Analysis Overview

score

10^/10

SHA256

8a1e5e1ddcf2e0e8f683d20a30b4c462bbb9dcc9f30fe2c6e72d046348f2f900

Threat Level: Known bad

The file 8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

miner upx xmrig

XMRig Miner payload

Xmrig family

xmrig

XMRig Miner payload

UPX packed file

Executes dropped EXE

Loads dropped DLL

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 14:02

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Xmrig family

xmrig

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 14:02

Reported

2024-06-13 14:05

Platform

win7-20240611-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\jCgInLD.exe	N/A
N/A	N/A	C:\Windows\System\zjTGrEi.exe	N/A
N/A	N/A	C:\Windows\System\YgjvJli.exe	N/A
N/A	N/A	C:\Windows\System\IKZqXfJ.exe	N/A
N/A	N/A	C:\Windows\System\LZFBzUU.exe	N/A
N/A	N/A	C:\Windows\System\zJtmbBH.exe	N/A
N/A	N/A	C:\Windows\System\LfTsTlB.exe	N/A
N/A	N/A	C:\Windows\System\VkGigco.exe	N/A
N/A	N/A	C:\Windows\System\vdMTVGX.exe	N/A
N/A	N/A	C:\Windows\System\jscoeZL.exe	N/A
N/A	N/A	C:\Windows\System\OmGjMNA.exe	N/A
N/A	N/A	C:\Windows\System\oUDCMqp.exe	N/A
N/A	N/A	C:\Windows\System\UFgpTad.exe	N/A
N/A	N/A	C:\Windows\System\KIyubfe.exe	N/A
N/A	N/A	C:\Windows\System\bxCqGSC.exe	N/A
N/A	N/A	C:\Windows\System\IzuoVsG.exe	N/A
N/A	N/A	C:\Windows\System\MpSShpu.exe	N/A
N/A	N/A	C:\Windows\System\LWJoRWY.exe	N/A
N/A	N/A	C:\Windows\System\imVwQif.exe	N/A
N/A	N/A	C:\Windows\System\uuGQMnX.exe	N/A
N/A	N/A	C:\Windows\System\olkUHjg.exe	N/A
N/A	N/A	C:\Windows\System\MObzWpU.exe	N/A
N/A	N/A	C:\Windows\System\ieOrCjQ.exe	N/A
N/A	N/A	C:\Windows\System\MroydCD.exe	N/A
N/A	N/A	C:\Windows\System\riKBOrw.exe	N/A
N/A	N/A	C:\Windows\System\sNlNuVz.exe	N/A
N/A	N/A	C:\Windows\System\hkMgzFQ.exe	N/A
N/A	N/A	C:\Windows\System\jciQhya.exe	N/A
N/A	N/A	C:\Windows\System\moOQbaw.exe	N/A
N/A	N/A	C:\Windows\System\FVUOyTv.exe	N/A
N/A	N/A	C:\Windows\System\UUBKOfy.exe	N/A
N/A	N/A	C:\Windows\System\LjgMakt.exe	N/A
N/A	N/A	C:\Windows\System\zSFeltp.exe	N/A
N/A	N/A	C:\Windows\System\IohUIhY.exe	N/A
N/A	N/A	C:\Windows\System\ZNsSMDQ.exe	N/A
N/A	N/A	C:\Windows\System\HYcNWXR.exe	N/A
N/A	N/A	C:\Windows\System\gVmecPu.exe	N/A
N/A	N/A	C:\Windows\System\UkpJqjt.exe	N/A
N/A	N/A	C:\Windows\System\iiMhcgG.exe	N/A
N/A	N/A	C:\Windows\System\idSQQkl.exe	N/A
N/A	N/A	C:\Windows\System\wlVgeJs.exe	N/A
N/A	N/A	C:\Windows\System\OycAmBG.exe	N/A
N/A	N/A	C:\Windows\System\dqLVBQA.exe	N/A
N/A	N/A	C:\Windows\System\dhnVkzY.exe	N/A
N/A	N/A	C:\Windows\System\eFbAjKh.exe	N/A
N/A	N/A	C:\Windows\System\tEajefI.exe	N/A
N/A	N/A	C:\Windows\System\LVDLHeZ.exe	N/A
N/A	N/A	C:\Windows\System\qkRwsDr.exe	N/A
N/A	N/A	C:\Windows\System\GCbjLVy.exe	N/A
N/A	N/A	C:\Windows\System\oYtjluP.exe	N/A
N/A	N/A	C:\Windows\System\PRFTSIe.exe	N/A
N/A	N/A	C:\Windows\System\iLBvUaq.exe	N/A
N/A	N/A	C:\Windows\System\HRwaMTo.exe	N/A
N/A	N/A	C:\Windows\System\skzcRYM.exe	N/A
N/A	N/A	C:\Windows\System\HPDyCFU.exe	N/A
N/A	N/A	C:\Windows\System\oINJJHs.exe	N/A
N/A	N/A	C:\Windows\System\CorlbFX.exe	N/A
N/A	N/A	C:\Windows\System\HUSTwNH.exe	N/A
N/A	N/A	C:\Windows\System\lcUOvld.exe	N/A
N/A	N/A	C:\Windows\System\rVLAqbZ.exe	N/A
N/A	N/A	C:\Windows\System\hANYOWw.exe	N/A
N/A	N/A	C:\Windows\System\iUjsOjh.exe	N/A
N/A	N/A	C:\Windows\System\EvkDCzU.exe	N/A
N/A	N/A	C:\Windows\System\LmSCjHn.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\LWJoRWY.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AYoeoZc.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zegOjhc.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xjPIFaS.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bxCqGSC.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tLpxqNf.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kUscgTk.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\syvPfZa.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UskDjgb.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KjDXivG.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gfUNUGn.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\izBEqJZ.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mpvGbHm.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WlCphlA.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MQQpnKx.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ujNFfEA.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\irQHXnr.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SzyhRLF.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wtwJkat.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EMHdWdq.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ThtDFSO.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\drCQdcc.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wOosnwY.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FmEYOeZ.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AwbbNrj.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NKWZnJc.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gHWHDRw.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pJLBekD.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pCxcggA.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vChNdjL.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AoZzYuF.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Wszcmbn.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CaMHviU.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mBvSgew.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rOASOzD.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vBBFVFp.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SJvmXrX.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cDtpkDJ.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SjJyhMj.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UvTkelC.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JWWoMsN.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UmCyvZV.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Jvrlwwj.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CjYRkAR.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SvNlPlH.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xNHUqPv.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fSMCKEL.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AskxlPg.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uYHgtEY.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lGpYUfb.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XsOPonv.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YgaOUFi.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lcIoabF.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZdDmYFQ.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pKhNfbT.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KMTLofU.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zwKSoRk.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ufTjKNi.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uBIVKXP.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SxEhcfv.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mXunuEa.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UDcgYJV.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\octiMtJ.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZCFpRXc.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1792 wrote to memory of 2944	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\jCgInLD.exe
PID 1792 wrote to memory of 2944	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\jCgInLD.exe
PID 1792 wrote to memory of 2944	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\jCgInLD.exe
PID 1792 wrote to memory of 2952	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\YgjvJli.exe
PID 1792 wrote to memory of 2952	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\YgjvJli.exe
PID 1792 wrote to memory of 2952	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\YgjvJli.exe
PID 1792 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\zjTGrEi.exe
PID 1792 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\zjTGrEi.exe
PID 1792 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\zjTGrEi.exe
PID 1792 wrote to memory of 1748	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\IKZqXfJ.exe
PID 1792 wrote to memory of 1748	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\IKZqXfJ.exe
PID 1792 wrote to memory of 1748	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\IKZqXfJ.exe
PID 1792 wrote to memory of 3008	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\LfTsTlB.exe
PID 1792 wrote to memory of 3008	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\LfTsTlB.exe
PID 1792 wrote to memory of 3008	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\LfTsTlB.exe
PID 1792 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\LZFBzUU.exe
PID 1792 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\LZFBzUU.exe
PID 1792 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\LZFBzUU.exe
PID 1792 wrote to memory of 2708	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\KIyubfe.exe
PID 1792 wrote to memory of 2708	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\KIyubfe.exe
PID 1792 wrote to memory of 2708	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\KIyubfe.exe
PID 1792 wrote to memory of 2764	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\zJtmbBH.exe
PID 1792 wrote to memory of 2764	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\zJtmbBH.exe
PID 1792 wrote to memory of 2764	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\zJtmbBH.exe
PID 1792 wrote to memory of 2636	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\bxCqGSC.exe
PID 1792 wrote to memory of 2636	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\bxCqGSC.exe
PID 1792 wrote to memory of 2636	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\bxCqGSC.exe
PID 1792 wrote to memory of 2996	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\VkGigco.exe
PID 1792 wrote to memory of 2996	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\VkGigco.exe
PID 1792 wrote to memory of 2996	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\VkGigco.exe
PID 1792 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\IzuoVsG.exe
PID 1792 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\IzuoVsG.exe
PID 1792 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\IzuoVsG.exe
PID 1792 wrote to memory of 2536	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\vdMTVGX.exe
PID 1792 wrote to memory of 2536	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\vdMTVGX.exe
PID 1792 wrote to memory of 2536	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\vdMTVGX.exe
PID 1792 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\LWJoRWY.exe
PID 1792 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\LWJoRWY.exe
PID 1792 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\LWJoRWY.exe
PID 1792 wrote to memory of 2516	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\jscoeZL.exe
PID 1792 wrote to memory of 2516	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\jscoeZL.exe
PID 1792 wrote to memory of 2516	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\jscoeZL.exe
PID 1792 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\imVwQif.exe
PID 1792 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\imVwQif.exe
PID 1792 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\imVwQif.exe
PID 1792 wrote to memory of 2896	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\OmGjMNA.exe
PID 1792 wrote to memory of 2896	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\OmGjMNA.exe
PID 1792 wrote to memory of 2896	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\OmGjMNA.exe
PID 1792 wrote to memory of 2000	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\uuGQMnX.exe
PID 1792 wrote to memory of 2000	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\uuGQMnX.exe
PID 1792 wrote to memory of 2000	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\uuGQMnX.exe
PID 1792 wrote to memory of 1864	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\oUDCMqp.exe
PID 1792 wrote to memory of 1864	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\oUDCMqp.exe
PID 1792 wrote to memory of 1864	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\oUDCMqp.exe
PID 1792 wrote to memory of 1668	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\MObzWpU.exe
PID 1792 wrote to memory of 1668	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\MObzWpU.exe
PID 1792 wrote to memory of 1668	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\MObzWpU.exe
PID 1792 wrote to memory of 2424	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\UFgpTad.exe
PID 1792 wrote to memory of 2424	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\UFgpTad.exe
PID 1792 wrote to memory of 2424	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\UFgpTad.exe
PID 1792 wrote to memory of 1860	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\ieOrCjQ.exe
PID 1792 wrote to memory of 1860	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\ieOrCjQ.exe
PID 1792 wrote to memory of 1860	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\ieOrCjQ.exe
PID 1792 wrote to memory of 2404	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\MpSShpu.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe"

