Analysis Overview

score

10^/10

SHA256

2272884e7fb6ecc098c10958db86d642ff6b528284d8b259627bbb81c03b5250

Threat Level: Known bad

The file 807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

upx miner xmrig

Xmrig family

XMRig Miner payload

xmrig

XMRig Miner payload

UPX packed file

Executes dropped EXE

Loads dropped DLL

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 13:33

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Xmrig family

xmrig

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 13:33

Reported

2024-06-13 13:36

Platform

win7-20240508-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\lXoKLXx.exe	N/A
N/A	N/A	C:\Windows\System\XljVDoh.exe	N/A
N/A	N/A	C:\Windows\System\NDPpENt.exe	N/A
N/A	N/A	C:\Windows\System\PtmjTXg.exe	N/A
N/A	N/A	C:\Windows\System\linJBYP.exe	N/A
N/A	N/A	C:\Windows\System\quDHuQU.exe	N/A
N/A	N/A	C:\Windows\System\lTdIQES.exe	N/A
N/A	N/A	C:\Windows\System\wSOvWHB.exe	N/A
N/A	N/A	C:\Windows\System\ksWofXE.exe	N/A
N/A	N/A	C:\Windows\System\RziLVFo.exe	N/A
N/A	N/A	C:\Windows\System\GvisYtL.exe	N/A
N/A	N/A	C:\Windows\System\xwkObqk.exe	N/A
N/A	N/A	C:\Windows\System\xnDEJKR.exe	N/A
N/A	N/A	C:\Windows\System\HXNcovF.exe	N/A
N/A	N/A	C:\Windows\System\jEEWKxV.exe	N/A
N/A	N/A	C:\Windows\System\hDxJiJf.exe	N/A
N/A	N/A	C:\Windows\System\bHUAJAY.exe	N/A
N/A	N/A	C:\Windows\System\jKOtqFP.exe	N/A
N/A	N/A	C:\Windows\System\RpCEfrz.exe	N/A
N/A	N/A	C:\Windows\System\yPqxAct.exe	N/A
N/A	N/A	C:\Windows\System\bgJRaRA.exe	N/A
N/A	N/A	C:\Windows\System\UnyGosW.exe	N/A
N/A	N/A	C:\Windows\System\dGlIIqR.exe	N/A
N/A	N/A	C:\Windows\System\YruYdVD.exe	N/A
N/A	N/A	C:\Windows\System\ACRfqnq.exe	N/A
N/A	N/A	C:\Windows\System\kjKOMZo.exe	N/A
N/A	N/A	C:\Windows\System\aVcjSge.exe	N/A
N/A	N/A	C:\Windows\System\ucMUZnc.exe	N/A
N/A	N/A	C:\Windows\System\oIlVSYi.exe	N/A
N/A	N/A	C:\Windows\System\faPaKmJ.exe	N/A
N/A	N/A	C:\Windows\System\odlqneE.exe	N/A
N/A	N/A	C:\Windows\System\dvPEQAR.exe	N/A
N/A	N/A	C:\Windows\System\lFHkLXf.exe	N/A
N/A	N/A	C:\Windows\System\bPPrnPt.exe	N/A
N/A	N/A	C:\Windows\System\jdnQidx.exe	N/A
N/A	N/A	C:\Windows\System\RUyyWrC.exe	N/A
N/A	N/A	C:\Windows\System\SQhQgqu.exe	N/A
N/A	N/A	C:\Windows\System\pLnlLdU.exe	N/A
N/A	N/A	C:\Windows\System\dMRlHwh.exe	N/A
N/A	N/A	C:\Windows\System\uIqUkvO.exe	N/A
N/A	N/A	C:\Windows\System\Sggjnpu.exe	N/A
N/A	N/A	C:\Windows\System\diVaHfC.exe	N/A
N/A	N/A	C:\Windows\System\IkYZCFo.exe	N/A
N/A	N/A	C:\Windows\System\ylmCVAw.exe	N/A
N/A	N/A	C:\Windows\System\fhZzGMq.exe	N/A
N/A	N/A	C:\Windows\System\QMywBRd.exe	N/A
N/A	N/A	C:\Windows\System\AibdJNY.exe	N/A
N/A	N/A	C:\Windows\System\PGVeXWZ.exe	N/A
N/A	N/A	C:\Windows\System\xjjPXaC.exe	N/A
N/A	N/A	C:\Windows\System\NQMFlQj.exe	N/A
N/A	N/A	C:\Windows\System\vMdYdLF.exe	N/A
N/A	N/A	C:\Windows\System\UNGNgIO.exe	N/A
N/A	N/A	C:\Windows\System\WNDfonE.exe	N/A
N/A	N/A	C:\Windows\System\IStEpYZ.exe	N/A
N/A	N/A	C:\Windows\System\NhShZJh.exe	N/A
N/A	N/A	C:\Windows\System\cUMqpBj.exe	N/A
N/A	N/A	C:\Windows\System\GhCXMuM.exe	N/A
N/A	N/A	C:\Windows\System\auImAzt.exe	N/A
N/A	N/A	C:\Windows\System\XysmwAD.exe	N/A
N/A	N/A	C:\Windows\System\KeYMFwI.exe	N/A
N/A	N/A	C:\Windows\System\DLBKXTY.exe	N/A
N/A	N/A	C:\Windows\System\SFLjusv.exe	N/A
N/A	N/A	C:\Windows\System\IprVCPM.exe	N/A
N/A	N/A	C:\Windows\System\CRGLtso.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\ZsPzHvj.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cYVuRbh.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kKxHqbo.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dddkNjZ.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QqCzzFp.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JFwkDSk.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AmgIiJF.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AnWRHpr.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OsRjlwl.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hLHrgGf.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ocKWBYF.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VShiYzt.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RUyyWrC.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fBETTCW.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AlyeKVN.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SOIKSRf.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ymCfvVY.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zrvrfcn.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WHghoUt.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YushNmM.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\egMIUMX.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gqCYavR.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bvGoETC.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\swJrwyI.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nLOwhns.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iLXUHgO.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xwyRFFk.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zrJqrfx.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GwVVuYT.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\suIktVE.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sPJfzPK.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PtmjTXg.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xtBisAE.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lkavWgr.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\udqMuLy.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lsxDXYD.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XHdRUWG.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HyKgJNx.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bkLuHFu.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lNfBYxI.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VWdOSYW.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DVRFbIp.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SiUHmGN.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ShUDnto.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vVFFrte.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QNVHIsW.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vsZcTIQ.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AiczaFX.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OtUvVor.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NiNDHtA.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kEdUCsa.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xsjowFW.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uIqUkvO.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QeLAiZR.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gOXUXdt.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vffPvkg.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PGunlvT.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WqWlGlS.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZZYOObn.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xZiJNAt.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GfpOXUO.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UauqUph.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RIahFoH.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dhLryoo.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1872 wrote to memory of 2948	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\lXoKLXx.exe
PID 1872 wrote to memory of 2948	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\lXoKLXx.exe
PID 1872 wrote to memory of 2948	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\lXoKLXx.exe
PID 1872 wrote to memory of 2880	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\XljVDoh.exe
PID 1872 wrote to memory of 2880	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\XljVDoh.exe
PID 1872 wrote to memory of 2880	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\XljVDoh.exe
PID 1872 wrote to memory of 3032	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\NDPpENt.exe
PID 1872 wrote to memory of 3032	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\NDPpENt.exe
PID 1872 wrote to memory of 3032	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\NDPpENt.exe
PID 1872 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\PtmjTXg.exe
PID 1872 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\PtmjTXg.exe
PID 1872 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\PtmjTXg.exe
PID 1872 wrote to memory of 2632	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\linJBYP.exe
PID 1872 wrote to memory of 2632	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\linJBYP.exe
PID 1872 wrote to memory of 2632	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\linJBYP.exe
PID 1872 wrote to memory of 2724	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\quDHuQU.exe
PID 1872 wrote to memory of 2724	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\quDHuQU.exe
PID 1872 wrote to memory of 2724	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\quDHuQU.exe
PID 1872 wrote to memory of 2680	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\lTdIQES.exe
PID 1872 wrote to memory of 2680	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\lTdIQES.exe
PID 1872 wrote to memory of 2680	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\lTdIQES.exe
PID 1872 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\ksWofXE.exe
PID 1872 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\ksWofXE.exe
PID 1872 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\ksWofXE.exe
PID 1872 wrote to memory of 2544	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\wSOvWHB.exe
PID 1872 wrote to memory of 2544	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\wSOvWHB.exe
PID 1872 wrote to memory of 2544	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\wSOvWHB.exe
PID 1872 wrote to memory of 2432	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\RziLVFo.exe
PID 1872 wrote to memory of 2432	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\RziLVFo.exe
PID 1872 wrote to memory of 2432	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\RziLVFo.exe
PID 1872 wrote to memory of 2972	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\GvisYtL.exe
PID 1872 wrote to memory of 2972	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\GvisYtL.exe
PID 1872 wrote to memory of 2972	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\GvisYtL.exe
PID 1872 wrote to memory of 2336	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\hDxJiJf.exe
PID 1872 wrote to memory of 2336	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\hDxJiJf.exe
PID 1872 wrote to memory of 2336	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\hDxJiJf.exe
PID 1872 wrote to memory of 1504	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\xwkObqk.exe
PID 1872 wrote to memory of 1504	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\xwkObqk.exe
PID 1872 wrote to memory of 1504	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\xwkObqk.exe
PID 1872 wrote to memory of 1240	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\bHUAJAY.exe
PID 1872 wrote to memory of 1240	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\bHUAJAY.exe
PID 1872 wrote to memory of 1240	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\bHUAJAY.exe
PID 1872 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\xnDEJKR.exe
PID 1872 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\xnDEJKR.exe
PID 1872 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\xnDEJKR.exe
PID 1872 wrote to memory of 2708	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\jKOtqFP.exe
PID 1872 wrote to memory of 2708	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\jKOtqFP.exe
PID 1872 wrote to memory of 2708	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\jKOtqFP.exe
PID 1872 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\HXNcovF.exe
PID 1872 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\HXNcovF.exe
PID 1872 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\HXNcovF.exe
PID 1872 wrote to memory of 1768	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\RpCEfrz.exe
PID 1872 wrote to memory of 1768	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\RpCEfrz.exe
PID 1872 wrote to memory of 1768	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\RpCEfrz.exe
PID 1872 wrote to memory of 1656	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\jEEWKxV.exe
PID 1872 wrote to memory of 1656	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\jEEWKxV.exe
PID 1872 wrote to memory of 1656	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\jEEWKxV.exe
PID 1872 wrote to memory of 1908	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\yPqxAct.exe
PID 1872 wrote to memory of 1908	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\yPqxAct.exe
PID 1872 wrote to memory of 1908	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\yPqxAct.exe
PID 1872 wrote to memory of 1448	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\bgJRaRA.exe
PID 1872 wrote to memory of 1448	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\bgJRaRA.exe
PID 1872 wrote to memory of 1448	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\bgJRaRA.exe
PID 1872 wrote to memory of 1572	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\UnyGosW.exe

Processes

C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe"

