Analysis Overview

score

10^/10

SHA256

99408aa4708f6726ca1a74b138d4f4d78215fff14fa3364173581a73215985a0

Threat Level: Known bad

The file 8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

miner upx xmrig

XMRig Miner payload

Xmrig family

xmrig

XMRig Miner payload

UPX packed file

Executes dropped EXE

Loads dropped DLL

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 22:11

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Xmrig family

xmrig

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 22:11

Reported

2024-06-13 22:13

Platform

win7-20240508-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\WzFntsv.exe	N/A
N/A	N/A	C:\Windows\System\dlllqth.exe	N/A
N/A	N/A	C:\Windows\System\DFKZBey.exe	N/A
N/A	N/A	C:\Windows\System\uXPPQAv.exe	N/A
N/A	N/A	C:\Windows\System\ywjrHUq.exe	N/A
N/A	N/A	C:\Windows\System\xtkmMHU.exe	N/A
N/A	N/A	C:\Windows\System\vAUFprE.exe	N/A
N/A	N/A	C:\Windows\System\hhrEsEo.exe	N/A
N/A	N/A	C:\Windows\System\YoHLgWw.exe	N/A
N/A	N/A	C:\Windows\System\yXtMzXm.exe	N/A
N/A	N/A	C:\Windows\System\RpwPfmv.exe	N/A
N/A	N/A	C:\Windows\System\rNexBJt.exe	N/A
N/A	N/A	C:\Windows\System\PmkvMDI.exe	N/A
N/A	N/A	C:\Windows\System\KfIXYVy.exe	N/A
N/A	N/A	C:\Windows\System\xtVWKUR.exe	N/A
N/A	N/A	C:\Windows\System\qzuhPKP.exe	N/A
N/A	N/A	C:\Windows\System\Swbyffu.exe	N/A
N/A	N/A	C:\Windows\System\EPcxTxX.exe	N/A
N/A	N/A	C:\Windows\System\IYgkMel.exe	N/A
N/A	N/A	C:\Windows\System\LmyAmPk.exe	N/A
N/A	N/A	C:\Windows\System\iYMSRvn.exe	N/A
N/A	N/A	C:\Windows\System\FXnMNbD.exe	N/A
N/A	N/A	C:\Windows\System\hwdGIYC.exe	N/A
N/A	N/A	C:\Windows\System\KSXAbBJ.exe	N/A
N/A	N/A	C:\Windows\System\CbfiGxE.exe	N/A
N/A	N/A	C:\Windows\System\QlzEbbU.exe	N/A
N/A	N/A	C:\Windows\System\bNoIsky.exe	N/A
N/A	N/A	C:\Windows\System\pMWakMU.exe	N/A
N/A	N/A	C:\Windows\System\THGtqQL.exe	N/A
N/A	N/A	C:\Windows\System\GsUMAHB.exe	N/A
N/A	N/A	C:\Windows\System\lkSBxLA.exe	N/A
N/A	N/A	C:\Windows\System\YhLXgVv.exe	N/A
N/A	N/A	C:\Windows\System\KqRTGZl.exe	N/A
N/A	N/A	C:\Windows\System\PtFBJdB.exe	N/A
N/A	N/A	C:\Windows\System\aRnfcBX.exe	N/A
N/A	N/A	C:\Windows\System\PpHfAUi.exe	N/A
N/A	N/A	C:\Windows\System\TtqqPRd.exe	N/A
N/A	N/A	C:\Windows\System\sNMGLvH.exe	N/A
N/A	N/A	C:\Windows\System\tBvublT.exe	N/A
N/A	N/A	C:\Windows\System\YYkLzbZ.exe	N/A
N/A	N/A	C:\Windows\System\oLcAuGI.exe	N/A
N/A	N/A	C:\Windows\System\oyhxDuj.exe	N/A
N/A	N/A	C:\Windows\System\BVEtyED.exe	N/A
N/A	N/A	C:\Windows\System\cOvudAr.exe	N/A
N/A	N/A	C:\Windows\System\fLtYRwU.exe	N/A
N/A	N/A	C:\Windows\System\NUjfDYI.exe	N/A
N/A	N/A	C:\Windows\System\vVSstEx.exe	N/A
N/A	N/A	C:\Windows\System\ZofNpsA.exe	N/A
N/A	N/A	C:\Windows\System\UfJiOSI.exe	N/A
N/A	N/A	C:\Windows\System\faPbIHV.exe	N/A
N/A	N/A	C:\Windows\System\WINQigp.exe	N/A
N/A	N/A	C:\Windows\System\mwfKJqb.exe	N/A
N/A	N/A	C:\Windows\System\KcZrAeN.exe	N/A
N/A	N/A	C:\Windows\System\OWgNiSt.exe	N/A
N/A	N/A	C:\Windows\System\XEtxzii.exe	N/A
N/A	N/A	C:\Windows\System\oMmryOb.exe	N/A
N/A	N/A	C:\Windows\System\CxfJzTw.exe	N/A
N/A	N/A	C:\Windows\System\hyljvgT.exe	N/A
N/A	N/A	C:\Windows\System\RHIiLRM.exe	N/A
N/A	N/A	C:\Windows\System\zhSMWFS.exe	N/A
N/A	N/A	C:\Windows\System\eGZueHv.exe	N/A
N/A	N/A	C:\Windows\System\DHaXlKp.exe	N/A
N/A	N/A	C:\Windows\System\aadLbZm.exe	N/A
N/A	N/A	C:\Windows\System\vMWhyFQ.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\PRebnsT.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iaHkCuK.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bcnaGMG.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PUooClA.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kffBVVH.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cmdhXHs.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lyoaQdu.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CSwOIPg.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tZWqaPi.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TozlbXU.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eNlRYXt.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iWmAwGu.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AeilFug.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XohyvrY.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SWCallj.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SzAilCY.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DFXDPgp.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TcyjYax.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DCLCOQH.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\scRriwG.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\meKEqJU.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XSvLXnJ.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BVEtyED.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jJuKaLB.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gjdjUWu.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MReZUxm.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yPGSyow.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HfsDYBv.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HEnZdnh.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XgPDYDh.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RMuBRew.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wOsEKmb.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NYDGvUL.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hGsBIhi.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KDTZJXp.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KDUfFKh.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yyblqxL.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hoHkknj.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LmyAmPk.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jRxAqvf.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hyljvgT.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ULrOBCL.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dnYNwrl.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TjfxssT.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ccMwJIt.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NxCeBJt.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KWgPfcO.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CKqFaEC.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\icYTeLT.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JDDhPqp.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lTTwLiV.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YokdIwU.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GZbKFZU.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zzezRis.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RyaHNgO.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rCQyRyy.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eFdVwPy.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mrMkTKD.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oamIlrV.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KQWLCOd.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gZRMEtL.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OndGXaD.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uCmTdjj.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nXVsoWT.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1936 wrote to memory of 2568	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\WzFntsv.exe
PID 1936 wrote to memory of 2568	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\WzFntsv.exe
PID 1936 wrote to memory of 2568	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\WzFntsv.exe
PID 1936 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\dlllqth.exe
PID 1936 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\dlllqth.exe
PID 1936 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\dlllqth.exe
PID 1936 wrote to memory of 2744	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\DFKZBey.exe
PID 1936 wrote to memory of 2744	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\DFKZBey.exe
PID 1936 wrote to memory of 2744	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\DFKZBey.exe
PID 1936 wrote to memory of 2800	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\uXPPQAv.exe
PID 1936 wrote to memory of 2800	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\uXPPQAv.exe
PID 1936 wrote to memory of 2800	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\uXPPQAv.exe
PID 1936 wrote to memory of 2808	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\ywjrHUq.exe
PID 1936 wrote to memory of 2808	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\ywjrHUq.exe
PID 1936 wrote to memory of 2808	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\ywjrHUq.exe
PID 1936 wrote to memory of 2716	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\xtkmMHU.exe
PID 1936 wrote to memory of 2716	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\xtkmMHU.exe
PID 1936 wrote to memory of 2716	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\xtkmMHU.exe
PID 1936 wrote to memory of 2868	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\vAUFprE.exe
PID 1936 wrote to memory of 2868	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\vAUFprE.exe
PID 1936 wrote to memory of 2868	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\vAUFprE.exe
PID 1936 wrote to memory of 2512	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\hhrEsEo.exe
PID 1936 wrote to memory of 2512	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\hhrEsEo.exe
PID 1936 wrote to memory of 2512	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\hhrEsEo.exe
PID 1936 wrote to memory of 3008	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\YoHLgWw.exe
PID 1936 wrote to memory of 3008	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\YoHLgWw.exe
PID 1936 wrote to memory of 3008	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\YoHLgWw.exe
PID 1936 wrote to memory of 2520	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\yXtMzXm.exe
PID 1936 wrote to memory of 2520	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\yXtMzXm.exe
PID 1936 wrote to memory of 2520	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\yXtMzXm.exe
PID 1936 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\RpwPfmv.exe
PID 1936 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\RpwPfmv.exe
PID 1936 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\RpwPfmv.exe
PID 1936 wrote to memory of 2508	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\rNexBJt.exe
PID 1936 wrote to memory of 2508	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\rNexBJt.exe
PID 1936 wrote to memory of 2508	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\rNexBJt.exe
PID 1936 wrote to memory of 2168	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\PmkvMDI.exe
PID 1936 wrote to memory of 2168	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\PmkvMDI.exe
PID 1936 wrote to memory of 2168	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\PmkvMDI.exe
PID 1936 wrote to memory of 2292	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\KfIXYVy.exe
PID 1936 wrote to memory of 2292	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\KfIXYVy.exe
PID 1936 wrote to memory of 2292	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\KfIXYVy.exe
PID 1936 wrote to memory of 2156	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\xtVWKUR.exe
PID 1936 wrote to memory of 2156	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\xtVWKUR.exe
PID 1936 wrote to memory of 2156	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\xtVWKUR.exe
PID 1936 wrote to memory of 2732	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\qzuhPKP.exe
PID 1936 wrote to memory of 2732	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\qzuhPKP.exe
PID 1936 wrote to memory of 2732	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\qzuhPKP.exe
PID 1936 wrote to memory of 2676	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\Swbyffu.exe
PID 1936 wrote to memory of 2676	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\Swbyffu.exe
PID 1936 wrote to memory of 2676	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\Swbyffu.exe
PID 1936 wrote to memory of 2788	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\EPcxTxX.exe
PID 1936 wrote to memory of 2788	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\EPcxTxX.exe
PID 1936 wrote to memory of 2788	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\EPcxTxX.exe
PID 1936 wrote to memory of 2828	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\IYgkMel.exe
PID 1936 wrote to memory of 2828	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\IYgkMel.exe
PID 1936 wrote to memory of 2828	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\IYgkMel.exe
PID 1936 wrote to memory of 1584	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\LmyAmPk.exe
PID 1936 wrote to memory of 1584	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\LmyAmPk.exe
PID 1936 wrote to memory of 1584	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\LmyAmPk.exe
PID 1936 wrote to memory of 1504	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\iYMSRvn.exe
PID 1936 wrote to memory of 1504	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\iYMSRvn.exe
PID 1936 wrote to memory of 1504	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\iYMSRvn.exe
PID 1936 wrote to memory of 1888	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\FXnMNbD.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe"