C:\Windows\System\jCgInLD.exe

C:\Windows\System\jCgInLD.exe

C:\Windows\System\YgjvJli.exe

C:\Windows\System\YgjvJli.exe

C:\Windows\System\zjTGrEi.exe

C:\Windows\System\zjTGrEi.exe

C:\Windows\System\IKZqXfJ.exe

C:\Windows\System\IKZqXfJ.exe

C:\Windows\System\LfTsTlB.exe

C:\Windows\System\LfTsTlB.exe

C:\Windows\System\LZFBzUU.exe

C:\Windows\System\LZFBzUU.exe

C:\Windows\System\KIyubfe.exe

C:\Windows\System\KIyubfe.exe

C:\Windows\System\zJtmbBH.exe

C:\Windows\System\zJtmbBH.exe

C:\Windows\System\bxCqGSC.exe

C:\Windows\System\bxCqGSC.exe

C:\Windows\System\VkGigco.exe

C:\Windows\System\VkGigco.exe

C:\Windows\System\IzuoVsG.exe

C:\Windows\System\IzuoVsG.exe

C:\Windows\System\vdMTVGX.exe

C:\Windows\System\vdMTVGX.exe

C:\Windows\System\LWJoRWY.exe

C:\Windows\System\LWJoRWY.exe

C:\Windows\System\jscoeZL.exe

C:\Windows\System\jscoeZL.exe

C:\Windows\System\imVwQif.exe

C:\Windows\System\imVwQif.exe

C:\Windows\System\OmGjMNA.exe

C:\Windows\System\OmGjMNA.exe

C:\Windows\System\uuGQMnX.exe

C:\Windows\System\uuGQMnX.exe

C:\Windows\System\oUDCMqp.exe

C:\Windows\System\oUDCMqp.exe

C:\Windows\System\MObzWpU.exe

C:\Windows\System\MObzWpU.exe

C:\Windows\System\UFgpTad.exe

C:\Windows\System\UFgpTad.exe

C:\Windows\System\ieOrCjQ.exe

C:\Windows\System\ieOrCjQ.exe

C:\Windows\System\MpSShpu.exe

C:\Windows\System\MpSShpu.exe

C:\Windows\System\MroydCD.exe

C:\Windows\System\MroydCD.exe

C:\Windows\System\olkUHjg.exe

C:\Windows\System\olkUHjg.exe

C:\Windows\System\sNlNuVz.exe

C:\Windows\System\sNlNuVz.exe

C:\Windows\System\riKBOrw.exe

C:\Windows\System\riKBOrw.exe

C:\Windows\System\hkMgzFQ.exe

C:\Windows\System\hkMgzFQ.exe

C:\Windows\System\jciQhya.exe

C:\Windows\System\jciQhya.exe

C:\Windows\System\moOQbaw.exe

C:\Windows\System\moOQbaw.exe

C:\Windows\System\FVUOyTv.exe

C:\Windows\System\FVUOyTv.exe

C:\Windows\System\UUBKOfy.exe

C:\Windows\System\UUBKOfy.exe

C:\Windows\System\LjgMakt.exe

C:\Windows\System\LjgMakt.exe

C:\Windows\System\zSFeltp.exe

C:\Windows\System\zSFeltp.exe

C:\Windows\System\IohUIhY.exe

C:\Windows\System\IohUIhY.exe

C:\Windows\System\ZNsSMDQ.exe

C:\Windows\System\ZNsSMDQ.exe

C:\Windows\System\HYcNWXR.exe

C:\Windows\System\HYcNWXR.exe

C:\Windows\System\gVmecPu.exe

C:\Windows\System\gVmecPu.exe

C:\Windows\System\UkpJqjt.exe

C:\Windows\System\UkpJqjt.exe

C:\Windows\System\iiMhcgG.exe

C:\Windows\System\iiMhcgG.exe

C:\Windows\System\idSQQkl.exe

C:\Windows\System\idSQQkl.exe

C:\Windows\System\wlVgeJs.exe

C:\Windows\System\wlVgeJs.exe

C:\Windows\System\OycAmBG.exe

C:\Windows\System\OycAmBG.exe

C:\Windows\System\dqLVBQA.exe

C:\Windows\System\dqLVBQA.exe

C:\Windows\System\dhnVkzY.exe

C:\Windows\System\dhnVkzY.exe

C:\Windows\System\eFbAjKh.exe

C:\Windows\System\eFbAjKh.exe

C:\Windows\System\tEajefI.exe

C:\Windows\System\tEajefI.exe

C:\Windows\System\LVDLHeZ.exe

C:\Windows\System\LVDLHeZ.exe

C:\Windows\System\qkRwsDr.exe

C:\Windows\System\qkRwsDr.exe

C:\Windows\System\GCbjLVy.exe

C:\Windows\System\GCbjLVy.exe

C:\Windows\System\oYtjluP.exe

C:\Windows\System\oYtjluP.exe

C:\Windows\System\PRFTSIe.exe

C:\Windows\System\PRFTSIe.exe

C:\Windows\System\iLBvUaq.exe

C:\Windows\System\iLBvUaq.exe

C:\Windows\System\HRwaMTo.exe

C:\Windows\System\HRwaMTo.exe

C:\Windows\System\skzcRYM.exe

C:\Windows\System\skzcRYM.exe

C:\Windows\System\HPDyCFU.exe

C:\Windows\System\HPDyCFU.exe

C:\Windows\System\oINJJHs.exe

C:\Windows\System\oINJJHs.exe

C:\Windows\System\CorlbFX.exe

C:\Windows\System\CorlbFX.exe

C:\Windows\System\HUSTwNH.exe

C:\Windows\System\HUSTwNH.exe

C:\Windows\System\lcUOvld.exe

C:\Windows\System\lcUOvld.exe

C:\Windows\System\rVLAqbZ.exe

C:\Windows\System\rVLAqbZ.exe

C:\Windows\System\hANYOWw.exe

C:\Windows\System\hANYOWw.exe

C:\Windows\System\iUjsOjh.exe

C:\Windows\System\iUjsOjh.exe

C:\Windows\System\EvkDCzU.exe

C:\Windows\System\EvkDCzU.exe

C:\Windows\System\LmSCjHn.exe

C:\Windows\System\LmSCjHn.exe

C:\Windows\System\GKIupEx.exe

C:\Windows\System\GKIupEx.exe

C:\Windows\System\JJUyiOf.exe

C:\Windows\System\JJUyiOf.exe

C:\Windows\System\gISBNfa.exe

C:\Windows\System\gISBNfa.exe

C:\Windows\System\NmOsngC.exe

C:\Windows\System\NmOsngC.exe

C:\Windows\System\dXCzgGy.exe

C:\Windows\System\dXCzgGy.exe

C:\Windows\System\VgvwjSM.exe

C:\Windows\System\VgvwjSM.exe

C:\Windows\System\SyzAVgq.exe

C:\Windows\System\SyzAVgq.exe

C:\Windows\System\VDWnLbo.exe

C:\Windows\System\VDWnLbo.exe

C:\Windows\System\oFcPLyF.exe

C:\Windows\System\oFcPLyF.exe

C:\Windows\System\NpkvNtB.exe

C:\Windows\System\NpkvNtB.exe

C:\Windows\System\rxsSPtW.exe

C:\Windows\System\rxsSPtW.exe

C:\Windows\System\AtnabkR.exe

C:\Windows\System\AtnabkR.exe

C:\Windows\System\aRnQUXk.exe

C:\Windows\System\aRnQUXk.exe

C:\Windows\System\mBvSgew.exe

C:\Windows\System\mBvSgew.exe

C:\Windows\System\xiaoyJy.exe

C:\Windows\System\xiaoyJy.exe

C:\Windows\System\NPChtDK.exe

C:\Windows\System\NPChtDK.exe

C:\Windows\System\xsVHIWU.exe

C:\Windows\System\xsVHIWU.exe

C:\Windows\System\oLibyhP.exe

C:\Windows\System\oLibyhP.exe

C:\Windows\System\RHGujUH.exe

C:\Windows\System\RHGujUH.exe

C:\Windows\System\WEXaAee.exe

C:\Windows\System\WEXaAee.exe

C:\Windows\System\Oixiipx.exe

C:\Windows\System\Oixiipx.exe

C:\Windows\System\BNAjrWN.exe

C:\Windows\System\BNAjrWN.exe

C:\Windows\System\ZgCWtWL.exe

C:\Windows\System\ZgCWtWL.exe

C:\Windows\System\dNTWXoM.exe

C:\Windows\System\dNTWXoM.exe

C:\Windows\System\GfnMxop.exe

C:\Windows\System\GfnMxop.exe

C:\Windows\System\yGrkhDK.exe

C:\Windows\System\yGrkhDK.exe

C:\Windows\System\XBHoDYC.exe

C:\Windows\System\XBHoDYC.exe

C:\Windows\System\hfMByzu.exe

C:\Windows\System\hfMByzu.exe

C:\Windows\System\AmzWnmR.exe

C:\Windows\System\AmzWnmR.exe

C:\Windows\System\ghEeWLb.exe

C:\Windows\System\ghEeWLb.exe

C:\Windows\System\rmmCCcn.exe

C:\Windows\System\rmmCCcn.exe

C:\Windows\System\WBdSHrn.exe

C:\Windows\System\WBdSHrn.exe

C:\Windows\System\cvDrtjK.exe

C:\Windows\System\cvDrtjK.exe

C:\Windows\System\gfooVRN.exe

C:\Windows\System\gfooVRN.exe

C:\Windows\System\PHJxmgQ.exe

C:\Windows\System\PHJxmgQ.exe

C:\Windows\System\NAPzFeJ.exe

C:\Windows\System\NAPzFeJ.exe

C:\Windows\System\nAivCtJ.exe

C:\Windows\System\nAivCtJ.exe

C:\Windows\System\kUscgTk.exe

C:\Windows\System\kUscgTk.exe

C:\Windows\System\tLpxqNf.exe

C:\Windows\System\tLpxqNf.exe

C:\Windows\System\PEKlHJY.exe

C:\Windows\System\PEKlHJY.exe

C:\Windows\System\gHWHDRw.exe

C:\Windows\System\gHWHDRw.exe

C:\Windows\System\aqODFjk.exe

C:\Windows\System\aqODFjk.exe

C:\Windows\System\YgaOUFi.exe

C:\Windows\System\YgaOUFi.exe

C:\Windows\System\pwkyfNW.exe

C:\Windows\System\pwkyfNW.exe

C:\Windows\System\cuURxqM.exe

C:\Windows\System\cuURxqM.exe

C:\Windows\System\akUWkzx.exe

C:\Windows\System\akUWkzx.exe

C:\Windows\System\gZpiUbX.exe

C:\Windows\System\gZpiUbX.exe

C:\Windows\System\dBlMCqa.exe

C:\Windows\System\dBlMCqa.exe

C:\Windows\System\aoxtBSJ.exe

C:\Windows\System\aoxtBSJ.exe

C:\Windows\System\GRysSgI.exe

C:\Windows\System\GRysSgI.exe

C:\Windows\System\OvGSaaN.exe

C:\Windows\System\OvGSaaN.exe

C:\Windows\System\OXqXCNC.exe

C:\Windows\System\OXqXCNC.exe

C:\Windows\System\ThtDFSO.exe

C:\Windows\System\ThtDFSO.exe

C:\Windows\System\jtSgxmx.exe

C:\Windows\System\jtSgxmx.exe

C:\Windows\System\HeFnbxA.exe

C:\Windows\System\HeFnbxA.exe

C:\Windows\System\CursYjo.exe

C:\Windows\System\CursYjo.exe

C:\Windows\System\XxpZDoK.exe

C:\Windows\System\XxpZDoK.exe

C:\Windows\System\ukYUceA.exe

C:\Windows\System\ukYUceA.exe

C:\Windows\System\zsTwvds.exe

C:\Windows\System\zsTwvds.exe

C:\Windows\System\gfWigUy.exe

C:\Windows\System\gfWigUy.exe

C:\Windows\System\VTgOVtw.exe

C:\Windows\System\VTgOVtw.exe

C:\Windows\System\YjyxzfF.exe

C:\Windows\System\YjyxzfF.exe

C:\Windows\System\wtGikeg.exe

C:\Windows\System\wtGikeg.exe

C:\Windows\System\GMEOBne.exe

C:\Windows\System\GMEOBne.exe

C:\Windows\System\kEQLXwM.exe

C:\Windows\System\kEQLXwM.exe

C:\Windows\System\vOZmOxu.exe

C:\Windows\System\vOZmOxu.exe

C:\Windows\System\UYhhCPK.exe

C:\Windows\System\UYhhCPK.exe

C:\Windows\System\kXyhDxc.exe

C:\Windows\System\kXyhDxc.exe

C:\Windows\System\YiuiOZb.exe

C:\Windows\System\YiuiOZb.exe

C:\Windows\System\RNYnrgy.exe

C:\Windows\System\RNYnrgy.exe

C:\Windows\System\YGUdWSo.exe

C:\Windows\System\YGUdWSo.exe

C:\Windows\System\QxFZJPT.exe

C:\Windows\System\QxFZJPT.exe

C:\Windows\System\nGBzszZ.exe

C:\Windows\System\nGBzszZ.exe

C:\Windows\System\qZuUZbF.exe

C:\Windows\System\qZuUZbF.exe

C:\Windows\System\GLkNsiR.exe

C:\Windows\System\GLkNsiR.exe

C:\Windows\System\gXUImar.exe

C:\Windows\System\gXUImar.exe

C:\Windows\System\ugimtCT.exe

C:\Windows\System\ugimtCT.exe

C:\Windows\System\PFkbmXZ.exe

C:\Windows\System\PFkbmXZ.exe

C:\Windows\System\DTqCdsT.exe

C:\Windows\System\DTqCdsT.exe

C:\Windows\System\QEzUUXf.exe

C:\Windows\System\QEzUUXf.exe

C:\Windows\System\LfgBIEt.exe

C:\Windows\System\LfgBIEt.exe

C:\Windows\System\DxuUeGD.exe

C:\Windows\System\DxuUeGD.exe

C:\Windows\System\SrBBKUB.exe

C:\Windows\System\SrBBKUB.exe

C:\Windows\System\GgJaYfc.exe

C:\Windows\System\GgJaYfc.exe

C:\Windows\System\pibJwKV.exe

C:\Windows\System\pibJwKV.exe

C:\Windows\System\FMxCtWJ.exe

C:\Windows\System\FMxCtWJ.exe

C:\Windows\System\gmEtuKz.exe

C:\Windows\System\gmEtuKz.exe

C:\Windows\System\pEcppzE.exe

C:\Windows\System\pEcppzE.exe

C:\Windows\System\ZCFpRXc.exe

C:\Windows\System\ZCFpRXc.exe

C:\Windows\System\mxVvadM.exe

C:\Windows\System\mxVvadM.exe

C:\Windows\System\JxShlhz.exe

C:\Windows\System\JxShlhz.exe

C:\Windows\System\GQrocbk.exe

C:\Windows\System\GQrocbk.exe

C:\Windows\System\WLwccvd.exe

C:\Windows\System\WLwccvd.exe

C:\Windows\System\lvesDTw.exe

C:\Windows\System\lvesDTw.exe

C:\Windows\System\cRWtzdd.exe

C:\Windows\System\cRWtzdd.exe

C:\Windows\System\mvXhpAL.exe

C:\Windows\System\mvXhpAL.exe

C:\Windows\System\uSfPCOo.exe

C:\Windows\System\uSfPCOo.exe

C:\Windows\System\bZYYfGc.exe

C:\Windows\System\bZYYfGc.exe

C:\Windows\System\iZDOenD.exe

C:\Windows\System\iZDOenD.exe

C:\Windows\System\peZzLMZ.exe

C:\Windows\System\peZzLMZ.exe

C:\Windows\System\VTOptBr.exe

C:\Windows\System\VTOptBr.exe

C:\Windows\System\BSmiGzI.exe

C:\Windows\System\BSmiGzI.exe

C:\Windows\System\WmxHvuF.exe

C:\Windows\System\WmxHvuF.exe

C:\Windows\System\soLYQkr.exe

C:\Windows\System\soLYQkr.exe

C:\Windows\System\KDHkPhw.exe

C:\Windows\System\KDHkPhw.exe

C:\Windows\System\HGlLlqu.exe

C:\Windows\System\HGlLlqu.exe

C:\Windows\System\nFDbOUT.exe

C:\Windows\System\nFDbOUT.exe

C:\Windows\System\YNtZNWR.exe

C:\Windows\System\YNtZNWR.exe

C:\Windows\System\SjJyhMj.exe

C:\Windows\System\SjJyhMj.exe

C:\Windows\System\CSJcZEz.exe

C:\Windows\System\CSJcZEz.exe

C:\Windows\System\uYzzxIa.exe

C:\Windows\System\uYzzxIa.exe

C:\Windows\System\YtitWGI.exe

C:\Windows\System\YtitWGI.exe

C:\Windows\System\MopyrmB.exe

C:\Windows\System\MopyrmB.exe

C:\Windows\System\MhZaNgg.exe

C:\Windows\System\MhZaNgg.exe

C:\Windows\System\BNEFEuD.exe

C:\Windows\System\BNEFEuD.exe

C:\Windows\System\XEZuFjD.exe

C:\Windows\System\XEZuFjD.exe

C:\Windows\System\etGtMzw.exe

C:\Windows\System\etGtMzw.exe

C:\Windows\System\MIMWwwA.exe

C:\Windows\System\MIMWwwA.exe

C:\Windows\System\ckiPwlh.exe

C:\Windows\System\ckiPwlh.exe

C:\Windows\System\xrKbick.exe

C:\Windows\System\xrKbick.exe

C:\Windows\System\ibvEXTe.exe

C:\Windows\System\ibvEXTe.exe

C:\Windows\System\SafmzFv.exe

C:\Windows\System\SafmzFv.exe

C:\Windows\System\tsXHebT.exe

C:\Windows\System\tsXHebT.exe

C:\Windows\System\DujDSAp.exe

C:\Windows\System\DujDSAp.exe

C:\Windows\System\Fyshdxn.exe

C:\Windows\System\Fyshdxn.exe

C:\Windows\System\EPwFXba.exe

C:\Windows\System\EPwFXba.exe

C:\Windows\System\LRMsTch.exe

C:\Windows\System\LRMsTch.exe

C:\Windows\System\yyavdRQ.exe

C:\Windows\System\yyavdRQ.exe

C:\Windows\System\MAijpkx.exe

C:\Windows\System\MAijpkx.exe

C:\Windows\System\ZOkPklh.exe

C:\Windows\System\ZOkPklh.exe

C:\Windows\System\lAWOtZY.exe

C:\Windows\System\lAWOtZY.exe

C:\Windows\System\NBilwxc.exe

C:\Windows\System\NBilwxc.exe

C:\Windows\System\PcbSzVy.exe

C:\Windows\System\PcbSzVy.exe

C:\Windows\System\PTMgPmU.exe

C:\Windows\System\PTMgPmU.exe

C:\Windows\System\BswQguO.exe

C:\Windows\System\BswQguO.exe

C:\Windows\System\PGMoNVd.exe

C:\Windows\System\PGMoNVd.exe

C:\Windows\System\wRJlhqy.exe

C:\Windows\System\wRJlhqy.exe

C:\Windows\System\aVuOzsU.exe

C:\Windows\System\aVuOzsU.exe

C:\Windows\System\VwxIeeT.exe

C:\Windows\System\VwxIeeT.exe

C:\Windows\System\iXwQJDf.exe

C:\Windows\System\iXwQJDf.exe

C:\Windows\System\yvKvUHl.exe

C:\Windows\System\yvKvUHl.exe

C:\Windows\System\lWNmPvQ.exe

C:\Windows\System\lWNmPvQ.exe

C:\Windows\System\LWhmHaQ.exe

C:\Windows\System\LWhmHaQ.exe

C:\Windows\System\vYZTdcf.exe

C:\Windows\System\vYZTdcf.exe

C:\Windows\System\arTRRGI.exe

C:\Windows\System\arTRRGI.exe

C:\Windows\System\HnXCFdX.exe

C:\Windows\System\HnXCFdX.exe

C:\Windows\System\rXaccbf.exe

C:\Windows\System\rXaccbf.exe

C:\Windows\System\hvKUwvw.exe

C:\Windows\System\hvKUwvw.exe

C:\Windows\System\taJmgfI.exe

C:\Windows\System\taJmgfI.exe

C:\Windows\System\XYIMXFy.exe

C:\Windows\System\XYIMXFy.exe

C:\Windows\System\tKgWvmh.exe

C:\Windows\System\tKgWvmh.exe

C:\Windows\System\mPmlSbr.exe

C:\Windows\System\mPmlSbr.exe

C:\Windows\System\PjSitKV.exe

C:\Windows\System\PjSitKV.exe

C:\Windows\System\xYknaFN.exe

C:\Windows\System\xYknaFN.exe

C:\Windows\System\XVebMcb.exe

C:\Windows\System\XVebMcb.exe

C:\Windows\System\kycyesP.exe

C:\Windows\System\kycyesP.exe

C:\Windows\System\LQLLEGU.exe

C:\Windows\System\LQLLEGU.exe

C:\Windows\System\lqvpsmF.exe

C:\Windows\System\lqvpsmF.exe

C:\Windows\System\UhpusxF.exe

C:\Windows\System\UhpusxF.exe

C:\Windows\System\SFmdmqj.exe

C:\Windows\System\SFmdmqj.exe

C:\Windows\System\Pyfeuzb.exe

C:\Windows\System\Pyfeuzb.exe

C:\Windows\System\rPCNItO.exe

C:\Windows\System\rPCNItO.exe

C:\Windows\System\RruKYAK.exe

C:\Windows\System\RruKYAK.exe

C:\Windows\System\DdZCyOP.exe

C:\Windows\System\DdZCyOP.exe

C:\Windows\System\wVrXLac.exe

C:\Windows\System\wVrXLac.exe

C:\Windows\System\ERAGMuG.exe

C:\Windows\System\ERAGMuG.exe

C:\Windows\System\dyEcVek.exe

C:\Windows\System\dyEcVek.exe

C:\Windows\System\pnBCLld.exe

C:\Windows\System\pnBCLld.exe

C:\Windows\System\mNKQYFC.exe

C:\Windows\System\mNKQYFC.exe

C:\Windows\System\vSlbcny.exe

C:\Windows\System\vSlbcny.exe

C:\Windows\System\iqwhVYn.exe

C:\Windows\System\iqwhVYn.exe

C:\Windows\System\hMlycXN.exe

C:\Windows\System\hMlycXN.exe

C:\Windows\System\gcEMzYg.exe

C:\Windows\System\gcEMzYg.exe

C:\Windows\System\oGFlLAe.exe

C:\Windows\System\oGFlLAe.exe

C:\Windows\System\PwYrJAR.exe

C:\Windows\System\PwYrJAR.exe

C:\Windows\System\XupvpQm.exe

C:\Windows\System\XupvpQm.exe

C:\Windows\System\cNpttCu.exe

C:\Windows\System\cNpttCu.exe

C:\Windows\System\qtVImBs.exe

C:\Windows\System\qtVImBs.exe

C:\Windows\System\gnkpxLg.exe

C:\Windows\System\gnkpxLg.exe

C:\Windows\System\vrkoHRJ.exe

C:\Windows\System\vrkoHRJ.exe

C:\Windows\System\CIdrFat.exe

C:\Windows\System\CIdrFat.exe

C:\Windows\System\jFmDNBb.exe

C:\Windows\System\jFmDNBb.exe

C:\Windows\System\EuiiVMX.exe

C:\Windows\System\EuiiVMX.exe

C:\Windows\System\UEfzxTv.exe

C:\Windows\System\UEfzxTv.exe

C:\Windows\System\GbvKDBz.exe

C:\Windows\System\GbvKDBz.exe

C:\Windows\System\ZVWUrBl.exe

C:\Windows\System\ZVWUrBl.exe

C:\Windows\System\fQYfHzl.exe

C:\Windows\System\fQYfHzl.exe

C:\Windows\System\NjAmMgM.exe

C:\Windows\System\NjAmMgM.exe

C:\Windows\System\hsNwszS.exe

C:\Windows\System\hsNwszS.exe

C:\Windows\System\DlBDEyV.exe

C:\Windows\System\DlBDEyV.exe

C:\Windows\System\HiYsGmX.exe

C:\Windows\System\HiYsGmX.exe

C:\Windows\System\uXWtTYB.exe

C:\Windows\System\uXWtTYB.exe

C:\Windows\System\hhrNzUW.exe

C:\Windows\System\hhrNzUW.exe

C:\Windows\System\nSpMIrf.exe

C:\Windows\System\nSpMIrf.exe

C:\Windows\System\ufTjKNi.exe

C:\Windows\System\ufTjKNi.exe

C:\Windows\System\geoDYcs.exe

C:\Windows\System\geoDYcs.exe

C:\Windows\System\NyAvmjd.exe

C:\Windows\System\NyAvmjd.exe

C:\Windows\System\ccXQnnE.exe

C:\Windows\System\ccXQnnE.exe

C:\Windows\System\jnWiazx.exe

C:\Windows\System\jnWiazx.exe

C:\Windows\System\xDRzvky.exe

C:\Windows\System\xDRzvky.exe

C:\Windows\System\sOMaqKp.exe

C:\Windows\System\sOMaqKp.exe

C:\Windows\System\PEvVKtS.exe

C:\Windows\System\PEvVKtS.exe

C:\Windows\System\MRMYubx.exe

C:\Windows\System\MRMYubx.exe

C:\Windows\System\qgAHwcw.exe

C:\Windows\System\qgAHwcw.exe

C:\Windows\System\KNveqyf.exe

C:\Windows\System\KNveqyf.exe

C:\Windows\System\GgpoFLf.exe

C:\Windows\System\GgpoFLf.exe

C:\Windows\System\JjEemkC.exe

C:\Windows\System\JjEemkC.exe

C:\Windows\System\CRgXBza.exe

C:\Windows\System\CRgXBza.exe

C:\Windows\System\naMTJgY.exe

C:\Windows\System\naMTJgY.exe

C:\Windows\System\LdykhRe.exe

C:\Windows\System\LdykhRe.exe

C:\Windows\System\wiQhbLP.exe

C:\Windows\System\wiQhbLP.exe

C:\Windows\System\VWaNpOt.exe

C:\Windows\System\VWaNpOt.exe

C:\Windows\System\RVMyrne.exe

C:\Windows\System\RVMyrne.exe

C:\Windows\System\LdrgNsE.exe

C:\Windows\System\LdrgNsE.exe

C:\Windows\System\AYoeoZc.exe

C:\Windows\System\AYoeoZc.exe

C:\Windows\System\HqVhMwe.exe

C:\Windows\System\HqVhMwe.exe

C:\Windows\System\nqWQJsK.exe

C:\Windows\System\nqWQJsK.exe

C:\Windows\System\VGFsXid.exe

C:\Windows\System\VGFsXid.exe

C:\Windows\System\pJLBekD.exe

C:\Windows\System\pJLBekD.exe

C:\Windows\System\ZdMXszD.exe

C:\Windows\System\ZdMXszD.exe

C:\Windows\System\KkKHiva.exe

C:\Windows\System\KkKHiva.exe

C:\Windows\System\ejkMBZs.exe

C:\Windows\System\ejkMBZs.exe

C:\Windows\System\Vnbyhla.exe

C:\Windows\System\Vnbyhla.exe

C:\Windows\System\bKHhlbC.exe

C:\Windows\System\bKHhlbC.exe

C:\Windows\System\usevmpz.exe

C:\Windows\System\usevmpz.exe

C:\Windows\System\nxJvvKg.exe

C:\Windows\System\nxJvvKg.exe

C:\Windows\System\chqEIPj.exe

C:\Windows\System\chqEIPj.exe

C:\Windows\System\rvJwEEO.exe

C:\Windows\System\rvJwEEO.exe

C:\Windows\System\fbmaTlE.exe

C:\Windows\System\fbmaTlE.exe

C:\Windows\System\GiFBGpc.exe

C:\Windows\System\GiFBGpc.exe

C:\Windows\System\fADnUzo.exe

C:\Windows\System\fADnUzo.exe

C:\Windows\System\VGQWwrK.exe

C:\Windows\System\VGQWwrK.exe

C:\Windows\System\xAdWZMF.exe

C:\Windows\System\xAdWZMF.exe

C:\Windows\System\gxLoxaK.exe

C:\Windows\System\gxLoxaK.exe

C:\Windows\System\CDfLPuq.exe

C:\Windows\System\CDfLPuq.exe

C:\Windows\System\YksCnom.exe

C:\Windows\System\YksCnom.exe

C:\Windows\System\aMsrMNV.exe

C:\Windows\System\aMsrMNV.exe

C:\Windows\System\kvxMZMa.exe

C:\Windows\System\kvxMZMa.exe

C:\Windows\System\GZUKKga.exe

C:\Windows\System\GZUKKga.exe

C:\Windows\System\mGBFeYD.exe

C:\Windows\System\mGBFeYD.exe

C:\Windows\System\DBgzYhc.exe

C:\Windows\System\DBgzYhc.exe

C:\Windows\System\IUWuqYS.exe

C:\Windows\System\IUWuqYS.exe

C:\Windows\System\PkQevKk.exe

C:\Windows\System\PkQevKk.exe

C:\Windows\System\woJcuuM.exe

C:\Windows\System\woJcuuM.exe

C:\Windows\System\yHhOpWl.exe

C:\Windows\System\yHhOpWl.exe

C:\Windows\System\kbubtuI.exe

C:\Windows\System\kbubtuI.exe

C:\Windows\System\OjhPKTD.exe

C:\Windows\System\OjhPKTD.exe

C:\Windows\System\PBtkHvo.exe

C:\Windows\System\PBtkHvo.exe

C:\Windows\System\dtWqnPC.exe

C:\Windows\System\dtWqnPC.exe

C:\Windows\System\xjrDVjj.exe

C:\Windows\System\xjrDVjj.exe

C:\Windows\System\dMCcuwF.exe

C:\Windows\System\dMCcuwF.exe

C:\Windows\System\cNUAqkh.exe

C:\Windows\System\cNUAqkh.exe

C:\Windows\System\ZunMZXr.exe

C:\Windows\System\ZunMZXr.exe

C:\Windows\System\rVBUxQg.exe

C:\Windows\System\rVBUxQg.exe

C:\Windows\System\ilMYBIS.exe

C:\Windows\System\ilMYBIS.exe

C:\Windows\System\LsrQDtB.exe

C:\Windows\System\LsrQDtB.exe

C:\Windows\System\ZTYVibV.exe

C:\Windows\System\ZTYVibV.exe

C:\Windows\System\tBiSyWY.exe

C:\Windows\System\tBiSyWY.exe

C:\Windows\System\vLCRhCf.exe

C:\Windows\System\vLCRhCf.exe

C:\Windows\System\FUGkNgC.exe

C:\Windows\System\FUGkNgC.exe

C:\Windows\System\ocscHjP.exe

C:\Windows\System\ocscHjP.exe

C:\Windows\System\GFSSHMh.exe

C:\Windows\System\GFSSHMh.exe

C:\Windows\System\UggDdfW.exe

C:\Windows\System\UggDdfW.exe

C:\Windows\System\YrPvHtD.exe

C:\Windows\System\YrPvHtD.exe

C:\Windows\System\xAGGjtk.exe

C:\Windows\System\xAGGjtk.exe

C:\Windows\System\MAlYgZz.exe

C:\Windows\System\MAlYgZz.exe

C:\Windows\System\fNHVFRR.exe

C:\Windows\System\fNHVFRR.exe

C:\Windows\System\UvuMHMG.exe

C:\Windows\System\UvuMHMG.exe

C:\Windows\System\mfqFNav.exe

C:\Windows\System\mfqFNav.exe

C:\Windows\System\qochXvk.exe

C:\Windows\System\qochXvk.exe

C:\Windows\System\FZJTBau.exe

C:\Windows\System\FZJTBau.exe

C:\Windows\System\dYosvjc.exe

C:\Windows\System\dYosvjc.exe

C:\Windows\System\zSAhRtc.exe

C:\Windows\System\zSAhRtc.exe

C:\Windows\System\TKtfsfU.exe

C:\Windows\System\TKtfsfU.exe

C:\Windows\System\NNQOZcP.exe

C:\Windows\System\NNQOZcP.exe

C:\Windows\System\gIZJmVS.exe

C:\Windows\System\gIZJmVS.exe

C:\Windows\System\ZvYArYI.exe

C:\Windows\System\ZvYArYI.exe

C:\Windows\System\ZsWknrX.exe

C:\Windows\System\ZsWknrX.exe

C:\Windows\System\drCQdcc.exe

C:\Windows\System\drCQdcc.exe

C:\Windows\System\EJFmRkz.exe

C:\Windows\System\EJFmRkz.exe

C:\Windows\System\lfpGpyp.exe

C:\Windows\System\lfpGpyp.exe

C:\Windows\System\doiNnBA.exe

C:\Windows\System\doiNnBA.exe

C:\Windows\System\fAmQzul.exe

C:\Windows\System\fAmQzul.exe

C:\Windows\System\nbEiOPE.exe

C:\Windows\System\nbEiOPE.exe

C:\Windows\System\EETfOqT.exe

C:\Windows\System\EETfOqT.exe

C:\Windows\System\WysmuvM.exe

C:\Windows\System\WysmuvM.exe

C:\Windows\System\NrUBmcb.exe

C:\Windows\System\NrUBmcb.exe

C:\Windows\System\zegOjhc.exe

C:\Windows\System\zegOjhc.exe

C:\Windows\System\nDprric.exe

C:\Windows\System\nDprric.exe