C:\Windows\System\lXoKLXx.exe

C:\Windows\System\lXoKLXx.exe

C:\Windows\System\XljVDoh.exe

C:\Windows\System\XljVDoh.exe

C:\Windows\System\NDPpENt.exe

C:\Windows\System\NDPpENt.exe

C:\Windows\System\PtmjTXg.exe

C:\Windows\System\PtmjTXg.exe

C:\Windows\System\linJBYP.exe

C:\Windows\System\linJBYP.exe

C:\Windows\System\quDHuQU.exe

C:\Windows\System\quDHuQU.exe

C:\Windows\System\lTdIQES.exe

C:\Windows\System\lTdIQES.exe

C:\Windows\System\ksWofXE.exe

C:\Windows\System\ksWofXE.exe

C:\Windows\System\wSOvWHB.exe

C:\Windows\System\wSOvWHB.exe

C:\Windows\System\RziLVFo.exe

C:\Windows\System\RziLVFo.exe

C:\Windows\System\GvisYtL.exe

C:\Windows\System\GvisYtL.exe

C:\Windows\System\hDxJiJf.exe

C:\Windows\System\hDxJiJf.exe

C:\Windows\System\xwkObqk.exe

C:\Windows\System\xwkObqk.exe

C:\Windows\System\bHUAJAY.exe

C:\Windows\System\bHUAJAY.exe

C:\Windows\System\xnDEJKR.exe

C:\Windows\System\xnDEJKR.exe

C:\Windows\System\jKOtqFP.exe

C:\Windows\System\jKOtqFP.exe

C:\Windows\System\HXNcovF.exe

C:\Windows\System\HXNcovF.exe

C:\Windows\System\RpCEfrz.exe

C:\Windows\System\RpCEfrz.exe

C:\Windows\System\jEEWKxV.exe

C:\Windows\System\jEEWKxV.exe

C:\Windows\System\yPqxAct.exe

C:\Windows\System\yPqxAct.exe

C:\Windows\System\bgJRaRA.exe

C:\Windows\System\bgJRaRA.exe

C:\Windows\System\UnyGosW.exe

C:\Windows\System\UnyGosW.exe

C:\Windows\System\dGlIIqR.exe

C:\Windows\System\dGlIIqR.exe

C:\Windows\System\YruYdVD.exe

C:\Windows\System\YruYdVD.exe

C:\Windows\System\ACRfqnq.exe

C:\Windows\System\ACRfqnq.exe

C:\Windows\System\kjKOMZo.exe

C:\Windows\System\kjKOMZo.exe

C:\Windows\System\aVcjSge.exe

C:\Windows\System\aVcjSge.exe

C:\Windows\System\ucMUZnc.exe

C:\Windows\System\ucMUZnc.exe

C:\Windows\System\oIlVSYi.exe

C:\Windows\System\oIlVSYi.exe

C:\Windows\System\faPaKmJ.exe

C:\Windows\System\faPaKmJ.exe

C:\Windows\System\odlqneE.exe

C:\Windows\System\odlqneE.exe

C:\Windows\System\dvPEQAR.exe

C:\Windows\System\dvPEQAR.exe

C:\Windows\System\lFHkLXf.exe

C:\Windows\System\lFHkLXf.exe

C:\Windows\System\jdnQidx.exe

C:\Windows\System\jdnQidx.exe

C:\Windows\System\bPPrnPt.exe

C:\Windows\System\bPPrnPt.exe

C:\Windows\System\RUyyWrC.exe

C:\Windows\System\RUyyWrC.exe

C:\Windows\System\SQhQgqu.exe

C:\Windows\System\SQhQgqu.exe

C:\Windows\System\pLnlLdU.exe

C:\Windows\System\pLnlLdU.exe

C:\Windows\System\dMRlHwh.exe

C:\Windows\System\dMRlHwh.exe

C:\Windows\System\Sggjnpu.exe

C:\Windows\System\Sggjnpu.exe

C:\Windows\System\uIqUkvO.exe

C:\Windows\System\uIqUkvO.exe

C:\Windows\System\IkYZCFo.exe

C:\Windows\System\IkYZCFo.exe

C:\Windows\System\diVaHfC.exe

C:\Windows\System\diVaHfC.exe

C:\Windows\System\ylmCVAw.exe

C:\Windows\System\ylmCVAw.exe

C:\Windows\System\fhZzGMq.exe

C:\Windows\System\fhZzGMq.exe

C:\Windows\System\QMywBRd.exe

C:\Windows\System\QMywBRd.exe

C:\Windows\System\AibdJNY.exe

C:\Windows\System\AibdJNY.exe

C:\Windows\System\PGVeXWZ.exe

C:\Windows\System\PGVeXWZ.exe

C:\Windows\System\xjjPXaC.exe

C:\Windows\System\xjjPXaC.exe

C:\Windows\System\NQMFlQj.exe

C:\Windows\System\NQMFlQj.exe

C:\Windows\System\vMdYdLF.exe

C:\Windows\System\vMdYdLF.exe

C:\Windows\System\UNGNgIO.exe

C:\Windows\System\UNGNgIO.exe

C:\Windows\System\WNDfonE.exe

C:\Windows\System\WNDfonE.exe

C:\Windows\System\IStEpYZ.exe

C:\Windows\System\IStEpYZ.exe

C:\Windows\System\NhShZJh.exe

C:\Windows\System\NhShZJh.exe

C:\Windows\System\auImAzt.exe

C:\Windows\System\auImAzt.exe

C:\Windows\System\cUMqpBj.exe

C:\Windows\System\cUMqpBj.exe

C:\Windows\System\XysmwAD.exe

C:\Windows\System\XysmwAD.exe

C:\Windows\System\GhCXMuM.exe

C:\Windows\System\GhCXMuM.exe

C:\Windows\System\KeYMFwI.exe

C:\Windows\System\KeYMFwI.exe

C:\Windows\System\DLBKXTY.exe

C:\Windows\System\DLBKXTY.exe

C:\Windows\System\IprVCPM.exe

C:\Windows\System\IprVCPM.exe

C:\Windows\System\SFLjusv.exe

C:\Windows\System\SFLjusv.exe

C:\Windows\System\CRGLtso.exe

C:\Windows\System\CRGLtso.exe

C:\Windows\System\irBIQVc.exe

C:\Windows\System\irBIQVc.exe

C:\Windows\System\sYxFwQe.exe

C:\Windows\System\sYxFwQe.exe

C:\Windows\System\MyWkxpI.exe

C:\Windows\System\MyWkxpI.exe

C:\Windows\System\cURibXL.exe

C:\Windows\System\cURibXL.exe

C:\Windows\System\oJxJoEc.exe

C:\Windows\System\oJxJoEc.exe

C:\Windows\System\kFhUBSY.exe

C:\Windows\System\kFhUBSY.exe

C:\Windows\System\RAvqaTp.exe

C:\Windows\System\RAvqaTp.exe

C:\Windows\System\fBETTCW.exe

C:\Windows\System\fBETTCW.exe

C:\Windows\System\yvJmgAT.exe

C:\Windows\System\yvJmgAT.exe

C:\Windows\System\dhLryoo.exe

C:\Windows\System\dhLryoo.exe

C:\Windows\System\dfleDPq.exe

C:\Windows\System\dfleDPq.exe

C:\Windows\System\nOEkyGC.exe

C:\Windows\System\nOEkyGC.exe

C:\Windows\System\vsZcTIQ.exe

C:\Windows\System\vsZcTIQ.exe

C:\Windows\System\XSHVNKW.exe

C:\Windows\System\XSHVNKW.exe

C:\Windows\System\zHadDZs.exe

C:\Windows\System\zHadDZs.exe

C:\Windows\System\cKnuGwU.exe

C:\Windows\System\cKnuGwU.exe

C:\Windows\System\iutYjiA.exe

C:\Windows\System\iutYjiA.exe

C:\Windows\System\JFwkDSk.exe

C:\Windows\System\JFwkDSk.exe

C:\Windows\System\rAVXtlm.exe

C:\Windows\System\rAVXtlm.exe

C:\Windows\System\UeGvQSd.exe

C:\Windows\System\UeGvQSd.exe

C:\Windows\System\EyVRiwh.exe

C:\Windows\System\EyVRiwh.exe

C:\Windows\System\QQkBJCt.exe

C:\Windows\System\QQkBJCt.exe

C:\Windows\System\QeLAiZR.exe

C:\Windows\System\QeLAiZR.exe

C:\Windows\System\qQJvhqF.exe

C:\Windows\System\qQJvhqF.exe

C:\Windows\System\QOIAAYx.exe

C:\Windows\System\QOIAAYx.exe

C:\Windows\System\XusbybN.exe

C:\Windows\System\XusbybN.exe

C:\Windows\System\tWMvOKq.exe

C:\Windows\System\tWMvOKq.exe

C:\Windows\System\cafaMNU.exe

C:\Windows\System\cafaMNU.exe

C:\Windows\System\NgSYhpD.exe

C:\Windows\System\NgSYhpD.exe

C:\Windows\System\qUMFGao.exe

C:\Windows\System\qUMFGao.exe

C:\Windows\System\gCfAoZc.exe

C:\Windows\System\gCfAoZc.exe

C:\Windows\System\gOXUXdt.exe

C:\Windows\System\gOXUXdt.exe

C:\Windows\System\EyBMnrg.exe

C:\Windows\System\EyBMnrg.exe

C:\Windows\System\znXyQFJ.exe

C:\Windows\System\znXyQFJ.exe

C:\Windows\System\inoYZGm.exe

C:\Windows\System\inoYZGm.exe

C:\Windows\System\whCrSFv.exe

C:\Windows\System\whCrSFv.exe

C:\Windows\System\nLOwhns.exe

C:\Windows\System\nLOwhns.exe

C:\Windows\System\osSANZq.exe

C:\Windows\System\osSANZq.exe

C:\Windows\System\dUKeCPs.exe

C:\Windows\System\dUKeCPs.exe

C:\Windows\System\VTZMcqj.exe

C:\Windows\System\VTZMcqj.exe

C:\Windows\System\DgAKwIM.exe

C:\Windows\System\DgAKwIM.exe

C:\Windows\System\hehKJSx.exe

C:\Windows\System\hehKJSx.exe

C:\Windows\System\pGUhRLK.exe

C:\Windows\System\pGUhRLK.exe

C:\Windows\System\JQUBqxu.exe

C:\Windows\System\JQUBqxu.exe

C:\Windows\System\AmgIiJF.exe

C:\Windows\System\AmgIiJF.exe

C:\Windows\System\NaMYjwP.exe

C:\Windows\System\NaMYjwP.exe

C:\Windows\System\EnuDGlN.exe

C:\Windows\System\EnuDGlN.exe

C:\Windows\System\ByqDBui.exe

C:\Windows\System\ByqDBui.exe

C:\Windows\System\TKQYSGn.exe

C:\Windows\System\TKQYSGn.exe

C:\Windows\System\tKlEdiv.exe

C:\Windows\System\tKlEdiv.exe

C:\Windows\System\varDoLx.exe

C:\Windows\System\varDoLx.exe

C:\Windows\System\bxLhYMR.exe

C:\Windows\System\bxLhYMR.exe

C:\Windows\System\JjIHQmR.exe

C:\Windows\System\JjIHQmR.exe

C:\Windows\System\ygrUGgn.exe

C:\Windows\System\ygrUGgn.exe

C:\Windows\System\hQopERt.exe

C:\Windows\System\hQopERt.exe

C:\Windows\System\PVloAne.exe

C:\Windows\System\PVloAne.exe

C:\Windows\System\ZjafpyJ.exe

C:\Windows\System\ZjafpyJ.exe

C:\Windows\System\ksiHYTK.exe

C:\Windows\System\ksiHYTK.exe

C:\Windows\System\WOSvWdl.exe

C:\Windows\System\WOSvWdl.exe

C:\Windows\System\UHuiqKs.exe

C:\Windows\System\UHuiqKs.exe

C:\Windows\System\PlPjiDv.exe

C:\Windows\System\PlPjiDv.exe

C:\Windows\System\seGcDPu.exe

C:\Windows\System\seGcDPu.exe

C:\Windows\System\kUeaeQY.exe

C:\Windows\System\kUeaeQY.exe

C:\Windows\System\LoibpOk.exe

C:\Windows\System\LoibpOk.exe

C:\Windows\System\sujJDIv.exe

C:\Windows\System\sujJDIv.exe

C:\Windows\System\wMzqaLI.exe

C:\Windows\System\wMzqaLI.exe

C:\Windows\System\GYRIvLI.exe

C:\Windows\System\GYRIvLI.exe

C:\Windows\System\yepFCLV.exe

C:\Windows\System\yepFCLV.exe

C:\Windows\System\CsOGrfq.exe

C:\Windows\System\CsOGrfq.exe

C:\Windows\System\eHNsrIX.exe

C:\Windows\System\eHNsrIX.exe

C:\Windows\System\pwHqjZY.exe

C:\Windows\System\pwHqjZY.exe

C:\Windows\System\uujfsjB.exe

C:\Windows\System\uujfsjB.exe

C:\Windows\System\LLWwqMQ.exe

C:\Windows\System\LLWwqMQ.exe

C:\Windows\System\vKAlkda.exe

C:\Windows\System\vKAlkda.exe

C:\Windows\System\qfgujET.exe

C:\Windows\System\qfgujET.exe

C:\Windows\System\qAdKsDF.exe

C:\Windows\System\qAdKsDF.exe

C:\Windows\System\rvRbDIu.exe

C:\Windows\System\rvRbDIu.exe

C:\Windows\System\szlYkdz.exe

C:\Windows\System\szlYkdz.exe

C:\Windows\System\FlfAMXf.exe

C:\Windows\System\FlfAMXf.exe

C:\Windows\System\wasbDWF.exe

C:\Windows\System\wasbDWF.exe

C:\Windows\System\uGnTBQP.exe

C:\Windows\System\uGnTBQP.exe

C:\Windows\System\cxuqAyP.exe

C:\Windows\System\cxuqAyP.exe

C:\Windows\System\ONCtcoF.exe

C:\Windows\System\ONCtcoF.exe

C:\Windows\System\eLsuMUB.exe

C:\Windows\System\eLsuMUB.exe

C:\Windows\System\IsqxAwi.exe

C:\Windows\System\IsqxAwi.exe

C:\Windows\System\gnvyOkl.exe

C:\Windows\System\gnvyOkl.exe

C:\Windows\System\DMQneFw.exe

C:\Windows\System\DMQneFw.exe

C:\Windows\System\HVDItil.exe

C:\Windows\System\HVDItil.exe

C:\Windows\System\VAOdBKn.exe

C:\Windows\System\VAOdBKn.exe

C:\Windows\System\xtBisAE.exe

C:\Windows\System\xtBisAE.exe

C:\Windows\System\CDowyOx.exe

C:\Windows\System\CDowyOx.exe

C:\Windows\System\qSgXCzX.exe

C:\Windows\System\qSgXCzX.exe

C:\Windows\System\kXuvkEF.exe

C:\Windows\System\kXuvkEF.exe

C:\Windows\System\GkBzpJK.exe

C:\Windows\System\GkBzpJK.exe

C:\Windows\System\Umntznz.exe

C:\Windows\System\Umntznz.exe

C:\Windows\System\mBzRxTK.exe

C:\Windows\System\mBzRxTK.exe

C:\Windows\System\NqQLFMR.exe

C:\Windows\System\NqQLFMR.exe

C:\Windows\System\GEDOKGv.exe

C:\Windows\System\GEDOKGv.exe

C:\Windows\System\fcBLkvB.exe

C:\Windows\System\fcBLkvB.exe

C:\Windows\System\ZsPzHvj.exe

C:\Windows\System\ZsPzHvj.exe

C:\Windows\System\KWHiOfL.exe

C:\Windows\System\KWHiOfL.exe

C:\Windows\System\AnWRHpr.exe

C:\Windows\System\AnWRHpr.exe

C:\Windows\System\izBSkWO.exe

C:\Windows\System\izBSkWO.exe

C:\Windows\System\GWJLpaB.exe

C:\Windows\System\GWJLpaB.exe

C:\Windows\System\pKIneQh.exe

C:\Windows\System\pKIneQh.exe

C:\Windows\System\ETyACgH.exe

C:\Windows\System\ETyACgH.exe

C:\Windows\System\sGflrdX.exe

C:\Windows\System\sGflrdX.exe

C:\Windows\System\AsvHeSt.exe

C:\Windows\System\AsvHeSt.exe

C:\Windows\System\ATuCOIq.exe

C:\Windows\System\ATuCOIq.exe

C:\Windows\System\eSwTDig.exe

C:\Windows\System\eSwTDig.exe

C:\Windows\System\lSLUeyq.exe

C:\Windows\System\lSLUeyq.exe

C:\Windows\System\GyKRkIh.exe

C:\Windows\System\GyKRkIh.exe

C:\Windows\System\xMGZvDr.exe

C:\Windows\System\xMGZvDr.exe

C:\Windows\System\KAIcOKd.exe

C:\Windows\System\KAIcOKd.exe

C:\Windows\System\oRyQkoa.exe

C:\Windows\System\oRyQkoa.exe

C:\Windows\System\sLhtXQv.exe

C:\Windows\System\sLhtXQv.exe

C:\Windows\System\lRPInoM.exe

C:\Windows\System\lRPInoM.exe

C:\Windows\System\kpbbCEo.exe

C:\Windows\System\kpbbCEo.exe

C:\Windows\System\UODcyxs.exe

C:\Windows\System\UODcyxs.exe

C:\Windows\System\swJrwyI.exe

C:\Windows\System\swJrwyI.exe

C:\Windows\System\WQfHDkz.exe

C:\Windows\System\WQfHDkz.exe

C:\Windows\System\frzCNFp.exe

C:\Windows\System\frzCNFp.exe

C:\Windows\System\pDiRtWk.exe

C:\Windows\System\pDiRtWk.exe

C:\Windows\System\TiOOhcv.exe

C:\Windows\System\TiOOhcv.exe

C:\Windows\System\dmeBSoI.exe

C:\Windows\System\dmeBSoI.exe

C:\Windows\System\kJyGPyw.exe

C:\Windows\System\kJyGPyw.exe

C:\Windows\System\yknxZxN.exe

C:\Windows\System\yknxZxN.exe

C:\Windows\System\tYxpnCe.exe

C:\Windows\System\tYxpnCe.exe

C:\Windows\System\XHgZlPd.exe

C:\Windows\System\XHgZlPd.exe

C:\Windows\System\WEFJkDw.exe

C:\Windows\System\WEFJkDw.exe

C:\Windows\System\TfPRmsG.exe

C:\Windows\System\TfPRmsG.exe

C:\Windows\System\JinyPWT.exe

C:\Windows\System\JinyPWT.exe

C:\Windows\System\iLXUHgO.exe

C:\Windows\System\iLXUHgO.exe

C:\Windows\System\MXGToSW.exe

C:\Windows\System\MXGToSW.exe

C:\Windows\System\mSdWCMC.exe

C:\Windows\System\mSdWCMC.exe

C:\Windows\System\KztsCNa.exe

C:\Windows\System\KztsCNa.exe

C:\Windows\System\GQRUKoR.exe

C:\Windows\System\GQRUKoR.exe

C:\Windows\System\jwobrxV.exe

C:\Windows\System\jwobrxV.exe

C:\Windows\System\mbjWoqm.exe

C:\Windows\System\mbjWoqm.exe

C:\Windows\System\eMDoEsb.exe

C:\Windows\System\eMDoEsb.exe

C:\Windows\System\yjZAwKh.exe

C:\Windows\System\yjZAwKh.exe

C:\Windows\System\yrErJMY.exe

C:\Windows\System\yrErJMY.exe

C:\Windows\System\olJiMem.exe

C:\Windows\System\olJiMem.exe

C:\Windows\System\DHEeotx.exe

C:\Windows\System\DHEeotx.exe

C:\Windows\System\nkaRpLd.exe

C:\Windows\System\nkaRpLd.exe

C:\Windows\System\NpIUFxQ.exe

C:\Windows\System\NpIUFxQ.exe

C:\Windows\System\virZUEp.exe

C:\Windows\System\virZUEp.exe

C:\Windows\System\RavLRlN.exe

C:\Windows\System\RavLRlN.exe

C:\Windows\System\CexaWWW.exe

C:\Windows\System\CexaWWW.exe

C:\Windows\System\glwvNyg.exe

C:\Windows\System\glwvNyg.exe

C:\Windows\System\jUiuVlw.exe

C:\Windows\System\jUiuVlw.exe

C:\Windows\System\yHddijr.exe

C:\Windows\System\yHddijr.exe

C:\Windows\System\zPBVRTJ.exe

C:\Windows\System\zPBVRTJ.exe

C:\Windows\System\BLnZnXZ.exe

C:\Windows\System\BLnZnXZ.exe

C:\Windows\System\eQLurBA.exe

C:\Windows\System\eQLurBA.exe

C:\Windows\System\hEfIKtG.exe

C:\Windows\System\hEfIKtG.exe

C:\Windows\System\ajacMBR.exe

C:\Windows\System\ajacMBR.exe

C:\Windows\System\OWxZOVU.exe

C:\Windows\System\OWxZOVU.exe

C:\Windows\System\RHdJdKu.exe

C:\Windows\System\RHdJdKu.exe

C:\Windows\System\mdaPdUl.exe

C:\Windows\System\mdaPdUl.exe

C:\Windows\System\ikNEblZ.exe

C:\Windows\System\ikNEblZ.exe

C:\Windows\System\ECSPMuC.exe

C:\Windows\System\ECSPMuC.exe

C:\Windows\System\DlZLrOS.exe

C:\Windows\System\DlZLrOS.exe

C:\Windows\System\uRCaIde.exe

C:\Windows\System\uRCaIde.exe

C:\Windows\System\UOkRNpY.exe

C:\Windows\System\UOkRNpY.exe

C:\Windows\System\RYBSuOc.exe

C:\Windows\System\RYBSuOc.exe

C:\Windows\System\XsOVdEc.exe

C:\Windows\System\XsOVdEc.exe

C:\Windows\System\iZNbLAF.exe

C:\Windows\System\iZNbLAF.exe

C:\Windows\System\InJIEBa.exe

C:\Windows\System\InJIEBa.exe

C:\Windows\System\ihuGfgz.exe

C:\Windows\System\ihuGfgz.exe

C:\Windows\System\VWdOSYW.exe

C:\Windows\System\VWdOSYW.exe

C:\Windows\System\QrwRwQn.exe

C:\Windows\System\QrwRwQn.exe

C:\Windows\System\Wxchric.exe

C:\Windows\System\Wxchric.exe

C:\Windows\System\HZmlWBY.exe

C:\Windows\System\HZmlWBY.exe

C:\Windows\System\WLeIlaz.exe

C:\Windows\System\WLeIlaz.exe

C:\Windows\System\KDawwdR.exe

C:\Windows\System\KDawwdR.exe

C:\Windows\System\gHngDcH.exe

C:\Windows\System\gHngDcH.exe

C:\Windows\System\LOgyUYU.exe

C:\Windows\System\LOgyUYU.exe

C:\Windows\System\NwweQEx.exe

C:\Windows\System\NwweQEx.exe

C:\Windows\System\xwKMwow.exe

C:\Windows\System\xwKMwow.exe

C:\Windows\System\FwLuAfk.exe

C:\Windows\System\FwLuAfk.exe

C:\Windows\System\PrZaMwF.exe

C:\Windows\System\PrZaMwF.exe

C:\Windows\System\tFMiqxz.exe

C:\Windows\System\tFMiqxz.exe

C:\Windows\System\qYJzBuQ.exe

C:\Windows\System\qYJzBuQ.exe

C:\Windows\System\srQukRN.exe

C:\Windows\System\srQukRN.exe

C:\Windows\System\AiczaFX.exe

C:\Windows\System\AiczaFX.exe

C:\Windows\System\WQdbkdx.exe

C:\Windows\System\WQdbkdx.exe

C:\Windows\System\yAzmLzd.exe

C:\Windows\System\yAzmLzd.exe

C:\Windows\System\uAjdOAj.exe

C:\Windows\System\uAjdOAj.exe

C:\Windows\System\NugfiGq.exe

C:\Windows\System\NugfiGq.exe

C:\Windows\System\VPlrape.exe

C:\Windows\System\VPlrape.exe

C:\Windows\System\fbQbBni.exe

C:\Windows\System\fbQbBni.exe

C:\Windows\System\uClgmSv.exe

C:\Windows\System\uClgmSv.exe

C:\Windows\System\YcykfOK.exe

C:\Windows\System\YcykfOK.exe

C:\Windows\System\eaxIWOB.exe

C:\Windows\System\eaxIWOB.exe

C:\Windows\System\cQDXHCx.exe

C:\Windows\System\cQDXHCx.exe

C:\Windows\System\aqzYPnM.exe

C:\Windows\System\aqzYPnM.exe

C:\Windows\System\DVRFbIp.exe

C:\Windows\System\DVRFbIp.exe

C:\Windows\System\MBQtYvg.exe

C:\Windows\System\MBQtYvg.exe

C:\Windows\System\acrPoux.exe

C:\Windows\System\acrPoux.exe

C:\Windows\System\pbtMkxO.exe

C:\Windows\System\pbtMkxO.exe

C:\Windows\System\LKMKWyu.exe

C:\Windows\System\LKMKWyu.exe

C:\Windows\System\JPpgpXx.exe

C:\Windows\System\JPpgpXx.exe

C:\Windows\System\zSiZwxE.exe

C:\Windows\System\zSiZwxE.exe

C:\Windows\System\UqZSJbu.exe

C:\Windows\System\UqZSJbu.exe

C:\Windows\System\fBwlJTs.exe

C:\Windows\System\fBwlJTs.exe

C:\Windows\System\DwkcFIp.exe

C:\Windows\System\DwkcFIp.exe

C:\Windows\System\cLYuKfy.exe

C:\Windows\System\cLYuKfy.exe

C:\Windows\System\JNnmBmz.exe

C:\Windows\System\JNnmBmz.exe

C:\Windows\System\RFBIfWK.exe

C:\Windows\System\RFBIfWK.exe

C:\Windows\System\vzSVVrT.exe

C:\Windows\System\vzSVVrT.exe

C:\Windows\System\UcorOYw.exe

C:\Windows\System\UcorOYw.exe

C:\Windows\System\eZgNVLX.exe

C:\Windows\System\eZgNVLX.exe

C:\Windows\System\hJvLPcy.exe

C:\Windows\System\hJvLPcy.exe

C:\Windows\System\EPFYKFG.exe

C:\Windows\System\EPFYKFG.exe

C:\Windows\System\oQXYvHa.exe

C:\Windows\System\oQXYvHa.exe

C:\Windows\System\tllPbFT.exe

C:\Windows\System\tllPbFT.exe

C:\Windows\System\MKweqAX.exe

C:\Windows\System\MKweqAX.exe

C:\Windows\System\cFnZMNO.exe

C:\Windows\System\cFnZMNO.exe

C:\Windows\System\xRTnhwJ.exe

C:\Windows\System\xRTnhwJ.exe

C:\Windows\System\OOBCAsu.exe

C:\Windows\System\OOBCAsu.exe

C:\Windows\System\sSKROhd.exe

C:\Windows\System\sSKROhd.exe

C:\Windows\System\vTwVJYc.exe

C:\Windows\System\vTwVJYc.exe

C:\Windows\System\cYVuRbh.exe

C:\Windows\System\cYVuRbh.exe

C:\Windows\System\nYgBCWw.exe

C:\Windows\System\nYgBCWw.exe

C:\Windows\System\dNZRUnO.exe

C:\Windows\System\dNZRUnO.exe

C:\Windows\System\OydgLrU.exe

C:\Windows\System\OydgLrU.exe

C:\Windows\System\zozQPPi.exe

C:\Windows\System\zozQPPi.exe

C:\Windows\System\cBIBnhS.exe

C:\Windows\System\cBIBnhS.exe

C:\Windows\System\jjllNat.exe

C:\Windows\System\jjllNat.exe

C:\Windows\System\pKEAsza.exe

C:\Windows\System\pKEAsza.exe

C:\Windows\System\dgBURQu.exe

C:\Windows\System\dgBURQu.exe

C:\Windows\System\DdcPgxS.exe

C:\Windows\System\DdcPgxS.exe

C:\Windows\System\SfSasjR.exe

C:\Windows\System\SfSasjR.exe

C:\Windows\System\JOXUyWT.exe

C:\Windows\System\JOXUyWT.exe

C:\Windows\System\xwyRFFk.exe

C:\Windows\System\xwyRFFk.exe

C:\Windows\System\HHVBdxc.exe

C:\Windows\System\HHVBdxc.exe

C:\Windows\System\yaBmwkM.exe

C:\Windows\System\yaBmwkM.exe

C:\Windows\System\szvPmjf.exe

C:\Windows\System\szvPmjf.exe

C:\Windows\System\sIGccbr.exe

C:\Windows\System\sIGccbr.exe

C:\Windows\System\YxJvSFz.exe

C:\Windows\System\YxJvSFz.exe

C:\Windows\System\akbwzoV.exe

C:\Windows\System\akbwzoV.exe

C:\Windows\System\krqiZeu.exe

C:\Windows\System\krqiZeu.exe

C:\Windows\System\uirdMQe.exe

C:\Windows\System\uirdMQe.exe

C:\Windows\System\ziKdxRq.exe

C:\Windows\System\ziKdxRq.exe

C:\Windows\System\DYofZJF.exe

C:\Windows\System\DYofZJF.exe

C:\Windows\System\WyqLNpJ.exe

C:\Windows\System\WyqLNpJ.exe

C:\Windows\System\wzIwvNa.exe

C:\Windows\System\wzIwvNa.exe

C:\Windows\System\GUwAQLO.exe

C:\Windows\System\GUwAQLO.exe

C:\Windows\System\QlZAIgO.exe

C:\Windows\System\QlZAIgO.exe

C:\Windows\System\exwnbTf.exe

C:\Windows\System\exwnbTf.exe

C:\Windows\System\ijaRftQ.exe

C:\Windows\System\ijaRftQ.exe

C:\Windows\System\ZaxRLCH.exe

C:\Windows\System\ZaxRLCH.exe

C:\Windows\System\SWAvDeL.exe

C:\Windows\System\SWAvDeL.exe

C:\Windows\System\doRIiim.exe

C:\Windows\System\doRIiim.exe

C:\Windows\System\zrvrfcn.exe

C:\Windows\System\zrvrfcn.exe

C:\Windows\System\WjBbdxd.exe

C:\Windows\System\WjBbdxd.exe

C:\Windows\System\fgnhrSu.exe

C:\Windows\System\fgnhrSu.exe

C:\Windows\System\ENPLmWy.exe

C:\Windows\System\ENPLmWy.exe

C:\Windows\System\wgEiVnu.exe

C:\Windows\System\wgEiVnu.exe

C:\Windows\System\zmTAJIv.exe

C:\Windows\System\zmTAJIv.exe

C:\Windows\System\byWiEzA.exe

C:\Windows\System\byWiEzA.exe

C:\Windows\System\GrlzlCV.exe

C:\Windows\System\GrlzlCV.exe

C:\Windows\System\EqUiPRd.exe

C:\Windows\System\EqUiPRd.exe

C:\Windows\System\cprEaSC.exe

C:\Windows\System\cprEaSC.exe

C:\Windows\System\YsAvWuw.exe

C:\Windows\System\YsAvWuw.exe

C:\Windows\System\TfbvniX.exe

C:\Windows\System\TfbvniX.exe

C:\Windows\System\cmbxuna.exe

C:\Windows\System\cmbxuna.exe

C:\Windows\System\MWAsDZp.exe

C:\Windows\System\MWAsDZp.exe

C:\Windows\System\mEaakSI.exe

C:\Windows\System\mEaakSI.exe

C:\Windows\System\rQuYyff.exe

C:\Windows\System\rQuYyff.exe

C:\Windows\System\bQwfNCV.exe

C:\Windows\System\bQwfNCV.exe

C:\Windows\System\qHmqWJM.exe

C:\Windows\System\qHmqWJM.exe

C:\Windows\System\XxWtuWS.exe

C:\Windows\System\XxWtuWS.exe

C:\Windows\System\lkavWgr.exe

C:\Windows\System\lkavWgr.exe

C:\Windows\System\AXrjNSj.exe

C:\Windows\System\AXrjNSj.exe

C:\Windows\System\KzLRgJy.exe

C:\Windows\System\KzLRgJy.exe

C:\Windows\System\bKzWXKJ.exe

C:\Windows\System\bKzWXKJ.exe

C:\Windows\System\GrKkyxt.exe

C:\Windows\System\GrKkyxt.exe

C:\Windows\System\thQMVgG.exe

C:\Windows\System\thQMVgG.exe

C:\Windows\System\sRcFQrc.exe

C:\Windows\System\sRcFQrc.exe

C:\Windows\System\NtUUuHv.exe

C:\Windows\System\NtUUuHv.exe

C:\Windows\System\uKdZGnR.exe

C:\Windows\System\uKdZGnR.exe

C:\Windows\System\VgQeXWn.exe

C:\Windows\System\VgQeXWn.exe

C:\Windows\System\JGxtSpW.exe

C:\Windows\System\JGxtSpW.exe

C:\Windows\System\dpkhAWa.exe

C:\Windows\System\dpkhAWa.exe

C:\Windows\System\JdgLBzy.exe

C:\Windows\System\JdgLBzy.exe

C:\Windows\System\hkLCmMz.exe

C:\Windows\System\hkLCmMz.exe

C:\Windows\System\xmEBdzE.exe

C:\Windows\System\xmEBdzE.exe

C:\Windows\System\MvEMMXN.exe

C:\Windows\System\MvEMMXN.exe

C:\Windows\System\vzciHrY.exe

C:\Windows\System\vzciHrY.exe

C:\Windows\System\RRBZFNl.exe

C:\Windows\System\RRBZFNl.exe

C:\Windows\System\PBoeXXq.exe

C:\Windows\System\PBoeXXq.exe

C:\Windows\System\llKAOKV.exe

C:\Windows\System\llKAOKV.exe

C:\Windows\System\sbHNKbX.exe

C:\Windows\System\sbHNKbX.exe

C:\Windows\System\mEEexyJ.exe

C:\Windows\System\mEEexyJ.exe

C:\Windows\System\DSFiKOG.exe

C:\Windows\System\DSFiKOG.exe

C:\Windows\System\RdZzbEg.exe

C:\Windows\System\RdZzbEg.exe

C:\Windows\System\caZMCCV.exe

C:\Windows\System\caZMCCV.exe

C:\Windows\System\zPGMgKF.exe

C:\Windows\System\zPGMgKF.exe

C:\Windows\System\nAivDDS.exe

C:\Windows\System\nAivDDS.exe

C:\Windows\System\ddjHYYc.exe

C:\Windows\System\ddjHYYc.exe

