlTBt.exe

C:\Windows\System\odphWhy.exe

C:\Windows\System\odphWhy.exe

C:\Windows\System\cCQQCWA.exe

C:\Windows\System\cCQQCWA.exe

C:\Windows\System\GVuUERp.exe

C:\Windows\System\GVuUERp.exe

C:\Windows\System\LEWNvPd.exe

C:\Windows\System\LEWNvPd.exe

C:\Windows\System\auDaWlF.exe

C:\Windows\System\auDaWlF.exe

C:\Windows\System\oCzmoGY.exe

C:\Windows\System\oCzmoGY.exe

C:\Windows\System\cAnMiOU.exe

C:\Windows\System\cAnMiOU.exe

C:\Windows\System\TFCivow.exe

C:\Windows\System\TFCivow.exe

C:\Windows\System\zTAfCrn.exe

C:\Windows\System\zTAfCrn.exe

C:\Windows\System\DZbwHvL.exe

C:\Windows\System\DZbwHvL.exe

C:\Windows\System\zOSDtGw.exe

C:\Windows\System\zOSDtGw.exe

C:\Windows\System\fJzlcUh.exe

C:\Windows\System\fJzlcUh.exe

C:\Windows\System\LwBzgWR.exe

C:\Windows\System\LwBzgWR.exe

C:\Windows\System\tdtGXND.exe

C:\Windows\System\tdtGXND.exe

C:\Windows\System\ImErbwF.exe

C:\Windows\System\ImErbwF.exe

C:\Windows\System\jUfnbsa.exe

C:\Windows\System\jUfnbsa.exe

C:\Windows\System\QLbzmbC.exe

C:\Windows\System\QLbzmbC.exe

C:\Windows\System\RWvoPBk.exe

C:\Windows\System\RWvoPBk.exe

C:\Windows\System\kMZzMgt.exe

C:\Windows\System\kMZzMgt.exe

C:\Windows\System\xImpRum.exe

C:\Windows\System\xImpRum.exe

C:\Windows\System\FoelfDD.exe

C:\Windows\System\FoelfDD.exe

C:\Windows\System\fgiWeUy.exe

C:\Windows\System\fgiWeUy.exe

C:\Windows\System\VDkwFzp.exe

C:\Windows\System\VDkwFzp.exe

C:\Windows\System\wdivnAm.exe

C:\Windows\System\wdivnAm.exe

C:\Windows\System\wxaZJIW.exe

C:\Windows\System\wxaZJIW.exe

C:\Windows\System\BSpWGke.exe

C:\Windows\System\BSpWGke.exe

C:\Windows\System\BoAFcHR.exe

C:\Windows\System\BoAFcHR.exe

C:\Windows\System\IDDuUqf.exe

C:\Windows\System\IDDuUqf.exe

C:\Windows\System\EhGOXiD.exe

C:\Windows\System\EhGOXiD.exe

C:\Windows\System\RkTykty.exe

C:\Windows\System\RkTykty.exe

C:\Windows\System\pimjzLS.exe

C:\Windows\System\pimjzLS.exe

C:\Windows\System\kIUougS.exe

C:\Windows\System\kIUougS.exe

C:\Windows\System\ffGFLdR.exe

C:\Windows\System\ffGFLdR.exe

C:\Windows\System\onEHeNo.exe

C:\Windows\System\onEHeNo.exe

C:\Windows\System\hDelNYm.exe

C:\Windows\System\hDelNYm.exe

C:\Windows\System\pMsAyiC.exe

C:\Windows\System\pMsAyiC.exe

C:\Windows\System\GsUbQqQ.exe

C:\Windows\System\GsUbQqQ.exe

C:\Windows\System\SPiELEn.exe

C:\Windows\System\SPiELEn.exe

C:\Windows\System\rRaFMak.exe

C:\Windows\System\rRaFMak.exe

C:\Windows\System\eTfUUTZ.exe

C:\Windows\System\eTfUUTZ.exe

C:\Windows\System\LClLmUx.exe

C:\Windows\System\LClLmUx.exe

C:\Windows\System\vEJfxkx.exe

C:\Windows\System\vEJfxkx.exe

C:\Windows\System\uBYGqAY.exe

C:\Windows\System\uBYGqAY.exe

C:\Windows\System\WfDHtkW.exe

C:\Windows\System\WfDHtkW.exe

C:\Windows\System\FzfcxaR.exe

C:\Windows\System\FzfcxaR.exe

C:\Windows\System\sRkDLYQ.exe

C:\Windows\System\sRkDLYQ.exe

C:\Windows\System\JuVVuDF.exe

C:\Windows\System\JuVVuDF.exe

C:\Windows\System\PBQnaXu.exe

C:\Windows\System\PBQnaXu.exe

C:\Windows\System\rBNLNzV.exe

C:\Windows\System\rBNLNzV.exe

C:\Windows\System\PGwOpxF.exe

C:\Windows\System\PGwOpxF.exe

C:\Windows\System\dHeSklN.exe

C:\Windows\System\dHeSklN.exe

C:\Windows\System\oKcpKCV.exe

C:\Windows\System\oKcpKCV.exe

C:\Windows\System\ujeivGo.exe

C:\Windows\System\ujeivGo.exe

C:\Windows\System\eizvvYg.exe

C:\Windows\System\eizvvYg.exe

C:\Windows\System\EBUzkhI.exe

C:\Windows\System\EBUzkhI.exe

C:\Windows\System\ptDrwgY.exe

C:\Windows\System\ptDrwgY.exe

C:\Windows\System\ZzNggtq.exe

C:\Windows\System\ZzNggtq.exe

C:\Windows\System\uSwmiLc.exe

C:\Windows\System\uSwmiLc.exe

C:\Windows\System\lCmcRJk.exe

C:\Windows\System\lCmcRJk.exe

C:\Windows\System\tjBtNoJ.exe

C:\Windows\System\tjBtNoJ.exe

C:\Windows\System\FWhnVBN.exe

C:\Windows\System\FWhnVBN.exe

C:\Windows\System\KlWNTKz.exe

C:\Windows\System\KlWNTKz.exe

C:\Windows\System\bDYSMuu.exe

C:\Windows\System\bDYSMuu.exe

C:\Windows\System\DRmKsTS.exe

C:\Windows\System\DRmKsTS.exe

C:\Windows\System\wfqLgoB.exe

C:\Windows\System\wfqLgoB.exe

C:\Windows\System\LqCTaXY.exe

C:\Windows\System\LqCTaXY.exe

C:\Windows\System\HfmiUyt.exe

C:\Windows\System\HfmiUyt.exe

C:\Windows\System\oVfjwJR.exe

C:\Windows\System\oVfjwJR.exe

C:\Windows\System\dmFRksE.exe

C:\Windows\System\dmFRksE.exe

C:\Windows\System\VXxUVeR.exe

C:\Windows\System\VXxUVeR.exe

C:\Windows\System\ERNfDhg.exe

C:\Windows\System\ERNfDhg.exe

C:\Windows\System\fpdVxpz.exe

C:\Windows\System\fpdVxpz.exe

C:\Windows\System\OpHulhS.exe

C:\Windows\System\OpHulhS.exe

C:\Windows\System\cXojPnO.exe

C:\Windows\System\cXojPnO.exe

C:\Windows\System\LhZBJoF.exe

C:\Windows\System\LhZBJoF.exe

C:\Windows\System\lVfUnFa.exe

C:\Windows\System\lVfUnFa.exe

C:\Windows\System\LbFaJBN.exe

C:\Windows\System\LbFaJBN.exe

C:\Windows\System\qOjbRBH.exe

C:\Windows\System\qOjbRBH.exe

C:\Windows\System\zavMojd.exe

C:\Windows\System\zavMojd.exe

C:\Windows\System\yvwLByP.exe

C:\Windows\System\yvwLByP.exe

C:\Windows\System\kFYgnSk.exe

C:\Windows\System\kFYgnSk.exe

C:\Windows\System\qniHacQ.exe

C:\Windows\System\qniHacQ.exe

C:\Windows\System\UzsjdSC.exe

C:\Windows\System\UzsjdSC.exe

C:\Windows\System\keZPaFN.exe

C:\Windows\System\keZPaFN.exe

C:\Windows\System\vpkhbng.exe