C:\Windows\System\bqMtAYF.exe

C:\Windows\System\bqMtAYF.exe

C:\Windows\System\rOASOzD.exe

C:\Windows\System\rOASOzD.exe

C:\Windows\System\NdEQPlq.exe

C:\Windows\System\NdEQPlq.exe

C:\Windows\System\WlCphlA.exe

C:\Windows\System\WlCphlA.exe

C:\Windows\System\eFpjZYv.exe

C:\Windows\System\eFpjZYv.exe

C:\Windows\System\SIkyWqh.exe

C:\Windows\System\SIkyWqh.exe

C:\Windows\System\DoluLXK.exe

C:\Windows\System\DoluLXK.exe

C:\Windows\System\ltfjvbp.exe

C:\Windows\System\ltfjvbp.exe

C:\Windows\System\xMqdwKt.exe

C:\Windows\System\xMqdwKt.exe

C:\Windows\System\RbLOepY.exe

C:\Windows\System\RbLOepY.exe

C:\Windows\System\CuWRWxt.exe

C:\Windows\System\CuWRWxt.exe

C:\Windows\System\QYBqWMN.exe

C:\Windows\System\QYBqWMN.exe

C:\Windows\System\WaTqzLs.exe

C:\Windows\System\WaTqzLs.exe

C:\Windows\System\TovbHvA.exe

C:\Windows\System\TovbHvA.exe

C:\Windows\System\OpaIwJm.exe

C:\Windows\System\OpaIwJm.exe

C:\Windows\System\raasKoE.exe

C:\Windows\System\raasKoE.exe

C:\Windows\System\urQybhD.exe

C:\Windows\System\urQybhD.exe

C:\Windows\System\eBuHgmk.exe

C:\Windows\System\eBuHgmk.exe

C:\Windows\System\gSWbhjc.exe

C:\Windows\System\gSWbhjc.exe

C:\Windows\System\OmuKmMY.exe

C:\Windows\System\OmuKmMY.exe

C:\Windows\System\DjmeRDN.exe

C:\Windows\System\DjmeRDN.exe

C:\Windows\System\etzPTir.exe

C:\Windows\System\etzPTir.exe

C:\Windows\System\eRfRXeZ.exe

C:\Windows\System\eRfRXeZ.exe

C:\Windows\System\mAxNfdZ.exe

C:\Windows\System\mAxNfdZ.exe

C:\Windows\System\xFNXqPD.exe

C:\Windows\System\xFNXqPD.exe

C:\Windows\System\gvhBzPx.exe

C:\Windows\System\gvhBzPx.exe

C:\Windows\System\uGjAsLO.exe

C:\Windows\System\uGjAsLO.exe

C:\Windows\System\dwKsUcQ.exe

C:\Windows\System\dwKsUcQ.exe

C:\Windows\System\OiAkKqR.exe

C:\Windows\System\OiAkKqR.exe

C:\Windows\System\utDlwaO.exe

C:\Windows\System\utDlwaO.exe

C:\Windows\System\PYaLlwx.exe

C:\Windows\System\PYaLlwx.exe

C:\Windows\System\LcAFYCE.exe

C:\Windows\System\LcAFYCE.exe

C:\Windows\System\XAkMGQZ.exe

C:\Windows\System\XAkMGQZ.exe

C:\Windows\System\kqmbGZT.exe

C:\Windows\System\kqmbGZT.exe

C:\Windows\System\UXGUWzg.exe

C:\Windows\System\UXGUWzg.exe

C:\Windows\System\fSMCKEL.exe

C:\Windows\System\fSMCKEL.exe

C:\Windows\System\DhDTnNT.exe

C:\Windows\System\DhDTnNT.exe

C:\Windows\System\mLhvLGw.exe

C:\Windows\System\mLhvLGw.exe

C:\Windows\System\IjGLhcf.exe

C:\Windows\System\IjGLhcf.exe

C:\Windows\System\JjvZgXZ.exe

C:\Windows\System\JjvZgXZ.exe

C:\Windows\System\tagQZuk.exe

C:\Windows\System\tagQZuk.exe

C:\Windows\System\zZDSaad.exe

C:\Windows\System\zZDSaad.exe

C:\Windows\System\xsEtmNJ.exe

C:\Windows\System\xsEtmNJ.exe

C:\Windows\System\fpOMvfL.exe

C:\Windows\System\fpOMvfL.exe

C:\Windows\System\fiSEtCe.exe

C:\Windows\System\fiSEtCe.exe

C:\Windows\System\jdqMoXq.exe

C:\Windows\System\jdqMoXq.exe

C:\Windows\System\YkVJalB.exe

C:\Windows\System\YkVJalB.exe

C:\Windows\System\owsBCea.exe

C:\Windows\System\owsBCea.exe

C:\Windows\System\Xnmigmp.exe

C:\Windows\System\Xnmigmp.exe

C:\Windows\System\WgIztry.exe

C:\Windows\System\WgIztry.exe

C:\Windows\System\dvkHrkd.exe

C:\Windows\System\dvkHrkd.exe

C:\Windows\System\ZSuOeCx.exe

C:\Windows\System\ZSuOeCx.exe

C:\Windows\System\lprhWNP.exe

C:\Windows\System\lprhWNP.exe

C:\Windows\System\MQQpnKx.exe

C:\Windows\System\MQQpnKx.exe

C:\Windows\System\BbrUgFb.exe

C:\Windows\System\BbrUgFb.exe

C:\Windows\System\VpDiKIJ.exe

C:\Windows\System\VpDiKIJ.exe

C:\Windows\System\puIPklq.exe

C:\Windows\System\puIPklq.exe

C:\Windows\System\uDGbpSC.exe

C:\Windows\System\uDGbpSC.exe

C:\Windows\System\oeevAOX.exe

C:\Windows\System\oeevAOX.exe

C:\Windows\System\SfFwwGj.exe

C:\Windows\System\SfFwwGj.exe

C:\Windows\System\syvPfZa.exe

C:\Windows\System\syvPfZa.exe

C:\Windows\System\WgBuDIi.exe

C:\Windows\System\WgBuDIi.exe

C:\Windows\System\bqXXSAp.exe

C:\Windows\System\bqXXSAp.exe

C:\Windows\System\uwuaXXW.exe

C:\Windows\System\uwuaXXW.exe

C:\Windows\System\zbVvvAg.exe

C:\Windows\System\zbVvvAg.exe

C:\Windows\System\LKSRCUH.exe

C:\Windows\System\LKSRCUH.exe

C:\Windows\System\GGfnKKX.exe

C:\Windows\System\GGfnKKX.exe

C:\Windows\System\NqGlJjm.exe

C:\Windows\System\NqGlJjm.exe

C:\Windows\System\PpksDGI.exe

C:\Windows\System\PpksDGI.exe

C:\Windows\System\ERhmMeP.exe

C:\Windows\System\ERhmMeP.exe

C:\Windows\System\AefPIEp.exe

C:\Windows\System\AefPIEp.exe

C:\Windows\System\wDwHgFy.exe

C:\Windows\System\wDwHgFy.exe

C:\Windows\System\WjBbpUX.exe

C:\Windows\System\WjBbpUX.exe

C:\Windows\System\tLsxceR.exe

C:\Windows\System\tLsxceR.exe

C:\Windows\System\tNETBtl.exe

C:\Windows\System\tNETBtl.exe

C:\Windows\System\CvTKLwY.exe

C:\Windows\System\CvTKLwY.exe

C:\Windows\System\nbNeVGO.exe

C:\Windows\System\nbNeVGO.exe

C:\Windows\System\PFNLcWo.exe

C:\Windows\System\PFNLcWo.exe

C:\Windows\System\hYAQBQZ.exe

C:\Windows\System\hYAQBQZ.exe

C:\Windows\System\SwHfNnM.exe

C:\Windows\System\SwHfNnM.exe

C:\Windows\System\oGjyzPQ.exe

C:\Windows\System\oGjyzPQ.exe

C:\Windows\System\huNJrUy.exe

C:\Windows\System\huNJrUy.exe

C:\Windows\System\yeeZoAq.exe

C:\Windows\System\yeeZoAq.exe

C:\Windows\System\usQieLe.exe

C:\Windows\System\usQieLe.exe

C:\Windows\System\wpNLNvw.exe

C:\Windows\System\wpNLNvw.exe

C:\Windows\System\BhtZpYt.exe

C:\Windows\System\BhtZpYt.exe

C:\Windows\System\dBrrRCN.exe

C:\Windows\System\dBrrRCN.exe

C:\Windows\System\mpLGYyN.exe

C:\Windows\System\mpLGYyN.exe

C:\Windows\System\VrsDNAD.exe

C:\Windows\System\VrsDNAD.exe

C:\Windows\System\euxPLMc.exe

C:\Windows\System\euxPLMc.exe

C:\Windows\System\iPljuet.exe

C:\Windows\System\iPljuet.exe

C:\Windows\System\SVTRabg.exe

C:\Windows\System\SVTRabg.exe

C:\Windows\System\XhbibcH.exe

C:\Windows\System\XhbibcH.exe

C:\Windows\System\VbxyLXA.exe

C:\Windows\System\VbxyLXA.exe

C:\Windows\System\QExapwo.exe

C:\Windows\System\QExapwo.exe

C:\Windows\System\MFnDLFt.exe

C:\Windows\System\MFnDLFt.exe

C:\Windows\System\dbQLkGc.exe

C:\Windows\System\dbQLkGc.exe

C:\Windows\System\SsYeCdP.exe

C:\Windows\System\SsYeCdP.exe

C:\Windows\System\aBGCvNs.exe

C:\Windows\System\aBGCvNs.exe

C:\Windows\System\intMnvL.exe

C:\Windows\System\intMnvL.exe

C:\Windows\System\CSYDQdi.exe

C:\Windows\System\CSYDQdi.exe

C:\Windows\System\njORlFr.exe

C:\Windows\System\njORlFr.exe

C:\Windows\System\HXmgNQN.exe

C:\Windows\System\HXmgNQN.exe

C:\Windows\System\zJkqiqm.exe

C:\Windows\System\zJkqiqm.exe

C:\Windows\System\ShtYHgD.exe

C:\Windows\System\ShtYHgD.exe

C:\Windows\System\OdxMBrs.exe

C:\Windows\System\OdxMBrs.exe

C:\Windows\System\fylTVQF.exe

C:\Windows\System\fylTVQF.exe

C:\Windows\System\viytfDN.exe

C:\Windows\System\viytfDN.exe

C:\Windows\System\etLyXlJ.exe

C:\Windows\System\etLyXlJ.exe

C:\Windows\System\jzqHPYg.exe

C:\Windows\System\jzqHPYg.exe

C:\Windows\System\InwPsFu.exe

C:\Windows\System\InwPsFu.exe

C:\Windows\System\snCXvyq.exe

C:\Windows\System\snCXvyq.exe

C:\Windows\System\gggjTYh.exe

C:\Windows\System\gggjTYh.exe

C:\Windows\System\kSRhmIE.exe

C:\Windows\System\kSRhmIE.exe

C:\Windows\System\obRswvR.exe

C:\Windows\System\obRswvR.exe

C:\Windows\System\tAwgbOE.exe

C:\Windows\System\tAwgbOE.exe

C:\Windows\System\wrPiYrJ.exe

C:\Windows\System\wrPiYrJ.exe

C:\Windows\System\ZnldIwb.exe

C:\Windows\System\ZnldIwb.exe

C:\Windows\System\eIpKhoD.exe

C:\Windows\System\eIpKhoD.exe

C:\Windows\System\jRcdede.exe

C:\Windows\System\jRcdede.exe

C:\Windows\System\ZjIeoLP.exe

C:\Windows\System\ZjIeoLP.exe

C:\Windows\System\FOfztbf.exe

C:\Windows\System\FOfztbf.exe

C:\Windows\System\LuggGtC.exe

C:\Windows\System\LuggGtC.exe

C:\Windows\System\ZCcRYXX.exe

C:\Windows\System\ZCcRYXX.exe

C:\Windows\System\rcNbcDo.exe

C:\Windows\System\rcNbcDo.exe

C:\Windows\System\iHYCYCe.exe

C:\Windows\System\iHYCYCe.exe

C:\Windows\System\EuvRLxd.exe

C:\Windows\System\EuvRLxd.exe

C:\Windows\System\DryDcvC.exe

C:\Windows\System\DryDcvC.exe

C:\Windows\System\YYrLlKr.exe

C:\Windows\System\YYrLlKr.exe

C:\Windows\System\iLyAJvm.exe

C:\Windows\System\iLyAJvm.exe

C:\Windows\System\EgocZCe.exe

C:\Windows\System\EgocZCe.exe

C:\Windows\System\wfYubnU.exe

C:\Windows\System\wfYubnU.exe

C:\Windows\System\bDaiZka.exe

C:\Windows\System\bDaiZka.exe

C:\Windows\System\McYiDBi.exe

C:\Windows\System\McYiDBi.exe

C:\Windows\System\NEFkEfX.exe

C:\Windows\System\NEFkEfX.exe

C:\Windows\System\lvYZubB.exe

C:\Windows\System\lvYZubB.exe

C:\Windows\System\DFOOBDA.exe

C:\Windows\System\DFOOBDA.exe

C:\Windows\System\kSOWYxW.exe

C:\Windows\System\kSOWYxW.exe

C:\Windows\System\mqYThsJ.exe

C:\Windows\System\mqYThsJ.exe

C:\Windows\System\lmHHquy.exe

C:\Windows\System\lmHHquy.exe

C:\Windows\System\RlCZwpi.exe

C:\Windows\System\RlCZwpi.exe

C:\Windows\System\InTlSxM.exe

C:\Windows\System\InTlSxM.exe

C:\Windows\System\ZXTYAkf.exe

C:\Windows\System\ZXTYAkf.exe

C:\Windows\System\LcPdTVi.exe

C:\Windows\System\LcPdTVi.exe

C:\Windows\System\KVDGdjw.exe

C:\Windows\System\KVDGdjw.exe

C:\Windows\System\pCxcggA.exe

C:\Windows\System\pCxcggA.exe

C:\Windows\System\ujNFfEA.exe

C:\Windows\System\ujNFfEA.exe

C:\Windows\System\mRPzoAf.exe

C:\Windows\System\mRPzoAf.exe

C:\Windows\System\AMvmyHQ.exe

C:\Windows\System\AMvmyHQ.exe

C:\Windows\System\xydiGaH.exe

C:\Windows\System\xydiGaH.exe

C:\Windows\System\AskxlPg.exe

C:\Windows\System\AskxlPg.exe

C:\Windows\System\zYLiMjb.exe

C:\Windows\System\zYLiMjb.exe

C:\Windows\System\ZgQYWfe.exe

C:\Windows\System\ZgQYWfe.exe

C:\Windows\System\dYmVgKn.exe

C:\Windows\System\dYmVgKn.exe

C:\Windows\System\YnuNUdd.exe

C:\Windows\System\YnuNUdd.exe

C:\Windows\System\OOxDdLb.exe

C:\Windows\System\OOxDdLb.exe

C:\Windows\System\WKcWtey.exe

C:\Windows\System\WKcWtey.exe

C:\Windows\System\ynCNybK.exe

C:\Windows\System\ynCNybK.exe

C:\Windows\System\owproCF.exe

C:\Windows\System\owproCF.exe

C:\Windows\System\qZdHOTr.exe

C:\Windows\System\qZdHOTr.exe

C:\Windows\System\oFEfpjb.exe

C:\Windows\System\oFEfpjb.exe

C:\Windows\System\LCWSDvZ.exe

C:\Windows\System\LCWSDvZ.exe

C:\Windows\System\hjNDkoN.exe

C:\Windows\System\hjNDkoN.exe

C:\Windows\System\mXsjqfv.exe

C:\Windows\System\mXsjqfv.exe

C:\Windows\System\zQHVkMf.exe

C:\Windows\System\zQHVkMf.exe

C:\Windows\System\KZVNAEH.exe

C:\Windows\System\KZVNAEH.exe

C:\Windows\System\OzsucWj.exe

C:\Windows\System\OzsucWj.exe

C:\Windows\System\GcMpbrp.exe

C:\Windows\System\GcMpbrp.exe

C:\Windows\System\rXSJPRO.exe

C:\Windows\System\rXSJPRO.exe

C:\Windows\System\WULyerq.exe

C:\Windows\System\WULyerq.exe

C:\Windows\System\gexRoYu.exe

C:\Windows\System\gexRoYu.exe

C:\Windows\System\krAZsPP.exe

C:\Windows\System\krAZsPP.exe

C:\Windows\System\UDomaHd.exe

C:\Windows\System\UDomaHd.exe

C:\Windows\System\OGolPhT.exe

C:\Windows\System\OGolPhT.exe

C:\Windows\System\gtgmMix.exe

C:\Windows\System\gtgmMix.exe

C:\Windows\System\aYoxrbK.exe

C:\Windows\System\aYoxrbK.exe

C:\Windows\System\YUGkgqY.exe

C:\Windows\System\YUGkgqY.exe

C:\Windows\System\lcIoabF.exe

C:\Windows\System\lcIoabF.exe

C:\Windows\System\lyiLRJD.exe

C:\Windows\System\lyiLRJD.exe

C:\Windows\System\ZhYXiwT.exe

C:\Windows\System\ZhYXiwT.exe

C:\Windows\System\IrbpzhD.exe

C:\Windows\System\IrbpzhD.exe

C:\Windows\System\ZzlvCKu.exe

C:\Windows\System\ZzlvCKu.exe

C:\Windows\System\MelhMMW.exe

C:\Windows\System\MelhMMW.exe

C:\Windows\System\smVKHuc.exe

C:\Windows\System\smVKHuc.exe

C:\Windows\System\ZgtduDo.exe

C:\Windows\System\ZgtduDo.exe

C:\Windows\System\zQxMkST.exe

C:\Windows\System\zQxMkST.exe

C:\Windows\System\IBljgjz.exe

C:\Windows\System\IBljgjz.exe

C:\Windows\System\vRofXvB.exe

C:\Windows\System\vRofXvB.exe

C:\Windows\System\prKNBhD.exe

C:\Windows\System\prKNBhD.exe

C:\Windows\System\EkHAppj.exe

C:\Windows\System\EkHAppj.exe

C:\Windows\System\wOosnwY.exe

C:\Windows\System\wOosnwY.exe

C:\Windows\System\zzyXxTW.exe

C:\Windows\System\zzyXxTW.exe

C:\Windows\System\comDgtO.exe

C:\Windows\System\comDgtO.exe

C:\Windows\System\OWTcZss.exe

C:\Windows\System\OWTcZss.exe

C:\Windows\System\pMIYISF.exe

C:\Windows\System\pMIYISF.exe

C:\Windows\System\PsPYskM.exe

C:\Windows\System\PsPYskM.exe

C:\Windows\System\BunoQyZ.exe

C:\Windows\System\BunoQyZ.exe

C:\Windows\System\iNXQJAr.exe

C:\Windows\System\iNXQJAr.exe

C:\Windows\System\idZeuQx.exe

C:\Windows\System\idZeuQx.exe

C:\Windows\System\oFHWPlg.exe

C:\Windows\System\oFHWPlg.exe

C:\Windows\System\ojAxaYQ.exe

C:\Windows\System\ojAxaYQ.exe

C:\Windows\System\MqhaaxF.exe

C:\Windows\System\MqhaaxF.exe

C:\Windows\System\SxEhcfv.exe

C:\Windows\System\SxEhcfv.exe

C:\Windows\System\HdfcTGg.exe

C:\Windows\System\HdfcTGg.exe

C:\Windows\System\WdKbyLH.exe

C:\Windows\System\WdKbyLH.exe

C:\Windows\System\IvDGHbx.exe

C:\Windows\System\IvDGHbx.exe

C:\Windows\System\cBTZlTY.exe

C:\Windows\System\cBTZlTY.exe

C:\Windows\System\maKiyrx.exe

C:\Windows\System\maKiyrx.exe

C:\Windows\System\lnlvNNj.exe

C:\Windows\System\lnlvNNj.exe

C:\Windows\System\oKCfTxY.exe

C:\Windows\System\oKCfTxY.exe

C:\Windows\System\UGQfCkc.exe

C:\Windows\System\UGQfCkc.exe

C:\Windows\System\XLkZQHA.exe

C:\Windows\System\XLkZQHA.exe

C:\Windows\System\BFYlHqN.exe

C:\Windows\System\BFYlHqN.exe

C:\Windows\System\INthQAr.exe

C:\Windows\System\INthQAr.exe

C:\Windows\System\MYmFDir.exe

C:\Windows\System\MYmFDir.exe

C:\Windows\System\WoPNJgu.exe

C:\Windows\System\WoPNJgu.exe

C:\Windows\System\BIWtZnU.exe

C:\Windows\System\BIWtZnU.exe

C:\Windows\System\AuZAgtg.exe

C:\Windows\System\AuZAgtg.exe

C:\Windows\System\MovNfzC.exe

C:\Windows\System\MovNfzC.exe

C:\Windows\System\bfbJCqV.exe

C:\Windows\System\bfbJCqV.exe

C:\Windows\System\nYNOazS.exe

C:\Windows\System\nYNOazS.exe

C:\Windows\System\BpGPJHe.exe

C:\Windows\System\BpGPJHe.exe

C:\Windows\System\xjPIFaS.exe

C:\Windows\System\xjPIFaS.exe

C:\Windows\System\uGuDxgC.exe

C:\Windows\System\uGuDxgC.exe

C:\Windows\System\ejujfgw.exe

C:\Windows\System\ejujfgw.exe

C:\Windows\System\RAVqbLm.exe

C:\Windows\System\RAVqbLm.exe

C:\Windows\System\zQjGVJf.exe

C:\Windows\System\zQjGVJf.exe

C:\Windows\System\dQzzwxx.exe

C:\Windows\System\dQzzwxx.exe

C:\Windows\System\KoSqdEI.exe

C:\Windows\System\KoSqdEI.exe

C:\Windows\System\HwXlbHI.exe

C:\Windows\System\HwXlbHI.exe

C:\Windows\System\eCuIJNU.exe

C:\Windows\System\eCuIJNU.exe

C:\Windows\System\YEygVRN.exe

C:\Windows\System\YEygVRN.exe

C:\Windows\System\wEdjOjk.exe

C:\Windows\System\wEdjOjk.exe

C:\Windows\System\yDfaBcf.exe

C:\Windows\System\yDfaBcf.exe

C:\Windows\System\iHYJcDE.exe

C:\Windows\System\iHYJcDE.exe

C:\Windows\System\QwDvMuw.exe

C:\Windows\System\QwDvMuw.exe

C:\Windows\System\jRnhcpG.exe

C:\Windows\System\jRnhcpG.exe

C:\Windows\System\GDLpylf.exe

C:\Windows\System\GDLpylf.exe

C:\Windows\System\DwdxLts.exe

C:\Windows\System\DwdxLts.exe

C:\Windows\System\GuBIAmH.exe

C:\Windows\System\GuBIAmH.exe

C:\Windows\System\hgqJjbn.exe

C:\Windows\System\hgqJjbn.exe

C:\Windows\System\TaAotjN.exe

C:\Windows\System\TaAotjN.exe

C:\Windows\System\YamluDl.exe

C:\Windows\System\YamluDl.exe

C:\Windows\System\CaxDXcp.exe

C:\Windows\System\CaxDXcp.exe

C:\Windows\System\bpZCGKX.exe

C:\Windows\System\bpZCGKX.exe

C:\Windows\System\mlUwAPe.exe

C:\Windows\System\mlUwAPe.exe

C:\Windows\System\NrhohCP.exe

C:\Windows\System\NrhohCP.exe

C:\Windows\System\udwWvug.exe

C:\Windows\System\udwWvug.exe

C:\Windows\System\NhDdOEP.exe

C:\Windows\System\NhDdOEP.exe

C:\Windows\System\qyQFkHa.exe

C:\Windows\System\qyQFkHa.exe

C:\Windows\System\QcNNzVc.exe

C:\Windows\System\QcNNzVc.exe

C:\Windows\System\qsiuTUP.exe

C:\Windows\System\qsiuTUP.exe

C:\Windows\System\SsCVbCk.exe

C:\Windows\System\SsCVbCk.exe

C:\Windows\System\AOJNjnO.exe

C:\Windows\System\AOJNjnO.exe

C:\Windows\System\dVunNIH.exe

C:\Windows\System\dVunNIH.exe

C:\Windows\System\EVMWWbU.exe

C:\Windows\System\EVMWWbU.exe

C:\Windows\System\BjfYKOz.exe

C:\Windows\System\BjfYKOz.exe

C:\Windows\System\pyFpYHx.exe

C:\Windows\System\pyFpYHx.exe

C:\Windows\System\fZUzoWW.exe

C:\Windows\System\fZUzoWW.exe

C:\Windows\System\vowqiHU.exe

C:\Windows\System\vowqiHU.exe

C:\Windows\System\hPoknbx.exe

C:\Windows\System\hPoknbx.exe

C:\Windows\System\mnNwwyJ.exe

C:\Windows\System\mnNwwyJ.exe

C:\Windows\System\wyCxtyN.exe

C:\Windows\System\wyCxtyN.exe

C:\Windows\System\VlVOxqt.exe

C:\Windows\System\VlVOxqt.exe

C:\Windows\System\CEEtiXs.exe

C:\Windows\System\CEEtiXs.exe

C:\Windows\System\IgCoePs.exe

C:\Windows\System\IgCoePs.exe

C:\Windows\System\IVXTUaq.exe

C:\Windows\System\IVXTUaq.exe

C:\Windows\System\uPBuqDA.exe

C:\Windows\System\uPBuqDA.exe

C:\Windows\System\gLxnhNR.exe

C:\Windows\System\gLxnhNR.exe

C:\Windows\System\ZdDmYFQ.exe

C:\Windows\System\ZdDmYFQ.exe

C:\Windows\System\AHUuJuM.exe

C:\Windows\System\AHUuJuM.exe

C:\Windows\System\TZxFpgV.exe

C:\Windows\System\TZxFpgV.exe

C:\Windows\System\fADxbwR.exe

C:\Windows\System\fADxbwR.exe

C:\Windows\System\sxUfUco.exe

C:\Windows\System\sxUfUco.exe

C:\Windows\System\oLtJFAN.exe

C:\Windows\System\oLtJFAN.exe

C:\Windows\System\fodLizs.exe

C:\Windows\System\fodLizs.exe

C:\Windows\System\pzQdbJc.exe

C:\Windows\System\pzQdbJc.exe

C:\Windows\System\gaHwhtU.exe

C:\Windows\System\gaHwhtU.exe

C:\Windows\System\TCOojvE.exe

C:\Windows\System\TCOojvE.exe

C:\Windows\System\MeXmCUa.exe

C:\Windows\System\MeXmCUa.exe

C:\Windows\System\aFYbmWZ.exe

C:\Windows\System\aFYbmWZ.exe

C:\Windows\System\XItzKng.exe

C:\Windows\System\XItzKng.exe

C:\Windows\System\XmycpVl.exe

C:\Windows\System\XmycpVl.exe

C:\Windows\System\UvTkelC.exe

C:\Windows\System\UvTkelC.exe

C:\Windows\System\OINIQEz.exe

C:\Windows\System\OINIQEz.exe

C:\Windows\System\OkWPdTX.exe

C:\Windows\System\OkWPdTX.exe

C:\Windows\System\SutVDLG.exe

C:\Windows\System\SutVDLG.exe

C:\Windows\System\hBWMYiH.exe

C:\Windows\System\hBWMYiH.exe

C:\Windows\System\ZpFQQIV.exe

C:\Windows\System\ZpFQQIV.exe

C:\Windows\System\rhWzsEH.exe

C:\Windows\System\rhWzsEH.exe

C:\Windows\System\HWUUDXO.exe

C:\Windows\System\HWUUDXO.exe

C:\Windows\System\ZEgXvRi.exe

C:\Windows\System\ZEgXvRi.exe

C:\Windows\System\bSAGWbb.exe

C:\Windows\System\bSAGWbb.exe

C:\Windows\System\OBFOhRa.exe

C:\Windows\System\OBFOhRa.exe

C:\Windows\System\dMlzLjs.exe

C:\Windows\System\dMlzLjs.exe

C:\Windows\System\hicdfOO.exe

C:\Windows\System\hicdfOO.exe

C:\Windows\System\BClRaqM.exe

C:\Windows\System\BClRaqM.exe

C:\Windows\System\uBIVKXP.exe

C:\Windows\System\uBIVKXP.exe

C:\Windows\System\zmXLrBc.exe

C:\Windows\System\zmXLrBc.exe

C:\Windows\System\pAnVXKE.exe

C:\Windows\System\pAnVXKE.exe

C:\Windows\System\tBWPrnd.exe

C:\Windows\System\tBWPrnd.exe

C:\Windows\System\ZlgsaZA.exe

C:\Windows\System\ZlgsaZA.exe

C:\Windows\System\ndeMfae.exe

C:\Windows\System\ndeMfae.exe

C:\Windows\System\sXhnRKy.exe

C:\Windows\System\sXhnRKy.exe

C:\Windows\System\ZPwnsJw.exe

C:\Windows\System\ZPwnsJw.exe

C:\Windows\System\oHEApRh.exe

C:\Windows\System\oHEApRh.exe

C:\Windows\System\RbRmvIU.exe

C:\Windows\System\RbRmvIU.exe

C:\Windows\System\CHXouxr.exe

C:\Windows\System\CHXouxr.exe

C:\Windows\System\jkjKkXE.exe

C:\Windows\System\jkjKkXE.exe

C:\Windows\System\uYHgtEY.exe

C:\Windows\System\uYHgtEY.exe

C:\Windows\System\rfPsMtk.exe

C:\Windows\System\rfPsMtk.exe

C:\Windows\System\zWrEomk.exe

C:\Windows\System\zWrEomk.exe

C:\Windows\System\WBeVYra.exe

C:\Windows\System\WBeVYra.exe

C:\Windows\System\hXEXHpM.exe

C:\Windows\System\hXEXHpM.exe

C:\Windows\System\FyYRCGj.exe

C:\Windows\System\FyYRCGj.exe

C:\Windows\System\RGMlyCQ.exe

C:\Windows\System\RGMlyCQ.exe

C:\Windows\System\gzmNNyC.exe

C:\Windows\System\gzmNNyC.exe

C:\Windows\System\bueBUBZ.exe

C:\Windows\System\bueBUBZ.exe

C:\Windows\System\WktvBuU.exe

C:\Windows\System\WktvBuU.exe

C:\Windows\System\wFObjWj.exe

C:\Windows\System\wFObjWj.exe

C:\Windows\System\WDcVlwX.exe

C:\Windows\System\WDcVlwX.exe

C:\Windows\System\hREWdXh.exe

C:\Windows\System\hREWdXh.exe

C:\Windows\System\sojpPpP.exe

C:\Windows\System\sojpPpP.exe

C:\Windows\System\GLNsTnb.exe

C:\Windows\System\GLNsTnb.exe

C:\Windows\System\wGrDGIS.exe

C:\Windows\System\wGrDGIS.exe

C:\Windows\System\wmerbET.exe

C:\Windows\System\wmerbET.exe

C:\Windows\System\uCUkTiZ.exe

C:\Windows\System\uCUkTiZ.exe

C:\Windows\System\cafozby.exe

C:\Windows\System\cafozby.exe

C:\Windows\System\TRAKQvq.exe

C:\Windows\System\TRAKQvq.exe

C:\Windows\System\YTjKhnG.exe

C:\Windows\System\YTjKhnG.exe

C:\Windows\System\EDdPPtK.exe

C:\Windows\System\EDdPPtK.exe

C:\Windows\System\ZRTAXiI.exe

C:\Windows\System\ZRTAXiI.exe

C:\Windows\System\hyjuzeY.exe

C:\Windows\System\hyjuzeY.exe

C:\Windows\System\FcxQWzg.exe

C:\Windows\System\FcxQWzg.exe

C:\Windows\System\ItvImcA.exe

C:\Windows\System\ItvImcA.exe

C:\Windows\System\qeGHwia.exe

C:\Windows\System\qeGHwia.exe

C:\Windows\System\CqzjjBe.exe

C:\Windows\System\CqzjjBe.exe

C:\Windows\System\UskDjgb.exe

C:\Windows\System\UskDjgb.exe

C:\Windows\System\vChNdjL.exe

C:\Windows\System\vChNdjL.exe

C:\Windows\System\UooqadW.exe

C:\Windows\System\UooqadW.exe

C:\Windows\System\jzrdYQv.exe

C:\Windows\System\jzrdYQv.exe

C:\Windows\System\LwZBjSu.exe

C:\Windows\System\LwZBjSu.exe

C:\Windows\System\fZShtNQ.exe

C:\Windows\System\fZShtNQ.exe

C:\Windows\System\QNZWvAj.exe

C:\Windows\System\QNZWvAj.exe

C:\Windows\System\qpASFpN.exe

C:\Windows\System\qpASFpN.exe

C:\Windows\System\eZNsZKw.exe

C:\Windows\System\eZNsZKw.exe

C:\Windows\System\znReEmU.exe

C:\Windows\System\znReEmU.exe

C:\Windows\System\tDosgnj.exe

C:\Windows\System\tDosgnj.exe

C:\Windows\System\fygQRwt.exe

C:\Windows\System\fygQRwt.exe

C:\Windows\System\pMAaBfV.exe

C:\Windows\System\pMAaBfV.exe

C:\Windows\System\LJZTsmh.exe

C:\Windows\System\LJZTsmh.exe

C:\Windows\System\qtBJzzI.exe

C:\Windows\System\qtBJzzI.exe

C:\Windows\System\feZaDZF.exe

C:\Windows\System\feZaDZF.exe