C:\Windows\System\aIFBaET.exe

C:\Windows\System\aIFBaET.exe

C:\Windows\System\hAdWFEb.exe

C:\Windows\System\hAdWFEb.exe

C:\Windows\System\gUYgXSq.exe

C:\Windows\System\gUYgXSq.exe

C:\Windows\System\sfNrWPc.exe

C:\Windows\System\sfNrWPc.exe

C:\Windows\System\aCnavCs.exe

C:\Windows\System\aCnavCs.exe

C:\Windows\System\VrzuisS.exe

C:\Windows\System\VrzuisS.exe

C:\Windows\System\PhlpCcW.exe

C:\Windows\System\PhlpCcW.exe

C:\Windows\System\vvZEJZB.exe

C:\Windows\System\vvZEJZB.exe

C:\Windows\System\LWCvrtc.exe

C:\Windows\System\LWCvrtc.exe

C:\Windows\System\gvbPttK.exe

C:\Windows\System\gvbPttK.exe

C:\Windows\System\yvBymJr.exe

C:\Windows\System\yvBymJr.exe

C:\Windows\System\DUJeyAq.exe

C:\Windows\System\DUJeyAq.exe

C:\Windows\System\ALvnEaf.exe

C:\Windows\System\ALvnEaf.exe

C:\Windows\System\udqMuLy.exe

C:\Windows\System\udqMuLy.exe

C:\Windows\System\IMxTAmx.exe

C:\Windows\System\IMxTAmx.exe

C:\Windows\System\EjCOzvI.exe

C:\Windows\System\EjCOzvI.exe

C:\Windows\System\KXmbNTu.exe

C:\Windows\System\KXmbNTu.exe

C:\Windows\System\BvpMWym.exe

C:\Windows\System\BvpMWym.exe

C:\Windows\System\yCSUHQa.exe

C:\Windows\System\yCSUHQa.exe

C:\Windows\System\SRsHHhP.exe

C:\Windows\System\SRsHHhP.exe

C:\Windows\System\QgEcitp.exe

C:\Windows\System\QgEcitp.exe

C:\Windows\System\QWfJuza.exe

C:\Windows\System\QWfJuza.exe

C:\Windows\System\nCDCyHM.exe

C:\Windows\System\nCDCyHM.exe

C:\Windows\System\rkJzBxy.exe

C:\Windows\System\rkJzBxy.exe

C:\Windows\System\ZHXoYtK.exe

C:\Windows\System\ZHXoYtK.exe

C:\Windows\System\QzpzebL.exe

C:\Windows\System\QzpzebL.exe

C:\Windows\System\BpqiNPW.exe

C:\Windows\System\BpqiNPW.exe

C:\Windows\System\RCXofMg.exe

C:\Windows\System\RCXofMg.exe

C:\Windows\System\zroXizG.exe

C:\Windows\System\zroXizG.exe

C:\Windows\System\qYqwzUz.exe

C:\Windows\System\qYqwzUz.exe

C:\Windows\System\DCjwuCF.exe

C:\Windows\System\DCjwuCF.exe

C:\Windows\System\tyaKmxU.exe

C:\Windows\System\tyaKmxU.exe

C:\Windows\System\IPdMdal.exe

C:\Windows\System\IPdMdal.exe

C:\Windows\System\NVvFgEx.exe

C:\Windows\System\NVvFgEx.exe

C:\Windows\System\dsrSzYp.exe

C:\Windows\System\dsrSzYp.exe

C:\Windows\System\slSzCbM.exe

C:\Windows\System\slSzCbM.exe

C:\Windows\System\yRNmsLM.exe

C:\Windows\System\yRNmsLM.exe

C:\Windows\System\BZXhzQq.exe

C:\Windows\System\BZXhzQq.exe

C:\Windows\System\YyWaIyy.exe

C:\Windows\System\YyWaIyy.exe

C:\Windows\System\eeIcWFX.exe

C:\Windows\System\eeIcWFX.exe

C:\Windows\System\MCZYhxz.exe

C:\Windows\System\MCZYhxz.exe

C:\Windows\System\ojltcEV.exe

C:\Windows\System\ojltcEV.exe

C:\Windows\System\TUjOEZx.exe

C:\Windows\System\TUjOEZx.exe

C:\Windows\System\SUgLrRc.exe

C:\Windows\System\SUgLrRc.exe

C:\Windows\System\ZHcKdQV.exe

C:\Windows\System\ZHcKdQV.exe

C:\Windows\System\ecEvzNd.exe

C:\Windows\System\ecEvzNd.exe

C:\Windows\System\WmHevoS.exe

C:\Windows\System\WmHevoS.exe

C:\Windows\System\kdMolGH.exe

C:\Windows\System\kdMolGH.exe

C:\Windows\System\YdnBPag.exe

C:\Windows\System\YdnBPag.exe

C:\Windows\System\lsxDXYD.exe

C:\Windows\System\lsxDXYD.exe

C:\Windows\System\gCKMCMT.exe

C:\Windows\System\gCKMCMT.exe

C:\Windows\System\ZVrNUVZ.exe

C:\Windows\System\ZVrNUVZ.exe

C:\Windows\System\LMjpoxy.exe

C:\Windows\System\LMjpoxy.exe

C:\Windows\System\cMoiFTr.exe

C:\Windows\System\cMoiFTr.exe

C:\Windows\System\pUbgHbU.exe

C:\Windows\System\pUbgHbU.exe

C:\Windows\System\bchSJPF.exe

C:\Windows\System\bchSJPF.exe

C:\Windows\System\HOoaKWM.exe

C:\Windows\System\HOoaKWM.exe

C:\Windows\System\ivLBsye.exe

C:\Windows\System\ivLBsye.exe

C:\Windows\System\IFnIzbq.exe

C:\Windows\System\IFnIzbq.exe

C:\Windows\System\XrEGWnV.exe

C:\Windows\System\XrEGWnV.exe

C:\Windows\System\uryYSFi.exe

C:\Windows\System\uryYSFi.exe

C:\Windows\System\tJsTyYu.exe

C:\Windows\System\tJsTyYu.exe

C:\Windows\System\dqXtKPp.exe

C:\Windows\System\dqXtKPp.exe

C:\Windows\System\wSduCvQ.exe

C:\Windows\System\wSduCvQ.exe

C:\Windows\System\dsxSoxj.exe

C:\Windows\System\dsxSoxj.exe

C:\Windows\System\xVIEvSM.exe

C:\Windows\System\xVIEvSM.exe

C:\Windows\System\pSdhbrB.exe

C:\Windows\System\pSdhbrB.exe

C:\Windows\System\cNQohvY.exe

C:\Windows\System\cNQohvY.exe

C:\Windows\System\nJcrFcY.exe

C:\Windows\System\nJcrFcY.exe

C:\Windows\System\QKUvzND.exe

C:\Windows\System\QKUvzND.exe

C:\Windows\System\TvTGAur.exe

C:\Windows\System\TvTGAur.exe

C:\Windows\System\kIcrfqF.exe

C:\Windows\System\kIcrfqF.exe

C:\Windows\System\SLoXrdF.exe

C:\Windows\System\SLoXrdF.exe

C:\Windows\System\aeieQgf.exe

C:\Windows\System\aeieQgf.exe

C:\Windows\System\RkfWjrs.exe

C:\Windows\System\RkfWjrs.exe

C:\Windows\System\hrhOVWN.exe

C:\Windows\System\hrhOVWN.exe

C:\Windows\System\hYBdZAg.exe

C:\Windows\System\hYBdZAg.exe

C:\Windows\System\wlIlwyo.exe

C:\Windows\System\wlIlwyo.exe

C:\Windows\System\AlyeKVN.exe

C:\Windows\System\AlyeKVN.exe

C:\Windows\System\PzZNRjY.exe

C:\Windows\System\PzZNRjY.exe

C:\Windows\System\zUaXGIB.exe

C:\Windows\System\zUaXGIB.exe

C:\Windows\System\OfvKySL.exe

C:\Windows\System\OfvKySL.exe

C:\Windows\System\TbgBbXy.exe

C:\Windows\System\TbgBbXy.exe

C:\Windows\System\HlESIyK.exe

C:\Windows\System\HlESIyK.exe

C:\Windows\System\XHdRUWG.exe

C:\Windows\System\XHdRUWG.exe

C:\Windows\System\BSgzKPr.exe

C:\Windows\System\BSgzKPr.exe

C:\Windows\System\SxygRsT.exe

C:\Windows\System\SxygRsT.exe

C:\Windows\System\ABZWAEP.exe

C:\Windows\System\ABZWAEP.exe

C:\Windows\System\AlbkKkD.exe

C:\Windows\System\AlbkKkD.exe

C:\Windows\System\YtpBqCD.exe

C:\Windows\System\YtpBqCD.exe

C:\Windows\System\WObPYwV.exe

C:\Windows\System\WObPYwV.exe

C:\Windows\System\oUufcQq.exe

C:\Windows\System\oUufcQq.exe

C:\Windows\System\FYyQpmD.exe

C:\Windows\System\FYyQpmD.exe

C:\Windows\System\EFPCSGr.exe

C:\Windows\System\EFPCSGr.exe

C:\Windows\System\pmheBNv.exe

C:\Windows\System\pmheBNv.exe

C:\Windows\System\xiAxiBE.exe

C:\Windows\System\xiAxiBE.exe

C:\Windows\System\dfVnrJq.exe

C:\Windows\System\dfVnrJq.exe

C:\Windows\System\quqsksf.exe

C:\Windows\System\quqsksf.exe

C:\Windows\System\cfJUCXG.exe

C:\Windows\System\cfJUCXG.exe

C:\Windows\System\MyeCyif.exe

C:\Windows\System\MyeCyif.exe

C:\Windows\System\SOIKSRf.exe

C:\Windows\System\SOIKSRf.exe

C:\Windows\System\WJxTXiA.exe

C:\Windows\System\WJxTXiA.exe

C:\Windows\System\cdUwgRw.exe

C:\Windows\System\cdUwgRw.exe

C:\Windows\System\JYYBQEk.exe

C:\Windows\System\JYYBQEk.exe

C:\Windows\System\ymCfvVY.exe

C:\Windows\System\ymCfvVY.exe

C:\Windows\System\GxJPbyp.exe

C:\Windows\System\GxJPbyp.exe

C:\Windows\System\rQpayDl.exe

C:\Windows\System\rQpayDl.exe

C:\Windows\System\sfIXAor.exe

C:\Windows\System\sfIXAor.exe

C:\Windows\System\AZOZgHs.exe

C:\Windows\System\AZOZgHs.exe

C:\Windows\System\wTYoOTK.exe

C:\Windows\System\wTYoOTK.exe

C:\Windows\System\yyuXitF.exe

C:\Windows\System\yyuXitF.exe

C:\Windows\System\boeeBmL.exe

C:\Windows\System\boeeBmL.exe

C:\Windows\System\TXvpjlB.exe

C:\Windows\System\TXvpjlB.exe

C:\Windows\System\AcDedZY.exe

C:\Windows\System\AcDedZY.exe

C:\Windows\System\fldTGxx.exe

C:\Windows\System\fldTGxx.exe

C:\Windows\System\mYJiZpO.exe

C:\Windows\System\mYJiZpO.exe

C:\Windows\System\xZiJNAt.exe

C:\Windows\System\xZiJNAt.exe

C:\Windows\System\vhqlQiR.exe

C:\Windows\System\vhqlQiR.exe

C:\Windows\System\FsObUmD.exe

C:\Windows\System\FsObUmD.exe

C:\Windows\System\LumTwcc.exe

C:\Windows\System\LumTwcc.exe

C:\Windows\System\qUbKRlc.exe

C:\Windows\System\qUbKRlc.exe

C:\Windows\System\tvpKxtY.exe

C:\Windows\System\tvpKxtY.exe

C:\Windows\System\ZCHwncV.exe

C:\Windows\System\ZCHwncV.exe

C:\Windows\System\MJzhNwz.exe

C:\Windows\System\MJzhNwz.exe

C:\Windows\System\WjrCkxv.exe

C:\Windows\System\WjrCkxv.exe

C:\Windows\System\QUzQOaK.exe

C:\Windows\System\QUzQOaK.exe

C:\Windows\System\WorhaJK.exe

C:\Windows\System\WorhaJK.exe

C:\Windows\System\IpFZQmz.exe

C:\Windows\System\IpFZQmz.exe

C:\Windows\System\VZKHdCC.exe

C:\Windows\System\VZKHdCC.exe

C:\Windows\System\DiLQNTH.exe

C:\Windows\System\DiLQNTH.exe

C:\Windows\System\XeQhJtj.exe

C:\Windows\System\XeQhJtj.exe

C:\Windows\System\LvuCmtq.exe

C:\Windows\System\LvuCmtq.exe

C:\Windows\System\iklGfoG.exe

C:\Windows\System\iklGfoG.exe

C:\Windows\System\fjDOPpH.exe

C:\Windows\System\fjDOPpH.exe

C:\Windows\System\tWltDGC.exe

C:\Windows\System\tWltDGC.exe

C:\Windows\System\RDkeAWM.exe

C:\Windows\System\RDkeAWM.exe

C:\Windows\System\ZjnGRtb.exe

C:\Windows\System\ZjnGRtb.exe

C:\Windows\System\kmUHslq.exe

C:\Windows\System\kmUHslq.exe

C:\Windows\System\ejwmOFA.exe

C:\Windows\System\ejwmOFA.exe

C:\Windows\System\FKpOVLh.exe

C:\Windows\System\FKpOVLh.exe

C:\Windows\System\FmXUeYP.exe

C:\Windows\System\FmXUeYP.exe

C:\Windows\System\yjIhkFB.exe

C:\Windows\System\yjIhkFB.exe

C:\Windows\System\YUCiVtK.exe

C:\Windows\System\YUCiVtK.exe

C:\Windows\System\uQFGOEk.exe

C:\Windows\System\uQFGOEk.exe

C:\Windows\System\xjGVmxA.exe

C:\Windows\System\xjGVmxA.exe

C:\Windows\System\aHpFKQF.exe

C:\Windows\System\aHpFKQF.exe

C:\Windows\System\hjQRWuv.exe

C:\Windows\System\hjQRWuv.exe

C:\Windows\System\WWcKBdO.exe

C:\Windows\System\WWcKBdO.exe

C:\Windows\System\ZqiUlxg.exe

C:\Windows\System\ZqiUlxg.exe

C:\Windows\System\HhqYksv.exe

C:\Windows\System\HhqYksv.exe

C:\Windows\System\sVhwMYz.exe

C:\Windows\System\sVhwMYz.exe

C:\Windows\System\GHOdNWZ.exe

C:\Windows\System\GHOdNWZ.exe

C:\Windows\System\RehkWEf.exe

C:\Windows\System\RehkWEf.exe

C:\Windows\System\qayIDLU.exe

C:\Windows\System\qayIDLU.exe

C:\Windows\System\HyKgJNx.exe

C:\Windows\System\HyKgJNx.exe

C:\Windows\System\SiUHmGN.exe

C:\Windows\System\SiUHmGN.exe

C:\Windows\System\zwieccu.exe

C:\Windows\System\zwieccu.exe

C:\Windows\System\jLlnoEL.exe

C:\Windows\System\jLlnoEL.exe

C:\Windows\System\lOQstCv.exe

C:\Windows\System\lOQstCv.exe

C:\Windows\System\KADLwMv.exe

C:\Windows\System\KADLwMv.exe

C:\Windows\System\rOHNLAH.exe

C:\Windows\System\rOHNLAH.exe

C:\Windows\System\KPYhNKr.exe

C:\Windows\System\KPYhNKr.exe

C:\Windows\System\cMYmQDm.exe

C:\Windows\System\cMYmQDm.exe

C:\Windows\System\qGiGeMn.exe

C:\Windows\System\qGiGeMn.exe

C:\Windows\System\JbLrZYr.exe

C:\Windows\System\JbLrZYr.exe

C:\Windows\System\kPBQiZC.exe

C:\Windows\System\kPBQiZC.exe

C:\Windows\System\bgOvlmI.exe

C:\Windows\System\bgOvlmI.exe

C:\Windows\System\REdqYCJ.exe

C:\Windows\System\REdqYCJ.exe

C:\Windows\System\hlEubql.exe

C:\Windows\System\hlEubql.exe

C:\Windows\System\LaBKzuu.exe

C:\Windows\System\LaBKzuu.exe

C:\Windows\System\oiAqPJV.exe

C:\Windows\System\oiAqPJV.exe

C:\Windows\System\uHgkyKQ.exe

C:\Windows\System\uHgkyKQ.exe

C:\Windows\System\RbPUwET.exe

C:\Windows\System\RbPUwET.exe

C:\Windows\System\uUvsgKz.exe

C:\Windows\System\uUvsgKz.exe

C:\Windows\System\xSkmtlR.exe

C:\Windows\System\xSkmtlR.exe

C:\Windows\System\OsSLXXL.exe

C:\Windows\System\OsSLXXL.exe

C:\Windows\System\DsUBOQS.exe

C:\Windows\System\DsUBOQS.exe

C:\Windows\System\xMIeAgH.exe

C:\Windows\System\xMIeAgH.exe

C:\Windows\System\DNSMUjb.exe

C:\Windows\System\DNSMUjb.exe

C:\Windows\System\RSSRjzl.exe

C:\Windows\System\RSSRjzl.exe

C:\Windows\System\aakLISO.exe

C:\Windows\System\aakLISO.exe

C:\Windows\System\rRZsKcL.exe

C:\Windows\System\rRZsKcL.exe

C:\Windows\System\IUpDhKA.exe

C:\Windows\System\IUpDhKA.exe

C:\Windows\System\TJZrVYo.exe

C:\Windows\System\TJZrVYo.exe

C:\Windows\System\rDMdDxM.exe

C:\Windows\System\rDMdDxM.exe

C:\Windows\System\ezLritk.exe

C:\Windows\System\ezLritk.exe

C:\Windows\System\rREgOVc.exe

C:\Windows\System\rREgOVc.exe

C:\Windows\System\jkZlNHY.exe

C:\Windows\System\jkZlNHY.exe

C:\Windows\System\EkwdGXq.exe

C:\Windows\System\EkwdGXq.exe

C:\Windows\System\jKoVike.exe

C:\Windows\System\jKoVike.exe

C:\Windows\System\NbnaelI.exe

C:\Windows\System\NbnaelI.exe

C:\Windows\System\FKLjwKa.exe

C:\Windows\System\FKLjwKa.exe

C:\Windows\System\txBqBjl.exe

C:\Windows\System\txBqBjl.exe

C:\Windows\System\rThZMqz.exe

C:\Windows\System\rThZMqz.exe

C:\Windows\System\hYNhSiq.exe

C:\Windows\System\hYNhSiq.exe

C:\Windows\System\tqrJXWq.exe

C:\Windows\System\tqrJXWq.exe

C:\Windows\System\zrJqrfx.exe

C:\Windows\System\zrJqrfx.exe

C:\Windows\System\DmjUFuH.exe

C:\Windows\System\DmjUFuH.exe

C:\Windows\System\lFHxjUO.exe

C:\Windows\System\lFHxjUO.exe

C:\Windows\System\LsmQcDT.exe

C:\Windows\System\LsmQcDT.exe

C:\Windows\System\kZUrTqc.exe

C:\Windows\System\kZUrTqc.exe

C:\Windows\System\TWCZwky.exe

C:\Windows\System\TWCZwky.exe

C:\Windows\System\XNuVIfk.exe

C:\Windows\System\XNuVIfk.exe

C:\Windows\System\jWYUNxq.exe

C:\Windows\System\jWYUNxq.exe

C:\Windows\System\zPMIEaA.exe

C:\Windows\System\zPMIEaA.exe

C:\Windows\System\ADxtrwC.exe

C:\Windows\System\ADxtrwC.exe

C:\Windows\System\emSTgkl.exe

C:\Windows\System\emSTgkl.exe

C:\Windows\System\OocvWgM.exe

C:\Windows\System\OocvWgM.exe

C:\Windows\System\nRRqImj.exe

C:\Windows\System\nRRqImj.exe

C:\Windows\System\tLWNTtR.exe

C:\Windows\System\tLWNTtR.exe

C:\Windows\System\TUOwIKX.exe

C:\Windows\System\TUOwIKX.exe

C:\Windows\System\VyvPTKQ.exe

C:\Windows\System\VyvPTKQ.exe

C:\Windows\System\VqOkcBn.exe

C:\Windows\System\VqOkcBn.exe

C:\Windows\System\lBqIxsC.exe

C:\Windows\System\lBqIxsC.exe

C:\Windows\System\ktXlDZd.exe

C:\Windows\System\ktXlDZd.exe

C:\Windows\System\sUBTahp.exe

C:\Windows\System\sUBTahp.exe

C:\Windows\System\xMYGRTf.exe

C:\Windows\System\xMYGRTf.exe

C:\Windows\System\KUFIojG.exe

C:\Windows\System\KUFIojG.exe

C:\Windows\System\BQenRWD.exe

C:\Windows\System\BQenRWD.exe

C:\Windows\System\eVPwgui.exe

C:\Windows\System\eVPwgui.exe

C:\Windows\System\iBHGxHq.exe

C:\Windows\System\iBHGxHq.exe

C:\Windows\System\jwoLACL.exe

C:\Windows\System\jwoLACL.exe

C:\Windows\System\kutXlBY.exe

C:\Windows\System\kutXlBY.exe

C:\Windows\System\vFnNSMV.exe

C:\Windows\System\vFnNSMV.exe

C:\Windows\System\azHOjLo.exe

C:\Windows\System\azHOjLo.exe

C:\Windows\System\EAmmWyU.exe

C:\Windows\System\EAmmWyU.exe

C:\Windows\System\ZzFqwym.exe

C:\Windows\System\ZzFqwym.exe

C:\Windows\System\rTJcrEa.exe

C:\Windows\System\rTJcrEa.exe

C:\Windows\System\GNZWZpR.exe

C:\Windows\System\GNZWZpR.exe

C:\Windows\System\WjCEsYU.exe

C:\Windows\System\WjCEsYU.exe

C:\Windows\System\RrzXjJt.exe

C:\Windows\System\RrzXjJt.exe

C:\Windows\System\VTsprZS.exe

C:\Windows\System\VTsprZS.exe

C:\Windows\System\ZOsvlam.exe

C:\Windows\System\ZOsvlam.exe

C:\Windows\System\moVanIR.exe

C:\Windows\System\moVanIR.exe

C:\Windows\System\BfdAqbF.exe

C:\Windows\System\BfdAqbF.exe

C:\Windows\System\iCDeNGW.exe

C:\Windows\System\iCDeNGW.exe

C:\Windows\System\gcdNMrB.exe

C:\Windows\System\gcdNMrB.exe

C:\Windows\System\cbHPQtg.exe

C:\Windows\System\cbHPQtg.exe

C:\Windows\System\vqldkKn.exe

C:\Windows\System\vqldkKn.exe

C:\Windows\System\GbHPAQe.exe

C:\Windows\System\GbHPAQe.exe

C:\Windows\System\IWrQwwH.exe

C:\Windows\System\IWrQwwH.exe

C:\Windows\System\dERqPKg.exe

C:\Windows\System\dERqPKg.exe

C:\Windows\System\okxNFkd.exe

C:\Windows\System\okxNFkd.exe

C:\Windows\System\StsoWvy.exe

C:\Windows\System\StsoWvy.exe

C:\Windows\System\SsKRemI.exe

C:\Windows\System\SsKRemI.exe

C:\Windows\System\UOFiivc.exe

C:\Windows\System\UOFiivc.exe

C:\Windows\System\xkrRDZr.exe

C:\Windows\System\xkrRDZr.exe

C:\Windows\System\LnNzMZa.exe

C:\Windows\System\LnNzMZa.exe

C:\Windows\System\QIGHLks.exe

C:\Windows\System\QIGHLks.exe

C:\Windows\System\GfpOXUO.exe

C:\Windows\System\GfpOXUO.exe

C:\Windows\System\GuzELHi.exe

C:\Windows\System\GuzELHi.exe

C:\Windows\System\AuXDyUF.exe

C:\Windows\System\AuXDyUF.exe

C:\Windows\System\NwAtFwL.exe

C:\Windows\System\NwAtFwL.exe

C:\Windows\System\PNqFIaO.exe

C:\Windows\System\PNqFIaO.exe

C:\Windows\System\TNDsnXw.exe

C:\Windows\System\TNDsnXw.exe

C:\Windows\System\aFzcamA.exe

C:\Windows\System\aFzcamA.exe

C:\Windows\System\uXKZAlv.exe

C:\Windows\System\uXKZAlv.exe

C:\Windows\System\jcbTDUl.exe

C:\Windows\System\jcbTDUl.exe

C:\Windows\System\YQPrOcL.exe

C:\Windows\System\YQPrOcL.exe

C:\Windows\System\hZcccdn.exe

C:\Windows\System\hZcccdn.exe

C:\Windows\System\sPJfzPK.exe

C:\Windows\System\sPJfzPK.exe

C:\Windows\System\oPBaWOG.exe

C:\Windows\System\oPBaWOG.exe

C:\Windows\System\kcoirAg.exe

C:\Windows\System\kcoirAg.exe

C:\Windows\System\GAFJGwO.exe

C:\Windows\System\GAFJGwO.exe

C:\Windows\System\UdfMHfh.exe

C:\Windows\System\UdfMHfh.exe

C:\Windows\System\muLXwxE.exe

C:\Windows\System\muLXwxE.exe

C:\Windows\System\ARZHVNj.exe

C:\Windows\System\ARZHVNj.exe

C:\Windows\System\ZdXHGeV.exe

C:\Windows\System\ZdXHGeV.exe

C:\Windows\System\oxVujaK.exe

C:\Windows\System\oxVujaK.exe

C:\Windows\System\vlEEoXC.exe

C:\Windows\System\vlEEoXC.exe

C:\Windows\System\TItNMkt.exe

C:\Windows\System\TItNMkt.exe

C:\Windows\System\vqwrgFn.exe

C:\Windows\System\vqwrgFn.exe

C:\Windows\System\OsRjlwl.exe

C:\Windows\System\OsRjlwl.exe

C:\Windows\System\KnOexYe.exe

C:\Windows\System\KnOexYe.exe

C:\Windows\System\CEeOkVr.exe

C:\Windows\System\CEeOkVr.exe

C:\Windows\System\KLzpKds.exe

C:\Windows\System\KLzpKds.exe

C:\Windows\System\wlmhjhw.exe

C:\Windows\System\wlmhjhw.exe

C:\Windows\System\YgvYxRW.exe

C:\Windows\System\YgvYxRW.exe

C:\Windows\System\fFtrgpI.exe

C:\Windows\System\fFtrgpI.exe

C:\Windows\System\HvSYYce.exe

C:\Windows\System\HvSYYce.exe

C:\Windows\System\LZNUPDb.exe

C:\Windows\System\LZNUPDb.exe

C:\Windows\System\lOVVqdj.exe

C:\Windows\System\lOVVqdj.exe

C:\Windows\System\UlUCfza.exe

C:\Windows\System\UlUCfza.exe

C:\Windows\System\BPAajcZ.exe

C:\Windows\System\BPAajcZ.exe

C:\Windows\System\FGTeSxj.exe

C:\Windows\System\FGTeSxj.exe

C:\Windows\System\Pauvnkv.exe

C:\Windows\System\Pauvnkv.exe

C:\Windows\System\hvLQOqT.exe

C:\Windows\System\hvLQOqT.exe

C:\Windows\System\QDKNuYj.exe

C:\Windows\System\QDKNuYj.exe

C:\Windows\System\liozArw.exe

C:\Windows\System\liozArw.exe

C:\Windows\System\VFwpYUT.exe

C:\Windows\System\VFwpYUT.exe

C:\Windows\System\mkMWTqO.exe

C:\Windows\System\mkMWTqO.exe

C:\Windows\System\LgkOJCa.exe

C:\Windows\System\LgkOJCa.exe

C:\Windows\System\JayFVht.exe

C:\Windows\System\JayFVht.exe

C:\Windows\System\JhZzgat.exe

C:\Windows\System\JhZzgat.exe

C:\Windows\System\GmwkGOY.exe

C:\Windows\System\GmwkGOY.exe

C:\Windows\System\GXAcQEP.exe

C:\Windows\System\GXAcQEP.exe

C:\Windows\System\iFFnHHn.exe

C:\Windows\System\iFFnHHn.exe

C:\Windows\System\gqMoEoq.exe

C:\Windows\System\gqMoEoq.exe

C:\Windows\System\DCLZomM.exe

C:\Windows\System\DCLZomM.exe

C:\Windows\System\oWhSEHW.exe

C:\Windows\System\oWhSEHW.exe

C:\Windows\System\aiGvJIk.exe

C:\Windows\System\aiGvJIk.exe

C:\Windows\System\QxRanQQ.exe

C:\Windows\System\QxRanQQ.exe

C:\Windows\System\nDHmpqq.exe

C:\Windows\System\nDHmpqq.exe

C:\Windows\System\rIymMwi.exe

C:\Windows\System\rIymMwi.exe

C:\Windows\System\JfUCwjv.exe

C:\Windows\System\JfUCwjv.exe

C:\Windows\System\DUGszCW.exe

C:\Windows\System\DUGszCW.exe

C:\Windows\System\hNNMxOT.exe

C:\Windows\System\hNNMxOT.exe

C:\Windows\System\vocRdVF.exe

C:\Windows\System\vocRdVF.exe

C:\Windows\System\cKEBGMQ.exe

C:\Windows\System\cKEBGMQ.exe

C:\Windows\System\VGrXhCy.exe

C:\Windows\System\VGrXhCy.exe

C:\Windows\System\tYpgCWf.exe

C:\Windows\System\tYpgCWf.exe

C:\Windows\System\EzWhaSh.exe

C:\Windows\System\EzWhaSh.exe

C:\Windows\System\tUuQeQn.exe

C:\Windows\System\tUuQeQn.exe

C:\Windows\System\YbyytpZ.exe

C:\Windows\System\YbyytpZ.exe

C:\Windows\System\tNYmGQh.exe

C:\Windows\System\tNYmGQh.exe

C:\Windows\System\hhtOXzl.exe

C:\Windows\System\hhtOXzl.exe

C:\Windows\System\VxYuEae.exe

C:\Windows\System\VxYuEae.exe

C:\Windows\System\XLzcQId.exe

C:\Windows\System\XLzcQId.exe

C:\Windows\System\gPerUDe.exe

C:\Windows\System\gPerUDe.exe

C:\Windows\System\MnQwASq.exe

C:\Windows\System\MnQwASq.exe

C:\Windows\System\XXkLhme.exe

C:\Windows\System\XXkLhme.exe

C:\Windows\System\JacmXfl.exe

C:\Windows\System\JacmXfl.exe

C:\Windows\System\XaWwoNB.exe

C:\Windows\System\XaWwoNB.exe

C:\Windows\System\cwVibmC.exe

C:\Windows\System\cwVibmC.exe

C:\Windows\System\jfIFPal.exe

C:\Windows\System\jfIFPal.exe

C:\Windows\System\xKNOOnV.exe

C:\Windows\System\xKNOOnV.exe

C:\Windows\System\SDxnoGg.exe

C:\Windows\System\SDxnoGg.exe

C:\Windows\System\GJPGfJc.exe

C:\Windows\System\GJPGfJc.exe

C:\Windows\System\ZTXsRjF.exe

C:\Windows\System\ZTXsRjF.exe

C:\Windows\System\XCkPyUg.exe

C:\Windows\System\XCkPyUg.exe

C:\Windows\System\yWOgMEG.exe

C:\Windows\System\yWOgMEG.exe

C:\Windows\System\FBGDPpW.exe

C:\Windows\System\FBGDPpW.exe

C:\Windows\System\ffmEfsG.exe

C:\Windows\System\ffmEfsG.exe

C:\Windows\System\XpBxEia.exe

C:\Windows\System\XpBxEia.exe

C:\Windows\System\ifFYRPU.exe

C:\Windows\System\ifFYRPU.exe

C:\Windows\System\YWdZZyK.exe

C:\Windows\System\YWdZZyK.exe

C:\Windows\System\mSSOZVT.exe

C:\Windows\System\mSSOZVT.exe

C:\Windows\System\NHjVLwt.exe

C:\Windows\System\NHjVLwt.exe

C:\Windows\System\CajrzNO.exe

C:\Windows\System\CajrzNO.exe

C:\Windows\System\ZQNohbR.exe

C:\Windows\System\ZQNohbR.exe

C:\Windows\System\mZFAbGH.exe

C:\Windows\System\mZFAbGH.exe

C:\Windows\System\MVqWHKE.exe

C:\Windows\System\MVqWHKE.exe

C:\Windows\System\omDmBvl.exe

C:\Windows\System\omDmBvl.exe

C:\Windows\System\bYdomTy.exe

C:\Windows\System\bYdomTy.exe

C:\Windows\System\RfUYHra.exe

C:\Windows\System\RfUYHra.exe

C:\Windows\System\rhgndsl.exe

C:\Windows\System\rhgndsl.exe

C:\Windows\System\jHIQsFw.exe

C:\Windows\System\jHIQsFw.exe

C:\Windows\System\vKuSnhN.exe

C:\Windows\System\vKuSnhN.exe

C:\Windows\System\uvegPpf.exe

C:\Windows\System\uvegPpf.exe

C:\Windows\System\EThhtyq.exe

C:\Windows\System\EThhtyq.exe

C:\Windows\System\JTQpolo.exe

C:\Windows\System\JTQpolo.exe

C:\Windows\System\foqFYXN.exe

C:\Windows\System\foqFYXN.exe

C:\Windows\System\BXzqBqk.exe

C:\Windows\System\BXzqBqk.exe

C:\Windows\System\QqpYWQX.exe

C:\Windows\System\QqpYWQX.exe

C:\Windows\System\HrBdcqB.exe

C:\Windows\System\HrBdcqB.exe

C:\Windows\System\tNLOMlU.exe

C:\Windows\System\tNLOMlU.exe

C:\Windows\System\owYtSLy.exe

C:\Windows\System\owYtSLy.exe

C:\Windows\System\BWRtbRW.exe

C:\Windows\System\BWRtbRW.exe

C:\Windows\System\NtRLBlg.exe

C:\Windows\System\NtRLBlg.exe

C:\Windows\System\UmWKkvX.exe

C:\Windows\System\UmWKkvX.exe

C:\Windows\System\DWgXyQz.exe

C:\Windows\System\DWgXyQz.exe

C:\Windows\System\QUnOeKt.exe

C:\Windows\System\QUnOeKt.exe

C:\Windows\System\azXylIT.exe

C:\Windows\System\azXylIT.exe

C:\Windows\System\KGQKcnQ.exe

C:\Windows\System\KGQKcnQ.exe

C:\Windows\System\PEOlvbF.exe

C:\Windows\System\PEOlvbF.exe

C:\Windows\System\kUAHAbE.exe