C:\Windows\System\WzFntsv.exe

C:\Windows\System\WzFntsv.exe

C:\Windows\System\dlllqth.exe

C:\Windows\System\dlllqth.exe

C:\Windows\System\DFKZBey.exe

C:\Windows\System\DFKZBey.exe

C:\Windows\System\uXPPQAv.exe

C:\Windows\System\uXPPQAv.exe

C:\Windows\System\ywjrHUq.exe

C:\Windows\System\ywjrHUq.exe

C:\Windows\System\xtkmMHU.exe

C:\Windows\System\xtkmMHU.exe

C:\Windows\System\vAUFprE.exe

C:\Windows\System\vAUFprE.exe

C:\Windows\System\hhrEsEo.exe

C:\Windows\System\hhrEsEo.exe

C:\Windows\System\YoHLgWw.exe

C:\Windows\System\YoHLgWw.exe

C:\Windows\System\yXtMzXm.exe

C:\Windows\System\yXtMzXm.exe

C:\Windows\System\RpwPfmv.exe

C:\Windows\System\RpwPfmv.exe

C:\Windows\System\rNexBJt.exe

C:\Windows\System\rNexBJt.exe

C:\Windows\System\PmkvMDI.exe

C:\Windows\System\PmkvMDI.exe

C:\Windows\System\KfIXYVy.exe

C:\Windows\System\KfIXYVy.exe

C:\Windows\System\xtVWKUR.exe

C:\Windows\System\xtVWKUR.exe

C:\Windows\System\qzuhPKP.exe

C:\Windows\System\qzuhPKP.exe

C:\Windows\System\Swbyffu.exe

C:\Windows\System\Swbyffu.exe

C:\Windows\System\EPcxTxX.exe

C:\Windows\System\EPcxTxX.exe

C:\Windows\System\IYgkMel.exe

C:\Windows\System\IYgkMel.exe

C:\Windows\System\LmyAmPk.exe

C:\Windows\System\LmyAmPk.exe

C:\Windows\System\iYMSRvn.exe

C:\Windows\System\iYMSRvn.exe

C:\Windows\System\FXnMNbD.exe

C:\Windows\System\FXnMNbD.exe

C:\Windows\System\hwdGIYC.exe

C:\Windows\System\hwdGIYC.exe

C:\Windows\System\KSXAbBJ.exe

C:\Windows\System\KSXAbBJ.exe

C:\Windows\System\CbfiGxE.exe

C:\Windows\System\CbfiGxE.exe

C:\Windows\System\QlzEbbU.exe

C:\Windows\System\QlzEbbU.exe

C:\Windows\System\bNoIsky.exe

C:\Windows\System\bNoIsky.exe

C:\Windows\System\pMWakMU.exe

C:\Windows\System\pMWakMU.exe

C:\Windows\System\THGtqQL.exe

C:\Windows\System\THGtqQL.exe

C:\Windows\System\GsUMAHB.exe

C:\Windows\System\GsUMAHB.exe

C:\Windows\System\lkSBxLA.exe

C:\Windows\System\lkSBxLA.exe

C:\Windows\System\YhLXgVv.exe

C:\Windows\System\YhLXgVv.exe

C:\Windows\System\KqRTGZl.exe

C:\Windows\System\KqRTGZl.exe

C:\Windows\System\PtFBJdB.exe

C:\Windows\System\PtFBJdB.exe

C:\Windows\System\aRnfcBX.exe

C:\Windows\System\aRnfcBX.exe

C:\Windows\System\PpHfAUi.exe

C:\Windows\System\PpHfAUi.exe

C:\Windows\System\TtqqPRd.exe

C:\Windows\System\TtqqPRd.exe

C:\Windows\System\sNMGLvH.exe

C:\Windows\System\sNMGLvH.exe

C:\Windows\System\tBvublT.exe

C:\Windows\System\tBvublT.exe

C:\Windows\System\YYkLzbZ.exe

C:\Windows\System\YYkLzbZ.exe

C:\Windows\System\oLcAuGI.exe

C:\Windows\System\oLcAuGI.exe

C:\Windows\System\cOvudAr.exe

C:\Windows\System\cOvudAr.exe

C:\Windows\System\oyhxDuj.exe

C:\Windows\System\oyhxDuj.exe

C:\Windows\System\fLtYRwU.exe

C:\Windows\System\fLtYRwU.exe

C:\Windows\System\BVEtyED.exe

C:\Windows\System\BVEtyED.exe

C:\Windows\System\vVSstEx.exe

C:\Windows\System\vVSstEx.exe

C:\Windows\System\NUjfDYI.exe

C:\Windows\System\NUjfDYI.exe

C:\Windows\System\ZofNpsA.exe

C:\Windows\System\ZofNpsA.exe

C:\Windows\System\UfJiOSI.exe

C:\Windows\System\UfJiOSI.exe

C:\Windows\System\faPbIHV.exe

C:\Windows\System\faPbIHV.exe

C:\Windows\System\WINQigp.exe

C:\Windows\System\WINQigp.exe

C:\Windows\System\mwfKJqb.exe

C:\Windows\System\mwfKJqb.exe

C:\Windows\System\KcZrAeN.exe

C:\Windows\System\KcZrAeN.exe

C:\Windows\System\OWgNiSt.exe

C:\Windows\System\OWgNiSt.exe

C:\Windows\System\XEtxzii.exe

C:\Windows\System\XEtxzii.exe

C:\Windows\System\CxfJzTw.exe

C:\Windows\System\CxfJzTw.exe

C:\Windows\System\oMmryOb.exe

C:\Windows\System\oMmryOb.exe

C:\Windows\System\hyljvgT.exe

C:\Windows\System\hyljvgT.exe

C:\Windows\System\RHIiLRM.exe

C:\Windows\System\RHIiLRM.exe

C:\Windows\System\zhSMWFS.exe

C:\Windows\System\zhSMWFS.exe

C:\Windows\System\eGZueHv.exe

C:\Windows\System\eGZueHv.exe

C:\Windows\System\DHaXlKp.exe

C:\Windows\System\DHaXlKp.exe

C:\Windows\System\aadLbZm.exe

C:\Windows\System\aadLbZm.exe

C:\Windows\System\vMWhyFQ.exe

C:\Windows\System\vMWhyFQ.exe

C:\Windows\System\COZtEsq.exe

C:\Windows\System\COZtEsq.exe

C:\Windows\System\KDUfFKh.exe

C:\Windows\System\KDUfFKh.exe

C:\Windows\System\SgohnJh.exe

C:\Windows\System\SgohnJh.exe

C:\Windows\System\nDlVlSM.exe

C:\Windows\System\nDlVlSM.exe

C:\Windows\System\fMVpzPn.exe

C:\Windows\System\fMVpzPn.exe

C:\Windows\System\zFLlXNB.exe

C:\Windows\System\zFLlXNB.exe

C:\Windows\System\mABhVFv.exe

C:\Windows\System\mABhVFv.exe

C:\Windows\System\JJTQwfF.exe

C:\Windows\System\JJTQwfF.exe

C:\Windows\System\RYWhZdo.exe

C:\Windows\System\RYWhZdo.exe

C:\Windows\System\AVJfgbJ.exe

C:\Windows\System\AVJfgbJ.exe

C:\Windows\System\DsULAvr.exe

C:\Windows\System\DsULAvr.exe

C:\Windows\System\ftlxklR.exe

C:\Windows\System\ftlxklR.exe

C:\Windows\System\HEnZdnh.exe

C:\Windows\System\HEnZdnh.exe

C:\Windows\System\RWgZoHw.exe

C:\Windows\System\RWgZoHw.exe

C:\Windows\System\ngzwaxv.exe

C:\Windows\System\ngzwaxv.exe

C:\Windows\System\KVCctly.exe

C:\Windows\System\KVCctly.exe

C:\Windows\System\gYsYTev.exe

C:\Windows\System\gYsYTev.exe

C:\Windows\System\hZrNYAQ.exe

C:\Windows\System\hZrNYAQ.exe

C:\Windows\System\PUooClA.exe

C:\Windows\System\PUooClA.exe

C:\Windows\System\TFibaiI.exe

C:\Windows\System\TFibaiI.exe

C:\Windows\System\PnuyNTY.exe

C:\Windows\System\PnuyNTY.exe

C:\Windows\System\hQWjmSF.exe

C:\Windows\System\hQWjmSF.exe

C:\Windows\System\pWcznMn.exe

C:\Windows\System\pWcznMn.exe

C:\Windows\System\XbHPBPb.exe

C:\Windows\System\XbHPBPb.exe

C:\Windows\System\VpHxZhe.exe

C:\Windows\System\VpHxZhe.exe

C:\Windows\System\oghaDKR.exe

C:\Windows\System\oghaDKR.exe

C:\Windows\System\kANHIEE.exe

C:\Windows\System\kANHIEE.exe

C:\Windows\System\LCavqJZ.exe

C:\Windows\System\LCavqJZ.exe

C:\Windows\System\IBGRtzN.exe

C:\Windows\System\IBGRtzN.exe

C:\Windows\System\LhlzKuY.exe

C:\Windows\System\LhlzKuY.exe

C:\Windows\System\zEUXuPb.exe

C:\Windows\System\zEUXuPb.exe

C:\Windows\System\hKLvrVf.exe

C:\Windows\System\hKLvrVf.exe

C:\Windows\System\iuoGOqv.exe

C:\Windows\System\iuoGOqv.exe

C:\Windows\System\VYHRvch.exe

C:\Windows\System\VYHRvch.exe

C:\Windows\System\iFMpUmn.exe

C:\Windows\System\iFMpUmn.exe

C:\Windows\System\cpPZObW.exe

C:\Windows\System\cpPZObW.exe

C:\Windows\System\vFyQeFc.exe

C:\Windows\System\vFyQeFc.exe

C:\Windows\System\HdhDfHb.exe

C:\Windows\System\HdhDfHb.exe

C:\Windows\System\RkZCrfv.exe

C:\Windows\System\RkZCrfv.exe

C:\Windows\System\kffBVVH.exe

C:\Windows\System\kffBVVH.exe

C:\Windows\System\jBsZJRG.exe

C:\Windows\System\jBsZJRG.exe

C:\Windows\System\lLUleok.exe

C:\Windows\System\lLUleok.exe

C:\Windows\System\FrKWMAd.exe

C:\Windows\System\FrKWMAd.exe

C:\Windows\System\lBjkrwp.exe

C:\Windows\System\lBjkrwp.exe

C:\Windows\System\BpnBdYM.exe

C:\Windows\System\BpnBdYM.exe

C:\Windows\System\vXrKHNj.exe

C:\Windows\System\vXrKHNj.exe

C:\Windows\System\bXsegyp.exe

C:\Windows\System\bXsegyp.exe

C:\Windows\System\lFZUGoC.exe

C:\Windows\System\lFZUGoC.exe

C:\Windows\System\FgEVzvj.exe

C:\Windows\System\FgEVzvj.exe

C:\Windows\System\aVKFvtK.exe

C:\Windows\System\aVKFvtK.exe

C:\Windows\System\ymdbCZo.exe

C:\Windows\System\ymdbCZo.exe

C:\Windows\System\CAKStna.exe

C:\Windows\System\CAKStna.exe

C:\Windows\System\CCYXzHU.exe

C:\Windows\System\CCYXzHU.exe

C:\Windows\System\hgJlXHa.exe

C:\Windows\System\hgJlXHa.exe

C:\Windows\System\hmTppRY.exe

C:\Windows\System\hmTppRY.exe

C:\Windows\System\YXrpTPq.exe

C:\Windows\System\YXrpTPq.exe

C:\Windows\System\udzQveH.exe

C:\Windows\System\udzQveH.exe

C:\Windows\System\kYglHLG.exe

C:\Windows\System\kYglHLG.exe

C:\Windows\System\IxfKLql.exe

C:\Windows\System\IxfKLql.exe

C:\Windows\System\TVKFDSd.exe

C:\Windows\System\TVKFDSd.exe

C:\Windows\System\MmVzfJV.exe

C:\Windows\System\MmVzfJV.exe

C:\Windows\System\CeogWbV.exe

C:\Windows\System\CeogWbV.exe

C:\Windows\System\BPeyBTY.exe

C:\Windows\System\BPeyBTY.exe

C:\Windows\System\KRfpYme.exe

C:\Windows\System\KRfpYme.exe

C:\Windows\System\umryRnQ.exe

C:\Windows\System\umryRnQ.exe

C:\Windows\System\wIiJVfR.exe

C:\Windows\System\wIiJVfR.exe

C:\Windows\System\HiopNER.exe

C:\Windows\System\HiopNER.exe

C:\Windows\System\IUQIDiw.exe

C:\Windows\System\IUQIDiw.exe

C:\Windows\System\KrpQlnQ.exe

C:\Windows\System\KrpQlnQ.exe

C:\Windows\System\aeafLrd.exe

C:\Windows\System\aeafLrd.exe

C:\Windows\System\YqnIgXN.exe

C:\Windows\System\YqnIgXN.exe

C:\Windows\System\eFdVwPy.exe

C:\Windows\System\eFdVwPy.exe

C:\Windows\System\qgWRzoI.exe

C:\Windows\System\qgWRzoI.exe

C:\Windows\System\LqcCpUR.exe

C:\Windows\System\LqcCpUR.exe

C:\Windows\System\PtToxJP.exe

C:\Windows\System\PtToxJP.exe

C:\Windows\System\iFUUyRH.exe

C:\Windows\System\iFUUyRH.exe

C:\Windows\System\YNOGedu.exe

C:\Windows\System\YNOGedu.exe

C:\Windows\System\DSBBVrf.exe

C:\Windows\System\DSBBVrf.exe

C:\Windows\System\pMyYkMM.exe

C:\Windows\System\pMyYkMM.exe

C:\Windows\System\xRluuJH.exe

C:\Windows\System\xRluuJH.exe

C:\Windows\System\xKSAdpx.exe

C:\Windows\System\xKSAdpx.exe

C:\Windows\System\RWyhhQp.exe

C:\Windows\System\RWyhhQp.exe

C:\Windows\System\HYHYQJG.exe

C:\Windows\System\HYHYQJG.exe

C:\Windows\System\DpHRvgW.exe

C:\Windows\System\DpHRvgW.exe

C:\Windows\System\TVqpkpl.exe

C:\Windows\System\TVqpkpl.exe

C:\Windows\System\MuBMIIx.exe

C:\Windows\System\MuBMIIx.exe

C:\Windows\System\qyjKcaK.exe

C:\Windows\System\qyjKcaK.exe

C:\Windows\System\ZiGtjtO.exe

C:\Windows\System\ZiGtjtO.exe

C:\Windows\System\FYtltwr.exe

C:\Windows\System\FYtltwr.exe

C:\Windows\System\mtWsXeu.exe

C:\Windows\System\mtWsXeu.exe

C:\Windows\System\WGerwlL.exe

C:\Windows\System\WGerwlL.exe

C:\Windows\System\odamNap.exe

C:\Windows\System\odamNap.exe

C:\Windows\System\inhRcDU.exe

C:\Windows\System\inhRcDU.exe

C:\Windows\System\cnYHhTa.exe

C:\Windows\System\cnYHhTa.exe

C:\Windows\System\ytHLhKV.exe

C:\Windows\System\ytHLhKV.exe

C:\Windows\System\nFurdvU.exe

C:\Windows\System\nFurdvU.exe

C:\Windows\System\SLsEwGV.exe

C:\Windows\System\SLsEwGV.exe

C:\Windows\System\kjIhYUp.exe

C:\Windows\System\kjIhYUp.exe

C:\Windows\System\clzjHMz.exe

C:\Windows\System\clzjHMz.exe

C:\Windows\System\EPEyBxd.exe

C:\Windows\System\EPEyBxd.exe

C:\Windows\System\dLIflOE.exe

C:\Windows\System\dLIflOE.exe

C:\Windows\System\FTOOACW.exe

C:\Windows\System\FTOOACW.exe

C:\Windows\System\isHEEsW.exe

C:\Windows\System\isHEEsW.exe

C:\Windows\System\iMFsizw.exe

C:\Windows\System\iMFsizw.exe

C:\Windows\System\mdxJyzm.exe

C:\Windows\System\mdxJyzm.exe

C:\Windows\System\HgQETdW.exe

C:\Windows\System\HgQETdW.exe

C:\Windows\System\EMKKFmo.exe

C:\Windows\System\EMKKFmo.exe

C:\Windows\System\uVmiPLk.exe

C:\Windows\System\uVmiPLk.exe

C:\Windows\System\LcQBMEZ.exe

C:\Windows\System\LcQBMEZ.exe

C:\Windows\System\gGYJrlg.exe

C:\Windows\System\gGYJrlg.exe

C:\Windows\System\QwFfGHl.exe

C:\Windows\System\QwFfGHl.exe

C:\Windows\System\WNNTbRR.exe

C:\Windows\System\WNNTbRR.exe

C:\Windows\System\SikTKzp.exe

C:\Windows\System\SikTKzp.exe

C:\Windows\System\icYTeLT.exe

C:\Windows\System\icYTeLT.exe

C:\Windows\System\HzLJJcf.exe

C:\Windows\System\HzLJJcf.exe

C:\Windows\System\aZNIgTM.exe

C:\Windows\System\aZNIgTM.exe

C:\Windows\System\dsaOTdk.exe

C:\Windows\System\dsaOTdk.exe

C:\Windows\System\UCKfyGm.exe

C:\Windows\System\UCKfyGm.exe

C:\Windows\System\XgPDYDh.exe

C:\Windows\System\XgPDYDh.exe

C:\Windows\System\HAhengG.exe

C:\Windows\System\HAhengG.exe

C:\Windows\System\rDZofAB.exe

C:\Windows\System\rDZofAB.exe

C:\Windows\System\UBabXQe.exe

C:\Windows\System\UBabXQe.exe

C:\Windows\System\xTNiiXm.exe

C:\Windows\System\xTNiiXm.exe

C:\Windows\System\iLKvFSS.exe

C:\Windows\System\iLKvFSS.exe

C:\Windows\System\TozlbXU.exe

C:\Windows\System\TozlbXU.exe

C:\Windows\System\APmMYsM.exe

C:\Windows\System\APmMYsM.exe

C:\Windows\System\nYnzlIN.exe

C:\Windows\System\nYnzlIN.exe

C:\Windows\System\sULlBAp.exe

C:\Windows\System\sULlBAp.exe

C:\Windows\System\WYdVbtl.exe

C:\Windows\System\WYdVbtl.exe

C:\Windows\System\kdujkSm.exe

C:\Windows\System\kdujkSm.exe

C:\Windows\System\xrKqGpB.exe

C:\Windows\System\xrKqGpB.exe

C:\Windows\System\ouTKHmm.exe

C:\Windows\System\ouTKHmm.exe

C:\Windows\System\TxFSotr.exe

C:\Windows\System\TxFSotr.exe

C:\Windows\System\zQGHOEk.exe

C:\Windows\System\zQGHOEk.exe

C:\Windows\System\eNlRYXt.exe

C:\Windows\System\eNlRYXt.exe

C:\Windows\System\JAiaswd.exe

C:\Windows\System\JAiaswd.exe

C:\Windows\System\bKDYKFa.exe

C:\Windows\System\bKDYKFa.exe

C:\Windows\System\ByptuBp.exe

C:\Windows\System\ByptuBp.exe

C:\Windows\System\ItkYxUM.exe

C:\Windows\System\ItkYxUM.exe

C:\Windows\System\BjbhdMs.exe

C:\Windows\System\BjbhdMs.exe

C:\Windows\System\iOuoXcN.exe

C:\Windows\System\iOuoXcN.exe

C:\Windows\System\NrnUPDu.exe

C:\Windows\System\NrnUPDu.exe

C:\Windows\System\qxVbfqw.exe

C:\Windows\System\qxVbfqw.exe

C:\Windows\System\NZKxDjc.exe

C:\Windows\System\NZKxDjc.exe

C:\Windows\System\hZUOxbj.exe

C:\Windows\System\hZUOxbj.exe

C:\Windows\System\yyblqxL.exe

C:\Windows\System\yyblqxL.exe

C:\Windows\System\VjcRtyK.exe

C:\Windows\System\VjcRtyK.exe

C:\Windows\System\mrMkTKD.exe

C:\Windows\System\mrMkTKD.exe

C:\Windows\System\cmdhXHs.exe

C:\Windows\System\cmdhXHs.exe

C:\Windows\System\jlJXHNw.exe

C:\Windows\System\jlJXHNw.exe

C:\Windows\System\WLrEOYU.exe

C:\Windows\System\WLrEOYU.exe

C:\Windows\System\OJgwUsN.exe

C:\Windows\System\OJgwUsN.exe

C:\Windows\System\nQPIHGi.exe

C:\Windows\System\nQPIHGi.exe

C:\Windows\System\GWtqHrh.exe

C:\Windows\System\GWtqHrh.exe

C:\Windows\System\eTFWngK.exe

C:\Windows\System\eTFWngK.exe

C:\Windows\System\lKrvnpM.exe

C:\Windows\System\lKrvnpM.exe

C:\Windows\System\CbvtmEH.exe

C:\Windows\System\CbvtmEH.exe

C:\Windows\System\EbLyqLC.exe

C:\Windows\System\EbLyqLC.exe

C:\Windows\System\osedWsJ.exe

C:\Windows\System\osedWsJ.exe

C:\Windows\System\EozLmWt.exe

C:\Windows\System\EozLmWt.exe

C:\Windows\System\KdQQzaJ.exe

C:\Windows\System\KdQQzaJ.exe

C:\Windows\System\gloegeS.exe

C:\Windows\System\gloegeS.exe

C:\Windows\System\jgpSmDP.exe

C:\Windows\System\jgpSmDP.exe

C:\Windows\System\UeNRlav.exe

C:\Windows\System\UeNRlav.exe

C:\Windows\System\wtImXcM.exe

C:\Windows\System\wtImXcM.exe

C:\Windows\System\GNVTLVI.exe

C:\Windows\System\GNVTLVI.exe

C:\Windows\System\ZdSobEc.exe

C:\Windows\System\ZdSobEc.exe

C:\Windows\System\eIRKMPv.exe

C:\Windows\System\eIRKMPv.exe

C:\Windows\System\pZOqwgp.exe

C:\Windows\System\pZOqwgp.exe

C:\Windows\System\bDbfzgk.exe

C:\Windows\System\bDbfzgk.exe

C:\Windows\System\sQpzFas.exe

C:\Windows\System\sQpzFas.exe

C:\Windows\System\bFKWFei.exe

C:\Windows\System\bFKWFei.exe

C:\Windows\System\SyUNedk.exe

C:\Windows\System\SyUNedk.exe

C:\Windows\System\opimdkI.exe

C:\Windows\System\opimdkI.exe

C:\Windows\System\dpKjivI.exe

C:\Windows\System\dpKjivI.exe

C:\Windows\System\BpYqofE.exe

C:\Windows\System\BpYqofE.exe

C:\Windows\System\CyleuPu.exe

C:\Windows\System\CyleuPu.exe

C:\Windows\System\YdgeVLq.exe

C:\Windows\System\YdgeVLq.exe

C:\Windows\System\hoHkknj.exe

C:\Windows\System\hoHkknj.exe

C:\Windows\System\RLMBQCg.exe

C:\Windows\System\RLMBQCg.exe

C:\Windows\System\lJGqOQp.exe

C:\Windows\System\lJGqOQp.exe

C:\Windows\System\PutkOQQ.exe

C:\Windows\System\PutkOQQ.exe

C:\Windows\System\NrvkxAs.exe

C:\Windows\System\NrvkxAs.exe

C:\Windows\System\cASbaiJ.exe

C:\Windows\System\cASbaiJ.exe

C:\Windows\System\rNTafaa.exe

C:\Windows\System\rNTafaa.exe

C:\Windows\System\fJfxGWT.exe

C:\Windows\System\fJfxGWT.exe

C:\Windows\System\snZFdGT.exe

C:\Windows\System\snZFdGT.exe

C:\Windows\System\pqjfJNq.exe

C:\Windows\System\pqjfJNq.exe

C:\Windows\System\cSwfYvE.exe

C:\Windows\System\cSwfYvE.exe

C:\Windows\System\mhhGYUu.exe

C:\Windows\System\mhhGYUu.exe

C:\Windows\System\tHFWXzw.exe

C:\Windows\System\tHFWXzw.exe

C:\Windows\System\LKlhbLY.exe

C:\Windows\System\LKlhbLY.exe

C:\Windows\System\JDDhPqp.exe

C:\Windows\System\JDDhPqp.exe

C:\Windows\System\JApxKSL.exe

C:\Windows\System\JApxKSL.exe

C:\Windows\System\VPwGffe.exe

C:\Windows\System\VPwGffe.exe

C:\Windows\System\stjiMxf.exe

C:\Windows\System\stjiMxf.exe

C:\Windows\System\dHDFOnp.exe

C:\Windows\System\dHDFOnp.exe

C:\Windows\System\dfqhxBB.exe

C:\Windows\System\dfqhxBB.exe

C:\Windows\System\sotEJno.exe

C:\Windows\System\sotEJno.exe

C:\Windows\System\xieynCL.exe

C:\Windows\System\xieynCL.exe

C:\Windows\System\IpAMQqm.exe

C:\Windows\System\IpAMQqm.exe

C:\Windows\System\bxicKcR.exe

C:\Windows\System\bxicKcR.exe

C:\Windows\System\XxkBRgG.exe

C:\Windows\System\XxkBRgG.exe

C:\Windows\System\EzbUNuk.exe

C:\Windows\System\EzbUNuk.exe

C:\Windows\System\PRebnsT.exe

C:\Windows\System\PRebnsT.exe

C:\Windows\System\fZpULKb.exe

C:\Windows\System\fZpULKb.exe

C:\Windows\System\eDhTUsS.exe

C:\Windows\System\eDhTUsS.exe

C:\Windows\System\qpmUTRR.exe

C:\Windows\System\qpmUTRR.exe

C:\Windows\System\FtiLKTb.exe

C:\Windows\System\FtiLKTb.exe

C:\Windows\System\hSzFjsW.exe

C:\Windows\System\hSzFjsW.exe

C:\Windows\System\QVAFqcu.exe

C:\Windows\System\QVAFqcu.exe

C:\Windows\System\dBOmgSb.exe

C:\Windows\System\dBOmgSb.exe

C:\Windows\System\PjTtODL.exe

C:\Windows\System\PjTtODL.exe

C:\Windows\System\VpuRsde.exe

C:\Windows\System\VpuRsde.exe

C:\Windows\System\NxfXOUd.exe

C:\Windows\System\NxfXOUd.exe

C:\Windows\System\IWUDlhF.exe

C:\Windows\System\IWUDlhF.exe

C:\Windows\System\aOpBbIA.exe

C:\Windows\System\aOpBbIA.exe

C:\Windows\System\nOLciZU.exe

C:\Windows\System\nOLciZU.exe

C:\Windows\System\foiaSHm.exe

C:\Windows\System\foiaSHm.exe

C:\Windows\System\yfcriMl.exe

C:\Windows\System\yfcriMl.exe

C:\Windows\System\UmjJcKn.exe

C:\Windows\System\UmjJcKn.exe

C:\Windows\System\brGvtrU.exe

C:\Windows\System\brGvtrU.exe

C:\Windows\System\ezGhsRI.exe

C:\Windows\System\ezGhsRI.exe

C:\Windows\System\hCDjHmn.exe

C:\Windows\System\hCDjHmn.exe

C:\Windows\System\xAtqnoo.exe

C:\Windows\System\xAtqnoo.exe

C:\Windows\System\GCWuhIs.exe

C:\Windows\System\GCWuhIs.exe

C:\Windows\System\oamIlrV.exe

C:\Windows\System\oamIlrV.exe

C:\Windows\System\IFfOkKv.exe

C:\Windows\System\IFfOkKv.exe

C:\Windows\System\xGXpBjK.exe

C:\Windows\System\xGXpBjK.exe

C:\Windows\System\QdrKUHg.exe

C:\Windows\System\QdrKUHg.exe

C:\Windows\System\VLZSTEI.exe

C:\Windows\System\VLZSTEI.exe

C:\Windows\System\rwkxZUy.exe

C:\Windows\System\rwkxZUy.exe

C:\Windows\System\TjfxssT.exe

C:\Windows\System\TjfxssT.exe

C:\Windows\System\ZetuzrE.exe

C:\Windows\System\ZetuzrE.exe

C:\Windows\System\qTqoNDY.exe

C:\Windows\System\qTqoNDY.exe

C:\Windows\System\IfbYgnL.exe

C:\Windows\System\IfbYgnL.exe

C:\Windows\System\LnbhUgL.exe

C:\Windows\System\LnbhUgL.exe

C:\Windows\System\XSBSETW.exe

C:\Windows\System\XSBSETW.exe

C:\Windows\System\uEVgQiF.exe

C:\Windows\System\uEVgQiF.exe

C:\Windows\System\RAZtwaM.exe

C:\Windows\System\RAZtwaM.exe

C:\Windows\System\KCGUotN.exe

C:\Windows\System\KCGUotN.exe

C:\Windows\System\MWDAjEY.exe

C:\Windows\System\MWDAjEY.exe

C:\Windows\System\asPezAL.exe

C:\Windows\System\asPezAL.exe

C:\Windows\System\ICJrWUL.exe

C:\Windows\System\ICJrWUL.exe

C:\Windows\System\OpFetRq.exe

C:\Windows\System\OpFetRq.exe

C:\Windows\System\pPUWwep.exe

C:\Windows\System\pPUWwep.exe

C:\Windows\System\uwfWUoe.exe

C:\Windows\System\uwfWUoe.exe

C:\Windows\System\HftwJhS.exe

C:\Windows\System\HftwJhS.exe

C:\Windows\System\jJuKaLB.exe

C:\Windows\System\jJuKaLB.exe

C:\Windows\System\XtOXxEM.exe

C:\Windows\System\XtOXxEM.exe

C:\Windows\System\gvsVAuy.exe

C:\Windows\System\gvsVAuy.exe

C:\Windows\System\ciVSHTI.exe

C:\Windows\System\ciVSHTI.exe

C:\Windows\System\ufDKoMU.exe

C:\Windows\System\ufDKoMU.exe

C:\Windows\System\HppSdbm.exe

C:\Windows\System\HppSdbm.exe

C:\Windows\System\aPDnKSG.exe

C:\Windows\System\aPDnKSG.exe

C:\Windows\System\kYixcYM.exe

C:\Windows\System\kYixcYM.exe

C:\Windows\System\UmmMYmn.exe

C:\Windows\System\UmmMYmn.exe

C:\Windows\System\ArXsonJ.exe

C:\Windows\System\ArXsonJ.exe

C:\Windows\System\LHwLsmk.exe

C:\Windows\System\LHwLsmk.exe

C:\Windows\System\sqHQUnL.exe

C:\Windows\System\sqHQUnL.exe

C:\Windows\System\BQrUTbR.exe

C:\Windows\System\BQrUTbR.exe

C:\Windows\System\OTAZbgo.exe

C:\Windows\System\OTAZbgo.exe

C:\Windows\System\dtAlcee.exe

C:\Windows\System\dtAlcee.exe

C:\Windows\System\rLQjthD.exe

C:\Windows\System\rLQjthD.exe

C:\Windows\System\gSWiGiN.exe

C:\Windows\System\gSWiGiN.exe

C:\Windows\System\krEzqMf.exe

C:\Windows\System\krEzqMf.exe

C:\Windows\System\AzuCJSl.exe

C:\Windows\System\AzuCJSl.exe

C:\Windows\System\uTMVXTq.exe

C:\Windows\System\uTMVXTq.exe

C:\Windows\System\RIYdfVT.exe

C:\Windows\System\RIYdfVT.exe

C:\Windows\System\oNMPxkL.exe

C:\Windows\System\oNMPxkL.exe

C:\Windows\System\nvOGfEG.exe

C:\Windows\System\nvOGfEG.exe

C:\Windows\System\pnlQPpo.exe

C:\Windows\System\pnlQPpo.exe

C:\Windows\System\NmSRlTK.exe

C:\Windows\System\NmSRlTK.exe

C:\Windows\System\JQZurrV.exe

C:\Windows\System\JQZurrV.exe

C:\Windows\System\NPLOGTz.exe

C:\Windows\System\NPLOGTz.exe

C:\Windows\System\oFtNiqF.exe

C:\Windows\System\oFtNiqF.exe

C:\Windows\System\DCbxtkf.exe

C:\Windows\System\DCbxtkf.exe

C:\Windows\System\vnnQvgu.exe

C:\Windows\System\vnnQvgu.exe

C:\Windows\System\YokdIwU.exe

C:\Windows\System\YokdIwU.exe

C:\Windows\System\zTPyayO.exe

C:\Windows\System\zTPyayO.exe

C:\Windows\System\ookIQBZ.exe

C:\Windows\System\ookIQBZ.exe

C:\Windows\System\mFjiYYb.exe

C:\Windows\System\mFjiYYb.exe

C:\Windows\System\CzSutEL.exe

C:\Windows\System\CzSutEL.exe

C:\Windows\System\yKqNWyF.exe

C:\Windows\System\yKqNWyF.exe

C:\Windows\System\XJWFihb.exe

C:\Windows\System\XJWFihb.exe

C:\Windows\System\mhiqxCK.exe

C:\Windows\System\mhiqxCK.exe

C:\Windows\System\TAnPBSN.exe

C:\Windows\System\TAnPBSN.exe

C:\Windows\System\JrpTYbd.exe

C:\Windows\System\JrpTYbd.exe

C:\Windows\System\sRvSZmh.exe

C:\Windows\System\sRvSZmh.exe

C:\Windows\System\aaXrNca.exe

C:\Windows\System\aaXrNca.exe

C:\Windows\System\CXVzHtj.exe

C:\Windows\System\CXVzHtj.exe

C:\Windows\System\oSapAmK.exe

C:\Windows\System\oSapAmK.exe

C:\Windows\System\AHdcqnf.exe

C:\Windows\System\AHdcqnf.exe

C:\Windows\System\dZbHqgj.exe

C:\Windows\System\dZbHqgj.exe

C:\Windows\System\ozKKNKf.exe

C:\Windows\System\ozKKNKf.exe

C:\Windows\System\Ojxghqu.exe