C:\Windows\System\vpkhbng.exe

C:\Windows\System\rSTgFuW.exe

C:\Windows\System\rSTgFuW.exe

C:\Windows\System\zoIkJzJ.exe

C:\Windows\System\zoIkJzJ.exe

C:\Windows\System\TCEJWhf.exe

C:\Windows\System\TCEJWhf.exe

C:\Windows\System\oslYzMS.exe

C:\Windows\System\oslYzMS.exe

C:\Windows\System\jkuFElI.exe

C:\Windows\System\jkuFElI.exe

C:\Windows\System\qmJBAVj.exe

C:\Windows\System\qmJBAVj.exe

C:\Windows\System\ItqyneR.exe

C:\Windows\System\ItqyneR.exe

C:\Windows\System\MyDifkG.exe

C:\Windows\System\MyDifkG.exe

C:\Windows\System\AdEfLqw.exe

C:\Windows\System\AdEfLqw.exe

C:\Windows\System\UqJbGdh.exe

C:\Windows\System\UqJbGdh.exe

C:\Windows\System\CYNpdVO.exe

C:\Windows\System\CYNpdVO.exe

C:\Windows\System\pLijkWw.exe

C:\Windows\System\pLijkWw.exe

C:\Windows\System\ADOsHTm.exe

C:\Windows\System\ADOsHTm.exe

C:\Windows\System\JVqblFK.exe

C:\Windows\System\JVqblFK.exe

C:\Windows\System\zFuFRcD.exe

C:\Windows\System\zFuFRcD.exe

C:\Windows\System\hoYehrW.exe

C:\Windows\System\hoYehrW.exe

C:\Windows\System\UJdhSie.exe

C:\Windows\System\UJdhSie.exe

C:\Windows\System\TypXOiF.exe

C:\Windows\System\TypXOiF.exe

C:\Windows\System\mTdEuXy.exe

C:\Windows\System\mTdEuXy.exe

C:\Windows\System\pUEIWTv.exe

C:\Windows\System\pUEIWTv.exe

C:\Windows\System\PgAHcAk.exe

C:\Windows\System\PgAHcAk.exe

C:\Windows\System\qpUzgIE.exe

C:\Windows\System\qpUzgIE.exe

C:\Windows\System\uZZqogz.exe

C:\Windows\System\uZZqogz.exe

C:\Windows\System\kAboqVe.exe

C:\Windows\System\kAboqVe.exe

C:\Windows\System\wIhxFwd.exe

C:\Windows\System\wIhxFwd.exe

C:\Windows\System\moSXagd.exe

C:\Windows\System\moSXagd.exe

C:\Windows\System\rdPPBPh.exe

C:\Windows\System\rdPPBPh.exe

C:\Windows\System\hBBUthP.exe

C:\Windows\System\hBBUthP.exe

C:\Windows\System\kjfniYK.exe

C:\Windows\System\kjfniYK.exe

C:\Windows\System\QlgAaDb.exe

C:\Windows\System\QlgAaDb.exe

C:\Windows\System\LIrGouu.exe

C:\Windows\System\LIrGouu.exe

C:\Windows\System\JlaNmgU.exe

C:\Windows\System\JlaNmgU.exe

C:\Windows\System\baCcgwa.exe

C:\Windows\System\baCcgwa.exe

C:\Windows\System\ljUldqJ.exe

C:\Windows\System\ljUldqJ.exe

C:\Windows\System\IAwebht.exe

C:\Windows\System\IAwebht.exe

C:\Windows\System\VCNKnKv.exe

C:\Windows\System\VCNKnKv.exe

C:\Windows\System\KuQdXHK.exe

C:\Windows\System\KuQdXHK.exe

C:\Windows\System\vhELHkN.exe

C:\Windows\System\vhELHkN.exe

C:\Windows\System\HriugXj.exe

C:\Windows\System\HriugXj.exe

C:\Windows\System\MaSkJSQ.exe

C:\Windows\System\MaSkJSQ.exe

C:\Windows\System\UpPLHiK.exe

C:\Windows\System\UpPLHiK.exe

C:\Windows\System\QNmPzoN.exe

C:\Windows\System\QNmPzoN.exe

C:\Windows\System\uNQJedk.exe

C:\Windows\System\uNQJedk.exe

C:\Windows\System\Qlwdxoc.exe

C:\Windows\System\Qlwdxoc.exe

C:\Windows\System\bCQaZWY.exe

C:\Windows\System\bCQaZWY.exe

C:\Windows\System\OXRhcjq.exe

C:\Windows\System\OXRhcjq.exe

C:\Windows\System\uJVuYIg.exe

C:\Windows\System\uJVuYIg.exe

C:\Windows\System\VWKjuWI.exe

C:\Windows\System\VWKjuWI.exe

C:\Windows\System\INajyxj.exe

C:\Windows\System\INajyxj.exe

C:\Windows\System\ghwbqFT.exe

C:\Windows\System\ghwbqFT.exe

C:\Windows\System\OLnZvRE.exe

C:\Windows\System\OLnZvRE.exe

C:\Windows\System\NbuGdBp.exe

C:\Windows\System\NbuGdBp.exe

C:\Windows\System\qRaTExh.exe

C:\Windows\System\qRaTExh.exe

C:\Windows\System\dhHttFU.exe

C:\Windows\System\dhHttFU.exe

C:\Windows\System\gFIwAMX.exe

C:\Windows\System\gFIwAMX.exe

C:\Windows\System\NzkOybi.exe

C:\Windows\System\NzkOybi.exe

C:\Windows\System\VMALDot.exe

C:\Windows\System\VMALDot.exe

C:\Windows\System\mqrlXfJ.exe

C:\Windows\System\mqrlXfJ.exe

C:\Windows\System\CjcyGcB.exe

C:\Windows\System\CjcyGcB.exe

C:\Windows\System\kWrZeKK.exe

C:\Windows\System\kWrZeKK.exe

C:\Windows\System\azJfEhn.exe

C:\Windows\System\azJfEhn.exe

C:\Windows\System\lbuzisE.exe

C:\Windows\System\lbuzisE.exe

C:\Windows\System\jEUGyJM.exe

C:\Windows\System\jEUGyJM.exe

C:\Windows\System\LPVQvIL.exe

C:\Windows\System\LPVQvIL.exe

C:\Windows\System\BesEIff.exe

C:\Windows\System\BesEIff.exe

C:\Windows\System\chMsclA.exe

C:\Windows\System\chMsclA.exe

C:\Windows\System\EIQBROW.exe

C:\Windows\System\EIQBROW.exe

C:\Windows\System\ACmobyF.exe

C:\Windows\System\ACmobyF.exe

C:\Windows\System\QulbwcZ.exe

C:\Windows\System\QulbwcZ.exe

C:\Windows\System\BWFLIbG.exe

C:\Windows\System\BWFLIbG.exe

C:\Windows\System\QzdLpLO.exe

C:\Windows\System\QzdLpLO.exe

C:\Windows\System\eZyJjxf.exe

C:\Windows\System\eZyJjxf.exe

C:\Windows\System\pgLemjT.exe

C:\Windows\System\pgLemjT.exe

C:\Windows\System\LmOAUSv.exe

C:\Windows\System\LmOAUSv.exe

C:\Windows\System\mNdkxdS.exe

C:\Windows\System\mNdkxdS.exe

C:\Windows\System\jGrqvVq.exe

C:\Windows\System\jGrqvVq.exe

C:\Windows\System\EeZBrTa.exe

C:\Windows\System\EeZBrTa.exe

C:\Windows\System\zshQZSP.exe

C:\Windows\System\zshQZSP.exe

C:\Windows\System\ROxSOQX.exe

C:\Windows\System\ROxSOQX.exe

C:\Windows\System\fhzvBPd.exe

C:\Windows\System\fhzvBPd.exe

C:\Windows\System\EMAgRXL.exe

C:\Windows\System\EMAgRXL.exe

C:\Windows\System\QqFNfye.exe

C:\Windows\System\QqFNfye.exe

C:\Windows\System\sEbSsaX.exe

C:\Windows\System\sEbSsaX.exe

C:\Windows\System\ghgijkf.exe

C:\Windows\System\ghgijkf.exe