C:\Windows\System\kUAHAbE.exe

C:\Windows\System\prjEJAP.exe

C:\Windows\System\prjEJAP.exe

C:\Windows\System\NLWxqJc.exe

C:\Windows\System\NLWxqJc.exe

C:\Windows\System\npTXHHD.exe

C:\Windows\System\npTXHHD.exe

C:\Windows\System\EJKzkQC.exe

C:\Windows\System\EJKzkQC.exe

C:\Windows\System\vffPvkg.exe

C:\Windows\System\vffPvkg.exe

C:\Windows\System\tPhHUax.exe

C:\Windows\System\tPhHUax.exe

C:\Windows\System\lztaGFO.exe

C:\Windows\System\lztaGFO.exe

C:\Windows\System\DcnLzZO.exe

C:\Windows\System\DcnLzZO.exe

C:\Windows\System\AxLzZdd.exe

C:\Windows\System\AxLzZdd.exe

C:\Windows\System\mxWbDoX.exe

C:\Windows\System\mxWbDoX.exe

C:\Windows\System\cafkUYS.exe

C:\Windows\System\cafkUYS.exe

C:\Windows\System\eDLmAAO.exe

C:\Windows\System\eDLmAAO.exe

C:\Windows\System\gSTPJia.exe

C:\Windows\System\gSTPJia.exe

C:\Windows\System\oMOyplO.exe

C:\Windows\System\oMOyplO.exe

C:\Windows\System\QeDMcHO.exe

C:\Windows\System\QeDMcHO.exe

C:\Windows\System\FfgWPiA.exe

C:\Windows\System\FfgWPiA.exe

C:\Windows\System\DOgTOpN.exe

C:\Windows\System\DOgTOpN.exe

C:\Windows\System\fejTHFE.exe

C:\Windows\System\fejTHFE.exe

C:\Windows\System\JGscQUv.exe

C:\Windows\System\JGscQUv.exe

C:\Windows\System\KTdLMsi.exe

C:\Windows\System\KTdLMsi.exe

C:\Windows\System\fLUJlra.exe

C:\Windows\System\fLUJlra.exe

C:\Windows\System\VvaIxVi.exe

C:\Windows\System\VvaIxVi.exe

C:\Windows\System\MSMwdPd.exe

C:\Windows\System\MSMwdPd.exe

C:\Windows\System\XUKScYz.exe

C:\Windows\System\XUKScYz.exe

C:\Windows\System\CXVyNnV.exe

C:\Windows\System\CXVyNnV.exe

C:\Windows\System\qhVJeyq.exe

C:\Windows\System\qhVJeyq.exe

C:\Windows\System\DXNbmwN.exe

C:\Windows\System\DXNbmwN.exe

C:\Windows\System\fiJlIOZ.exe

C:\Windows\System\fiJlIOZ.exe

C:\Windows\System\tmBEayN.exe

C:\Windows\System\tmBEayN.exe

C:\Windows\System\PhMgyOQ.exe

C:\Windows\System\PhMgyOQ.exe

C:\Windows\System\ypujbso.exe

C:\Windows\System\ypujbso.exe

C:\Windows\System\bkLuHFu.exe

C:\Windows\System\bkLuHFu.exe

C:\Windows\System\MFDVCkn.exe

C:\Windows\System\MFDVCkn.exe

C:\Windows\System\qkwvUfx.exe

C:\Windows\System\qkwvUfx.exe

C:\Windows\System\qFiNPTR.exe

C:\Windows\System\qFiNPTR.exe

C:\Windows\System\cAzYOHa.exe

C:\Windows\System\cAzYOHa.exe

C:\Windows\System\uumvNJp.exe

C:\Windows\System\uumvNJp.exe

C:\Windows\System\PlEBVKs.exe

C:\Windows\System\PlEBVKs.exe

C:\Windows\System\ShUDnto.exe

C:\Windows\System\ShUDnto.exe

C:\Windows\System\IgPQQXj.exe

C:\Windows\System\IgPQQXj.exe

C:\Windows\System\kKxHqbo.exe

C:\Windows\System\kKxHqbo.exe

C:\Windows\System\XzxDeDq.exe

C:\Windows\System\XzxDeDq.exe

C:\Windows\System\nIMAqDB.exe

C:\Windows\System\nIMAqDB.exe

C:\Windows\System\Ufbnomx.exe

C:\Windows\System\Ufbnomx.exe

C:\Windows\System\zzZVcjF.exe

C:\Windows\System\zzZVcjF.exe

C:\Windows\System\XlDWzHz.exe

C:\Windows\System\XlDWzHz.exe

C:\Windows\System\yMibBaM.exe

C:\Windows\System\yMibBaM.exe

C:\Windows\System\tSJfKEo.exe

C:\Windows\System\tSJfKEo.exe

C:\Windows\System\AYocyTu.exe

C:\Windows\System\AYocyTu.exe

C:\Windows\System\iOLgZzD.exe

C:\Windows\System\iOLgZzD.exe

C:\Windows\System\NuIUUqr.exe

C:\Windows\System\NuIUUqr.exe

C:\Windows\System\awmdZHZ.exe

C:\Windows\System\awmdZHZ.exe

C:\Windows\System\uFbrdOL.exe

C:\Windows\System\uFbrdOL.exe

C:\Windows\System\myxPPwj.exe

C:\Windows\System\myxPPwj.exe

C:\Windows\System\cSZTTPh.exe

C:\Windows\System\cSZTTPh.exe

C:\Windows\System\NYrKkEa.exe

C:\Windows\System\NYrKkEa.exe

C:\Windows\System\jhRGori.exe

C:\Windows\System\jhRGori.exe

C:\Windows\System\uWRnnfG.exe

C:\Windows\System\uWRnnfG.exe

C:\Windows\System\dWRZVNy.exe

C:\Windows\System\dWRZVNy.exe

C:\Windows\System\TfSeMzh.exe

C:\Windows\System\TfSeMzh.exe

C:\Windows\System\VShiYzt.exe

C:\Windows\System\VShiYzt.exe

C:\Windows\System\hxKQcBH.exe

C:\Windows\System\hxKQcBH.exe

C:\Windows\System\rKOCtQj.exe

C:\Windows\System\rKOCtQj.exe

C:\Windows\System\tVpfEHE.exe

C:\Windows\System\tVpfEHE.exe

C:\Windows\System\vEYbPwx.exe

C:\Windows\System\vEYbPwx.exe

C:\Windows\System\HsUerOX.exe

C:\Windows\System\HsUerOX.exe

C:\Windows\System\yKnclKG.exe

C:\Windows\System\yKnclKG.exe

C:\Windows\System\gVCXVkg.exe

C:\Windows\System\gVCXVkg.exe

C:\Windows\System\WsThAtF.exe

C:\Windows\System\WsThAtF.exe

C:\Windows\System\nWBeZhG.exe

C:\Windows\System\nWBeZhG.exe

C:\Windows\System\BdeszXh.exe

C:\Windows\System\BdeszXh.exe

C:\Windows\System\yshGTMv.exe

C:\Windows\System\yshGTMv.exe

C:\Windows\System\ZZEIdOd.exe

C:\Windows\System\ZZEIdOd.exe

C:\Windows\System\RpfEyNo.exe

C:\Windows\System\RpfEyNo.exe

C:\Windows\System\XyagEod.exe

C:\Windows\System\XyagEod.exe

C:\Windows\System\JbnEAps.exe

C:\Windows\System\JbnEAps.exe

C:\Windows\System\teLoqfg.exe

C:\Windows\System\teLoqfg.exe

C:\Windows\System\pGjjMpM.exe

C:\Windows\System\pGjjMpM.exe

C:\Windows\System\lICvgKg.exe

C:\Windows\System\lICvgKg.exe

C:\Windows\System\OtUvVor.exe

C:\Windows\System\OtUvVor.exe

C:\Windows\System\RxzYlCy.exe

C:\Windows\System\RxzYlCy.exe

C:\Windows\System\GIjamqx.exe

C:\Windows\System\GIjamqx.exe

C:\Windows\System\YaZYuRN.exe

C:\Windows\System\YaZYuRN.exe

C:\Windows\System\NlucJcd.exe

C:\Windows\System\NlucJcd.exe

C:\Windows\System\MZvhcBS.exe

C:\Windows\System\MZvhcBS.exe

C:\Windows\System\GuSPBid.exe

C:\Windows\System\GuSPBid.exe

C:\Windows\System\sCagiCO.exe

C:\Windows\System\sCagiCO.exe

C:\Windows\System\GLpFJhq.exe

C:\Windows\System\GLpFJhq.exe

C:\Windows\System\NiNDHtA.exe

C:\Windows\System\NiNDHtA.exe

C:\Windows\System\yOynwMU.exe

C:\Windows\System\yOynwMU.exe

C:\Windows\System\VJEVmdU.exe

C:\Windows\System\VJEVmdU.exe

C:\Windows\System\hiSfTZE.exe

C:\Windows\System\hiSfTZE.exe

C:\Windows\System\JgBDLZz.exe

C:\Windows\System\JgBDLZz.exe

C:\Windows\System\kkmyoRQ.exe

C:\Windows\System\kkmyoRQ.exe

C:\Windows\System\aLaATjT.exe

C:\Windows\System\aLaATjT.exe

C:\Windows\System\MUDWwEW.exe

C:\Windows\System\MUDWwEW.exe

C:\Windows\System\douSwXZ.exe

C:\Windows\System\douSwXZ.exe

C:\Windows\System\QclhiMn.exe

C:\Windows\System\QclhiMn.exe

C:\Windows\System\fjqrERi.exe

C:\Windows\System\fjqrERi.exe

C:\Windows\System\dcOZtwE.exe

C:\Windows\System\dcOZtwE.exe

C:\Windows\System\Xcijtlv.exe

C:\Windows\System\Xcijtlv.exe

C:\Windows\System\QKyjaMk.exe

C:\Windows\System\QKyjaMk.exe

C:\Windows\System\JdTTYDa.exe

C:\Windows\System\JdTTYDa.exe

C:\Windows\System\RFpsLUR.exe

C:\Windows\System\RFpsLUR.exe

C:\Windows\System\LamIotQ.exe

C:\Windows\System\LamIotQ.exe

C:\Windows\System\HQrRdOF.exe

C:\Windows\System\HQrRdOF.exe

C:\Windows\System\GLmPHbL.exe

C:\Windows\System\GLmPHbL.exe

C:\Windows\System\nphLYCq.exe

C:\Windows\System\nphLYCq.exe

C:\Windows\System\cGURGkC.exe

C:\Windows\System\cGURGkC.exe

C:\Windows\System\mobPUMu.exe

C:\Windows\System\mobPUMu.exe

C:\Windows\System\glQzoei.exe

C:\Windows\System\glQzoei.exe

C:\Windows\System\YLgQRiX.exe

C:\Windows\System\YLgQRiX.exe

C:\Windows\System\ZpUEVuy.exe

C:\Windows\System\ZpUEVuy.exe

C:\Windows\System\RLKdtkI.exe

C:\Windows\System\RLKdtkI.exe

C:\Windows\System\aMCGleH.exe

C:\Windows\System\aMCGleH.exe

C:\Windows\System\LSyXJnp.exe

C:\Windows\System\LSyXJnp.exe

C:\Windows\System\VEbNMeS.exe

C:\Windows\System\VEbNMeS.exe

C:\Windows\System\NXDBjsk.exe

C:\Windows\System\NXDBjsk.exe

C:\Windows\System\wQhSGtV.exe

C:\Windows\System\wQhSGtV.exe

C:\Windows\System\utnrAfy.exe

C:\Windows\System\utnrAfy.exe

C:\Windows\System\rMFbBGu.exe

C:\Windows\System\rMFbBGu.exe

C:\Windows\System\NdiHpyq.exe

C:\Windows\System\NdiHpyq.exe

C:\Windows\System\vLbTSCa.exe

C:\Windows\System\vLbTSCa.exe

C:\Windows\System\ttIrXVe.exe

C:\Windows\System\ttIrXVe.exe

C:\Windows\System\JjkxSeL.exe

C:\Windows\System\JjkxSeL.exe

C:\Windows\System\YdnbBKo.exe

C:\Windows\System\YdnbBKo.exe

C:\Windows\System\VQGzMwr.exe

C:\Windows\System\VQGzMwr.exe

C:\Windows\System\OxQPziD.exe

C:\Windows\System\OxQPziD.exe

C:\Windows\System\qBAPpuh.exe

C:\Windows\System\qBAPpuh.exe

C:\Windows\System\CHsrqHR.exe

C:\Windows\System\CHsrqHR.exe

C:\Windows\System\NBcftCR.exe

C:\Windows\System\NBcftCR.exe

C:\Windows\System\KiNkrCL.exe

C:\Windows\System\KiNkrCL.exe

C:\Windows\System\RTgaPcF.exe

C:\Windows\System\RTgaPcF.exe

C:\Windows\System\fBNeidK.exe

C:\Windows\System\fBNeidK.exe

C:\Windows\System\DrvDEYq.exe

C:\Windows\System\DrvDEYq.exe

C:\Windows\System\tWgsGjW.exe

C:\Windows\System\tWgsGjW.exe

C:\Windows\System\tSBKppe.exe

C:\Windows\System\tSBKppe.exe

C:\Windows\System\gEtDoWR.exe

C:\Windows\System\gEtDoWR.exe

C:\Windows\System\WYjGDsn.exe

C:\Windows\System\WYjGDsn.exe

C:\Windows\System\QEXUsMh.exe

C:\Windows\System\QEXUsMh.exe

C:\Windows\System\CborxlF.exe

C:\Windows\System\CborxlF.exe

C:\Windows\System\RdARTWZ.exe

C:\Windows\System\RdARTWZ.exe

C:\Windows\System\xxlIZTj.exe

C:\Windows\System\xxlIZTj.exe

C:\Windows\System\dddkNjZ.exe

C:\Windows\System\dddkNjZ.exe

C:\Windows\System\OHdDUBJ.exe

C:\Windows\System\OHdDUBJ.exe

C:\Windows\System\qApnneO.exe

C:\Windows\System\qApnneO.exe

C:\Windows\System\DkgXXji.exe

C:\Windows\System\DkgXXji.exe

C:\Windows\System\rjOmflB.exe

C:\Windows\System\rjOmflB.exe

C:\Windows\System\FKfbCLy.exe

C:\Windows\System\FKfbCLy.exe

C:\Windows\System\ANNkBtc.exe

C:\Windows\System\ANNkBtc.exe

C:\Windows\System\zmFdVfi.exe

C:\Windows\System\zmFdVfi.exe

C:\Windows\System\lhRHkjf.exe

C:\Windows\System\lhRHkjf.exe

C:\Windows\System\rKBcGCQ.exe

C:\Windows\System\rKBcGCQ.exe

C:\Windows\System\vqolFld.exe

C:\Windows\System\vqolFld.exe

C:\Windows\System\vuFzpab.exe

C:\Windows\System\vuFzpab.exe

C:\Windows\System\OjCaijo.exe

C:\Windows\System\OjCaijo.exe

C:\Windows\System\ZNraiUh.exe

C:\Windows\System\ZNraiUh.exe

C:\Windows\System\okDSwPu.exe

C:\Windows\System\okDSwPu.exe

C:\Windows\System\eKyeVvY.exe

C:\Windows\System\eKyeVvY.exe

C:\Windows\System\WHghoUt.exe

C:\Windows\System\WHghoUt.exe

C:\Windows\System\YLTFmgI.exe

C:\Windows\System\YLTFmgI.exe

C:\Windows\System\ryDFbBl.exe

C:\Windows\System\ryDFbBl.exe

C:\Windows\System\YHNMcTX.exe

C:\Windows\System\YHNMcTX.exe

C:\Windows\System\UVmDJAk.exe

C:\Windows\System\UVmDJAk.exe

C:\Windows\System\AUUFjJB.exe

C:\Windows\System\AUUFjJB.exe

C:\Windows\System\LPDFfky.exe

C:\Windows\System\LPDFfky.exe

C:\Windows\System\mldtCyW.exe

C:\Windows\System\mldtCyW.exe

C:\Windows\System\iYBIltH.exe

C:\Windows\System\iYBIltH.exe

C:\Windows\System\sryTLJi.exe

C:\Windows\System\sryTLJi.exe

C:\Windows\System\xkCOqmk.exe

C:\Windows\System\xkCOqmk.exe

C:\Windows\System\Wwxtnvx.exe

C:\Windows\System\Wwxtnvx.exe

C:\Windows\System\cwTpshN.exe

C:\Windows\System\cwTpshN.exe

C:\Windows\System\JPUgrGX.exe

C:\Windows\System\JPUgrGX.exe

C:\Windows\System\jPgWijH.exe

C:\Windows\System\jPgWijH.exe

C:\Windows\System\RyXwgwH.exe

C:\Windows\System\RyXwgwH.exe

C:\Windows\System\OrzoSpx.exe

C:\Windows\System\OrzoSpx.exe

C:\Windows\System\xZcNpIr.exe

C:\Windows\System\xZcNpIr.exe

C:\Windows\System\NOvmkEQ.exe

C:\Windows\System\NOvmkEQ.exe

C:\Windows\System\ovmLNyB.exe

C:\Windows\System\ovmLNyB.exe

C:\Windows\System\mraWVey.exe

C:\Windows\System\mraWVey.exe

C:\Windows\System\YushNmM.exe

C:\Windows\System\YushNmM.exe

C:\Windows\System\LIRsbCq.exe

C:\Windows\System\LIRsbCq.exe

C:\Windows\System\GGRaYpI.exe

C:\Windows\System\GGRaYpI.exe

C:\Windows\System\sYEODvK.exe

C:\Windows\System\sYEODvK.exe

C:\Windows\System\GwVVuYT.exe

C:\Windows\System\GwVVuYT.exe

C:\Windows\System\lGhGdOp.exe

C:\Windows\System\lGhGdOp.exe

C:\Windows\System\qnjAqPp.exe

C:\Windows\System\qnjAqPp.exe

C:\Windows\System\dsKxHui.exe

C:\Windows\System\dsKxHui.exe

C:\Windows\System\ZepnHxN.exe

C:\Windows\System\ZepnHxN.exe

C:\Windows\System\FesnnEr.exe

C:\Windows\System\FesnnEr.exe

C:\Windows\System\dXdpsSB.exe

C:\Windows\System\dXdpsSB.exe

C:\Windows\System\ALoGIuq.exe

C:\Windows\System\ALoGIuq.exe

C:\Windows\System\JyQIACv.exe

C:\Windows\System\JyQIACv.exe

C:\Windows\System\NBhrlhu.exe

C:\Windows\System\NBhrlhu.exe

C:\Windows\System\dCQGoaY.exe

C:\Windows\System\dCQGoaY.exe

C:\Windows\System\XvgrVuE.exe

C:\Windows\System\XvgrVuE.exe

C:\Windows\System\ExaqluZ.exe

C:\Windows\System\ExaqluZ.exe

C:\Windows\System\elEsncm.exe

C:\Windows\System\elEsncm.exe

C:\Windows\System\IBbHiWF.exe

C:\Windows\System\IBbHiWF.exe

C:\Windows\System\IXpdzaK.exe

C:\Windows\System\IXpdzaK.exe

C:\Windows\System\EeZpGSM.exe

C:\Windows\System\EeZpGSM.exe

C:\Windows\System\zAJmNgq.exe

C:\Windows\System\zAJmNgq.exe

C:\Windows\System\iotQIMl.exe

C:\Windows\System\iotQIMl.exe

C:\Windows\System\BlrMZxe.exe

C:\Windows\System\BlrMZxe.exe

C:\Windows\System\vPLurzu.exe

C:\Windows\System\vPLurzu.exe

C:\Windows\System\YxMkriO.exe

C:\Windows\System\YxMkriO.exe

C:\Windows\System\XKHdPSY.exe

C:\Windows\System\XKHdPSY.exe

C:\Windows\System\wbUXExy.exe

C:\Windows\System\wbUXExy.exe

C:\Windows\System\NavaMZp.exe

C:\Windows\System\NavaMZp.exe

C:\Windows\System\LWZMPin.exe

C:\Windows\System\LWZMPin.exe

C:\Windows\System\vVFFrte.exe

C:\Windows\System\vVFFrte.exe

C:\Windows\System\TYqeCZs.exe

C:\Windows\System\TYqeCZs.exe

C:\Windows\System\HxlpfBi.exe

C:\Windows\System\HxlpfBi.exe

C:\Windows\System\qVhZyvG.exe

C:\Windows\System\qVhZyvG.exe

C:\Windows\System\pjrocyL.exe

C:\Windows\System\pjrocyL.exe

C:\Windows\System\JtbUagF.exe

C:\Windows\System\JtbUagF.exe

C:\Windows\System\PuUmhFW.exe

C:\Windows\System\PuUmhFW.exe

C:\Windows\System\VgrSIPR.exe

C:\Windows\System\VgrSIPR.exe

C:\Windows\System\XdozWXS.exe

C:\Windows\System\XdozWXS.exe

C:\Windows\System\eABLSfu.exe

C:\Windows\System\eABLSfu.exe

C:\Windows\System\ubbnELf.exe

C:\Windows\System\ubbnELf.exe

C:\Windows\System\zlQioSF.exe

C:\Windows\System\zlQioSF.exe

C:\Windows\System\sIlZbqG.exe

C:\Windows\System\sIlZbqG.exe

C:\Windows\System\EoDgXzj.exe

C:\Windows\System\EoDgXzj.exe

C:\Windows\System\CKdhFAs.exe

C:\Windows\System\CKdhFAs.exe

C:\Windows\System\PLkozqe.exe

C:\Windows\System\PLkozqe.exe

C:\Windows\System\uxFQypw.exe

C:\Windows\System\uxFQypw.exe

C:\Windows\System\qKIlulC.exe

C:\Windows\System\qKIlulC.exe

C:\Windows\System\SmvLJpH.exe

C:\Windows\System\SmvLJpH.exe

C:\Windows\System\OVQFFqS.exe

C:\Windows\System\OVQFFqS.exe

C:\Windows\System\yNnsccL.exe

C:\Windows\System\yNnsccL.exe

C:\Windows\System\cdLraDI.exe

C:\Windows\System\cdLraDI.exe

C:\Windows\System\EYjeqbd.exe

C:\Windows\System\EYjeqbd.exe

C:\Windows\System\DtXLOJr.exe

C:\Windows\System\DtXLOJr.exe

C:\Windows\System\XHizSnD.exe

C:\Windows\System\XHizSnD.exe

C:\Windows\System\pGIgBtJ.exe

C:\Windows\System\pGIgBtJ.exe

C:\Windows\System\vROiCYE.exe

C:\Windows\System\vROiCYE.exe

C:\Windows\System\DyUGQca.exe

C:\Windows\System\DyUGQca.exe

C:\Windows\System\VMRiYhM.exe

C:\Windows\System\VMRiYhM.exe

C:\Windows\System\egRTbwq.exe

C:\Windows\System\egRTbwq.exe

C:\Windows\System\jegXVYa.exe

C:\Windows\System\jegXVYa.exe

C:\Windows\System\GrqLdMR.exe

C:\Windows\System\GrqLdMR.exe

C:\Windows\System\iRcrYmI.exe

C:\Windows\System\iRcrYmI.exe

C:\Windows\System\wtimiTF.exe

C:\Windows\System\wtimiTF.exe

C:\Windows\System\hqDINaG.exe

C:\Windows\System\hqDINaG.exe

C:\Windows\System\wCecsbK.exe

C:\Windows\System\wCecsbK.exe

C:\Windows\System\LUtngLn.exe

C:\Windows\System\LUtngLn.exe

C:\Windows\System\KATdxCh.exe

C:\Windows\System\KATdxCh.exe

C:\Windows\System\fPQcvMK.exe

C:\Windows\System\fPQcvMK.exe

C:\Windows\System\tlCEnFv.exe

C:\Windows\System\tlCEnFv.exe

C:\Windows\System\egMIUMX.exe

C:\Windows\System\egMIUMX.exe

C:\Windows\System\IycEHFn.exe

C:\Windows\System\IycEHFn.exe

C:\Windows\System\qXvIeAL.exe

C:\Windows\System\qXvIeAL.exe

C:\Windows\System\BKxYStH.exe

C:\Windows\System\BKxYStH.exe

C:\Windows\System\ZhgEstQ.exe

C:\Windows\System\ZhgEstQ.exe

C:\Windows\System\ybOQcBJ.exe

C:\Windows\System\ybOQcBJ.exe

C:\Windows\System\ijLTLND.exe

C:\Windows\System\ijLTLND.exe

C:\Windows\System\BggqBOs.exe

C:\Windows\System\BggqBOs.exe

C:\Windows\System\BNtHZam.exe

C:\Windows\System\BNtHZam.exe

C:\Windows\System\bcjaYgu.exe

C:\Windows\System\bcjaYgu.exe

C:\Windows\System\ZoLRiII.exe

C:\Windows\System\ZoLRiII.exe

C:\Windows\System\PEDStFB.exe

C:\Windows\System\PEDStFB.exe

C:\Windows\System\HAqkZXl.exe

C:\Windows\System\HAqkZXl.exe

C:\Windows\System\VxDiDiN.exe

C:\Windows\System\VxDiDiN.exe

C:\Windows\System\dHlOABR.exe

C:\Windows\System\dHlOABR.exe

C:\Windows\System\UnXYwCv.exe

C:\Windows\System\UnXYwCv.exe

C:\Windows\System\LSBBYAT.exe

C:\Windows\System\LSBBYAT.exe

C:\Windows\System\MNKVSUK.exe

C:\Windows\System\MNKVSUK.exe

C:\Windows\System\lBwgApm.exe

C:\Windows\System\lBwgApm.exe

C:\Windows\System\xozQcgu.exe

C:\Windows\System\xozQcgu.exe

C:\Windows\System\UIRQmov.exe

C:\Windows\System\UIRQmov.exe

C:\Windows\System\kAoeGQU.exe

C:\Windows\System\kAoeGQU.exe

C:\Windows\System\nmkfkcT.exe

C:\Windows\System\nmkfkcT.exe

C:\Windows\System\AemXBrD.exe

C:\Windows\System\AemXBrD.exe

C:\Windows\System\YIPbhnK.exe

C:\Windows\System\YIPbhnK.exe

C:\Windows\System\PGunlvT.exe

C:\Windows\System\PGunlvT.exe

C:\Windows\System\tepKXAW.exe

C:\Windows\System\tepKXAW.exe

C:\Windows\System\mYoormE.exe

C:\Windows\System\mYoormE.exe

C:\Windows\System\NjQbMDN.exe

C:\Windows\System\NjQbMDN.exe

C:\Windows\System\WLnRDti.exe

C:\Windows\System\WLnRDti.exe

C:\Windows\System\GdruJem.exe

C:\Windows\System\GdruJem.exe

C:\Windows\System\IYAGeRC.exe

C:\Windows\System\IYAGeRC.exe

C:\Windows\System\DVUriFl.exe

C:\Windows\System\DVUriFl.exe

C:\Windows\System\QMFhWlu.exe

C:\Windows\System\QMFhWlu.exe

C:\Windows\System\fXUYMyw.exe

C:\Windows\System\fXUYMyw.exe

C:\Windows\System\QFREsoG.exe

C:\Windows\System\QFREsoG.exe

C:\Windows\System\sDsJZnm.exe

C:\Windows\System\sDsJZnm.exe

C:\Windows\System\bvEVkrO.exe

C:\Windows\System\bvEVkrO.exe

C:\Windows\System\eBmmlhq.exe

C:\Windows\System\eBmmlhq.exe

C:\Windows\System\TCNvNsr.exe

C:\Windows\System\TCNvNsr.exe

C:\Windows\System\dyXbDHs.exe

C:\Windows\System\dyXbDHs.exe

Network

N/A

Files

memory/1872-0-0x000000013F2A0000-0x000000013F5F1000-memory.dmp

memory/1872-1-0x0000000000080000-0x0000000000090000-memory.dmp

C:\Windows\system\lXoKLXx.exe

MD5	296bb3d3151f5f87f3f689437a499d2d
SHA1	58a1611f1f5fe0a460024b89dc065deb71f97bdd
SHA256	dc9ad5f29b2071e5f44ae88f7cfc20c840c005a85f9e4aeb4df357ca05a3c26b
SHA512	99f4f236ad8ea4e6d25ae4c65a662abea3036f48f5ed7cefcd555faf07804a05f9ad75a2074889c25945f78d703e7878e6b3a54b2499ce2970f3d4c197bf9c5c

C:\Windows\system\XljVDoh.exe

MD5	2d575876f98a4a3539396d304b4e3eb7
SHA1	9ee24e09996df8e729b80f009fd395c5740732a7
SHA256	b140ff9d950ef3e9bbb8fe42b6170eb4139295a35a44de1695620ea713860ba0
SHA512	0b48546572192b36bb4e127facb40e2c8ef4a767f6484050c2c5863ba4379e4174d5aff5d03546132a2074f92a0ed2a290be4572a377fe01d58b4d47e444a3ca

memory/3032-20-0x000000013FF40000-0x0000000140291000-memory.dmp

C:\Windows\system\NDPpENt.exe

MD5	76713011e6613fa068ce524098e72ee4
SHA1	283f8caefc4c8720d8d47096749690ac80802a44
SHA256	72bc351cd6fee03c85d4fd077e4a9ded2ab0db1bbf37d1f579a0aaad838197d6
SHA512	49f79a0830bb885847dcc69bf468893d1a42909e952b90b78d62b2d9d239dfde43179dbd500567dbbbccb5abd9cdf5ae6619e9a552b7df84e8ffe4f9c7de0640

memory/1872-19-0x000000013FF40000-0x0000000140291000-memory.dmp

C:\Windows\system\PtmjTXg.exe

MD5	91aa29b325594f4689a016f415d12cbc
SHA1	985976c64cb5ef24d3f6a9b9e6658fdcd33a5be9
SHA256	fea0f275c5e37b67ef380c0ffa7a806d534f63374eaa6ba9b340d4f17be8c021
SHA512	7f2a4d309d7f91a096c3c22794f4da53397d6c66d66dfb3ccf01b999f7f378fffdca093df4de662073cf37808e332021b7c72f59ae8f773fa4ca09ce3984d978

memory/1872-27-0x000000013F990000-0x000000013FCE1000-memory.dmp

C:\Windows\system\linJBYP.exe

MD5	c5fdac1856ddd21eeb925583cd999c41
SHA1	c7b698d7efec909496592b39fe1a7be7e3403aa6
SHA256	01a991c57ebb63324c012306297d8a263bed2501fae0797932df30e36c05e37a
SHA512	b0205620290f3865ea2f7aeba42c05185a09c4398e5df3fb1197e23e559acfa4ddfdc15cfe3109e3d9a4296ecb0b64308d45820524bf0d9c669b1ec391dde0cd

\Windows\system\quDHuQU.exe

MD5	1e1843f138a6bbb4c3bcbc424d5dc183
SHA1	fd9bc33ff5f8aca5800b2f9b5ada0ea0378d134c
SHA256	777ad6fea96315cc1cfc106d75cf94883b8977f9c3e6902d080c4844d7e15928
SHA512	ec9f80957028e1338198dc6328b1f50139e6009a0763c0ba6ff2bb5e4e708bebc96ffb42068f4ec611f1dc0c9af366eb5a1107233f9cd3e5a7290f71b53e63ec

memory/1872-38-0x000000013FF40000-0x0000000140291000-memory.dmp

memory/2724-39-0x000000013FF40000-0x0000000140291000-memory.dmp

memory/1872-110-0x000000013F2A0000-0x000000013F5F1000-memory.dmp

\Windows\system\hDxJiJf.exe

MD5	012299a0679a9596114aef0421d5b1c6
SHA1	12150971f7809f722ef7108651e75fffda42b50f
SHA256	48ebfc82dd285e8784cac6b1c65bed481c5e2ca421217ffef9dffd5c8cc83438
SHA512	98fd45a55b79be0df9092357c91af1fc960aa9e5f7140bd3944896e5a4da79172a778796d0897c0f04acbaec118cc5a501f4d456f67dd48a49258e6cba0fd040

C:\Windows\system\bgJRaRA.exe

MD5	b728ca7f44cf3d28d4bede36d871313d
SHA1	c1450219e5d1203861ffdb217867056a863e20a6
SHA256	6bec31cb75317c923c374d6c2e4efb5afb4e13c721084b9a4b6a16a15889aeab
SHA512	186a66bad1cf05344c8c670b412f8dd1942661d7d131b43392c45c3b33ec52ac1f3f9c8262781737331bf8065d528b9b0b8af90d6d8a112b9b077884c1a69d98

C:\Windows\system\aVcjSge.exe

MD5	4091f5a3c587bf2a14da3800c542ad1a
SHA1	846527737f8a160df1adc0d9b0efdc7f3c824ed3
SHA256	fa0efcd17512f3be9b746725bf918adc6d40045e8612e37246c86c9c267df1a8
SHA512	758b51d6fae1a40428cd3c75958932c4298b4bdbd05e7a55e3a8c39da6852de3863aa011031e040d4bd0711d1dc895e913fdb79dffd146d530f8a253606a0b1e

memory/3032-470-0x000000013FF40000-0x0000000140291000-memory.dmp

memory/2880-469-0x000000013F110000-0x000000013F461000-memory.dmp

memory/1872-468-0x000000013FE30000-0x0000000140181000-memory.dmp

C:\Windows\system\dvPEQAR.exe

MD5	b1b492b60a5bb734b6f00046313ca6a1
SHA1	44c0863db7f4044fbe21609f43fb950fd492fff9
SHA256	63ae63530ce0daf4ec03fb64481fe86ff35e700f5b67442ee66b2bf69ff6675e
SHA512	aae31c97e55a661acd9403e2c85e9602ee096303979373f875d3797353eb8518bf13f6280d718888744f561b9d9938a3bfe49d5d6396c24c53098699691fc76e

C:\Windows\system\faPaKmJ.exe

MD5	a317f83ef1a8e84e3de95922ad5ff51d
SHA1	ec5a3f65e563c8cb3f4ab9d955009b35b14e66cf
SHA256	d27dc501b33bd18595cb90097468db6ea7e90c935fb01dc19e9e25fca2b2aeb8
SHA512	5dff1486d8e82fa86f75e31509211700aa93100aa39cd8dc290b3fc0170166342163ed6c7b9242fa1ec5bfae7f01240b41726ed6092495e63c12839cb4f482cb

C:\Windows\system\odlqneE.exe

MD5	5fbe5726953db47439b67256e91cc5d4
SHA1	1af91801fe0b9fab68084eae54d720f314a23a67
SHA256	31ad7f40d8bb269f5351e09ac323a8e5a195c20f671ba3f29f67b413f4c6363d
SHA512	c2a4a90decf9deab1202c5dec3b24b13582a8b1d33fe8cec9b83ff82213d2bcb6e729111b4173736cd91846c6b321053689ba427f1f8f977b7d5514b491d6aff