C:\Windows\System\Ojxghqu.exe

C:\Windows\System\NqKLags.exe

C:\Windows\System\NqKLags.exe

C:\Windows\System\kstKHMv.exe

C:\Windows\System\kstKHMv.exe

C:\Windows\System\VhGJBdJ.exe

C:\Windows\System\VhGJBdJ.exe

C:\Windows\System\EKoABUb.exe

C:\Windows\System\EKoABUb.exe

C:\Windows\System\CMhNuby.exe

C:\Windows\System\CMhNuby.exe

C:\Windows\System\qEErAsr.exe

C:\Windows\System\qEErAsr.exe

C:\Windows\System\eUIkcMR.exe

C:\Windows\System\eUIkcMR.exe

C:\Windows\System\ryGcsyx.exe

C:\Windows\System\ryGcsyx.exe

C:\Windows\System\iADroHL.exe

C:\Windows\System\iADroHL.exe

C:\Windows\System\RGBrRuU.exe

C:\Windows\System\RGBrRuU.exe

C:\Windows\System\DjNdRCY.exe

C:\Windows\System\DjNdRCY.exe

C:\Windows\System\OiWshRl.exe

C:\Windows\System\OiWshRl.exe

C:\Windows\System\BoGefKY.exe

C:\Windows\System\BoGefKY.exe

C:\Windows\System\TlLDsSx.exe

C:\Windows\System\TlLDsSx.exe

C:\Windows\System\PCFrUHu.exe

C:\Windows\System\PCFrUHu.exe

C:\Windows\System\AuIhnVe.exe

C:\Windows\System\AuIhnVe.exe

C:\Windows\System\bSxsyfz.exe

C:\Windows\System\bSxsyfz.exe

C:\Windows\System\IbXhogS.exe

C:\Windows\System\IbXhogS.exe

C:\Windows\System\eOddjUx.exe

C:\Windows\System\eOddjUx.exe

C:\Windows\System\mvXvatG.exe

C:\Windows\System\mvXvatG.exe

C:\Windows\System\WvtsXKJ.exe

C:\Windows\System\WvtsXKJ.exe

C:\Windows\System\ctOkYGM.exe

C:\Windows\System\ctOkYGM.exe

C:\Windows\System\jwSKjAb.exe

C:\Windows\System\jwSKjAb.exe

C:\Windows\System\GIydVex.exe

C:\Windows\System\GIydVex.exe

C:\Windows\System\LzWSPxz.exe

C:\Windows\System\LzWSPxz.exe

C:\Windows\System\lcTqSGA.exe

C:\Windows\System\lcTqSGA.exe

C:\Windows\System\iWmAwGu.exe

C:\Windows\System\iWmAwGu.exe

C:\Windows\System\wzQlYMF.exe

C:\Windows\System\wzQlYMF.exe

C:\Windows\System\PjaDBAt.exe

C:\Windows\System\PjaDBAt.exe

C:\Windows\System\LAxnCie.exe

C:\Windows\System\LAxnCie.exe

C:\Windows\System\CvFwZQi.exe

C:\Windows\System\CvFwZQi.exe

C:\Windows\System\nXVsoWT.exe

C:\Windows\System\nXVsoWT.exe

C:\Windows\System\kHRznNf.exe

C:\Windows\System\kHRznNf.exe

C:\Windows\System\iYSeBOt.exe

C:\Windows\System\iYSeBOt.exe

C:\Windows\System\WBXrYUI.exe

C:\Windows\System\WBXrYUI.exe

C:\Windows\System\hUiMTzL.exe

C:\Windows\System\hUiMTzL.exe

C:\Windows\System\UidjKLa.exe

C:\Windows\System\UidjKLa.exe

C:\Windows\System\RhoThld.exe

C:\Windows\System\RhoThld.exe

C:\Windows\System\XDHqLIa.exe

C:\Windows\System\XDHqLIa.exe

C:\Windows\System\iQHnOCn.exe

C:\Windows\System\iQHnOCn.exe

C:\Windows\System\VACGGqv.exe

C:\Windows\System\VACGGqv.exe

C:\Windows\System\LdSeyYt.exe

C:\Windows\System\LdSeyYt.exe

C:\Windows\System\IXAveAs.exe

C:\Windows\System\IXAveAs.exe

C:\Windows\System\WtETDVu.exe

C:\Windows\System\WtETDVu.exe

C:\Windows\System\VZuxvKX.exe

C:\Windows\System\VZuxvKX.exe

C:\Windows\System\xJRSzqx.exe

C:\Windows\System\xJRSzqx.exe

C:\Windows\System\jxmsDHi.exe

C:\Windows\System\jxmsDHi.exe

C:\Windows\System\oTchuNX.exe

C:\Windows\System\oTchuNX.exe

C:\Windows\System\VgQRjIY.exe

C:\Windows\System\VgQRjIY.exe

C:\Windows\System\ezKFrpX.exe

C:\Windows\System\ezKFrpX.exe

C:\Windows\System\TylmbuI.exe

C:\Windows\System\TylmbuI.exe

C:\Windows\System\yBpUEzv.exe

C:\Windows\System\yBpUEzv.exe

C:\Windows\System\wTTmDmA.exe

C:\Windows\System\wTTmDmA.exe

C:\Windows\System\pYTTLzO.exe

C:\Windows\System\pYTTLzO.exe

C:\Windows\System\IJdfSBh.exe

C:\Windows\System\IJdfSBh.exe

C:\Windows\System\qzaHdFo.exe

C:\Windows\System\qzaHdFo.exe

C:\Windows\System\WytYVnd.exe

C:\Windows\System\WytYVnd.exe

C:\Windows\System\TajnUdV.exe

C:\Windows\System\TajnUdV.exe

C:\Windows\System\KvfqFUx.exe

C:\Windows\System\KvfqFUx.exe

C:\Windows\System\rASrdps.exe

C:\Windows\System\rASrdps.exe

C:\Windows\System\hyunjUm.exe

C:\Windows\System\hyunjUm.exe

C:\Windows\System\xPPiakF.exe

C:\Windows\System\xPPiakF.exe

C:\Windows\System\qrSYFIo.exe

C:\Windows\System\qrSYFIo.exe

C:\Windows\System\LwWfdZa.exe

C:\Windows\System\LwWfdZa.exe

C:\Windows\System\XNVHViT.exe

C:\Windows\System\XNVHViT.exe

C:\Windows\System\ZhDtqin.exe

C:\Windows\System\ZhDtqin.exe

C:\Windows\System\WDcywcS.exe

C:\Windows\System\WDcywcS.exe

C:\Windows\System\QCSKYwB.exe

C:\Windows\System\QCSKYwB.exe

C:\Windows\System\TXJuXkz.exe

C:\Windows\System\TXJuXkz.exe

C:\Windows\System\hQAPrxL.exe

C:\Windows\System\hQAPrxL.exe

C:\Windows\System\GZbKFZU.exe

C:\Windows\System\GZbKFZU.exe

C:\Windows\System\GaAALIm.exe

C:\Windows\System\GaAALIm.exe

C:\Windows\System\JKRZJzc.exe

C:\Windows\System\JKRZJzc.exe

C:\Windows\System\wRdhiRE.exe

C:\Windows\System\wRdhiRE.exe

C:\Windows\System\TNpwzRS.exe

C:\Windows\System\TNpwzRS.exe

C:\Windows\System\EnvLCSV.exe

C:\Windows\System\EnvLCSV.exe

C:\Windows\System\SWCallj.exe

C:\Windows\System\SWCallj.exe

C:\Windows\System\YMAxVeP.exe

C:\Windows\System\YMAxVeP.exe

C:\Windows\System\sZfWGSO.exe

C:\Windows\System\sZfWGSO.exe

C:\Windows\System\SzAilCY.exe

C:\Windows\System\SzAilCY.exe

C:\Windows\System\vAdcQjo.exe

C:\Windows\System\vAdcQjo.exe

C:\Windows\System\wdUoStA.exe

C:\Windows\System\wdUoStA.exe

C:\Windows\System\RMuBRew.exe

C:\Windows\System\RMuBRew.exe

C:\Windows\System\fBKOflh.exe

C:\Windows\System\fBKOflh.exe

C:\Windows\System\EryqSJy.exe

C:\Windows\System\EryqSJy.exe

C:\Windows\System\djLQZXa.exe

C:\Windows\System\djLQZXa.exe

C:\Windows\System\MrOjWtW.exe

C:\Windows\System\MrOjWtW.exe

C:\Windows\System\qkxmZgH.exe

C:\Windows\System\qkxmZgH.exe

C:\Windows\System\pdmBkQa.exe

C:\Windows\System\pdmBkQa.exe

C:\Windows\System\XNShXZn.exe

C:\Windows\System\XNShXZn.exe

C:\Windows\System\HHvtkvl.exe

C:\Windows\System\HHvtkvl.exe

C:\Windows\System\PGKPzcu.exe

C:\Windows\System\PGKPzcu.exe

C:\Windows\System\CuIiFyy.exe

C:\Windows\System\CuIiFyy.exe

C:\Windows\System\ruEnewT.exe

C:\Windows\System\ruEnewT.exe

C:\Windows\System\eOiqgih.exe

C:\Windows\System\eOiqgih.exe

C:\Windows\System\FuwBODc.exe

C:\Windows\System\FuwBODc.exe

C:\Windows\System\vpgmRbv.exe

C:\Windows\System\vpgmRbv.exe

C:\Windows\System\RdGCYcP.exe

C:\Windows\System\RdGCYcP.exe

C:\Windows\System\OWvgPsD.exe

C:\Windows\System\OWvgPsD.exe

C:\Windows\System\yzUaoSq.exe

C:\Windows\System\yzUaoSq.exe

C:\Windows\System\FToidur.exe

C:\Windows\System\FToidur.exe

C:\Windows\System\qLIiuRq.exe

C:\Windows\System\qLIiuRq.exe

C:\Windows\System\PxlRpXQ.exe

C:\Windows\System\PxlRpXQ.exe

C:\Windows\System\YdjauUe.exe

C:\Windows\System\YdjauUe.exe

C:\Windows\System\MvSxMdz.exe

C:\Windows\System\MvSxMdz.exe

C:\Windows\System\PSevNaZ.exe

C:\Windows\System\PSevNaZ.exe

C:\Windows\System\UPgUuhO.exe

C:\Windows\System\UPgUuhO.exe

C:\Windows\System\UnYncjF.exe

C:\Windows\System\UnYncjF.exe

C:\Windows\System\VqLRlNI.exe

C:\Windows\System\VqLRlNI.exe

C:\Windows\System\SZMKOHm.exe

C:\Windows\System\SZMKOHm.exe

C:\Windows\System\lyoaQdu.exe

C:\Windows\System\lyoaQdu.exe

C:\Windows\System\PuEEapN.exe

C:\Windows\System\PuEEapN.exe

C:\Windows\System\jwUxkXi.exe

C:\Windows\System\jwUxkXi.exe

C:\Windows\System\oNsDtyU.exe

C:\Windows\System\oNsDtyU.exe

C:\Windows\System\hzjjhxq.exe

C:\Windows\System\hzjjhxq.exe

C:\Windows\System\CSwOIPg.exe

C:\Windows\System\CSwOIPg.exe

C:\Windows\System\jYnOEDe.exe

C:\Windows\System\jYnOEDe.exe

C:\Windows\System\UIkLKsU.exe

C:\Windows\System\UIkLKsU.exe

C:\Windows\System\YgLChcL.exe

C:\Windows\System\YgLChcL.exe

C:\Windows\System\BOaIdsk.exe

C:\Windows\System\BOaIdsk.exe

C:\Windows\System\AlvwrnY.exe

C:\Windows\System\AlvwrnY.exe

C:\Windows\System\eoVsTvx.exe

C:\Windows\System\eoVsTvx.exe

C:\Windows\System\IeYVLfY.exe

C:\Windows\System\IeYVLfY.exe

C:\Windows\System\SbWaluE.exe

C:\Windows\System\SbWaluE.exe

C:\Windows\System\zIlmErt.exe

C:\Windows\System\zIlmErt.exe

C:\Windows\System\xywnXLd.exe

C:\Windows\System\xywnXLd.exe

C:\Windows\System\hlIBaxk.exe

C:\Windows\System\hlIBaxk.exe

C:\Windows\System\VlgHFpT.exe

C:\Windows\System\VlgHFpT.exe

C:\Windows\System\oWUtiYw.exe

C:\Windows\System\oWUtiYw.exe

C:\Windows\System\DFtpRtk.exe

C:\Windows\System\DFtpRtk.exe

C:\Windows\System\tXZTXEM.exe

C:\Windows\System\tXZTXEM.exe

C:\Windows\System\DXgjAri.exe

C:\Windows\System\DXgjAri.exe

C:\Windows\System\AezGEGg.exe

C:\Windows\System\AezGEGg.exe

C:\Windows\System\LEARrlR.exe

C:\Windows\System\LEARrlR.exe

C:\Windows\System\pDbyfBJ.exe

C:\Windows\System\pDbyfBJ.exe

C:\Windows\System\PvmLaWU.exe

C:\Windows\System\PvmLaWU.exe

C:\Windows\System\MOAdkbX.exe

C:\Windows\System\MOAdkbX.exe

C:\Windows\System\wQgUHFF.exe

C:\Windows\System\wQgUHFF.exe

C:\Windows\System\QiEPMdo.exe

C:\Windows\System\QiEPMdo.exe

C:\Windows\System\aeRQNtg.exe

C:\Windows\System\aeRQNtg.exe

C:\Windows\System\prZnXke.exe

C:\Windows\System\prZnXke.exe

C:\Windows\System\GUtGMhs.exe

C:\Windows\System\GUtGMhs.exe

C:\Windows\System\gthbmLf.exe

C:\Windows\System\gthbmLf.exe

C:\Windows\System\tkAbrNW.exe

C:\Windows\System\tkAbrNW.exe

C:\Windows\System\usOfblD.exe

C:\Windows\System\usOfblD.exe

C:\Windows\System\pKbLULj.exe

C:\Windows\System\pKbLULj.exe

C:\Windows\System\WuseaVw.exe

C:\Windows\System\WuseaVw.exe

C:\Windows\System\pkSuupU.exe

C:\Windows\System\pkSuupU.exe

C:\Windows\System\nNtZVhk.exe

C:\Windows\System\nNtZVhk.exe

C:\Windows\System\RFMXHQi.exe

C:\Windows\System\RFMXHQi.exe

C:\Windows\System\dmKTqxM.exe

C:\Windows\System\dmKTqxM.exe

C:\Windows\System\TDWKtQV.exe

C:\Windows\System\TDWKtQV.exe

C:\Windows\System\DgHOSpg.exe

C:\Windows\System\DgHOSpg.exe

C:\Windows\System\fNYUkCb.exe

C:\Windows\System\fNYUkCb.exe

C:\Windows\System\iAziLhc.exe

C:\Windows\System\iAziLhc.exe

C:\Windows\System\dZoXnXC.exe

C:\Windows\System\dZoXnXC.exe

C:\Windows\System\nIoeSxz.exe

C:\Windows\System\nIoeSxz.exe

C:\Windows\System\LCLKxoP.exe

C:\Windows\System\LCLKxoP.exe

C:\Windows\System\KjIFkKm.exe

C:\Windows\System\KjIFkKm.exe

C:\Windows\System\sZuXzyx.exe

C:\Windows\System\sZuXzyx.exe

C:\Windows\System\qZUzJwi.exe

C:\Windows\System\qZUzJwi.exe

C:\Windows\System\HAgRHrL.exe

C:\Windows\System\HAgRHrL.exe

C:\Windows\System\zGiqahY.exe

C:\Windows\System\zGiqahY.exe

C:\Windows\System\kSKdLpc.exe

C:\Windows\System\kSKdLpc.exe

C:\Windows\System\svmEcHU.exe

C:\Windows\System\svmEcHU.exe

C:\Windows\System\OOxTtod.exe

C:\Windows\System\OOxTtod.exe

C:\Windows\System\GnjScpE.exe

C:\Windows\System\GnjScpE.exe

C:\Windows\System\IEdiQbq.exe

C:\Windows\System\IEdiQbq.exe

C:\Windows\System\iMzpfmd.exe

C:\Windows\System\iMzpfmd.exe

C:\Windows\System\smAQMEi.exe

C:\Windows\System\smAQMEi.exe

C:\Windows\System\OBelZYB.exe

C:\Windows\System\OBelZYB.exe

C:\Windows\System\ZOctIAf.exe

C:\Windows\System\ZOctIAf.exe

C:\Windows\System\CTXeeSx.exe

C:\Windows\System\CTXeeSx.exe

C:\Windows\System\fCbAlMv.exe

C:\Windows\System\fCbAlMv.exe

C:\Windows\System\ntPeCCB.exe

C:\Windows\System\ntPeCCB.exe

C:\Windows\System\QRDrFyY.exe

C:\Windows\System\QRDrFyY.exe

C:\Windows\System\ACRmGRD.exe

C:\Windows\System\ACRmGRD.exe

C:\Windows\System\slEGiNV.exe

C:\Windows\System\slEGiNV.exe

C:\Windows\System\BgHvOBU.exe

C:\Windows\System\BgHvOBU.exe

C:\Windows\System\ZUYOFmk.exe

C:\Windows\System\ZUYOFmk.exe

C:\Windows\System\zzezRis.exe

C:\Windows\System\zzezRis.exe

C:\Windows\System\mtKIndG.exe

C:\Windows\System\mtKIndG.exe

C:\Windows\System\JEZWCqd.exe

C:\Windows\System\JEZWCqd.exe

C:\Windows\System\dxswEoc.exe

C:\Windows\System\dxswEoc.exe

C:\Windows\System\WczzWaB.exe

C:\Windows\System\WczzWaB.exe

C:\Windows\System\DBSVGqB.exe

C:\Windows\System\DBSVGqB.exe

C:\Windows\System\QtnckUg.exe

C:\Windows\System\QtnckUg.exe

C:\Windows\System\kYufpXv.exe

C:\Windows\System\kYufpXv.exe

C:\Windows\System\aivNguB.exe

C:\Windows\System\aivNguB.exe

C:\Windows\System\RapzSxc.exe

C:\Windows\System\RapzSxc.exe

C:\Windows\System\PUavFBr.exe

C:\Windows\System\PUavFBr.exe

C:\Windows\System\ZFaWJSN.exe

C:\Windows\System\ZFaWJSN.exe

C:\Windows\System\JdIhtgR.exe

C:\Windows\System\JdIhtgR.exe

C:\Windows\System\foZMvIy.exe

C:\Windows\System\foZMvIy.exe

C:\Windows\System\hjpEhRv.exe

C:\Windows\System\hjpEhRv.exe

C:\Windows\System\HNDdGVh.exe

C:\Windows\System\HNDdGVh.exe

C:\Windows\System\gcBXNBp.exe

C:\Windows\System\gcBXNBp.exe

C:\Windows\System\lpyxQTC.exe

C:\Windows\System\lpyxQTC.exe

C:\Windows\System\gaUMUhx.exe

C:\Windows\System\gaUMUhx.exe

C:\Windows\System\maCnRSK.exe

C:\Windows\System\maCnRSK.exe

C:\Windows\System\bPgPNSh.exe

C:\Windows\System\bPgPNSh.exe

C:\Windows\System\KJFvoHG.exe

C:\Windows\System\KJFvoHG.exe

C:\Windows\System\vSmulqT.exe

C:\Windows\System\vSmulqT.exe

C:\Windows\System\jhcHFUN.exe

C:\Windows\System\jhcHFUN.exe

C:\Windows\System\RrergFu.exe

C:\Windows\System\RrergFu.exe

C:\Windows\System\emedVnP.exe

C:\Windows\System\emedVnP.exe

C:\Windows\System\keIeLgw.exe

C:\Windows\System\keIeLgw.exe

C:\Windows\System\ukuMAYZ.exe

C:\Windows\System\ukuMAYZ.exe

C:\Windows\System\QorfAXR.exe

C:\Windows\System\QorfAXR.exe

C:\Windows\System\XuwxBHL.exe

C:\Windows\System\XuwxBHL.exe

C:\Windows\System\paWWkqF.exe

C:\Windows\System\paWWkqF.exe

C:\Windows\System\ONKSWox.exe

C:\Windows\System\ONKSWox.exe

C:\Windows\System\ADToDqb.exe

C:\Windows\System\ADToDqb.exe

C:\Windows\System\JdLzPfg.exe

C:\Windows\System\JdLzPfg.exe

C:\Windows\System\hvHgbxx.exe

C:\Windows\System\hvHgbxx.exe

C:\Windows\System\uZRncNn.exe

C:\Windows\System\uZRncNn.exe

C:\Windows\System\opdCqOp.exe

C:\Windows\System\opdCqOp.exe

C:\Windows\System\QEYfhfM.exe

C:\Windows\System\QEYfhfM.exe

C:\Windows\System\OgKTuNY.exe

C:\Windows\System\OgKTuNY.exe

C:\Windows\System\vijiBOQ.exe

C:\Windows\System\vijiBOQ.exe

C:\Windows\System\BaDZGVF.exe

C:\Windows\System\BaDZGVF.exe

C:\Windows\System\jneGJoV.exe

C:\Windows\System\jneGJoV.exe

C:\Windows\System\mMyLJNH.exe

C:\Windows\System\mMyLJNH.exe

C:\Windows\System\IWzIViv.exe

C:\Windows\System\IWzIViv.exe

C:\Windows\System\laBGCog.exe

C:\Windows\System\laBGCog.exe

C:\Windows\System\qzyxZQm.exe

C:\Windows\System\qzyxZQm.exe

C:\Windows\System\iNTDcWZ.exe

C:\Windows\System\iNTDcWZ.exe

C:\Windows\System\UXafMXh.exe

C:\Windows\System\UXafMXh.exe

C:\Windows\System\sbzPmUi.exe

C:\Windows\System\sbzPmUi.exe

C:\Windows\System\yWeytXo.exe

C:\Windows\System\yWeytXo.exe

C:\Windows\System\FbSpBuL.exe

C:\Windows\System\FbSpBuL.exe

C:\Windows\System\Wryqfnb.exe

C:\Windows\System\Wryqfnb.exe

C:\Windows\System\JtJxtuX.exe

C:\Windows\System\JtJxtuX.exe

C:\Windows\System\PVZVvow.exe

C:\Windows\System\PVZVvow.exe

C:\Windows\System\SjHugYs.exe

C:\Windows\System\SjHugYs.exe

C:\Windows\System\TapNlgc.exe

C:\Windows\System\TapNlgc.exe

C:\Windows\System\RjOGfTr.exe

C:\Windows\System\RjOGfTr.exe

C:\Windows\System\bAjIvrF.exe

C:\Windows\System\bAjIvrF.exe

C:\Windows\System\poSsymz.exe

C:\Windows\System\poSsymz.exe

C:\Windows\System\KqkXEgn.exe

C:\Windows\System\KqkXEgn.exe

C:\Windows\System\UNbqGKy.exe

C:\Windows\System\UNbqGKy.exe

C:\Windows\System\GQrdwpf.exe

C:\Windows\System\GQrdwpf.exe

C:\Windows\System\mEJbHur.exe

C:\Windows\System\mEJbHur.exe

C:\Windows\System\AfYEMBK.exe

C:\Windows\System\AfYEMBK.exe

C:\Windows\System\ZrjfJOb.exe

C:\Windows\System\ZrjfJOb.exe

C:\Windows\System\wUlEWYd.exe

C:\Windows\System\wUlEWYd.exe

C:\Windows\System\gFFBBuU.exe

C:\Windows\System\gFFBBuU.exe

C:\Windows\System\jehZEON.exe

C:\Windows\System\jehZEON.exe

C:\Windows\System\DFXDPgp.exe

C:\Windows\System\DFXDPgp.exe

C:\Windows\System\tGSCZeW.exe

C:\Windows\System\tGSCZeW.exe

C:\Windows\System\NSYfdeZ.exe

C:\Windows\System\NSYfdeZ.exe

C:\Windows\System\ihkrgrY.exe

C:\Windows\System\ihkrgrY.exe

C:\Windows\System\szbhMbF.exe

C:\Windows\System\szbhMbF.exe

C:\Windows\System\lTTwLiV.exe

C:\Windows\System\lTTwLiV.exe

C:\Windows\System\ccMwJIt.exe

C:\Windows\System\ccMwJIt.exe

C:\Windows\System\GwaVcNz.exe

C:\Windows\System\GwaVcNz.exe

C:\Windows\System\hkZXtYQ.exe

C:\Windows\System\hkZXtYQ.exe

C:\Windows\System\BmHAuOQ.exe

C:\Windows\System\BmHAuOQ.exe

C:\Windows\System\fSTqrse.exe

C:\Windows\System\fSTqrse.exe

C:\Windows\System\hYqSpqT.exe

C:\Windows\System\hYqSpqT.exe

C:\Windows\System\pJIgdFz.exe

C:\Windows\System\pJIgdFz.exe

C:\Windows\System\PIvbzxG.exe

C:\Windows\System\PIvbzxG.exe

C:\Windows\System\nyagmkH.exe

C:\Windows\System\nyagmkH.exe

C:\Windows\System\HEwXvrt.exe

C:\Windows\System\HEwXvrt.exe

C:\Windows\System\xBsffUq.exe

C:\Windows\System\xBsffUq.exe

C:\Windows\System\axqeAVM.exe

C:\Windows\System\axqeAVM.exe

C:\Windows\System\XZupecn.exe

C:\Windows\System\XZupecn.exe

C:\Windows\System\IKIgrKl.exe

C:\Windows\System\IKIgrKl.exe

C:\Windows\System\eLKANfi.exe

C:\Windows\System\eLKANfi.exe

C:\Windows\System\nUcKTER.exe

C:\Windows\System\nUcKTER.exe

C:\Windows\System\jkUbWsz.exe

C:\Windows\System\jkUbWsz.exe

C:\Windows\System\lfquxdQ.exe

C:\Windows\System\lfquxdQ.exe

C:\Windows\System\LutWbrC.exe

C:\Windows\System\LutWbrC.exe

C:\Windows\System\jRxAqvf.exe

C:\Windows\System\jRxAqvf.exe

C:\Windows\System\RyaHNgO.exe

C:\Windows\System\RyaHNgO.exe

C:\Windows\System\WKCDISd.exe

C:\Windows\System\WKCDISd.exe

C:\Windows\System\jbEWBtG.exe

C:\Windows\System\jbEWBtG.exe

C:\Windows\System\FCmGRmN.exe

C:\Windows\System\FCmGRmN.exe

C:\Windows\System\cIJcbHw.exe

C:\Windows\System\cIJcbHw.exe

C:\Windows\System\naHsbzD.exe

C:\Windows\System\naHsbzD.exe

C:\Windows\System\hujzAOE.exe

C:\Windows\System\hujzAOE.exe

C:\Windows\System\THHGVGp.exe

C:\Windows\System\THHGVGp.exe

C:\Windows\System\AfnQZBl.exe

C:\Windows\System\AfnQZBl.exe

C:\Windows\System\lYrrUHU.exe

C:\Windows\System\lYrrUHU.exe

C:\Windows\System\hGpZKCg.exe

C:\Windows\System\hGpZKCg.exe

C:\Windows\System\iwDtmLW.exe

C:\Windows\System\iwDtmLW.exe

C:\Windows\System\JvdjNwl.exe

C:\Windows\System\JvdjNwl.exe

C:\Windows\System\SDWGlDG.exe

C:\Windows\System\SDWGlDG.exe

C:\Windows\System\vraftMA.exe

C:\Windows\System\vraftMA.exe

C:\Windows\System\mJKpTCX.exe

C:\Windows\System\mJKpTCX.exe

C:\Windows\System\XUydGpG.exe

C:\Windows\System\XUydGpG.exe

C:\Windows\System\htqrWPM.exe

C:\Windows\System\htqrWPM.exe

C:\Windows\System\GhCCMvp.exe

C:\Windows\System\GhCCMvp.exe

C:\Windows\System\FPZnngc.exe

C:\Windows\System\FPZnngc.exe

C:\Windows\System\TcyjYax.exe

C:\Windows\System\TcyjYax.exe

C:\Windows\System\NxCeBJt.exe

C:\Windows\System\NxCeBJt.exe

C:\Windows\System\fYMSImi.exe

C:\Windows\System\fYMSImi.exe

C:\Windows\System\fDsGJRa.exe

C:\Windows\System\fDsGJRa.exe

C:\Windows\System\PobjvlM.exe

C:\Windows\System\PobjvlM.exe

C:\Windows\System\XkjTIoM.exe

C:\Windows\System\XkjTIoM.exe

C:\Windows\System\JuvzIiq.exe

C:\Windows\System\JuvzIiq.exe

C:\Windows\System\ITXOhuH.exe

C:\Windows\System\ITXOhuH.exe

C:\Windows\System\SZqZEGL.exe

C:\Windows\System\SZqZEGL.exe

C:\Windows\System\RXEWHrK.exe

C:\Windows\System\RXEWHrK.exe

C:\Windows\System\MVpPDCQ.exe

C:\Windows\System\MVpPDCQ.exe

C:\Windows\System\gjdjUWu.exe

C:\Windows\System\gjdjUWu.exe

C:\Windows\System\SbfUIoL.exe

C:\Windows\System\SbfUIoL.exe

C:\Windows\System\qDppxSb.exe

C:\Windows\System\qDppxSb.exe

C:\Windows\System\EBzMtPr.exe

C:\Windows\System\EBzMtPr.exe

C:\Windows\System\tfQWvyQ.exe

C:\Windows\System\tfQWvyQ.exe

C:\Windows\System\MjRedKH.exe

C:\Windows\System\MjRedKH.exe

C:\Windows\System\vXsCDJz.exe

C:\Windows\System\vXsCDJz.exe

C:\Windows\System\ULrOBCL.exe

C:\Windows\System\ULrOBCL.exe

C:\Windows\System\paEzLnv.exe

C:\Windows\System\paEzLnv.exe

C:\Windows\System\LvhGBGy.exe

C:\Windows\System\LvhGBGy.exe

C:\Windows\System\MgupoyM.exe

C:\Windows\System\MgupoyM.exe

C:\Windows\System\SfalXlu.exe

C:\Windows\System\SfalXlu.exe

C:\Windows\System\MiCwVnZ.exe

C:\Windows\System\MiCwVnZ.exe

C:\Windows\System\JdHnDWN.exe

C:\Windows\System\JdHnDWN.exe

C:\Windows\System\BzIJWoO.exe

C:\Windows\System\BzIJWoO.exe

C:\Windows\System\BwPLDHd.exe

C:\Windows\System\BwPLDHd.exe

C:\Windows\System\RIgAzEj.exe

C:\Windows\System\RIgAzEj.exe

C:\Windows\System\vvgApzm.exe

C:\Windows\System\vvgApzm.exe

C:\Windows\System\khrdeuA.exe

C:\Windows\System\khrdeuA.exe

C:\Windows\System\gFzhEWe.exe

C:\Windows\System\gFzhEWe.exe

C:\Windows\System\oIebIXg.exe

C:\Windows\System\oIebIXg.exe

C:\Windows\System\lwoyZls.exe

C:\Windows\System\lwoyZls.exe

C:\Windows\System\pJFiZdZ.exe

C:\Windows\System\pJFiZdZ.exe

C:\Windows\System\OpBdHFN.exe

C:\Windows\System\OpBdHFN.exe

C:\Windows\System\TVQlMpj.exe

C:\Windows\System\TVQlMpj.exe

C:\Windows\System\xIdtOgb.exe

C:\Windows\System\xIdtOgb.exe

C:\Windows\System\BIoPLPc.exe

C:\Windows\System\BIoPLPc.exe

C:\Windows\System\BpxYpiL.exe

C:\Windows\System\BpxYpiL.exe

C:\Windows\System\XATivEK.exe

C:\Windows\System\XATivEK.exe

C:\Windows\System\aTwWDzZ.exe

C:\Windows\System\aTwWDzZ.exe

C:\Windows\System\GxSIajl.exe

C:\Windows\System\GxSIajl.exe

C:\Windows\System\ZUYqLPF.exe

C:\Windows\System\ZUYqLPF.exe

C:\Windows\System\JvHHvpk.exe

C:\Windows\System\JvHHvpk.exe

C:\Windows\System\rIcbRLg.exe

C:\Windows\System\rIcbRLg.exe

C:\Windows\System\LdAOUnv.exe

C:\Windows\System\LdAOUnv.exe

C:\Windows\System\vDbVjsO.exe

C:\Windows\System\vDbVjsO.exe

C:\Windows\System\McRLgUJ.exe

C:\Windows\System\McRLgUJ.exe

C:\Windows\System\zLHOARu.exe

C:\Windows\System\zLHOARu.exe

C:\Windows\System\iCsEequ.exe

C:\Windows\System\iCsEequ.exe

C:\Windows\System\KVKnvQu.exe

C:\Windows\System\KVKnvQu.exe

C:\Windows\System\okEVVKi.exe

C:\Windows\System\okEVVKi.exe

C:\Windows\System\fSfmTju.exe

C:\Windows\System\fSfmTju.exe

C:\Windows\System\nXnGtMA.exe

C:\Windows\System\nXnGtMA.exe

C:\Windows\System\HtNglkX.exe

C:\Windows\System\HtNglkX.exe

C:\Windows\System\ZbEeFVF.exe

C:\Windows\System\ZbEeFVF.exe

C:\Windows\System\wOsEKmb.exe

C:\Windows\System\wOsEKmb.exe

C:\Windows\System\anMDSlx.exe

C:\Windows\System\anMDSlx.exe

C:\Windows\System\ZazqKmL.exe

C:\Windows\System\ZazqKmL.exe

C:\Windows\System\UicxxwY.exe

C:\Windows\System\UicxxwY.exe

C:\Windows\System\ddBCjZE.exe

C:\Windows\System\ddBCjZE.exe

C:\Windows\System\hUGwiTK.exe

C:\Windows\System\hUGwiTK.exe

C:\Windows\System\GLMJyzs.exe

C:\Windows\System\GLMJyzs.exe

C:\Windows\System\QNvrTZs.exe

C:\Windows\System\QNvrTZs.exe

C:\Windows\System\RWiygGa.exe

C:\Windows\System\RWiygGa.exe