C:\Windows\System\CQVLYRW.exe

C:\Windows\System\CQVLYRW.exe

C:\Windows\System\ROcmKox.exe

C:\Windows\System\ROcmKox.exe

C:\Windows\System\aDoCMNv.exe

C:\Windows\System\aDoCMNv.exe

C:\Windows\System\BfFecvI.exe

C:\Windows\System\BfFecvI.exe

C:\Windows\System\dqaRbTT.exe

C:\Windows\System\dqaRbTT.exe

C:\Windows\System\bdhwEfM.exe

C:\Windows\System\bdhwEfM.exe

C:\Windows\System\JagoJrC.exe

C:\Windows\System\JagoJrC.exe

C:\Windows\System\vdSGHBY.exe

C:\Windows\System\vdSGHBY.exe

C:\Windows\System\ZfrdFWf.exe

C:\Windows\System\ZfrdFWf.exe

C:\Windows\System\UwWhzpl.exe

C:\Windows\System\UwWhzpl.exe

C:\Windows\System\OpUzArf.exe

C:\Windows\System\OpUzArf.exe

C:\Windows\System\dQkPIOF.exe

C:\Windows\System\dQkPIOF.exe

C:\Windows\System\yywshjl.exe

C:\Windows\System\yywshjl.exe

C:\Windows\System\rzZvJEy.exe

C:\Windows\System\rzZvJEy.exe

C:\Windows\System\AiYAKJM.exe

C:\Windows\System\AiYAKJM.exe

C:\Windows\System\JkeUQcH.exe

C:\Windows\System\JkeUQcH.exe

C:\Windows\System\JKxIuIv.exe

C:\Windows\System\JKxIuIv.exe

C:\Windows\System\ntaRVcW.exe

C:\Windows\System\ntaRVcW.exe

C:\Windows\System\piHvpOE.exe

C:\Windows\System\piHvpOE.exe

C:\Windows\System\yftAdbC.exe

C:\Windows\System\yftAdbC.exe

C:\Windows\System\kruDCLd.exe

C:\Windows\System\kruDCLd.exe

C:\Windows\System\eSFUPDb.exe

C:\Windows\System\eSFUPDb.exe

C:\Windows\System\DEWYvHs.exe

C:\Windows\System\DEWYvHs.exe

C:\Windows\System\cKMoTiW.exe

C:\Windows\System\cKMoTiW.exe

C:\Windows\System\zhnexPy.exe

C:\Windows\System\zhnexPy.exe

C:\Windows\System\LlQgkff.exe

C:\Windows\System\LlQgkff.exe

C:\Windows\System\ACBJKNS.exe

C:\Windows\System\ACBJKNS.exe

C:\Windows\System\DZiLhQO.exe

C:\Windows\System\DZiLhQO.exe

C:\Windows\System\QGayTYz.exe

C:\Windows\System\QGayTYz.exe

C:\Windows\System\NEEIfSe.exe

C:\Windows\System\NEEIfSe.exe

C:\Windows\System\nHspBQC.exe

C:\Windows\System\nHspBQC.exe

C:\Windows\System\kMyaoTD.exe

C:\Windows\System\kMyaoTD.exe

C:\Windows\System\UbpjgRW.exe

C:\Windows\System\UbpjgRW.exe

C:\Windows\System\oXsTVbz.exe

C:\Windows\System\oXsTVbz.exe

C:\Windows\System\GZmwXwa.exe

C:\Windows\System\GZmwXwa.exe

C:\Windows\System\FJGOboY.exe

C:\Windows\System\FJGOboY.exe

C:\Windows\System\BsoFqsQ.exe

C:\Windows\System\BsoFqsQ.exe

C:\Windows\System\lewrFAb.exe

C:\Windows\System\lewrFAb.exe

C:\Windows\System\htHykeJ.exe

C:\Windows\System\htHykeJ.exe

C:\Windows\System\QgPHvpu.exe

C:\Windows\System\QgPHvpu.exe

C:\Windows\System\Xravtrx.exe

C:\Windows\System\Xravtrx.exe

C:\Windows\System\VBDBMZj.exe

C:\Windows\System\VBDBMZj.exe

C:\Windows\System\WtNaXAS.exe

C:\Windows\System\WtNaXAS.exe

C:\Windows\System\pjdAAor.exe

C:\Windows\System\pjdAAor.exe

C:\Windows\System\mTYfXEg.exe

C:\Windows\System\mTYfXEg.exe

C:\Windows\System\CiyxJcq.exe

C:\Windows\System\CiyxJcq.exe

C:\Windows\System\DBQEFLh.exe

C:\Windows\System\DBQEFLh.exe

C:\Windows\System\HsQNhRq.exe

C:\Windows\System\HsQNhRq.exe

C:\Windows\System\KMQXWQe.exe

C:\Windows\System\KMQXWQe.exe

C:\Windows\System\KnzkAAm.exe

C:\Windows\System\KnzkAAm.exe

C:\Windows\System\xsBBRWT.exe

C:\Windows\System\xsBBRWT.exe

C:\Windows\System\nVhiPtw.exe

C:\Windows\System\nVhiPtw.exe

C:\Windows\System\BFSbGXz.exe

C:\Windows\System\BFSbGXz.exe

C:\Windows\System\fpnRcgc.exe

C:\Windows\System\fpnRcgc.exe

C:\Windows\System\lNTNZsQ.exe

C:\Windows\System\lNTNZsQ.exe

C:\Windows\System\pZlxtGI.exe

C:\Windows\System\pZlxtGI.exe

C:\Windows\System\URdAMte.exe

C:\Windows\System\URdAMte.exe

C:\Windows\System\rEOceKe.exe

C:\Windows\System\rEOceKe.exe

C:\Windows\System\cCpsVCf.exe

C:\Windows\System\cCpsVCf.exe

C:\Windows\System\CctTeXR.exe

C:\Windows\System\CctTeXR.exe

C:\Windows\System\qdNCUwF.exe

C:\Windows\System\qdNCUwF.exe

C:\Windows\System\MNyolFC.exe

C:\Windows\System\MNyolFC.exe

C:\Windows\System\UqfqTaK.exe

C:\Windows\System\UqfqTaK.exe

C:\Windows\System\zOxNffD.exe

C:\Windows\System\zOxNffD.exe

C:\Windows\System\KrHfjXb.exe

C:\Windows\System\KrHfjXb.exe

C:\Windows\System\axqcofn.exe

C:\Windows\System\axqcofn.exe

C:\Windows\System\PYJvyRK.exe

C:\Windows\System\PYJvyRK.exe

C:\Windows\System\IAbidQX.exe

C:\Windows\System\IAbidQX.exe

C:\Windows\System\xtdxmeP.exe

C:\Windows\System\xtdxmeP.exe

C:\Windows\System\hjRXxHa.exe

C:\Windows\System\hjRXxHa.exe

C:\Windows\System\VslEcGQ.exe

C:\Windows\System\VslEcGQ.exe

C:\Windows\System\lcEZXOc.exe

C:\Windows\System\lcEZXOc.exe

C:\Windows\System\KHdEelL.exe

C:\Windows\System\KHdEelL.exe

C:\Windows\System\fRDIcmh.exe

C:\Windows\System\fRDIcmh.exe

C:\Windows\System\JuBBrqK.exe

C:\Windows\System\JuBBrqK.exe

C:\Windows\System\wIyDfYg.exe

C:\Windows\System\wIyDfYg.exe

C:\Windows\System\cVyWqKF.exe

C:\Windows\System\cVyWqKF.exe

C:\Windows\System\dArCzwd.exe

C:\Windows\System\dArCzwd.exe

C:\Windows\System\yxURVCk.exe

C:\Windows\System\yxURVCk.exe

C:\Windows\System\UiEjLEH.exe

C:\Windows\System\UiEjLEH.exe

C:\Windows\System\JtLwYTu.exe

C:\Windows\System\JtLwYTu.exe

C:\Windows\System\ysmVLPh.exe

C:\Windows\System\ysmVLPh.exe

C:\Windows\System\guCJQkU.exe

C:\Windows\System\guCJQkU.exe

C:\Windows\System\dCrWxPY.exe

C:\Windows\System\dCrWxPY.exe

C:\Windows\System\XehSJfm.exe