C:\Windows\system\oIlVSYi.exe

MD5	5d0e25a9df9744aa6b4f6ccaa5318070
SHA1	0a70702e4b9ecfe9d776a3ed264dd957ebea0fa7
SHA256	d8bf286bd61d82cff2f8ed46ab2589363fa33cded970aba745a84adfbd4a804d
SHA512	a4bd2e283b27f2ac57f83280478beeb168e32f1be8859064b4ca09a3fdad1ef00f916032801bed21c1a12ccdd3d6c056e67c438d56dab84dff365f6830c0f989

C:\Windows\system\ucMUZnc.exe

MD5	9e8b06ddf6f22db6e976769216a39f7c
SHA1	189396f6c5a615fcf203d9fe645f4bc5ff2b0ef3
SHA256	4ce77d9f7f190a38890291cd830fef152712cd07cfc0978d2b583d83d4fda4c3
SHA512	8e25b344f4960d6e57d1c35da4d119035bb1712fc1cd3267369268d567b97c0926b0d909dc594265b58148b63b12c4a6a526f0d93e110757106ece079164fcd4

C:\Windows\system\kjKOMZo.exe

MD5	1c715334523be5951ca24ce450369f93
SHA1	d347ceee594d19988f246ea5c583416be24cfb55
SHA256	3a93b0ca83bc5b9a952429086b091fdf35f818c8ece71601789918d8939213e3
SHA512	dca4787ffdb135f9f1de92fb98f77f6c33de1f4880aec6c611dc4d94de0e651b09dfbb8c7e5216bafc506de416241965d5f0c04c8d76b83eabd4e9175159b2a2

C:\Windows\system\ACRfqnq.exe

MD5	fe34a4a4e54ed28db6e7720294e88b45
SHA1	94395731e6b1b7084c81666d435aabdf714e470d
SHA256	5ad4de9fc27bf4b1afc352f406965097658dd798a5351d7f2985f8a503500ebe
SHA512	a0ec7906416463dc80d31b1185e32248115743f571c3027aa0dad1533d4a49e43210e6b2fe45bfa2c4f994b36894bcb256c475d8d0411a69dc4d673f2b0ccae1

C:\Windows\system\YruYdVD.exe

MD5	b26bc020bccf41d6a74d113fb99c1da1
SHA1	d88493ba9db378713b95d5327879290ed5e2d05c
SHA256	df88043e6f9990dbe9fb43d4b4a7911995b4bcb1830434d17dda84e4a7874fe0
SHA512	580627b6b57aae3bb74f1b62d6f37c88d17f1b92af7b5fc79c17d360f275443c84a3fc175ad17b724212adbb0dda8ba7a9b08809101c803903ca2ccd9266683f

C:\Windows\system\dGlIIqR.exe

MD5	73efa2f24debb218aae2cf4cf47a73fb
SHA1	adea90bad0659783ac3d2146fc84c4701b08f251
SHA256	8bc5c209893c125b5b421356a35688adbf1128710f1bed73eea8db358f806429
SHA512	569e530b8534e91ecb82d5167cce30b46be358faaa06391d44c0033b2756160f27e729c6eb460ef15f056b44975aa6731fdabd3b091d1bdcb2c5d6a1e8804968

C:\Windows\system\UnyGosW.exe

MD5	ac4115175ee1fa1531d748ceaaed2ab7
SHA1	2db94fb1b629de360b8db884738224ac95d261a8
SHA256	09ebf66da41c736848f07c4dd3634985477dd64584c9e2938202994f7971cce9
SHA512	dacc583c07cf92e1bac3ddb3bf3062ddb4577b201a2ec542dc2e9f37dce2f62b3a3a676c339561f34d3894f81afe486ab6ca868cb26a3494827710ec8a0cf797

C:\Windows\system\yPqxAct.exe

MD5	855d6b6e8e30ed9e9095e69ec7473ca8
SHA1	346e601f956de94f87e5d8b065ea440d0db92707
SHA256	120e15a8332c4897db78c8002570b0ac22f23d61f29ba23eca680be3e4183beb
SHA512	63477ee3a441e51387be21f5455d17b7fb8d70b0dd6d402889cd18a02989d40ac8590738bbefca00cbd66046fe044bacb2670f7fb7bec152a7503decaff2ee27

memory/1872-101-0x000000013FD90000-0x00000001400E1000-memory.dmp

\Windows\system\RpCEfrz.exe

MD5	ffa3f52066b168fe7912d4f8e4e0cd52
SHA1	1c40393574da6c126b3a0d9af6d24dd95f8d768c
SHA256	f101361bb03b57a34df96e4579afcb278f58cd3449dd88c3ab8c66e03a2f1fb8
SHA512	0fc77edb8223296cd30e6f556faf714f51acbd2c8325fc066c15693a8f08f39a11d8b9a3b161a0ed213830640b3ec250cc72a2965374d3017d7641c0938f0e00

C:\Windows\system\xnDEJKR.exe

MD5	f3903b97bfe8d6fa8e779fcd99cad2ae
SHA1	bd2966120da2d87a74c98b5961905a545c7ad31b
SHA256	53314462505d2d0c655e8660b4f2dabf67b48d85e8795d35c62456f67a4964f2
SHA512	fea4dfcb0c0e65221d6cd928c40ffcba9f8ff5e3b28b2f74c9cfa4d4d9a8af5d1fefe443da5b8f9f9a05986abd878c5e9f0d8c3ea337809ad77fa37c3a85ce38

\Windows\system\jKOtqFP.exe

MD5	76b90b6688b82b4494f679fd5394e9c7
SHA1	e319f467607e5f3a5ad7998014244a23660c0c04
SHA256	635d83670fbe09ef2d14cfa2c5cef968f8fc25b416a8a08912b26a91001902a8
SHA512	b407b4724894eea46e5dd376505a4696bcb18158f5aa16f7f58955f43bc76b0e5500db824196c9133967f63d76861c6a3a646c04ae31cd24cf915ac3acf13c90

\Windows\system\bHUAJAY.exe

MD5	3abbe8b617d1ae05d3bc5d659515ee88
SHA1	1d12a7018b3ab4194ecbd01a724c888bc0168616
SHA256	f317583f84d3f6cfbbd2884b5a8251400060820600d3c5614deb803197eaba55
SHA512	d35669c37090a2f51eae12958c6e11bf34362efb7ede1c2f83ff329b311cdf9c7bcc3be87ee4ea8b9a1e84cf2ce884c6e53b2575ab09e40397b1ce9a7bdea4de

memory/2492-112-0x000000013F9F0000-0x000000013FD41000-memory.dmp

memory/2948-111-0x000000013FE30000-0x0000000140181000-memory.dmp

memory/2432-69-0x000000013F510000-0x000000013F861000-memory.dmp

memory/2456-68-0x000000013FB40000-0x000000013FE91000-memory.dmp

memory/1872-109-0x000000013FB40000-0x000000013FE91000-memory.dmp

memory/1504-108-0x000000013F110000-0x000000013F461000-memory.dmp

C:\Windows\system\jEEWKxV.exe

MD5	e68d4c3f8b725f40f8fed0a570c98ce6
SHA1	518b8e73bbfc58cbd341b35a418b7597348c40d1
SHA256	378cfd298f159ccad4a2ea2a3373f2ae3d729483a0a4b37189c95133de2e735f
SHA512	eddb87b8ba4312a50b62ff09ee7d54ab944d03bcb3058b5d8893c676fa022331c5b4150905c0e5df67e507c9dd28c295cc6c019d0f072de82afd48978d1df7eb

C:\Windows\system\HXNcovF.exe

MD5	1d978e9971fcbd6d157fe0479b469f9e
SHA1	888e4e586b7729386b1eed02d6b609dc8b74f600
SHA256	0df960dd8a2255b3a232b44752c521389b3f1b526b4404f99f59d502c0e531be
SHA512	fe9f8b1a10132b531c3fdfcde16ae752074f003a81d665523d62d10c7f9280b22c27954f53cc24031b79a6b381b9b89ffffd2d5d74272d2ec9d2ba0ed3cd3ce8

memory/1872-105-0x0000000001EE0000-0x0000000002231000-memory.dmp

memory/2972-97-0x000000013F1F0000-0x000000013F541000-memory.dmp

C:\Windows\system\xwkObqk.exe

MD5	e271491f629001c170893afdfd9d5257
SHA1	d7c953dbedee4185bb207cbe643b72ce29795402
SHA256	81f59aedd4e2421934378b50fa37ea715bd99e1fa8ebeb32a5a37354d1c3bc4a
SHA512	58660f726431883b4b7904ed3c847924136b20297f8fedfdbb9741b753a8b015d7666989b34141d21b8f7065c2c5ad12f4664126bd30b3f63371c33a171f318a

C:\Windows\system\GvisYtL.exe

MD5	8484dabc16352b228025b234527fa1ec
SHA1	748eb0cbbcde08059b0b222ba0e1851779ff9eb1
SHA256	951e3c62081a753c3fbbe0408a1c1b5fb4c466ee5213343e05451df5a33af244
SHA512	18f819336f0c3ae4b7372defa125123c9e5ce4936559893ce3cde35791f04a9083b44329d318bf4c51bbca1efaf782e06a8333a1d60cb2c661c7cd546d05a035

C:\Windows\system\RziLVFo.exe

MD5	bff0087d83e62f877b12846649caa951
SHA1	31a672cf7ae4a9b8f6eaa12951ea2ee086571a9c
SHA256	94fab56335c2a77d1356fe7ea27995702e577b574dafe50549f828146fed6645
SHA512	d681f7a34eac4c0a636223eacd43ae943a19c0fd6a3a6ef55b2c9a25a565b615c50dd93ae760b01cd021c52f84b15f75f4fb8b7ac7e7f26e19aa833dc20d7607

C:\Windows\system\ksWofXE.exe

MD5	a303741a99624b5f45d205f158f63428
SHA1	969d0d0cf6b392da2b038fc721f6322596e29abb
SHA256	d33eea9aef49f5b7248fd11b4189d11521f81fb063119129e6b880d6fada21a7
SHA512	adace7001793dcb29a7acb41ab211e4628fe3e7d5318c1ad80ca27f1923c612c5a82e805aa38de1bcd29b89e3b674d756727e3da8f0f406b6eb5fff43b7e8393

memory/1872-64-0x0000000001EE0000-0x0000000002231000-memory.dmp

memory/2544-63-0x000000013FC50000-0x000000013FFA1000-memory.dmp

memory/1872-62-0x000000013FC50000-0x000000013FFA1000-memory.dmp

memory/1872-61-0x000000013FB40000-0x000000013FE91000-memory.dmp

memory/2680-60-0x000000013F850000-0x000000013FBA1000-memory.dmp

memory/1872-57-0x000000013F850000-0x000000013FBA1000-memory.dmp

C:\Windows\system\wSOvWHB.exe

MD5	bb335cb5fa6c50b2458d278aa9b14fe8
SHA1	8c868710f8d16c7b175a293f0a0e6542ce328558
SHA256	17ad64bcd16be3a8f28603effa87035d49fbfe05fdfaedc4d65795dd50119b91
SHA512	e307a1e71155fb42cde343dee3f23f9385ed1123a8c5591772774f41bb08825c111ca2b32478cdc368d822bb45927e4dbcbe0ae72464c67db09c81e095cfa8c4

C:\Windows\system\lTdIQES.exe

MD5	b115c1d67fa105556de7c9f54af5b5df
SHA1	3ac1a81c228a5bba71b213f5d03f6953578c8b1c
SHA256	ad4ab79cf158dedf7b87053ef16317910cf353a878bbb5c8330de848860f30ea
SHA512	e7d9628506fccb44809cdc97b463790d900d5e98c116b197e140b2f38d30a130bcea8a632dded6538527053749acbfeb1b90235a8b78590393171e45c1c122e6

memory/2632-34-0x000000013F770000-0x000000013FAC1000-memory.dmp

memory/1872-33-0x000000013F770000-0x000000013FAC1000-memory.dmp

memory/2628-28-0x000000013F990000-0x000000013FCE1000-memory.dmp

memory/2880-17-0x000000013F110000-0x000000013F461000-memory.dmp

memory/2948-16-0x000000013FE30000-0x0000000140181000-memory.dmp

memory/1872-749-0x0000000001EE0000-0x0000000002231000-memory.dmp

memory/2632-1319-0x000000013F770000-0x000000013FAC1000-memory.dmp

memory/2724-1980-0x000000013FF40000-0x0000000140291000-memory.dmp

memory/2948-4033-0x000000013FE30000-0x0000000140181000-memory.dmp

memory/3032-4040-0x000000013FF40000-0x0000000140291000-memory.dmp

memory/2880-4047-0x000000013F110000-0x000000013F461000-memory.dmp

memory/2628-4072-0x000000013F990000-0x000000013FCE1000-memory.dmp

memory/2972-4216-0x000000013F1F0000-0x000000013F541000-memory.dmp

memory/2680-4214-0x000000013F850000-0x000000013FBA1000-memory.dmp

memory/1504-4220-0x000000013F110000-0x000000013F461000-memory.dmp

memory/2544-4243-0x000000013FC50000-0x000000013FFA1000-memory.dmp

memory/2492-4239-0x000000013F9F0000-0x000000013FD41000-memory.dmp

memory/2632-4251-0x000000013F770000-0x000000013FAC1000-memory.dmp

memory/2432-4253-0x000000013F510000-0x000000013F861000-memory.dmp

memory/2724-4227-0x000000013FF40000-0x0000000140291000-memory.dmp

memory/2456-4221-0x000000013FB40000-0x000000013FE91000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 13:33

Reported

2024-06-13 13:36

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\oHQpWyi.exe	N/A
N/A	N/A	C:\Windows\System\rUcdFXW.exe	N/A
N/A	N/A	C:\Windows\System\vvyUNYw.exe	N/A
N/A	N/A	C:\Windows\System\ptQuozS.exe	N/A
N/A	N/A	C:\Windows\System\BJcEWFJ.exe	N/A
N/A	N/A	C:\Windows\System\BLhvIqg.exe	N/A
N/A	N/A	C:\Windows\System\vEasJuc.exe	N/A
N/A	N/A	C:\Windows\System\DzHkcZZ.exe	N/A
N/A	N/A	C:\Windows\System\yvOTCZv.exe	N/A
N/A	N/A	C:\Windows\System\dizUeJR.exe	N/A
N/A	N/A	C:\Windows\System\cHORLgG.exe	N/A
N/A	N/A	C:\Windows\System\gdtrWjO.exe	N/A
N/A	N/A	C:\Windows\System\EFAZvvV.exe	N/A
N/A	N/A	C:\Windows\System\EUZfPXn.exe	N/A
N/A	N/A	C:\Windows\System\wUgCFZs.exe	N/A
N/A	N/A	C:\Windows\System\spvyFpS.exe	N/A
N/A	N/A	C:\Windows\System\YYaLRYs.exe	N/A
N/A	N/A	C:\Windows\System\UeFiBPm.exe	N/A
N/A	N/A	C:\Windows\System\OzYawZy.exe	N/A
N/A	N/A	C:\Windows\System\naRohcR.exe	N/A
N/A	N/A	C:\Windows\System\KYNgysO.exe	N/A
N/A	N/A	C:\Windows\System\OlgDnQF.exe	N/A
N/A	N/A	C:\Windows\System\frwSNiI.exe	N/A
N/A	N/A	C:\Windows\System\wtTyOsj.exe	N/A
N/A	N/A	C:\Windows\System\KNURQdf.exe	N/A
N/A	N/A	C:\Windows\System\enxJevN.exe	N/A
N/A	N/A	C:\Windows\System\NreXXmG.exe	N/A
N/A	N/A	C:\Windows\System\nlqyGwv.exe	N/A
N/A	N/A	C:\Windows\System\MeZkckw.exe	N/A
N/A	N/A	C:\Windows\System\XELtKjB.exe	N/A
N/A	N/A	C:\Windows\System\VPcOHiw.exe	N/A
N/A	N/A	C:\Windows\System\PKJxECG.exe	N/A
N/A	N/A	C:\Windows\System\CyKXLnG.exe	N/A
N/A	N/A	C:\Windows\System\zWunpMp.exe	N/A
N/A	N/A	C:\Windows\System\nrhLgHL.exe	N/A
N/A	N/A	C:\Windows\System\BKkYshP.exe	N/A
N/A	N/A	C:\Windows\System\HxIDmHY.exe	N/A
N/A	N/A	C:\Windows\System\RZTTOCe.exe	N/A
N/A	N/A	C:\Windows\System\NssedBt.exe	N/A
N/A	N/A	C:\Windows\System\KPfFHyl.exe	N/A
N/A	N/A	C:\Windows\System\GjIKwDV.exe	N/A
N/A	N/A	C:\Windows\System\dJnFwxG.exe	N/A
N/A	N/A	C:\Windows\System\TIERdmT.exe	N/A
N/A	N/A	C:\Windows\System\WBLxYWr.exe	N/A
N/A	N/A	C:\Windows\System\tZyaAAU.exe	N/A
N/A	N/A	C:\Windows\System\hqoziXx.exe	N/A
N/A	N/A	C:\Windows\System\aUNIAMw.exe	N/A
N/A	N/A	C:\Windows\System\RCXevsq.exe	N/A
N/A	N/A	C:\Windows\System\udWsngI.exe	N/A
N/A	N/A	C:\Windows\System\fAqnpEw.exe	N/A
N/A	N/A	C:\Windows\System\UJryLxM.exe	N/A
N/A	N/A	C:\Windows\System\Wjvwzyy.exe	N/A
N/A	N/A	C:\Windows\System\EUeaeBg.exe	N/A
N/A	N/A	C:\Windows\System\bBcMybO.exe	N/A
N/A	N/A	C:\Windows\System\yUafHVk.exe	N/A
N/A	N/A	C:\Windows\System\PqtUmSK.exe	N/A
N/A	N/A	C:\Windows\System\FDbYrdY.exe	N/A
N/A	N/A	C:\Windows\System\CMAhWtK.exe	N/A
N/A	N/A	C:\Windows\System\zTHRSHA.exe	N/A
N/A	N/A	C:\Windows\System\iBymQVD.exe	N/A
N/A	N/A	C:\Windows\System\INVjOUg.exe	N/A
N/A	N/A	C:\Windows\System\txkwktd.exe	N/A
N/A	N/A	C:\Windows\System\DLRmfDu.exe	N/A
N/A	N/A	C:\Windows\System\vutEbqD.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\nrhLgHL.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tbFgENf.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fzUQRrO.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\clHtUOa.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eaMxedQ.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LnoLVQw.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VWNycZn.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dQzimVb.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\thCRJau.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\juKxblE.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UeFiBPm.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zTHRSHA.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lEkbqMW.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MHuTAAI.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KNpGnhP.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wknziDS.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TiQGrqh.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rshjtFc.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YXvIWje.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yvOTCZv.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LvjUlAM.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nelaMgM.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ROFtPrs.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nCcHuyG.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SbggoCZ.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wNAJGUb.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zwTihWJ.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lAstttH.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KcGBaaJ.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DAqUgGt.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hNYwLKY.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gSMAxTs.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GnDBxHL.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WiDgpdd.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LMDkASF.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XUiArUL.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fSVLVpB.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gKZTfKP.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LeGfgsg.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FPTjSMj.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hRnZhFn.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\khtROEg.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KSdveqm.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vvyUNYw.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jzpBqhp.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EjFGXtd.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QcqipQZ.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\psYPlao.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EaJkeHM.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WStCCSz.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\upWgBMp.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cKcZHzE.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DzHkcZZ.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dmGPXdo.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qCRCKrd.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TWpeOMe.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZQJSJWQ.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pWijSSj.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mmfNtjs.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ptyrkaM.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FfxnJqq.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gpddaqr.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EFAZvvV.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FpOlukp.exe	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 864 wrote to memory of 1844	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\oHQpWyi.exe
PID 864 wrote to memory of 1844	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\oHQpWyi.exe
PID 864 wrote to memory of 2524	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\rUcdFXW.exe
PID 864 wrote to memory of 2524	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\rUcdFXW.exe
PID 864 wrote to memory of 4576	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\vvyUNYw.exe
PID 864 wrote to memory of 4576	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\vvyUNYw.exe
PID 864 wrote to memory of 220	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\ptQuozS.exe
PID 864 wrote to memory of 220	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\ptQuozS.exe
PID 864 wrote to memory of 4344	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\BJcEWFJ.exe
PID 864 wrote to memory of 4344	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\BJcEWFJ.exe
PID 864 wrote to memory of 3060	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\BLhvIqg.exe
PID 864 wrote to memory of 3060	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\BLhvIqg.exe
PID 864 wrote to memory of 1228	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\vEasJuc.exe
PID 864 wrote to memory of 1228	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\vEasJuc.exe
PID 864 wrote to memory of 1296	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\DzHkcZZ.exe
PID 864 wrote to memory of 1296	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\DzHkcZZ.exe
PID 864 wrote to memory of 4496	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\yvOTCZv.exe
PID 864 wrote to memory of 4496	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\yvOTCZv.exe
PID 864 wrote to memory of 1512	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\dizUeJR.exe
PID 864 wrote to memory of 1512	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\dizUeJR.exe
PID 864 wrote to memory of 3376	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\cHORLgG.exe
PID 864 wrote to memory of 3376	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\cHORLgG.exe
PID 864 wrote to memory of 3736	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\gdtrWjO.exe
PID 864 wrote to memory of 3736	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\gdtrWjO.exe
PID 864 wrote to memory of 2168	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\EFAZvvV.exe
PID 864 wrote to memory of 2168	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\EFAZvvV.exe
PID 864 wrote to memory of 4544	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\EUZfPXn.exe
PID 864 wrote to memory of 4544	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\EUZfPXn.exe
PID 864 wrote to memory of 1148	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\wUgCFZs.exe
PID 864 wrote to memory of 1148	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\wUgCFZs.exe
PID 864 wrote to memory of 1908	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\spvyFpS.exe
PID 864 wrote to memory of 1908	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\spvyFpS.exe
PID 864 wrote to memory of 1696	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\YYaLRYs.exe
PID 864 wrote to memory of 1696	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\YYaLRYs.exe
PID 864 wrote to memory of 3272	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\OlgDnQF.exe
PID 864 wrote to memory of 3272	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\OlgDnQF.exe
PID 864 wrote to memory of 4208	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\UeFiBPm.exe
PID 864 wrote to memory of 4208	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\UeFiBPm.exe
PID 864 wrote to memory of 3576	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\OzYawZy.exe
PID 864 wrote to memory of 3576	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\OzYawZy.exe
PID 864 wrote to memory of 2352	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\naRohcR.exe
PID 864 wrote to memory of 2352	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\naRohcR.exe
PID 864 wrote to memory of 3168	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\KYNgysO.exe
PID 864 wrote to memory of 3168	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\KYNgysO.exe
PID 864 wrote to memory of 5024	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\frwSNiI.exe
PID 864 wrote to memory of 5024	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\frwSNiI.exe
PID 864 wrote to memory of 3652	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\wtTyOsj.exe
PID 864 wrote to memory of 3652	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\wtTyOsj.exe
PID 864 wrote to memory of 3172	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\KNURQdf.exe
PID 864 wrote to memory of 3172	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\KNURQdf.exe
PID 864 wrote to memory of 4608	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\HxIDmHY.exe
PID 864 wrote to memory of 4608	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\HxIDmHY.exe
PID 864 wrote to memory of 4596	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\enxJevN.exe
PID 864 wrote to memory of 4596	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\enxJevN.exe
PID 864 wrote to memory of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\NreXXmG.exe
PID 864 wrote to memory of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\NreXXmG.exe
PID 864 wrote to memory of 2928	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\nlqyGwv.exe
PID 864 wrote to memory of 2928	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\nlqyGwv.exe
PID 864 wrote to memory of 8	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\GjIKwDV.exe
PID 864 wrote to memory of 8	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\GjIKwDV.exe
PID 864 wrote to memory of 1596	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\MeZkckw.exe
PID 864 wrote to memory of 1596	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\MeZkckw.exe
PID 864 wrote to memory of 4028	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\XELtKjB.exe
PID 864 wrote to memory of 4028	N/A	C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe	C:\Windows\System\XELtKjB.exe

Processes

C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe"