C:\Windows\System\GSlVCDb.exe

C:\Windows\System\GSlVCDb.exe

C:\Windows\System\AYXhIhp.exe

C:\Windows\System\AYXhIhp.exe

C:\Windows\System\CQSjTMZ.exe

C:\Windows\System\CQSjTMZ.exe

C:\Windows\System\aUhBVjh.exe

C:\Windows\System\aUhBVjh.exe

C:\Windows\System\QCFQYiW.exe

C:\Windows\System\QCFQYiW.exe

C:\Windows\System\TMHYoxq.exe

C:\Windows\System\TMHYoxq.exe

C:\Windows\System\HDAiKED.exe

C:\Windows\System\HDAiKED.exe

C:\Windows\System\PDfrvUy.exe

C:\Windows\System\PDfrvUy.exe

C:\Windows\System\DCLCOQH.exe

C:\Windows\System\DCLCOQH.exe

C:\Windows\System\IboXeWJ.exe

C:\Windows\System\IboXeWJ.exe

C:\Windows\System\VhlPFEB.exe

C:\Windows\System\VhlPFEB.exe

C:\Windows\System\exrhsDH.exe

C:\Windows\System\exrhsDH.exe

C:\Windows\System\MMXvHfb.exe

C:\Windows\System\MMXvHfb.exe

C:\Windows\System\JWNZMRb.exe

C:\Windows\System\JWNZMRb.exe

C:\Windows\System\ioIhNEJ.exe

C:\Windows\System\ioIhNEJ.exe

C:\Windows\System\LrlpzmM.exe

C:\Windows\System\LrlpzmM.exe

C:\Windows\System\MrDPdEN.exe

C:\Windows\System\MrDPdEN.exe

C:\Windows\System\cKJnJCg.exe

C:\Windows\System\cKJnJCg.exe

C:\Windows\System\DZwYAmG.exe

C:\Windows\System\DZwYAmG.exe

C:\Windows\System\bvcWhWz.exe

C:\Windows\System\bvcWhWz.exe

C:\Windows\System\FDAtiFP.exe

C:\Windows\System\FDAtiFP.exe

C:\Windows\System\XujwrwL.exe

C:\Windows\System\XujwrwL.exe

C:\Windows\System\ClpSRes.exe

C:\Windows\System\ClpSRes.exe

C:\Windows\System\qnfwvjb.exe

C:\Windows\System\qnfwvjb.exe

C:\Windows\System\KweRctm.exe

C:\Windows\System\KweRctm.exe

C:\Windows\System\NKFhuhh.exe

C:\Windows\System\NKFhuhh.exe

C:\Windows\System\OAAYNLq.exe

C:\Windows\System\OAAYNLq.exe

C:\Windows\System\cwodSwe.exe

C:\Windows\System\cwodSwe.exe

C:\Windows\System\aOQqxij.exe

C:\Windows\System\aOQqxij.exe

C:\Windows\System\hAsqUVZ.exe

C:\Windows\System\hAsqUVZ.exe

C:\Windows\System\RVlGafR.exe

C:\Windows\System\RVlGafR.exe

C:\Windows\System\TGujGeM.exe

C:\Windows\System\TGujGeM.exe

C:\Windows\System\IOJquAR.exe

C:\Windows\System\IOJquAR.exe

C:\Windows\System\MReZUxm.exe

C:\Windows\System\MReZUxm.exe

C:\Windows\System\eQyFwui.exe

C:\Windows\System\eQyFwui.exe

C:\Windows\System\dFfUiMs.exe

C:\Windows\System\dFfUiMs.exe

C:\Windows\System\dnYNwrl.exe

C:\Windows\System\dnYNwrl.exe

C:\Windows\System\uDGJJbd.exe

C:\Windows\System\uDGJJbd.exe

C:\Windows\System\aQenIMd.exe

C:\Windows\System\aQenIMd.exe

C:\Windows\System\hwJIpxB.exe

C:\Windows\System\hwJIpxB.exe

C:\Windows\System\QKUNiCp.exe

C:\Windows\System\QKUNiCp.exe

C:\Windows\System\OoHBZiv.exe

C:\Windows\System\OoHBZiv.exe

C:\Windows\System\UwtGTbC.exe

C:\Windows\System\UwtGTbC.exe

C:\Windows\System\LmSwBbb.exe

C:\Windows\System\LmSwBbb.exe

C:\Windows\System\fdOQZjk.exe

C:\Windows\System\fdOQZjk.exe

C:\Windows\System\JOxQIZP.exe

C:\Windows\System\JOxQIZP.exe

C:\Windows\System\HjRKltD.exe

C:\Windows\System\HjRKltD.exe

C:\Windows\System\mryiCde.exe

C:\Windows\System\mryiCde.exe

C:\Windows\System\mZkqZHf.exe

C:\Windows\System\mZkqZHf.exe

C:\Windows\System\CAGtEzC.exe

C:\Windows\System\CAGtEzC.exe

C:\Windows\System\GhgFQTZ.exe

C:\Windows\System\GhgFQTZ.exe

C:\Windows\System\gDhbtOM.exe

C:\Windows\System\gDhbtOM.exe

C:\Windows\System\QssPjUy.exe

C:\Windows\System\QssPjUy.exe

C:\Windows\System\KcIIooT.exe

C:\Windows\System\KcIIooT.exe

C:\Windows\System\PvZJuGz.exe

C:\Windows\System\PvZJuGz.exe

C:\Windows\System\rnBIIDX.exe

C:\Windows\System\rnBIIDX.exe

C:\Windows\System\ISdpGEl.exe

C:\Windows\System\ISdpGEl.exe

C:\Windows\System\SKywsIU.exe

C:\Windows\System\SKywsIU.exe

C:\Windows\System\kmZxmAK.exe

C:\Windows\System\kmZxmAK.exe

C:\Windows\System\lyOAYTD.exe

C:\Windows\System\lyOAYTD.exe

C:\Windows\System\tYnIQaP.exe

C:\Windows\System\tYnIQaP.exe

C:\Windows\System\PTkInsf.exe

C:\Windows\System\PTkInsf.exe

C:\Windows\System\jBjwkpS.exe

C:\Windows\System\jBjwkpS.exe

C:\Windows\System\zFTgnwp.exe

C:\Windows\System\zFTgnwp.exe

C:\Windows\System\YCeaoLl.exe

C:\Windows\System\YCeaoLl.exe

C:\Windows\System\tZWqaPi.exe

C:\Windows\System\tZWqaPi.exe

C:\Windows\System\VgbFoHx.exe

C:\Windows\System\VgbFoHx.exe

C:\Windows\System\izeGzKS.exe

C:\Windows\System\izeGzKS.exe

C:\Windows\System\IKQKiwa.exe

C:\Windows\System\IKQKiwa.exe

C:\Windows\System\HeqdgOW.exe

C:\Windows\System\HeqdgOW.exe

C:\Windows\System\LIGtEVR.exe

C:\Windows\System\LIGtEVR.exe

C:\Windows\System\zuUsIiE.exe

C:\Windows\System\zuUsIiE.exe

C:\Windows\System\ZVwaExs.exe

C:\Windows\System\ZVwaExs.exe

C:\Windows\System\PNoNzsE.exe

C:\Windows\System\PNoNzsE.exe

C:\Windows\System\bWYWBLR.exe

C:\Windows\System\bWYWBLR.exe

C:\Windows\System\RXRlsEM.exe

C:\Windows\System\RXRlsEM.exe

C:\Windows\System\OvBEHjJ.exe

C:\Windows\System\OvBEHjJ.exe

C:\Windows\System\oruzfgo.exe

C:\Windows\System\oruzfgo.exe

C:\Windows\System\vttPsMd.exe

C:\Windows\System\vttPsMd.exe

C:\Windows\System\yPGSyow.exe

C:\Windows\System\yPGSyow.exe

C:\Windows\System\raPYwtA.exe

C:\Windows\System\raPYwtA.exe

C:\Windows\System\onmOPyM.exe

C:\Windows\System\onmOPyM.exe

C:\Windows\System\iXYiSpY.exe

C:\Windows\System\iXYiSpY.exe

C:\Windows\System\NGtZZDa.exe

C:\Windows\System\NGtZZDa.exe

C:\Windows\System\CEDLRyk.exe

C:\Windows\System\CEDLRyk.exe

C:\Windows\System\NIYIhAa.exe

C:\Windows\System\NIYIhAa.exe

C:\Windows\System\hqlGbJZ.exe

C:\Windows\System\hqlGbJZ.exe

C:\Windows\System\umMnlgl.exe

C:\Windows\System\umMnlgl.exe

C:\Windows\System\MNJhmjy.exe

C:\Windows\System\MNJhmjy.exe

C:\Windows\System\wEnacHs.exe

C:\Windows\System\wEnacHs.exe

C:\Windows\System\UEDUGcS.exe

C:\Windows\System\UEDUGcS.exe

C:\Windows\System\SYePXSX.exe

C:\Windows\System\SYePXSX.exe

C:\Windows\System\vFhJBoZ.exe

C:\Windows\System\vFhJBoZ.exe

C:\Windows\System\jSUHzoR.exe

C:\Windows\System\jSUHzoR.exe

C:\Windows\System\SadiuCQ.exe

C:\Windows\System\SadiuCQ.exe

C:\Windows\System\dqCRJmT.exe

C:\Windows\System\dqCRJmT.exe

C:\Windows\System\KWgPfcO.exe

C:\Windows\System\KWgPfcO.exe

C:\Windows\System\tzYojNL.exe

C:\Windows\System\tzYojNL.exe

C:\Windows\System\LZSQXXG.exe

C:\Windows\System\LZSQXXG.exe

C:\Windows\System\iaHkCuK.exe

C:\Windows\System\iaHkCuK.exe

C:\Windows\System\RXqkbal.exe

C:\Windows\System\RXqkbal.exe

C:\Windows\System\tUmShon.exe

C:\Windows\System\tUmShon.exe

C:\Windows\System\JmSffuT.exe

C:\Windows\System\JmSffuT.exe

C:\Windows\System\jizTJGI.exe

C:\Windows\System\jizTJGI.exe

C:\Windows\System\IXMHSGy.exe

C:\Windows\System\IXMHSGy.exe

C:\Windows\System\nFniMQH.exe

C:\Windows\System\nFniMQH.exe

C:\Windows\System\dVVZDXQ.exe

C:\Windows\System\dVVZDXQ.exe

C:\Windows\System\gbJNRcq.exe

C:\Windows\System\gbJNRcq.exe

C:\Windows\System\GClvTCb.exe

C:\Windows\System\GClvTCb.exe

C:\Windows\System\lExgxrI.exe

C:\Windows\System\lExgxrI.exe

C:\Windows\System\ZTyTTZd.exe

C:\Windows\System\ZTyTTZd.exe

C:\Windows\System\RgSoPNB.exe

C:\Windows\System\RgSoPNB.exe

C:\Windows\System\XgyPfwk.exe

C:\Windows\System\XgyPfwk.exe

C:\Windows\System\KdKZOYd.exe

C:\Windows\System\KdKZOYd.exe

C:\Windows\System\yQDEcJk.exe

C:\Windows\System\yQDEcJk.exe

C:\Windows\System\rwqdCGT.exe

C:\Windows\System\rwqdCGT.exe

C:\Windows\System\wJdCfXC.exe

C:\Windows\System\wJdCfXC.exe

C:\Windows\System\rpeknFT.exe

C:\Windows\System\rpeknFT.exe

C:\Windows\System\OMnWEnU.exe

C:\Windows\System\OMnWEnU.exe

C:\Windows\System\FJpfALB.exe

C:\Windows\System\FJpfALB.exe

C:\Windows\System\bwQDScV.exe

C:\Windows\System\bwQDScV.exe

C:\Windows\System\bfZHIRs.exe

C:\Windows\System\bfZHIRs.exe

C:\Windows\System\GNpxnxQ.exe

C:\Windows\System\GNpxnxQ.exe

C:\Windows\System\rVhGhFf.exe

C:\Windows\System\rVhGhFf.exe

C:\Windows\System\IdhLXMO.exe

C:\Windows\System\IdhLXMO.exe

C:\Windows\System\uvjjgSE.exe

C:\Windows\System\uvjjgSE.exe

C:\Windows\System\ZdDUHgz.exe

C:\Windows\System\ZdDUHgz.exe

C:\Windows\System\lxFnequ.exe

C:\Windows\System\lxFnequ.exe

C:\Windows\System\kZiOlXx.exe

C:\Windows\System\kZiOlXx.exe

C:\Windows\System\KbXSafV.exe

C:\Windows\System\KbXSafV.exe

C:\Windows\System\jUmSVzh.exe

C:\Windows\System\jUmSVzh.exe

C:\Windows\System\cOqksqb.exe

C:\Windows\System\cOqksqb.exe

C:\Windows\System\HCAHqhu.exe

C:\Windows\System\HCAHqhu.exe

C:\Windows\System\YqPGAUa.exe

C:\Windows\System\YqPGAUa.exe

C:\Windows\System\uCYxUtL.exe

C:\Windows\System\uCYxUtL.exe

C:\Windows\System\AiqSDeY.exe

C:\Windows\System\AiqSDeY.exe

C:\Windows\System\mLIuJQN.exe

C:\Windows\System\mLIuJQN.exe

C:\Windows\System\CYIJpmC.exe

C:\Windows\System\CYIJpmC.exe

C:\Windows\System\jqxpBrm.exe

C:\Windows\System\jqxpBrm.exe

C:\Windows\System\lXmecqO.exe

C:\Windows\System\lXmecqO.exe

C:\Windows\System\rCQyRyy.exe

C:\Windows\System\rCQyRyy.exe

C:\Windows\System\kmOAeYi.exe

C:\Windows\System\kmOAeYi.exe

C:\Windows\System\LoOPpwH.exe

C:\Windows\System\LoOPpwH.exe

C:\Windows\System\MBElTpK.exe

C:\Windows\System\MBElTpK.exe

C:\Windows\System\fYfZVHb.exe

C:\Windows\System\fYfZVHb.exe

C:\Windows\System\scRriwG.exe

C:\Windows\System\scRriwG.exe

C:\Windows\System\jgubeGQ.exe

C:\Windows\System\jgubeGQ.exe

C:\Windows\System\VcSVwWx.exe

C:\Windows\System\VcSVwWx.exe

C:\Windows\System\TKDTWbQ.exe

C:\Windows\System\TKDTWbQ.exe

C:\Windows\System\pROEUFQ.exe

C:\Windows\System\pROEUFQ.exe

C:\Windows\System\jThcCHR.exe

C:\Windows\System\jThcCHR.exe

C:\Windows\System\CXVcQTA.exe

C:\Windows\System\CXVcQTA.exe

C:\Windows\System\wQsloiL.exe

C:\Windows\System\wQsloiL.exe

C:\Windows\System\nMPYSPR.exe

C:\Windows\System\nMPYSPR.exe

C:\Windows\System\QHEgexn.exe

C:\Windows\System\QHEgexn.exe

C:\Windows\System\nsHlfpp.exe

C:\Windows\System\nsHlfpp.exe

C:\Windows\System\YZzGTGJ.exe

C:\Windows\System\YZzGTGJ.exe

C:\Windows\System\mbmgRxi.exe

C:\Windows\System\mbmgRxi.exe

C:\Windows\System\autFcRe.exe

C:\Windows\System\autFcRe.exe

C:\Windows\System\abeOiqw.exe

C:\Windows\System\abeOiqw.exe

C:\Windows\System\MoxHwhU.exe

C:\Windows\System\MoxHwhU.exe

C:\Windows\System\ytLNIPS.exe

C:\Windows\System\ytLNIPS.exe

C:\Windows\System\lKYoaui.exe

C:\Windows\System\lKYoaui.exe

C:\Windows\System\Veekplc.exe

C:\Windows\System\Veekplc.exe

C:\Windows\System\sQgGnAQ.exe

C:\Windows\System\sQgGnAQ.exe

C:\Windows\System\pMlXsTO.exe

C:\Windows\System\pMlXsTO.exe

C:\Windows\System\QpfwUQA.exe

C:\Windows\System\QpfwUQA.exe

C:\Windows\System\holBOiB.exe

C:\Windows\System\holBOiB.exe

C:\Windows\System\JqfBZbY.exe

C:\Windows\System\JqfBZbY.exe

C:\Windows\System\sjXpiRy.exe

C:\Windows\System\sjXpiRy.exe

C:\Windows\System\AkoFuoD.exe

C:\Windows\System\AkoFuoD.exe

C:\Windows\System\rnUOBqu.exe

C:\Windows\System\rnUOBqu.exe

C:\Windows\System\lwAFUNt.exe

C:\Windows\System\lwAFUNt.exe

C:\Windows\System\WZMviOh.exe

C:\Windows\System\WZMviOh.exe

C:\Windows\System\HsUezQk.exe

C:\Windows\System\HsUezQk.exe

C:\Windows\System\LqeoYMT.exe

C:\Windows\System\LqeoYMT.exe

C:\Windows\System\nZrcYHO.exe

C:\Windows\System\nZrcYHO.exe

C:\Windows\System\CnTPGsD.exe

C:\Windows\System\CnTPGsD.exe

C:\Windows\System\wLsgewf.exe

C:\Windows\System\wLsgewf.exe

C:\Windows\System\PvlbMLe.exe

C:\Windows\System\PvlbMLe.exe

C:\Windows\System\djwPxNu.exe

C:\Windows\System\djwPxNu.exe

C:\Windows\System\qGqQRes.exe

C:\Windows\System\qGqQRes.exe

C:\Windows\System\LSyJsar.exe

C:\Windows\System\LSyJsar.exe

C:\Windows\System\Hcvrequ.exe

C:\Windows\System\Hcvrequ.exe

C:\Windows\System\ERyJRWO.exe

C:\Windows\System\ERyJRWO.exe

C:\Windows\System\cWwZOFD.exe

C:\Windows\System\cWwZOFD.exe

C:\Windows\System\NYDGvUL.exe

C:\Windows\System\NYDGvUL.exe

C:\Windows\System\WsDoGZL.exe

C:\Windows\System\WsDoGZL.exe

C:\Windows\System\fIjbvVU.exe

C:\Windows\System\fIjbvVU.exe

C:\Windows\System\HqpusVp.exe

C:\Windows\System\HqpusVp.exe

C:\Windows\System\jTjlLaG.exe

C:\Windows\System\jTjlLaG.exe

C:\Windows\System\ujPVfGP.exe

C:\Windows\System\ujPVfGP.exe

C:\Windows\System\KMImVls.exe

C:\Windows\System\KMImVls.exe

C:\Windows\System\TuAgsss.exe

C:\Windows\System\TuAgsss.exe

C:\Windows\System\SaEoeNa.exe

C:\Windows\System\SaEoeNa.exe

C:\Windows\System\kPEmVrK.exe

C:\Windows\System\kPEmVrK.exe

C:\Windows\System\PMIqDNj.exe

C:\Windows\System\PMIqDNj.exe

C:\Windows\System\LqbjjjH.exe

C:\Windows\System\LqbjjjH.exe

C:\Windows\System\VWbwZUb.exe

C:\Windows\System\VWbwZUb.exe

C:\Windows\System\TkVLHaz.exe

C:\Windows\System\TkVLHaz.exe

C:\Windows\System\kECGqkI.exe

C:\Windows\System\kECGqkI.exe

C:\Windows\System\JVRTxGC.exe

C:\Windows\System\JVRTxGC.exe

C:\Windows\System\gZRMEtL.exe

C:\Windows\System\gZRMEtL.exe

C:\Windows\System\WHKXvIU.exe

C:\Windows\System\WHKXvIU.exe

C:\Windows\System\kPcfwUx.exe

C:\Windows\System\kPcfwUx.exe

C:\Windows\System\epsJMqE.exe

C:\Windows\System\epsJMqE.exe

C:\Windows\System\LEsyATc.exe

C:\Windows\System\LEsyATc.exe

C:\Windows\System\yLOKuuP.exe

C:\Windows\System\yLOKuuP.exe

C:\Windows\System\ihhnzOb.exe

C:\Windows\System\ihhnzOb.exe

C:\Windows\System\DOAuXOP.exe

C:\Windows\System\DOAuXOP.exe

C:\Windows\System\FAOlvgE.exe

C:\Windows\System\FAOlvgE.exe

C:\Windows\System\mdZVnpw.exe

C:\Windows\System\mdZVnpw.exe

C:\Windows\System\fZvRZKH.exe

C:\Windows\System\fZvRZKH.exe

C:\Windows\System\yVgkGos.exe

C:\Windows\System\yVgkGos.exe

C:\Windows\System\IeiIzEM.exe

C:\Windows\System\IeiIzEM.exe

C:\Windows\System\GwHbkCX.exe

C:\Windows\System\GwHbkCX.exe

C:\Windows\System\afplFqk.exe

C:\Windows\System\afplFqk.exe

C:\Windows\System\yFOdzqR.exe

C:\Windows\System\yFOdzqR.exe

C:\Windows\System\WlzxzMI.exe

C:\Windows\System\WlzxzMI.exe

C:\Windows\System\tmurQVM.exe

C:\Windows\System\tmurQVM.exe

C:\Windows\System\VaaVfnZ.exe

C:\Windows\System\VaaVfnZ.exe

C:\Windows\System\ocHGwDj.exe

C:\Windows\System\ocHGwDj.exe

C:\Windows\System\SuedHGT.exe

C:\Windows\System\SuedHGT.exe

C:\Windows\System\fNilwsj.exe

C:\Windows\System\fNilwsj.exe

C:\Windows\System\tWEPoMO.exe

C:\Windows\System\tWEPoMO.exe

C:\Windows\System\aBajuxj.exe

C:\Windows\System\aBajuxj.exe

C:\Windows\System\BCaPRfL.exe

C:\Windows\System\BCaPRfL.exe

C:\Windows\System\CVgnMxu.exe

C:\Windows\System\CVgnMxu.exe

C:\Windows\System\HiCCpKd.exe

C:\Windows\System\HiCCpKd.exe

C:\Windows\System\jjSMrOy.exe

C:\Windows\System\jjSMrOy.exe

C:\Windows\System\zRgoiRD.exe

C:\Windows\System\zRgoiRD.exe

C:\Windows\System\GkENpuC.exe

C:\Windows\System\GkENpuC.exe

C:\Windows\System\INVbQVf.exe

C:\Windows\System\INVbQVf.exe

C:\Windows\System\BGInUNs.exe

C:\Windows\System\BGInUNs.exe

C:\Windows\System\wPpgmeS.exe

C:\Windows\System\wPpgmeS.exe

C:\Windows\System\ruNbwNz.exe

C:\Windows\System\ruNbwNz.exe

C:\Windows\System\cfopSCy.exe

C:\Windows\System\cfopSCy.exe

C:\Windows\System\RdCKiOU.exe

C:\Windows\System\RdCKiOU.exe

C:\Windows\System\RzifRXq.exe

C:\Windows\System\RzifRXq.exe

C:\Windows\System\hpCqUiP.exe

C:\Windows\System\hpCqUiP.exe

C:\Windows\System\AeilFug.exe

C:\Windows\System\AeilFug.exe

C:\Windows\System\hOkAATX.exe

C:\Windows\System\hOkAATX.exe

C:\Windows\System\LJsrNhM.exe

C:\Windows\System\LJsrNhM.exe

C:\Windows\System\hGsBIhi.exe

C:\Windows\System\hGsBIhi.exe

C:\Windows\System\ZHGOpKz.exe

C:\Windows\System\ZHGOpKz.exe

C:\Windows\System\mulRbFW.exe

C:\Windows\System\mulRbFW.exe

C:\Windows\System\tCliadZ.exe

C:\Windows\System\tCliadZ.exe

C:\Windows\System\IQNBmYO.exe

C:\Windows\System\IQNBmYO.exe

C:\Windows\System\yKaXYpE.exe

C:\Windows\System\yKaXYpE.exe

C:\Windows\System\IttllIU.exe

C:\Windows\System\IttllIU.exe

C:\Windows\System\FhoCUfH.exe

C:\Windows\System\FhoCUfH.exe

C:\Windows\System\HmIGBpP.exe

C:\Windows\System\HmIGBpP.exe

C:\Windows\System\GDehWWQ.exe

C:\Windows\System\GDehWWQ.exe

C:\Windows\System\tcRSMla.exe

C:\Windows\System\tcRSMla.exe

C:\Windows\System\VuUdRPE.exe

C:\Windows\System\VuUdRPE.exe

C:\Windows\System\udypmiB.exe

C:\Windows\System\udypmiB.exe

C:\Windows\System\pttmJct.exe

C:\Windows\System\pttmJct.exe

C:\Windows\System\reFDfDt.exe

C:\Windows\System\reFDfDt.exe

C:\Windows\System\KQheqgH.exe

C:\Windows\System\KQheqgH.exe

C:\Windows\System\tcBseeZ.exe

C:\Windows\System\tcBseeZ.exe

C:\Windows\System\hLVGWcE.exe

C:\Windows\System\hLVGWcE.exe

C:\Windows\System\sAREBwF.exe

C:\Windows\System\sAREBwF.exe

C:\Windows\System\PfzhBuR.exe

C:\Windows\System\PfzhBuR.exe

C:\Windows\System\bWYSZlF.exe

C:\Windows\System\bWYSZlF.exe

C:\Windows\System\wUfybYb.exe

C:\Windows\System\wUfybYb.exe

C:\Windows\System\HfyAnWJ.exe

C:\Windows\System\HfyAnWJ.exe

C:\Windows\System\ozYwPLU.exe

C:\Windows\System\ozYwPLU.exe

C:\Windows\System\idttawD.exe

C:\Windows\System\idttawD.exe

C:\Windows\System\tZMSFBM.exe

C:\Windows\System\tZMSFBM.exe

C:\Windows\System\KLpbioS.exe

C:\Windows\System\KLpbioS.exe

C:\Windows\System\KdqGVxo.exe

C:\Windows\System\KdqGVxo.exe

C:\Windows\System\nnZJCdu.exe

C:\Windows\System\nnZJCdu.exe

C:\Windows\System\JdiAkXw.exe

C:\Windows\System\JdiAkXw.exe

C:\Windows\System\iiQHBrX.exe

C:\Windows\System\iiQHBrX.exe

C:\Windows\System\lQeHbDg.exe

C:\Windows\System\lQeHbDg.exe

C:\Windows\System\wNylCKw.exe

C:\Windows\System\wNylCKw.exe

C:\Windows\System\jlcmlhY.exe

C:\Windows\System\jlcmlhY.exe

C:\Windows\System\lJkNozY.exe

C:\Windows\System\lJkNozY.exe

C:\Windows\System\xSICWMZ.exe

C:\Windows\System\xSICWMZ.exe

C:\Windows\System\dvZZOUo.exe

C:\Windows\System\dvZZOUo.exe

C:\Windows\System\ptZFyfe.exe

C:\Windows\System\ptZFyfe.exe

C:\Windows\System\sPjYlVw.exe

C:\Windows\System\sPjYlVw.exe

C:\Windows\System\CKqFaEC.exe

C:\Windows\System\CKqFaEC.exe

C:\Windows\System\hUgqDav.exe

C:\Windows\System\hUgqDav.exe

C:\Windows\System\mMFLIbC.exe

C:\Windows\System\mMFLIbC.exe

C:\Windows\System\bXTPiRt.exe

C:\Windows\System\bXTPiRt.exe

C:\Windows\System\NbzgwPS.exe

C:\Windows\System\NbzgwPS.exe

C:\Windows\System\DIbmjdJ.exe

C:\Windows\System\DIbmjdJ.exe

C:\Windows\System\LLbskXp.exe

C:\Windows\System\LLbskXp.exe

C:\Windows\System\meKEqJU.exe

C:\Windows\System\meKEqJU.exe

C:\Windows\System\OKennsN.exe

C:\Windows\System\OKennsN.exe

C:\Windows\System\MroXOSG.exe

C:\Windows\System\MroXOSG.exe

C:\Windows\System\SOtQJWJ.exe

C:\Windows\System\SOtQJWJ.exe

C:\Windows\System\emhSmfS.exe

C:\Windows\System\emhSmfS.exe

C:\Windows\System\dyKSGNp.exe

C:\Windows\System\dyKSGNp.exe

C:\Windows\System\AxsfaEA.exe

C:\Windows\System\AxsfaEA.exe

C:\Windows\System\UmGmjdu.exe

C:\Windows\System\UmGmjdu.exe

C:\Windows\System\NmaOVtc.exe

C:\Windows\System\NmaOVtc.exe

C:\Windows\System\KhhAsJW.exe

C:\Windows\System\KhhAsJW.exe

C:\Windows\System\FEpsSCY.exe

C:\Windows\System\FEpsSCY.exe

C:\Windows\System\WHgbBLK.exe

C:\Windows\System\WHgbBLK.exe

C:\Windows\System\VJyqKbL.exe

C:\Windows\System\VJyqKbL.exe

C:\Windows\System\WWZuQkr.exe

C:\Windows\System\WWZuQkr.exe

C:\Windows\System\CeMrZzy.exe

C:\Windows\System\CeMrZzy.exe

Network

N/A

Files

memory/1936-0-0x000000013F9B0000-0x000000013FD04000-memory.dmp

memory/1936-1-0x00000000002F0000-0x0000000000300000-memory.dmp

C:\Windows\system\WzFntsv.exe

MD5	a3a144567f2c73ecc7f521c20087a8be
SHA1	b3778c93056c72905e98bafc2839f4a4ee37c968
SHA256	2c0fb25fc1af55c38136afbd52ae2664a7eb585223e5d38209d8a0ed428955a5
SHA512	b1af448b9c7780cef8a144ae620545f71a04e833474092eaec5427d48f3cc1f732ed1e582f39db3110245ce0d6a2c1df299df91ae612a4b9a21e2a34fca618e0

memory/1936-7-0x000000013F3C0000-0x000000013F714000-memory.dmp

C:\Windows\system\dlllqth.exe

MD5	53441d803539935e14da3a20b8e70315
SHA1	acc1e0530f46fd19a3558dd0c716c986b858766b
SHA256	5206217d1fd5e9e9df5cd570154c8f158587a75f7d262c2499e1d129d166daf0
SHA512	cf6629661b3c96b4eb88e35d4a846db73516a0030f0117222e9d1073134fbc549968e8af3ab37af9673aaa6c524d33fc18959799ad5ae3a42c19a91edeac68c1

C:\Windows\system\ywjrHUq.exe

MD5	385213a04b817d1cdce9695c687b52ed
SHA1	0a9792940d4dbe205ba51ba44736f935e34ad0ec
SHA256	f83af215722d8f68a5b6f4342229a30769bf66b2746ed92609ca12727b972396
SHA512	4f3fe976d40484030bb6f79ea493002cd5f3a6f49bebb9003a4be49020b0068d8c9edd8dbaf2a57998bc75f37054e3ae44914a1c05ede4939389f3f549156051

C:\Windows\system\xtkmMHU.exe

MD5	a9ae02ced746cb11ceb01f9404cc824d
SHA1	98332514e21487701475833456d62506940bd62f
SHA256	ddc105e29a6b5c49cecc7ea1f2e39480fe4e891358d92357a3bc1ce403e75e21
SHA512	dfe3bd6f77d31279c743d0355a84fb2104f468d084e759dc8bb8bc7660b8157240345b1f86eae5896aca30c1a6a4baffb893ed485d4a04097a5b24caf898c26a

C:\Windows\system\vAUFprE.exe

MD5	c75961963319b7913abb52d81736e70b
SHA1	8fda9e4e9a3ab246fc95f2675e3f880dfc2c3295
SHA256	15433e5706b63a8eabf2d6305ae6346c57d543d71cfcc4149d9720bb272bd6d1
SHA512	b3cc049e2eecce59f12740901242070d08ad0ed93c57fb8a0f66004d3817bd22214eb8f0a15ba714fab29427be9ec0ce970ff749caf0e01899877ff2fa51a7f7

C:\Windows\system\hhrEsEo.exe

MD5	1e25d290085052b3a16d58c245e7f370
SHA1	164c641ab96071d1b1054b8946c41cc34de4a00d
SHA256	3d552150c1036d60ad71fc6771c893ae4522d60197daf43ce337fdbcbc267ee2
SHA512	d4d65bcf71b7de8e92e586a0510c93f0421e8271bd07d70fc4a1c1e2eae981c2874ffdd0bc439e00efff568550274c4de542680db63b8e9e1261fa6af11d807f

C:\Windows\system\yXtMzXm.exe

MD5	9004a1bae3fb9b11594dbcbd373ca715
SHA1	7e4947d7f39a60cec54ff1bfe7309c63454dea58
SHA256	a41b3e8b01e42f6923e19b3adbd266adbfb82f52baf960fdf1352a5840f1d575
SHA512	0e0e97d046167e62ad5a8a45a0d5a6b52ce330c9bd26c798dd6ddebf4e283a84571cc26bd02428f9a6a283482501e4c11bd4b6039fcc8de683c2aa3660d18bfe

\Windows\system\KfIXYVy.exe

MD5	59cb60a43299cde9a7fdef8e0dcf008f
SHA1	2a7f9e653ef6fb64438a7d3a5f4ab0eb510427ab
SHA256	4d4519f47414c8ee55b3deabbb2ff9238bcf6d207bd6b216d3d81b9609e580a0
SHA512	1be0603c7ed5b3a6d4d475d210c4ad91d263806ca39fb4d4b269179481064efd3e19e3002ceb82cb150d9d71b6d1e16d7044751eb8c8e58f8d3bf8529899da53

C:\Windows\system\qzuhPKP.exe

MD5	f39efcd1931e59e7bebb50c6e0bce53a
SHA1	6768b9fa4b46c0c90b842f8a25dd98b4b823b022
SHA256	03435f712b91d6eaeb0add3cb57100083748306903715429ca307b4737e5ec21
SHA512	07888d920291cae7ecf9ad38b3e10e2a244aed6495a2088cda91f792820bead6e9a6b31e712071bbfbb8d4923e750e864d74a9e85741e53931f1843ab99f4680

C:\Windows\system\Swbyffu.exe

MD5	49c670a361eb10c6bee9ca64144440f3
SHA1	f4acb4accbecad90687fb505def5026b06c02db5
SHA256	392ff701e12dda61c9b508fae579de667aec6bae134685622d7b8dcba632b7e3
SHA512	fe782ef1f0c5e18f9fa8cb33dd8cab122d183f68a8ba7d334b3724e29507425e38136ed2f366904ea1c2c76bd80457e9546a11fb4334fd931ed9aa927696d313