C:\Windows\System\XehSJfm.exe

C:\Windows\System\fbJBKcI.exe

C:\Windows\System\fbJBKcI.exe

C:\Windows\System\LQyRVUo.exe

C:\Windows\System\LQyRVUo.exe

C:\Windows\System\QLpIghj.exe

C:\Windows\System\QLpIghj.exe

C:\Windows\System\bjQikRf.exe

C:\Windows\System\bjQikRf.exe

C:\Windows\System\rkpZdEq.exe

C:\Windows\System\rkpZdEq.exe

C:\Windows\System\jGOdKPv.exe

C:\Windows\System\jGOdKPv.exe

C:\Windows\System\UVmiHGc.exe

C:\Windows\System\UVmiHGc.exe

C:\Windows\System\rjJTAzb.exe

C:\Windows\System\rjJTAzb.exe

C:\Windows\System\egRNnSH.exe

C:\Windows\System\egRNnSH.exe

C:\Windows\System\mpITwrC.exe

C:\Windows\System\mpITwrC.exe

C:\Windows\System\uIUDIvt.exe

C:\Windows\System\uIUDIvt.exe

C:\Windows\System\lseEqur.exe

C:\Windows\System\lseEqur.exe

C:\Windows\System\WzIMZsM.exe

C:\Windows\System\WzIMZsM.exe

C:\Windows\System\ckVhlCp.exe

C:\Windows\System\ckVhlCp.exe

C:\Windows\System\jsDEVWs.exe

C:\Windows\System\jsDEVWs.exe

C:\Windows\System\sOTZcWo.exe

C:\Windows\System\sOTZcWo.exe

C:\Windows\System\BxuWcgp.exe

C:\Windows\System\BxuWcgp.exe

C:\Windows\System\awxyiDl.exe

C:\Windows\System\awxyiDl.exe

C:\Windows\System\cwjuaQi.exe

C:\Windows\System\cwjuaQi.exe

C:\Windows\System\AWgwfnr.exe

C:\Windows\System\AWgwfnr.exe

C:\Windows\System\XlwSZOH.exe

C:\Windows\System\XlwSZOH.exe

C:\Windows\System\lGzqLTH.exe

C:\Windows\System\lGzqLTH.exe

C:\Windows\System\BEUwZjs.exe

C:\Windows\System\BEUwZjs.exe

C:\Windows\System\oDfpqYn.exe

C:\Windows\System\oDfpqYn.exe

C:\Windows\System\baUbIcT.exe

C:\Windows\System\baUbIcT.exe

C:\Windows\System\dyTuALF.exe

C:\Windows\System\dyTuALF.exe

C:\Windows\System\TmLytCH.exe

C:\Windows\System\TmLytCH.exe

C:\Windows\System\otdnOtB.exe

C:\Windows\System\otdnOtB.exe

C:\Windows\System\CzBAltL.exe

C:\Windows\System\CzBAltL.exe

C:\Windows\System\VpPvfGb.exe

C:\Windows\System\VpPvfGb.exe

C:\Windows\System\RfLxTtf.exe

C:\Windows\System\RfLxTtf.exe

C:\Windows\System\yXsoZDR.exe

C:\Windows\System\yXsoZDR.exe

C:\Windows\System\WMevacF.exe

C:\Windows\System\WMevacF.exe

C:\Windows\System\dFCJYjH.exe

C:\Windows\System\dFCJYjH.exe

C:\Windows\System\PYsxZss.exe

C:\Windows\System\PYsxZss.exe

C:\Windows\System\cHqWUYd.exe

C:\Windows\System\cHqWUYd.exe

C:\Windows\System\ayoOqWp.exe

C:\Windows\System\ayoOqWp.exe

C:\Windows\System\SVbGqBW.exe

C:\Windows\System\SVbGqBW.exe

C:\Windows\System\ERGZiWe.exe

C:\Windows\System\ERGZiWe.exe

C:\Windows\System\mQSKoYo.exe

C:\Windows\System\mQSKoYo.exe

C:\Windows\System\BMvsldF.exe

C:\Windows\System\BMvsldF.exe

C:\Windows\System\ynXuBpm.exe

C:\Windows\System\ynXuBpm.exe

C:\Windows\System\CefcRPN.exe

C:\Windows\System\CefcRPN.exe

C:\Windows\System\OeeZgfL.exe

C:\Windows\System\OeeZgfL.exe

C:\Windows\System\VeQMPtz.exe

C:\Windows\System\VeQMPtz.exe

C:\Windows\System\HRfYzRs.exe

C:\Windows\System\HRfYzRs.exe

C:\Windows\System\RKHeqlb.exe

C:\Windows\System\RKHeqlb.exe

C:\Windows\System\vdMHENL.exe

C:\Windows\System\vdMHENL.exe

C:\Windows\System\eIyGvhf.exe

C:\Windows\System\eIyGvhf.exe

C:\Windows\System\fUlHINX.exe

C:\Windows\System\fUlHINX.exe

C:\Windows\System\UeUQNJQ.exe

C:\Windows\System\UeUQNJQ.exe

C:\Windows\System\vCzXiVx.exe

C:\Windows\System\vCzXiVx.exe

C:\Windows\System\UMSmefO.exe

C:\Windows\System\UMSmefO.exe

C:\Windows\System\wXocDrM.exe

C:\Windows\System\wXocDrM.exe

C:\Windows\System\BDzOtRP.exe

C:\Windows\System\BDzOtRP.exe

C:\Windows\System\XFqDIQW.exe

C:\Windows\System\XFqDIQW.exe

C:\Windows\System\qguuTtU.exe

C:\Windows\System\qguuTtU.exe

C:\Windows\System\jKysZqJ.exe

C:\Windows\System\jKysZqJ.exe

C:\Windows\System\drDWQSp.exe

C:\Windows\System\drDWQSp.exe

C:\Windows\System\FgPkrbl.exe

C:\Windows\System\FgPkrbl.exe

C:\Windows\System\CwJkRZB.exe

C:\Windows\System\CwJkRZB.exe

C:\Windows\System\GMebZXP.exe

C:\Windows\System\GMebZXP.exe

C:\Windows\System\zTxfqbj.exe

C:\Windows\System\zTxfqbj.exe

C:\Windows\System\jvegxKU.exe

C:\Windows\System\jvegxKU.exe

C:\Windows\System\xYCDHDQ.exe

C:\Windows\System\xYCDHDQ.exe

C:\Windows\System\FVCYHRF.exe

C:\Windows\System\FVCYHRF.exe

C:\Windows\System\BEWofyz.exe

C:\Windows\System\BEWofyz.exe

C:\Windows\System\fFagZJs.exe

C:\Windows\System\fFagZJs.exe

C:\Windows\System\wpGExTH.exe

C:\Windows\System\wpGExTH.exe

C:\Windows\System\thsGsTD.exe

C:\Windows\System\thsGsTD.exe

C:\Windows\System\yiRbqLM.exe

C:\Windows\System\yiRbqLM.exe

C:\Windows\System\wfPLeVV.exe

C:\Windows\System\wfPLeVV.exe

C:\Windows\System\jrsnIrc.exe

C:\Windows\System\jrsnIrc.exe

C:\Windows\System\vsEbame.exe

C:\Windows\System\vsEbame.exe

C:\Windows\System\OdOITkx.exe

C:\Windows\System\OdOITkx.exe

C:\Windows\System\XlchhRf.exe

C:\Windows\System\XlchhRf.exe

C:\Windows\System\GtHINkK.exe

C:\Windows\System\GtHINkK.exe

C:\Windows\System\ffFPZaD.exe

C:\Windows\System\ffFPZaD.exe

C:\Windows\System\blnQKrY.exe

C:\Windows\System\blnQKrY.exe

C:\Windows\System\BOJBLdp.exe

C:\Windows\System\BOJBLdp.exe

C:\Windows\System\FniFmFN.exe

C:\Windows\System\FniFmFN.exe

C:\Windows\System\CZLkTgz.exe

C:\Windows\System\CZLkTgz.exe

C:\Windows\System\gJKGkKZ.exe

C:\Windows\System\gJKGkKZ.exe

C:\Windows\System\hZzFvgn.exe

C:\Windows\System\hZzFvgn.exe