C:\Windows\System\QWzVsfL.exe

C:\Windows\System\QWzVsfL.exe

C:\Windows\System\EaERwAm.exe

C:\Windows\System\EaERwAm.exe

C:\Windows\System\ETWQJyn.exe

C:\Windows\System\ETWQJyn.exe

C:\Windows\System\nyxcjBG.exe

C:\Windows\System\nyxcjBG.exe

C:\Windows\System\AoZzYuF.exe

C:\Windows\System\AoZzYuF.exe

C:\Windows\System\xrSHMxY.exe

C:\Windows\System\xrSHMxY.exe

C:\Windows\System\fiNcFnB.exe

C:\Windows\System\fiNcFnB.exe

C:\Windows\System\LGKEpPF.exe

C:\Windows\System\LGKEpPF.exe

C:\Windows\System\aUSKVfz.exe

C:\Windows\System\aUSKVfz.exe

C:\Windows\System\GHUdLUR.exe

C:\Windows\System\GHUdLUR.exe

C:\Windows\System\SgRUjUv.exe

C:\Windows\System\SgRUjUv.exe

C:\Windows\System\VXQnqYQ.exe

C:\Windows\System\VXQnqYQ.exe

C:\Windows\System\amUOtUu.exe

C:\Windows\System\amUOtUu.exe

C:\Windows\System\DXhBxgH.exe

C:\Windows\System\DXhBxgH.exe

C:\Windows\System\wsQIjZx.exe

C:\Windows\System\wsQIjZx.exe

C:\Windows\System\erCeEIN.exe

C:\Windows\System\erCeEIN.exe

C:\Windows\System\CYOcnwb.exe

C:\Windows\System\CYOcnwb.exe

C:\Windows\System\Febphpp.exe

C:\Windows\System\Febphpp.exe

C:\Windows\System\nUWhzAP.exe

C:\Windows\System\nUWhzAP.exe

C:\Windows\System\SNAhTQC.exe

C:\Windows\System\SNAhTQC.exe

C:\Windows\System\MhYmDlb.exe

C:\Windows\System\MhYmDlb.exe

C:\Windows\System\FXGBWSU.exe

C:\Windows\System\FXGBWSU.exe

C:\Windows\System\iQVahOJ.exe

C:\Windows\System\iQVahOJ.exe

C:\Windows\System\CVqOhAc.exe

C:\Windows\System\CVqOhAc.exe

C:\Windows\System\octiMtJ.exe

C:\Windows\System\octiMtJ.exe

C:\Windows\System\EheMEQb.exe

C:\Windows\System\EheMEQb.exe

C:\Windows\System\QXvBPmn.exe

C:\Windows\System\QXvBPmn.exe

C:\Windows\System\IEQLyqt.exe

C:\Windows\System\IEQLyqt.exe

C:\Windows\System\jLOPqiG.exe

C:\Windows\System\jLOPqiG.exe

C:\Windows\System\TSNbDyJ.exe

C:\Windows\System\TSNbDyJ.exe

C:\Windows\System\qyzfQdL.exe

C:\Windows\System\qyzfQdL.exe

C:\Windows\System\OyzDTwj.exe

C:\Windows\System\OyzDTwj.exe

C:\Windows\System\pIIQAtQ.exe

C:\Windows\System\pIIQAtQ.exe

C:\Windows\System\nEhVaca.exe

C:\Windows\System\nEhVaca.exe

C:\Windows\System\SvXfiOd.exe

C:\Windows\System\SvXfiOd.exe

C:\Windows\System\gCCNdAY.exe

C:\Windows\System\gCCNdAY.exe

C:\Windows\System\dUuFWBv.exe

C:\Windows\System\dUuFWBv.exe

C:\Windows\System\vSbgbgA.exe

C:\Windows\System\vSbgbgA.exe

C:\Windows\System\RAPlZgB.exe

C:\Windows\System\RAPlZgB.exe

C:\Windows\System\JiNvfdI.exe

C:\Windows\System\JiNvfdI.exe

C:\Windows\System\ohOtRky.exe

C:\Windows\System\ohOtRky.exe

C:\Windows\System\mexZvbj.exe

C:\Windows\System\mexZvbj.exe

C:\Windows\System\gLnPWrS.exe

C:\Windows\System\gLnPWrS.exe

C:\Windows\System\AqEUugo.exe

C:\Windows\System\AqEUugo.exe

C:\Windows\System\rlLlgws.exe

C:\Windows\System\rlLlgws.exe

C:\Windows\System\ImOnFbm.exe

C:\Windows\System\ImOnFbm.exe

C:\Windows\System\jNjvsGE.exe

C:\Windows\System\jNjvsGE.exe

C:\Windows\System\xqceqXa.exe

C:\Windows\System\xqceqXa.exe

C:\Windows\System\MDAoBvl.exe

C:\Windows\System\MDAoBvl.exe

C:\Windows\System\DZZYEay.exe

C:\Windows\System\DZZYEay.exe

C:\Windows\System\UJfVsRc.exe

C:\Windows\System\UJfVsRc.exe

C:\Windows\System\vlKjxqw.exe

C:\Windows\System\vlKjxqw.exe

C:\Windows\System\UwCEhSV.exe

C:\Windows\System\UwCEhSV.exe

C:\Windows\System\DnHSqNw.exe

C:\Windows\System\DnHSqNw.exe

C:\Windows\System\JWWoMsN.exe

C:\Windows\System\JWWoMsN.exe

C:\Windows\System\LcMeqjR.exe

C:\Windows\System\LcMeqjR.exe

C:\Windows\System\VWzBHSf.exe

C:\Windows\System\VWzBHSf.exe

C:\Windows\System\tpLGHHZ.exe

C:\Windows\System\tpLGHHZ.exe

C:\Windows\System\iSqMPWW.exe

C:\Windows\System\iSqMPWW.exe

C:\Windows\System\nVmQLkg.exe

C:\Windows\System\nVmQLkg.exe

C:\Windows\System\nDCrkmU.exe

C:\Windows\System\nDCrkmU.exe

C:\Windows\System\oHOKXCw.exe

C:\Windows\System\oHOKXCw.exe

C:\Windows\System\MHMoOkf.exe

C:\Windows\System\MHMoOkf.exe

C:\Windows\System\CnuwPEs.exe

C:\Windows\System\CnuwPEs.exe

C:\Windows\System\mXunuEa.exe

C:\Windows\System\mXunuEa.exe

C:\Windows\System\QzgkWdE.exe

C:\Windows\System\QzgkWdE.exe

C:\Windows\System\cWtiFBC.exe

C:\Windows\System\cWtiFBC.exe

C:\Windows\System\gTSpoMn.exe

C:\Windows\System\gTSpoMn.exe

C:\Windows\System\DAFGPYS.exe

C:\Windows\System\DAFGPYS.exe

C:\Windows\System\NZQDPuC.exe

C:\Windows\System\NZQDPuC.exe

C:\Windows\System\TcdavTQ.exe

C:\Windows\System\TcdavTQ.exe

C:\Windows\System\ZrAsiyo.exe

C:\Windows\System\ZrAsiyo.exe

C:\Windows\System\WVJXHlh.exe

C:\Windows\System\WVJXHlh.exe

C:\Windows\System\jhlMjyG.exe

C:\Windows\System\jhlMjyG.exe

C:\Windows\System\bfbvJnZ.exe

C:\Windows\System\bfbvJnZ.exe

C:\Windows\System\XXUCYVt.exe

C:\Windows\System\XXUCYVt.exe

C:\Windows\System\BzTKBLe.exe

C:\Windows\System\BzTKBLe.exe

C:\Windows\System\DQWCywT.exe

C:\Windows\System\DQWCywT.exe

C:\Windows\System\LYuggPG.exe

C:\Windows\System\LYuggPG.exe

C:\Windows\System\vBBFVFp.exe

C:\Windows\System\vBBFVFp.exe

C:\Windows\System\wNdasBZ.exe

C:\Windows\System\wNdasBZ.exe

C:\Windows\System\eronDir.exe

C:\Windows\System\eronDir.exe

C:\Windows\System\MkzWWga.exe

C:\Windows\System\MkzWWga.exe

C:\Windows\System\zAMPvcl.exe

C:\Windows\System\zAMPvcl.exe

C:\Windows\System\IglXZBK.exe

C:\Windows\System\IglXZBK.exe

C:\Windows\System\vjiqFFT.exe

C:\Windows\System\vjiqFFT.exe

C:\Windows\System\vgtlCNk.exe

C:\Windows\System\vgtlCNk.exe

C:\Windows\System\boTADix.exe

C:\Windows\System\boTADix.exe

C:\Windows\System\MRQNrOB.exe

C:\Windows\System\MRQNrOB.exe

C:\Windows\System\eqbJjEc.exe

C:\Windows\System\eqbJjEc.exe

C:\Windows\System\nJgFeoW.exe

C:\Windows\System\nJgFeoW.exe

C:\Windows\System\nRijIWQ.exe

C:\Windows\System\nRijIWQ.exe

C:\Windows\System\RytIknb.exe

C:\Windows\System\RytIknb.exe

C:\Windows\System\sUrUTbB.exe

C:\Windows\System\sUrUTbB.exe

C:\Windows\System\iZzFdnY.exe

C:\Windows\System\iZzFdnY.exe

C:\Windows\System\nEapLil.exe

C:\Windows\System\nEapLil.exe

C:\Windows\System\NyBqREL.exe

C:\Windows\System\NyBqREL.exe

C:\Windows\System\YfureOi.exe

C:\Windows\System\YfureOi.exe

C:\Windows\System\qeHvnhK.exe

C:\Windows\System\qeHvnhK.exe

C:\Windows\System\ngYVAkT.exe

C:\Windows\System\ngYVAkT.exe

C:\Windows\System\zTqmxiM.exe

C:\Windows\System\zTqmxiM.exe

C:\Windows\System\VewkRjm.exe

C:\Windows\System\VewkRjm.exe

C:\Windows\System\txbgPkp.exe

C:\Windows\System\txbgPkp.exe

C:\Windows\System\nuAdltQ.exe

C:\Windows\System\nuAdltQ.exe

C:\Windows\System\lGpYUfb.exe

C:\Windows\System\lGpYUfb.exe

C:\Windows\System\CfCafkW.exe

C:\Windows\System\CfCafkW.exe

C:\Windows\System\TMkTwNA.exe

C:\Windows\System\TMkTwNA.exe

C:\Windows\System\RhRwBkx.exe

C:\Windows\System\RhRwBkx.exe

C:\Windows\System\DYMsuVG.exe

C:\Windows\System\DYMsuVG.exe

C:\Windows\System\AvbCrTM.exe

C:\Windows\System\AvbCrTM.exe

C:\Windows\System\SJvmXrX.exe

C:\Windows\System\SJvmXrX.exe

C:\Windows\System\kTSievt.exe

C:\Windows\System\kTSievt.exe

C:\Windows\System\kxiqYee.exe

C:\Windows\System\kxiqYee.exe

C:\Windows\System\anEBYwW.exe

C:\Windows\System\anEBYwW.exe

C:\Windows\System\hpwVlmR.exe

C:\Windows\System\hpwVlmR.exe

C:\Windows\System\xobsnoN.exe

C:\Windows\System\xobsnoN.exe

C:\Windows\System\nBHakaq.exe

C:\Windows\System\nBHakaq.exe

C:\Windows\System\XsOPonv.exe

C:\Windows\System\XsOPonv.exe

C:\Windows\System\pVzlFbU.exe

C:\Windows\System\pVzlFbU.exe

C:\Windows\System\ToSiWOr.exe

C:\Windows\System\ToSiWOr.exe

C:\Windows\System\UmCyvZV.exe

C:\Windows\System\UmCyvZV.exe

C:\Windows\System\esTxuIu.exe

C:\Windows\System\esTxuIu.exe

C:\Windows\System\nWhlpyd.exe

C:\Windows\System\nWhlpyd.exe

C:\Windows\System\UuXthAt.exe

C:\Windows\System\UuXthAt.exe

C:\Windows\System\Onbcglw.exe

C:\Windows\System\Onbcglw.exe

C:\Windows\System\plsylgB.exe

C:\Windows\System\plsylgB.exe

C:\Windows\System\dPlmSMC.exe

C:\Windows\System\dPlmSMC.exe

C:\Windows\System\BHsfGlO.exe

C:\Windows\System\BHsfGlO.exe

C:\Windows\System\gbGeaeo.exe

C:\Windows\System\gbGeaeo.exe

C:\Windows\System\TyausJe.exe

C:\Windows\System\TyausJe.exe

C:\Windows\System\sxBonip.exe

C:\Windows\System\sxBonip.exe

C:\Windows\System\kuZgdFx.exe

C:\Windows\System\kuZgdFx.exe

C:\Windows\System\hWsMHpL.exe

C:\Windows\System\hWsMHpL.exe

C:\Windows\System\lKXYREs.exe

C:\Windows\System\lKXYREs.exe

C:\Windows\System\iHYXlXR.exe

C:\Windows\System\iHYXlXR.exe

C:\Windows\System\yjHMhCS.exe

C:\Windows\System\yjHMhCS.exe

C:\Windows\System\ffmYntj.exe

C:\Windows\System\ffmYntj.exe

C:\Windows\System\ShMHHLJ.exe

C:\Windows\System\ShMHHLJ.exe

C:\Windows\System\UWOHKwb.exe

C:\Windows\System\UWOHKwb.exe

C:\Windows\System\TAIDnCH.exe

C:\Windows\System\TAIDnCH.exe

C:\Windows\System\OHuBtGO.exe

C:\Windows\System\OHuBtGO.exe

C:\Windows\System\kFjftNO.exe

C:\Windows\System\kFjftNO.exe

C:\Windows\System\fZoilJY.exe

C:\Windows\System\fZoilJY.exe

C:\Windows\System\wAGZdEc.exe

C:\Windows\System\wAGZdEc.exe

C:\Windows\System\yJmgOvm.exe

C:\Windows\System\yJmgOvm.exe

C:\Windows\System\mFkEUit.exe

C:\Windows\System\mFkEUit.exe

C:\Windows\System\tjwZEWl.exe

C:\Windows\System\tjwZEWl.exe

C:\Windows\System\CYLTqEN.exe

C:\Windows\System\CYLTqEN.exe

C:\Windows\System\ugAuAdX.exe

C:\Windows\System\ugAuAdX.exe

C:\Windows\System\FvLYLKe.exe

C:\Windows\System\FvLYLKe.exe

C:\Windows\System\qVVkfQQ.exe

C:\Windows\System\qVVkfQQ.exe

C:\Windows\System\cXWWcSR.exe

C:\Windows\System\cXWWcSR.exe

C:\Windows\System\nxXYEVZ.exe

C:\Windows\System\nxXYEVZ.exe

C:\Windows\System\yoUFyVC.exe

C:\Windows\System\yoUFyVC.exe

C:\Windows\System\KRebvMt.exe

C:\Windows\System\KRebvMt.exe

C:\Windows\System\bZXiCmG.exe

C:\Windows\System\bZXiCmG.exe

C:\Windows\System\KjDXivG.exe

C:\Windows\System\KjDXivG.exe

C:\Windows\System\WGZipCU.exe

C:\Windows\System\WGZipCU.exe

C:\Windows\System\wheKvFu.exe

C:\Windows\System\wheKvFu.exe

C:\Windows\System\YDXQRVT.exe

C:\Windows\System\YDXQRVT.exe

C:\Windows\System\ZMYRENY.exe

C:\Windows\System\ZMYRENY.exe

C:\Windows\System\wCCUGsb.exe

C:\Windows\System\wCCUGsb.exe

C:\Windows\System\Wszcmbn.exe

C:\Windows\System\Wszcmbn.exe

C:\Windows\System\rTpwLEY.exe

C:\Windows\System\rTpwLEY.exe

C:\Windows\System\kMMhYjP.exe

C:\Windows\System\kMMhYjP.exe

C:\Windows\System\vBNRxQv.exe

C:\Windows\System\vBNRxQv.exe

C:\Windows\System\iWOKJQS.exe

C:\Windows\System\iWOKJQS.exe

C:\Windows\System\MGgQmSk.exe

C:\Windows\System\MGgQmSk.exe

C:\Windows\System\hzuMEjm.exe

C:\Windows\System\hzuMEjm.exe

C:\Windows\System\keRCHCd.exe

C:\Windows\System\keRCHCd.exe

C:\Windows\System\ylGvDpN.exe

C:\Windows\System\ylGvDpN.exe

C:\Windows\System\gVAjYVP.exe

C:\Windows\System\gVAjYVP.exe

C:\Windows\System\BgMzYdR.exe

C:\Windows\System\BgMzYdR.exe

C:\Windows\System\lklyzeJ.exe

C:\Windows\System\lklyzeJ.exe

C:\Windows\System\AnWMvnY.exe

C:\Windows\System\AnWMvnY.exe

C:\Windows\System\TzlCdJc.exe

C:\Windows\System\TzlCdJc.exe

C:\Windows\System\cbREOUD.exe

C:\Windows\System\cbREOUD.exe

C:\Windows\System\TKqhwSs.exe

C:\Windows\System\TKqhwSs.exe

C:\Windows\System\GICWXBN.exe

C:\Windows\System\GICWXBN.exe

C:\Windows\System\hRoDQqg.exe

C:\Windows\System\hRoDQqg.exe

C:\Windows\System\kASPqev.exe

C:\Windows\System\kASPqev.exe

C:\Windows\System\numORKp.exe

C:\Windows\System\numORKp.exe

C:\Windows\System\TdSpaJY.exe

C:\Windows\System\TdSpaJY.exe

C:\Windows\System\AORaoWR.exe

C:\Windows\System\AORaoWR.exe

C:\Windows\System\YyisScR.exe

C:\Windows\System\YyisScR.exe

C:\Windows\System\FtvnJsJ.exe

C:\Windows\System\FtvnJsJ.exe

C:\Windows\System\kYCiFlC.exe

C:\Windows\System\kYCiFlC.exe

C:\Windows\System\YggmzzH.exe

C:\Windows\System\YggmzzH.exe

C:\Windows\System\QEDukHV.exe

C:\Windows\System\QEDukHV.exe

C:\Windows\System\KOTeYEG.exe

C:\Windows\System\KOTeYEG.exe

C:\Windows\System\Jcuepgr.exe

C:\Windows\System\Jcuepgr.exe

C:\Windows\System\NHPmETj.exe

C:\Windows\System\NHPmETj.exe

C:\Windows\System\bXbxtOt.exe

C:\Windows\System\bXbxtOt.exe

C:\Windows\System\rTQedZC.exe

C:\Windows\System\rTQedZC.exe

C:\Windows\System\IvCLbgz.exe

C:\Windows\System\IvCLbgz.exe

C:\Windows\System\RyPWWrM.exe

C:\Windows\System\RyPWWrM.exe

C:\Windows\System\wdqYuhe.exe

C:\Windows\System\wdqYuhe.exe

C:\Windows\System\dHrNMTc.exe

C:\Windows\System\dHrNMTc.exe

C:\Windows\System\eAzuTLW.exe

C:\Windows\System\eAzuTLW.exe

C:\Windows\System\YrjJmMH.exe

C:\Windows\System\YrjJmMH.exe

C:\Windows\System\TMfXgmH.exe

C:\Windows\System\TMfXgmH.exe

C:\Windows\System\QDvMnwV.exe

C:\Windows\System\QDvMnwV.exe

C:\Windows\System\RVvoQHn.exe

C:\Windows\System\RVvoQHn.exe

C:\Windows\System\hjUjPSS.exe

C:\Windows\System\hjUjPSS.exe

C:\Windows\System\dXkeFUM.exe

C:\Windows\System\dXkeFUM.exe

C:\Windows\System\cZhGlwE.exe

C:\Windows\System\cZhGlwE.exe

C:\Windows\System\irQHXnr.exe

C:\Windows\System\irQHXnr.exe

C:\Windows\System\NeDeaNa.exe

C:\Windows\System\NeDeaNa.exe

C:\Windows\System\JcTyPsm.exe

C:\Windows\System\JcTyPsm.exe

C:\Windows\System\whobSGd.exe

C:\Windows\System\whobSGd.exe

C:\Windows\System\eXSAXyC.exe

C:\Windows\System\eXSAXyC.exe

C:\Windows\System\wJhJZTi.exe

C:\Windows\System\wJhJZTi.exe

C:\Windows\System\eeXwGtZ.exe

C:\Windows\System\eeXwGtZ.exe

C:\Windows\System\TuCzrIT.exe

C:\Windows\System\TuCzrIT.exe

C:\Windows\System\bUxFdHh.exe

C:\Windows\System\bUxFdHh.exe

C:\Windows\System\NWRFGjA.exe

C:\Windows\System\NWRFGjA.exe

C:\Windows\System\HRkNYuz.exe

C:\Windows\System\HRkNYuz.exe

C:\Windows\System\wMvsBJC.exe

C:\Windows\System\wMvsBJC.exe

C:\Windows\System\RuFYSJS.exe

C:\Windows\System\RuFYSJS.exe

C:\Windows\System\KWzMkFs.exe

C:\Windows\System\KWzMkFs.exe

C:\Windows\System\tlVxMEu.exe

C:\Windows\System\tlVxMEu.exe

C:\Windows\System\DzddtWa.exe

C:\Windows\System\DzddtWa.exe

C:\Windows\System\MbNyMLp.exe

C:\Windows\System\MbNyMLp.exe

C:\Windows\System\CNJINuY.exe

C:\Windows\System\CNJINuY.exe

C:\Windows\System\lCoFlMN.exe

C:\Windows\System\lCoFlMN.exe

C:\Windows\System\pUVQiKW.exe

C:\Windows\System\pUVQiKW.exe

C:\Windows\System\Gjhhbiu.exe

C:\Windows\System\Gjhhbiu.exe

C:\Windows\System\ylBZLXl.exe

C:\Windows\System\ylBZLXl.exe

C:\Windows\System\GquSooW.exe

C:\Windows\System\GquSooW.exe

C:\Windows\System\SAAHEqr.exe

C:\Windows\System\SAAHEqr.exe

C:\Windows\System\iysXrjQ.exe

C:\Windows\System\iysXrjQ.exe

C:\Windows\System\WusTsZb.exe

C:\Windows\System\WusTsZb.exe

C:\Windows\System\OYsELFQ.exe

C:\Windows\System\OYsELFQ.exe

C:\Windows\System\wnLdnjO.exe

C:\Windows\System\wnLdnjO.exe

C:\Windows\System\iVVgtmZ.exe

C:\Windows\System\iVVgtmZ.exe

C:\Windows\System\WqLIDhP.exe

C:\Windows\System\WqLIDhP.exe

C:\Windows\System\dWMrqeJ.exe

C:\Windows\System\dWMrqeJ.exe

C:\Windows\System\xckqpNA.exe

C:\Windows\System\xckqpNA.exe

C:\Windows\System\AOcYyOy.exe

C:\Windows\System\AOcYyOy.exe

C:\Windows\System\Wjdflom.exe

C:\Windows\System\Wjdflom.exe

C:\Windows\System\kBETWnO.exe

C:\Windows\System\kBETWnO.exe

C:\Windows\System\ufDrwAy.exe

C:\Windows\System\ufDrwAy.exe

C:\Windows\System\znRvglI.exe

C:\Windows\System\znRvglI.exe

C:\Windows\System\LAsxhLo.exe

C:\Windows\System\LAsxhLo.exe

C:\Windows\System\PxgSwBa.exe

C:\Windows\System\PxgSwBa.exe

C:\Windows\System\LuHMQvO.exe

C:\Windows\System\LuHMQvO.exe

C:\Windows\System\crVjDMa.exe

C:\Windows\System\crVjDMa.exe

C:\Windows\System\tJNfPdm.exe

C:\Windows\System\tJNfPdm.exe

C:\Windows\System\bmQrGaq.exe

C:\Windows\System\bmQrGaq.exe

C:\Windows\System\mQPLYUx.exe

C:\Windows\System\mQPLYUx.exe

C:\Windows\System\Jvrlwwj.exe

C:\Windows\System\Jvrlwwj.exe

C:\Windows\System\OszRtip.exe

C:\Windows\System\OszRtip.exe

C:\Windows\System\gDeIVpI.exe

C:\Windows\System\gDeIVpI.exe

C:\Windows\System\osHLNRh.exe

C:\Windows\System\osHLNRh.exe

C:\Windows\System\SzyhRLF.exe

C:\Windows\System\SzyhRLF.exe

C:\Windows\System\kXMmjyw.exe

C:\Windows\System\kXMmjyw.exe

C:\Windows\System\dCtFFnh.exe

C:\Windows\System\dCtFFnh.exe

C:\Windows\System\hhFaXQn.exe

C:\Windows\System\hhFaXQn.exe

C:\Windows\System\YaBuJsU.exe

C:\Windows\System\YaBuJsU.exe

C:\Windows\System\JwtjIUg.exe

C:\Windows\System\JwtjIUg.exe

C:\Windows\System\CyjDBaK.exe

C:\Windows\System\CyjDBaK.exe

C:\Windows\System\BEYvhJM.exe

C:\Windows\System\BEYvhJM.exe

C:\Windows\System\FmEYOeZ.exe

C:\Windows\System\FmEYOeZ.exe

C:\Windows\System\eiEGWgs.exe

C:\Windows\System\eiEGWgs.exe

C:\Windows\System\oYyRQpT.exe

C:\Windows\System\oYyRQpT.exe

C:\Windows\System\nKNAHZn.exe

C:\Windows\System\nKNAHZn.exe

C:\Windows\System\zvJBhnn.exe

C:\Windows\System\zvJBhnn.exe

C:\Windows\System\tXyaSaa.exe

C:\Windows\System\tXyaSaa.exe

C:\Windows\System\uOkqxCG.exe

C:\Windows\System\uOkqxCG.exe

C:\Windows\System\kRpwEli.exe

C:\Windows\System\kRpwEli.exe

C:\Windows\System\GAgLIJD.exe

C:\Windows\System\GAgLIJD.exe

C:\Windows\System\HDubejX.exe

C:\Windows\System\HDubejX.exe

C:\Windows\System\TEJKSpJ.exe

C:\Windows\System\TEJKSpJ.exe

C:\Windows\System\wvOBklG.exe

C:\Windows\System\wvOBklG.exe

C:\Windows\System\HSivFXn.exe

C:\Windows\System\HSivFXn.exe

C:\Windows\System\jFzrFud.exe

C:\Windows\System\jFzrFud.exe

C:\Windows\System\wdNlooA.exe

C:\Windows\System\wdNlooA.exe

C:\Windows\System\VAFadrM.exe

C:\Windows\System\VAFadrM.exe

C:\Windows\System\idPhaxX.exe

C:\Windows\System\idPhaxX.exe

C:\Windows\System\WcKdTKS.exe

C:\Windows\System\WcKdTKS.exe

C:\Windows\System\CZKytot.exe

C:\Windows\System\CZKytot.exe

C:\Windows\System\sOmWtNS.exe

C:\Windows\System\sOmWtNS.exe

C:\Windows\System\lidHTIG.exe

C:\Windows\System\lidHTIG.exe

C:\Windows\System\jdKMXfP.exe

C:\Windows\System\jdKMXfP.exe

C:\Windows\System\pZJKqbz.exe

C:\Windows\System\pZJKqbz.exe

C:\Windows\System\ZwGAYoj.exe

C:\Windows\System\ZwGAYoj.exe

C:\Windows\System\evOwmxS.exe

C:\Windows\System\evOwmxS.exe

C:\Windows\System\jGgcsEM.exe

C:\Windows\System\jGgcsEM.exe

C:\Windows\System\CjYRkAR.exe

C:\Windows\System\CjYRkAR.exe

C:\Windows\System\sPPTqEh.exe

C:\Windows\System\sPPTqEh.exe

C:\Windows\System\ysgLSOp.exe

C:\Windows\System\ysgLSOp.exe

C:\Windows\System\PbYJSiI.exe

C:\Windows\System\PbYJSiI.exe

C:\Windows\System\rKXbzIS.exe

C:\Windows\System\rKXbzIS.exe

C:\Windows\System\gfUNUGn.exe

C:\Windows\System\gfUNUGn.exe

C:\Windows\System\EfpGmOA.exe

C:\Windows\System\EfpGmOA.exe

C:\Windows\System\cxCOYKF.exe

C:\Windows\System\cxCOYKF.exe

C:\Windows\System\OtbOcxJ.exe

C:\Windows\System\OtbOcxJ.exe

C:\Windows\System\HZZSgjU.exe

C:\Windows\System\HZZSgjU.exe

C:\Windows\System\BdCOtmk.exe

C:\Windows\System\BdCOtmk.exe

C:\Windows\System\ZWBEqgj.exe

C:\Windows\System\ZWBEqgj.exe

C:\Windows\System\UFSjEdT.exe

C:\Windows\System\UFSjEdT.exe

C:\Windows\System\OkUQRTP.exe

C:\Windows\System\OkUQRTP.exe

C:\Windows\System\KDNraKY.exe

C:\Windows\System\KDNraKY.exe

C:\Windows\System\miqRAJK.exe

C:\Windows\System\miqRAJK.exe

C:\Windows\System\dqVOwLZ.exe

C:\Windows\System\dqVOwLZ.exe

C:\Windows\System\neDMcJe.exe

C:\Windows\System\neDMcJe.exe

C:\Windows\System\pKhNfbT.exe

C:\Windows\System\pKhNfbT.exe

C:\Windows\System\QoXKzgZ.exe

C:\Windows\System\QoXKzgZ.exe

C:\Windows\System\tnacrQB.exe

C:\Windows\System\tnacrQB.exe

C:\Windows\System\kPtodFe.exe

C:\Windows\System\kPtodFe.exe

C:\Windows\System\STDMhWk.exe

C:\Windows\System\STDMhWk.exe

C:\Windows\System\PPeVhYK.exe

C:\Windows\System\PPeVhYK.exe

C:\Windows\System\PNGmVll.exe

C:\Windows\System\PNGmVll.exe

C:\Windows\System\BtVZzfW.exe

C:\Windows\System\BtVZzfW.exe

C:\Windows\System\XNiHMWH.exe

C:\Windows\System\XNiHMWH.exe

C:\Windows\System\SiavIRB.exe

C:\Windows\System\SiavIRB.exe

C:\Windows\System\uAYQlzX.exe

C:\Windows\System\uAYQlzX.exe

Network

N/A

Files

memory/1792-0-0x000000013FBA0000-0x000000013FEF4000-memory.dmp

memory/1792-1-0x00000000000F0000-0x0000000000100000-memory.dmp

\Windows\system\jCgInLD.exe

MD5	11b0173396a3b11f97b7d3266afaaa37
SHA1	02e7a9cfd19de474cee3e3f8ab24e4e12188c1c6
SHA256	48313da5889d81c37fe25cfb9212d1c04ea688ff058758001007bc2cf5b0f0e6
SHA512	2832bdb8ecbab1857b002c1e3d1b2e0e3a93b385cfffb62690c7fbe127d87ebc73f00f6568eb384d515c30c8b8c7c97767e992df016cd56159975556e7170f5f

C:\Windows\system\VkGigco.exe

MD5	ae20d4a6a5e368aef225987ad265c573
SHA1	66b259ce8e4a40834f041b9c4957a37387a4035f
SHA256	e590f8ccade546e3a7eb1e610825535441c45ed7f9541441a5f33d4b997a16c3
SHA512	49af720b24fa37f0de4a9333c0693e32e474b899f20f231c32f4949f914d4b57395f53c542cf29e4517983b1230d79beee2a94dba32a600240d66ed536920457

\Windows\system\oUDCMqp.exe

MD5	ca57102cd7d284c6981070be017ab216
SHA1	b14574b19332544e1a97a3018dd94b1f83a5a6e1
SHA256	9666ba9747e1c0f3fad86fe978db4b42129aa31661907bfeb6cbe5669ed15e44
SHA512	996a4100020eb49d5cc294be9fd87da661abfaa154b960f38ee6653b25c85fc56991872bc1bbcccae6879e056423cbf314cdb896bd0ab80e331c5227a388f6c8

\Windows\system\UFgpTad.exe

MD5	76584ca885321038ede5411b1f754702
SHA1	659dffcb53b3db6eed174af85a98e7ce80929673
SHA256	a6b19d4e9ffb0d2406df4d84aaee28203199ca9c49292b77802114f6ecec7f11
SHA512	5e05fc57d90c8bf1b316150f078746c1e56756aee160e8da8bb3b4dc4f303e1922bd5e63cd39c9832548a47d39c94573221763cd3df917a37d483910fec48123

memory/1792-100-0x000000013FF10000-0x0000000140264000-memory.dmp

memory/2536-103-0x000000013FC70000-0x000000013FFC4000-memory.dmp

C:\Windows\system\KIyubfe.exe

MD5	97805480049e8a4df19ec20939e193c5
SHA1	05ab73b9a240264f58e460036b314c63be0cd274
SHA256	ff82fde9142ede9ad91835942384b32ba5ec0fe5a7d664587d6f44d35c9037bd
SHA512	ce29fdb58cfc412d1823b7ebda1d3429c0a4645d14f273d64fb4f8506967b56358bf00d4b987ebb6c4ca92ddc70a9b137764654d3c9e67763eb258e3c8fe47b4

C:\Windows\system\MObzWpU.exe

MD5	65d3867c43ce5dbdc0ba63d6dd9e88ca
SHA1	960810d89120ed67db9e85a3861ceb245c1d958e
SHA256	c34985ca0e32b028032cb45374508d231b12a8f3dbf072083b41f5f2bc495c8d
SHA512	9e1801d1f81009c1270ffd9d2bbe4274c79b4e284102d23cc9f50decc9df25351a8eb22e97d7ff69021d6894b623451aa05651fa1da54303397b90462e67507b