C:\Windows\system\FXnMNbD.exe

MD5	c7a3299afcfce2d6c3e1c21896346a2b
SHA1	4b06c544b234461b22a6f0506d99d1ce9cd0f2a4
SHA256	5e084f49c29148a884d7adc0f44c4be4edd2bbf733512032266c379cbaec5a2d
SHA512	a546dfeba59ffb9c75b91c1ebad8d44a072c0fed4de5690c9dec807be270ba1f325930f112fd17cee145638bd2de8b2d77839e7bc714643f2cadecd0e4f8a14a

C:\Windows\system\pMWakMU.exe

MD5	e1ad410a5ce6bedc212bc650e26000a8
SHA1	91db79a26f03fe0765e86a45390a073656d1df90
SHA256	3b1f3824728bcc1c56f1e13e5bee48aebf7a1d20901e84de03c41a281629dd0a
SHA512	6795b6bd1e82e94c1c3ee5a9f425d55ff6fc6bc0ec18acf31777f81ac5787dcb3afb6a4b2a2cf5539e67934cacd160f62d596491f063f804566256d38cf5401e

memory/2800-560-0x000000013F410000-0x000000013F764000-memory.dmp

memory/1936-563-0x0000000002000000-0x0000000002354000-memory.dmp

memory/2808-562-0x000000013F290000-0x000000013F5E4000-memory.dmp

memory/1936-565-0x0000000002000000-0x0000000002354000-memory.dmp

memory/1936-567-0x0000000002000000-0x0000000002354000-memory.dmp

memory/3008-570-0x000000013F3F0000-0x000000013F744000-memory.dmp

memory/1936-569-0x000000013F3F0000-0x000000013F744000-memory.dmp

memory/1936-573-0x000000013F1E0000-0x000000013F534000-memory.dmp

memory/1936-582-0x000000013F370000-0x000000013F6C4000-memory.dmp

memory/1936-581-0x000000013F150000-0x000000013F4A4000-memory.dmp

memory/2292-580-0x000000013FFF0000-0x0000000140344000-memory.dmp

memory/1936-579-0x000000013FFF0000-0x0000000140344000-memory.dmp

memory/2168-578-0x000000013FEC0000-0x0000000140214000-memory.dmp

memory/1936-577-0x000000013FEC0000-0x0000000140214000-memory.dmp

memory/2508-576-0x000000013F1C0000-0x000000013F514000-memory.dmp

memory/1936-575-0x000000013F1C0000-0x000000013F514000-memory.dmp

memory/2476-574-0x000000013F1E0000-0x000000013F534000-memory.dmp

memory/2520-572-0x000000013FC90000-0x000000013FFE4000-memory.dmp

memory/1936-571-0x0000000002000000-0x0000000002354000-memory.dmp

memory/2512-568-0x000000013F980000-0x000000013FCD4000-memory.dmp

memory/2868-566-0x000000013F720000-0x000000013FA74000-memory.dmp

memory/2716-564-0x000000013F930000-0x000000013FC84000-memory.dmp

memory/1936-561-0x000000013F290000-0x000000013F5E4000-memory.dmp

memory/2568-526-0x000000013F3C0000-0x000000013F714000-memory.dmp

memory/1936-559-0x000000013F410000-0x000000013F764000-memory.dmp

memory/2744-558-0x000000013F500000-0x000000013F854000-memory.dmp

memory/1936-557-0x000000013F500000-0x000000013F854000-memory.dmp

memory/2620-556-0x000000013F370000-0x000000013F6C4000-memory.dmp

C:\Windows\system\YhLXgVv.exe

MD5	92ae00e82b09c9faef4ac0cedde572ad
SHA1	8638bc420c7722bb567da32551bcd800964c9fb2
SHA256	273256ecb9329051ba79b95824e864d86490c586b0bcecc28c5328914f7b20d0
SHA512	5ee5c8e02b8dfbcdd8d6289fe27ba57e8f196f4046373ce3cc781df01e89b2d6ed230da914505847398bc84a539730c91abae3d7cfe6e6897d1a65d887325ae7

C:\Windows\system\lkSBxLA.exe

MD5	bfc9a18d3b04ddf8147adf7583651bed
SHA1	7a436f03c73e46fcf1188213729c6100463fb894
SHA256	303a5377679792307d5d18d99fb7fa198e04842c5aa16943043b42bcd2b7b725
SHA512	30a5f1c8b68e2b78da846208831c5a512f04a1c4b53f8db9d5e7ef5c66ed23233daed6e76cdbd8e869733b111762cc740a159a8648e3e70c812ee0c053f73d59

C:\Windows\system\GsUMAHB.exe

MD5	545c2cc1b8c1ea0985dbb649cb4ea9bb
SHA1	ffc3217be39ebaa54331e88e07c79b8e14a62f54
SHA256	e41c2ee3f782d92474debc3bf85c90052cad3eafa9e99b0d9979749f222b3529
SHA512	e66da3f973233328afd5d7ff2d5648b46d9b191d653390c96a99fe0011e307afd7908202977e829f655124636323ec8d2a4af396ac717d669cfd5545f32eb0c6

C:\Windows\system\THGtqQL.exe

MD5	432393cbd7bb829984c5674731b05537
SHA1	c5559f8094e2b56fdfb8c83b09e617c7186eeaae
SHA256	87a9c89a43d1d81b54c5246021927df8c679800af4100a5af75026002dca9882
SHA512	80cb7816445baf96cca6f1798a32a6649cbcb5c5c60fb925f2b9a8b93890a3029eac17676acc01b50607748427bd01d0eeb8cb007958f4078fc1b266723d887f

C:\Windows\system\bNoIsky.exe

MD5	db1073f40015c0a1eff171407fd361c0
SHA1	b6b175ebdffc956b86132280d0c75473a5524ed0
SHA256	ff25dc39de7f5e059cf9698c59455ab63149595e7e7d792d08d6ba792a4b7e95
SHA512	a6d8e2ef86588703522e1ed70442969ec90110424fa5cc7055b298ce8fbf3d7436e83927c7aa781bad9ba9ecf9cecb5125f9b23d64da0c1244128390b1f2507b

C:\Windows\system\QlzEbbU.exe

MD5	d29f96cb4f04df9a9839e66bb0a4ce84
SHA1	8734a0f54ee54e3b214917b32e9775b3eb45c9a2
SHA256	efb31eb17191f553ccff7a632b297263bcffb626d3f94d2f643969fe63bf1a52
SHA512	70c7cf931f9d8d3a45cce4ef393c7c94e221ad0946415cbd9c0841e645abb70d68069e15707109d80a1f8783dd09eab96004bafe427608525a927130e598c103

C:\Windows\system\CbfiGxE.exe

MD5	835aa7b61f0cc53d2ae6fdbfc5b5eb30
SHA1	a4a883957e70c44c48ab83e910d83d8aeef8415f
SHA256	93c8e383955ad8562ef2b2d6632be19d4144cc0a077443ea5173617e9176a625
SHA512	e943788dff2c5bed580408b571c33361b0e56c1d3fae06278d490c50ea7f8392bb1d3d4fea257412e17bfb02ab2f3889affe8b47f4180ef2d0d6c94840836f79

C:\Windows\system\KSXAbBJ.exe

MD5	c46c11d0839dd6122f93277e7901624f
SHA1	23168a72d9c3b895c5cf5fe9aafdaa32b9d15794
SHA256	5e0d06c1e98485af0e35468b7c3fa8c3401b9cefdaa4bdb1c34559b6625b865d
SHA512	81ed3c05ead1cfe376414d782b80af0d7e602a7d4ee74b8ee887c9222506c407b96615aebb2c547dce1e1a33a7c57e610f2b9de9cf4dd91e8cb10b95e47b24a8

C:\Windows\system\hwdGIYC.exe

MD5	a99967dbf6f6f4f525c6573b2367c89d
SHA1	3547fcee5bcfaa681329a19cfa2a601b640f6ae3
SHA256	397cba4bd9a119eb76a9b687c5f24b7377d015402c6515f0c9818e8778522f66
SHA512	058daeee5c6eae6f4b1014274b9b45ede7003ec039b283b8130c9fa2c506e59f7e9cecf074ec6d7ba48b57b89464f06057b64aac1f452eb0e306363e2528d180

C:\Windows\system\iYMSRvn.exe

MD5	11fb6316c1c390c9d25d1fe3ad1a75e3
SHA1	3d7f8b3c9a0d2f8586cd558e5864c065329ab29d
SHA256	74ca3c3cfeb5239ba4084ab1a7eb16350b4bb84dfaa52dc25e3b93f0400996fd
SHA512	6d0f5dc866eceab26c59386a487f877f21febee2daa09a79e393a1674950110be9c5c3f7186ef6d3fbbbfca4efe475f6ab3f6ef270a9bcca79b1897fccdc45a0

C:\Windows\system\LmyAmPk.exe

MD5	7dcea0d19e522c18947d85a0bda8103a
SHA1	e81e90e8c27fb21c384a1786c5d79861fd852669
SHA256	04ec0cf4f9b5d1d7cd3a85627af792d40ad5677672a91bacf82ef805115daaec
SHA512	d93213430045db291d5426d89a8faa9bb123467b8afb76b134ba4c746427af8b34d2b7b5f8e2c290da398896eed56b2059e8777c60e3e8cc6e4c501b5be55e42

C:\Windows\system\IYgkMel.exe

MD5	a1777e3d2a3f6be5969a6a98e5cf7787
SHA1	7462df16ef429aa4182b2bb102ad9adc961d6bab
SHA256	e955ea1f0809607f5d5218025f05e1a17cf5432ff12209bc980b19a97db3dc35
SHA512	344eee98943438a8f1b9394fc36954969ef7cf63ed55394db86e8d7dd4b103849b3fd86dca146b5e059a7783c61eaf2c7342fcfa17485aef569568fc285612e2

C:\Windows\system\EPcxTxX.exe

MD5	abe02e175459051b1540ce2799e94fdb
SHA1	bc4b0993e130e281fb11ced9ef63dddb0e2fbe66
SHA256	84f65ae95854743a18ee145461e077ac7f8164a2ed4110359270568d2d31d5ba
SHA512	e2a6bf6b244760d311bca25a17ba8d0f7c9df0407e25a6c9b02a5c091c15833fb196fc9a903840c251f89c8d9eecb98e6434d3ea44b2e4ffb3b2ad1c8ecc62b8

C:\Windows\system\xtVWKUR.exe

MD5	c1ee86ab40c95a5b02010f182ea383b2
SHA1	2f0e624a4685f174422d5e7bc4f9417155297d07
SHA256	b0a78ca2a4d096d71f464d3a714e657f296bb79acf6eb83a5f373213c15230a6
SHA512	bd36b4ced4db63809734f945d993e91f944497ba9881ec1dd50fbc0dee9c8f3e6bff41b5e886f1e62aa98e7c2266acf732599784ef5724201f8a962f0b59dd93

C:\Windows\system\PmkvMDI.exe

MD5	d62ba040331efe5100fff269f79fc123
SHA1	06e74dfeed522de9c2e7b5488cac818c4c7575ba
SHA256	dfb145406c5c7bb5b560d095ae848f46b725347e0b38e83711b8152ca48da77d
SHA512	03c0f49294c681832ce4942b4d07bc72068bdda5bdf3e8f5ef9887b6dc13cfa08397d4faa8f387d5fa84ceb91ebdd224c1dead7c9474711aac692fdb71f02765

C:\Windows\system\rNexBJt.exe

MD5	d244effbd27312a0ba4c6b217bb40765
SHA1	fd52482c160a0cc1dd80af700da81ef51be4bd0d
SHA256	cfb7827f72d8773aff1c87aae16dfd7eab619d6be333379640d27fc04d5d4163
SHA512	e76caeb698bffd6fb0ffc20bf1bec5243b0cf2b042fd977db711c7b8c37fe4c6e5c2b02b0f744bcdcc1208fa67eb2305c6ce180620c7cc76e4180dfe6f5a3ba3

C:\Windows\system\RpwPfmv.exe

MD5	e5dbc5322b473d15955d5fd88c62ea7f
SHA1	5cf9215f49533288940f79b999566caed7bc5704
SHA256	6d5183cf5850683dbd813af724791d6b53aed08f0ecf7de1a48623abd8328fbd
SHA512	fb3f7bf3bd22209e5d97af2fe302f1961f66700ec98102300132ed2f6031a98a11595d96d787371c9a970e1e467b88ec723b2a1e89270a0761a207211b5a88ce

C:\Windows\system\YoHLgWw.exe

MD5	c34b6a49daeb876754590bc69f41ac67
SHA1	74eb2aaded692e41d4fbf66f11511fdf608c2995
SHA256	10c1ca0b784bad70af056e5d8780f8e9757dfb1a2352bd0043dedddb1be25650
SHA512	8c7027fd70d1dddc41bbedeb07435cc3c7c140261807a6910777780d183aba80de1b77f54f147c021fc5f8cbb7f495ae32e6dd09f6416390117d65f95ebc857f

C:\Windows\system\uXPPQAv.exe

MD5	0450fba8429ba7ca567ec08333bf54fa
SHA1	ad00561f08205c1d3a07427f129a485dc0c131f2
SHA256	bb1a097ad26aebb0736a39aad411fed4ea9805cb90307434a816afbbb652f9da
SHA512	12d3f56af2567caa19bf93fe7461c9cd70f2afffc982f57d1d15ce21e71bbfbe4038daf0faaf30f7cc6cfa1d049246c3f672d40a6abfc03401d59aee9cfab807

C:\Windows\system\DFKZBey.exe

MD5	669238eeeab0ca5d8f6a93b154cc870f
SHA1	40c61ca9dd4b9503fc536b95b1f4b223db46c17b
SHA256	b72b60a7161d3b7f37d76a2f58aee4f05f6180116ec01705c2220e6d4442cdf5
SHA512	5d3e17aedf348ca46c09628ac1a9c0e39789345069192b569a52764ff935abdde85ed1bf9f274cccad9b72a99d146dc504bc83cb60a7ccef97974535018043ef

memory/2568-3813-0x000000013F3C0000-0x000000013F714000-memory.dmp

memory/1936-3811-0x000000013F9B0000-0x000000013FD04000-memory.dmp

memory/1936-3972-0x000000013F500000-0x000000013F854000-memory.dmp

memory/1936-3973-0x000000013F410000-0x000000013F764000-memory.dmp

memory/1936-3974-0x000000013F290000-0x000000013F5E4000-memory.dmp

memory/1936-3975-0x0000000002000000-0x0000000002354000-memory.dmp

memory/1936-3976-0x0000000002000000-0x0000000002354000-memory.dmp

memory/1936-3977-0x0000000002000000-0x0000000002354000-memory.dmp

memory/1936-3978-0x000000013F3F0000-0x000000013F744000-memory.dmp

memory/1936-3984-0x000000013F150000-0x000000013F4A4000-memory.dmp

memory/1936-3983-0x000000013FFF0000-0x0000000140344000-memory.dmp

memory/1936-3982-0x000000013FEC0000-0x0000000140214000-memory.dmp

memory/1936-3981-0x000000013F1C0000-0x000000013F514000-memory.dmp

memory/1936-3980-0x000000013F1E0000-0x000000013F534000-memory.dmp

memory/1936-3979-0x0000000002000000-0x0000000002354000-memory.dmp

memory/1936-3985-0x000000013F370000-0x000000013F6C4000-memory.dmp

memory/2568-3986-0x000000013F3C0000-0x000000013F714000-memory.dmp

memory/2744-3987-0x000000013F500000-0x000000013F854000-memory.dmp

memory/2868-3988-0x000000013F720000-0x000000013FA74000-memory.dmp

memory/2476-3990-0x000000013F1E0000-0x000000013F534000-memory.dmp

memory/2808-3989-0x000000013F290000-0x000000013F5E4000-memory.dmp

memory/3008-3992-0x000000013F3F0000-0x000000013F744000-memory.dmp

memory/2168-3991-0x000000013FEC0000-0x0000000140214000-memory.dmp

memory/2620-3993-0x000000013F370000-0x000000013F6C4000-memory.dmp

memory/2716-3994-0x000000013F930000-0x000000013FC84000-memory.dmp

memory/2800-3995-0x000000013F410000-0x000000013F764000-memory.dmp

memory/2512-3996-0x000000013F980000-0x000000013FCD4000-memory.dmp

memory/2508-3997-0x000000013F1C0000-0x000000013F514000-memory.dmp

memory/2292-3998-0x000000013FFF0000-0x0000000140344000-memory.dmp

memory/2520-3999-0x000000013FC90000-0x000000013FFE4000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 22:11

Reported

2024-06-13 22:13

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\ZjZSELn.exe	N/A
N/A	N/A	C:\Windows\System\yUflscW.exe	N/A
N/A	N/A	C:\Windows\System\ewtELpB.exe	N/A
N/A	N/A	C:\Windows\System\OfgldBk.exe	N/A
N/A	N/A	C:\Windows\System\cftalch.exe	N/A
N/A	N/A	C:\Windows\System\HDPaagg.exe	N/A
N/A	N/A	C:\Windows\System\FdRpZgO.exe	N/A
N/A	N/A	C:\Windows\System\AwkIpGJ.exe	N/A
N/A	N/A	C:\Windows\System\aYyaMwq.exe	N/A
N/A	N/A	C:\Windows\System\SyKVIcP.exe	N/A
N/A	N/A	C:\Windows\System\nBcgahq.exe	N/A
N/A	N/A	C:\Windows\System\rnanhrk.exe	N/A
N/A	N/A	C:\Windows\System\WuAHgIu.exe	N/A
N/A	N/A	C:\Windows\System\esNCesN.exe	N/A
N/A	N/A	C:\Windows\System\wSGLNbt.exe	N/A
N/A	N/A	C:\Windows\System\zWitftR.exe	N/A
N/A	N/A	C:\Windows\System\jwhpBAa.exe	N/A
N/A	N/A	C:\Windows\System\BUGwbWd.exe	N/A
N/A	N/A	C:\Windows\System\txgxDxC.exe	N/A
N/A	N/A	C:\Windows\System\SegeiLh.exe	N/A
N/A	N/A	C:\Windows\System\lSUpYGL.exe	N/A
N/A	N/A	C:\Windows\System\vJCdXUv.exe	N/A
N/A	N/A	C:\Windows\System\jhpQMZs.exe	N/A
N/A	N/A	C:\Windows\System\iLvaTZp.exe	N/A
N/A	N/A	C:\Windows\System\LmiUons.exe	N/A
N/A	N/A	C:\Windows\System\nzqtBJD.exe	N/A
N/A	N/A	C:\Windows\System\efJhDqZ.exe	N/A
N/A	N/A	C:\Windows\System\IcodiDG.exe	N/A
N/A	N/A	C:\Windows\System\ZkLedwQ.exe	N/A
N/A	N/A	C:\Windows\System\ZANxlYN.exe	N/A
N/A	N/A	C:\Windows\System\JlFvlJt.exe	N/A
N/A	N/A	C:\Windows\System\RrPEaMf.exe	N/A
N/A	N/A	C:\Windows\System\DsmwDkt.exe	N/A
N/A	N/A	C:\Windows\System\EabinBK.exe	N/A
N/A	N/A	C:\Windows\System\tziKHZd.exe	N/A
N/A	N/A	C:\Windows\System\xrCTTwU.exe	N/A
N/A	N/A	C:\Windows\System\nbqtIit.exe	N/A
N/A	N/A	C:\Windows\System\EMJtsyK.exe	N/A
N/A	N/A	C:\Windows\System\gWxdqrQ.exe	N/A
N/A	N/A	C:\Windows\System\TlwOwnZ.exe	N/A
N/A	N/A	C:\Windows\System\ESRmRIe.exe	N/A
N/A	N/A	C:\Windows\System\GuBaXkJ.exe	N/A
N/A	N/A	C:\Windows\System\ePQoRBB.exe	N/A
N/A	N/A	C:\Windows\System\vjJTTKP.exe	N/A
N/A	N/A	C:\Windows\System\OOcVstp.exe	N/A
N/A	N/A	C:\Windows\System\MzQnaKQ.exe	N/A
N/A	N/A	C:\Windows\System\nFVSCXo.exe	N/A
N/A	N/A	C:\Windows\System\bsaGOOR.exe	N/A
N/A	N/A	C:\Windows\System\RYFMdRN.exe	N/A
N/A	N/A	C:\Windows\System\xJsJMvi.exe	N/A
N/A	N/A	C:\Windows\System\vFkrQTE.exe	N/A
N/A	N/A	C:\Windows\System\oaUlbgL.exe	N/A
N/A	N/A	C:\Windows\System\zbImxsp.exe	N/A
N/A	N/A	C:\Windows\System\pFPNrNi.exe	N/A
N/A	N/A	C:\Windows\System\Hrsvgul.exe	N/A
N/A	N/A	C:\Windows\System\zsQjtmN.exe	N/A
N/A	N/A	C:\Windows\System\REBZAzJ.exe	N/A
N/A	N/A	C:\Windows\System\TLlmdhh.exe	N/A
N/A	N/A	C:\Windows\System\KBOdIeA.exe	N/A
N/A	N/A	C:\Windows\System\YMsmheN.exe	N/A
N/A	N/A	C:\Windows\System\jItbcID.exe	N/A
N/A	N/A	C:\Windows\System\oOTqToy.exe	N/A
N/A	N/A	C:\Windows\System\DYjGMcl.exe	N/A
N/A	N/A	C:\Windows\System\vxIafDf.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\txgxDxC.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SyGnlCf.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UhVuNGw.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cfJzLhs.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AixEjPt.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\asbPUYd.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bVgTorb.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hJhNPVB.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DlEthNZ.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mfjDnOk.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YuVBbWu.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RUZDnZy.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WRPafRQ.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VaMnnnJ.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fEWBwop.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zPnCsOr.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KDGdgKn.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZLfcsFN.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BlAOPJF.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lXfMUVg.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sOATJxD.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ApYUbPU.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yUflscW.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EoQKjQW.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kAZSHlS.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DljGBQd.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tmtvOCw.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AhrtStc.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QbTRfeD.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jhpQMZs.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zZVgHzn.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ngovRYt.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QrbZgLo.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zHbjNlJ.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zuKMFRz.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PeBcRot.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xiTXGjc.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FdwXIXc.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gJUUfRS.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gTtxpuh.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QvNPYLa.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qubpqnE.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pobAiSn.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HDPaagg.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TSDGGfL.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JTxkQHG.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XgUhran.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cEoAbLW.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MzQnaKQ.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hsrRxCq.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ratYduC.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OJBgTIb.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CGjOrzQ.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zaJnZkQ.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ORpJChS.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bVEpofL.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pskCdFl.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YIIMwoo.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lHvMZyP.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AZYNXPT.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sUNvAFh.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dHyHqLu.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rxFYdhP.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TlwOwnZ.exe	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 5056 wrote to memory of 928	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\ZjZSELn.exe
PID 5056 wrote to memory of 928	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\ZjZSELn.exe
PID 5056 wrote to memory of 4088	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\yUflscW.exe
PID 5056 wrote to memory of 4088	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\yUflscW.exe
PID 5056 wrote to memory of 2556	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\ewtELpB.exe
PID 5056 wrote to memory of 2556	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\ewtELpB.exe
PID 5056 wrote to memory of 3040	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\cftalch.exe
PID 5056 wrote to memory of 3040	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\cftalch.exe
PID 5056 wrote to memory of 424	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\OfgldBk.exe
PID 5056 wrote to memory of 424	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\OfgldBk.exe
PID 5056 wrote to memory of 3104	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\HDPaagg.exe
PID 5056 wrote to memory of 3104	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\HDPaagg.exe
PID 5056 wrote to memory of 2848	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\FdRpZgO.exe
PID 5056 wrote to memory of 2848	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\FdRpZgO.exe
PID 5056 wrote to memory of 4960	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\AwkIpGJ.exe
PID 5056 wrote to memory of 4960	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\AwkIpGJ.exe
PID 5056 wrote to memory of 2924	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\aYyaMwq.exe
PID 5056 wrote to memory of 2924	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\aYyaMwq.exe
PID 5056 wrote to memory of 3652	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\SyKVIcP.exe
PID 5056 wrote to memory of 3652	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\SyKVIcP.exe
PID 5056 wrote to memory of 4940	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\nBcgahq.exe
PID 5056 wrote to memory of 4940	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\nBcgahq.exe
PID 5056 wrote to memory of 1628	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\rnanhrk.exe
PID 5056 wrote to memory of 1628	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\rnanhrk.exe
PID 5056 wrote to memory of 1080	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\WuAHgIu.exe
PID 5056 wrote to memory of 1080	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\WuAHgIu.exe
PID 5056 wrote to memory of 3684	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\esNCesN.exe
PID 5056 wrote to memory of 3684	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\esNCesN.exe
PID 5056 wrote to memory of 4404	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\wSGLNbt.exe
PID 5056 wrote to memory of 4404	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\wSGLNbt.exe
PID 5056 wrote to memory of 2864	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\zWitftR.exe
PID 5056 wrote to memory of 2864	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\zWitftR.exe
PID 5056 wrote to memory of 3568	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\jwhpBAa.exe
PID 5056 wrote to memory of 3568	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\jwhpBAa.exe
PID 5056 wrote to memory of 4156	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\BUGwbWd.exe
PID 5056 wrote to memory of 4156	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\BUGwbWd.exe
PID 5056 wrote to memory of 4372	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\txgxDxC.exe
PID 5056 wrote to memory of 4372	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\txgxDxC.exe
PID 5056 wrote to memory of 3164	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\SegeiLh.exe
PID 5056 wrote to memory of 3164	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\SegeiLh.exe
PID 5056 wrote to memory of 5072	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\lSUpYGL.exe
PID 5056 wrote to memory of 5072	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\lSUpYGL.exe
PID 5056 wrote to memory of 4784	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\vJCdXUv.exe
PID 5056 wrote to memory of 4784	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\vJCdXUv.exe
PID 5056 wrote to memory of 3612	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\jhpQMZs.exe
PID 5056 wrote to memory of 3612	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\jhpQMZs.exe
PID 5056 wrote to memory of 4756	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\iLvaTZp.exe
PID 5056 wrote to memory of 4756	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\iLvaTZp.exe
PID 5056 wrote to memory of 8	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\LmiUons.exe
PID 5056 wrote to memory of 8	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\LmiUons.exe
PID 5056 wrote to memory of 2388	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\nzqtBJD.exe
PID 5056 wrote to memory of 2388	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\nzqtBJD.exe
PID 5056 wrote to memory of 4496	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\efJhDqZ.exe
PID 5056 wrote to memory of 4496	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\efJhDqZ.exe
PID 5056 wrote to memory of 3932	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\IcodiDG.exe
PID 5056 wrote to memory of 3932	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\IcodiDG.exe
PID 5056 wrote to memory of 392	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\ZkLedwQ.exe
PID 5056 wrote to memory of 392	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\ZkLedwQ.exe
PID 5056 wrote to memory of 1444	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\ZANxlYN.exe
PID 5056 wrote to memory of 1444	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\ZANxlYN.exe
PID 5056 wrote to memory of 4460	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\JlFvlJt.exe
PID 5056 wrote to memory of 4460	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\JlFvlJt.exe
PID 5056 wrote to memory of 3136	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\RrPEaMf.exe
PID 5056 wrote to memory of 3136	N/A	C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe	C:\Windows\System\RrPEaMf.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe"