C:\Windows\System\DafljTl.exe

C:\Windows\System\DafljTl.exe

C:\Windows\System\xiLDsxz.exe

C:\Windows\System\xiLDsxz.exe

C:\Windows\System\XXruZea.exe

C:\Windows\System\XXruZea.exe

C:\Windows\System\ZzVVWln.exe

C:\Windows\System\ZzVVWln.exe

C:\Windows\System\pqwdZvM.exe

C:\Windows\System\pqwdZvM.exe

C:\Windows\System\FmFycaP.exe

C:\Windows\System\FmFycaP.exe

C:\Windows\System\AryYIwQ.exe

C:\Windows\System\AryYIwQ.exe

C:\Windows\System\JancRFg.exe

C:\Windows\System\JancRFg.exe

C:\Windows\System\vfWmxVZ.exe

C:\Windows\System\vfWmxVZ.exe

C:\Windows\System\CSBKQoZ.exe

C:\Windows\System\CSBKQoZ.exe

C:\Windows\System\WrwYQpj.exe

C:\Windows\System\WrwYQpj.exe

C:\Windows\System\unCDxSb.exe

C:\Windows\System\unCDxSb.exe

C:\Windows\System\WTRCehY.exe

C:\Windows\System\WTRCehY.exe

C:\Windows\System\wgHAwWT.exe

C:\Windows\System\wgHAwWT.exe

C:\Windows\System\hSoNbEQ.exe

C:\Windows\System\hSoNbEQ.exe

C:\Windows\System\ktcSKRL.exe

C:\Windows\System\ktcSKRL.exe

C:\Windows\System\WyYPLiS.exe

C:\Windows\System\WyYPLiS.exe

C:\Windows\System\YJdRhqs.exe

C:\Windows\System\YJdRhqs.exe

C:\Windows\System\jEOarBU.exe

C:\Windows\System\jEOarBU.exe

C:\Windows\System\IMiNfUZ.exe

C:\Windows\System\IMiNfUZ.exe

C:\Windows\System\GDDoAnL.exe

C:\Windows\System\GDDoAnL.exe

C:\Windows\System\KgeowLy.exe

C:\Windows\System\KgeowLy.exe

C:\Windows\System\tfqwUtz.exe

C:\Windows\System\tfqwUtz.exe

C:\Windows\System\KFmOzFi.exe

C:\Windows\System\KFmOzFi.exe

C:\Windows\System\ycZnRIH.exe

C:\Windows\System\ycZnRIH.exe

C:\Windows\System\EFqWaEe.exe

C:\Windows\System\EFqWaEe.exe

C:\Windows\System\EenAsyk.exe

C:\Windows\System\EenAsyk.exe

C:\Windows\System\LbePPzp.exe

C:\Windows\System\LbePPzp.exe

C:\Windows\System\IIYdIJo.exe

C:\Windows\System\IIYdIJo.exe

C:\Windows\System\rCsBYEc.exe

C:\Windows\System\rCsBYEc.exe

C:\Windows\System\CRUEWly.exe

C:\Windows\System\CRUEWly.exe

C:\Windows\System\wFrWTPj.exe

C:\Windows\System\wFrWTPj.exe

C:\Windows\System\boNvPHE.exe

C:\Windows\System\boNvPHE.exe

C:\Windows\System\QzAnilG.exe

C:\Windows\System\QzAnilG.exe

C:\Windows\System\ZSPEYGg.exe

C:\Windows\System\ZSPEYGg.exe

C:\Windows\System\FCCTFaR.exe

C:\Windows\System\FCCTFaR.exe

C:\Windows\System\YYyjxtS.exe

C:\Windows\System\YYyjxtS.exe

C:\Windows\System\OggllJj.exe

C:\Windows\System\OggllJj.exe

C:\Windows\System\BYAiQtT.exe

C:\Windows\System\BYAiQtT.exe

C:\Windows\System\BXXdMNT.exe

C:\Windows\System\BXXdMNT.exe

C:\Windows\System\VGoaskp.exe

C:\Windows\System\VGoaskp.exe

C:\Windows\System\FDzWkkh.exe

C:\Windows\System\FDzWkkh.exe

C:\Windows\System\mlVHWrj.exe

C:\Windows\System\mlVHWrj.exe

C:\Windows\System\SWnERBv.exe

C:\Windows\System\SWnERBv.exe

C:\Windows\System\edIaqjX.exe

C:\Windows\System\edIaqjX.exe

C:\Windows\System\IlVqBCs.exe

C:\Windows\System\IlVqBCs.exe

C:\Windows\System\NgJRYJz.exe

C:\Windows\System\NgJRYJz.exe

C:\Windows\System\vbBCIzM.exe

C:\Windows\System\vbBCIzM.exe

C:\Windows\System\gcpzmvo.exe

C:\Windows\System\gcpzmvo.exe

C:\Windows\System\jcPowhn.exe

C:\Windows\System\jcPowhn.exe

C:\Windows\System\naeEhEl.exe

C:\Windows\System\naeEhEl.exe

C:\Windows\System\AotRvXk.exe

C:\Windows\System\AotRvXk.exe

C:\Windows\System\UlDmQZM.exe

C:\Windows\System\UlDmQZM.exe

C:\Windows\System\SReHVcj.exe

C:\Windows\System\SReHVcj.exe

C:\Windows\System\BYWTsGw.exe

C:\Windows\System\BYWTsGw.exe

C:\Windows\System\paisjSx.exe

C:\Windows\System\paisjSx.exe

C:\Windows\System\EoZeOkd.exe

C:\Windows\System\EoZeOkd.exe

C:\Windows\System\WFPtSnw.exe

C:\Windows\System\WFPtSnw.exe

C:\Windows\System\RMrYEPG.exe

C:\Windows\System\RMrYEPG.exe

C:\Windows\System\RjjzWPX.exe

C:\Windows\System\RjjzWPX.exe

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 13500 -s 248

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	133.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	35.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	153.141.79.40.in-addr.arpa	udp

Files

memory/2136-0-0x00007FF63A8E0000-0x00007FF63AC34000-memory.dmp

memory/2136-1-0x0000022940080000-0x0000022940090000-memory.dmp

C:\Windows\System\kRXgzej.exe

MD5	4f973009d744bd89ec6a13143aa6cddc
SHA1	9a5cbbb78d40f2095a225bd6ff0fabcfe9804ad7
SHA256	296af30a282aec85c92a5b721f24e599fe25c662175dbee1a44e9487017c9896
SHA512	324c0be9b7e3e0ce09f49565b914b35c7bdf1e655631e6f0671129b76f63ef9699a383e06e597045a8c2e5d4f9ba38e9f337390bd8cdeb7f6a37119f883c13ba

C:\Windows\System\dsslWdm.exe

MD5	100202c5027d63be7993ef887a50c7af
SHA1	392fa6d901cec6945c6d499281f359ce83231a0e
SHA256	6f98b27f44fa3f9ff6e83b192cb8ed211b6e7d2da81d35f59af230630be7f1bb
SHA512	fd95f537ccad25b9b62ab3a5349272d24e12c2b500785f0e4c7d6a49ed8b574e2f3b6d2118d6324bbe89ff7e8ff759b045429da1e9be6567e6c5ebd15287c4a2

memory/1908-24-0x00007FF617B20000-0x00007FF617E74000-memory.dmp

memory/4100-45-0x00007FF605420000-0x00007FF605774000-memory.dmp

C:\Windows\System\JTfAAoc.exe

MD5	e5d8510e5e701283e0a3714243b9bfa1
SHA1	738b30b79e4dfe8d54dcc3615316f732fbf37112
SHA256	769be1d4c40f1d1915fbdd077be85ccc8b5f2883f320ae0cd9a02d33a5d6e45a
SHA512	a0ff79045e38eae536299b5a590477536b9e8218a8298cae04d720921de2cfcc439024a8cb0a353eb7c71e04a47f165eba729d65437b55b51e64f29015d83e44