C:\Windows\System\oHQpWyi.exe

C:\Windows\System\oHQpWyi.exe

C:\Windows\System\rUcdFXW.exe

C:\Windows\System\rUcdFXW.exe

C:\Windows\System\vvyUNYw.exe

C:\Windows\System\vvyUNYw.exe

C:\Windows\System\ptQuozS.exe

C:\Windows\System\ptQuozS.exe

C:\Windows\System\BJcEWFJ.exe

C:\Windows\System\BJcEWFJ.exe

C:\Windows\System\BLhvIqg.exe

C:\Windows\System\BLhvIqg.exe

C:\Windows\System\vEasJuc.exe

C:\Windows\System\vEasJuc.exe

C:\Windows\System\DzHkcZZ.exe

C:\Windows\System\DzHkcZZ.exe

C:\Windows\System\yvOTCZv.exe

C:\Windows\System\yvOTCZv.exe

C:\Windows\System\dizUeJR.exe

C:\Windows\System\dizUeJR.exe

C:\Windows\System\cHORLgG.exe

C:\Windows\System\cHORLgG.exe

C:\Windows\System\gdtrWjO.exe

C:\Windows\System\gdtrWjO.exe

C:\Windows\System\EFAZvvV.exe

C:\Windows\System\EFAZvvV.exe

C:\Windows\System\EUZfPXn.exe

C:\Windows\System\EUZfPXn.exe

C:\Windows\System\wUgCFZs.exe

C:\Windows\System\wUgCFZs.exe

C:\Windows\System\spvyFpS.exe

C:\Windows\System\spvyFpS.exe

C:\Windows\System\YYaLRYs.exe

C:\Windows\System\YYaLRYs.exe

C:\Windows\System\OlgDnQF.exe

C:\Windows\System\OlgDnQF.exe

C:\Windows\System\UeFiBPm.exe

C:\Windows\System\UeFiBPm.exe

C:\Windows\System\OzYawZy.exe

C:\Windows\System\OzYawZy.exe

C:\Windows\System\naRohcR.exe

C:\Windows\System\naRohcR.exe

C:\Windows\System\KYNgysO.exe

C:\Windows\System\KYNgysO.exe

C:\Windows\System\frwSNiI.exe

C:\Windows\System\frwSNiI.exe

C:\Windows\System\wtTyOsj.exe

C:\Windows\System\wtTyOsj.exe

C:\Windows\System\KNURQdf.exe

C:\Windows\System\KNURQdf.exe

C:\Windows\System\HxIDmHY.exe

C:\Windows\System\HxIDmHY.exe

C:\Windows\System\enxJevN.exe

C:\Windows\System\enxJevN.exe

C:\Windows\System\NreXXmG.exe

C:\Windows\System\NreXXmG.exe

C:\Windows\System\nlqyGwv.exe

C:\Windows\System\nlqyGwv.exe

C:\Windows\System\GjIKwDV.exe

C:\Windows\System\GjIKwDV.exe

C:\Windows\System\MeZkckw.exe

C:\Windows\System\MeZkckw.exe

C:\Windows\System\XELtKjB.exe

C:\Windows\System\XELtKjB.exe

C:\Windows\System\VPcOHiw.exe

C:\Windows\System\VPcOHiw.exe

C:\Windows\System\PKJxECG.exe

C:\Windows\System\PKJxECG.exe

C:\Windows\System\CyKXLnG.exe

C:\Windows\System\CyKXLnG.exe

C:\Windows\System\zWunpMp.exe

C:\Windows\System\zWunpMp.exe

C:\Windows\System\nrhLgHL.exe

C:\Windows\System\nrhLgHL.exe

C:\Windows\System\BKkYshP.exe

C:\Windows\System\BKkYshP.exe

C:\Windows\System\RZTTOCe.exe

C:\Windows\System\RZTTOCe.exe

C:\Windows\System\NssedBt.exe

C:\Windows\System\NssedBt.exe

C:\Windows\System\KPfFHyl.exe

C:\Windows\System\KPfFHyl.exe

C:\Windows\System\dJnFwxG.exe

C:\Windows\System\dJnFwxG.exe

C:\Windows\System\TIERdmT.exe

C:\Windows\System\TIERdmT.exe

C:\Windows\System\WBLxYWr.exe

C:\Windows\System\WBLxYWr.exe

C:\Windows\System\tZyaAAU.exe

C:\Windows\System\tZyaAAU.exe

C:\Windows\System\hqoziXx.exe

C:\Windows\System\hqoziXx.exe

C:\Windows\System\aUNIAMw.exe

C:\Windows\System\aUNIAMw.exe

C:\Windows\System\RCXevsq.exe

C:\Windows\System\RCXevsq.exe

C:\Windows\System\udWsngI.exe

C:\Windows\System\udWsngI.exe

C:\Windows\System\fAqnpEw.exe

C:\Windows\System\fAqnpEw.exe

C:\Windows\System\UJryLxM.exe

C:\Windows\System\UJryLxM.exe

C:\Windows\System\Wjvwzyy.exe

C:\Windows\System\Wjvwzyy.exe

C:\Windows\System\EUeaeBg.exe

C:\Windows\System\EUeaeBg.exe

C:\Windows\System\bBcMybO.exe

C:\Windows\System\bBcMybO.exe

C:\Windows\System\yUafHVk.exe

C:\Windows\System\yUafHVk.exe

C:\Windows\System\PqtUmSK.exe

C:\Windows\System\PqtUmSK.exe

C:\Windows\System\FDbYrdY.exe

C:\Windows\System\FDbYrdY.exe

C:\Windows\System\CMAhWtK.exe

C:\Windows\System\CMAhWtK.exe

C:\Windows\System\zTHRSHA.exe

C:\Windows\System\zTHRSHA.exe

C:\Windows\System\iBymQVD.exe

C:\Windows\System\iBymQVD.exe

C:\Windows\System\INVjOUg.exe

C:\Windows\System\INVjOUg.exe

C:\Windows\System\txkwktd.exe

C:\Windows\System\txkwktd.exe

C:\Windows\System\DLRmfDu.exe

C:\Windows\System\DLRmfDu.exe

C:\Windows\System\vutEbqD.exe

C:\Windows\System\vutEbqD.exe

C:\Windows\System\VexkdOh.exe

C:\Windows\System\VexkdOh.exe

C:\Windows\System\pVhCuRF.exe

C:\Windows\System\pVhCuRF.exe

C:\Windows\System\RwmDRPv.exe

C:\Windows\System\RwmDRPv.exe

C:\Windows\System\tbFgENf.exe

C:\Windows\System\tbFgENf.exe

C:\Windows\System\NEIXNsJ.exe

C:\Windows\System\NEIXNsJ.exe

C:\Windows\System\TxUhBUa.exe

C:\Windows\System\TxUhBUa.exe

C:\Windows\System\cgJOYKn.exe

C:\Windows\System\cgJOYKn.exe

C:\Windows\System\robAjrZ.exe

C:\Windows\System\robAjrZ.exe

C:\Windows\System\RUltanS.exe

C:\Windows\System\RUltanS.exe

C:\Windows\System\wYvdXSK.exe

C:\Windows\System\wYvdXSK.exe

C:\Windows\System\ebZdmkW.exe

C:\Windows\System\ebZdmkW.exe

C:\Windows\System\lEkbqMW.exe

C:\Windows\System\lEkbqMW.exe

C:\Windows\System\XqjhVmd.exe

C:\Windows\System\XqjhVmd.exe

C:\Windows\System\PMlkcxf.exe

C:\Windows\System\PMlkcxf.exe

C:\Windows\System\tpIyXZi.exe

C:\Windows\System\tpIyXZi.exe

C:\Windows\System\jzpBqhp.exe

C:\Windows\System\jzpBqhp.exe

C:\Windows\System\ZPSMrqM.exe

C:\Windows\System\ZPSMrqM.exe

C:\Windows\System\ysxvFPf.exe

C:\Windows\System\ysxvFPf.exe

C:\Windows\System\mWnWTCS.exe

C:\Windows\System\mWnWTCS.exe

C:\Windows\System\zslRICh.exe

C:\Windows\System\zslRICh.exe

C:\Windows\System\YJYZcIr.exe

C:\Windows\System\YJYZcIr.exe

C:\Windows\System\BjawJkM.exe

C:\Windows\System\BjawJkM.exe

C:\Windows\System\oeefjNE.exe

C:\Windows\System\oeefjNE.exe

C:\Windows\System\fzUQRrO.exe

C:\Windows\System\fzUQRrO.exe

C:\Windows\System\dEKLXtA.exe

C:\Windows\System\dEKLXtA.exe

C:\Windows\System\kayXZnF.exe

C:\Windows\System\kayXZnF.exe

C:\Windows\System\bRWZDWh.exe

C:\Windows\System\bRWZDWh.exe

C:\Windows\System\nDwevxI.exe

C:\Windows\System\nDwevxI.exe

C:\Windows\System\oXRIHZV.exe

C:\Windows\System\oXRIHZV.exe

C:\Windows\System\mNneEfD.exe

C:\Windows\System\mNneEfD.exe

C:\Windows\System\csbFwFC.exe

C:\Windows\System\csbFwFC.exe

C:\Windows\System\TWpeOMe.exe

C:\Windows\System\TWpeOMe.exe

C:\Windows\System\wkEzxum.exe

C:\Windows\System\wkEzxum.exe

C:\Windows\System\DzMARUO.exe

C:\Windows\System\DzMARUO.exe

C:\Windows\System\mfxceoB.exe

C:\Windows\System\mfxceoB.exe

C:\Windows\System\ZzJTwml.exe

C:\Windows\System\ZzJTwml.exe

C:\Windows\System\rYmMkZs.exe

C:\Windows\System\rYmMkZs.exe

C:\Windows\System\VDZAAzQ.exe

C:\Windows\System\VDZAAzQ.exe

C:\Windows\System\FnyxaBS.exe

C:\Windows\System\FnyxaBS.exe

C:\Windows\System\QaAVvXV.exe

C:\Windows\System\QaAVvXV.exe

C:\Windows\System\BuuIIuZ.exe

C:\Windows\System\BuuIIuZ.exe

C:\Windows\System\otYLzFl.exe

C:\Windows\System\otYLzFl.exe

C:\Windows\System\laVyeaJ.exe

C:\Windows\System\laVyeaJ.exe

C:\Windows\System\axqJVCk.exe

C:\Windows\System\axqJVCk.exe

C:\Windows\System\TybdxNf.exe

C:\Windows\System\TybdxNf.exe

C:\Windows\System\QvUbkEW.exe

C:\Windows\System\QvUbkEW.exe

C:\Windows\System\YQGSRMF.exe

C:\Windows\System\YQGSRMF.exe

C:\Windows\System\IiyLxML.exe

C:\Windows\System\IiyLxML.exe

C:\Windows\System\wzQrHqG.exe

C:\Windows\System\wzQrHqG.exe

C:\Windows\System\ZuihXwT.exe

C:\Windows\System\ZuihXwT.exe

C:\Windows\System\oGosRWo.exe

C:\Windows\System\oGosRWo.exe

C:\Windows\System\xrOQFwl.exe

C:\Windows\System\xrOQFwl.exe

C:\Windows\System\iiHnOwM.exe

C:\Windows\System\iiHnOwM.exe

C:\Windows\System\ryviAij.exe

C:\Windows\System\ryviAij.exe

C:\Windows\System\nYskquG.exe

C:\Windows\System\nYskquG.exe

C:\Windows\System\wgpeNCF.exe

C:\Windows\System\wgpeNCF.exe

C:\Windows\System\koumAEe.exe

C:\Windows\System\koumAEe.exe

C:\Windows\System\QDWiHUh.exe

C:\Windows\System\QDWiHUh.exe

C:\Windows\System\hYtyZmR.exe

C:\Windows\System\hYtyZmR.exe

C:\Windows\System\nTZwIHu.exe

C:\Windows\System\nTZwIHu.exe

C:\Windows\System\gLjkTGi.exe

C:\Windows\System\gLjkTGi.exe

C:\Windows\System\pnHARok.exe

C:\Windows\System\pnHARok.exe

C:\Windows\System\xtNxqwK.exe

C:\Windows\System\xtNxqwK.exe

C:\Windows\System\XGPiUay.exe

C:\Windows\System\XGPiUay.exe

C:\Windows\System\CLbPaPi.exe

C:\Windows\System\CLbPaPi.exe

C:\Windows\System\TeLEvpJ.exe

C:\Windows\System\TeLEvpJ.exe

C:\Windows\System\IjojvZB.exe

C:\Windows\System\IjojvZB.exe

C:\Windows\System\kcuTFcK.exe

C:\Windows\System\kcuTFcK.exe

C:\Windows\System\ubaQbSs.exe

C:\Windows\System\ubaQbSs.exe

C:\Windows\System\llGnceF.exe

C:\Windows\System\llGnceF.exe

C:\Windows\System\UoMjsfw.exe

C:\Windows\System\UoMjsfw.exe

C:\Windows\System\kWmuFqC.exe

C:\Windows\System\kWmuFqC.exe

C:\Windows\System\gMeozpw.exe

C:\Windows\System\gMeozpw.exe

C:\Windows\System\LTKHwan.exe

C:\Windows\System\LTKHwan.exe

C:\Windows\System\lMjHdrx.exe

C:\Windows\System\lMjHdrx.exe

C:\Windows\System\xNsmTaV.exe

C:\Windows\System\xNsmTaV.exe

C:\Windows\System\rPPeZAs.exe

C:\Windows\System\rPPeZAs.exe

C:\Windows\System\hmqYuoS.exe

C:\Windows\System\hmqYuoS.exe

C:\Windows\System\MtgpuJV.exe

C:\Windows\System\MtgpuJV.exe

C:\Windows\System\vSBHdcw.exe

C:\Windows\System\vSBHdcw.exe

C:\Windows\System\tZJRmwO.exe

C:\Windows\System\tZJRmwO.exe

C:\Windows\System\PbIjCgm.exe

C:\Windows\System\PbIjCgm.exe

C:\Windows\System\tIzbxcZ.exe

C:\Windows\System\tIzbxcZ.exe

C:\Windows\System\cvKDpQD.exe

C:\Windows\System\cvKDpQD.exe

C:\Windows\System\OAGfhOc.exe

C:\Windows\System\OAGfhOc.exe

C:\Windows\System\SsqXmDc.exe

C:\Windows\System\SsqXmDc.exe

C:\Windows\System\tqQDXUn.exe

C:\Windows\System\tqQDXUn.exe

C:\Windows\System\CifhMNd.exe

C:\Windows\System\CifhMNd.exe

C:\Windows\System\gSOEYln.exe

C:\Windows\System\gSOEYln.exe

C:\Windows\System\XHqtThW.exe

C:\Windows\System\XHqtThW.exe

C:\Windows\System\VoBWznk.exe

C:\Windows\System\VoBWznk.exe

C:\Windows\System\YqzkDxU.exe

C:\Windows\System\YqzkDxU.exe

C:\Windows\System\feaYIxr.exe

C:\Windows\System\feaYIxr.exe

C:\Windows\System\dhXNiwj.exe

C:\Windows\System\dhXNiwj.exe

C:\Windows\System\slsOOrS.exe

C:\Windows\System\slsOOrS.exe

C:\Windows\System\wNAJGUb.exe

C:\Windows\System\wNAJGUb.exe

C:\Windows\System\GRPcsMW.exe

C:\Windows\System\GRPcsMW.exe

C:\Windows\System\thCRJau.exe

C:\Windows\System\thCRJau.exe

C:\Windows\System\rmWQtfM.exe

C:\Windows\System\rmWQtfM.exe

C:\Windows\System\VvsbbxH.exe

C:\Windows\System\VvsbbxH.exe

C:\Windows\System\dKkdcuy.exe

C:\Windows\System\dKkdcuy.exe

C:\Windows\System\UTBDNOC.exe

C:\Windows\System\UTBDNOC.exe

C:\Windows\System\EjFGXtd.exe

C:\Windows\System\EjFGXtd.exe

C:\Windows\System\swxSgMe.exe

C:\Windows\System\swxSgMe.exe

C:\Windows\System\yLjCieH.exe

C:\Windows\System\yLjCieH.exe

C:\Windows\System\cvoWxoI.exe

C:\Windows\System\cvoWxoI.exe

C:\Windows\System\BurFGcG.exe

C:\Windows\System\BurFGcG.exe

C:\Windows\System\yYuMquA.exe

C:\Windows\System\yYuMquA.exe

C:\Windows\System\KMnJVUf.exe

C:\Windows\System\KMnJVUf.exe

C:\Windows\System\OzREexC.exe

C:\Windows\System\OzREexC.exe

C:\Windows\System\BIoyPML.exe

C:\Windows\System\BIoyPML.exe

C:\Windows\System\sPoZWWw.exe

C:\Windows\System\sPoZWWw.exe

C:\Windows\System\WIhKkkP.exe

C:\Windows\System\WIhKkkP.exe

C:\Windows\System\AxIxUTB.exe

C:\Windows\System\AxIxUTB.exe

C:\Windows\System\CDEIyxz.exe

C:\Windows\System\CDEIyxz.exe

C:\Windows\System\nxBkxKK.exe

C:\Windows\System\nxBkxKK.exe

C:\Windows\System\ZQJSJWQ.exe

C:\Windows\System\ZQJSJWQ.exe

C:\Windows\System\GzlTTWW.exe

C:\Windows\System\GzlTTWW.exe

C:\Windows\System\rWGcawx.exe

C:\Windows\System\rWGcawx.exe

C:\Windows\System\GzLNzEI.exe

C:\Windows\System\GzLNzEI.exe

C:\Windows\System\SbNzNKm.exe

C:\Windows\System\SbNzNKm.exe

C:\Windows\System\vGDIjdU.exe

C:\Windows\System\vGDIjdU.exe

C:\Windows\System\guxsSvu.exe

C:\Windows\System\guxsSvu.exe

C:\Windows\System\YTzqdNP.exe

C:\Windows\System\YTzqdNP.exe

C:\Windows\System\BifnUyI.exe

C:\Windows\System\BifnUyI.exe

C:\Windows\System\XBSPDsV.exe

C:\Windows\System\XBSPDsV.exe

C:\Windows\System\pJpcbCt.exe

C:\Windows\System\pJpcbCt.exe

C:\Windows\System\tTAZFpA.exe

C:\Windows\System\tTAZFpA.exe

C:\Windows\System\xisNrdi.exe

C:\Windows\System\xisNrdi.exe

C:\Windows\System\LhQMzTB.exe

C:\Windows\System\LhQMzTB.exe

C:\Windows\System\oxIhdaQ.exe

C:\Windows\System\oxIhdaQ.exe

C:\Windows\System\ObPMDTz.exe

C:\Windows\System\ObPMDTz.exe

C:\Windows\System\gvqDPmU.exe

C:\Windows\System\gvqDPmU.exe

C:\Windows\System\mgpkPmL.exe

C:\Windows\System\mgpkPmL.exe

C:\Windows\System\PZvAOBQ.exe

C:\Windows\System\PZvAOBQ.exe

C:\Windows\System\GcGpSpa.exe

C:\Windows\System\GcGpSpa.exe

C:\Windows\System\xviWyIT.exe

C:\Windows\System\xviWyIT.exe

C:\Windows\System\MHuTAAI.exe

C:\Windows\System\MHuTAAI.exe

C:\Windows\System\dmGPXdo.exe

C:\Windows\System\dmGPXdo.exe

C:\Windows\System\tJbxism.exe

C:\Windows\System\tJbxism.exe

C:\Windows\System\hNOSQkT.exe

C:\Windows\System\hNOSQkT.exe

C:\Windows\System\bHasZgq.exe

C:\Windows\System\bHasZgq.exe

C:\Windows\System\uAsjnGy.exe

C:\Windows\System\uAsjnGy.exe

C:\Windows\System\fxXqIpT.exe

C:\Windows\System\fxXqIpT.exe

C:\Windows\System\gZIVinq.exe

C:\Windows\System\gZIVinq.exe

C:\Windows\System\luByHkJ.exe

C:\Windows\System\luByHkJ.exe

C:\Windows\System\FpOlukp.exe

C:\Windows\System\FpOlukp.exe

C:\Windows\System\clHtUOa.exe

C:\Windows\System\clHtUOa.exe

C:\Windows\System\SlNzhHi.exe

C:\Windows\System\SlNzhHi.exe

C:\Windows\System\zbPXbwu.exe

C:\Windows\System\zbPXbwu.exe

C:\Windows\System\daiXkww.exe

C:\Windows\System\daiXkww.exe

C:\Windows\System\vJEDmJR.exe

C:\Windows\System\vJEDmJR.exe

C:\Windows\System\CiBpWnk.exe

C:\Windows\System\CiBpWnk.exe

C:\Windows\System\XlsQdxL.exe

C:\Windows\System\XlsQdxL.exe

C:\Windows\System\BYylioA.exe

C:\Windows\System\BYylioA.exe

C:\Windows\System\QcJGlSr.exe

C:\Windows\System\QcJGlSr.exe

C:\Windows\System\DJBddnS.exe

C:\Windows\System\DJBddnS.exe

C:\Windows\System\bHygICp.exe

C:\Windows\System\bHygICp.exe

C:\Windows\System\ORSPpVw.exe

C:\Windows\System\ORSPpVw.exe

C:\Windows\System\yMCaQGA.exe

C:\Windows\System\yMCaQGA.exe

C:\Windows\System\DAqUgGt.exe

C:\Windows\System\DAqUgGt.exe

C:\Windows\System\TQdAghO.exe

C:\Windows\System\TQdAghO.exe

C:\Windows\System\SRthmZi.exe

C:\Windows\System\SRthmZi.exe

C:\Windows\System\lucHMdH.exe

C:\Windows\System\lucHMdH.exe

C:\Windows\System\EIxVuun.exe

C:\Windows\System\EIxVuun.exe

C:\Windows\System\fZSGDRz.exe

C:\Windows\System\fZSGDRz.exe

C:\Windows\System\fSVLVpB.exe

C:\Windows\System\fSVLVpB.exe

C:\Windows\System\kmtgloC.exe

C:\Windows\System\kmtgloC.exe

C:\Windows\System\LvjUlAM.exe

C:\Windows\System\LvjUlAM.exe

C:\Windows\System\KNpGnhP.exe

C:\Windows\System\KNpGnhP.exe

C:\Windows\System\eaMxedQ.exe

C:\Windows\System\eaMxedQ.exe

C:\Windows\System\hpRzRmW.exe

C:\Windows\System\hpRzRmW.exe

C:\Windows\System\WagXAeq.exe

C:\Windows\System\WagXAeq.exe

C:\Windows\System\TZtzmfU.exe

C:\Windows\System\TZtzmfU.exe

C:\Windows\System\pWijSSj.exe

C:\Windows\System\pWijSSj.exe

C:\Windows\System\hETxbnZ.exe

C:\Windows\System\hETxbnZ.exe

C:\Windows\System\PMXAfkK.exe

C:\Windows\System\PMXAfkK.exe

C:\Windows\System\dZUeAAc.exe

C:\Windows\System\dZUeAAc.exe

C:\Windows\System\wyauzSf.exe

C:\Windows\System\wyauzSf.exe

C:\Windows\System\tHckmpY.exe

C:\Windows\System\tHckmpY.exe

C:\Windows\System\tTeXLmD.exe

C:\Windows\System\tTeXLmD.exe

C:\Windows\System\cKcZHzE.exe

C:\Windows\System\cKcZHzE.exe

C:\Windows\System\CGcMgSo.exe

C:\Windows\System\CGcMgSo.exe

C:\Windows\System\BLQOBKP.exe

C:\Windows\System\BLQOBKP.exe

C:\Windows\System\oFEXnqU.exe

C:\Windows\System\oFEXnqU.exe

C:\Windows\System\oSHgydb.exe

C:\Windows\System\oSHgydb.exe

C:\Windows\System\kwHYbGk.exe

C:\Windows\System\kwHYbGk.exe

C:\Windows\System\ziacvXu.exe

C:\Windows\System\ziacvXu.exe

C:\Windows\System\gKZTfKP.exe

C:\Windows\System\gKZTfKP.exe

C:\Windows\System\FFOWqUA.exe

C:\Windows\System\FFOWqUA.exe

C:\Windows\System\BgFfoYa.exe

C:\Windows\System\BgFfoYa.exe

C:\Windows\System\HxPehTo.exe

C:\Windows\System\HxPehTo.exe

C:\Windows\System\UtKjSDH.exe

C:\Windows\System\UtKjSDH.exe

C:\Windows\System\QcqipQZ.exe

C:\Windows\System\QcqipQZ.exe

C:\Windows\System\xRGxGJf.exe

C:\Windows\System\xRGxGJf.exe

C:\Windows\System\HNlWWXe.exe

C:\Windows\System\HNlWWXe.exe

C:\Windows\System\fAgjLNo.exe

C:\Windows\System\fAgjLNo.exe

C:\Windows\System\OaIpMJP.exe

C:\Windows\System\OaIpMJP.exe

C:\Windows\System\BySRFzR.exe

C:\Windows\System\BySRFzR.exe

C:\Windows\System\SnxSeyW.exe

C:\Windows\System\SnxSeyW.exe

C:\Windows\System\poGXGIl.exe

C:\Windows\System\poGXGIl.exe

C:\Windows\System\WzFcLEW.exe

C:\Windows\System\WzFcLEW.exe

C:\Windows\System\zggkbdI.exe

C:\Windows\System\zggkbdI.exe

C:\Windows\System\PwnMlfM.exe

C:\Windows\System\PwnMlfM.exe

C:\Windows\System\QgqKrnP.exe

C:\Windows\System\QgqKrnP.exe

C:\Windows\System\vXTAqgF.exe

C:\Windows\System\vXTAqgF.exe

C:\Windows\System\cSEWgYO.exe

C:\Windows\System\cSEWgYO.exe

C:\Windows\System\RBXOidW.exe

C:\Windows\System\RBXOidW.exe

C:\Windows\System\zkgJXOg.exe

C:\Windows\System\zkgJXOg.exe

C:\Windows\System\MWoKOvw.exe

C:\Windows\System\MWoKOvw.exe

C:\Windows\System\HgjVtnZ.exe

C:\Windows\System\HgjVtnZ.exe

C:\Windows\System\mOkWzWg.exe

C:\Windows\System\mOkWzWg.exe

C:\Windows\System\mmfNtjs.exe

C:\Windows\System\mmfNtjs.exe

C:\Windows\System\ySEZGhz.exe

C:\Windows\System\ySEZGhz.exe

C:\Windows\System\QYUemRv.exe

C:\Windows\System\QYUemRv.exe

C:\Windows\System\dFvKrwg.exe

C:\Windows\System\dFvKrwg.exe

C:\Windows\System\jZQyFIf.exe

C:\Windows\System\jZQyFIf.exe

C:\Windows\System\YDMlONM.exe

C:\Windows\System\YDMlONM.exe

C:\Windows\System\axNyFvb.exe

C:\Windows\System\axNyFvb.exe

C:\Windows\System\TAwsIDb.exe

C:\Windows\System\TAwsIDb.exe

C:\Windows\System\wViMMDo.exe

C:\Windows\System\wViMMDo.exe

C:\Windows\System\ZRaLAsi.exe

C:\Windows\System\ZRaLAsi.exe

C:\Windows\System\LnoLVQw.exe

C:\Windows\System\LnoLVQw.exe

C:\Windows\System\hsCbmbZ.exe

C:\Windows\System\hsCbmbZ.exe

C:\Windows\System\MtCTlUN.exe

C:\Windows\System\MtCTlUN.exe

C:\Windows\System\SjvVmIa.exe

C:\Windows\System\SjvVmIa.exe

C:\Windows\System\xhTDHKd.exe

C:\Windows\System\xhTDHKd.exe

C:\Windows\System\zwTihWJ.exe

C:\Windows\System\zwTihWJ.exe

C:\Windows\System\rvtePUB.exe

C:\Windows\System\rvtePUB.exe

C:\Windows\System\cujZiyG.exe

C:\Windows\System\cujZiyG.exe

C:\Windows\System\EoIfsVs.exe

C:\Windows\System\EoIfsVs.exe

C:\Windows\System\bqvMhmu.exe

C:\Windows\System\bqvMhmu.exe

C:\Windows\System\viDpNSv.exe

C:\Windows\System\viDpNSv.exe

C:\Windows\System\IfBFjhf.exe

C:\Windows\System\IfBFjhf.exe

C:\Windows\System\wuHzsNN.exe

C:\Windows\System\wuHzsNN.exe

C:\Windows\System\vRdhGbm.exe

C:\Windows\System\vRdhGbm.exe

C:\Windows\System\fNYvOyu.exe

C:\Windows\System\fNYvOyu.exe

C:\Windows\System\fyOrjyz.exe

C:\Windows\System\fyOrjyz.exe

C:\Windows\System\AvYvWEO.exe

C:\Windows\System\AvYvWEO.exe

C:\Windows\System\keQWqey.exe

C:\Windows\System\keQWqey.exe

C:\Windows\System\rKMRyvs.exe

C:\Windows\System\rKMRyvs.exe

C:\Windows\System\fpmVvRA.exe

C:\Windows\System\fpmVvRA.exe

C:\Windows\System\wByxmqD.exe

C:\Windows\System\wByxmqD.exe

C:\Windows\System\hXgnkZB.exe

C:\Windows\System\hXgnkZB.exe

C:\Windows\System\aKIpMJz.exe

C:\Windows\System\aKIpMJz.exe

C:\Windows\System\OjfdRFz.exe

C:\Windows\System\OjfdRFz.exe

C:\Windows\System\tOPTiFg.exe

C:\Windows\System\tOPTiFg.exe

C:\Windows\System\dTuQFWz.exe

C:\Windows\System\dTuQFWz.exe

C:\Windows\System\hNYwLKY.exe

C:\Windows\System\hNYwLKY.exe

C:\Windows\System\RbQGAwy.exe

C:\Windows\System\RbQGAwy.exe

C:\Windows\System\VLMeXMe.exe

C:\Windows\System\VLMeXMe.exe

C:\Windows\System\OXoqGvw.exe

C:\Windows\System\OXoqGvw.exe

C:\Windows\System\LiZFWUC.exe

C:\Windows\System\LiZFWUC.exe

C:\Windows\System\evecCMS.exe

C:\Windows\System\evecCMS.exe

C:\Windows\System\MdJBqDN.exe

C:\Windows\System\MdJBqDN.exe

C:\Windows\System\TvcxEHX.exe

C:\Windows\System\TvcxEHX.exe

C:\Windows\System\CKDJSen.exe

C:\Windows\System\CKDJSen.exe

C:\Windows\System\KzbFHAt.exe

C:\Windows\System\KzbFHAt.exe

C:\Windows\System\zRDzvTK.exe

C:\Windows\System\zRDzvTK.exe

C:\Windows\System\HyOjywk.exe

C:\Windows\System\HyOjywk.exe

C:\Windows\System\UOARCjs.exe

C:\Windows\System\UOARCjs.exe

C:\Windows\System\FqLSdGd.exe

C:\Windows\System\FqLSdGd.exe

C:\Windows\System\SlOFBet.exe

C:\Windows\System\SlOFBet.exe

C:\Windows\System\beyRlen.exe

C:\Windows\System\beyRlen.exe

C:\Windows\System\RcSBeEt.exe

C:\Windows\System\RcSBeEt.exe

C:\Windows\System\gcigpsP.exe

C:\Windows\System\gcigpsP.exe

C:\Windows\System\RLEXLUY.exe

C:\Windows\System\RLEXLUY.exe

C:\Windows\System\YZnyGfR.exe

C:\Windows\System\YZnyGfR.exe

C:\Windows\System\DjJwAxT.exe

C:\Windows\System\DjJwAxT.exe

C:\Windows\System\PdvbvBq.exe

C:\Windows\System\PdvbvBq.exe