C:\Windows\System\ZjZSELn.exe

C:\Windows\System\ZjZSELn.exe

C:\Windows\System\yUflscW.exe

C:\Windows\System\yUflscW.exe

C:\Windows\System\ewtELpB.exe

C:\Windows\System\ewtELpB.exe

C:\Windows\System\cftalch.exe

C:\Windows\System\cftalch.exe

C:\Windows\System\OfgldBk.exe

C:\Windows\System\OfgldBk.exe

C:\Windows\System\HDPaagg.exe

C:\Windows\System\HDPaagg.exe

C:\Windows\System\FdRpZgO.exe

C:\Windows\System\FdRpZgO.exe

C:\Windows\System\AwkIpGJ.exe

C:\Windows\System\AwkIpGJ.exe

C:\Windows\System\aYyaMwq.exe

C:\Windows\System\aYyaMwq.exe

C:\Windows\System\SyKVIcP.exe

C:\Windows\System\SyKVIcP.exe

C:\Windows\System\nBcgahq.exe

C:\Windows\System\nBcgahq.exe

C:\Windows\System\rnanhrk.exe

C:\Windows\System\rnanhrk.exe

C:\Windows\System\WuAHgIu.exe

C:\Windows\System\WuAHgIu.exe

C:\Windows\System\esNCesN.exe

C:\Windows\System\esNCesN.exe

C:\Windows\System\wSGLNbt.exe

C:\Windows\System\wSGLNbt.exe

C:\Windows\System\zWitftR.exe

C:\Windows\System\zWitftR.exe

C:\Windows\System\jwhpBAa.exe

C:\Windows\System\jwhpBAa.exe

C:\Windows\System\BUGwbWd.exe

C:\Windows\System\BUGwbWd.exe

C:\Windows\System\txgxDxC.exe

C:\Windows\System\txgxDxC.exe

C:\Windows\System\SegeiLh.exe

C:\Windows\System\SegeiLh.exe

C:\Windows\System\lSUpYGL.exe

C:\Windows\System\lSUpYGL.exe

C:\Windows\System\vJCdXUv.exe

C:\Windows\System\vJCdXUv.exe

C:\Windows\System\jhpQMZs.exe

C:\Windows\System\jhpQMZs.exe

C:\Windows\System\iLvaTZp.exe

C:\Windows\System\iLvaTZp.exe

C:\Windows\System\LmiUons.exe

C:\Windows\System\LmiUons.exe

C:\Windows\System\nzqtBJD.exe

C:\Windows\System\nzqtBJD.exe

C:\Windows\System\efJhDqZ.exe

C:\Windows\System\efJhDqZ.exe

C:\Windows\System\IcodiDG.exe

C:\Windows\System\IcodiDG.exe

C:\Windows\System\ZkLedwQ.exe

C:\Windows\System\ZkLedwQ.exe

C:\Windows\System\ZANxlYN.exe

C:\Windows\System\ZANxlYN.exe

C:\Windows\System\JlFvlJt.exe

C:\Windows\System\JlFvlJt.exe

C:\Windows\System\RrPEaMf.exe

C:\Windows\System\RrPEaMf.exe

C:\Windows\System\DsmwDkt.exe

C:\Windows\System\DsmwDkt.exe

C:\Windows\System\EabinBK.exe

C:\Windows\System\EabinBK.exe

C:\Windows\System\tziKHZd.exe

C:\Windows\System\tziKHZd.exe

C:\Windows\System\xrCTTwU.exe

C:\Windows\System\xrCTTwU.exe

C:\Windows\System\nbqtIit.exe

C:\Windows\System\nbqtIit.exe

C:\Windows\System\EMJtsyK.exe

C:\Windows\System\EMJtsyK.exe

C:\Windows\System\gWxdqrQ.exe

C:\Windows\System\gWxdqrQ.exe

C:\Windows\System\TlwOwnZ.exe

C:\Windows\System\TlwOwnZ.exe

C:\Windows\System\ESRmRIe.exe

C:\Windows\System\ESRmRIe.exe

C:\Windows\System\GuBaXkJ.exe

C:\Windows\System\GuBaXkJ.exe

C:\Windows\System\ePQoRBB.exe

C:\Windows\System\ePQoRBB.exe

C:\Windows\System\vjJTTKP.exe

C:\Windows\System\vjJTTKP.exe

C:\Windows\System\OOcVstp.exe

C:\Windows\System\OOcVstp.exe

C:\Windows\System\MzQnaKQ.exe

C:\Windows\System\MzQnaKQ.exe

C:\Windows\System\nFVSCXo.exe

C:\Windows\System\nFVSCXo.exe

C:\Windows\System\bsaGOOR.exe

C:\Windows\System\bsaGOOR.exe

C:\Windows\System\RYFMdRN.exe

C:\Windows\System\RYFMdRN.exe

C:\Windows\System\xJsJMvi.exe

C:\Windows\System\xJsJMvi.exe

C:\Windows\System\vFkrQTE.exe

C:\Windows\System\vFkrQTE.exe

C:\Windows\System\oaUlbgL.exe

C:\Windows\System\oaUlbgL.exe

C:\Windows\System\zbImxsp.exe

C:\Windows\System\zbImxsp.exe

C:\Windows\System\pFPNrNi.exe

C:\Windows\System\pFPNrNi.exe

C:\Windows\System\Hrsvgul.exe

C:\Windows\System\Hrsvgul.exe

C:\Windows\System\zsQjtmN.exe

C:\Windows\System\zsQjtmN.exe

C:\Windows\System\REBZAzJ.exe

C:\Windows\System\REBZAzJ.exe

C:\Windows\System\TLlmdhh.exe

C:\Windows\System\TLlmdhh.exe

C:\Windows\System\KBOdIeA.exe

C:\Windows\System\KBOdIeA.exe

C:\Windows\System\YMsmheN.exe

C:\Windows\System\YMsmheN.exe

C:\Windows\System\jItbcID.exe

C:\Windows\System\jItbcID.exe

C:\Windows\System\oOTqToy.exe

C:\Windows\System\oOTqToy.exe

C:\Windows\System\DYjGMcl.exe

C:\Windows\System\DYjGMcl.exe

C:\Windows\System\vxIafDf.exe

C:\Windows\System\vxIafDf.exe

C:\Windows\System\iAeWRlv.exe

C:\Windows\System\iAeWRlv.exe

C:\Windows\System\zzEbMKJ.exe

C:\Windows\System\zzEbMKJ.exe

C:\Windows\System\XeEAHiM.exe

C:\Windows\System\XeEAHiM.exe

C:\Windows\System\EKZTNIg.exe

C:\Windows\System\EKZTNIg.exe

C:\Windows\System\EHoDYDM.exe

C:\Windows\System\EHoDYDM.exe

C:\Windows\System\jwxzPPD.exe

C:\Windows\System\jwxzPPD.exe

C:\Windows\System\FhPGbxt.exe

C:\Windows\System\FhPGbxt.exe

C:\Windows\System\UwqxMTI.exe

C:\Windows\System\UwqxMTI.exe

C:\Windows\System\lEyoSRw.exe

C:\Windows\System\lEyoSRw.exe

C:\Windows\System\bEtQOFf.exe

C:\Windows\System\bEtQOFf.exe

C:\Windows\System\EoQKjQW.exe

C:\Windows\System\EoQKjQW.exe

C:\Windows\System\diRolsl.exe

C:\Windows\System\diRolsl.exe

C:\Windows\System\jCxmfSm.exe

C:\Windows\System\jCxmfSm.exe

C:\Windows\System\QPKoClN.exe

C:\Windows\System\QPKoClN.exe

C:\Windows\System\hWhRtxl.exe

C:\Windows\System\hWhRtxl.exe

C:\Windows\System\RKDjcNU.exe

C:\Windows\System\RKDjcNU.exe

C:\Windows\System\WuREUnP.exe

C:\Windows\System\WuREUnP.exe

C:\Windows\System\XMtXaxL.exe

C:\Windows\System\XMtXaxL.exe

C:\Windows\System\SyGnlCf.exe

C:\Windows\System\SyGnlCf.exe

C:\Windows\System\yTNxKSL.exe

C:\Windows\System\yTNxKSL.exe

C:\Windows\System\jqpOGga.exe

C:\Windows\System\jqpOGga.exe

C:\Windows\System\arMelAX.exe

C:\Windows\System\arMelAX.exe

C:\Windows\System\GWmlxzi.exe

C:\Windows\System\GWmlxzi.exe

C:\Windows\System\TJSkmPc.exe

C:\Windows\System\TJSkmPc.exe

C:\Windows\System\ifJHwBh.exe

C:\Windows\System\ifJHwBh.exe

C:\Windows\System\KLfWeNI.exe

C:\Windows\System\KLfWeNI.exe

C:\Windows\System\SvXlxQu.exe

C:\Windows\System\SvXlxQu.exe

C:\Windows\System\eorzYtO.exe

C:\Windows\System\eorzYtO.exe

C:\Windows\System\jtGBTrf.exe

C:\Windows\System\jtGBTrf.exe

C:\Windows\System\zZVgHzn.exe

C:\Windows\System\zZVgHzn.exe

C:\Windows\System\wuPUvDC.exe

C:\Windows\System\wuPUvDC.exe

C:\Windows\System\TKdFiNY.exe

C:\Windows\System\TKdFiNY.exe

C:\Windows\System\SgrtYlB.exe

C:\Windows\System\SgrtYlB.exe

C:\Windows\System\ZlwTwzm.exe

C:\Windows\System\ZlwTwzm.exe

C:\Windows\System\mxVtZUC.exe

C:\Windows\System\mxVtZUC.exe

C:\Windows\System\EIWtsQM.exe

C:\Windows\System\EIWtsQM.exe

C:\Windows\System\sRdXirc.exe

C:\Windows\System\sRdXirc.exe

C:\Windows\System\ngovRYt.exe

C:\Windows\System\ngovRYt.exe

C:\Windows\System\tCNNORd.exe

C:\Windows\System\tCNNORd.exe

C:\Windows\System\fmGSout.exe

C:\Windows\System\fmGSout.exe

C:\Windows\System\hXffVvT.exe

C:\Windows\System\hXffVvT.exe

C:\Windows\System\tjLmMcZ.exe

C:\Windows\System\tjLmMcZ.exe

C:\Windows\System\BUDuiOc.exe

C:\Windows\System\BUDuiOc.exe

C:\Windows\System\DjGrWIf.exe

C:\Windows\System\DjGrWIf.exe

C:\Windows\System\LBiWkbm.exe

C:\Windows\System\LBiWkbm.exe

C:\Windows\System\zsHVQdj.exe

C:\Windows\System\zsHVQdj.exe

C:\Windows\System\mAEtqYg.exe

C:\Windows\System\mAEtqYg.exe

C:\Windows\System\spicDOm.exe

C:\Windows\System\spicDOm.exe

C:\Windows\System\bVEpofL.exe

C:\Windows\System\bVEpofL.exe

C:\Windows\System\GFHihzh.exe

C:\Windows\System\GFHihzh.exe

C:\Windows\System\rSaQetn.exe

C:\Windows\System\rSaQetn.exe

C:\Windows\System\YuVBbWu.exe

C:\Windows\System\YuVBbWu.exe

C:\Windows\System\cJfDyRP.exe

C:\Windows\System\cJfDyRP.exe

C:\Windows\System\aqMrZJf.exe

C:\Windows\System\aqMrZJf.exe

C:\Windows\System\fBPkaCl.exe

C:\Windows\System\fBPkaCl.exe

C:\Windows\System\wqvfhdK.exe

C:\Windows\System\wqvfhdK.exe

C:\Windows\System\xiTXGjc.exe

C:\Windows\System\xiTXGjc.exe

C:\Windows\System\QiVLiMd.exe

C:\Windows\System\QiVLiMd.exe

C:\Windows\System\bHGNFyI.exe

C:\Windows\System\bHGNFyI.exe

C:\Windows\System\nhoTdOf.exe

C:\Windows\System\nhoTdOf.exe

C:\Windows\System\dMoBHMI.exe

C:\Windows\System\dMoBHMI.exe

C:\Windows\System\yvpEjBL.exe

C:\Windows\System\yvpEjBL.exe

C:\Windows\System\OoFdOzK.exe

C:\Windows\System\OoFdOzK.exe

C:\Windows\System\XaMvDzj.exe

C:\Windows\System\XaMvDzj.exe

C:\Windows\System\MDaEnuE.exe

C:\Windows\System\MDaEnuE.exe

C:\Windows\System\TbuWiJa.exe

C:\Windows\System\TbuWiJa.exe

C:\Windows\System\JALJFSK.exe

C:\Windows\System\JALJFSK.exe

C:\Windows\System\BSUWGAl.exe

C:\Windows\System\BSUWGAl.exe

C:\Windows\System\KataNaT.exe

C:\Windows\System\KataNaT.exe

C:\Windows\System\hILawGL.exe

C:\Windows\System\hILawGL.exe

C:\Windows\System\uqABpld.exe

C:\Windows\System\uqABpld.exe

C:\Windows\System\cZgkJez.exe

C:\Windows\System\cZgkJez.exe

C:\Windows\System\LieJIRn.exe

C:\Windows\System\LieJIRn.exe

C:\Windows\System\crmYBQe.exe

C:\Windows\System\crmYBQe.exe

C:\Windows\System\KbVJqwB.exe

C:\Windows\System\KbVJqwB.exe

C:\Windows\System\hSjEhof.exe

C:\Windows\System\hSjEhof.exe

C:\Windows\System\ghDKAVt.exe

C:\Windows\System\ghDKAVt.exe

C:\Windows\System\sFGBfKG.exe

C:\Windows\System\sFGBfKG.exe

C:\Windows\System\vUzFayC.exe

C:\Windows\System\vUzFayC.exe

C:\Windows\System\vBBaUHx.exe

C:\Windows\System\vBBaUHx.exe

C:\Windows\System\DdwyOVF.exe

C:\Windows\System\DdwyOVF.exe

C:\Windows\System\EsUikyU.exe

C:\Windows\System\EsUikyU.exe

C:\Windows\System\mbEGdxT.exe

C:\Windows\System\mbEGdxT.exe

C:\Windows\System\taZaZVf.exe

C:\Windows\System\taZaZVf.exe

C:\Windows\System\ZlyQZHf.exe

C:\Windows\System\ZlyQZHf.exe

C:\Windows\System\yywtXcg.exe

C:\Windows\System\yywtXcg.exe

C:\Windows\System\fUjadxB.exe

C:\Windows\System\fUjadxB.exe

C:\Windows\System\VChSCgy.exe

C:\Windows\System\VChSCgy.exe

C:\Windows\System\PrsVQYi.exe

C:\Windows\System\PrsVQYi.exe

C:\Windows\System\FHKDHKM.exe

C:\Windows\System\FHKDHKM.exe

C:\Windows\System\hsrRxCq.exe

C:\Windows\System\hsrRxCq.exe

C:\Windows\System\OCBrXgm.exe

C:\Windows\System\OCBrXgm.exe

C:\Windows\System\dBNtsvG.exe

C:\Windows\System\dBNtsvG.exe

C:\Windows\System\rktWaGy.exe

C:\Windows\System\rktWaGy.exe

C:\Windows\System\NlMgEWo.exe

C:\Windows\System\NlMgEWo.exe

C:\Windows\System\yRDjlvk.exe

C:\Windows\System\yRDjlvk.exe

C:\Windows\System\MmrViGb.exe

C:\Windows\System\MmrViGb.exe

C:\Windows\System\WUHtXwp.exe

C:\Windows\System\WUHtXwp.exe

C:\Windows\System\oDVoQwR.exe

C:\Windows\System\oDVoQwR.exe

C:\Windows\System\JThSUHt.exe

C:\Windows\System\JThSUHt.exe

C:\Windows\System\wHtaGdr.exe

C:\Windows\System\wHtaGdr.exe

C:\Windows\System\YyBAGbZ.exe

C:\Windows\System\YyBAGbZ.exe

C:\Windows\System\EUDsrPk.exe

C:\Windows\System\EUDsrPk.exe

C:\Windows\System\UmtramZ.exe

C:\Windows\System\UmtramZ.exe

C:\Windows\System\nWPXtVV.exe

C:\Windows\System\nWPXtVV.exe

C:\Windows\System\YHGaOlX.exe

C:\Windows\System\YHGaOlX.exe

C:\Windows\System\NAXeMmX.exe

C:\Windows\System\NAXeMmX.exe

C:\Windows\System\kAlmUnr.exe

C:\Windows\System\kAlmUnr.exe

C:\Windows\System\cVJISHG.exe

C:\Windows\System\cVJISHG.exe

C:\Windows\System\ImAtSsD.exe

C:\Windows\System\ImAtSsD.exe

C:\Windows\System\glhKrVO.exe

C:\Windows\System\glhKrVO.exe

C:\Windows\System\QerbNef.exe

C:\Windows\System\QerbNef.exe

C:\Windows\System\rfLEzhF.exe

C:\Windows\System\rfLEzhF.exe

C:\Windows\System\YZXobUs.exe

C:\Windows\System\YZXobUs.exe

C:\Windows\System\UmRJXkw.exe

C:\Windows\System\UmRJXkw.exe

C:\Windows\System\dLgsONT.exe

C:\Windows\System\dLgsONT.exe

C:\Windows\System\QrbZgLo.exe

C:\Windows\System\QrbZgLo.exe

C:\Windows\System\qUMXPYU.exe

C:\Windows\System\qUMXPYU.exe

C:\Windows\System\mgKLICm.exe

C:\Windows\System\mgKLICm.exe

C:\Windows\System\WLkAqnF.exe

C:\Windows\System\WLkAqnF.exe

C:\Windows\System\nOHgobw.exe

C:\Windows\System\nOHgobw.exe

C:\Windows\System\lQWhloQ.exe

C:\Windows\System\lQWhloQ.exe

C:\Windows\System\wJcJIwE.exe

C:\Windows\System\wJcJIwE.exe

C:\Windows\System\nDoXJCn.exe

C:\Windows\System\nDoXJCn.exe

C:\Windows\System\rkAXdhU.exe

C:\Windows\System\rkAXdhU.exe

C:\Windows\System\nzGVLld.exe

C:\Windows\System\nzGVLld.exe

C:\Windows\System\WxpenUB.exe

C:\Windows\System\WxpenUB.exe

C:\Windows\System\jPNVUwL.exe

C:\Windows\System\jPNVUwL.exe

C:\Windows\System\xspBZHq.exe

C:\Windows\System\xspBZHq.exe

C:\Windows\System\QFFuyiq.exe

C:\Windows\System\QFFuyiq.exe

C:\Windows\System\TSDGGfL.exe

C:\Windows\System\TSDGGfL.exe

C:\Windows\System\tnvgnrK.exe

C:\Windows\System\tnvgnrK.exe

C:\Windows\System\JaYJwzx.exe

C:\Windows\System\JaYJwzx.exe

C:\Windows\System\ZYxYpYY.exe

C:\Windows\System\ZYxYpYY.exe

C:\Windows\System\GUEvjMH.exe

C:\Windows\System\GUEvjMH.exe

C:\Windows\System\FdwXIXc.exe

C:\Windows\System\FdwXIXc.exe

C:\Windows\System\SiMZzhc.exe

C:\Windows\System\SiMZzhc.exe

C:\Windows\System\dJolvEc.exe

C:\Windows\System\dJolvEc.exe

C:\Windows\System\zFHJgGP.exe

C:\Windows\System\zFHJgGP.exe

C:\Windows\System\QZsiGMv.exe

C:\Windows\System\QZsiGMv.exe

C:\Windows\System\RsbGzCr.exe

C:\Windows\System\RsbGzCr.exe

C:\Windows\System\qHJVnXM.exe

C:\Windows\System\qHJVnXM.exe

C:\Windows\System\wMEcGLQ.exe

C:\Windows\System\wMEcGLQ.exe

C:\Windows\System\hQdJWfy.exe

C:\Windows\System\hQdJWfy.exe

C:\Windows\System\aWuSpDo.exe

C:\Windows\System\aWuSpDo.exe

C:\Windows\System\WEVOslM.exe

C:\Windows\System\WEVOslM.exe

C:\Windows\System\nzAdLWK.exe

C:\Windows\System\nzAdLWK.exe

C:\Windows\System\xCQSVnQ.exe

C:\Windows\System\xCQSVnQ.exe

C:\Windows\System\sttGjtw.exe

C:\Windows\System\sttGjtw.exe

C:\Windows\System\BTczNLL.exe

C:\Windows\System\BTczNLL.exe

C:\Windows\System\XQrYVjV.exe

C:\Windows\System\XQrYVjV.exe

C:\Windows\System\KDGdgKn.exe

C:\Windows\System\KDGdgKn.exe

C:\Windows\System\zjPVMiJ.exe

C:\Windows\System\zjPVMiJ.exe

C:\Windows\System\UnyhxRT.exe

C:\Windows\System\UnyhxRT.exe

C:\Windows\System\tczOfTJ.exe

C:\Windows\System\tczOfTJ.exe

C:\Windows\System\UhVuNGw.exe

C:\Windows\System\UhVuNGw.exe

C:\Windows\System\nBOuDiI.exe

C:\Windows\System\nBOuDiI.exe

C:\Windows\System\QUMyksf.exe

C:\Windows\System\QUMyksf.exe

C:\Windows\System\lBUqaDL.exe

C:\Windows\System\lBUqaDL.exe

C:\Windows\System\QYbNRII.exe

C:\Windows\System\QYbNRII.exe

C:\Windows\System\ottfEvV.exe

C:\Windows\System\ottfEvV.exe

C:\Windows\System\vzzXsRf.exe

C:\Windows\System\vzzXsRf.exe

C:\Windows\System\xMKfiOg.exe

C:\Windows\System\xMKfiOg.exe

C:\Windows\System\MHvyxag.exe

C:\Windows\System\MHvyxag.exe

C:\Windows\System\gwWqEhU.exe

C:\Windows\System\gwWqEhU.exe

C:\Windows\System\UOeHbZf.exe

C:\Windows\System\UOeHbZf.exe

C:\Windows\System\hvZdbpB.exe

C:\Windows\System\hvZdbpB.exe

C:\Windows\System\gWxQmDs.exe

C:\Windows\System\gWxQmDs.exe

C:\Windows\System\kinCdfc.exe

C:\Windows\System\kinCdfc.exe

C:\Windows\System\DbWfHZt.exe

C:\Windows\System\DbWfHZt.exe

C:\Windows\System\AUYaRXl.exe

C:\Windows\System\AUYaRXl.exe

C:\Windows\System\AvgEbsS.exe

C:\Windows\System\AvgEbsS.exe

C:\Windows\System\RUZDnZy.exe

C:\Windows\System\RUZDnZy.exe

C:\Windows\System\zppAlOv.exe

C:\Windows\System\zppAlOv.exe

C:\Windows\System\wsOKPus.exe

C:\Windows\System\wsOKPus.exe

C:\Windows\System\YqRrSxE.exe

C:\Windows\System\YqRrSxE.exe

C:\Windows\System\lvUGWWx.exe

C:\Windows\System\lvUGWWx.exe

C:\Windows\System\qwUKIny.exe

C:\Windows\System\qwUKIny.exe

C:\Windows\System\RqlzSKJ.exe

C:\Windows\System\RqlzSKJ.exe

C:\Windows\System\NWXhGDA.exe

C:\Windows\System\NWXhGDA.exe

C:\Windows\System\ZgYURPI.exe

C:\Windows\System\ZgYURPI.exe

C:\Windows\System\UMorKLP.exe

C:\Windows\System\UMorKLP.exe

C:\Windows\System\etLNnVg.exe

C:\Windows\System\etLNnVg.exe

C:\Windows\System\ngRpZGA.exe

C:\Windows\System\ngRpZGA.exe

C:\Windows\System\nbPDjzZ.exe

C:\Windows\System\nbPDjzZ.exe

C:\Windows\System\SuJfWBf.exe

C:\Windows\System\SuJfWBf.exe

C:\Windows\System\yTwCVjH.exe

C:\Windows\System\yTwCVjH.exe

C:\Windows\System\rgKVmmH.exe

C:\Windows\System\rgKVmmH.exe

C:\Windows\System\WcmWpEk.exe

C:\Windows\System\WcmWpEk.exe

C:\Windows\System\msXpgpE.exe

C:\Windows\System\msXpgpE.exe

C:\Windows\System\hYZRdit.exe

C:\Windows\System\hYZRdit.exe

C:\Windows\System\ofkcIre.exe

C:\Windows\System\ofkcIre.exe

C:\Windows\System\kubsnbB.exe

C:\Windows\System\kubsnbB.exe

C:\Windows\System\BAhnUVa.exe

C:\Windows\System\BAhnUVa.exe

C:\Windows\System\wzFwIaA.exe

C:\Windows\System\wzFwIaA.exe

C:\Windows\System\XrQhcSN.exe

C:\Windows\System\XrQhcSN.exe

C:\Windows\System\rRjRBWa.exe

C:\Windows\System\rRjRBWa.exe

C:\Windows\System\ojhJiCa.exe

C:\Windows\System\ojhJiCa.exe

C:\Windows\System\glnUiAa.exe

C:\Windows\System\glnUiAa.exe

C:\Windows\System\pskCdFl.exe

C:\Windows\System\pskCdFl.exe

C:\Windows\System\IDOXlJR.exe

C:\Windows\System\IDOXlJR.exe

C:\Windows\System\mmauzat.exe

C:\Windows\System\mmauzat.exe

C:\Windows\System\VObNDmR.exe

C:\Windows\System\VObNDmR.exe

C:\Windows\System\UcgPCcs.exe

C:\Windows\System\UcgPCcs.exe

C:\Windows\System\KHvbVEo.exe

C:\Windows\System\KHvbVEo.exe

C:\Windows\System\vwUrsXo.exe

C:\Windows\System\vwUrsXo.exe

C:\Windows\System\LZAVvHz.exe

C:\Windows\System\LZAVvHz.exe

C:\Windows\System\gelxiQh.exe

C:\Windows\System\gelxiQh.exe

C:\Windows\System\oYbhgoJ.exe

C:\Windows\System\oYbhgoJ.exe

C:\Windows\System\cjeHRRI.exe

C:\Windows\System\cjeHRRI.exe

C:\Windows\System\cDJFPQA.exe

C:\Windows\System\cDJFPQA.exe

C:\Windows\System\wnKRRRC.exe

C:\Windows\System\wnKRRRC.exe

C:\Windows\System\WoRlvkg.exe

C:\Windows\System\WoRlvkg.exe

C:\Windows\System\eyLnkhe.exe

C:\Windows\System\eyLnkhe.exe

C:\Windows\System\QGuepgK.exe

C:\Windows\System\QGuepgK.exe

C:\Windows\System\oMsphWM.exe

C:\Windows\System\oMsphWM.exe

C:\Windows\System\QuUrELM.exe

C:\Windows\System\QuUrELM.exe

C:\Windows\System\zHbjNlJ.exe

C:\Windows\System\zHbjNlJ.exe

C:\Windows\System\cfJzLhs.exe

C:\Windows\System\cfJzLhs.exe

C:\Windows\System\UXFwATL.exe

C:\Windows\System\UXFwATL.exe

C:\Windows\System\utYToWh.exe

C:\Windows\System\utYToWh.exe

C:\Windows\System\IqOhXKZ.exe

C:\Windows\System\IqOhXKZ.exe

C:\Windows\System\uLzXEJb.exe

C:\Windows\System\uLzXEJb.exe

C:\Windows\System\mWkQUte.exe

C:\Windows\System\mWkQUte.exe

C:\Windows\System\WWPIOnx.exe

C:\Windows\System\WWPIOnx.exe

C:\Windows\System\wZsGHdE.exe

C:\Windows\System\wZsGHdE.exe

C:\Windows\System\XRcYpSW.exe

C:\Windows\System\XRcYpSW.exe

C:\Windows\System\JVIgCRX.exe

C:\Windows\System\JVIgCRX.exe

C:\Windows\System\NBIKcWt.exe

C:\Windows\System\NBIKcWt.exe

C:\Windows\System\JnqFpet.exe

C:\Windows\System\JnqFpet.exe

C:\Windows\System\sxmxLaa.exe

C:\Windows\System\sxmxLaa.exe

C:\Windows\System\pFWpgqq.exe

C:\Windows\System\pFWpgqq.exe

C:\Windows\System\LoGfiMw.exe

C:\Windows\System\LoGfiMw.exe

C:\Windows\System\OWUhqhR.exe

C:\Windows\System\OWUhqhR.exe

C:\Windows\System\kAZSHlS.exe

C:\Windows\System\kAZSHlS.exe

C:\Windows\System\xsFghKN.exe

C:\Windows\System\xsFghKN.exe

C:\Windows\System\ruWaFgd.exe

C:\Windows\System\ruWaFgd.exe

C:\Windows\System\xyNWrgR.exe

C:\Windows\System\xyNWrgR.exe

C:\Windows\System\CAyMsCo.exe