C:\Windows\System\cEHLAZi.exe

MD5	153307c6c5edacc40369ce8f9687ed98
SHA1	f1b4dc77a5bf7d65dffc66b66444371be7135729
SHA256	b28a7be85781a74961ce12b0075f3553ff3510ddb83a069644914e0df51a609a
SHA512	ca3c6a167e36116e168b4ec33ed9ba9d0365179ae7e7854e5d8d8c6e185721f8ff276c50b379da4991c1e48eb09310b4c568c27093f3d93da1108156bda0f7e7

C:\Windows\System\EMQDwak.exe

MD5	e7fd5de9dd067d71332bf349875f62c4
SHA1	7079257886230d745db67d3d9d4ac325ab66891c
SHA256	5f4380a1de9811339599d48afa098c29ac4b66583300dca822c5409f3345af07
SHA512	c5a028bec9bd50692b0ffc3a63cd7dc7237206be0e43ecbf05b8a1bf9068941def9a9ed63712161783491e2193febbc660236d5154e89755e194776660785f08

C:\Windows\System\omQqzJk.exe

MD5	03969940df07bb2a2e3b0bc898f35d6e
SHA1	bcdc3f288d14d620bde946bbfd99845d6f8221e8
SHA256	3777954c37284bdfa1824a51a107139b40f29575506c7c9b2313426366c538a8
SHA512	2d46da1a9dee7eb1b523d1b773d2280a16401390fae8b13a5d6fc4ed3b3eb0453e40023bd13899a0259d0d32e53d6735ae0e3c07fe2de5d9962fb57add445d4b

C:\Windows\System\ufnjAOe.exe

MD5	114888a39a5691788f8c1464c954ae2e
SHA1	b896db494e3c76f2686abc95ca5fcc6359e358d4
SHA256	599c5f640f663d5f92635d4306fe4072519e4a79ad556ff46cc459b7d9467d04
SHA512	ba59a4968a38e57fdf59c42e744d0cee0d04b5b0f939e739f11e4245751c1dadd74bf31bfa156ce45b6b89638bf4fa3a6002f04afa60983683e5eb328a69469c

memory/3316-192-0x00007FF680D80000-0x00007FF6810D4000-memory.dmp

memory/2768-213-0x00007FF619180000-0x00007FF6194D4000-memory.dmp

memory/2444-220-0x00007FF702FE0000-0x00007FF703334000-memory.dmp

memory/1904-224-0x00007FF6DFA30000-0x00007FF6DFD84000-memory.dmp

memory/5028-223-0x00007FF677080000-0x00007FF6773D4000-memory.dmp

memory/2528-222-0x00007FF6F34E0000-0x00007FF6F3834000-memory.dmp

memory/1716-221-0x00007FF761090000-0x00007FF7613E4000-memory.dmp

memory/1580-219-0x00007FF742850000-0x00007FF742BA4000-memory.dmp

memory/4260-218-0x00007FF6030B0000-0x00007FF603404000-memory.dmp

memory/2064-217-0x00007FF645930000-0x00007FF645C84000-memory.dmp

memory/3192-216-0x00007FF793870000-0x00007FF793BC4000-memory.dmp

memory/4556-215-0x00007FF79B350000-0x00007FF79B6A4000-memory.dmp

memory/4524-214-0x00007FF60C140000-0x00007FF60C494000-memory.dmp

memory/3056-212-0x00007FF7EA4B0000-0x00007FF7EA804000-memory.dmp

memory/3768-211-0x00007FF67CF80000-0x00007FF67D2D4000-memory.dmp

memory/1440-203-0x00007FF679540000-0x00007FF679894000-memory.dmp

memory/4364-202-0x00007FF6E3F40000-0x00007FF6E4294000-memory.dmp

memory/5104-191-0x00007FF7EF810000-0x00007FF7EFB64000-memory.dmp

C:\Windows\System\EIEhmPw.exe

MD5	56c664b73c8eff710cac59837d7ff3ee
SHA1	7531824dabb14af89c11409593faa507343cfb2c
SHA256	9b155f1e7eb7fe7fdcca877ab7582d94b3ca715d6f693d3c29757b9abe093366
SHA512	f088342bd8ce9baa21fc9ae180333f3bf480bd03944fcf477745244f0df87e7522d19d8367c9f61fce6c358fbcdf1bd3c2cef43ce27af8e610fa4b86d55ce18a

C:\Windows\System\WaJaisJ.exe

MD5	9a1daaab4da20e503fd55db381fbedb9
SHA1	c09361ab28a97f4f581bc0b78de097e6848debdf
SHA256	fd7be51dd9f1d151a26ee6bc887060f16f26098dfa0c10bb6388a17469fd2e88
SHA512	d979aabfcf0cbf2a56eea88096d6e4da3be3cb224941c13bdf02605408ac4ec7340a6683bf13a015764c4ded4127fe2703859c3df2166dd6c85ad1ba041a0868

memory/4028-182-0x00007FF771800000-0x00007FF771B54000-memory.dmp

C:\Windows\System\NpXsEUJ.exe

MD5	1bd283059905886d6cb07848224797fd
SHA1	f745d8e41a8ffa44e89b9a3341d1b6d22f96d813
SHA256	560a8dfe0a3ffd0334bfb85d05ea8e248097f63acbd1b008ff9e4595658e055b
SHA512	77c72864896eb8f44174e92c11196e16d7994345e8f43c47e0ebc2e46df3368a6f44bd130869580bd3ec80ca60fe1ef3dbc50feca0dc61728af387fcef2591e3

C:\Windows\System\MWtZnsU.exe

MD5	f2ef6e3b9cc6352affbd376eb706b96e
SHA1	42f96eaea3df52b690524ce95f930110dfc79e65
SHA256	e62dac261da995130110048028464d13b4321fe8daa0dbe619b750404482df29
SHA512	7c0fac09ddcc2c7270bb8468a2f9500071f8eca16b1ffd94a9fa97484bd48171e448b368453beb7cb597a93e7dee90779f314845fef640bcbae172f584552a9a

C:\Windows\System\jFXJquj.exe

MD5	ac9e25d7041b0a89ed82132017a921af
SHA1	433d9597046a1211841de7657a13d7fe0889d2af
SHA256	fc78d8b07d443e386d36f34ccb0454ce172133bce17f8bac0ae2d47194fdd1a8
SHA512	f4e31b7b53eea6d2236ed35834eac78bd103d2f6d689b988b800a619a2d78e6b16a45c4d1731bcc7c184a1cecf5e385de7d1f15b5c56519769836a5e65416963

C:\Windows\System\TsNSlPh.exe

MD5	50606ea7a20680cbc72e0cfacf1e6804
SHA1	d40c8ba7c685de068f4a630c291445072411fc47
SHA256	318b2944b2a1969c1f8ea840d3545fc5163c4e388af8e80763c82e3688f86526
SHA512	0552b0f8fcc358c6883bcd0672d6283c5159c41d193d79712c7befa48a64b6ad2c8d17e5e7daf854562e499f96511f33b6d38b045327e829bc526ee44bf979d3

C:\Windows\System\MyvlURt.exe

MD5	c6c4aa7aeb5d388284fa183b5d0bbc11
SHA1	34207fb3f4ff340204ba541ab0770163dddaf6ea
SHA256	9668a4ca306248a6d7c594d52cc12f09186c8c27fdd6d5719758fa5696606480
SHA512	c5673c1bd006e92c638f7454ae74710ea902f4b3d3d5d2e4d8a897f36cffee364a39d114b8e7ce36566dea09d52adea231d60a7efafe99ccb5c44db447353176

C:\Windows\System\ejEKUfD.exe

MD5	81921be0bf5d80f19ddaca7438ca65b5
SHA1	af594c87654d45413e9ff5168af4f5bd2cdfdd02
SHA256	6713de97b38fe62f795cba2810b2bb871ea04223bb073d2567aea2221111b29b
SHA512	d9e977252a6d2d559b672a75fd0278b40e69e635380ec1f9f1c71f3ff4039b1fbfccb7a1eef4001e12818c41c4d3c5ee18cb570e00d632864098c679197dbdd2