C:\Windows\system\moOQbaw.exe

MD5	9bf5a7f4b561c29daf8817303a4d634e
SHA1	1616b9507253170599f7857af6b16fe754d6d1b1
SHA256	e5056dfdef45bda615ae5b3da4ffe1ea34cc12ff80155964f78a5d9e1c45f8ac
SHA512	98606a5cd01c5ef51300d815422a0c3400211ebbbe63e3cfcabf5466f9894b5f9aed276c93226d4cc26028979063c3455eb243987140930f401921fac0ef34e4

C:\Windows\system\LjgMakt.exe

MD5	b0c144cba063e27c894a7d285d54b4ea
SHA1	d61e9cb74e7dfc708fd0516694cecb82d2b7f439
SHA256	f02a9db71ab24c0769196e71b616210bf88446d2f6dc64e5e04f03b1353b354b
SHA512	c2743bd606d8f1aa8e56ea360594774ce7c023bc1dbd6919c0a5fcf2311cfe29f666f6c152ea00494becc205ffbb9cac97c1ae18baa5be96bc0db5536053db5b

C:\Windows\system\UUBKOfy.exe

MD5	d8fdfc407d186816d51a3d7d81cc507c
SHA1	5f590f38036b57468954b0a51c4c3b099ac583b0
SHA256	9ffab30620417fa759011e15a98caa226a18d2a8ea2d9ca9be6acbcd97cd98cb
SHA512	1246aad896524efb19e067804dd25b4bcc23dd72187c0545aaafc7badddf3364191ac7497b0bfcab129010eb32479d4f8912478fb842474917d87abd20d3403b

C:\Windows\system\FVUOyTv.exe

MD5	629c42a7bb7d1147aa25f8c12eb06ab6
SHA1	bcd190a35855d4efa14eb91a857d08e8eb4e8545
SHA256	9d729d818a5928753998274238362dc8db20afc87391b547f41a66ec6e7095e1
SHA512	1570a8451130cc4aa181de28e45053dd9faf757a2af8895f3d4c0ae946774c4687d343fcbd7bb42968fdab2434c02fc5855cff2c2d88b76f12e6fcb0b60b9bce

C:\Windows\system\jciQhya.exe

MD5	0a64e6a5df46a8a670c3f06c624f217e
SHA1	f4ec113b57c1eea14ae294db7f4d94fd16110c90
SHA256	1cb5c29e365c35436133f66cb5396630e3bfbece6b8d2f72c354cebca0cf74b3
SHA512	d819a867c1a9827ba89da4c2ee399b96e9ca57b3041a4a45793cb1dd9fce5317cb9d4e4aa814fc202c7d466d994d264542b50d991dc494e43549f2d1cb045ad9

C:\Windows\system\hkMgzFQ.exe

MD5	ff0c2c3d6892ae812f0e7eed8abd5492
SHA1	c1bb8bdc4396777feebf553392f2fcadf3e0cbe4
SHA256	7cbb42caa046bbd7df235a013818f7d1a50785cc761114f59272254b788138a5
SHA512	d2669f616d94b333d1cce84895ea25518045c57f9966f0b9e3941e1c2c6e1472c741be37ee8f1533e75c43acaee1d3d6eed3c4027a51a2372124582ad6fa7ea7

C:\Windows\system\MroydCD.exe

MD5	3aa64162b0982f567272ffb515da029a
SHA1	402493207ee2e0387d2d148be4617d4d6af94d39
SHA256	76f24e3fd2e375f23289f1ef73787f943050fe8cde0221f16575a7777d636742
SHA512	421bf76d12eeac1b458468a26f31b7f0a8bbc0fefbcf1c1226be6e9d41da1dcc6567ba573427f2343ecebbc3a38a26695ff4b20b3f12525cbc1cc51dfa5a864d

C:\Windows\system\ieOrCjQ.exe

MD5	c29a1794a42857e964de6a31912e86c0
SHA1	e0a72faf1000cd8849c69e4fd5b79d307c59b5a5
SHA256	3dc9f64a33881ab8881c78913e0bc2cfdb025bf487cf4e6fff950a1117175ec5
SHA512	5251162ec3cd852f2931079d6e6dc66b7b6a06dc2db614ef580bb0f19201e2c38e308f6bcdb3f13dcb3617c37411b4030b6758bf81053ad1e9a4943499fd5596

\Windows\system\sNlNuVz.exe

MD5	d2a033da9df1f771e63b16d9a8430c8c
SHA1	ada30e9a359948354d8e40a967d9c4e7bf656a62
SHA256	9d37b4b8dec1f0f762045c989ec20f316792b754a07905384a73db28f04f49bc
SHA512	5b51b80c402bb2b6ebce975d2e0717815baf6c59dad0d39e6418611dabb9236794db7dfddafee98e32a756cb3e0d1a29a6c30fde725501644ab3da4419750d32

C:\Windows\system\uuGQMnX.exe

MD5	641449d2bb64239e92cf08443a634173
SHA1	dc480c8be0962f50bb0a581099ace4c21c396ec4
SHA256	4473be303d0502b33fe2e85830f5bd035f721cafb1cb3af3f71f147b76fd3afa
SHA512	33f02ba5e7034fc890a231bbfebce6cddbd2ee8f9daf46537197d6e3751bc6e84839090ac29d4b05ace1c4cdd7c7ba93dc2f70e49c2ec3daa12c53b61fb1eebe

C:\Windows\system\imVwQif.exe

MD5	319c29a978812d1757658b0544c68b84
SHA1	b5edf558bdb6e59249b2538b536a276c1bb538ed
SHA256	e4b3e8fae3fad76819e54e12f17d978e5b71f08cd103f23e224ccd171b068abd
SHA512	5aa670aabb05f93064e9da1b5051243c3d4c549eb59c0675f0b407f0e1db40495257bd738ba12e9025cc01c59d97a9b5db693f8e8e5d9ef9391bbb164576840a

C:\Windows\system\IzuoVsG.exe

MD5	27eb1a139e5b83fc02477e57cba7d48a
SHA1	3ca8d6a7d40f6974e3160e5a179620a9ad8d2a4c
SHA256	2f24a3f7725bdeb1e0d7543963319f2a1189bb921a5b1d9379d3c043790e364b
SHA512	229d709dda6ff5d5ab67674debe6bc99665379045ca14fdf002a1ed89453a4a559faa135da63f0fe18970637747276c70c27c75c310d9095ee01592f3f91b3c8

C:\Windows\system\bxCqGSC.exe

MD5	8a1d74f5e61f540628ac5046c1ebaaa6
SHA1	6be70a29b4e7951a0f033db5ed8882cde55978d5
SHA256	2d3a2f78c9ae33e2ee26fc09f2a2f9a490020020706dbf6b7461ee44bcd17c11
SHA512	a6304bbe308ae1df45ed5cdadfd14eb28b26cc8c1e69975ee61ca29b816c07164110014aa4f695ae6fcd827e75f6faed69e8541302096a16d6b4e6e3eae3fdec

memory/1792-114-0x000000013F660000-0x000000013F9B4000-memory.dmp

memory/2764-91-0x000000013F230000-0x000000013F584000-memory.dmp

memory/2620-90-0x000000013FF80000-0x00000001402D4000-memory.dmp

C:\Windows\system\OmGjMNA.exe

MD5	eeba4a1f1e404e1cb10c91e92291b4f6
SHA1	2e656559878090017ef194f63ad5e150159516ff
SHA256	9e97b1d0a9eee40a60d6c4976e6e771ab67a4ba1b09d1f1b231631f4fadb56dd
SHA512	4bc05f7b8ea5f3e60c5ec3010be7becc3e1a5bab746893dd51e29130a082a4a8b5d23072ba9ab18c085ccb3a3452e69d6038a6b01eb9d06cfc1d36a47ba3bb44

memory/1748-82-0x000000013FB20000-0x000000013FE74000-memory.dmp

memory/1792-61-0x000000013FF80000-0x00000001402D4000-memory.dmp

\Windows\system\LWJoRWY.exe

MD5	259646dfd7b470b6faab1f537ccc4403
SHA1	152f38a5ff57d84ffebbb1609c88e5b57fcc418a
SHA256	1eba2b935e6fb21e0b5fa89d26dd4dfe13594d6657d99c8ce93951bb5db9a80e
SHA512	ba7d1f0636ca01c3c84d0bd42cc1652c497fda4c8fba0061374b765f7a1b30708ef86dcb781d03037d36f2b58cba659acefa8e7398ab7ff4de682a2940b3cb35

memory/1792-49-0x000000013F4B0000-0x000000013F804000-memory.dmp

C:\Windows\system\zJtmbBH.exe

MD5	91c6f798cd91ccc8f0628d34f31d3730
SHA1	f8f00456170869d325e0e12ed08fcc85832792b4
SHA256	028bdd774323e4b5602084d729d78c32223e36bd98e5cae131bc2ffd7f6a86d5
SHA512	9399d493c7f8dacdce9a4d5e2383d44028bec1bd1065bedb79923aa96877a57f99165595d9234fdcb8cd11ca5ca77aa327cc3fc0798b6903ec7c1eefb3ca178c

C:\Windows\system\LZFBzUU.exe

MD5	832709c724450cde8747748007728e22
SHA1	243c238d546b54992fefdd6b02fe53fbff0b2704
SHA256	3a19f093b03ed7f16eb1d78ad0e736cfadccb6a67f3de264f6e0dc9e6dfeff72
SHA512	ae28eacefc55ff4b695aad4d276a9df954c09012af7dfd5ffc6bf9441f9548db6e4894836f362a1d70edfe36fec07821be70fae31b126f5b6d5c490ea5d6901a

C:\Windows\system\IKZqXfJ.exe

MD5	7e2ef37702b5a6ac97771e91b34f1c1d
SHA1	b640d2109ea437c915199ce817059b23412af9b7
SHA256	8dc524fc4df46d33b31847e55b47940e5be3756945dbf7ac2d4ef5d0bf546bc9
SHA512	76a7dbed98a36e06b09aaf4e9e2b76a2c70c0b22d2fc7d065350158f83b438737280e34f762a34579cfc8df24947167fbcc119a0de7e1665cdae86dae541d351

C:\Windows\system\YgjvJli.exe

MD5	5cce50c074c2b6145c1cccd8e2a329be
SHA1	324181e74f1adb3d6c4b52e93893b6b0436c4cd5
SHA256	419fc51657b73f1067a8fb34854660d6dee5522f4b0c9f119d9311e70f70f6fb
SHA512	db758714c9a83ac02d563bb50a3e52dc544b16664a0d062841f4d32c2ba8151ee7346f4608c9ae4726e7fc290ecc62b6e0a08d82d808a2711d3fa50ce4c5e0e6

memory/1792-39-0x000000013F310000-0x000000013F664000-memory.dmp

C:\Windows\system\riKBOrw.exe

MD5	003c74cf98dad4926fccbcb558b7a696
SHA1	1e6c8bda849ed9a1acab3a3623edd43d5b0fc071
SHA256	0d6209da75590ad26a93eafc150977ba08405da479c2a8eb09880eea9754af6e
SHA512	49f95f2cde53cd5cba2bed551e0294aaa0041be427debfd2bc63708e4f493cf7bad79ef743de90d5cd34dfed6c3b253969ff817cc13f9dcd9a6e5a9bb0dfbcbb

C:\Windows\system\olkUHjg.exe

MD5	2dbcf6b2e443affdebb7fcaf8cf75a06
SHA1	564324a8d75e316f655a905f7434d9cf26704744
SHA256	42cfd9df77928d634eee9c756a1d0cc88ede85634420aacce19167f3e193b938
SHA512	6b1a8b60032dcd347c6451f64570b98e879d150f6495ab98eea66a6564586f7abc8f17a04ad3a2b940c8b6cf368520b2a467c6f9e75ccf17139c73323a04c181

C:\Windows\system\MpSShpu.exe

MD5	d832a45ceab4df0d8a3d668a68868fa9
SHA1	ee04f5588774fdfe4d511b5662bd61ccdf3bc4ba
SHA256	bccb8cc79591bebad21b32212db3787ec94b230c6f702a066c29e1064f74efa6
SHA512	d5e8b3a54425fc6a8d3d9e6d8849c242b15d6d23cad9e933cea92110e1bb2259dac33fb8fe19f180517238efe6da19285545548d91ef33a2500ae408fba193dc

memory/3012-28-0x000000013F310000-0x000000013F664000-memory.dmp

memory/1792-113-0x0000000001EF0000-0x0000000002244000-memory.dmp

memory/2952-112-0x000000013F400000-0x000000013F754000-memory.dmp

memory/1792-111-0x000000013F770000-0x000000013FAC4000-memory.dmp

memory/1792-110-0x000000013F230000-0x000000013F584000-memory.dmp

memory/1792-109-0x000000013FF40000-0x0000000140294000-memory.dmp

memory/1792-106-0x0000000001EF0000-0x0000000002244000-memory.dmp

memory/1792-105-0x0000000001EF0000-0x0000000002244000-memory.dmp

memory/2516-104-0x000000013F830000-0x000000013FB84000-memory.dmp

memory/2996-102-0x000000013F8D0000-0x000000013FC24000-memory.dmp

memory/3008-101-0x000000013F4B0000-0x000000013F804000-memory.dmp

memory/1792-99-0x0000000001EF0000-0x0000000002244000-memory.dmp

memory/1792-98-0x0000000001EF0000-0x0000000002244000-memory.dmp

memory/1792-75-0x0000000001EF0000-0x0000000002244000-memory.dmp

C:\Windows\system\jscoeZL.exe

MD5	abe4ae3516a2fcb7fe51eadda0c5a4a3
SHA1	94834b41d33b02ee2f9eaa97c985e8b8189e22b2
SHA256	a5f6a47b6a1d97558df6dc9eb02cd2b0765732c0a5ba0c2d62ccd963b4f3c02c
SHA512	eb5b684c8bb3d0b58325ef219a3695c2898ac46a42abea837a7befe02befe39f129956bd7982215645dcb47a24bd1293010296ed2447262a9ba65b1bde9fbb85

C:\Windows\system\vdMTVGX.exe

MD5	7d3b0ae133435b80f7c1556aeeb675a2
SHA1	65406adb28c02d352eede2c36897b9728e500ef9
SHA256	0cd579b476714c423a2c676d1ff87855cdf6009519478e511c0853b9a75e65ae
SHA512	f9091924358059dc10793f6d6ab61c09ee8e6350caaa91c391d23a52d6a71258b9fd995437dae48939f00f7022c97d2e32c9e741d92354a3f112ae6bea4bada2

C:\Windows\system\LfTsTlB.exe

MD5	6bfdb0f19cfbd1df10d3385046460216
SHA1	096ebcbbbff0c4ea4525945ba4adbfe4917afa85
SHA256	3e23d8e8a8b93991f8f47e8488e1e0bc6035e17e2a1eebb73acbb83db8f26975
SHA512	a159f176b3b53f34992eb9494874fb4611cd62ffa9f6c731e040542d29670e8776e33c21e0c0536691dacf8cdb1d40c4116abcac1243e9ce7d2202ff6804b0d4

memory/1792-35-0x000000013F400000-0x000000013F754000-memory.dmp

memory/1792-25-0x0000000001EF0000-0x0000000002244000-memory.dmp

C:\Windows\system\zjTGrEi.exe

MD5	abbe3e1ffa7408027cbd6b1d19226bf0
SHA1	cf30577b271415796106b1baf3bf4a3e555edc7c
SHA256	3d85d93bdbdf4d1480c95aaaf0b406c08bafeb73a68fc8bcac9ce77a190983d8
SHA512	b217592631fad66458c5090091ae76f4300ac5487eb4bb6f5cfc82663d7d521c2a4ae01395590cd3435ae56f6752fe70795652b3f11a91e6901aa301f2feba4a

memory/2944-18-0x000000013F470000-0x000000013F7C4000-memory.dmp

memory/1792-10-0x000000013F470000-0x000000013F7C4000-memory.dmp

memory/2944-2641-0x000000013F470000-0x000000013F7C4000-memory.dmp

memory/3012-2643-0x000000013F310000-0x000000013F664000-memory.dmp

memory/1792-2642-0x0000000001EF0000-0x0000000002244000-memory.dmp

memory/1792-2640-0x000000013FBA0000-0x000000013FEF4000-memory.dmp

memory/1792-2793-0x0000000001EF0000-0x0000000002244000-memory.dmp

memory/1792-2974-0x0000000001EF0000-0x0000000002244000-memory.dmp

memory/1792-2979-0x0000000001EF0000-0x0000000002244000-memory.dmp

memory/1792-2980-0x0000000001EF0000-0x0000000002244000-memory.dmp

memory/1792-2982-0x000000013FF40000-0x0000000140294000-memory.dmp

memory/1792-3357-0x0000000001EF0000-0x0000000002244000-memory.dmp

memory/1792-3359-0x000000013F830000-0x000000013FB84000-memory.dmp

memory/2944-4028-0x000000013F470000-0x000000013F7C4000-memory.dmp

memory/3012-4029-0x000000013F310000-0x000000013F664000-memory.dmp

memory/2952-4031-0x000000013F400000-0x000000013F754000-memory.dmp

memory/2620-4030-0x000000013FF80000-0x00000001402D4000-memory.dmp

memory/2764-4034-0x000000013F230000-0x000000013F584000-memory.dmp

memory/3008-4033-0x000000013F4B0000-0x000000013F804000-memory.dmp

memory/1748-4032-0x000000013FB20000-0x000000013FE74000-memory.dmp

memory/2996-4036-0x000000013F8D0000-0x000000013FC24000-memory.dmp

memory/2516-4035-0x000000013F830000-0x000000013FB84000-memory.dmp

memory/2536-4037-0x000000013FC70000-0x000000013FFC4000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 14:02

Reported

2024-06-13 14:05

Platform

win10v2004-20240611-en

Max time kernel

93s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\pPdbYMo.exe	N/A
N/A	N/A	C:\Windows\System\NyWDNwM.exe	N/A
N/A	N/A	C:\Windows\System\JSWQRZo.exe	N/A
N/A	N/A	C:\Windows\System\QKpLFjo.exe	N/A
N/A	N/A	C:\Windows\System\rpNiCsy.exe	N/A
N/A	N/A	C:\Windows\System\XAOcbbs.exe	N/A
N/A	N/A	C:\Windows\System\XStcTCy.exe	N/A
N/A	N/A	C:\Windows\System\BloIyku.exe	N/A
N/A	N/A	C:\Windows\System\eWsODKp.exe	N/A
N/A	N/A	C:\Windows\System\sfPeVNG.exe	N/A
N/A	N/A	C:\Windows\System\udEspXw.exe	N/A
N/A	N/A	C:\Windows\System\YmpTFpw.exe	N/A
N/A	N/A	C:\Windows\System\IfGdDav.exe	N/A
N/A	N/A	C:\Windows\System\oKnyrjw.exe	N/A
N/A	N/A	C:\Windows\System\XqikOLr.exe	N/A
N/A	N/A	C:\Windows\System\cvZqMei.exe	N/A
N/A	N/A	C:\Windows\System\iNEKlgB.exe	N/A
N/A	N/A	C:\Windows\System\jVbYLaK.exe	N/A
N/A	N/A	C:\Windows\System\qiwxMan.exe	N/A
N/A	N/A	C:\Windows\System\FRddJxx.exe	N/A
N/A	N/A	C:\Windows\System\ghbzigy.exe	N/A
N/A	N/A	C:\Windows\System\sUwKKjX.exe	N/A
N/A	N/A	C:\Windows\System\QNLbuvV.exe	N/A
N/A	N/A	C:\Windows\System\lfoMkms.exe	N/A
N/A	N/A	C:\Windows\System\LiytJtc.exe	N/A
N/A	N/A	C:\Windows\System\lJzfVIX.exe	N/A
N/A	N/A	C:\Windows\System\fTDfWZb.exe	N/A
N/A	N/A	C:\Windows\System\OHJPloq.exe	N/A
N/A	N/A	C:\Windows\System\ruZmCWW.exe	N/A
N/A	N/A	C:\Windows\System\HfOjNBa.exe	N/A
N/A	N/A	C:\Windows\System\QXcyAja.exe	N/A
N/A	N/A	C:\Windows\System\yLgiVSN.exe	N/A
N/A	N/A	C:\Windows\System\kmndeXW.exe	N/A
N/A	N/A	C:\Windows\System\mDZjHWi.exe	N/A
N/A	N/A	C:\Windows\System\RmilPAk.exe	N/A
N/A	N/A	C:\Windows\System\YbLpIUq.exe	N/A
N/A	N/A	C:\Windows\System\NWmlVyc.exe	N/A
N/A	N/A	C:\Windows\System\tijqFhr.exe	N/A
N/A	N/A	C:\Windows\System\JQQqqAA.exe	N/A
N/A	N/A	C:\Windows\System\ZChHLAr.exe	N/A
N/A	N/A	C:\Windows\System\czqugFt.exe	N/A
N/A	N/A	C:\Windows\System\NDxMbkq.exe	N/A
N/A	N/A	C:\Windows\System\JqmDldc.exe	N/A
N/A	N/A	C:\Windows\System\ZdUChjG.exe	N/A
N/A	N/A	C:\Windows\System\FyQDPnx.exe	N/A
N/A	N/A	C:\Windows\System\jUHprrf.exe	N/A
N/A	N/A	C:\Windows\System\Csbeqbe.exe	N/A
N/A	N/A	C:\Windows\System\ukOxxEg.exe	N/A
N/A	N/A	C:\Windows\System\rpLypaJ.exe	N/A
N/A	N/A	C:\Windows\System\PaAIBVp.exe	N/A
N/A	N/A	C:\Windows\System\ULqdphJ.exe	N/A
N/A	N/A	C:\Windows\System\fTfGFyC.exe	N/A
N/A	N/A	C:\Windows\System\XYOHHDs.exe	N/A
N/A	N/A	C:\Windows\System\uBRkrey.exe	N/A
N/A	N/A	C:\Windows\System\cwLvQMh.exe	N/A
N/A	N/A	C:\Windows\System\Zzjaxsa.exe	N/A
N/A	N/A	C:\Windows\System\HGduYSu.exe	N/A
N/A	N/A	C:\Windows\System\PwaJLHc.exe	N/A
N/A	N/A	C:\Windows\System\WPfDxME.exe	N/A
N/A	N/A	C:\Windows\System\gPDAwJP.exe	N/A
N/A	N/A	C:\Windows\System\sDBfLXM.exe	N/A
N/A	N/A	C:\Windows\System\DidmmkG.exe	N/A
N/A	N/A	C:\Windows\System\LroCQUB.exe	N/A
N/A	N/A	C:\Windows\System\LzjfrDR.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\cvZqMei.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rpLypaJ.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\btFHgsO.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EPKMaRo.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RwRPYEY.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DxItGdc.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PgdVEAt.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XjluELT.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Jghaloc.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\shFNLBq.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YmpTFpw.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KGyaSnQ.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VtwaPst.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\udEspXw.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lGdfZPk.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tGVNLFX.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MGUOkAF.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yiIexcz.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nCaGudR.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jaoHHEN.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RFbrgnl.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OfwFmMD.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NGijXRC.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DidmmkG.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ounewAS.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fdJQSZc.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NRjLFxm.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NrjHdjv.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FHNOWaV.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GMwcIhl.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aWKWIaG.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EebZJKi.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XZYycEQ.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mwRnzHt.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KUOAMlE.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RKwbgeI.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yMfuknP.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IQwlvSu.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nDmAwLP.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IzCZZem.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MeFNBVn.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nEhcrUH.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rWrjywL.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EzMxOBI.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dlBTZBh.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Zzjaxsa.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bVocWaF.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qOmVGxl.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PaXkSWF.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WUnIhZb.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Rftsqdi.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RFNtExQ.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cCfjLFc.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KhbMVtx.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uTFdFRy.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HYJQPYw.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xQNbNlk.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TkByxAv.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WEJpbrM.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bFpgZuj.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JoywlXL.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bxlPgIA.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sPiiQaB.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\trZWaDg.exe	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2488 wrote to memory of 3676	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\pPdbYMo.exe
PID 2488 wrote to memory of 3676	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\pPdbYMo.exe
PID 2488 wrote to memory of 3116	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\NyWDNwM.exe
PID 2488 wrote to memory of 3116	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\NyWDNwM.exe
PID 2488 wrote to memory of 2360	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\JSWQRZo.exe
PID 2488 wrote to memory of 2360	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\JSWQRZo.exe
PID 2488 wrote to memory of 2304	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\QKpLFjo.exe
PID 2488 wrote to memory of 2304	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\QKpLFjo.exe
PID 2488 wrote to memory of 3484	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\rpNiCsy.exe
PID 2488 wrote to memory of 3484	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\rpNiCsy.exe
PID 2488 wrote to memory of 2392	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\XAOcbbs.exe
PID 2488 wrote to memory of 2392	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\XAOcbbs.exe
PID 2488 wrote to memory of 1520	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\eWsODKp.exe
PID 2488 wrote to memory of 1520	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\eWsODKp.exe
PID 2488 wrote to memory of 684	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\sfPeVNG.exe
PID 2488 wrote to memory of 684	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\sfPeVNG.exe
PID 2488 wrote to memory of 3460	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\XStcTCy.exe
PID 2488 wrote to memory of 3460	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\XStcTCy.exe
PID 2488 wrote to memory of 3080	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\BloIyku.exe
PID 2488 wrote to memory of 3080	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\BloIyku.exe
PID 2488 wrote to memory of 3888	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\IfGdDav.exe
PID 2488 wrote to memory of 3888	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\IfGdDav.exe
PID 2488 wrote to memory of 2240	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\udEspXw.exe
PID 2488 wrote to memory of 2240	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\udEspXw.exe
PID 2488 wrote to memory of 4448	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\YmpTFpw.exe
PID 2488 wrote to memory of 4448	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\YmpTFpw.exe
PID 2488 wrote to memory of 1360	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\oKnyrjw.exe
PID 2488 wrote to memory of 1360	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\oKnyrjw.exe
PID 2488 wrote to memory of 2552	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\XqikOLr.exe
PID 2488 wrote to memory of 2552	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\XqikOLr.exe
PID 2488 wrote to memory of 2700	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\ghbzigy.exe
PID 2488 wrote to memory of 2700	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\ghbzigy.exe
PID 2488 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\cvZqMei.exe
PID 2488 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\cvZqMei.exe
PID 2488 wrote to memory of 4352	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\iNEKlgB.exe
PID 2488 wrote to memory of 4352	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\iNEKlgB.exe
PID 2488 wrote to memory of 2660	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\jVbYLaK.exe
PID 2488 wrote to memory of 2660	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\jVbYLaK.exe
PID 2488 wrote to memory of 4652	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\qiwxMan.exe
PID 2488 wrote to memory of 4652	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\qiwxMan.exe
PID 2488 wrote to memory of 5008	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\FRddJxx.exe
PID 2488 wrote to memory of 5008	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\FRddJxx.exe
PID 2488 wrote to memory of 972	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\sUwKKjX.exe
PID 2488 wrote to memory of 972	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\sUwKKjX.exe
PID 2488 wrote to memory of 2096	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\QNLbuvV.exe
PID 2488 wrote to memory of 2096	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\QNLbuvV.exe
PID 2488 wrote to memory of 1816	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\lfoMkms.exe
PID 2488 wrote to memory of 1816	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\lfoMkms.exe
PID 2488 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\LiytJtc.exe
PID 2488 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\LiytJtc.exe
PID 2488 wrote to memory of 2624	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\lJzfVIX.exe
PID 2488 wrote to memory of 2624	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\lJzfVIX.exe
PID 2488 wrote to memory of 2032	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\fTDfWZb.exe
PID 2488 wrote to memory of 2032	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\fTDfWZb.exe
PID 2488 wrote to memory of 3652	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\OHJPloq.exe
PID 2488 wrote to memory of 3652	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\OHJPloq.exe
PID 2488 wrote to memory of 984	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\ruZmCWW.exe
PID 2488 wrote to memory of 984	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\ruZmCWW.exe
PID 2488 wrote to memory of 3100	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\HfOjNBa.exe
PID 2488 wrote to memory of 3100	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\HfOjNBa.exe
PID 2488 wrote to memory of 4156	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\QXcyAja.exe
PID 2488 wrote to memory of 4156	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\QXcyAja.exe
PID 2488 wrote to memory of 3284	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\yLgiVSN.exe
PID 2488 wrote to memory of 3284	N/A	C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe	C:\Windows\System\yLgiVSN.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe"