C:\Windows\System\CAyMsCo.exe

C:\Windows\System\RWsfKdT.exe

C:\Windows\System\RWsfKdT.exe

C:\Windows\System\eQJqVkG.exe

C:\Windows\System\eQJqVkG.exe

C:\Windows\System\QTWZfgL.exe

C:\Windows\System\QTWZfgL.exe

C:\Windows\System\mCOlMNU.exe

C:\Windows\System\mCOlMNU.exe

C:\Windows\System\uqxBucj.exe

C:\Windows\System\uqxBucj.exe

C:\Windows\System\xQvrIRH.exe

C:\Windows\System\xQvrIRH.exe

C:\Windows\System\ASKMgaj.exe

C:\Windows\System\ASKMgaj.exe

C:\Windows\System\JMEWpMA.exe

C:\Windows\System\JMEWpMA.exe

C:\Windows\System\xAYPLqq.exe

C:\Windows\System\xAYPLqq.exe

C:\Windows\System\KLWxVKT.exe

C:\Windows\System\KLWxVKT.exe

C:\Windows\System\YrxdqVo.exe

C:\Windows\System\YrxdqVo.exe

C:\Windows\System\YIIMwoo.exe

C:\Windows\System\YIIMwoo.exe

C:\Windows\System\IWkqrVo.exe

C:\Windows\System\IWkqrVo.exe

C:\Windows\System\gngpzdG.exe

C:\Windows\System\gngpzdG.exe

C:\Windows\System\TWbzUBt.exe

C:\Windows\System\TWbzUBt.exe

C:\Windows\System\JFvgSni.exe

C:\Windows\System\JFvgSni.exe

C:\Windows\System\EbPDBvw.exe

C:\Windows\System\EbPDBvw.exe

C:\Windows\System\BVpuNTx.exe

C:\Windows\System\BVpuNTx.exe

C:\Windows\System\mKLQFVA.exe

C:\Windows\System\mKLQFVA.exe

C:\Windows\System\GLjrtiv.exe

C:\Windows\System\GLjrtiv.exe

C:\Windows\System\EIZRxEB.exe

C:\Windows\System\EIZRxEB.exe

C:\Windows\System\WrYlNCW.exe

C:\Windows\System\WrYlNCW.exe

C:\Windows\System\sLgArvR.exe

C:\Windows\System\sLgArvR.exe

C:\Windows\System\overszB.exe

C:\Windows\System\overszB.exe

C:\Windows\System\OsmSQtM.exe

C:\Windows\System\OsmSQtM.exe

C:\Windows\System\cxyfTME.exe

C:\Windows\System\cxyfTME.exe

C:\Windows\System\sbecJSy.exe

C:\Windows\System\sbecJSy.exe

C:\Windows\System\ygXWhDd.exe

C:\Windows\System\ygXWhDd.exe

C:\Windows\System\zGPXbTh.exe

C:\Windows\System\zGPXbTh.exe

C:\Windows\System\IVhhUBw.exe

C:\Windows\System\IVhhUBw.exe

C:\Windows\System\RmZQIKs.exe

C:\Windows\System\RmZQIKs.exe

C:\Windows\System\VkIFwDX.exe

C:\Windows\System\VkIFwDX.exe

C:\Windows\System\yALdUrg.exe

C:\Windows\System\yALdUrg.exe

C:\Windows\System\DxrjTdq.exe

C:\Windows\System\DxrjTdq.exe

C:\Windows\System\ratYduC.exe

C:\Windows\System\ratYduC.exe

C:\Windows\System\NqGGBwV.exe

C:\Windows\System\NqGGBwV.exe

C:\Windows\System\cbsWFGh.exe

C:\Windows\System\cbsWFGh.exe

C:\Windows\System\ZGOpFUv.exe

C:\Windows\System\ZGOpFUv.exe

C:\Windows\System\NLxWqwO.exe

C:\Windows\System\NLxWqwO.exe

C:\Windows\System\gWAKipw.exe

C:\Windows\System\gWAKipw.exe

C:\Windows\System\GErJcjD.exe

C:\Windows\System\GErJcjD.exe

C:\Windows\System\IiwVldZ.exe

C:\Windows\System\IiwVldZ.exe

C:\Windows\System\POJCIkK.exe

C:\Windows\System\POJCIkK.exe

C:\Windows\System\kLkNdJt.exe

C:\Windows\System\kLkNdJt.exe

C:\Windows\System\OJBgTIb.exe

C:\Windows\System\OJBgTIb.exe

C:\Windows\System\csPRDPd.exe

C:\Windows\System\csPRDPd.exe

C:\Windows\System\WtcfNzM.exe

C:\Windows\System\WtcfNzM.exe

C:\Windows\System\GGtDZWh.exe

C:\Windows\System\GGtDZWh.exe

C:\Windows\System\BcGEMYs.exe

C:\Windows\System\BcGEMYs.exe

C:\Windows\System\GIEvcnK.exe

C:\Windows\System\GIEvcnK.exe

C:\Windows\System\xvSdRGU.exe

C:\Windows\System\xvSdRGU.exe

C:\Windows\System\VhvVjjj.exe

C:\Windows\System\VhvVjjj.exe

C:\Windows\System\AZYNXPT.exe

C:\Windows\System\AZYNXPT.exe

C:\Windows\System\WRPafRQ.exe

C:\Windows\System\WRPafRQ.exe

C:\Windows\System\ROheGMh.exe

C:\Windows\System\ROheGMh.exe

C:\Windows\System\lIaEoKE.exe

C:\Windows\System\lIaEoKE.exe

C:\Windows\System\SUoUYHv.exe

C:\Windows\System\SUoUYHv.exe

C:\Windows\System\cXlbiZd.exe

C:\Windows\System\cXlbiZd.exe

C:\Windows\System\CxWDnAN.exe

C:\Windows\System\CxWDnAN.exe

C:\Windows\System\sfhUERO.exe

C:\Windows\System\sfhUERO.exe

C:\Windows\System\Nqqfszl.exe

C:\Windows\System\Nqqfszl.exe

C:\Windows\System\osMuCFu.exe

C:\Windows\System\osMuCFu.exe

C:\Windows\System\sVIaWxt.exe

C:\Windows\System\sVIaWxt.exe

C:\Windows\System\OahaRKx.exe

C:\Windows\System\OahaRKx.exe

C:\Windows\System\VaMnnnJ.exe

C:\Windows\System\VaMnnnJ.exe

C:\Windows\System\sXJxAII.exe

C:\Windows\System\sXJxAII.exe

C:\Windows\System\fWqsAnv.exe

C:\Windows\System\fWqsAnv.exe

C:\Windows\System\PhRwXtn.exe

C:\Windows\System\PhRwXtn.exe

C:\Windows\System\iECbmSe.exe

C:\Windows\System\iECbmSe.exe

C:\Windows\System\mlCPtMS.exe

C:\Windows\System\mlCPtMS.exe

C:\Windows\System\ixwNOgc.exe

C:\Windows\System\ixwNOgc.exe

C:\Windows\System\qIUZUfR.exe

C:\Windows\System\qIUZUfR.exe

C:\Windows\System\rUXCDob.exe

C:\Windows\System\rUXCDob.exe

C:\Windows\System\KAIOsWH.exe

C:\Windows\System\KAIOsWH.exe

C:\Windows\System\dcdJXiZ.exe

C:\Windows\System\dcdJXiZ.exe

C:\Windows\System\lyVPuHJ.exe

C:\Windows\System\lyVPuHJ.exe

C:\Windows\System\nZQCMAj.exe

C:\Windows\System\nZQCMAj.exe

C:\Windows\System\CGjOrzQ.exe

C:\Windows\System\CGjOrzQ.exe

C:\Windows\System\aSuchhW.exe

C:\Windows\System\aSuchhW.exe

C:\Windows\System\MHVNoMI.exe

C:\Windows\System\MHVNoMI.exe

C:\Windows\System\JXMzVtZ.exe

C:\Windows\System\JXMzVtZ.exe

C:\Windows\System\sfhbvTS.exe

C:\Windows\System\sfhbvTS.exe

C:\Windows\System\IfRNjPK.exe

C:\Windows\System\IfRNjPK.exe

C:\Windows\System\YrvuQIO.exe

C:\Windows\System\YrvuQIO.exe

C:\Windows\System\GuNHmaS.exe

C:\Windows\System\GuNHmaS.exe

C:\Windows\System\Qmqqyzp.exe

C:\Windows\System\Qmqqyzp.exe

C:\Windows\System\DljGBQd.exe

C:\Windows\System\DljGBQd.exe

C:\Windows\System\LzbVTRu.exe

C:\Windows\System\LzbVTRu.exe

C:\Windows\System\rWtPhjj.exe

C:\Windows\System\rWtPhjj.exe

C:\Windows\System\KNKjWjj.exe

C:\Windows\System\KNKjWjj.exe

C:\Windows\System\NAPKRTx.exe

C:\Windows\System\NAPKRTx.exe

C:\Windows\System\UldYVil.exe

C:\Windows\System\UldYVil.exe

C:\Windows\System\oZKhAiE.exe

C:\Windows\System\oZKhAiE.exe

C:\Windows\System\NfHTqOH.exe

C:\Windows\System\NfHTqOH.exe

C:\Windows\System\mJmoxVG.exe

C:\Windows\System\mJmoxVG.exe

C:\Windows\System\oVTDxzE.exe

C:\Windows\System\oVTDxzE.exe

C:\Windows\System\htquJYO.exe

C:\Windows\System\htquJYO.exe

C:\Windows\System\pmjgXyx.exe

C:\Windows\System\pmjgXyx.exe

C:\Windows\System\NAVarWw.exe

C:\Windows\System\NAVarWw.exe

C:\Windows\System\yySPxhO.exe

C:\Windows\System\yySPxhO.exe

C:\Windows\System\TkMxhjC.exe

C:\Windows\System\TkMxhjC.exe

C:\Windows\System\UEMdRKh.exe

C:\Windows\System\UEMdRKh.exe

C:\Windows\System\CVzkFag.exe

C:\Windows\System\CVzkFag.exe

C:\Windows\System\abqwnRf.exe

C:\Windows\System\abqwnRf.exe

C:\Windows\System\MMHqJqW.exe

C:\Windows\System\MMHqJqW.exe

C:\Windows\System\pYMlJJz.exe

C:\Windows\System\pYMlJJz.exe

C:\Windows\System\rxRyYry.exe

C:\Windows\System\rxRyYry.exe

C:\Windows\System\wxkEWuJ.exe

C:\Windows\System\wxkEWuJ.exe

C:\Windows\System\Safrhpw.exe

C:\Windows\System\Safrhpw.exe

C:\Windows\System\LDfjcGU.exe

C:\Windows\System\LDfjcGU.exe

C:\Windows\System\WSUnwFY.exe

C:\Windows\System\WSUnwFY.exe

C:\Windows\System\wjnhfSX.exe

C:\Windows\System\wjnhfSX.exe

C:\Windows\System\fFxYPxV.exe

C:\Windows\System\fFxYPxV.exe

C:\Windows\System\swwBHLv.exe

C:\Windows\System\swwBHLv.exe

C:\Windows\System\CohxIBv.exe

C:\Windows\System\CohxIBv.exe

C:\Windows\System\ElraLub.exe

C:\Windows\System\ElraLub.exe

C:\Windows\System\ZLfcsFN.exe

C:\Windows\System\ZLfcsFN.exe

C:\Windows\System\ONQcwRL.exe

C:\Windows\System\ONQcwRL.exe

C:\Windows\System\OCTJcZi.exe

C:\Windows\System\OCTJcZi.exe

C:\Windows\System\psxZNzU.exe

C:\Windows\System\psxZNzU.exe

C:\Windows\System\nLEzzdI.exe

C:\Windows\System\nLEzzdI.exe

C:\Windows\System\zUayfez.exe

C:\Windows\System\zUayfez.exe

C:\Windows\System\ewWSmEA.exe

C:\Windows\System\ewWSmEA.exe

C:\Windows\System\gJBGfHO.exe

C:\Windows\System\gJBGfHO.exe

C:\Windows\System\DueFrHn.exe

C:\Windows\System\DueFrHn.exe

C:\Windows\System\WafTQoH.exe

C:\Windows\System\WafTQoH.exe

C:\Windows\System\yWnVVuR.exe

C:\Windows\System\yWnVVuR.exe

C:\Windows\System\ZpMdGiT.exe

C:\Windows\System\ZpMdGiT.exe

C:\Windows\System\yutVCyX.exe

C:\Windows\System\yutVCyX.exe

C:\Windows\System\hvYvvBX.exe

C:\Windows\System\hvYvvBX.exe

C:\Windows\System\tlWlbLK.exe

C:\Windows\System\tlWlbLK.exe

C:\Windows\System\AoMkkzh.exe

C:\Windows\System\AoMkkzh.exe

C:\Windows\System\YIacunP.exe

C:\Windows\System\YIacunP.exe

C:\Windows\System\PBnHUdz.exe

C:\Windows\System\PBnHUdz.exe

C:\Windows\System\CexIVSK.exe

C:\Windows\System\CexIVSK.exe

C:\Windows\System\VOnPrVz.exe

C:\Windows\System\VOnPrVz.exe

C:\Windows\System\NToNpwf.exe

C:\Windows\System\NToNpwf.exe

C:\Windows\System\lyFZGcf.exe

C:\Windows\System\lyFZGcf.exe

C:\Windows\System\TQPBHAN.exe

C:\Windows\System\TQPBHAN.exe

C:\Windows\System\TmEONHd.exe

C:\Windows\System\TmEONHd.exe

C:\Windows\System\snUUETH.exe

C:\Windows\System\snUUETH.exe

C:\Windows\System\JdAOtzJ.exe

C:\Windows\System\JdAOtzJ.exe

C:\Windows\System\DkcMywo.exe

C:\Windows\System\DkcMywo.exe

C:\Windows\System\lvSkyoX.exe

C:\Windows\System\lvSkyoX.exe

C:\Windows\System\lKFIjlG.exe

C:\Windows\System\lKFIjlG.exe

C:\Windows\System\FOtGGeR.exe

C:\Windows\System\FOtGGeR.exe

C:\Windows\System\VppIwnH.exe

C:\Windows\System\VppIwnH.exe

C:\Windows\System\PrMulsD.exe

C:\Windows\System\PrMulsD.exe

C:\Windows\System\mOgcvwE.exe

C:\Windows\System\mOgcvwE.exe

C:\Windows\System\vfhIOzP.exe

C:\Windows\System\vfhIOzP.exe

C:\Windows\System\MQkPHRr.exe

C:\Windows\System\MQkPHRr.exe

C:\Windows\System\vEwKyDx.exe

C:\Windows\System\vEwKyDx.exe

C:\Windows\System\odVIheZ.exe

C:\Windows\System\odVIheZ.exe

C:\Windows\System\mjFpseg.exe

C:\Windows\System\mjFpseg.exe

C:\Windows\System\DdJFHuj.exe

C:\Windows\System\DdJFHuj.exe

C:\Windows\System\GpsSfjI.exe

C:\Windows\System\GpsSfjI.exe

C:\Windows\System\jhPOtsU.exe

C:\Windows\System\jhPOtsU.exe

C:\Windows\System\PVjutya.exe

C:\Windows\System\PVjutya.exe

C:\Windows\System\xGSmywZ.exe

C:\Windows\System\xGSmywZ.exe

C:\Windows\System\Bbosquv.exe

C:\Windows\System\Bbosquv.exe

C:\Windows\System\wPmYHyf.exe

C:\Windows\System\wPmYHyf.exe

C:\Windows\System\tmtvOCw.exe

C:\Windows\System\tmtvOCw.exe

C:\Windows\System\jnmgYjg.exe

C:\Windows\System\jnmgYjg.exe

C:\Windows\System\fEWBwop.exe

C:\Windows\System\fEWBwop.exe

C:\Windows\System\sCEkZEv.exe

C:\Windows\System\sCEkZEv.exe

C:\Windows\System\TGrSDqm.exe

C:\Windows\System\TGrSDqm.exe

C:\Windows\System\ttvQTrn.exe

C:\Windows\System\ttvQTrn.exe

C:\Windows\System\GtCtMxL.exe

C:\Windows\System\GtCtMxL.exe

C:\Windows\System\qXZfUPb.exe

C:\Windows\System\qXZfUPb.exe

C:\Windows\System\pzCTSGL.exe

C:\Windows\System\pzCTSGL.exe

C:\Windows\System\mrtqLBF.exe

C:\Windows\System\mrtqLBF.exe

C:\Windows\System\sUNvAFh.exe

C:\Windows\System\sUNvAFh.exe

C:\Windows\System\BEocdxT.exe

C:\Windows\System\BEocdxT.exe

C:\Windows\System\BVkmrvy.exe

C:\Windows\System\BVkmrvy.exe

C:\Windows\System\BlAOPJF.exe

C:\Windows\System\BlAOPJF.exe

C:\Windows\System\EWvOBbb.exe

C:\Windows\System\EWvOBbb.exe

C:\Windows\System\yKlpoYY.exe

C:\Windows\System\yKlpoYY.exe

C:\Windows\System\kWAOByu.exe

C:\Windows\System\kWAOByu.exe

C:\Windows\System\QNFpeRe.exe

C:\Windows\System\QNFpeRe.exe

C:\Windows\System\StdUFaS.exe

C:\Windows\System\StdUFaS.exe

C:\Windows\System\JiKKWLw.exe

C:\Windows\System\JiKKWLw.exe

C:\Windows\System\zJVeWoh.exe

C:\Windows\System\zJVeWoh.exe

C:\Windows\System\WRsPBNs.exe

C:\Windows\System\WRsPBNs.exe

C:\Windows\System\qubpqnE.exe

C:\Windows\System\qubpqnE.exe

C:\Windows\System\IxJXHlH.exe

C:\Windows\System\IxJXHlH.exe

C:\Windows\System\YvKDrfv.exe

C:\Windows\System\YvKDrfv.exe

C:\Windows\System\dempziu.exe

C:\Windows\System\dempziu.exe

C:\Windows\System\IcKgAuA.exe

C:\Windows\System\IcKgAuA.exe

C:\Windows\System\frlFKUJ.exe

C:\Windows\System\frlFKUJ.exe

C:\Windows\System\MjQodgj.exe

C:\Windows\System\MjQodgj.exe

C:\Windows\System\uIcbUDm.exe

C:\Windows\System\uIcbUDm.exe

C:\Windows\System\BuFQjFu.exe

C:\Windows\System\BuFQjFu.exe

C:\Windows\System\bVgTorb.exe

C:\Windows\System\bVgTorb.exe

C:\Windows\System\EVqbLxM.exe

C:\Windows\System\EVqbLxM.exe

C:\Windows\System\MLwNgZQ.exe

C:\Windows\System\MLwNgZQ.exe

C:\Windows\System\JTxkQHG.exe

C:\Windows\System\JTxkQHG.exe

C:\Windows\System\AixEjPt.exe

C:\Windows\System\AixEjPt.exe

C:\Windows\System\gENwaYk.exe

C:\Windows\System\gENwaYk.exe

C:\Windows\System\wQdJYHx.exe

C:\Windows\System\wQdJYHx.exe

C:\Windows\System\mtFnyfJ.exe

C:\Windows\System\mtFnyfJ.exe

C:\Windows\System\DnSxJqC.exe

C:\Windows\System\DnSxJqC.exe

C:\Windows\System\emVjhmZ.exe

C:\Windows\System\emVjhmZ.exe

C:\Windows\System\RNexUho.exe

C:\Windows\System\RNexUho.exe

C:\Windows\System\JnTlbNl.exe

C:\Windows\System\JnTlbNl.exe

C:\Windows\System\AhrtStc.exe

C:\Windows\System\AhrtStc.exe

C:\Windows\System\IXeQyFk.exe

C:\Windows\System\IXeQyFk.exe

C:\Windows\System\joZGniE.exe

C:\Windows\System\joZGniE.exe

C:\Windows\System\UkOiZhc.exe

C:\Windows\System\UkOiZhc.exe

C:\Windows\System\ipwRDmd.exe

C:\Windows\System\ipwRDmd.exe

C:\Windows\System\cSMUgZQ.exe

C:\Windows\System\cSMUgZQ.exe

C:\Windows\System\rZmznEX.exe

C:\Windows\System\rZmznEX.exe

C:\Windows\System\trKeopc.exe

C:\Windows\System\trKeopc.exe

C:\Windows\System\BEGncen.exe

C:\Windows\System\BEGncen.exe

C:\Windows\System\yNRSkgN.exe

C:\Windows\System\yNRSkgN.exe

C:\Windows\System\uZFiYth.exe

C:\Windows\System\uZFiYth.exe

C:\Windows\System\OfUJptE.exe

C:\Windows\System\OfUJptE.exe

C:\Windows\System\NvCiuPC.exe

C:\Windows\System\NvCiuPC.exe

C:\Windows\System\tnTVzUa.exe

C:\Windows\System\tnTVzUa.exe

C:\Windows\System\dpJZTzV.exe

C:\Windows\System\dpJZTzV.exe

C:\Windows\System\gJUUfRS.exe

C:\Windows\System\gJUUfRS.exe

C:\Windows\System\wIoZyaK.exe

C:\Windows\System\wIoZyaK.exe

C:\Windows\System\sqkWfXc.exe

C:\Windows\System\sqkWfXc.exe

C:\Windows\System\SlBHbHZ.exe

C:\Windows\System\SlBHbHZ.exe

C:\Windows\System\xXRgvFL.exe

C:\Windows\System\xXRgvFL.exe

C:\Windows\System\zPnCsOr.exe

C:\Windows\System\zPnCsOr.exe

C:\Windows\System\iPHYGqt.exe

C:\Windows\System\iPHYGqt.exe

C:\Windows\System\CIovKRw.exe

C:\Windows\System\CIovKRw.exe

C:\Windows\System\lXfMUVg.exe

C:\Windows\System\lXfMUVg.exe

C:\Windows\System\DuDlOQK.exe

C:\Windows\System\DuDlOQK.exe

C:\Windows\System\SzYrUbC.exe

C:\Windows\System\SzYrUbC.exe

C:\Windows\System\jCXruVm.exe

C:\Windows\System\jCXruVm.exe

C:\Windows\System\kqOZZhl.exe

C:\Windows\System\kqOZZhl.exe

C:\Windows\System\UqPmJVc.exe

C:\Windows\System\UqPmJVc.exe

C:\Windows\System\XgUhran.exe

C:\Windows\System\XgUhran.exe

C:\Windows\System\idPjsIY.exe

C:\Windows\System\idPjsIY.exe

C:\Windows\System\syznROo.exe

C:\Windows\System\syznROo.exe

C:\Windows\System\eHlUMle.exe

C:\Windows\System\eHlUMle.exe

C:\Windows\System\QXGikVf.exe

C:\Windows\System\QXGikVf.exe

C:\Windows\System\NtivKaz.exe

C:\Windows\System\NtivKaz.exe

C:\Windows\System\CWPpEOs.exe

C:\Windows\System\CWPpEOs.exe

C:\Windows\System\NDOeDYb.exe

C:\Windows\System\NDOeDYb.exe

C:\Windows\System\KFidQFv.exe

C:\Windows\System\KFidQFv.exe

C:\Windows\System\eWbbGvr.exe

C:\Windows\System\eWbbGvr.exe

C:\Windows\System\EYbrBAV.exe

C:\Windows\System\EYbrBAV.exe

C:\Windows\System\jGHbjow.exe

C:\Windows\System\jGHbjow.exe

C:\Windows\System\cEoAbLW.exe

C:\Windows\System\cEoAbLW.exe

C:\Windows\System\sYkMTZn.exe

C:\Windows\System\sYkMTZn.exe

C:\Windows\System\iqJbXOu.exe

C:\Windows\System\iqJbXOu.exe

C:\Windows\System\dHyHqLu.exe

C:\Windows\System\dHyHqLu.exe

C:\Windows\System\IXqnwSj.exe

C:\Windows\System\IXqnwSj.exe

C:\Windows\System\JYklvpo.exe

C:\Windows\System\JYklvpo.exe

C:\Windows\System\USNrvPu.exe

C:\Windows\System\USNrvPu.exe

C:\Windows\System\diMnZcl.exe

C:\Windows\System\diMnZcl.exe

C:\Windows\System\xktSMWj.exe

C:\Windows\System\xktSMWj.exe

C:\Windows\System\gfkrDwB.exe

C:\Windows\System\gfkrDwB.exe

C:\Windows\System\kFFZQcG.exe

C:\Windows\System\kFFZQcG.exe

C:\Windows\System\QbTRfeD.exe

C:\Windows\System\QbTRfeD.exe

C:\Windows\System\FJrqXtV.exe

C:\Windows\System\FJrqXtV.exe

C:\Windows\System\asbPUYd.exe

C:\Windows\System\asbPUYd.exe

C:\Windows\System\XVntWFa.exe

C:\Windows\System\XVntWFa.exe

C:\Windows\System\KNAWHDU.exe

C:\Windows\System\KNAWHDU.exe

C:\Windows\System\lvMqhwc.exe

C:\Windows\System\lvMqhwc.exe

C:\Windows\System\hVMJOYK.exe

C:\Windows\System\hVMJOYK.exe

C:\Windows\System\RzGXdwy.exe

C:\Windows\System\RzGXdwy.exe

C:\Windows\System\hJhNPVB.exe

C:\Windows\System\hJhNPVB.exe

C:\Windows\System\UIcwUMA.exe

C:\Windows\System\UIcwUMA.exe

C:\Windows\System\DYePYmi.exe

C:\Windows\System\DYePYmi.exe

C:\Windows\System\saYNesn.exe

C:\Windows\System\saYNesn.exe

C:\Windows\System\GSpcbXC.exe

C:\Windows\System\GSpcbXC.exe

C:\Windows\System\rZJeQsz.exe

C:\Windows\System\rZJeQsz.exe

C:\Windows\System\AJRjkQF.exe

C:\Windows\System\AJRjkQF.exe

C:\Windows\System\NLCXDQN.exe

C:\Windows\System\NLCXDQN.exe

C:\Windows\System\bcsqZlk.exe

C:\Windows\System\bcsqZlk.exe

C:\Windows\System\GQSprgF.exe

C:\Windows\System\GQSprgF.exe

C:\Windows\System\YOcqsrO.exe

C:\Windows\System\YOcqsrO.exe

C:\Windows\System\zaJnZkQ.exe

C:\Windows\System\zaJnZkQ.exe

C:\Windows\System\qgPBKTM.exe

C:\Windows\System\qgPBKTM.exe

C:\Windows\System\lmqJAqJ.exe

C:\Windows\System\lmqJAqJ.exe

C:\Windows\System\bDdsmlN.exe

C:\Windows\System\bDdsmlN.exe

C:\Windows\System\CTqHMWw.exe

C:\Windows\System\CTqHMWw.exe

C:\Windows\System\ORpJChS.exe

C:\Windows\System\ORpJChS.exe

C:\Windows\System\BMsZKyx.exe

C:\Windows\System\BMsZKyx.exe

C:\Windows\System\nodVSJW.exe

C:\Windows\System\nodVSJW.exe

C:\Windows\System\rxFYdhP.exe

C:\Windows\System\rxFYdhP.exe

C:\Windows\System\HYYXUsM.exe

C:\Windows\System\HYYXUsM.exe

C:\Windows\System\eHyCDdI.exe

C:\Windows\System\eHyCDdI.exe

C:\Windows\System\dGLTAVq.exe

C:\Windows\System\dGLTAVq.exe

C:\Windows\System\zFhPIAP.exe

C:\Windows\System\zFhPIAP.exe

C:\Windows\System\yYpprfz.exe

C:\Windows\System\yYpprfz.exe

C:\Windows\System\iRHtFFz.exe

C:\Windows\System\iRHtFFz.exe

C:\Windows\System\FKHPGBH.exe

C:\Windows\System\FKHPGBH.exe

C:\Windows\System\GhFPrbm.exe

C:\Windows\System\GhFPrbm.exe

C:\Windows\System\RYdlSUx.exe

C:\Windows\System\RYdlSUx.exe

C:\Windows\System\NwNVOqB.exe

C:\Windows\System\NwNVOqB.exe

C:\Windows\System\OhVtFhj.exe

C:\Windows\System\OhVtFhj.exe

C:\Windows\System\kYkcGwH.exe

C:\Windows\System\kYkcGwH.exe

C:\Windows\System\ilPMwdE.exe

C:\Windows\System\ilPMwdE.exe

C:\Windows\System\jydcYOw.exe

C:\Windows\System\jydcYOw.exe

C:\Windows\System\SjxoHYV.exe

C:\Windows\System\SjxoHYV.exe

C:\Windows\System\QECgTcS.exe

C:\Windows\System\QECgTcS.exe

C:\Windows\System\MRAXvlL.exe

C:\Windows\System\MRAXvlL.exe

C:\Windows\System\vJBSINk.exe