C:\Windows\System\xvaDiBl.exe

MD5	70139aa82331e54f825f13eb7a40d68d
SHA1	57e72f41e6da8bcc9f521c04d8dc605bfc399480
SHA256	38235c478c566a4f8e85745cecc9bc9df7bd4babdb919bbba399f6665d2f6ead
SHA512	aea2134327f8feef4280a9d2ec76cfd1a236266e17061396cfa70ebdc3de704be9071461eac71dce95cc8fa1a1aad646f59e50ab4c8ce5e37350d46790efc969

memory/2944-153-0x00007FF6C7700000-0x00007FF6C7A54000-memory.dmp

memory/724-150-0x00007FF6C5290000-0x00007FF6C55E4000-memory.dmp

C:\Windows\System\Ojhjygt.exe

MD5	05a8024a27271452e7c6c0d9133e1162
SHA1	61a9347f90b18ece5cd3e180bcd7cc1ea80bbf01
SHA256	2dfa4b4329e209f2c91bf7a9c86881dc8779dba2717bca57172f94b1ebb7027f
SHA512	a945e860a851475ddd2ae61e6bfe19c7076cf984d04878ff722968db5c4dd3e8d445650d13011871969465464575b36bcf89cd9afc3b8bb9e6f4179b9d6ef087

C:\Windows\System\lhqsshq.exe

MD5	52f5cd1819a241ed7b9397e88219d73c
SHA1	c8d078910c466e04899a197889e23c1c91c7fc72
SHA256	e0247db49ddfd21fda7d238957c5bb1b4b452db007ad82efbff449e599d3fa1d
SHA512	2cbdfd686ee22efe24c0c5c97a642e2fad502f1aaf43729c1b91e75d291b38d2bd618560e995254a36001de4b0b0de49c33865cc4e5eedc48a26862b12d08134

C:\Windows\System\XbonLZr.exe

MD5	dfb2fe6033b05532f23252cd00b30c4f
SHA1	6e4f056b6be9ded3d6973dd37fd582427a28a79d
SHA256	82c0151bd06310523e939749026b3518ce6a8f2edbbf4a5c93bd011f4db4d10d
SHA512	172adbd1c9dc92466bc113bc2704ee32c6467e37b6d2af6825571efff3958cce9def8be0010a8c1c0291b0e21340dd4fc0294689025a67c3b2143b348823c024

C:\Windows\System\OyvjHig.exe

MD5	7d7462337c58bd7a1ba15124c4e94582
SHA1	b32c0d6de3aa51516c7f7d3f9c1ac13a0654b9b0
SHA256	a33fd40e5f1c5580e6df24710ecd4b9dda0470946c29869efdc30a6bfee933ac
SHA512	68c477e1002a5136dd98d95ae6b23e9593321beacb094a4b1abf0fa45d51506327fd7ce7367e452cc7e87624674f6885c93f2df10224ab9809a9d028c6eadb96

C:\Windows\System\WehpFIH.exe

MD5	c41194a3e3638ca636a2d03eb1ea281b
SHA1	96c781bd0198394abbd912b7ed2c3512bb17a214
SHA256	7d2661d86a82cf4960b6b18d6b7e054267d196f62867b9d85f3b55abfa9f20c3
SHA512	5734142ed62b6ac58a35eafb77f153367f836c8b8f1740ab95608321973e30dac0672e24acb7a36202847e8934d842b4b47e891ad9e98612dc37fc4e2a7b3806

C:\Windows\System\EljmcwV.exe

MD5	64a4eb5904eca8eebdd19d2680297d79
SHA1	47453eea52e6dc66d856250375af92e926895ef6
SHA256	a3207725891709abd9622503fab5e3e8995931fc3c9f97798a3a642dc1fd8bba
SHA512	8e9c7dc18b30a9e71e3eaf6f837ae0df53d1148e79fd9c5ae26bf30b44189510c8eb480fc8c01c6084beac9934a79c4db8768febbe13c6db38a1afb401f52868

C:\Windows\System\PWWVbKd.exe

MD5	864f3584bf2c4b47099de45a16c2e4c3
SHA1	c46f50733521f7ab71a0a627f55bbb7179882e5a
SHA256	9a602b2d2694f643ccbe4bab3a1e54e07700ae664eee99b0be5754c790d5f00a
SHA512	0edecb9df48614a2d8940b397387cc6203200ecc8b2a0c2c53ac8edc29b9228436bbdd0f287ad80a1ddf799f4a2327ef5a95dd69f993024cad191615f4bea036

memory/1232-127-0x00007FF6370E0000-0x00007FF637434000-memory.dmp

C:\Windows\System\gyWszpf.exe

MD5	1cb4022dd630266c2b633c0eefc16731
SHA1	25ccd8c22398f9cbea32a670792393152d2f0b3c
SHA256	81ce94ac3b83527c15cb7009b0692d2d74eedeeb13a10474e4828c5155838b1d
SHA512	716eaac2130a46b04e83edccf589a54d97c6fbc69ecb3ecea7a7a154b29d052773d40e9fbeb671f8ef7ecba374de77777abe17ef7919cb2e8b7964615de37318

C:\Windows\System\MHTVTmQ.exe

MD5	9dc8e7c7c9d7281dfff3eeaec83ed915
SHA1	077f55f4af5e998dc5447e196add4869f34591c3
SHA256	c0f1457970709e09641e35ca94a43edcef3444a41d8bae53620e5802f2d96696
SHA512	651dacd80c7aacdbbcf67e25ab7246d4ae2fa38300db03b8e6ef1b711f511f2749957adece6fbc26a923455b5202be103f84a6ac8164c6f2ac8fb8343a35c750

C:\Windows\System\pGMGwbz.exe

MD5	54c4aa2202a8110a66098c34d8d61f81
SHA1	f5e9c6a8c0350053c0d81973bfcddab611e83ecf
SHA256	4136706d2ccdc68de622b96ac7143fae8d416d3c25ada61a9f03b17edf7323a2
SHA512	5368c7a9431b43978f2b522b6b5386dcc10b71de82fa04ce0bae05c621ceb216789072c25585b37a2de1b704c9ca95f0111c6cbe444e0454d0abc3215fcb1e44

C:\Windows\System\OcLdeZH.exe

MD5	0f228f02c38a053aed7fcf232fb0c8b3
SHA1	2ef609e4fb14ae8f88eabac0f681f59791f5a02e
SHA256	cbbece0d012d989516c14dc09598e14f57be360eadc62acd5b6a90b77e887d3c
SHA512	c8ef7542fd743e014283c6234ed349db5221f6581f2ab7c3782ed2d4f1156a1afabeff6d1ff59f523085695e526f1919d87919e5fc731b22cd1c4e537c8e479d

memory/796-104-0x00007FF6B8950000-0x00007FF6B8CA4000-memory.dmp

memory/2276-97-0x00007FF7A4810000-0x00007FF7A4B64000-memory.dmp

C:\Windows\System\rTBCvJi.exe

MD5	f405cfd62ea96af8f316564cc3898952
SHA1	c1dcccbb5af77e1851aebdd93902ec8b9d390107
SHA256	2e053ce8758c6f27e8fe07620211b4bdc539fbcee5bfe138c0e93a5a84246563
SHA512	03fbd37c8ebde9e1ee1e0de2454eeb60eaa9fd53e4d497b6c3914a170198d698aeddfc41ef194332f54fed4682e3ae1c8313f91f8fd03e0367681315c05aaba2

C:\Windows\System\jSlYqqP.exe

MD5	0ca244d5b63541048e8ee0a0e41a0872
SHA1	7fe1b23f739425d02e60806b06f06caa31a37e4e
SHA256	2a2416e1b3c65dac323fe2a712d30b56dddd8849d48edf031d34eb7ec587372c
SHA512	7e7679bb83fb42e63e27daacf6741939a443cf2aec7fec853b140479ef42de8931e32ad6867b5f0c42c36ae66c388da2475cd69ff7d2ad529bb75bfa4d236df9