C:\Windows\System\ZOoXPWw.exe

C:\Windows\System\ZOoXPWw.exe

C:\Windows\System\kdWkTEV.exe

C:\Windows\System\kdWkTEV.exe

C:\Windows\System\gSMAxTs.exe

C:\Windows\System\gSMAxTs.exe

C:\Windows\System\EHqXhRz.exe

C:\Windows\System\EHqXhRz.exe

C:\Windows\System\tTOvIIN.exe

C:\Windows\System\tTOvIIN.exe

C:\Windows\System\ptyrkaM.exe

C:\Windows\System\ptyrkaM.exe

C:\Windows\System\gLyIstG.exe

C:\Windows\System\gLyIstG.exe

C:\Windows\System\tiJcSad.exe

C:\Windows\System\tiJcSad.exe

C:\Windows\System\FQbZhqd.exe

C:\Windows\System\FQbZhqd.exe

C:\Windows\System\IaBXPRn.exe

C:\Windows\System\IaBXPRn.exe

C:\Windows\System\EDoSlbk.exe

C:\Windows\System\EDoSlbk.exe

C:\Windows\System\iCmodLd.exe

C:\Windows\System\iCmodLd.exe

C:\Windows\System\bWvsrsH.exe

C:\Windows\System\bWvsrsH.exe

C:\Windows\System\lfbxUgJ.exe

C:\Windows\System\lfbxUgJ.exe

C:\Windows\System\OpqFmPX.exe

C:\Windows\System\OpqFmPX.exe

C:\Windows\System\NAeNJTc.exe

C:\Windows\System\NAeNJTc.exe

C:\Windows\System\wknziDS.exe

C:\Windows\System\wknziDS.exe

C:\Windows\System\ZNcnaSO.exe

C:\Windows\System\ZNcnaSO.exe

C:\Windows\System\LeGfgsg.exe

C:\Windows\System\LeGfgsg.exe

C:\Windows\System\jPHHQJO.exe

C:\Windows\System\jPHHQJO.exe

C:\Windows\System\WJCMjhY.exe

C:\Windows\System\WJCMjhY.exe

C:\Windows\System\lYyFcru.exe

C:\Windows\System\lYyFcru.exe

C:\Windows\System\sLacMBb.exe

C:\Windows\System\sLacMBb.exe

C:\Windows\System\ZZQYWqb.exe

C:\Windows\System\ZZQYWqb.exe

C:\Windows\System\psYPlao.exe

C:\Windows\System\psYPlao.exe

C:\Windows\System\qpDSgPL.exe

C:\Windows\System\qpDSgPL.exe

C:\Windows\System\azgySIj.exe

C:\Windows\System\azgySIj.exe

C:\Windows\System\jiLtHsy.exe

C:\Windows\System\jiLtHsy.exe

C:\Windows\System\zXIXFrj.exe

C:\Windows\System\zXIXFrj.exe

C:\Windows\System\IwBjXpQ.exe

C:\Windows\System\IwBjXpQ.exe

C:\Windows\System\ZhOULhN.exe

C:\Windows\System\ZhOULhN.exe

C:\Windows\System\XBnqtde.exe

C:\Windows\System\XBnqtde.exe

C:\Windows\System\LOnrPKz.exe

C:\Windows\System\LOnrPKz.exe

C:\Windows\System\DdshAAn.exe

C:\Windows\System\DdshAAn.exe

C:\Windows\System\irembUn.exe

C:\Windows\System\irembUn.exe

C:\Windows\System\GnDBxHL.exe

C:\Windows\System\GnDBxHL.exe

C:\Windows\System\lAstttH.exe

C:\Windows\System\lAstttH.exe

C:\Windows\System\pOfenBM.exe

C:\Windows\System\pOfenBM.exe

C:\Windows\System\AWZaQfP.exe

C:\Windows\System\AWZaQfP.exe

C:\Windows\System\KHSOfnh.exe

C:\Windows\System\KHSOfnh.exe

C:\Windows\System\ucReqQG.exe

C:\Windows\System\ucReqQG.exe

C:\Windows\System\XMzkJNy.exe

C:\Windows\System\XMzkJNy.exe

C:\Windows\System\gcDUfHz.exe

C:\Windows\System\gcDUfHz.exe

C:\Windows\System\QUPFZJy.exe

C:\Windows\System\QUPFZJy.exe

C:\Windows\System\IumZPNs.exe

C:\Windows\System\IumZPNs.exe

C:\Windows\System\EIbTfTb.exe

C:\Windows\System\EIbTfTb.exe

C:\Windows\System\oenpUcE.exe

C:\Windows\System\oenpUcE.exe

C:\Windows\System\CIiGIOZ.exe

C:\Windows\System\CIiGIOZ.exe

C:\Windows\System\mZpWafb.exe

C:\Windows\System\mZpWafb.exe

C:\Windows\System\MSDhPNO.exe

C:\Windows\System\MSDhPNO.exe

C:\Windows\System\XhVeflt.exe

C:\Windows\System\XhVeflt.exe

C:\Windows\System\pTqegiZ.exe

C:\Windows\System\pTqegiZ.exe

C:\Windows\System\OCNWKvJ.exe

C:\Windows\System\OCNWKvJ.exe

C:\Windows\System\SRUoANn.exe

C:\Windows\System\SRUoANn.exe

C:\Windows\System\xESooHQ.exe

C:\Windows\System\xESooHQ.exe

C:\Windows\System\jVuSAfx.exe

C:\Windows\System\jVuSAfx.exe

C:\Windows\System\iKBNSCX.exe

C:\Windows\System\iKBNSCX.exe

C:\Windows\System\UzNWgwb.exe

C:\Windows\System\UzNWgwb.exe

C:\Windows\System\bvjRwdb.exe

C:\Windows\System\bvjRwdb.exe

C:\Windows\System\oeUUual.exe

C:\Windows\System\oeUUual.exe

C:\Windows\System\xbuDeNk.exe

C:\Windows\System\xbuDeNk.exe

C:\Windows\System\xdSQgvs.exe

C:\Windows\System\xdSQgvs.exe

C:\Windows\System\ozGgRFm.exe

C:\Windows\System\ozGgRFm.exe

C:\Windows\System\OSYWCix.exe

C:\Windows\System\OSYWCix.exe

C:\Windows\System\ZZohHJY.exe

C:\Windows\System\ZZohHJY.exe

C:\Windows\System\NGeUbiY.exe

C:\Windows\System\NGeUbiY.exe

C:\Windows\System\xeXrQfr.exe

C:\Windows\System\xeXrQfr.exe

C:\Windows\System\uIVuvRO.exe

C:\Windows\System\uIVuvRO.exe

C:\Windows\System\pzfPDth.exe

C:\Windows\System\pzfPDth.exe

C:\Windows\System\GPgEdeG.exe

C:\Windows\System\GPgEdeG.exe

C:\Windows\System\fdwFeyI.exe

C:\Windows\System\fdwFeyI.exe

C:\Windows\System\jqqubpy.exe

C:\Windows\System\jqqubpy.exe

C:\Windows\System\DgeURzw.exe

C:\Windows\System\DgeURzw.exe

C:\Windows\System\MjQCihb.exe

C:\Windows\System\MjQCihb.exe

C:\Windows\System\nLnieiY.exe

C:\Windows\System\nLnieiY.exe

C:\Windows\System\WKfEQUD.exe

C:\Windows\System\WKfEQUD.exe

C:\Windows\System\CzakXQX.exe

C:\Windows\System\CzakXQX.exe

C:\Windows\System\yBuSdve.exe

C:\Windows\System\yBuSdve.exe

C:\Windows\System\lWLcUIm.exe

C:\Windows\System\lWLcUIm.exe

C:\Windows\System\RXOHXLJ.exe

C:\Windows\System\RXOHXLJ.exe

C:\Windows\System\MDxCUjP.exe

C:\Windows\System\MDxCUjP.exe

C:\Windows\System\byUMKYb.exe

C:\Windows\System\byUMKYb.exe

C:\Windows\System\CBVqnjl.exe

C:\Windows\System\CBVqnjl.exe

C:\Windows\System\IcpWJtz.exe

C:\Windows\System\IcpWJtz.exe

C:\Windows\System\wCEZtPT.exe

C:\Windows\System\wCEZtPT.exe

C:\Windows\System\KWuTMkM.exe

C:\Windows\System\KWuTMkM.exe

C:\Windows\System\WjxVTQt.exe

C:\Windows\System\WjxVTQt.exe

C:\Windows\System\tPduTMi.exe

C:\Windows\System\tPduTMi.exe

C:\Windows\System\FPTjSMj.exe

C:\Windows\System\FPTjSMj.exe

C:\Windows\System\KKtVWDE.exe

C:\Windows\System\KKtVWDE.exe

C:\Windows\System\cLkzRXW.exe

C:\Windows\System\cLkzRXW.exe

C:\Windows\System\UOfmaJi.exe

C:\Windows\System\UOfmaJi.exe

C:\Windows\System\DxfYCcd.exe

C:\Windows\System\DxfYCcd.exe

C:\Windows\System\oBENRkY.exe

C:\Windows\System\oBENRkY.exe

C:\Windows\System\pttSDKx.exe

C:\Windows\System\pttSDKx.exe

C:\Windows\System\FgIBhtO.exe

C:\Windows\System\FgIBhtO.exe

C:\Windows\System\wApeqya.exe

C:\Windows\System\wApeqya.exe

C:\Windows\System\ogBamJx.exe

C:\Windows\System\ogBamJx.exe

C:\Windows\System\FLkDNtw.exe

C:\Windows\System\FLkDNtw.exe

C:\Windows\System\ZgJzapm.exe

C:\Windows\System\ZgJzapm.exe

C:\Windows\System\TcAfiLn.exe

C:\Windows\System\TcAfiLn.exe

C:\Windows\System\bfzMrix.exe

C:\Windows\System\bfzMrix.exe

C:\Windows\System\PaMvkvH.exe

C:\Windows\System\PaMvkvH.exe

C:\Windows\System\OaZKfdA.exe

C:\Windows\System\OaZKfdA.exe

C:\Windows\System\vAoYTYq.exe

C:\Windows\System\vAoYTYq.exe

C:\Windows\System\WyVBLam.exe

C:\Windows\System\WyVBLam.exe

C:\Windows\System\HiHTZkj.exe

C:\Windows\System\HiHTZkj.exe

C:\Windows\System\welSKlh.exe

C:\Windows\System\welSKlh.exe

C:\Windows\System\jGTpVlO.exe

C:\Windows\System\jGTpVlO.exe

C:\Windows\System\JXSrVfF.exe

C:\Windows\System\JXSrVfF.exe

C:\Windows\System\FYsClLP.exe

C:\Windows\System\FYsClLP.exe

C:\Windows\System\xAqIqAn.exe

C:\Windows\System\xAqIqAn.exe

C:\Windows\System\YYeYrvC.exe

C:\Windows\System\YYeYrvC.exe

C:\Windows\System\KFEYQXK.exe

C:\Windows\System\KFEYQXK.exe

C:\Windows\System\jLnHxup.exe

C:\Windows\System\jLnHxup.exe

C:\Windows\System\FMbsYMe.exe

C:\Windows\System\FMbsYMe.exe

C:\Windows\System\nruSVSY.exe

C:\Windows\System\nruSVSY.exe

C:\Windows\System\ZTBMGbB.exe

C:\Windows\System\ZTBMGbB.exe

C:\Windows\System\MqXFSuc.exe

C:\Windows\System\MqXFSuc.exe

C:\Windows\System\VWNycZn.exe

C:\Windows\System\VWNycZn.exe

C:\Windows\System\KbxwcGT.exe

C:\Windows\System\KbxwcGT.exe

C:\Windows\System\HbWzJds.exe

C:\Windows\System\HbWzJds.exe

C:\Windows\System\NIAKzzz.exe

C:\Windows\System\NIAKzzz.exe

C:\Windows\System\iUFjKiK.exe

C:\Windows\System\iUFjKiK.exe

C:\Windows\System\yruBweI.exe

C:\Windows\System\yruBweI.exe

C:\Windows\System\gnKqXYW.exe

C:\Windows\System\gnKqXYW.exe

C:\Windows\System\qndqZQe.exe

C:\Windows\System\qndqZQe.exe

C:\Windows\System\EeBBugn.exe

C:\Windows\System\EeBBugn.exe

C:\Windows\System\QKhOsgV.exe

C:\Windows\System\QKhOsgV.exe

C:\Windows\System\WgBqyeg.exe

C:\Windows\System\WgBqyeg.exe

C:\Windows\System\JNbaFpD.exe

C:\Windows\System\JNbaFpD.exe

C:\Windows\System\oSnnIru.exe

C:\Windows\System\oSnnIru.exe

C:\Windows\System\dwqscXF.exe

C:\Windows\System\dwqscXF.exe

C:\Windows\System\mYdQUDq.exe

C:\Windows\System\mYdQUDq.exe

C:\Windows\System\asswHtS.exe

C:\Windows\System\asswHtS.exe

C:\Windows\System\lsHINos.exe

C:\Windows\System\lsHINos.exe

C:\Windows\System\TiQGrqh.exe

C:\Windows\System\TiQGrqh.exe

C:\Windows\System\ZZeqcXD.exe

C:\Windows\System\ZZeqcXD.exe

C:\Windows\System\GaXxYdN.exe

C:\Windows\System\GaXxYdN.exe

C:\Windows\System\qCRCKrd.exe

C:\Windows\System\qCRCKrd.exe

C:\Windows\System\KuslzPb.exe

C:\Windows\System\KuslzPb.exe

C:\Windows\System\vFJCrux.exe

C:\Windows\System\vFJCrux.exe

C:\Windows\System\RwqDdlR.exe

C:\Windows\System\RwqDdlR.exe

C:\Windows\System\IYmhODv.exe

C:\Windows\System\IYmhODv.exe

C:\Windows\System\GNfBDcZ.exe

C:\Windows\System\GNfBDcZ.exe

C:\Windows\System\FXOLxFN.exe

C:\Windows\System\FXOLxFN.exe

C:\Windows\System\PWhkQQc.exe

C:\Windows\System\PWhkQQc.exe

C:\Windows\System\XxlXkLv.exe

C:\Windows\System\XxlXkLv.exe

C:\Windows\System\PonJzDf.exe

C:\Windows\System\PonJzDf.exe

C:\Windows\System\unmNBrJ.exe

C:\Windows\System\unmNBrJ.exe

C:\Windows\System\GsHTmjs.exe

C:\Windows\System\GsHTmjs.exe

C:\Windows\System\kMivaWr.exe

C:\Windows\System\kMivaWr.exe

C:\Windows\System\sdDGZjE.exe

C:\Windows\System\sdDGZjE.exe

C:\Windows\System\gzJSrhM.exe

C:\Windows\System\gzJSrhM.exe

C:\Windows\System\CixHobT.exe

C:\Windows\System\CixHobT.exe

C:\Windows\System\ujlqvdC.exe

C:\Windows\System\ujlqvdC.exe

C:\Windows\System\dgcPNnj.exe

C:\Windows\System\dgcPNnj.exe

C:\Windows\System\jpFmhDe.exe

C:\Windows\System\jpFmhDe.exe

C:\Windows\System\huIPziN.exe

C:\Windows\System\huIPziN.exe

C:\Windows\System\rshjtFc.exe

C:\Windows\System\rshjtFc.exe

C:\Windows\System\hRnZhFn.exe

C:\Windows\System\hRnZhFn.exe

C:\Windows\System\OIFYboW.exe

C:\Windows\System\OIFYboW.exe

C:\Windows\System\OlGosOQ.exe

C:\Windows\System\OlGosOQ.exe

C:\Windows\System\bqCnLFu.exe

C:\Windows\System\bqCnLFu.exe

C:\Windows\System\bVebjTY.exe

C:\Windows\System\bVebjTY.exe

C:\Windows\System\FnjulLV.exe

C:\Windows\System\FnjulLV.exe

C:\Windows\System\kjZDGmQ.exe

C:\Windows\System\kjZDGmQ.exe

C:\Windows\System\AHVhDES.exe

C:\Windows\System\AHVhDES.exe

C:\Windows\System\XkLSVNN.exe

C:\Windows\System\XkLSVNN.exe

C:\Windows\System\lwudRWW.exe

C:\Windows\System\lwudRWW.exe

C:\Windows\System\OWDrUGO.exe

C:\Windows\System\OWDrUGO.exe

C:\Windows\System\hNABWol.exe

C:\Windows\System\hNABWol.exe

C:\Windows\System\seycePE.exe

C:\Windows\System\seycePE.exe

C:\Windows\System\RghfHBR.exe

C:\Windows\System\RghfHBR.exe

C:\Windows\System\kevZyRK.exe

C:\Windows\System\kevZyRK.exe

C:\Windows\System\MzShuWH.exe

C:\Windows\System\MzShuWH.exe

C:\Windows\System\oZSkNgY.exe

C:\Windows\System\oZSkNgY.exe

C:\Windows\System\ptPDVfN.exe

C:\Windows\System\ptPDVfN.exe

C:\Windows\System\GUdfsWn.exe

C:\Windows\System\GUdfsWn.exe

C:\Windows\System\jqqoEfS.exe

C:\Windows\System\jqqoEfS.exe

C:\Windows\System\khtROEg.exe

C:\Windows\System\khtROEg.exe

C:\Windows\System\fLHoaqp.exe

C:\Windows\System\fLHoaqp.exe

C:\Windows\System\EaJkeHM.exe

C:\Windows\System\EaJkeHM.exe

C:\Windows\System\peJChjj.exe

C:\Windows\System\peJChjj.exe

C:\Windows\System\Uatnbvx.exe

C:\Windows\System\Uatnbvx.exe

C:\Windows\System\LxGTykR.exe

C:\Windows\System\LxGTykR.exe

C:\Windows\System\SMQCzlx.exe

C:\Windows\System\SMQCzlx.exe

C:\Windows\System\oXFPyOY.exe

C:\Windows\System\oXFPyOY.exe

C:\Windows\System\gsUJhMo.exe

C:\Windows\System\gsUJhMo.exe

C:\Windows\System\vtHbbpt.exe

C:\Windows\System\vtHbbpt.exe

C:\Windows\System\lQOJwSC.exe

C:\Windows\System\lQOJwSC.exe

C:\Windows\System\NgGHffq.exe

C:\Windows\System\NgGHffq.exe

C:\Windows\System\iypbeRO.exe

C:\Windows\System\iypbeRO.exe

C:\Windows\System\IiiBoEr.exe

C:\Windows\System\IiiBoEr.exe

C:\Windows\System\cPndyHK.exe

C:\Windows\System\cPndyHK.exe

C:\Windows\System\IVWechB.exe

C:\Windows\System\IVWechB.exe

C:\Windows\System\XxLSUVO.exe

C:\Windows\System\XxLSUVO.exe

C:\Windows\System\NDbQoph.exe

C:\Windows\System\NDbQoph.exe

C:\Windows\System\rEGITvM.exe

C:\Windows\System\rEGITvM.exe

C:\Windows\System\VxRhhLB.exe

C:\Windows\System\VxRhhLB.exe

C:\Windows\System\WiDgpdd.exe

C:\Windows\System\WiDgpdd.exe

C:\Windows\System\PAOECZr.exe

C:\Windows\System\PAOECZr.exe

C:\Windows\System\LMDkASF.exe

C:\Windows\System\LMDkASF.exe

C:\Windows\System\kzqNQxT.exe

C:\Windows\System\kzqNQxT.exe

C:\Windows\System\AsIVGJf.exe

C:\Windows\System\AsIVGJf.exe

C:\Windows\System\yQQGeJt.exe

C:\Windows\System\yQQGeJt.exe

C:\Windows\System\HqMVMYE.exe

C:\Windows\System\HqMVMYE.exe

C:\Windows\System\qsqyuUw.exe

C:\Windows\System\qsqyuUw.exe

C:\Windows\System\ECCUPpi.exe

C:\Windows\System\ECCUPpi.exe

C:\Windows\System\pSWMzIH.exe

C:\Windows\System\pSWMzIH.exe

C:\Windows\System\sqCjOVV.exe

C:\Windows\System\sqCjOVV.exe

C:\Windows\System\rnbejwc.exe

C:\Windows\System\rnbejwc.exe

C:\Windows\System\HyRaZyC.exe

C:\Windows\System\HyRaZyC.exe

C:\Windows\System\qHmfLtM.exe

C:\Windows\System\qHmfLtM.exe

C:\Windows\System\KqrqcbW.exe

C:\Windows\System\KqrqcbW.exe

C:\Windows\System\uIUNVBz.exe

C:\Windows\System\uIUNVBz.exe

C:\Windows\System\KRvJNKX.exe

C:\Windows\System\KRvJNKX.exe

C:\Windows\System\iBkcPmZ.exe

C:\Windows\System\iBkcPmZ.exe

C:\Windows\System\qLufZIC.exe

C:\Windows\System\qLufZIC.exe

C:\Windows\System\UUlKMoN.exe

C:\Windows\System\UUlKMoN.exe

C:\Windows\System\rTTYUVp.exe

C:\Windows\System\rTTYUVp.exe

C:\Windows\System\FfxnJqq.exe

C:\Windows\System\FfxnJqq.exe

C:\Windows\System\fjgVdFB.exe

C:\Windows\System\fjgVdFB.exe

C:\Windows\System\zsqVqmQ.exe

C:\Windows\System\zsqVqmQ.exe

C:\Windows\System\wcuEyWu.exe

C:\Windows\System\wcuEyWu.exe

C:\Windows\System\dNzEbCA.exe

C:\Windows\System\dNzEbCA.exe

C:\Windows\System\LKgIcJm.exe

C:\Windows\System\LKgIcJm.exe

C:\Windows\System\JRMkCnN.exe

C:\Windows\System\JRMkCnN.exe

C:\Windows\System\juKxblE.exe

C:\Windows\System\juKxblE.exe

C:\Windows\System\eRHczdO.exe

C:\Windows\System\eRHczdO.exe

C:\Windows\System\FJoDkDw.exe

C:\Windows\System\FJoDkDw.exe

C:\Windows\System\OjUwNoO.exe

C:\Windows\System\OjUwNoO.exe

C:\Windows\System\RCSksOm.exe

C:\Windows\System\RCSksOm.exe

C:\Windows\System\GvpaKga.exe

C:\Windows\System\GvpaKga.exe

C:\Windows\System\ThflkVS.exe

C:\Windows\System\ThflkVS.exe

C:\Windows\System\XAOlkVF.exe

C:\Windows\System\XAOlkVF.exe

C:\Windows\System\KYOAzci.exe

C:\Windows\System\KYOAzci.exe

C:\Windows\System\kIdDnfH.exe

C:\Windows\System\kIdDnfH.exe

C:\Windows\System\UIHJlmK.exe

C:\Windows\System\UIHJlmK.exe

C:\Windows\System\FUaerRl.exe

C:\Windows\System\FUaerRl.exe

C:\Windows\System\UhLhkGz.exe

C:\Windows\System\UhLhkGz.exe

C:\Windows\System\ZOEIYRF.exe

C:\Windows\System\ZOEIYRF.exe

C:\Windows\System\dwDjBkn.exe

C:\Windows\System\dwDjBkn.exe

C:\Windows\System\dQzimVb.exe

C:\Windows\System\dQzimVb.exe

C:\Windows\System\zjFFHYf.exe

C:\Windows\System\zjFFHYf.exe

C:\Windows\System\frVbGpz.exe

C:\Windows\System\frVbGpz.exe

C:\Windows\System\UGKUpvh.exe

C:\Windows\System\UGKUpvh.exe

C:\Windows\System\tlANDei.exe

C:\Windows\System\tlANDei.exe

C:\Windows\System\OTJCTkV.exe

C:\Windows\System\OTJCTkV.exe

C:\Windows\System\YXvIWje.exe

C:\Windows\System\YXvIWje.exe

C:\Windows\System\SDVGZoV.exe

C:\Windows\System\SDVGZoV.exe

C:\Windows\System\bKuUYna.exe

C:\Windows\System\bKuUYna.exe

C:\Windows\System\rdtaqSY.exe

C:\Windows\System\rdtaqSY.exe

C:\Windows\System\VwnEQXq.exe

C:\Windows\System\VwnEQXq.exe

C:\Windows\System\WStCCSz.exe

C:\Windows\System\WStCCSz.exe

C:\Windows\System\RpUhZKX.exe

C:\Windows\System\RpUhZKX.exe

C:\Windows\System\LcOvhJs.exe

C:\Windows\System\LcOvhJs.exe

C:\Windows\System\gpddaqr.exe

C:\Windows\System\gpddaqr.exe

C:\Windows\System\yfEuRJP.exe

C:\Windows\System\yfEuRJP.exe

C:\Windows\System\hAsODRl.exe

C:\Windows\System\hAsODRl.exe

C:\Windows\System\CSXrctK.exe

C:\Windows\System\CSXrctK.exe

C:\Windows\System\chpbRLx.exe

C:\Windows\System\chpbRLx.exe

C:\Windows\System\OEzmSgD.exe

C:\Windows\System\OEzmSgD.exe

C:\Windows\System\AAeatPw.exe

C:\Windows\System\AAeatPw.exe

C:\Windows\System\VxKWtsv.exe

C:\Windows\System\VxKWtsv.exe

C:\Windows\System\LjAQeEr.exe

C:\Windows\System\LjAQeEr.exe

C:\Windows\System\QQfnIfD.exe

C:\Windows\System\QQfnIfD.exe

C:\Windows\System\mNJigpM.exe

C:\Windows\System\mNJigpM.exe

C:\Windows\System\KkWZYZU.exe

C:\Windows\System\KkWZYZU.exe

C:\Windows\System\pNrizdo.exe

C:\Windows\System\pNrizdo.exe

C:\Windows\System\RJEIjKD.exe

C:\Windows\System\RJEIjKD.exe

C:\Windows\System\zGemzeb.exe

C:\Windows\System\zGemzeb.exe

C:\Windows\System\BpNfJvB.exe

C:\Windows\System\BpNfJvB.exe

C:\Windows\System\itVOAqA.exe

C:\Windows\System\itVOAqA.exe

C:\Windows\System\ktyZZzB.exe

C:\Windows\System\ktyZZzB.exe

C:\Windows\System\IBjTFsw.exe

C:\Windows\System\IBjTFsw.exe

C:\Windows\System\MlJRZga.exe

C:\Windows\System\MlJRZga.exe

C:\Windows\System\EWKpjlt.exe

C:\Windows\System\EWKpjlt.exe

C:\Windows\System\vIovpnE.exe

C:\Windows\System\vIovpnE.exe

C:\Windows\System\bitWSoI.exe

C:\Windows\System\bitWSoI.exe

C:\Windows\System\fwznGmF.exe

C:\Windows\System\fwznGmF.exe

C:\Windows\System\yvgsWWO.exe

C:\Windows\System\yvgsWWO.exe

C:\Windows\System\OPbXPVU.exe

C:\Windows\System\OPbXPVU.exe

C:\Windows\System\sSvldFh.exe

C:\Windows\System\sSvldFh.exe

C:\Windows\System\LqxCGWI.exe

C:\Windows\System\LqxCGWI.exe

C:\Windows\System\rchYbvx.exe

C:\Windows\System\rchYbvx.exe

C:\Windows\System\ipGErfO.exe

C:\Windows\System\ipGErfO.exe

C:\Windows\System\vePPRcj.exe

C:\Windows\System\vePPRcj.exe

C:\Windows\System\fmxakbX.exe

C:\Windows\System\fmxakbX.exe

C:\Windows\System\xSPtyPW.exe

C:\Windows\System\xSPtyPW.exe

C:\Windows\System\upWgBMp.exe

C:\Windows\System\upWgBMp.exe

C:\Windows\System\slJrlZx.exe

C:\Windows\System\slJrlZx.exe

C:\Windows\System\MghEijp.exe

C:\Windows\System\MghEijp.exe

C:\Windows\System\KWzNPQJ.exe

C:\Windows\System\KWzNPQJ.exe

C:\Windows\System\kAKWBHY.exe

C:\Windows\System\kAKWBHY.exe

C:\Windows\System\TSoLsBo.exe

C:\Windows\System\TSoLsBo.exe

C:\Windows\System\nelaMgM.exe

C:\Windows\System\nelaMgM.exe

C:\Windows\System\cLikWFi.exe

C:\Windows\System\cLikWFi.exe

C:\Windows\System\bCPghkZ.exe

C:\Windows\System\bCPghkZ.exe

C:\Windows\System\WsKHqBd.exe

C:\Windows\System\WsKHqBd.exe

C:\Windows\System\ROFtPrs.exe

C:\Windows\System\ROFtPrs.exe

C:\Windows\System\CHgbABL.exe

C:\Windows\System\CHgbABL.exe

C:\Windows\System\JQOrbNp.exe

C:\Windows\System\JQOrbNp.exe

C:\Windows\System\OACjMdN.exe

C:\Windows\System\OACjMdN.exe

C:\Windows\System\WgwVUsl.exe

C:\Windows\System\WgwVUsl.exe

C:\Windows\System\jvkDfLh.exe

C:\Windows\System\jvkDfLh.exe

C:\Windows\System\KSdveqm.exe

C:\Windows\System\KSdveqm.exe

C:\Windows\System\FizBIWE.exe

C:\Windows\System\FizBIWE.exe

C:\Windows\System\bfYCjDn.exe

C:\Windows\System\bfYCjDn.exe

C:\Windows\System\nMXzIhf.exe

C:\Windows\System\nMXzIhf.exe

C:\Windows\System\mmNKkmx.exe

C:\Windows\System\mmNKkmx.exe

C:\Windows\System\nCcHuyG.exe

C:\Windows\System\nCcHuyG.exe

C:\Windows\System\njZhFWj.exe

C:\Windows\System\njZhFWj.exe

C:\Windows\System\LRzHEXT.exe

C:\Windows\System\LRzHEXT.exe

C:\Windows\System\pAGZbPf.exe

C:\Windows\System\pAGZbPf.exe

C:\Windows\System\kitkeow.exe

C:\Windows\System\kitkeow.exe

C:\Windows\System\fjLVtio.exe

C:\Windows\System\fjLVtio.exe

C:\Windows\System\KbHIWua.exe

C:\Windows\System\KbHIWua.exe

C:\Windows\System\XUiArUL.exe

C:\Windows\System\XUiArUL.exe

C:\Windows\System\xoxKgGn.exe

C:\Windows\System\xoxKgGn.exe

C:\Windows\System\IanPyvc.exe

C:\Windows\System\IanPyvc.exe

C:\Windows\System\BwKQuJH.exe

C:\Windows\System\BwKQuJH.exe

C:\Windows\System\LVQccwi.exe

C:\Windows\System\LVQccwi.exe

C:\Windows\System\jkEcprx.exe

C:\Windows\System\jkEcprx.exe

C:\Windows\System\ChkdqHH.exe

C:\Windows\System\ChkdqHH.exe

C:\Windows\System\WhvGjqw.exe

C:\Windows\System\WhvGjqw.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	131.253.33.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	14.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	237.33.253.131.in-addr.arpa	udp
US	8.8.8.8:53	42.56.20.217.in-addr.arpa	udp
BE	23.41.178.121:443	www.bing.com	tcp
BE	23.41.178.121:443	www.bing.com	tcp
US	8.8.8.8:53	121.178.41.23.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	57.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	23.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53		udp