C:\Windows\System\vJBSINk.exe

C:\Windows\System\ozIbVmi.exe

C:\Windows\System\ozIbVmi.exe

C:\Windows\System\aYiPGuW.exe

C:\Windows\System\aYiPGuW.exe

C:\Windows\System\gTtxpuh.exe

C:\Windows\System\gTtxpuh.exe

C:\Windows\System\zGYPiDM.exe

C:\Windows\System\zGYPiDM.exe

C:\Windows\System\jGJpIbU.exe

C:\Windows\System\jGJpIbU.exe

C:\Windows\System\HLPfXQq.exe

C:\Windows\System\HLPfXQq.exe

C:\Windows\System\SogGpho.exe

C:\Windows\System\SogGpho.exe

C:\Windows\System\qPYLGpS.exe

C:\Windows\System\qPYLGpS.exe

C:\Windows\System\sOATJxD.exe

C:\Windows\System\sOATJxD.exe

C:\Windows\System\rHFkEBx.exe

C:\Windows\System\rHFkEBx.exe

C:\Windows\System\yFJAiGA.exe

C:\Windows\System\yFJAiGA.exe

C:\Windows\System\pNsqxmB.exe

C:\Windows\System\pNsqxmB.exe

C:\Windows\System\tKfqgyk.exe

C:\Windows\System\tKfqgyk.exe

C:\Windows\System\cLQzlaS.exe

C:\Windows\System\cLQzlaS.exe

C:\Windows\System\BnpdRDC.exe

C:\Windows\System\BnpdRDC.exe

C:\Windows\System\DlEthNZ.exe

C:\Windows\System\DlEthNZ.exe

C:\Windows\System\khMGyno.exe

C:\Windows\System\khMGyno.exe

C:\Windows\System\RNNZOaj.exe

C:\Windows\System\RNNZOaj.exe

C:\Windows\System\Vtkxpme.exe

C:\Windows\System\Vtkxpme.exe

C:\Windows\System\cbzUKEM.exe

C:\Windows\System\cbzUKEM.exe

C:\Windows\System\tJetJRO.exe

C:\Windows\System\tJetJRO.exe

C:\Windows\System\ArSPNEa.exe

C:\Windows\System\ArSPNEa.exe

C:\Windows\System\eRFLsTx.exe

C:\Windows\System\eRFLsTx.exe

C:\Windows\System\WqYoXmT.exe

C:\Windows\System\WqYoXmT.exe

C:\Windows\System\zuKMFRz.exe

C:\Windows\System\zuKMFRz.exe

C:\Windows\System\ClSoctX.exe

C:\Windows\System\ClSoctX.exe

C:\Windows\System\TwNHflu.exe

C:\Windows\System\TwNHflu.exe

C:\Windows\System\mfjDnOk.exe

C:\Windows\System\mfjDnOk.exe

C:\Windows\System\pobAiSn.exe

C:\Windows\System\pobAiSn.exe

C:\Windows\System\uOKGsxE.exe

C:\Windows\System\uOKGsxE.exe

C:\Windows\System\dgeaUEl.exe

C:\Windows\System\dgeaUEl.exe

C:\Windows\System\ajZIRVt.exe

C:\Windows\System\ajZIRVt.exe

C:\Windows\System\YMAGxCn.exe

C:\Windows\System\YMAGxCn.exe

C:\Windows\System\kooGJEE.exe

C:\Windows\System\kooGJEE.exe

C:\Windows\System\EilJKmF.exe

C:\Windows\System\EilJKmF.exe

C:\Windows\System\pIjguaz.exe

C:\Windows\System\pIjguaz.exe

C:\Windows\System\WeHSTzt.exe

C:\Windows\System\WeHSTzt.exe

C:\Windows\System\mZRtYQj.exe

C:\Windows\System\mZRtYQj.exe

C:\Windows\System\ANbSfXd.exe

C:\Windows\System\ANbSfXd.exe

C:\Windows\System\pnRAGzV.exe

C:\Windows\System\pnRAGzV.exe

C:\Windows\System\HDMdIhy.exe

C:\Windows\System\HDMdIhy.exe

C:\Windows\System\lFwDDXC.exe

C:\Windows\System\lFwDDXC.exe

C:\Windows\System\sOAsAxq.exe

C:\Windows\System\sOAsAxq.exe

C:\Windows\System\QHMCpbG.exe

C:\Windows\System\QHMCpbG.exe

C:\Windows\System\VcDyWNu.exe

C:\Windows\System\VcDyWNu.exe

C:\Windows\System\xFzUqaL.exe

C:\Windows\System\xFzUqaL.exe

C:\Windows\System\klDwFZr.exe

C:\Windows\System\klDwFZr.exe

C:\Windows\System\wzavphg.exe

C:\Windows\System\wzavphg.exe

C:\Windows\System\mAUdZHg.exe

C:\Windows\System\mAUdZHg.exe

C:\Windows\System\qcEAWWV.exe

C:\Windows\System\qcEAWWV.exe

C:\Windows\System\BoRFXqZ.exe

C:\Windows\System\BoRFXqZ.exe

C:\Windows\System\wJPYRsC.exe

C:\Windows\System\wJPYRsC.exe

C:\Windows\System\DHMbpHx.exe

C:\Windows\System\DHMbpHx.exe

C:\Windows\System\QvNPYLa.exe

C:\Windows\System\QvNPYLa.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	76.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	52.111.227.11:443		tcp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	88.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53		udp

Files

memory/5056-0-0x00007FF7A3B30000-0x00007FF7A3E84000-memory.dmp

memory/5056-1-0x000001CD99670000-0x000001CD99680000-memory.dmp

C:\Windows\System\ZjZSELn.exe

MD5	c2cab43b4f67673982f9a863f8c5026b
SHA1	bd8bebfba906b72014ceb36235cae51b75fe937f
SHA256	ca78e41ff44f489bf1bf5c70e477d70ff2bb02eccff979be7c4201a750dad39e
SHA512	a572950a8f134264994dad1879513987221aa5a8f5fe6bf9f91a0cbb0ae3b70a62f75e0a7d1fbb4924bd05f04e368b6dba26695a96a8fc1512c0cf6295fbd4b1

C:\Windows\System\ewtELpB.exe

MD5	0b352431c8824fac7b40ea3b196b4637
SHA1	54d804c4740ab447e24b1c4f4a0255dd78fa0c8a
SHA256	9b97e43c0955812e49210f2e11695457873201e38e56749b80e0dfe22b9c2b11
SHA512	4ed60a08fc1c6e251ebec2a37419130c642628eb200205aa3da863d9fbaa4dd1c59e9c30d3e6e9e1a805592b3b4ac1e00af66c99666ad2b13dfd309d5819e68c

C:\Windows\System\yUflscW.exe

MD5	1038ebcd625a98681862aaccbdc80d05
SHA1	abcc57c46bf34fca9355fe211f039a5e1c1e197c
SHA256	cacbe7e88ee71ffe0f0d8ca6a144d401156292699a8c44bc2bc8588eb6fa5b44
SHA512	4a336ed3fe57193e881a6865f3cc38478988f5e705da7a723fa894fab0059b771145df33653cafaa5573ca86b5927306c99b7ee1e6a9a1830ebad274ab6bd0a6

memory/928-12-0x00007FF63FCB0000-0x00007FF640004000-memory.dmp

memory/4088-16-0x00007FF611750000-0x00007FF611AA4000-memory.dmp

memory/2556-25-0x00007FF7F0500000-0x00007FF7F0854000-memory.dmp

C:\Windows\System\OfgldBk.exe

MD5	cae6acde18c20b861c58264968eb70d2
SHA1	603687649e47f5f44e5a37e254a2f538309fa334
SHA256	d5c2edfd95e192d08ae1c515802ccd69bc8ea0a9ba06f845316d90bec60b9a44
SHA512	5ecc35e2f763e0d234559d39bc430bd23fbffff89477b8a9fd759c0c80e881ccb074260d52f6df9f8d76ff96a52390a90a1532d5e6f5aae5d38c76c6c909d10b

C:\Windows\System\cftalch.exe

MD5	fa8f276b2d4ddf41383f4406525e2ac4
SHA1	a3def6c749473c458269d83784de8ebd5911d5cb
SHA256	d933f210481ea4c16870abb30b80a962f83b6e93779d7f0f5acb398f7047029c
SHA512	8705eb3b7cb4191ee5266b3ff28a1f54e57cd7ab68d441deea103724ec5889b6cb90d7685c476554a8dd546bb2a69193ab941d256809c722bbddf62717ea8a30

C:\Windows\System\HDPaagg.exe

MD5	307d6a0c6f3340144a2e00a43c3a9711
SHA1	d2b66f082a7fd2978b025c83db8d0217472c495b
SHA256	29b1c7ca16f984f87e772e90e687d63302871d1bf8bcc06ef00a28bbb0793b82
SHA512	5cdd455435a22b3918584933f3ddfbfd6357e9668ac7174196c4499de966d79f5e2ab6f77583703238c1e985641b209eade231d5dad9e7eba29fb8eaf6edb63f

memory/424-32-0x00007FF782D10000-0x00007FF783064000-memory.dmp

C:\Windows\System\FdRpZgO.exe

MD5	cfedfa7383253de9c7b9ffa4196b92cf
SHA1	404e205dd2a6d909ce078e8cd23c02674931ef7b
SHA256	c1e89a28b20c3549666d6deb5c66f9227ac5c31a790be35367e7b8bcb26316d4
SHA512	c334fa044f4f74a2d555c37df1d51382354fda460dfc153a0523e1a752cc1fb0aa5c6c3b49914d6d34f14d11c991807736d467957f23fc5a71abe0eb931d4392

C:\Windows\System\aYyaMwq.exe

MD5	78c519275ab240f20042938c699d5b50
SHA1	03cc1d5de368a2f28956bdd9f0197b291b92c2d3
SHA256	ecc5a5b8c368e0ec072d55a1c85694ab8514b8d205e7c1d5edca00f3f40a405a
SHA512	bea8db62b467c133a39a23e9a0eaeb064aaeb5e0a8d7088142cbe7431444981de03bd6464de25fb3c731458856e27bc6ef4a552b8a85e71fb5f05418dd35b10a

C:\Windows\System\nBcgahq.exe

MD5	ec11e0f2b4bf15f32e8964abf5d7ae7c
SHA1	c56efa991f27b34cc930d8045dd9e26ccb04972d
SHA256	39f034d30df07fc36af2153c3706bcf6253f85994afcfbbf3451be5cf67385b5
SHA512	51ea1844fa3f3ceaf3bd8ee83970fce5b7b232d79cd17ef8caf4c2b1220ddd67cde0cff8499f93ca6820031e923611dab98d3197e2165ead4975fce0f329c3e7

C:\Windows\System\rnanhrk.exe

MD5	456f5eb804e4a471c782f081b7ccfa4e
SHA1	f5e576831ca54a8e4919552e98e3965a02f1cb46
SHA256	d5c4e6287a900bcaa09aa4c9cd97f07a03c53d96861ed8b742239339f9bb2797
SHA512	6dfee14eddfd893f0dacc996325dcc2371709ea43046438a6525061dcfcbfae0b79e87000d27e906477273b679f06cc299902ab26a6bd4f027a9936ad04776de

C:\Windows\System\WuAHgIu.exe

MD5	53daf778bd8a5c9912daa73217b900de
SHA1	0e14878086dc1fb8636a188065d4b2c3a4d752b0
SHA256	2bac07b6d4bbb57faf76177a16b4c4e3c683a26f93dcf0a055441cd2823a6786
SHA512	7559b2db86432f7e4e5d2a6de231e06e14bc39ff7a1c19499737ac1897bdb069e2ae6c0052329a60c6da48ec1090f2f11484276fce42dbe3b7a4ff9f5767e98f

C:\Windows\System\wSGLNbt.exe

MD5	ff0db1c8ab1926942d5df8161f43959c
SHA1	85bcdcc20bd793518479ee3afaf5a0fd4cc95fae
SHA256	4347c9a98fb26b1d458cf6956404a3f95e2b7dc8d333e14b5a9f46cb602ff0e2
SHA512	31658dfb92727d12cb6cc586c23827283331482686c2cba8a2c06b8f67eafe0e251f3693a6c48eb976227bc2e2db3cfb42bc028b222172dc39d2dd946de9f5d5

C:\Windows\System\zWitftR.exe

MD5	688b4757897094603cf3edd7a6375ccd
SHA1	952a344c7907f66750e31639689bc7b8b2c5b393
SHA256	7d1f86c96f2cdf5664d320a24608b06605884d9eb1d747b93d0a30af311d3227
SHA512	892208f33b7a94f96a1fb7708fd6ee986a6878aab59e9b1cb2b19632216977bc6d88ae94c3d0908e9d78c505cb0be7a44477c04146d106d4167fc3928231636b

memory/4960-566-0x00007FF62D660000-0x00007FF62D9B4000-memory.dmp

memory/3652-567-0x00007FF6D4120000-0x00007FF6D4474000-memory.dmp

memory/4940-568-0x00007FF65C230000-0x00007FF65C584000-memory.dmp

C:\Windows\System\DsmwDkt.exe

MD5	3e6a0fc3fe00c14fe61d14d8b60d94d1
SHA1	93e924b8821a63dc330a6d4849783d32f4ffb88f
SHA256	9cbef03d5a9fbfea7d7cc4798a7b17ed73f6a7160a6d7a332f1f7c72a8fb8472
SHA512	4db406e14a4f4d50dc10219defbe159b0e6d54206a4a3991545849f0a28640600a8fd190442c94b7b3b091d26add1fc3e16c303f915806f25f99b9faabd86e57

C:\Windows\System\JlFvlJt.exe

MD5	b9275f19bbbe20f984666524f27d4133
SHA1	2f78b56223dbffc45f6e41efa28695494a2cae14
SHA256	76bd38782d0f7dc3ede7b9f520b3193fcfb3fe704c5a2a8dde5870c928a0049e
SHA512	6fb0c1ca896eb9654a634a0d76a2a95b172df4dec74867ee0d617775cd932dbebec1f283a7221f78d4b93339fe2954939d5cfbe347346f9fb35fe8bba22236de

C:\Windows\System\RrPEaMf.exe

MD5	70263d63ae478493a487fc036cba54de
SHA1	804849ddf87df19ad68b7cc6351e98b43712b34e
SHA256	cca34494711180a5631d00487495cdee25ef9a1ef2650aa3b90553b0f8ae8b01
SHA512	b1a4ac2ceee0aba1964b7362f86ed7276daeadf0df7013c3278490f3c967e6fcc09257b4d4e0574a46e50b011ecb54ec4a3b5b6b4bb7a29dd92d9fbc3df46d0d

C:\Windows\System\ZANxlYN.exe

MD5	1303d6530358c583a242bea082278827
SHA1	def3224230adc9c47360e260933e7cf75c055b23
SHA256	da47840378b0f89f6cd13a3d2f997222694886cbc6ba33cf949bde082307e8ca
SHA512	0e872ad8dc28bb65ce5735b4d2c2101c66b3698237680bd7f1f0dd6158e5b06cc226d13ee7122c8c7819fd3a5535130b3e6b54212fffa9a1cfee92d9265cf377

C:\Windows\System\ZkLedwQ.exe

MD5	a1aba2c77ae17d008601393cbf7f9d1a
SHA1	977750b1eb15c7c1d5b0532df2d7580ef4aea8c7
SHA256	fbcb0d0923508613725b5dc19e38cb83d4116ec51acecfa730efe03b073ece8e
SHA512	6815ab3e449272eb77539fa9b5f32ef89d565f190367e07bbe43b2077f01f4765556c387599b6e25e39370fffc884a2f92aefd1f88171d1b24340c68fb31bc88

C:\Windows\System\IcodiDG.exe

MD5	4185c339e5e6bb708b00ef6c1f7babba
SHA1	db8fd084e93e5657bc4e6cdffbf7c8e5e82fc019
SHA256	5c086f0fee3f2b7e29a80639e6f7a6498ad2a74994f482ff4ae14ad3abe2f98d
SHA512	35fd16b50b3b1789bf9384e1b6dd9ca949c088083c4de8282ec9947558bb6863167d2bde44f94d8f61b74742a46d405f019c7698c6d3b3d6e86b0517e37014bd

C:\Windows\System\efJhDqZ.exe

MD5	a21acb8f37286a30efbe368518447c4d
SHA1	bf9c6ccd704417e4a72ca034b0eeb7a06568c4ee
SHA256	f2cd1e50f111856854dc8c392da860ba4d3de6fcb1f171757bed602db10aca1a
SHA512	cf5b93b7157761422c976e91dd88427e64230d2847c17fc1032a728c744dd99fc6fc7b1d6427a363ef398b7c0e191c49e5c314af52616bb53da1e75a971142ff

C:\Windows\System\nzqtBJD.exe

MD5	74deb6da6315295da4d48f44ff2536bf
SHA1	369787a992f21418420cddbcadfb2c3a5122c5b9
SHA256	96c0974fe653041b780238ca816ad74f561a84901833ad4f6a88a4836c43e54b
SHA512	7717f80c53b8343efbb9593558fe95ee791ad74f43397bfadd5c201e6c661b9b55e04370891f335e1cfa1d8c20be6d2a814d4c36cfccc5f300b5a210960f0898

C:\Windows\System\LmiUons.exe

MD5	1cf70d042ec9e590dc8c66f15db0f88a
SHA1	75ab4e6d1df83ec0c7500b93f7ba347083c177c7
SHA256	fd02ee8986eefb2827aef5e3f5dd7483887b8d4d699ee6758b4e68f406cafc8b
SHA512	8fc618bf7deb543c6e3b5a20b21b17e299a414b22732d5f884325df81ec3d54ab0a7368e9eca2a5567553c5741c0ccc3babc2bf53f6d77c44403149c371485a9

C:\Windows\System\iLvaTZp.exe

MD5	980aa496f90fd8baea8b9baf47339cd2
SHA1	c4d554e6c092c792da92d86138525c3115173aad
SHA256	b172f4164187c1085caae015e3e80a2e2b2e9ed78b7ef7fd5e0bf62f19c35a7d
SHA512	9ddd7b7bd5b0526e6f303593789d4898e2f1d43e4c5fd4bbab4a644b46ae1498d60a4cf35fa1d5fbab72ce77daef8d240a4c67c7c6a5d9ceaf1920e1f675c3f4

C:\Windows\System\jhpQMZs.exe

MD5	c90b25c30e32a13ef4e89acb472bf3ea
SHA1	ac4244f2fa799832071b0731f7f5711510b9a3d2
SHA256	bbf7ab01d495b537ada0ca98d6ba5246eb6e2f1594047ebd98cd7b52af483561
SHA512	bcc51dba46b06c57a908740714e2c9d97e582b54a6bf0cf0b7ca6b0c4bc36286fe513678046e565d3ff85bfcc0e8b3a7439af56f885c70792be342be15aab2f5

C:\Windows\System\vJCdXUv.exe

MD5	29b1001cdc8a86aa35b0a5c5f3fb2ea7
SHA1	5c880bfba37e9332aff979ed4200f3c15bc45c98
SHA256	e08e9471571325f4772ba8819a08225914af86ba1e836c3f8e9134c273a4bc44
SHA512	deb210bce317a7d77c090518f74d6e93c7ba5e7b318bb3765624d6bd3ee6a30bf24a9f2455e42236d5f08b9a88ad5e34fe93a492b9cd3f206fa39bf98cc35fce

C:\Windows\System\lSUpYGL.exe

MD5	c9196df3c062dbdf1f35f3c1f693e477
SHA1	62ee4cbc762491076c8ea733fc5280aa4a09364a
SHA256	9474e16e192701f3e9849ebca29854109933d0fc74db6b2dc20b0ff45cad7a4a
SHA512	ad2d40a89026745edf26835bc7eaf2176f442614c98d2ffa61110472249d740ce24ac6867708d0ccba4700950727054fb350a9c59d982c64c4fe2f75547adfd7

C:\Windows\System\SegeiLh.exe

MD5	83e746f4c227b58ee7b9cf5b6f9312fc
SHA1	75307fe813521000b5152137a1caf4d8491f2332
SHA256	d4dbd71ea534d8de2a088b015cbac40d0dd00ec55a83796314e2c59f5a644228
SHA512	a26260651d94affafb09c17245fc00f93f4a25543957abce254794372575688b6f32a68c7b0f9dfb817e9a61c915dd0138005b090a4eb6e0387d2dd411fd2b9a

C:\Windows\System\txgxDxC.exe

MD5	3c4fc3b3cdbce72065002705af91aed5
SHA1	8ca46e627ddcd59a0490ffe16211eb00d0862b1b
SHA256	d25e8468812f1fb04c29763409f70882aa295fb8b680d693c3b02e3ad585673b
SHA512	e8b6e059eb100da5447412163182a9e4504cbbe693fe273e1e2c323cb424c2fb3b20c9345cb35f929741d502732c752daecaf458f3e6bc6b628687cdbb266587

C:\Windows\System\BUGwbWd.exe

MD5	e793f22e1f32aea81f147491b61eb3aa
SHA1	1bc6f4e4572f3b59f24c910397dd6a6cdd955491
SHA256	e5230ac334ca1ce9a2bbf5414929e5b24d3ab70524e02ef68cd63a1a87580012
SHA512	7ab91499cd472c45d1c762387346a5f1c893d1a0dec6b16469b9ae48dd078439f8f838f11727f7176d6c53ed3162edf3024eda63dfed477274848bf94cd19f40

C:\Windows\System\jwhpBAa.exe

MD5	61cc32a13fbb561171fc97fb4911e852
SHA1	e167296dc54c9631fe97538c5ad51b278c3ff3f2
SHA256	0b6ec0eec89e763161e7ba30bee1638d15edc31a5d5d416480f90952dae923cc
SHA512	d15ca8fe1b107a815d6ccfe71994e4be1dca021a905784dc8893e282eada24cdd43f3dcb5e9aec4489fbb8a1f6b87cb00480e0ce89e8914530ee4e8d2bf79b3b

C:\Windows\System\esNCesN.exe

MD5	55f4ed77127c7eb77b094e5c9ff6eb82
SHA1	1d26f63a36029d00a170e72cf7b3156bb299bcd1
SHA256	84b96497a8963e131d8318fef951598ed9740c519e282675ac39dd327b6a75ed
SHA512	21cab905089be2225b51b4e7da22fb278f667f9eab1e43c9a43c78eb33e119985dfe4e7cf411d98cb8e0a3ac3f6634147bfe067f1b9a239c2b84824a858a9b3e

C:\Windows\System\SyKVIcP.exe

MD5	a0f1dbacfbb057acfcf34435273727f0
SHA1	00636ea1746e53f61bf07060f8d57d3e1cbf4efd
SHA256	b9bda47ae457def8d8eebfb7bf9d4f913aa9f88d9b70cbceec27ea85b4563f4f
SHA512	5cc3453b98a917762c0b712dfe2bd26fe0c10ae026103e7d1a6e0f96ec793fb0a7ac8f2472f4698694d74c15fc0eee90a6f994a83e8e6c228d7760040d2fb292

C:\Windows\System\AwkIpGJ.exe

MD5	1e39a3ea92285f799af88a2e1e139a5f
SHA1	c720820826583bfe69e23b9060eb3d6244fe81c8
SHA256	d152fa4ec0a63e764c1fbf3b5755df887d802418c2770ae34da422b3e450652d
SHA512	aea233c432ad9966abfb07d36087994941fd651357ea3beea0c916cc3f6a818fc0d06d4515621f5de90f135cc63f0c557bd7e18821c347fd83165b5486231216

memory/3104-40-0x00007FF6AB350000-0x00007FF6AB6A4000-memory.dmp

memory/1628-569-0x00007FF690A50000-0x00007FF690DA4000-memory.dmp

memory/1080-570-0x00007FF648910000-0x00007FF648C64000-memory.dmp

memory/3684-571-0x00007FF611B90000-0x00007FF611EE4000-memory.dmp

memory/2864-573-0x00007FF6DC850000-0x00007FF6DCBA4000-memory.dmp

memory/4156-575-0x00007FF6E1910000-0x00007FF6E1C64000-memory.dmp

memory/4372-576-0x00007FF62A950000-0x00007FF62ACA4000-memory.dmp

memory/3568-574-0x00007FF787150000-0x00007FF7874A4000-memory.dmp

memory/3164-577-0x00007FF730620000-0x00007FF730974000-memory.dmp

memory/4784-579-0x00007FF6D2C50000-0x00007FF6D2FA4000-memory.dmp

memory/3612-580-0x00007FF760D80000-0x00007FF7610D4000-memory.dmp

memory/4756-581-0x00007FF7C5C10000-0x00007FF7C5F64000-memory.dmp

memory/5072-578-0x00007FF66F680000-0x00007FF66F9D4000-memory.dmp

memory/4404-572-0x00007FF737FE0000-0x00007FF738334000-memory.dmp

memory/3932-607-0x00007FF764060000-0x00007FF7643B4000-memory.dmp

memory/3040-620-0x00007FF691320000-0x00007FF691674000-memory.dmp

memory/2924-624-0x00007FF7BCEB0000-0x00007FF7BD204000-memory.dmp

memory/2848-621-0x00007FF717390000-0x00007FF7176E4000-memory.dmp

memory/392-614-0x00007FF665540000-0x00007FF665894000-memory.dmp

memory/4496-604-0x00007FF732DA0000-0x00007FF7330F4000-memory.dmp

memory/2388-599-0x00007FF7223E0000-0x00007FF722734000-memory.dmp

memory/8-591-0x00007FF740F20000-0x00007FF741274000-memory.dmp

memory/424-2131-0x00007FF782D10000-0x00007FF783064000-memory.dmp

memory/3104-2132-0x00007FF6AB350000-0x00007FF6AB6A4000-memory.dmp

memory/4960-2133-0x00007FF62D660000-0x00007FF62D9B4000-memory.dmp

memory/928-2134-0x00007FF63FCB0000-0x00007FF640004000-memory.dmp

memory/4088-2135-0x00007FF611750000-0x00007FF611AA4000-memory.dmp

memory/2556-2136-0x00007FF7F0500000-0x00007FF7F0854000-memory.dmp

memory/3040-2137-0x00007FF691320000-0x00007FF691674000-memory.dmp

memory/3104-2138-0x00007FF6AB350000-0x00007FF6AB6A4000-memory.dmp

memory/424-2139-0x00007FF782D10000-0x00007FF783064000-memory.dmp

memory/3652-2141-0x00007FF6D4120000-0x00007FF6D4474000-memory.dmp

memory/4960-2147-0x00007FF62D660000-0x00007FF62D9B4000-memory.dmp

memory/2848-2149-0x00007FF717390000-0x00007FF7176E4000-memory.dmp

memory/3568-2150-0x00007FF787150000-0x00007FF7874A4000-memory.dmp

memory/2864-2148-0x00007FF6DC850000-0x00007FF6DCBA4000-memory.dmp

memory/2924-2146-0x00007FF7BCEB0000-0x00007FF7BD204000-memory.dmp

memory/4940-2145-0x00007FF65C230000-0x00007FF65C584000-memory.dmp

memory/1628-2144-0x00007FF690A50000-0x00007FF690DA4000-memory.dmp

memory/1080-2143-0x00007FF648910000-0x00007FF648C64000-memory.dmp

memory/3684-2142-0x00007FF611B90000-0x00007FF611EE4000-memory.dmp

memory/4404-2140-0x00007FF737FE0000-0x00007FF738334000-memory.dmp

memory/4156-2153-0x00007FF6E1910000-0x00007FF6E1C64000-memory.dmp

memory/4372-2162-0x00007FF62A950000-0x00007FF62ACA4000-memory.dmp

memory/8-2161-0x00007FF740F20000-0x00007FF741274000-memory.dmp

memory/3164-2160-0x00007FF730620000-0x00007FF730974000-memory.dmp

memory/3612-2159-0x00007FF760D80000-0x00007FF7610D4000-memory.dmp

memory/4756-2158-0x00007FF7C5C10000-0x00007FF7C5F64000-memory.dmp

memory/2388-2157-0x00007FF7223E0000-0x00007FF722734000-memory.dmp

memory/4496-2156-0x00007FF732DA0000-0x00007FF7330F4000-memory.dmp

memory/3932-2155-0x00007FF764060000-0x00007FF7643B4000-memory.dmp

memory/392-2154-0x00007FF665540000-0x00007FF665894000-memory.dmp

memory/5072-2152-0x00007FF66F680000-0x00007FF66F9D4000-memory.dmp

memory/4784-2151-0x00007FF6D2C50000-0x00007FF6D2FA4000-memory.dmp

Sample ID	240613-13x5xsscnh
Target	8b0aae0b93211d6839a46bc1b18f0390_NeikiAnalytics.exe
SHA256	99408aa4708f6726ca1a74b138d4f4d78215fff14fa3364173581a73215985a0
Tags	miner upx xmrig

Malware Analysis Report

2024-07-28 22:39

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files