C:\Windows\System\obPYeDa.exe

MD5	60bced04c25e404b9c6725c7b95ebb11
SHA1	983a2367bda232e0727fc62ae0fdb94d3d48b62e
SHA256	d439d737aa75b7dd971758a21b772c52d216efaf56c7e6e8826eb26e122e567e
SHA512	d7bb4bb411d158e6707b1af3c6ac1d916d003da07b800d6c8fd9a6727856c0361dcae618792e001f027fe79b254c91dfb3b8530a4834c8948ce5486aff008a1b

C:\Windows\System\zEujyYj.exe

MD5	3225c316d4e7c16801ed3bd3e5be7d82
SHA1	7d43cc383bb590a4d2d221c891f3ebe55103d534
SHA256	feb0e2c266c09cee601ac9dfca1a286968f1b0f6b22f8def89c80745113397b0
SHA512	fa9d36eb02a5b3d51bb800895989084d8741b98ab9872b71fb2f8e66e771a7f0d8726029c034bb692b9391a5eca984d8e416372c3118f6f4572d697918ea64d6

C:\Windows\System\GpzAabu.exe

MD5	1acd6f6ccf4f396ddd8ce8c1fd6e0344
SHA1	e039f6f7188c448c74e9a1852495b4ba6e1f7fc1
SHA256	81726d2b3f6bf7747a8f6621e5da496285fe5eca659435b6e331430134b7aafa
SHA512	4bd909a2337dea85c9cb9817d5ab79ff4ce62ac899b1bbe5925b0f7ffbe24c1b9f5047c8ad888efd828408069530766133c935ddcb86aff1efc535c45fddc84b

C:\Windows\System\dgjOBFB.exe

MD5	991b642b71ccd4b0b404eb6ecf7c40df
SHA1	60007e02eb289d62a96e51f49f278697922ff673
SHA256	f5d8fd02d74d14dbdb6c0babd4e86a5b4a5d17a2911bf196034032158b92d5be
SHA512	efcb0c29440e636d84a2df487c26790917836ab9ca6330c17e3046d174d0390c18e5a88ac6b3e578dcb1f4ee7d3945735732f5e3ca579cf5a5c514d3b1ebfaf1

memory/2848-68-0x00007FF7BAB20000-0x00007FF7BAE74000-memory.dmp

memory/1724-50-0x00007FF7FF980000-0x00007FF7FFCD4000-memory.dmp

C:\Windows\System\fDVKVkm.exe

MD5	2e4dc4f23b648f6b857142d0714ffef4
SHA1	caf529625a85e16b7721237cad2a9ccfb0eaf90c
SHA256	aab996cd2ff58ffbc7a588fbb34236d9f5359abb756e7c60d5305049ebbceac6
SHA512	fdfc269f1b26bdb9b165f51f2359229a8a512808d62a91024f0ae6e9daf8cdeb8d59ffb197ccd4ac96568e454dfa6ef2879264872d254436db1c041ee3e0616c

C:\Windows\System\XjYCjmk.exe

MD5	143067653ed6004fa7390474b5be72fc
SHA1	4e23dcc5eb396dfe59752a9d7cc073c25102f069
SHA256	c2ddf640ee0ab88520954a1cdf4d9b14ee2956ed234054b4a01614d50d2309c7
SHA512	2fc09192b2705684f4e93a39e38bb198da253b817a4fd215a273dc6abfa92283a89a4a8e5a4e21764764ac800c8670640e4299cdba2c7e323277024062e54cc4

C:\Windows\System\SFBPjHp.exe

MD5	9d8164e45572f99d8f63d89013d16c14
SHA1	1a3475f06bfa944ef1b12fe9357230f59afad773
SHA256	07646e609e2bafd5194dc8cf2dc29fa7fc5ecdcf36b4ce98bde5ba851e5499a1
SHA512	c7da8656623fefd62ba7b7c340b0274668429a2e66725b06cdfa2a128b31b503d2d953b49ed427d78c0eb0c3827465d7bad8e415eeec0068a0c8117b272cac28

C:\Windows\System\rRsoBpw.exe

MD5	b9e703b5129ec68bda82fac16dd7a996
SHA1	a10cfc90423ba3d32e7ec3798d4b2b849b76b645
SHA256	d3c83472e7dcfc133c8dca3e62f54829dcc7d4c075e0ca66cfa051e3d5b4b7ea
SHA512	9d0116fa6974c1361833fb2777f2b4b9c02436e1ee577644a8841bb0cf4c2eee5eb97824d4e63d4929b501b9a200ec01ea004f3e790d6bfcd1ebe68db1e79897

memory/4024-10-0x00007FF6D1F80000-0x00007FF6D22D4000-memory.dmp

memory/2136-2092-0x00007FF63A8E0000-0x00007FF63AC34000-memory.dmp

memory/4024-2093-0x00007FF6D1F80000-0x00007FF6D22D4000-memory.dmp

memory/1908-2094-0x00007FF617B20000-0x00007FF617E74000-memory.dmp

memory/4100-2095-0x00007FF605420000-0x00007FF605774000-memory.dmp

memory/2848-2096-0x00007FF7BAB20000-0x00007FF7BAE74000-memory.dmp

memory/724-2097-0x00007FF6C5290000-0x00007FF6C55E4000-memory.dmp

memory/4024-2098-0x00007FF6D1F80000-0x00007FF6D22D4000-memory.dmp

memory/1908-2099-0x00007FF617B20000-0x00007FF617E74000-memory.dmp

memory/4100-2101-0x00007FF605420000-0x00007FF605774000-memory.dmp

memory/2276-2100-0x00007FF7A4810000-0x00007FF7A4B64000-memory.dmp

memory/2444-2103-0x00007FF702FE0000-0x00007FF703334000-memory.dmp

memory/1724-2102-0x00007FF7FF980000-0x00007FF7FFCD4000-memory.dmp

memory/1580-2106-0x00007FF742850000-0x00007FF742BA4000-memory.dmp

memory/4260-2105-0x00007FF6030B0000-0x00007FF603404000-memory.dmp

memory/4364-2104-0x00007FF6E3F40000-0x00007FF6E4294000-memory.dmp

memory/796-2109-0x00007FF6B8950000-0x00007FF6B8CA4000-memory.dmp

memory/1440-2120-0x00007FF679540000-0x00007FF679894000-memory.dmp

memory/3056-2121-0x00007FF7EA4B0000-0x00007FF7EA804000-memory.dmp

memory/5028-2119-0x00007FF677080000-0x00007FF6773D4000-memory.dmp

memory/3768-2118-0x00007FF67CF80000-0x00007FF67D2D4000-memory.dmp

memory/5104-2117-0x00007FF7EF810000-0x00007FF7EFB64000-memory.dmp

memory/2944-2116-0x00007FF6C7700000-0x00007FF6C7A54000-memory.dmp

memory/3316-2115-0x00007FF680D80000-0x00007FF6810D4000-memory.dmp

memory/2528-2114-0x00007FF6F34E0000-0x00007FF6F3834000-memory.dmp

memory/4556-2113-0x00007FF79B350000-0x00007FF79B6A4000-memory.dmp

memory/724-2112-0x00007FF6C5290000-0x00007FF6C55E4000-memory.dmp

memory/1716-2111-0x00007FF761090000-0x00007FF7613E4000-memory.dmp

memory/1232-2110-0x00007FF6370E0000-0x00007FF637434000-memory.dmp

memory/2848-2108-0x00007FF7BAB20000-0x00007FF7BAE74000-memory.dmp

memory/4028-2107-0x00007FF771800000-0x00007FF771B54000-memory.dmp

memory/2768-2123-0x00007FF619180000-0x00007FF6194D4000-memory.dmp

memory/2064-2125-0x00007FF645930000-0x00007FF645C84000-memory.dmp

memory/3192-2126-0x00007FF793870000-0x00007FF793BC4000-memory.dmp

memory/1904-2124-0x00007FF6DFA30000-0x00007FF6DFD84000-memory.dmp

memory/4524-2122-0x00007FF60C140000-0x00007FF60C494000-memory.dmp

Sample ID	240613-q42vds1flg
Target	817449af1a069071e1d9f5c1337cc730_NeikiAnalytics.exe
SHA256	cce8b1d06912ef6819863db08f7fea5b99bca5ff7caf6b4197564b866780f60e
Tags	miner upx xmrig

Malware Analysis Report

2024-07-28 20:00

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files