Files

memory/864-0-0x00007FF6D2AE0000-0x00007FF6D2E31000-memory.dmp

memory/864-1-0x000001412B800000-0x000001412B810000-memory.dmp

C:\Windows\System\oHQpWyi.exe

MD5	a9fa152c8b55dfc3979ccb7914dfe51b
SHA1	07faad422e9c248b070bb58f856ac6009d3ed0b1
SHA256	341f5f6a8def61409ca97bfa05bdc5804947aed7740e988d9392f0765e27cd62
SHA512	4a55db45da97e227cf6a3702a06cbf520324d8f6bdf65d2412349abba4b048e254738fb9d8ce7928624e640349073c76e5768ceec27a2b0b1226f55d2187b4fe

memory/1844-11-0x00007FF7235E0000-0x00007FF723931000-memory.dmp

memory/2524-29-0x00007FF7C5AA0000-0x00007FF7C5DF1000-memory.dmp

C:\Windows\System\BJcEWFJ.exe

MD5	92010292b149e4c5f3abca4a9cd2ea57
SHA1	06e35ca2bb3f72ddfb0bb4ef9b508b8672868f20
SHA256	aeef33ed73b1e37f30a4e552fe5576fb66521087b7344397c50ac7206116ef7c
SHA512	95ef00b5d57931469f3a83874a2f4c808d38b6d1e16e5bdb16dce809832aee161af58b484881388d7ed42a8f8a161f7e0f2be6cec4758e871ba03a7057359340

C:\Windows\System\wUgCFZs.exe

MD5	4a6dfae63b28cf3b0f5b837619b12385
SHA1	fbf263320e7b9b8eec458b86d91a26b718635a6e
SHA256	e67dc19182ae7bb18e75c4fd93426aa6aa77a0731c8811f1b819c19a646f5bed
SHA512	6d87626fb65786f46507e814417f75da4af801f6562f7a05a5e61152e5d2ffad37bc794f918307d4e1d5e43077acde725884138d52c06cb0d1f0aedc2fac1f77

C:\Windows\System\OzYawZy.exe

MD5	d09348f483153105039a959fb738c9cb
SHA1	51e8d133d46cdefdbb2d34f10721215fb1c3e9f5
SHA256	6ad8af3f396f7db76d1811b069d640083af7c6a95ab7cf7c94aa32427c9c2b5d
SHA512	c4e2dce75b8804ee5b4f66535ef18ea26cde515bf3ce30b848561ac8a33f3f20b3a58e92a0d3ef3d2cd18b16305388199c17ced253368b9a9825482b8e239228

C:\Windows\System\BKkYshP.exe

MD5	8cbc499163041e0db229acdfc0626ee1
SHA1	a875dea73c679e841503da0f649075473d8bd701
SHA256	98af7f3431d284f4bc57012a8fdd7492f056ae53264f2f346fba766f8579eb89
SHA512	a9e484256b8c37bd4afa74e1f4f071870e0be54683a7e48008a736566804759f862f6ccde2405316a15c251f20074aaf839655c20260b233e0eb5aafa3bcbd13

memory/4544-179-0x00007FF68C310000-0x00007FF68C661000-memory.dmp

memory/2168-168-0x00007FF63EEB0000-0x00007FF63F201000-memory.dmp

C:\Windows\System\nrhLgHL.exe

MD5	3835103aca6ab4df53e54c03713b2ee7
SHA1	dc194df53fdd159a97d677dff5839f4216a8e7e0
SHA256	b13a5a750283e52c20a27695683d494255781406d418338dcd00c861956ede75
SHA512	c74fc9c9ed292662faeb7b434a03a362da424388be07ae44c953c50ba4467d134de6f566e243af39c14bdfeb90580cba4e3f48fbf282bfad930b45878ee52c10

C:\Windows\System\zWunpMp.exe

MD5	29eaf0e100de4a51bffa6137f8932af1
SHA1	8c9568d371af855780c015a67d1e529d72b52c83
SHA256	fdc1dc09e7d3b0ce6615b4929264140c3142dfab40ba573a7fdb83eba7f2c5a7
SHA512	b9ab74074ef2abe1eb6a97576739ed592d625fb7d906718f3f52acf96498c91f50f31a5162cd25405e3d57c65568c6a734629c8e9cf9375704783a04031d2c51

C:\Windows\System\PKJxECG.exe

MD5	4a91ebc8c6cbf76196f08298385594d7
SHA1	dd0d3a0ff5a3f3f1bfd51bb67b3fd8cb61b55aa3
SHA256	ad174edc549ffa63bd621277164824db6a16e7dad310151ce20d3d1f49d30a23
SHA512	5c4d259334d8ba47126a366cb92c39daaa2d5ef875e30ea9473b018ae5a24216c14f01f833160fe2f31ce99033fc44fba4408c428d41bc2cb364c050ae5bf6a1

C:\Windows\System\VPcOHiw.exe

MD5	8a224c3eb0bedda12f7a0dc17f417800
SHA1	ac3002394f43e696ef9b7102052cb8f7810f49ef
SHA256	73cef4ba9a7506641b4675053dd3b7075cd8c660724c0545866ddae06723cf73
SHA512	a31bfbc4b1db32067106787dddc032d8603a03662fca191d1d9ca3fae398782277e7ef375467d799de8c8ba21307142eb4280a64ca63fdae763ff746dbee37a9

C:\Windows\System\XELtKjB.exe

MD5	e9887f68bb047792d2ae7f5572923fd4
SHA1	211ee0195a4e054d5ef11f9cbc1dca9da83a2dc5
SHA256	2a352a88574e8eba96e0f419f998a1ae9f9a81c88fe5789f2602a04e0022c0a4
SHA512	fe886642cc6788ea8899f57a0052aab8372a67b4d061f1f824d35072ae230775c50c7e1032464c0badba7e698f957d3ae68f11e66d1dc9661a050320ff122528

C:\Windows\System\UeFiBPm.exe

MD5	2ec0dccdda30b761344febace7b79209
SHA1	0fc303eb8d009e8874bc80ef6863b0778dddb659
SHA256	d3c0a4b1b453c6f5c676b3a1b5b48edd6abb40e70e8614eb670951607fbacd5c
SHA512	e0a33b889a35f40720b925c923074323e4ead1dec5c80927e4243efccb7cc6a3ba12f75fd3fb42abe5cd24635fa8353a74d97a51fb5242b744171e1868599c37

C:\Windows\System\naRohcR.exe

MD5	36cc2eb0f4d2031051b66d17a7017295
SHA1	23e126a486fa45f2777d1330e06526fb74a266c8
SHA256	40a4f30146e856d8d60bf0b06782cf0d551b398b091fa0c12a4b743b374edaae
SHA512	dc7cc55fcb5eb2f7a714eca819badadf2de06a307e0aa66f40d185bb2780a7a7653a65d63f143d50755e4cb1decd8dc23e3300b05cb8bac089d6d7cb116dca6f

C:\Windows\System\nlqyGwv.exe

MD5	7ea1b4d91f3b7a9447c3205a1f2baf2f
SHA1	9fea2facbbc44a9cdeb17c1d3ae76596ed19ee05
SHA256	2ec5ef65952371b744408944bd85ae706c34983ca03f0574d934d187eddd8edb
SHA512	bf637d09e0ffd82ea1fd7d270300e998bb9b5bd1e44c3e2cb76b7cc772f49034cc9c6d7e9ca1ffdcd90b16242616be5e4d40c777c3e663f0215961bb08d1c02e

C:\Windows\System\enxJevN.exe

MD5	770087519f159f23b5a50cdbc6420d19
SHA1	c5e7345112ddcb7d4ee29df61ff4c348ea2396f0
SHA256	814288217bffd178b8cb16321293a464388477a6d68d71a9066190334cb6df74
SHA512	a316d2c7fff5f638e642a959b3727504ec95f0a3cf174dcf287309c15366173af68ea34e0cdd08d045f9e80fe1a2b166c01793aa80ce39fae2063b7c097011dc

memory/1908-224-0x00007FF6A4BA0000-0x00007FF6A4EF1000-memory.dmp

C:\Windows\System\YYaLRYs.exe

MD5	0c903087bbeecefd3e016d5e549f8637
SHA1	1291fa231404a2d78ccee334e35750b2822ae359
SHA256	5e9eecb7003cc37f17eafa46a1f4a466ae5d6b2261a7d0ffc3e2bf289144fef8
SHA512	b28f6015650eaf71a8acdc22875ea6bbbe3cf8675f77400b84a046c8b0fe7760bbbf00c044b5f710843f0190501e5c879518476122cecc452a1080f1d290e8b2

memory/5024-291-0x00007FF6393E0000-0x00007FF639731000-memory.dmp

memory/2928-295-0x00007FF6754F0000-0x00007FF675841000-memory.dmp

memory/4596-302-0x00007FF65D690000-0x00007FF65D9E1000-memory.dmp

memory/864-2065-0x00007FF6D2AE0000-0x00007FF6D2E31000-memory.dmp

memory/3576-301-0x00007FF685D90000-0x00007FF6860E1000-memory.dmp

memory/1148-300-0x00007FF7830B0000-0x00007FF783401000-memory.dmp

memory/3376-299-0x00007FF7ACCC0000-0x00007FF7AD011000-memory.dmp

memory/1228-298-0x00007FF760060000-0x00007FF7603B1000-memory.dmp

memory/220-297-0x00007FF65C130000-0x00007FF65C481000-memory.dmp

memory/1596-296-0x00007FF795C00000-0x00007FF795F51000-memory.dmp

memory/2472-294-0x00007FF7BBB10000-0x00007FF7BBE61000-memory.dmp

memory/3172-293-0x00007FF67DC30000-0x00007FF67DF81000-memory.dmp

memory/3652-292-0x00007FF7A43F0000-0x00007FF7A4741000-memory.dmp

memory/3272-290-0x00007FF743CE0000-0x00007FF744031000-memory.dmp

memory/3168-289-0x00007FF7C1ED0000-0x00007FF7C2221000-memory.dmp

memory/2352-288-0x00007FF7FE0B0000-0x00007FF7FE401000-memory.dmp

memory/4208-281-0x00007FF657EC0000-0x00007FF658211000-memory.dmp

memory/1696-280-0x00007FF746EA0000-0x00007FF7471F1000-memory.dmp

C:\Windows\System\GjIKwDV.exe

MD5	76e62d96e4d5f6a278e1c54d53a34ed0
SHA1	574f26c162149117d53eb18eb9a4a7a3da6bc747
SHA256	b9f23c211c8fe1e78b40b8d047624ca05daa208c8f193782d8b5ba685a4b0fe6
SHA512	213da4870e3b343a765224beeb56e9510302056f194a8b5e7c9cddb254e096dd90ed5c5d55854123f9ea65cda2790ab051103eb5574f12e5188d46aca9343066

C:\Windows\System\KYNgysO.exe

MD5	9c6b49419c34e4a75bc5ed464b428b64
SHA1	6adf3d52cf392e166c925a0d6285204947fcb9c2
SHA256	50e6b3a2d73d5a340958595ccf0e3db34723a4471e7223fd0b8bd52a7a2f6690
SHA512	6641aeb7c3d037625507c6aac6d1b7cfc6e2cc6a2ef6aa626a530053263e94b467b1e83cc8ec1ea5e4d7ca5c7b89cd11106a9764b984718908d2079332f373f7

C:\Windows\System\KPfFHyl.exe

MD5	6063651711b6fd2a0851b1c3e34e374f
SHA1	745bce3b375b546bf7e403d19e32edfb190a9675
SHA256	80e5b29d9edc835da90944bd0081b9b711391a6f0c95220ec678989b78adf43b
SHA512	6b3659c09c974a99a510559e82ab43ea46fca5d0b0249b7c61cb532a3cfe0ede2c49b8b070da8bc4b8bbb43d1509c3e712d741695ffd545dce2956a644305eea

C:\Windows\System\NssedBt.exe

MD5	c79b89c57a3ddf12d4cd9f93390619f7
SHA1	721196eee20b61df229bd80e54d3fbf7dbe62c20
SHA256	44cb109c2221adee75539a34a01b269241e89256c4ce93c57351df10590433d0
SHA512	1f557f6dcb71d7435dcd6430023ee7d6089a65ee93ba62725f601e64f26f71a76f1618dae6077178e392de599442bc99206a23cc5d7d1b596643817760647dda

C:\Windows\System\RZTTOCe.exe

MD5	bea1ec627d81138b130a3485c3551078
SHA1	e8bb3c1b1ad318ffda13567fd6d03bf430fb09bd
SHA256	c359e5180990b3a2d7fb73bf9783c05eea77d02b5fc173230e5a452a64412221
SHA512	c079cfad16368f1ef1ba46e438a70fdede09d72f974b9798a5fdd5ec6e988a897d28985d02b38134a9f51be00deb296bab54fb9ae083b52d73a224b754368f5e

C:\Windows\System\HxIDmHY.exe

MD5	d378303ca30cfd97f7a4e335289eb02d
SHA1	b7cb1611505be6ed43e620a7b52b6720c8673d04
SHA256	860d7a11e675d18828acf794ecf7e202eaf2a93d31b58712257b271173a2abda
SHA512	8e2e9cae14dc601e97ad8b5712131189f606f53c1d6b9cb8e27d2a1e609bb0ba29a052d6978cc5c5943e7fd16e52b73e985f2c0b0527feee08a1384c0827bf2b

C:\Windows\System\CyKXLnG.exe

MD5	130a9abefa5baf5aa9864bc3805c6409
SHA1	9996a02bb42061a26516c1ea7f6ffd7488863bb2
SHA256	616b73d302918190181d7f9dd7f1d08665f734790a008c43943e144e2820ee07
SHA512	8f259ba8d7987172353574fcee9efb139d98d685e51ad8d42d84ec4244e2e12cd8f1ea45ab4252f4e63a091fff71be84e73193ba3112491bd3330ae2771154be

memory/3736-142-0x00007FF786BA0000-0x00007FF786EF1000-memory.dmp

C:\Windows\System\KNURQdf.exe

MD5	f384b54b7acb73185c6d5e78ecdb91c6
SHA1	62be259f24053a44adeb78e1b1e31978b4ef48b8
SHA256	c12a711556e8ebd582070d01a97c92c35972d08bc937909c6061ae4f640587f8
SHA512	9e4477e308727624bf8ed7f91e4cd220c40ca4edfd62627a5fb6921aad97ad24b335faee25848989b9e92943e5da133668a0a3934eeb57f26046b251f2432752

C:\Windows\System\frwSNiI.exe

MD5	1587b233ccf13580c8ddcff33fc089ee
SHA1	fcfaf5d01708f891ab46c8b9040b56e133c39082
SHA256	62dc4d7613d491e3deb0d1206cf7df778a8e3bcf748ebc7cafcbbaed51943906
SHA512	45ad1df302dc756b98d6c1df873030d73d3757022e2cc7ece7447ecb254acee0bd2092f72805cf450644a7a3f3f937eb1a4d801ff4e042e56a9b8ce9d87be63d

C:\Windows\System\wtTyOsj.exe

MD5	3dc899a18ebb1de4b55d0eaadc7be337
SHA1	bc5964b14c7fb467906f225a6df3dd4fa3fa9ab7
SHA256	ac7b672f62a8affbfab91b7da4080647d51bd330bfa764161284976ba168b86b
SHA512	607d74adff8480ddabc4adbeaa7355285bd41b0aea332e44a14688df14100cdd3326a270db87982fc434866802dde844f66bff0303509a5862573699ae4def5d

C:\Windows\System\OlgDnQF.exe

MD5	9f04942bed9069c4f961e3015d6e30d3
SHA1	8265b1e9d7103c33d04da99ad5d4da87c32c4b00
SHA256	508ee49950ed0e4fb146d9ecfa35c56d5018eda55a8fc9f8111b8448141e5619
SHA512	c98aa7f0f154ae83d9f862ea602602f861c34349f857c5e11486ffef15667ccc48ca44a10f65d685cf69dc74ef21afa81d579db657f2719507a7fbb179795825

C:\Windows\System\spvyFpS.exe

MD5	f0cd9ece98b67964e766d786f79f8d2c
SHA1	0c07e8b09bd8cbb9691291f0e553c854593be2da
SHA256	f549f3bbfbe4966c9726f2f7781ee52b216276de88c9865cf49472641b37a983
SHA512	715df98b421fa41de8b7273eb7ca39566a71c919299f9715757c3fc52678f2940c11b81e628f4a17d31c5f19b47a10a2512174cbf71efeec71437d564d83c1ac

C:\Windows\System\MeZkckw.exe

MD5	2d6ab2ee668f0711a99f200c3ccfb71b
SHA1	9ffcab8e015374d8b64c61efcdd7849318f3ec68
SHA256	53592c597d11538b38fb5c2a18c568441708fe86afaed4995ffe748eb030a04f
SHA512	bef583868b2c4a9568bd1e96ee539b0574afe6416c1559691ccb5b8e129c01c567c1f38ab7a9b13c9442d9bfd05688bea0b4c573c560b5f985dafecb7e618aa6

C:\Windows\System\NreXXmG.exe

MD5	91522f4ca48c2c32cb88510fea3ca4cf
SHA1	8eff05c9754a001ab3df1f0141b893067707a627
SHA256	3e78524111545e19f18e5c8f7995e0b955457befe390d7878e79a7759947c34a
SHA512	f1c43f49cfaec01393293fdbeb74cf29f2ca624f9e47cd952c27e5aa7c675d5a0db5b7ee072aafdd902af29e8cc7ece41ac5df266132293bd5875f5792e6c9f0

C:\Windows\System\cHORLgG.exe

MD5	9d1f2e52efeb162a5742337aa897d3ac
SHA1	5e19d7215af16c900736419e104d036a6f29831b
SHA256	6040bab1faa585d19a2e2b4725b631cd009ce2bd3d9105405e69d76ff5988b99
SHA512	46a75abb587d942aeb3cbb2a4aaa18323eacdaa2738ce7cf6ba24ed4793a8f7b86b80b6ad9c0d97a8849f2bbe65188c7b8cbb93c7856f034840948e5aeba640f

memory/1512-95-0x00007FF734560000-0x00007FF7348B1000-memory.dmp

C:\Windows\System\EFAZvvV.exe

MD5	bd0eab56546a51b69f78ca2baac876b2
SHA1	672a1823a7178b17572509a20f0b50d0b701f745
SHA256	47a17dc9330ed29fafa65b21c974e1deea4e297565f2cbbed7f635f20111a04d
SHA512	74c98bc09252d366c011dceb09681593a058f1f15021797565d4003a2e4e555805d4fba08d32d581fc1e21179e2a83f9b3ee733c846bb8e6ee239338fbb85fb5

C:\Windows\System\gdtrWjO.exe

MD5	3aa2ac556d25959dee3099e3d3c71e1a
SHA1	a11950d55159613271d7595a1366ade830772ef9
SHA256	f6fade486938831b2841fc3a61d0b5245fee742cd25819549cf7ed88c6c5b955
SHA512	86caa956b927945197fc1733329e8ee47bf2fa6aa332cffbed36c6142c4f8b3b5be515c9368bdb27dabe082746b3f91eb93335488508d3ac333b6bb4f385783f

C:\Windows\System\dizUeJR.exe

MD5	263e56ad8952e77c576641cfd115d0da
SHA1	63f4ef19f258dd7d70fdf75dbc9992525d3d5810
SHA256	8af25eccc6451ce4c984271c484e87344c37768526245fd941675bad752bf47c
SHA512	763db940b627d884a97c0e6f3a08603c38b7738fa011908cafa9f5b053715e735073f229c20325c33ff4cfc4d85385ef896ab3791d4d8b4f5987f8cd44482cb3

C:\Windows\System\DzHkcZZ.exe

MD5	9723553ee004e2a7fc60419f3082e0a7
SHA1	2c6fb301f2ea6746be6586b4f48ddacf33f7d622
SHA256	3dc54e22c21174e146fe3c105f45a98755dc055b1dc753d3592b92d5d4a460ed
SHA512	a9cb8ba4740237c95d07824e0ff62cd2df538871da69586e54f56269c0c1879aa8acbe5d45561dd346abcdc2edc6dea3a0b32ffda5ae0eb08c7efa5901c193d7

C:\Windows\System\yvOTCZv.exe

MD5	007c16c3a73af6cd904484232e1ddcaa
SHA1	3aedd3f3f30e0addb91fc91c891342fe030073fb
SHA256	acfe5a88607890fa4ba19abc4adde7f77655dcf9e05f92501f9886c1a7d9c504
SHA512	815745336b45170d2c0001679dd86dfb8d562686f85b4cab62b7de1da7ff1425e661942a2d9618f959db8304242a7549ae19e5ccf231b12cdbf013856e3d98f5

memory/4496-74-0x00007FF7F2340000-0x00007FF7F2691000-memory.dmp

C:\Windows\System\EUZfPXn.exe

MD5	5fa2ba246f88003e81f27661f02f4f30
SHA1	5dc278993af758f6c02a9ec6563d5eb2f317248d
SHA256	9f92b2f3cbae2f6844248b60b262f8dbfe17b88e26c6e0229fb4df9ffeeaab70
SHA512	2a3b22a3cb215cdfe4ba2ea8798bf8a1fb6517d5f31f6f1ca8eaeb430d3abad8e71d23044816ea9354d49cfa5834eb7d08ca197122cd67af6f7f04d47ed126c4

memory/1296-55-0x00007FF7601E0000-0x00007FF760531000-memory.dmp

memory/3060-52-0x00007FF7AC990000-0x00007FF7ACCE1000-memory.dmp

C:\Windows\System\vEasJuc.exe

MD5	05d5564d51243f9bfc89db0b3aa9f634
SHA1	2b9cd4c25c5fe80b4d232c23e035b6212b648dfa
SHA256	02ef78ce659d1d42e662d1911f662a6dba5088a786be01d42e9eafc2d04abbc7
SHA512	7eb60708c95312b2bf75add0ee227ead315c283534a5eced5645db94fddfd642ae55c0f74ceda80f34e60d1ae96d85764ca60424b7c935c010cdf6162675dcb5

C:\Windows\System\BLhvIqg.exe

MD5	c0d2c2981dbac8effc438971c83ba941
SHA1	b273d89c555283814c366ce533adef12e5b21260
SHA256	c8197ff640164e873c44942f618fa7f77e5c957ad59a2f30a918dc41f2c25f47
SHA512	8ce1ef7b99fed15053e7852359a433509845a898dd3eb14a4b2a531cab9d303799c43429783c522f60cefb322e672ea7525ccc474dc8ee6f021acd9e65819b69

memory/4344-38-0x00007FF700500000-0x00007FF700851000-memory.dmp

memory/4576-35-0x00007FF62E410000-0x00007FF62E761000-memory.dmp

C:\Windows\System\ptQuozS.exe

MD5	1a37cbbf9d0b0ea92fb349e64d74378d
SHA1	c82e914873f8cbb812377bb7a413a31ab9eaca02
SHA256	a80b62aa0783b40027dc5cdc557bfa8ba4c3aadbeab1b11260d2fbb7ef5c5075
SHA512	1dad98156826f8ceed5b68e531e2eddb68724aacdc6c6c08cdcb7894aaf29275cf09a72a6ff38ca7dd243c1c1ad7f93154f4168b31e287bf8cbc315e2425cd0e

C:\Windows\System\vvyUNYw.exe

MD5	a808ae519c4adfba09b5ab3efa1836bd
SHA1	5e8433d9cb59759ea265e38f39ea2c4bc1f4eae0
SHA256	d4fd57879939e417755645d96d07b6b3e2a93471e2bbd9c26924b71c1e4ad0f0
SHA512	39e3a8b57a5b0d7e28ecfa1de986933534f1a83148a84f6e4f59bf6f01ca83e03c88ee3f9302df472e82b55a544c845756671b9d2f31ea9a1a31977f9ebdff89

C:\Windows\System\rUcdFXW.exe

MD5	71531137b0fd141fac5a3a5be1729cda
SHA1	4aca3bf20d99090884f9123c922e8aebaea677f9
SHA256	395402097fc487f945391de4def67225a160f41146bf7acc2eb0a6a5b4b17bb4
SHA512	41372082a0933b84615a0bbe6df4f46850074c5c2bd2a932097cb790f8dc4d701fe81fa3ad09114b089bf954f96a5087368c9a08a8795202f1c92acb39b6ec63

memory/3060-2179-0x00007FF7AC990000-0x00007FF7ACCE1000-memory.dmp

memory/1844-2180-0x00007FF7235E0000-0x00007FF723931000-memory.dmp

memory/4496-2181-0x00007FF7F2340000-0x00007FF7F2691000-memory.dmp

memory/1512-2182-0x00007FF734560000-0x00007FF7348B1000-memory.dmp

memory/4576-2183-0x00007FF62E410000-0x00007FF62E761000-memory.dmp

memory/4344-2184-0x00007FF700500000-0x00007FF700851000-memory.dmp

memory/1296-2185-0x00007FF7601E0000-0x00007FF760531000-memory.dmp

memory/3272-2186-0x00007FF743CE0000-0x00007FF744031000-memory.dmp

memory/3652-2187-0x00007FF7A43F0000-0x00007FF7A4741000-memory.dmp

memory/1844-2189-0x00007FF7235E0000-0x00007FF723931000-memory.dmp

memory/2524-2191-0x00007FF7C5AA0000-0x00007FF7C5DF1000-memory.dmp

memory/220-2194-0x00007FF65C130000-0x00007FF65C481000-memory.dmp

memory/4576-2195-0x00007FF62E410000-0x00007FF62E761000-memory.dmp

memory/4344-2197-0x00007FF700500000-0x00007FF700851000-memory.dmp

memory/3060-2199-0x00007FF7AC990000-0x00007FF7ACCE1000-memory.dmp

memory/4544-2205-0x00007FF68C310000-0x00007FF68C661000-memory.dmp

memory/3576-2209-0x00007FF685D90000-0x00007FF6860E1000-memory.dmp

memory/1908-2215-0x00007FF6A4BA0000-0x00007FF6A4EF1000-memory.dmp

memory/5024-2217-0x00007FF6393E0000-0x00007FF639731000-memory.dmp

memory/2168-2219-0x00007FF63EEB0000-0x00007FF63F201000-memory.dmp

memory/1296-2213-0x00007FF7601E0000-0x00007FF760531000-memory.dmp

memory/3736-2211-0x00007FF786BA0000-0x00007FF786EF1000-memory.dmp

memory/1228-2207-0x00007FF760060000-0x00007FF7603B1000-memory.dmp

memory/1512-2204-0x00007FF734560000-0x00007FF7348B1000-memory.dmp

memory/3376-2202-0x00007FF7ACCC0000-0x00007FF7AD011000-memory.dmp

memory/4208-2225-0x00007FF657EC0000-0x00007FF658211000-memory.dmp

memory/1696-2231-0x00007FF746EA0000-0x00007FF7471F1000-memory.dmp

memory/3168-2229-0x00007FF7C1ED0000-0x00007FF7C2221000-memory.dmp

memory/1148-2223-0x00007FF7830B0000-0x00007FF783401000-memory.dmp

memory/4496-2222-0x00007FF7F2340000-0x00007FF7F2691000-memory.dmp

memory/4596-2227-0x00007FF65D690000-0x00007FF65D9E1000-memory.dmp

memory/2352-2246-0x00007FF7FE0B0000-0x00007FF7FE401000-memory.dmp

memory/1596-2247-0x00007FF795C00000-0x00007FF795F51000-memory.dmp

memory/2472-2237-0x00007FF7BBB10000-0x00007FF7BBE61000-memory.dmp

memory/3172-2252-0x00007FF67DC30000-0x00007FF67DF81000-memory.dmp

memory/2928-2240-0x00007FF6754F0000-0x00007FF675841000-memory.dmp

memory/3272-2266-0x00007FF743CE0000-0x00007FF744031000-memory.dmp

memory/3652-2268-0x00007FF7A43F0000-0x00007FF7A4741000-memory.dmp

Sample ID	240613-qtr77svenq
Target	807b65145396a9ef591b274d4571bf20_NeikiAnalytics.exe
SHA256	2272884e7fb6ecc098c10958db86d642ff6b528284d8b259627bbb81c03b5250
Tags	upx miner xmrig

Malware Analysis Report

2024-07-28 20:00

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files