C:\Windows\System\pPdbYMo.exe

C:\Windows\System\pPdbYMo.exe

C:\Windows\System\NyWDNwM.exe

C:\Windows\System\NyWDNwM.exe

C:\Windows\System\JSWQRZo.exe

C:\Windows\System\JSWQRZo.exe

C:\Windows\System\QKpLFjo.exe

C:\Windows\System\QKpLFjo.exe

C:\Windows\System\rpNiCsy.exe

C:\Windows\System\rpNiCsy.exe

C:\Windows\System\XAOcbbs.exe

C:\Windows\System\XAOcbbs.exe

C:\Windows\System\eWsODKp.exe

C:\Windows\System\eWsODKp.exe

C:\Windows\System\sfPeVNG.exe

C:\Windows\System\sfPeVNG.exe

C:\Windows\System\XStcTCy.exe

C:\Windows\System\XStcTCy.exe

C:\Windows\System\BloIyku.exe

C:\Windows\System\BloIyku.exe

C:\Windows\System\IfGdDav.exe

C:\Windows\System\IfGdDav.exe

C:\Windows\System\udEspXw.exe

C:\Windows\System\udEspXw.exe

C:\Windows\System\YmpTFpw.exe

C:\Windows\System\YmpTFpw.exe

C:\Windows\System\oKnyrjw.exe

C:\Windows\System\oKnyrjw.exe

C:\Windows\System\XqikOLr.exe

C:\Windows\System\XqikOLr.exe

C:\Windows\System\ghbzigy.exe

C:\Windows\System\ghbzigy.exe

C:\Windows\System\cvZqMei.exe

C:\Windows\System\cvZqMei.exe

C:\Windows\System\iNEKlgB.exe

C:\Windows\System\iNEKlgB.exe

C:\Windows\System\jVbYLaK.exe

C:\Windows\System\jVbYLaK.exe

C:\Windows\System\qiwxMan.exe

C:\Windows\System\qiwxMan.exe

C:\Windows\System\FRddJxx.exe

C:\Windows\System\FRddJxx.exe

C:\Windows\System\sUwKKjX.exe

C:\Windows\System\sUwKKjX.exe

C:\Windows\System\QNLbuvV.exe

C:\Windows\System\QNLbuvV.exe

C:\Windows\System\lfoMkms.exe

C:\Windows\System\lfoMkms.exe

C:\Windows\System\LiytJtc.exe

C:\Windows\System\LiytJtc.exe

C:\Windows\System\lJzfVIX.exe

C:\Windows\System\lJzfVIX.exe

C:\Windows\System\fTDfWZb.exe

C:\Windows\System\fTDfWZb.exe

C:\Windows\System\OHJPloq.exe

C:\Windows\System\OHJPloq.exe

C:\Windows\System\ruZmCWW.exe

C:\Windows\System\ruZmCWW.exe

C:\Windows\System\HfOjNBa.exe

C:\Windows\System\HfOjNBa.exe

C:\Windows\System\QXcyAja.exe

C:\Windows\System\QXcyAja.exe

C:\Windows\System\yLgiVSN.exe

C:\Windows\System\yLgiVSN.exe

C:\Windows\System\kmndeXW.exe

C:\Windows\System\kmndeXW.exe

C:\Windows\System\mDZjHWi.exe

C:\Windows\System\mDZjHWi.exe

C:\Windows\System\RmilPAk.exe

C:\Windows\System\RmilPAk.exe

C:\Windows\System\YbLpIUq.exe

C:\Windows\System\YbLpIUq.exe

C:\Windows\System\NWmlVyc.exe

C:\Windows\System\NWmlVyc.exe

C:\Windows\System\tijqFhr.exe

C:\Windows\System\tijqFhr.exe

C:\Windows\System\JQQqqAA.exe

C:\Windows\System\JQQqqAA.exe

C:\Windows\System\ZChHLAr.exe

C:\Windows\System\ZChHLAr.exe

C:\Windows\System\czqugFt.exe

C:\Windows\System\czqugFt.exe

C:\Windows\System\NDxMbkq.exe

C:\Windows\System\NDxMbkq.exe

C:\Windows\System\JqmDldc.exe

C:\Windows\System\JqmDldc.exe

C:\Windows\System\ZdUChjG.exe

C:\Windows\System\ZdUChjG.exe

C:\Windows\System\FyQDPnx.exe

C:\Windows\System\FyQDPnx.exe

C:\Windows\System\jUHprrf.exe

C:\Windows\System\jUHprrf.exe

C:\Windows\System\Csbeqbe.exe

C:\Windows\System\Csbeqbe.exe

C:\Windows\System\ukOxxEg.exe

C:\Windows\System\ukOxxEg.exe

C:\Windows\System\rpLypaJ.exe

C:\Windows\System\rpLypaJ.exe

C:\Windows\System\PaAIBVp.exe

C:\Windows\System\PaAIBVp.exe

C:\Windows\System\ULqdphJ.exe

C:\Windows\System\ULqdphJ.exe

C:\Windows\System\fTfGFyC.exe

C:\Windows\System\fTfGFyC.exe

C:\Windows\System\XYOHHDs.exe

C:\Windows\System\XYOHHDs.exe

C:\Windows\System\uBRkrey.exe

C:\Windows\System\uBRkrey.exe

C:\Windows\System\cwLvQMh.exe

C:\Windows\System\cwLvQMh.exe

C:\Windows\System\Zzjaxsa.exe

C:\Windows\System\Zzjaxsa.exe

C:\Windows\System\HGduYSu.exe

C:\Windows\System\HGduYSu.exe

C:\Windows\System\PwaJLHc.exe

C:\Windows\System\PwaJLHc.exe

C:\Windows\System\WPfDxME.exe

C:\Windows\System\WPfDxME.exe

C:\Windows\System\gPDAwJP.exe

C:\Windows\System\gPDAwJP.exe

C:\Windows\System\sDBfLXM.exe

C:\Windows\System\sDBfLXM.exe

C:\Windows\System\DidmmkG.exe

C:\Windows\System\DidmmkG.exe

C:\Windows\System\LroCQUB.exe

C:\Windows\System\LroCQUB.exe

C:\Windows\System\LzjfrDR.exe

C:\Windows\System\LzjfrDR.exe

C:\Windows\System\RjJzHpG.exe

C:\Windows\System\RjJzHpG.exe

C:\Windows\System\DCurfPq.exe

C:\Windows\System\DCurfPq.exe

C:\Windows\System\qFxDIXA.exe

C:\Windows\System\qFxDIXA.exe

C:\Windows\System\mziolFi.exe

C:\Windows\System\mziolFi.exe

C:\Windows\System\bVocWaF.exe

C:\Windows\System\bVocWaF.exe

C:\Windows\System\wPMXjeQ.exe

C:\Windows\System\wPMXjeQ.exe

C:\Windows\System\wLbFQYl.exe

C:\Windows\System\wLbFQYl.exe

C:\Windows\System\AeQCiFn.exe

C:\Windows\System\AeQCiFn.exe

C:\Windows\System\cLgWzRM.exe

C:\Windows\System\cLgWzRM.exe

C:\Windows\System\PQEKbBs.exe

C:\Windows\System\PQEKbBs.exe

C:\Windows\System\tqcIpig.exe

C:\Windows\System\tqcIpig.exe

C:\Windows\System\xQzIVFF.exe

C:\Windows\System\xQzIVFF.exe

C:\Windows\System\eFGjQYu.exe

C:\Windows\System\eFGjQYu.exe

C:\Windows\System\lpLxKoW.exe

C:\Windows\System\lpLxKoW.exe

C:\Windows\System\kGxllBd.exe

C:\Windows\System\kGxllBd.exe

C:\Windows\System\KuwwMQB.exe

C:\Windows\System\KuwwMQB.exe

C:\Windows\System\mrLcRns.exe

C:\Windows\System\mrLcRns.exe

C:\Windows\System\atswCbF.exe

C:\Windows\System\atswCbF.exe

C:\Windows\System\HyprsCS.exe

C:\Windows\System\HyprsCS.exe

C:\Windows\System\oYgRbym.exe

C:\Windows\System\oYgRbym.exe

C:\Windows\System\BwvHUHJ.exe

C:\Windows\System\BwvHUHJ.exe

C:\Windows\System\nHYZzey.exe

C:\Windows\System\nHYZzey.exe

C:\Windows\System\GffnEqu.exe

C:\Windows\System\GffnEqu.exe

C:\Windows\System\OepVsqe.exe

C:\Windows\System\OepVsqe.exe

C:\Windows\System\oDHhrem.exe

C:\Windows\System\oDHhrem.exe

C:\Windows\System\hRvbkSt.exe

C:\Windows\System\hRvbkSt.exe

C:\Windows\System\nAaEhDj.exe

C:\Windows\System\nAaEhDj.exe

C:\Windows\System\MCuRHbX.exe

C:\Windows\System\MCuRHbX.exe

C:\Windows\System\vNyzwOt.exe

C:\Windows\System\vNyzwOt.exe

C:\Windows\System\PaXkSWF.exe

C:\Windows\System\PaXkSWF.exe

C:\Windows\System\kKcFExn.exe

C:\Windows\System\kKcFExn.exe

C:\Windows\System\oKEnqSR.exe

C:\Windows\System\oKEnqSR.exe

C:\Windows\System\LbIROad.exe

C:\Windows\System\LbIROad.exe

C:\Windows\System\gFasXEe.exe

C:\Windows\System\gFasXEe.exe

C:\Windows\System\Xsjxwxu.exe

C:\Windows\System\Xsjxwxu.exe

C:\Windows\System\RdtCNAp.exe

C:\Windows\System\RdtCNAp.exe

C:\Windows\System\oZcSRRC.exe

C:\Windows\System\oZcSRRC.exe

C:\Windows\System\xiGUNKb.exe

C:\Windows\System\xiGUNKb.exe

C:\Windows\System\EnJatmo.exe

C:\Windows\System\EnJatmo.exe

C:\Windows\System\FSLLlPy.exe

C:\Windows\System\FSLLlPy.exe

C:\Windows\System\iqDSahe.exe

C:\Windows\System\iqDSahe.exe

C:\Windows\System\qewNkKF.exe

C:\Windows\System\qewNkKF.exe

C:\Windows\System\RdUEDig.exe

C:\Windows\System\RdUEDig.exe

C:\Windows\System\JMdEfVK.exe

C:\Windows\System\JMdEfVK.exe

C:\Windows\System\ETKHLyE.exe

C:\Windows\System\ETKHLyE.exe

C:\Windows\System\pikllgE.exe

C:\Windows\System\pikllgE.exe

C:\Windows\System\LoGLicF.exe

C:\Windows\System\LoGLicF.exe

C:\Windows\System\qUucuZn.exe

C:\Windows\System\qUucuZn.exe

C:\Windows\System\ZaxfetE.exe

C:\Windows\System\ZaxfetE.exe

C:\Windows\System\TkByxAv.exe

C:\Windows\System\TkByxAv.exe

C:\Windows\System\BHAEfNL.exe

C:\Windows\System\BHAEfNL.exe

C:\Windows\System\xKMyQoG.exe

C:\Windows\System\xKMyQoG.exe

C:\Windows\System\ZnzYKeo.exe

C:\Windows\System\ZnzYKeo.exe

C:\Windows\System\FVYAsry.exe

C:\Windows\System\FVYAsry.exe

C:\Windows\System\LtFdyLa.exe

C:\Windows\System\LtFdyLa.exe

C:\Windows\System\HQJYHUj.exe

C:\Windows\System\HQJYHUj.exe

C:\Windows\System\lGdfZPk.exe

C:\Windows\System\lGdfZPk.exe

C:\Windows\System\OwCUlne.exe

C:\Windows\System\OwCUlne.exe

C:\Windows\System\cMNCsvo.exe

C:\Windows\System\cMNCsvo.exe

C:\Windows\System\TBfTYND.exe

C:\Windows\System\TBfTYND.exe

C:\Windows\System\EULRiHW.exe

C:\Windows\System\EULRiHW.exe

C:\Windows\System\ZIstaek.exe

C:\Windows\System\ZIstaek.exe

C:\Windows\System\msYkAxE.exe

C:\Windows\System\msYkAxE.exe

C:\Windows\System\YwSbTMx.exe

C:\Windows\System\YwSbTMx.exe

C:\Windows\System\LeqXQKv.exe

C:\Windows\System\LeqXQKv.exe

C:\Windows\System\yyFVFNw.exe

C:\Windows\System\yyFVFNw.exe

C:\Windows\System\gBbcmrE.exe

C:\Windows\System\gBbcmrE.exe

C:\Windows\System\PaIJJny.exe

C:\Windows\System\PaIJJny.exe

C:\Windows\System\IAJLZzY.exe

C:\Windows\System\IAJLZzY.exe

C:\Windows\System\oVDdLRV.exe

C:\Windows\System\oVDdLRV.exe

C:\Windows\System\ZGmPhmc.exe

C:\Windows\System\ZGmPhmc.exe

C:\Windows\System\FsLDqnT.exe

C:\Windows\System\FsLDqnT.exe

C:\Windows\System\cCfjLFc.exe

C:\Windows\System\cCfjLFc.exe

C:\Windows\System\WbWFoTn.exe

C:\Windows\System\WbWFoTn.exe

C:\Windows\System\ESpvfJg.exe

C:\Windows\System\ESpvfJg.exe

C:\Windows\System\uFyTFMo.exe

C:\Windows\System\uFyTFMo.exe

C:\Windows\System\CcVAdmY.exe

C:\Windows\System\CcVAdmY.exe

C:\Windows\System\tmvrGBS.exe

C:\Windows\System\tmvrGBS.exe

C:\Windows\System\RsAXJYy.exe

C:\Windows\System\RsAXJYy.exe

C:\Windows\System\MnYmdbL.exe

C:\Windows\System\MnYmdbL.exe

C:\Windows\System\HZhFmIs.exe

C:\Windows\System\HZhFmIs.exe

C:\Windows\System\mxePjWF.exe

C:\Windows\System\mxePjWF.exe

C:\Windows\System\VowPspq.exe

C:\Windows\System\VowPspq.exe

C:\Windows\System\CBltgPn.exe

C:\Windows\System\CBltgPn.exe

C:\Windows\System\KGyaSnQ.exe

C:\Windows\System\KGyaSnQ.exe

C:\Windows\System\WUnIhZb.exe

C:\Windows\System\WUnIhZb.exe

C:\Windows\System\DfEYgxZ.exe

C:\Windows\System\DfEYgxZ.exe

C:\Windows\System\glXwcRZ.exe

C:\Windows\System\glXwcRZ.exe

C:\Windows\System\vfxIKbT.exe

C:\Windows\System\vfxIKbT.exe

C:\Windows\System\fZGZlqD.exe

C:\Windows\System\fZGZlqD.exe

C:\Windows\System\fVsifPS.exe

C:\Windows\System\fVsifPS.exe

C:\Windows\System\NMkGeXf.exe

C:\Windows\System\NMkGeXf.exe

C:\Windows\System\MgIRRZB.exe

C:\Windows\System\MgIRRZB.exe

C:\Windows\System\PgdVEAt.exe

C:\Windows\System\PgdVEAt.exe

C:\Windows\System\PIgTtsP.exe

C:\Windows\System\PIgTtsP.exe

C:\Windows\System\HTaaFJd.exe

C:\Windows\System\HTaaFJd.exe

C:\Windows\System\pTlpSOr.exe

C:\Windows\System\pTlpSOr.exe

C:\Windows\System\AnWndtb.exe

C:\Windows\System\AnWndtb.exe

C:\Windows\System\yBKfvIg.exe

C:\Windows\System\yBKfvIg.exe

C:\Windows\System\ylfDyZN.exe

C:\Windows\System\ylfDyZN.exe

C:\Windows\System\XCcncfJ.exe

C:\Windows\System\XCcncfJ.exe

C:\Windows\System\pdEGSwW.exe

C:\Windows\System\pdEGSwW.exe

C:\Windows\System\Xqyjdgi.exe

C:\Windows\System\Xqyjdgi.exe

C:\Windows\System\OYvVPRE.exe

C:\Windows\System\OYvVPRE.exe

C:\Windows\System\UpBNGKF.exe

C:\Windows\System\UpBNGKF.exe

C:\Windows\System\wJRDcOw.exe

C:\Windows\System\wJRDcOw.exe

C:\Windows\System\OpUOsSl.exe

C:\Windows\System\OpUOsSl.exe

C:\Windows\System\MYrifgX.exe

C:\Windows\System\MYrifgX.exe

C:\Windows\System\scvNmTE.exe

C:\Windows\System\scvNmTE.exe

C:\Windows\System\PWOycas.exe

C:\Windows\System\PWOycas.exe

C:\Windows\System\aDFJStW.exe

C:\Windows\System\aDFJStW.exe

C:\Windows\System\EapBLpm.exe

C:\Windows\System\EapBLpm.exe

C:\Windows\System\KhbMVtx.exe

C:\Windows\System\KhbMVtx.exe

C:\Windows\System\sbYfXGd.exe

C:\Windows\System\sbYfXGd.exe

C:\Windows\System\TnZpZTl.exe

C:\Windows\System\TnZpZTl.exe

C:\Windows\System\edMVNPY.exe

C:\Windows\System\edMVNPY.exe

C:\Windows\System\FqCGnQD.exe

C:\Windows\System\FqCGnQD.exe

C:\Windows\System\DcQHnhJ.exe

C:\Windows\System\DcQHnhJ.exe

C:\Windows\System\OkgXIik.exe

C:\Windows\System\OkgXIik.exe

C:\Windows\System\aFQToqj.exe

C:\Windows\System\aFQToqj.exe

C:\Windows\System\axUgjNU.exe

C:\Windows\System\axUgjNU.exe

C:\Windows\System\rFfFjJE.exe

C:\Windows\System\rFfFjJE.exe

C:\Windows\System\rRKbegD.exe

C:\Windows\System\rRKbegD.exe

C:\Windows\System\WfGGade.exe

C:\Windows\System\WfGGade.exe

C:\Windows\System\KxuEpZw.exe

C:\Windows\System\KxuEpZw.exe

C:\Windows\System\eqsXyFQ.exe

C:\Windows\System\eqsXyFQ.exe

C:\Windows\System\lOQCOuB.exe

C:\Windows\System\lOQCOuB.exe

C:\Windows\System\hofgOAJ.exe

C:\Windows\System\hofgOAJ.exe

C:\Windows\System\NnHDtEy.exe

C:\Windows\System\NnHDtEy.exe

C:\Windows\System\uTFdFRy.exe

C:\Windows\System\uTFdFRy.exe

C:\Windows\System\stPurpt.exe

C:\Windows\System\stPurpt.exe

C:\Windows\System\fwldIzX.exe

C:\Windows\System\fwldIzX.exe

C:\Windows\System\uhNrIaS.exe

C:\Windows\System\uhNrIaS.exe

C:\Windows\System\PtlHJZx.exe

C:\Windows\System\PtlHJZx.exe

C:\Windows\System\FAphwYh.exe

C:\Windows\System\FAphwYh.exe

C:\Windows\System\PMoiAQU.exe

C:\Windows\System\PMoiAQU.exe

C:\Windows\System\fUjgJmC.exe

C:\Windows\System\fUjgJmC.exe

C:\Windows\System\fryyIpm.exe

C:\Windows\System\fryyIpm.exe

C:\Windows\System\DbstnKZ.exe

C:\Windows\System\DbstnKZ.exe

C:\Windows\System\TBmTPDl.exe

C:\Windows\System\TBmTPDl.exe

C:\Windows\System\PMenKHC.exe

C:\Windows\System\PMenKHC.exe

C:\Windows\System\sCypvjB.exe

C:\Windows\System\sCypvjB.exe

C:\Windows\System\YAzwKXw.exe

C:\Windows\System\YAzwKXw.exe

C:\Windows\System\ANaiRdG.exe

C:\Windows\System\ANaiRdG.exe

C:\Windows\System\EebZJKi.exe

C:\Windows\System\EebZJKi.exe

C:\Windows\System\DqCIIvZ.exe

C:\Windows\System\DqCIIvZ.exe

C:\Windows\System\UmeBLmX.exe

C:\Windows\System\UmeBLmX.exe

C:\Windows\System\CZasJJO.exe

C:\Windows\System\CZasJJO.exe

C:\Windows\System\hmgcMKY.exe

C:\Windows\System\hmgcMKY.exe

C:\Windows\System\IEvPsBS.exe

C:\Windows\System\IEvPsBS.exe

C:\Windows\System\nVhUZAa.exe

C:\Windows\System\nVhUZAa.exe

C:\Windows\System\fMXkiSr.exe

C:\Windows\System\fMXkiSr.exe

C:\Windows\System\eNSHCFW.exe

C:\Windows\System\eNSHCFW.exe

C:\Windows\System\qOmVGxl.exe

C:\Windows\System\qOmVGxl.exe

C:\Windows\System\JmLBoKi.exe

C:\Windows\System\JmLBoKi.exe

C:\Windows\System\tltvfgs.exe

C:\Windows\System\tltvfgs.exe

C:\Windows\System\aYNNmXN.exe

C:\Windows\System\aYNNmXN.exe

C:\Windows\System\KVrxozw.exe

C:\Windows\System\KVrxozw.exe

C:\Windows\System\VAMNHcB.exe

C:\Windows\System\VAMNHcB.exe

C:\Windows\System\jYyiMOV.exe

C:\Windows\System\jYyiMOV.exe

C:\Windows\System\PVmBxaH.exe

C:\Windows\System\PVmBxaH.exe

C:\Windows\System\dzQrvVn.exe

C:\Windows\System\dzQrvVn.exe

C:\Windows\System\CwbuWer.exe

C:\Windows\System\CwbuWer.exe

C:\Windows\System\ldgPFPk.exe

C:\Windows\System\ldgPFPk.exe

C:\Windows\System\YKTXakA.exe

C:\Windows\System\YKTXakA.exe

C:\Windows\System\vLjclCz.exe

C:\Windows\System\vLjclCz.exe

C:\Windows\System\lzTyOHi.exe

C:\Windows\System\lzTyOHi.exe

C:\Windows\System\tGVNLFX.exe

C:\Windows\System\tGVNLFX.exe

C:\Windows\System\keKvmDb.exe

C:\Windows\System\keKvmDb.exe

C:\Windows\System\HVkTshf.exe

C:\Windows\System\HVkTshf.exe

C:\Windows\System\IGGqsZh.exe

C:\Windows\System\IGGqsZh.exe

C:\Windows\System\OAcPLIX.exe

C:\Windows\System\OAcPLIX.exe

C:\Windows\System\WSNsQPI.exe

C:\Windows\System\WSNsQPI.exe

C:\Windows\System\MGUOkAF.exe

C:\Windows\System\MGUOkAF.exe

C:\Windows\System\JBgCgrm.exe

C:\Windows\System\JBgCgrm.exe

C:\Windows\System\awaEGst.exe

C:\Windows\System\awaEGst.exe

C:\Windows\System\uPJwwZA.exe

C:\Windows\System\uPJwwZA.exe

C:\Windows\System\aPxUFGI.exe

C:\Windows\System\aPxUFGI.exe

C:\Windows\System\yHrUFvo.exe

C:\Windows\System\yHrUFvo.exe

C:\Windows\System\uNVtnbx.exe

C:\Windows\System\uNVtnbx.exe

C:\Windows\System\mKOyUgf.exe

C:\Windows\System\mKOyUgf.exe

C:\Windows\System\ApkBLHR.exe

C:\Windows\System\ApkBLHR.exe

C:\Windows\System\fyHpsuA.exe

C:\Windows\System\fyHpsuA.exe

C:\Windows\System\xfldEzk.exe

C:\Windows\System\xfldEzk.exe

C:\Windows\System\yDfQJzF.exe

C:\Windows\System\yDfQJzF.exe

C:\Windows\System\IqncXFK.exe

C:\Windows\System\IqncXFK.exe

C:\Windows\System\zjYZiFL.exe

C:\Windows\System\zjYZiFL.exe

C:\Windows\System\IzCZZem.exe

C:\Windows\System\IzCZZem.exe

C:\Windows\System\FMsdrSe.exe

C:\Windows\System\FMsdrSe.exe

C:\Windows\System\vFYdVgy.exe

C:\Windows\System\vFYdVgy.exe

C:\Windows\System\jYccZEY.exe

C:\Windows\System\jYccZEY.exe

C:\Windows\System\IGLjYjN.exe

C:\Windows\System\IGLjYjN.exe

C:\Windows\System\aPwSwrn.exe

C:\Windows\System\aPwSwrn.exe

C:\Windows\System\XZYycEQ.exe

C:\Windows\System\XZYycEQ.exe

C:\Windows\System\oOlWYLh.exe

C:\Windows\System\oOlWYLh.exe

C:\Windows\System\qYDtLSH.exe

C:\Windows\System\qYDtLSH.exe

C:\Windows\System\pSGCVsh.exe

C:\Windows\System\pSGCVsh.exe

C:\Windows\System\xkEUIqL.exe

C:\Windows\System\xkEUIqL.exe

C:\Windows\System\NgUXfPM.exe

C:\Windows\System\NgUXfPM.exe

C:\Windows\System\iYnGSrx.exe

C:\Windows\System\iYnGSrx.exe

C:\Windows\System\BomEYoz.exe

C:\Windows\System\BomEYoz.exe

C:\Windows\System\ljZNfxV.exe

C:\Windows\System\ljZNfxV.exe

C:\Windows\System\zACoTmK.exe

C:\Windows\System\zACoTmK.exe

C:\Windows\System\WEJpbrM.exe

C:\Windows\System\WEJpbrM.exe

C:\Windows\System\BAeXxfU.exe

C:\Windows\System\BAeXxfU.exe

C:\Windows\System\mZqbJdN.exe

C:\Windows\System\mZqbJdN.exe

C:\Windows\System\ObqhwPQ.exe

C:\Windows\System\ObqhwPQ.exe

C:\Windows\System\hwWcgxN.exe

C:\Windows\System\hwWcgxN.exe

C:\Windows\System\MeFNBVn.exe

C:\Windows\System\MeFNBVn.exe

C:\Windows\System\mwRnzHt.exe

C:\Windows\System\mwRnzHt.exe

C:\Windows\System\bFpgZuj.exe

C:\Windows\System\bFpgZuj.exe

C:\Windows\System\WDSfMLM.exe

C:\Windows\System\WDSfMLM.exe

C:\Windows\System\oeAiwrc.exe

C:\Windows\System\oeAiwrc.exe

C:\Windows\System\lvSSoCw.exe

C:\Windows\System\lvSSoCw.exe

C:\Windows\System\GySzrxy.exe

C:\Windows\System\GySzrxy.exe

C:\Windows\System\cNSGEjq.exe

C:\Windows\System\cNSGEjq.exe

C:\Windows\System\MLXxQzb.exe

C:\Windows\System\MLXxQzb.exe

C:\Windows\System\uAVOSHz.exe

C:\Windows\System\uAVOSHz.exe

C:\Windows\System\btFHgsO.exe

C:\Windows\System\btFHgsO.exe

C:\Windows\System\RwTgcVo.exe

C:\Windows\System\RwTgcVo.exe

C:\Windows\System\RwobFLN.exe

C:\Windows\System\RwobFLN.exe

C:\Windows\System\sgRAJDJ.exe

C:\Windows\System\sgRAJDJ.exe

C:\Windows\System\KTUfvUV.exe

C:\Windows\System\KTUfvUV.exe

C:\Windows\System\kFNwSit.exe

C:\Windows\System\kFNwSit.exe

C:\Windows\System\rjXgwnZ.exe

C:\Windows\System\rjXgwnZ.exe

C:\Windows\System\KirBozD.exe

C:\Windows\System\KirBozD.exe

C:\Windows\System\nzWrIzB.exe

C:\Windows\System\nzWrIzB.exe

C:\Windows\System\sLGfhRJ.exe

C:\Windows\System\sLGfhRJ.exe

C:\Windows\System\SIPQXLf.exe

C:\Windows\System\SIPQXLf.exe

C:\Windows\System\tDBlwdC.exe

C:\Windows\System\tDBlwdC.exe

C:\Windows\System\RPMyMiY.exe

C:\Windows\System\RPMyMiY.exe

C:\Windows\System\ZYFyTAK.exe

C:\Windows\System\ZYFyTAK.exe

C:\Windows\System\ounewAS.exe

C:\Windows\System\ounewAS.exe

C:\Windows\System\LqVxfOm.exe

C:\Windows\System\LqVxfOm.exe

C:\Windows\System\rQGMDSe.exe

C:\Windows\System\rQGMDSe.exe

C:\Windows\System\LSCTpph.exe

C:\Windows\System\LSCTpph.exe

C:\Windows\System\UZpehOF.exe

C:\Windows\System\UZpehOF.exe

C:\Windows\System\szWdBuI.exe

C:\Windows\System\szWdBuI.exe

C:\Windows\System\fSbWeNj.exe

C:\Windows\System\fSbWeNj.exe

C:\Windows\System\mzVcxeQ.exe

C:\Windows\System\mzVcxeQ.exe

C:\Windows\System\hcfklOO.exe

C:\Windows\System\hcfklOO.exe

C:\Windows\System\Rftsqdi.exe

C:\Windows\System\Rftsqdi.exe

C:\Windows\System\nMYAVjC.exe

C:\Windows\System\nMYAVjC.exe

C:\Windows\System\WRmviDH.exe

C:\Windows\System\WRmviDH.exe

C:\Windows\System\ILdwUPL.exe

C:\Windows\System\ILdwUPL.exe

C:\Windows\System\FpTIUmv.exe

C:\Windows\System\FpTIUmv.exe

C:\Windows\System\IymWsHD.exe

C:\Windows\System\IymWsHD.exe

C:\Windows\System\uyBXTOt.exe

C:\Windows\System\uyBXTOt.exe

C:\Windows\System\moSZdOd.exe

C:\Windows\System\moSZdOd.exe

C:\Windows\System\HYJQPYw.exe

C:\Windows\System\HYJQPYw.exe

C:\Windows\System\NmpCujv.exe

C:\Windows\System\NmpCujv.exe

C:\Windows\System\hxxwBwl.exe

C:\Windows\System\hxxwBwl.exe

C:\Windows\System\ECAfwNg.exe

C:\Windows\System\ECAfwNg.exe

C:\Windows\System\XcQiwYu.exe

C:\Windows\System\XcQiwYu.exe

C:\Windows\System\AYoCZqV.exe

C:\Windows\System\AYoCZqV.exe

C:\Windows\System\AIFcCwV.exe

C:\Windows\System\AIFcCwV.exe

C:\Windows\System\CltlMqi.exe

C:\Windows\System\CltlMqi.exe

C:\Windows\System\KnBNfmP.exe

C:\Windows\System\KnBNfmP.exe

C:\Windows\System\eTekrnC.exe

C:\Windows\System\eTekrnC.exe

C:\Windows\System\cEhtLHq.exe

C:\Windows\System\cEhtLHq.exe

C:\Windows\System\dgOKukQ.exe

C:\Windows\System\dgOKukQ.exe

C:\Windows\System\zpnWEjf.exe

C:\Windows\System\zpnWEjf.exe

C:\Windows\System\rbvYQTZ.exe

C:\Windows\System\rbvYQTZ.exe

C:\Windows\System\SFYNAKW.exe

C:\Windows\System\SFYNAKW.exe

C:\Windows\System\iTJABKZ.exe

C:\Windows\System\iTJABKZ.exe

C:\Windows\System\cUtlSkl.exe

C:\Windows\System\cUtlSkl.exe

C:\Windows\System\VaFYJxD.exe

C:\Windows\System\VaFYJxD.exe

C:\Windows\System\dNJYXMh.exe

C:\Windows\System\dNJYXMh.exe

C:\Windows\System\MxzNAdu.exe

C:\Windows\System\MxzNAdu.exe

C:\Windows\System\EuKktwA.exe

C:\Windows\System\EuKktwA.exe

C:\Windows\System\cNyJbYT.exe

C:\Windows\System\cNyJbYT.exe

C:\Windows\System\DjwTGfV.exe

C:\Windows\System\DjwTGfV.exe

C:\Windows\System\fwrJaMp.exe

C:\Windows\System\fwrJaMp.exe

C:\Windows\System\iehfZli.exe

C:\Windows\System\iehfZli.exe

C:\Windows\System\UZzGGpA.exe

C:\Windows\System\UZzGGpA.exe

C:\Windows\System\JsXaflf.exe

C:\Windows\System\JsXaflf.exe

C:\Windows\System\RLqjPrg.exe

C:\Windows\System\RLqjPrg.exe

C:\Windows\System\JoywlXL.exe

C:\Windows\System\JoywlXL.exe

C:\Windows\System\cGjmmOw.exe

C:\Windows\System\cGjmmOw.exe

C:\Windows\System\ZmbBNFV.exe

C:\Windows\System\ZmbBNFV.exe

C:\Windows\System\ZKFnWKy.exe

C:\Windows\System\ZKFnWKy.exe

C:\Windows\System\bGaBxYR.exe

C:\Windows\System\bGaBxYR.exe

C:\Windows\System\vYNKcwC.exe

C:\Windows\System\vYNKcwC.exe

C:\Windows\System\baRVzjx.exe

C:\Windows\System\baRVzjx.exe

C:\Windows\System\WeNKEpW.exe

C:\Windows\System\WeNKEpW.exe

C:\Windows\System\yWnHarQ.exe

C:\Windows\System\yWnHarQ.exe

C:\Windows\System\nEhcrUH.exe

C:\Windows\System\nEhcrUH.exe

C:\Windows\System\jsOkLkN.exe

C:\Windows\System\jsOkLkN.exe

C:\Windows\System\HmAGEkh.exe

C:\Windows\System\HmAGEkh.exe

C:\Windows\System\dfBhJos.exe

C:\Windows\System\dfBhJos.exe

C:\Windows\System\lbsaJWE.exe

C:\Windows\System\lbsaJWE.exe

C:\Windows\System\lzATKAA.exe

C:\Windows\System\lzATKAA.exe

C:\Windows\System\MGSnTle.exe

C:\Windows\System\MGSnTle.exe

C:\Windows\System\yiIexcz.exe

C:\Windows\System\yiIexcz.exe

C:\Windows\System\ViRtgiQ.exe

C:\Windows\System\ViRtgiQ.exe

C:\Windows\System\SDbVtxd.exe

C:\Windows\System\SDbVtxd.exe

C:\Windows\System\fQhILHE.exe

C:\Windows\System\fQhILHE.exe

C:\Windows\System\ZPwQRel.exe

C:\Windows\System\ZPwQRel.exe

C:\Windows\System\TONktaj.exe

C:\Windows\System\TONktaj.exe

C:\Windows\System\TGTTwOG.exe

C:\Windows\System\TGTTwOG.exe

C:\Windows\System\wkMwmTF.exe

C:\Windows\System\wkMwmTF.exe

C:\Windows\System\bQcIrWu.exe

C:\Windows\System\bQcIrWu.exe

C:\Windows\System\pJDquIb.exe

C:\Windows\System\pJDquIb.exe

C:\Windows\System\OuvenuT.exe

C:\Windows\System\OuvenuT.exe

C:\Windows\System\MMtMasF.exe

C:\Windows\System\MMtMasF.exe

C:\Windows\System\VPmBmTN.exe

C:\Windows\System\VPmBmTN.exe

C:\Windows\System\IyvmkUF.exe

C:\Windows\System\IyvmkUF.exe

C:\Windows\System\MDjuikI.exe

C:\Windows\System\MDjuikI.exe

C:\Windows\System\bYXXPRD.exe

C:\Windows\System\bYXXPRD.exe

C:\Windows\System\hQPxBWY.exe

C:\Windows\System\hQPxBWY.exe

C:\Windows\System\oFVfKUk.exe

C:\Windows\System\oFVfKUk.exe

C:\Windows\System\MRbImIK.exe

C:\Windows\System\MRbImIK.exe

C:\Windows\System\EPKMaRo.exe

C:\Windows\System\EPKMaRo.exe

C:\Windows\System\eGRZBia.exe

C:\Windows\System\eGRZBia.exe

C:\Windows\System\nVQPVpX.exe

C:\Windows\System\nVQPVpX.exe

C:\Windows\System\FHNOWaV.exe

C:\Windows\System\FHNOWaV.exe

C:\Windows\System\yaijIHe.exe

C:\Windows\System\yaijIHe.exe

C:\Windows\System\JhMbkkk.exe

C:\Windows\System\JhMbkkk.exe

C:\Windows\System\rPRbOGU.exe

C:\Windows\System\rPRbOGU.exe

C:\Windows\System\lKACect.exe

C:\Windows\System\lKACect.exe

C:\Windows\System\JmXYdCr.exe

C:\Windows\System\JmXYdCr.exe

C:\Windows\System\RyoyxaC.exe

C:\Windows\System\RyoyxaC.exe

C:\Windows\System\RhEPCVz.exe

C:\Windows\System\RhEPCVz.exe

C:\Windows\System\hNrUpky.exe

C:\Windows\System\hNrUpky.exe

C:\Windows\System\rWrjywL.exe

C:\Windows\System\rWrjywL.exe

C:\Windows\System\nCaGudR.exe

C:\Windows\System\nCaGudR.exe

C:\Windows\System\xRityYM.exe

C:\Windows\System\xRityYM.exe

C:\Windows\System\PiDwcCT.exe

C:\Windows\System\PiDwcCT.exe

C:\Windows\System\KphsOIa.exe

C:\Windows\System\KphsOIa.exe

C:\Windows\System\vWbjDNA.exe

C:\Windows\System\vWbjDNA.exe

C:\Windows\System\wkGfTKk.exe

C:\Windows\System\wkGfTKk.exe

C:\Windows\System\LBJaAWw.exe

C:\Windows\System\LBJaAWw.exe

C:\Windows\System\QbPgyeR.exe

C:\Windows\System\QbPgyeR.exe

C:\Windows\System\UmPlaYk.exe

C:\Windows\System\UmPlaYk.exe

C:\Windows\System\RFNtExQ.exe

C:\Windows\System\RFNtExQ.exe

C:\Windows\System\XyofHtE.exe

C:\Windows\System\XyofHtE.exe

C:\Windows\System\kUFlsAW.exe

C:\Windows\System\kUFlsAW.exe

C:\Windows\System\TpkhbaD.exe

C:\Windows\System\TpkhbaD.exe

C:\Windows\System\CpzEXGh.exe

C:\Windows\System\CpzEXGh.exe

C:\Windows\System\fjAIAEJ.exe

C:\Windows\System\fjAIAEJ.exe

C:\Windows\System\ecmZOuI.exe

C:\Windows\System\ecmZOuI.exe

C:\Windows\System\wMqJghR.exe

C:\Windows\System\wMqJghR.exe

C:\Windows\System\CQYpPXz.exe

C:\Windows\System\CQYpPXz.exe

C:\Windows\System\wbBmBLo.exe

C:\Windows\System\wbBmBLo.exe

C:\Windows\System\RZCdKKD.exe

C:\Windows\System\RZCdKKD.exe

C:\Windows\System\FhFBjrr.exe

C:\Windows\System\FhFBjrr.exe

C:\Windows\System\ADvaWbG.exe

C:\Windows\System\ADvaWbG.exe

C:\Windows\System\dbSwGeZ.exe

C:\Windows\System\dbSwGeZ.exe

C:\Windows\System\vHUrtvO.exe

C:\Windows\System\vHUrtvO.exe

C:\Windows\System\GexuBsl.exe

C:\Windows\System\GexuBsl.exe

C:\Windows\System\GYVpViQ.exe

C:\Windows\System\GYVpViQ.exe

C:\Windows\System\ODQFztl.exe

C:\Windows\System\ODQFztl.exe

C:\Windows\System\mtJhuaP.exe

C:\Windows\System\mtJhuaP.exe

C:\Windows\System\RwRPYEY.exe

C:\Windows\System\RwRPYEY.exe

C:\Windows\System\prHeFMz.exe

C:\Windows\System\prHeFMz.exe

C:\Windows\System\WaqKgjW.exe

C:\Windows\System\WaqKgjW.exe

C:\Windows\System\ccyXSVt.exe

C:\Windows\System\ccyXSVt.exe

C:\Windows\System\yIjvPkO.exe

C:\Windows\System\yIjvPkO.exe

C:\Windows\System\JTqDcLa.exe

C:\Windows\System\JTqDcLa.exe

C:\Windows\System\DznCzNw.exe

C:\Windows\System\DznCzNw.exe

C:\Windows\System\sRqpGGL.exe

C:\Windows\System\sRqpGGL.exe

C:\Windows\System\XVuhpNx.exe

C:\Windows\System\XVuhpNx.exe

C:\Windows\System\MYxFvhI.exe

C:\Windows\System\MYxFvhI.exe

C:\Windows\System\bxlPgIA.exe

C:\Windows\System\bxlPgIA.exe

C:\Windows\System\RANJFvp.exe

C:\Windows\System\RANJFvp.exe

C:\Windows\System\VvmrWCa.exe

C:\Windows\System\VvmrWCa.exe

C:\Windows\System\tWiqXfd.exe

C:\Windows\System\tWiqXfd.exe

C:\Windows\System\QCmGkpv.exe

C:\Windows\System\QCmGkpv.exe

C:\Windows\System\FaUXtqD.exe

C:\Windows\System\FaUXtqD.exe

C:\Windows\System\adeUlvj.exe

C:\Windows\System\adeUlvj.exe

C:\Windows\System\DxItGdc.exe

C:\Windows\System\DxItGdc.exe

C:\Windows\System\WcoIYqf.exe

C:\Windows\System\WcoIYqf.exe

C:\Windows\System\nBmExFT.exe

C:\Windows\System\nBmExFT.exe

C:\Windows\System\vZHnNWn.exe

C:\Windows\System\vZHnNWn.exe

C:\Windows\System\HTBUJeO.exe

C:\Windows\System\HTBUJeO.exe

C:\Windows\System\cpSCHpj.exe

C:\Windows\System\cpSCHpj.exe

C:\Windows\System\KUOAMlE.exe

C:\Windows\System\KUOAMlE.exe

C:\Windows\System\PSrUrOd.exe

C:\Windows\System\PSrUrOd.exe

C:\Windows\System\jBRvDZz.exe

C:\Windows\System\jBRvDZz.exe

C:\Windows\System\IuFwslk.exe

C:\Windows\System\IuFwslk.exe

C:\Windows\System\kCXNbQt.exe

C:\Windows\System\kCXNbQt.exe

C:\Windows\System\fdJQSZc.exe

C:\Windows\System\fdJQSZc.exe

C:\Windows\System\TkNAYxK.exe

C:\Windows\System\TkNAYxK.exe

C:\Windows\System\HNWKKym.exe

C:\Windows\System\HNWKKym.exe

C:\Windows\System\AaAOLiS.exe

C:\Windows\System\AaAOLiS.exe

C:\Windows\System\SdRUiZQ.exe

C:\Windows\System\SdRUiZQ.exe

C:\Windows\System\pExYwWs.exe

C:\Windows\System\pExYwWs.exe

C:\Windows\System\VKxjvuM.exe

C:\Windows\System\VKxjvuM.exe

C:\Windows\System\NRjLFxm.exe

C:\Windows\System\NRjLFxm.exe

C:\Windows\System\rQtPcTe.exe

C:\Windows\System\rQtPcTe.exe

C:\Windows\System\FOxpWxW.exe

C:\Windows\System\FOxpWxW.exe

C:\Windows\System\SgsmrSA.exe

C:\Windows\System\SgsmrSA.exe

C:\Windows\System\ixhncnB.exe

C:\Windows\System\ixhncnB.exe

C:\Windows\System\xgIfgZr.exe

C:\Windows\System\xgIfgZr.exe

C:\Windows\System\sPiiQaB.exe

C:\Windows\System\sPiiQaB.exe

C:\Windows\System\APlofAN.exe

C:\Windows\System\APlofAN.exe

C:\Windows\System\GlpJTtX.exe

C:\Windows\System\GlpJTtX.exe

C:\Windows\System\AcfOnwb.exe

C:\Windows\System\AcfOnwb.exe

C:\Windows\System\JQxJRTr.exe

C:\Windows\System\JQxJRTr.exe

C:\Windows\System\LLLKUVv.exe

C:\Windows\System\LLLKUVv.exe

C:\Windows\System\GMwcIhl.exe

C:\Windows\System\GMwcIhl.exe

C:\Windows\System\dNwFnqD.exe

C:\Windows\System\dNwFnqD.exe

C:\Windows\System\GixxyeG.exe

C:\Windows\System\GixxyeG.exe

C:\Windows\System\cNmmqcp.exe

C:\Windows\System\cNmmqcp.exe

C:\Windows\System\pXBgUME.exe

C:\Windows\System\pXBgUME.exe

C:\Windows\System\ynimcEJ.exe

C:\Windows\System\ynimcEJ.exe

C:\Windows\System\WeOXAlB.exe

C:\Windows\System\WeOXAlB.exe

C:\Windows\System\YNOVcff.exe

C:\Windows\System\YNOVcff.exe

C:\Windows\System\EVkWmvi.exe

C:\Windows\System\EVkWmvi.exe

C:\Windows\System\MkSDQQm.exe

C:\Windows\System\MkSDQQm.exe

C:\Windows\System\iDnZgsG.exe

C:\Windows\System\iDnZgsG.exe

C:\Windows\System\KKIIDBr.exe

C:\Windows\System\KKIIDBr.exe

C:\Windows\System\SqeWGPv.exe

C:\Windows\System\SqeWGPv.exe

C:\Windows\System\xxjhtdJ.exe

C:\Windows\System\xxjhtdJ.exe

C:\Windows\System\tnuaUsS.exe

C:\Windows\System\tnuaUsS.exe

C:\Windows\System\HuRfrJO.exe

C:\Windows\System\HuRfrJO.exe

C:\Windows\System\XOHvwZE.exe

C:\Windows\System\XOHvwZE.exe

C:\Windows\System\veLyOuF.exe

C:\Windows\System\veLyOuF.exe

C:\Windows\System\JoJzpBa.exe

C:\Windows\System\JoJzpBa.exe

C:\Windows\System\usgxvjF.exe

C:\Windows\System\usgxvjF.exe

C:\Windows\System\yfBVNgo.exe

C:\Windows\System\yfBVNgo.exe

C:\Windows\System\ZwKnihM.exe

C:\Windows\System\ZwKnihM.exe

C:\Windows\System\XmTaagn.exe

C:\Windows\System\XmTaagn.exe

C:\Windows\System\mLCIIQr.exe

C:\Windows\System\mLCIIQr.exe

C:\Windows\System\FAMuDhx.exe

C:\Windows\System\FAMuDhx.exe

C:\Windows\System\LEuXSaM.exe

C:\Windows\System\LEuXSaM.exe

C:\Windows\System\OUcnfmG.exe

C:\Windows\System\OUcnfmG.exe

C:\Windows\System\hfjTJyE.exe

C:\Windows\System\hfjTJyE.exe

C:\Windows\System\HFofguG.exe

C:\Windows\System\HFofguG.exe

C:\Windows\System\itFlCaY.exe

C:\Windows\System\itFlCaY.exe

C:\Windows\System\gfaOZEp.exe

C:\Windows\System\gfaOZEp.exe

C:\Windows\System\DXHvkaC.exe

C:\Windows\System\DXHvkaC.exe

C:\Windows\System\mquqdND.exe

C:\Windows\System\mquqdND.exe

C:\Windows\System\hLbkbGC.exe

C:\Windows\System\hLbkbGC.exe

C:\Windows\System\bYjKfoj.exe

C:\Windows\System\bYjKfoj.exe

C:\Windows\System\urhSWwU.exe

C:\Windows\System\urhSWwU.exe

C:\Windows\System\VsrambA.exe

C:\Windows\System\VsrambA.exe

C:\Windows\System\RVHkNXU.exe

C:\Windows\System\RVHkNXU.exe

C:\Windows\System\tkQAVVX.exe

C:\Windows\System\tkQAVVX.exe

C:\Windows\System\MFchcdt.exe

C:\Windows\System\MFchcdt.exe

C:\Windows\System\TMRrYeK.exe

C:\Windows\System\TMRrYeK.exe

C:\Windows\System\dlXpQdv.exe

C:\Windows\System\dlXpQdv.exe

C:\Windows\System\vJgchsX.exe

C:\Windows\System\vJgchsX.exe

C:\Windows\System\uplRPdB.exe

C:\Windows\System\uplRPdB.exe

C:\Windows\System\vbZViHT.exe

C:\Windows\System\vbZViHT.exe

C:\Windows\System\EbBgEPr.exe

C:\Windows\System\EbBgEPr.exe

C:\Windows\System\ZcSsIup.exe

C:\Windows\System\ZcSsIup.exe

C:\Windows\System\SNqwJnW.exe

C:\Windows\System\SNqwJnW.exe

C:\Windows\System\hoCcyfU.exe

C:\Windows\System\hoCcyfU.exe

C:\Windows\System\Eugomnb.exe

C:\Windows\System\Eugomnb.exe

C:\Windows\System\ijrLJKR.exe

C:\Windows\System\ijrLJKR.exe

C:\Windows\System\VtwaPst.exe

C:\Windows\System\VtwaPst.exe

C:\Windows\System\JoxLbGe.exe

C:\Windows\System\JoxLbGe.exe

C:\Windows\System\RKwbgeI.exe

C:\Windows\System\RKwbgeI.exe

C:\Windows\System\RZtVKeh.exe

C:\Windows\System\RZtVKeh.exe

C:\Windows\System\FzAZSMd.exe

C:\Windows\System\FzAZSMd.exe

C:\Windows\System\UwRiQni.exe

C:\Windows\System\UwRiQni.exe

C:\Windows\System\jznYnYb.exe

C:\Windows\System\jznYnYb.exe

C:\Windows\System\lScIoUe.exe

C:\Windows\System\lScIoUe.exe

C:\Windows\System\wBxBOuR.exe

C:\Windows\System\wBxBOuR.exe

C:\Windows\System\koxIrvm.exe

C:\Windows\System\koxIrvm.exe

C:\Windows\System\bxDWitU.exe

C:\Windows\System\bxDWitU.exe

C:\Windows\System\wipMANg.exe

C:\Windows\System\wipMANg.exe

C:\Windows\System\NYzaHIz.exe

C:\Windows\System\NYzaHIz.exe

C:\Windows\System\aWKWIaG.exe

C:\Windows\System\aWKWIaG.exe

C:\Windows\System\sNjubQs.exe

C:\Windows\System\sNjubQs.exe

C:\Windows\System\WbJzRUH.exe

C:\Windows\System\WbJzRUH.exe

C:\Windows\System\sSbvVxL.exe

C:\Windows\System\sSbvVxL.exe

C:\Windows\System\NdRxEYd.exe

C:\Windows\System\NdRxEYd.exe

C:\Windows\System\YkLfIzn.exe

C:\Windows\System\YkLfIzn.exe

C:\Windows\System\StbdvcV.exe

C:\Windows\System\StbdvcV.exe

C:\Windows\System\UUROSOX.exe

C:\Windows\System\UUROSOX.exe

C:\Windows\System\mtizcME.exe

C:\Windows\System\mtizcME.exe

C:\Windows\System\xQNbNlk.exe

C:\Windows\System\xQNbNlk.exe

C:\Windows\System\aAhFxsy.exe

C:\Windows\System\aAhFxsy.exe

C:\Windows\System\acTLlhv.exe

C:\Windows\System\acTLlhv.exe

C:\Windows\System\eNtyCNb.exe

C:\Windows\System\eNtyCNb.exe

C:\Windows\System\srGnKTi.exe

C:\Windows\System\srGnKTi.exe

C:\Windows\System\yMfuknP.exe

C:\Windows\System\yMfuknP.exe

C:\Windows\System\ZaYAlHW.exe

C:\Windows\System\ZaYAlHW.exe

C:\Windows\System\UpJYckS.exe

C:\Windows\System\UpJYckS.exe

C:\Windows\System\dUEOYDC.exe

C:\Windows\System\dUEOYDC.exe

C:\Windows\System\jaoHHEN.exe

C:\Windows\System\jaoHHEN.exe

C:\Windows\System\tkbHDIH.exe

C:\Windows\System\tkbHDIH.exe

C:\Windows\System\cjKxiSD.exe

C:\Windows\System\cjKxiSD.exe

C:\Windows\System\DrmPSuv.exe

C:\Windows\System\DrmPSuv.exe

C:\Windows\System\UxxUtaN.exe

C:\Windows\System\UxxUtaN.exe

C:\Windows\System\jgOIIBK.exe

C:\Windows\System\jgOIIBK.exe

C:\Windows\System\tvebWRh.exe

C:\Windows\System\tvebWRh.exe

C:\Windows\System\EvXnZmE.exe

C:\Windows\System\EvXnZmE.exe

C:\Windows\System\mPdILtv.exe

C:\Windows\System\mPdILtv.exe

C:\Windows\System\LoVKXlL.exe

C:\Windows\System\LoVKXlL.exe

C:\Windows\System\quRSJDT.exe

C:\Windows\System\quRSJDT.exe

C:\Windows\System\SBbHoHo.exe

C:\Windows\System\SBbHoHo.exe

C:\Windows\System\HFahBIP.exe

C:\Windows\System\HFahBIP.exe

C:\Windows\System\rEviHqS.exe

C:\Windows\System\rEviHqS.exe

C:\Windows\System\lGpsSkh.exe

C:\Windows\System\lGpsSkh.exe

C:\Windows\System\RFbrgnl.exe

C:\Windows\System\RFbrgnl.exe

C:\Windows\System\IQwlvSu.exe

C:\Windows\System\IQwlvSu.exe

C:\Windows\System\WRLvqvr.exe

C:\Windows\System\WRLvqvr.exe

C:\Windows\System\LTzebhQ.exe

C:\Windows\System\LTzebhQ.exe

C:\Windows\System\OfwFmMD.exe

C:\Windows\System\OfwFmMD.exe

C:\Windows\System\eKocGgC.exe

C:\Windows\System\eKocGgC.exe

C:\Windows\System\dONOYTe.exe

C:\Windows\System\dONOYTe.exe

C:\Windows\System\XjluELT.exe

C:\Windows\System\XjluELT.exe

C:\Windows\System\UKtkMzG.exe

C:\Windows\System\UKtkMzG.exe

C:\Windows\System\NDWrdxw.exe

C:\Windows\System\NDWrdxw.exe

C:\Windows\System\wyFqoJE.exe

C:\Windows\System\wyFqoJE.exe

C:\Windows\System\PYyqbtS.exe

C:\Windows\System\PYyqbtS.exe

C:\Windows\System\dkSgINP.exe

C:\Windows\System\dkSgINP.exe

C:\Windows\System\WeDwUvD.exe

C:\Windows\System\WeDwUvD.exe

C:\Windows\System\KyYHHOL.exe

C:\Windows\System\KyYHHOL.exe

C:\Windows\System\VRXdyhj.exe

C:\Windows\System\VRXdyhj.exe

C:\Windows\System\vKKNJvC.exe

C:\Windows\System\vKKNJvC.exe

C:\Windows\System\gfMnlNW.exe

C:\Windows\System\gfMnlNW.exe

C:\Windows\System\nDmAwLP.exe

C:\Windows\System\nDmAwLP.exe

C:\Windows\System\yoZScpx.exe

C:\Windows\System\yoZScpx.exe

C:\Windows\System\DOHWkqB.exe

C:\Windows\System\DOHWkqB.exe

C:\Windows\System\oKAVfZn.exe

C:\Windows\System\oKAVfZn.exe

C:\Windows\System\GyZJXNP.exe

C:\Windows\System\GyZJXNP.exe

C:\Windows\System\yNhRcsx.exe

C:\Windows\System\yNhRcsx.exe

C:\Windows\System\ybonqVL.exe

C:\Windows\System\ybonqVL.exe

C:\Windows\System\PPDHvxE.exe

C:\Windows\System\PPDHvxE.exe

C:\Windows\System\PIVmrCH.exe

C:\Windows\System\PIVmrCH.exe

C:\Windows\System\wzvNuTo.exe

C:\Windows\System\wzvNuTo.exe

C:\Windows\System\ttAOyuL.exe

C:\Windows\System\ttAOyuL.exe

C:\Windows\System\mKgDwpf.exe

C:\Windows\System\mKgDwpf.exe

C:\Windows\System\HRKnSln.exe

C:\Windows\System\HRKnSln.exe

C:\Windows\System\xqxJiIV.exe

C:\Windows\System\xqxJiIV.exe

C:\Windows\System\MCspGBJ.exe

C:\Windows\System\MCspGBJ.exe

C:\Windows\System\ElEeHxA.exe

C:\Windows\System\ElEeHxA.exe

C:\Windows\System\UVEgJWb.exe

C:\Windows\System\UVEgJWb.exe

C:\Windows\System\CtogoOB.exe

C:\Windows\System\CtogoOB.exe

C:\Windows\System\sLzgarX.exe

C:\Windows\System\sLzgarX.exe

C:\Windows\System\lvNHGAv.exe

C:\Windows\System\lvNHGAv.exe

C:\Windows\System\LoyUYvG.exe

C:\Windows\System\LoyUYvG.exe

C:\Windows\System\QzIDfBb.exe

C:\Windows\System\QzIDfBb.exe

C:\Windows\System\mRPksYf.exe

C:\Windows\System\mRPksYf.exe

C:\Windows\System\yFBeJXT.exe

C:\Windows\System\yFBeJXT.exe

C:\Windows\System\hsRyQpl.exe

C:\Windows\System\hsRyQpl.exe

C:\Windows\System\rUbUZbw.exe

C:\Windows\System\rUbUZbw.exe

C:\Windows\System\CvERRWu.exe

C:\Windows\System\CvERRWu.exe

C:\Windows\System\nsPiBuR.exe

C:\Windows\System\nsPiBuR.exe

C:\Windows\System\frKaiUv.exe

C:\Windows\System\frKaiUv.exe

C:\Windows\System\wgOuJMP.exe

C:\Windows\System\wgOuJMP.exe

C:\Windows\System\ZrOplPn.exe

C:\Windows\System\ZrOplPn.exe

C:\Windows\System\WkugFlo.exe

C:\Windows\System\WkugFlo.exe

C:\Windows\System\HvNVxtC.exe

C:\Windows\System\HvNVxtC.exe

C:\Windows\System\rUZyPin.exe

C:\Windows\System\rUZyPin.exe

C:\Windows\System\FEBWrEF.exe

C:\Windows\System\FEBWrEF.exe

C:\Windows\System\RGzRlBa.exe

C:\Windows\System\RGzRlBa.exe

C:\Windows\System\gOVxztO.exe

C:\Windows\System\gOVxztO.exe

C:\Windows\System\ljQsFaz.exe

C:\Windows\System\ljQsFaz.exe

C:\Windows\System\uHHZHto.exe

C:\Windows\System\uHHZHto.exe

C:\Windows\System\TMEGhgl.exe

C:\Windows\System\TMEGhgl.exe

C:\Windows\System\EzMxOBI.exe

C:\Windows\System\EzMxOBI.exe

C:\Windows\System\WcsLqTz.exe

C:\Windows\System\WcsLqTz.exe

C:\Windows\System\OAeFWtq.exe

C:\Windows\System\OAeFWtq.exe

C:\Windows\System\oHlflmj.exe

C:\Windows\System\oHlflmj.exe

C:\Windows\System\UmxuFka.exe

C:\Windows\System\UmxuFka.exe

C:\Windows\System\MXMjIld.exe

C:\Windows\System\MXMjIld.exe

C:\Windows\System\Jghaloc.exe

C:\Windows\System\Jghaloc.exe

C:\Windows\System\ioQtnWN.exe

C:\Windows\System\ioQtnWN.exe

C:\Windows\System\hSgcySc.exe

C:\Windows\System\hSgcySc.exe

C:\Windows\System\XqMoCNV.exe

C:\Windows\System\XqMoCNV.exe

C:\Windows\System\OsghBak.exe

C:\Windows\System\OsghBak.exe

C:\Windows\System\KcDXkwg.exe

C:\Windows\System\KcDXkwg.exe

C:\Windows\System\AkPNjLL.exe

C:\Windows\System\AkPNjLL.exe

C:\Windows\System\OttsSVF.exe

C:\Windows\System\OttsSVF.exe

C:\Windows\System\cjqkPzh.exe

C:\Windows\System\cjqkPzh.exe

C:\Windows\System\coNzcdE.exe

C:\Windows\System\coNzcdE.exe

C:\Windows\System\keJXFuK.exe

C:\Windows\System\keJXFuK.exe

C:\Windows\System\BKIIQql.exe

C:\Windows\System\BKIIQql.exe

C:\Windows\System\kkiIdsG.exe

C:\Windows\System\kkiIdsG.exe

C:\Windows\System\WEYguMm.exe

C:\Windows\System\WEYguMm.exe

C:\Windows\System\IDkMMlU.exe

C:\Windows\System\IDkMMlU.exe

C:\Windows\System\pdVaUXx.exe

C:\Windows\System\pdVaUXx.exe

C:\Windows\System\XUNgDul.exe

C:\Windows\System\XUNgDul.exe

C:\Windows\System\HUvpkqv.exe

C:\Windows\System\HUvpkqv.exe

C:\Windows\System\trZWaDg.exe

C:\Windows\System\trZWaDg.exe

C:\Windows\System\wBjawKV.exe

C:\Windows\System\wBjawKV.exe

C:\Windows\System\YpbSOKX.exe

C:\Windows\System\YpbSOKX.exe

C:\Windows\System\SXkwGMy.exe

C:\Windows\System\SXkwGMy.exe

C:\Windows\System\katYogE.exe

C:\Windows\System\katYogE.exe

C:\Windows\System\eNtfeda.exe

C:\Windows\System\eNtfeda.exe

C:\Windows\System\KnPsYNz.exe

C:\Windows\System\KnPsYNz.exe

C:\Windows\System\CQtEdlZ.exe

C:\Windows\System\CQtEdlZ.exe

C:\Windows\System\xXpeJWm.exe

C:\Windows\System\xXpeJWm.exe

C:\Windows\System\NrjHdjv.exe

C:\Windows\System\NrjHdjv.exe

C:\Windows\System\GXxJPws.exe

C:\Windows\System\GXxJPws.exe

C:\Windows\System\TVsaVQE.exe

C:\Windows\System\TVsaVQE.exe

C:\Windows\System\HUPOYpy.exe

C:\Windows\System\HUPOYpy.exe

C:\Windows\System\jloHceu.exe

C:\Windows\System\jloHceu.exe

C:\Windows\System\VYrWwYq.exe

C:\Windows\System\VYrWwYq.exe

C:\Windows\System\icUvfRB.exe

C:\Windows\System\icUvfRB.exe

C:\Windows\System\qjCBKga.exe

C:\Windows\System\qjCBKga.exe

C:\Windows\System\kgcNnEy.exe

C:\Windows\System\kgcNnEy.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	74.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	83.210.23.2.in-addr.arpa	udp
BE	88.221.83.193:443	www.bing.com	tcp
US	8.8.8.8:53	193.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	145.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	23.236.111.52.in-addr.arpa	udp

Files

memory/2488-0-0x00007FF6E2110000-0x00007FF6E2464000-memory.dmp

memory/2488-1-0x00000252C3100000-0x00000252C3110000-memory.dmp

C:\Windows\System\pPdbYMo.exe

MD5	b60a4d87358b21a521b07786a3dadd24
SHA1	30c0b4f3746e9b3458f84fe6465b5813c911f219
SHA256	fd0d9e81b139976dc762e9588f3ad6def00850d7087f6c4084bffb6ef6f43786
SHA512	89015b58d68b37511c5040fe64326d3ac2ed837d6053124fd803ffb68031094893e8b3d9f7e0dc1d3822f7b00303629dbf751568adebb599faf12edcf8ae518e

C:\Windows\System\NyWDNwM.exe

MD5	0b1b77fabf3068da04aa993b8e9f7612
SHA1	2ec90d992820c5a3bc7e9671e5ec1c793fe09158
SHA256	941d63803b4ee14d0a55398488bdf70bdd6bf13da8c2208dc3b02e68c5ba69c1
SHA512	04c58e35235a822b698aabf8856e1b5263f50ebff7a10e8c692d0d8c39bf70def88d441204e81806967296040b515b761e2e0fcd967fced9d4f879a53be29272

C:\Windows\System\JSWQRZo.exe

MD5	8d92f736a0d6f0b8e45e746c7500d380
SHA1	7a76b32dcec2526acc8638f7f9189c8fe00e1944
SHA256	4e894fbc8682afff763a1b50a185ca3df802ad6e7ac2a31749c9a26e86351748
SHA512	ca7ec825f9db9b2753758c7f37b7dfc5bc863a1f2c7d918d1310be501d00440845eb3bdde6929c39e8ca4877e9acced9c82d42c0b057b747a8bce0dd27a3b7d1

C:\Windows\System\sfPeVNG.exe

MD5	23f21a7dfdf3a227310ad46b739820ff
SHA1	482b27be9a88438a0eb59d40e2d782dec534aba9
SHA256	12df29a2b0cc13eff6a7e5f3f2dbdf31a98fe0b9cb0d9d5bde714cf602751dd2
SHA512	c7de9c24c0a4f5fee6acb9a1cced294d0cb79b46952dd32dbc1453dd8d1d4e5a25a9991b9de2fcb5da6bb0ae477a3866759faead2ca41af38669dcfe284605e3

C:\Windows\System\eWsODKp.exe

MD5	827165abe28d85a0968bbeddd5cd3ead
SHA1	3a10bf5b5700267f33f715bd771bbbc3f23805a9
SHA256	cb894e767dfc15cfb78011e8d3280095132e7736425ab6f9511e0a74578e094b
SHA512	4a92fcf39a1fd2f6b4112b49a45804decb114e3d2d0185c73ebe773e0621e5ad17b8ff663f3efea7ce6a3d7ba539003c3fc43d85e7374deecb977ba13ceebe44

C:\Windows\System\YmpTFpw.exe

MD5	785ec4e8d1313ddadcdbeb6855e5d1bd
SHA1	2f97ed64fe9bc3b1983718817d66bf704ebaa4fc
SHA256	b8f5475a7c74525d9fa6c05cf3971fa8365826c4ff4a3441f2840e075ce88003
SHA512	02b4744e9213e051280ab7351eecab4a76152f418871d4b95316f0ff90e3d78ec28ff34b76b705a547a64981f086f56dcc1dd2a376c4c7ddcf1ae9b77a48c053

C:\Windows\System\BloIyku.exe

MD5	de9779e865b255f630b33da8dc80ed15
SHA1	eeb31f3f4713ba8e20a86582eeb1cf4ecebd52ee
SHA256	e7c9f82f4c299adfe70a5e5d5075b7207b9a8b11f79d0705bbfc7234338d153b
SHA512	0cd8ecf80028137f64880015d339cadb2b2dd558115f34145d17d224e54ccdf4db894980269264dada6f8b25e430a24b0194499ba8797210db6a70cd6ca2085c

C:\Windows\System\XqikOLr.exe

MD5	cc4c31d33dc6aa5376a7a707d2a4c510
SHA1	e655038f6d14830f5097bc5a660a38236ca1f25b
SHA256	4dc1fc0a63a409b5b6366fdad704450042081c5c3a92fb7361c983079b4619b1
SHA512	e6b7f371a920d5b94efef0998d26e09bfb9d107700ee7f26e95bee594f4fb18bdd3c95113569616503f3d4ee2b7e01df377c8cfc0f3a26677cf7cb8a52cc17bf

C:\Windows\System\ghbzigy.exe

MD5	5606c09a001e2d3eb1093dc8dc7cf9cd
SHA1	7cd58ffd1a7747eeb378f582598f1e8e951034a7
SHA256	3b4e7ea1a27db21abda7859ec09374e20a1d7124b1c32d06e6360857be58d8d8
SHA512	d4bcfc59fe30fd5e8af0f0b3cf321413ae24969eed2a5e77d9bb2b45178a3cecdaef48bce39cdf27c1c11c1a1c6b9ef7e5c50d34303f628b3a30ec87f25c6fc7

memory/4352-151-0x00007FF648AC0000-0x00007FF648E14000-memory.dmp

C:\Windows\System\kmndeXW.exe

MD5	0d24f0c8a4357b40d0e93cea9c876e3a
SHA1	9388eb4c0d0a85efc1561ff78c249d81357538bf
SHA256	3beea772b65db3da85bceecf668819cbd670d00a599cdda58053a8d3cb1d0ddf
SHA512	73ec0049767b2c249c7d5e673085b922fb38385a02c3e14280deea3c2cbb227f0323e4172888952704aad7601295720ace9f2ab272c9bde563dee372f2cd1988

memory/1816-185-0x00007FF6AFCA0000-0x00007FF6AFFF4000-memory.dmp

memory/1520-192-0x00007FF679BE0000-0x00007FF679F34000-memory.dmp

memory/984-197-0x00007FF6FCB90000-0x00007FF6FCEE4000-memory.dmp

memory/2032-196-0x00007FF7566B0000-0x00007FF756A04000-memory.dmp

memory/2096-195-0x00007FF64FAE0000-0x00007FF64FE34000-memory.dmp

memory/2628-194-0x00007FF7821E0000-0x00007FF782534000-memory.dmp

memory/4448-193-0x00007FF68A1F0000-0x00007FF68A544000-memory.dmp

memory/2392-191-0x00007FF60FAD0000-0x00007FF60FE24000-memory.dmp

memory/2360-190-0x00007FF7E1D50000-0x00007FF7E20A4000-memory.dmp

memory/3652-189-0x00007FF6E4570000-0x00007FF6E48C4000-memory.dmp

memory/2624-188-0x00007FF63ADB0000-0x00007FF63B104000-memory.dmp

memory/2620-187-0x00007FF796780000-0x00007FF796AD4000-memory.dmp

memory/972-184-0x00007FF6C9DE0000-0x00007FF6CA134000-memory.dmp

C:\Windows\System\HfOjNBa.exe

MD5	fedaed7aa4eb37ac3f1da2dc03475cf2
SHA1	2b5e44cdebb92bd75342a8b6e518cc0ee5c85839
SHA256	c37ce3cfa906745edab374d2d97a5a155e794f5a2877922ec22c6f211042a5a8
SHA512	39def4f7fc1c2a515a869503db0590038ead6f8f244c67dadad0a3ad3a0e363ad7dac69a5a0c03d183818c149337d4915ac0aa1ace7c005bfaf6a1122c7170f6

C:\Windows\System\ruZmCWW.exe

MD5	9da392f20e14296d80989ce02ae27e8c
SHA1	85d8b1fcf76b7473324c09c5ad5fbdd54424b05a
SHA256	f88e3a3c2d04cd35a473bf7f8620276a3612258cf21bb061a68c50e61e02a6ed
SHA512	35d5612ac4c74cc14b2867f7a0dd555dd22a7c67af7b1d5a4128a18f4a3f4769207580a20414253326215c2f7d371a115caa6d90cf694d7d69410a6a8cf64f83

memory/2700-176-0x00007FF6248A0000-0x00007FF624BF4000-memory.dmp

C:\Windows\System\OHJPloq.exe

MD5	b48c280b3aa555a9efe4a5cf2dc2d7ea
SHA1	a11c4d272e8f85728bced72547be661d4a8318dd
SHA256	8acb66d886bb3762221ee2ff84bd260c070b41667ad513b1aa7b07009cd799e1
SHA512	3f6db532989c8c95e4c03df8843f5fc742f1970225ef93236b8fd82e4e1a7be30bd6901677affd2b57fbfdf116d069f3eacc87a5009de90dbe75ced472dc1f68

C:\Windows\System\mDZjHWi.exe

MD5	6c6b71b3bbf2eab615ebb3f8361752a5
SHA1	91afa00da336eca15a71ef3bb6fec362551487e7
SHA256	1947b5e20238688374456aecf6fb7840e0e709429f2ed2f2b8127c2c1d4f7727
SHA512	4974e2fe0f3bd6b684ec262ccf89e4649ea4ef939b63479d200037afd0fecce3c313b167ac4291dc0084970f28a45b0b0451f5c78bcad1b6509862bc394282de

C:\Windows\System\fTDfWZb.exe

MD5	9939db8f6e6c1fef295253edcd208283
SHA1	fd0c5cb9dd35f6ee2c382e8a3a3ec74c04f8e4a6
SHA256	3568c73e2329945bc4939212d4e5895f6ff2255bca28a89968698210b4ec9f04
SHA512	ebc75c206e8784a6fc6f3381708b1f8f8ae12bda5223eacf93e4b7a2f94047f7c5b777f4eb41911cc9886cde0b34b175f8e07e5e4ef431769f98313a0f3a78f2

memory/5008-170-0x00007FF7A5C80000-0x00007FF7A5FD4000-memory.dmp

memory/4652-169-0x00007FF63B5A0000-0x00007FF63B8F4000-memory.dmp

C:\Windows\System\yLgiVSN.exe

MD5	0ad2fb8f578e002fe73a3ad6d648f94a
SHA1	876200d318eed00f673da97718395a535bea20a0
SHA256	7006135053537f7133a9542260df8d81f478dedff06ec694e8a9a5b73f1ccd8a
SHA512	8fd2febc41fed65dc3c3d2a86295fd58d36274c32bbf1be7532877a02706786643e955a8c335a41828768e5981e670adea354105945f13581d645b2fa0746b7c

C:\Windows\System\QXcyAja.exe

MD5	49badbaba41dabc36d032e83a28fbd23
SHA1	42d7235680a3e925bb4141c0724e852e29cc0168
SHA256	fa88524d7d8671a4258840a19326074160fe69cdafc89ef97adb230384ce848d
SHA512	7ccce6564176ee3f4ef85b974e8684226e1d78a97f5a9f3b43f253a519aea1306ca70293057e9eeb4ba7238682d95d358a6014af449f86c5886cc6633411109d

memory/2660-159-0x00007FF709480000-0x00007FF7097D4000-memory.dmp

C:\Windows\System\lJzfVIX.exe

MD5	3b02d1752f4b90346cb9c33c3bebe9f0
SHA1	9035dc85c642909178198c91243144d06d1c9a48
SHA256	bd4c38e3cc7a9c18357456c8ba2a859b7162df5f4739f84e0dd00bd16a559a69
SHA512	4f248498f26493e944185a3930db05c07117018f93061c66e2803e41d87db628d274e7aeaf3ec54aeac1b10a68813fbdf638204d80b8f47b92367d39219d99a4

C:\Windows\System\LiytJtc.exe

MD5	efac14fffd96a317d921681042b9158a
SHA1	1d9663cc0dab012da4c0c57826e11cdfacb9af3e
SHA256	8eda14193d029013eacdf2a39e3644f3286291c4e2f65cf07c08dacd8521fdc5
SHA512	b3d2650d72d01414a0a36af43ab914d46121d9c0569386ab442bf57498cdd45179466d322428c97b07e917cfb279d789d88efbb5b0dbf7cc13323dd3d49812bf

C:\Windows\System\sUwKKjX.exe

MD5	f380bdb321186bd6dd207235271b11ed
SHA1	23c84c55254dfe345ca3ded50193836964ef1032
SHA256	5f9807fbad6fb0bba0fc9f8bea81f83929c8b03b87742f96c52feedaaa66eb68
SHA512	9f85b03015881ed05f814b7c93dbe78b72099abe3580b6f9f39e5686341441856fd46a8cf88d693bb377d60863e54fe8cb456fce91259ab3cc4c1e5d3f9cf6e3

C:\Windows\System\lfoMkms.exe

MD5	faf18ea2525eff29f6117d67fd814725
SHA1	04b4f213f7d1b974a4f27b9421d8e0755a3c91ed
SHA256	e2c583eb3cc71ce6cb558baa5c01c6f6203b47f74c8e24f7e13f1e51e6e380a2
SHA512	d49b7501b25447267b453d248e49e349ebc58e3af7d0d51baa0818e76ee0597edfe43fd12777ece2433439adb3c70a5544fc7fc12a65908c2a7da28a0215c2dc

C:\Windows\System\QNLbuvV.exe

MD5	5c23ed11d0c312632fce4d9d18a92f7f
SHA1	f523e2f8029c8200a29b5e0a10ae6c0077516235
SHA256	848652e79088774be12eec648d77f5693b379e92d524c7127142ba121762a2e2
SHA512	39fb6010579c0ea653771457b015e11753e10f06e43d2cc34b4b2445bc6b24752699cfc26ee4f5b92b36227e0896b6f74044de44962c5be13eff7559e387359e

memory/2552-137-0x00007FF6F16F0000-0x00007FF6F1A44000-memory.dmp

C:\Windows\System\FRddJxx.exe

MD5	09b9cf5a5464e18287de437e4c4a66d8
SHA1	20595c96e9a8996caff6cefb87c50ef512557ec1
SHA256	d2ef05b2c7869b22b1e6d5dc05cc75efbc49d403cc54c6cc5ba51e839100b69d
SHA512	ea40234d152c04d38bfa462bc3b63f57f6d1b846224274de362c13ecd771dd62a0c3d1c95c10913080cbf812ac0cfe3fa9b5fe6355d9499a1542c32d44a3b7e3

C:\Windows\System\qiwxMan.exe

MD5	aec2be82f7353946dd3247c53475dc9e
SHA1	62462025cc9ab0e9c654daff94612e8697051158
SHA256	0a056a6407b8f4d2b96963d3442bcbb1194df4d6755ac67b06da91dce9c752ec
SHA512	c21bc5c812b6204a756faac9a91e770183b1917cc7c44a1dda6f77994a6a8f2112c72e649e8946304e8e1f486c5469c7d8d06a50815e99551228362d31cbfb59

memory/1360-126-0x00007FF6A9B90000-0x00007FF6A9EE4000-memory.dmp

memory/3888-125-0x00007FF6479F0000-0x00007FF647D44000-memory.dmp

C:\Windows\System\jVbYLaK.exe

MD5	3460878f6d7626bde6824cf8328a2c74
SHA1	4a27ebc738fcf18f24e27a7bd095791c8f6b3659
SHA256	b8a9a904f10b87a32f00ebd14666d3794db9dce3897d56552bda30ee394bf225
SHA512	08a660ecd62d41f3de5ba9d40dae4a335c4ae98e0f2d61da2ea944aa0729174bcaeb7ec1136d41ef26957173fb230fa8f3e3dbcad970537ebc1478667e14714c

C:\Windows\System\iNEKlgB.exe

MD5	a3be56456a6bb20ce68a7720b508dd52
SHA1	7d0f9f68ad9e1f220a4414b1c5e4c1666ef1dc18
SHA256	adbf2405c0af8a41cf87f88bbdd7fb6326edc47d5841df8661dc9911a59e4301
SHA512	561911eaa5d3bedac6244e470f84de9dbdb1425118b2ac7f4c09d34618339fbbaa5a4c0faab28ade8d0960b8f5049bd15bc7c57c15c0d5aa7f46be4112f299c7

C:\Windows\System\IfGdDav.exe

MD5	00b0ea2ca452e1f542c9978c6005b298
SHA1	d04faf3f50b15daa7a2c390cdd59cd22d4840eee
SHA256	656978979b18d63a7c8146ec9d721820c4904029a27c608d6b6aabe64cf3ee8c
SHA512	3aa4b0bac820035013ff0b13255c88c03acb918819fe3e155ca90b5b93c1e57828c6dd8bb934ea5381f383d8c207a284a8b36b2c60d3f3cd3ed6197de84e99c0

memory/2240-107-0x00007FF6DE7D0000-0x00007FF6DEB24000-memory.dmp

C:\Windows\System\udEspXw.exe

MD5	0e7ac0032c8e554ac3a403d72580616a
SHA1	b670cb8adc0e500ad6ce4cb86e5070fdbeadaa16
SHA256	b4a5bf3276b8a01f9f1ea057f0ae54d262b610630bbc999c7c3d230c8c342c78
SHA512	67def1de007b73afa452737e23bacc613ccde420c7edca6ec9b27a2c0c4b81cbc99aa5404686d863e63e8c46485390c213a2668d48934757a5cab8169d08e054

C:\Windows\System\cvZqMei.exe

MD5	07d0d851f67dca217fa5f2387b356153
SHA1	4e0b764539e10403cba2a7a881b6954661722b41
SHA256	72980da4cadaad04a02ce90283495e6e29d88d3ff1d0aa0ef883507610219116
SHA512	bed4db04618fb05f91e8891a6adee619b1288462e9f516257e43d843fd875bc98ba0768229f3049c8d785dfdddc34df4d9c9a1f41f2d6f6f12c9e1c52689ede8

C:\Windows\System\oKnyrjw.exe

MD5	02d5c6e4edfe1dfd221c2716170b4174
SHA1	3d0fd92a98b739f902e44d6fb7e185b653340c02
SHA256	bdb7cf38455450474bae5d7357189abdba6705b794a0997773298d0a6dff5af7
SHA512	96062269351d0815989531ab317e59aaafebe45cce1eb8153b5e376ef5f16525858b96306b716c60217f3cd214406a604fa66df00db772451709e34a635424e3

memory/684-83-0x00007FF743320000-0x00007FF743674000-memory.dmp

C:\Windows\System\XStcTCy.exe

MD5	cc969b0893a14648e46925a1e5a029f3
SHA1	8b77dba84f971744a10c06f60883e57ef8b5c7ec
SHA256	ff9122b562570f2f1decc982c8e15082ee36973975fdb586dade6ce1f359b37a
SHA512	ace778c01c8c5a96d874b2156b91fd5548976fde3c472aba1e6164901ab1005c7e5e5701f44ec5684e6f1dc3a6d64747c58090792c3320568a7546d505906ead

memory/3460-56-0x00007FF68EB40000-0x00007FF68EE94000-memory.dmp

memory/3080-59-0x00007FF6E8450000-0x00007FF6E87A4000-memory.dmp

memory/3484-47-0x00007FF6B64A0000-0x00007FF6B67F4000-memory.dmp

memory/2304-45-0x00007FF705090000-0x00007FF7053E4000-memory.dmp

C:\Windows\System\rpNiCsy.exe

MD5	19b8b4ee1fb630b0409b2d1eb6ded38d
SHA1	25293c618a0748cadb43aeffc1ecedd44d3098b7
SHA256	595e106e898b9ddea9b924259a6c18eb6dbfa04a37b6956d3ec5d632c0640356
SHA512	c55baa6a533360d1a206f5712b27ee559009129b9664a0963f1e838c05b01f6d93f887dc27b1e4add5ce8ed87fa99ae3c9d25399398a08263d3100bbffaa95eb

C:\Windows\System\QKpLFjo.exe

MD5	32da8e66e563b4b686059eb74761d8d7
SHA1	e6941c2c081a6d3b8d5b52f6d0ee751e9225479c
SHA256	10f35beee27b96e6c5d0335414a1e245f0b37dee5cc95871360f3763aee26370
SHA512	c7c3e3e811650b22803f3cd2fc3d1013ef3c150cc982a70be8597434c5833e9a1ba922197a15754cb8cbf152dae68552266b6bf86eb7c3994ca4f4f9c653eff1

C:\Windows\System\XAOcbbs.exe

MD5	e1d82a6e88811963c138387c49a03889
SHA1	a89b7ea525b013b202312f9c09f29d64ff5d63ed
SHA256	ffdcd2f7c97d003860713c3ca40011fd929635714fcdf4a11c484b9751440ef2
SHA512	e8ee5a11b7b32e56efc78b7e08264819f0099f422fc2cf53f942f72ea68b00aab3f1590d31595fb49350b75fc52576b9dcde3f8f56da072d03f07734961989a8

memory/3116-26-0x00007FF738B30000-0x00007FF738E84000-memory.dmp

memory/3676-10-0x00007FF7CCE30000-0x00007FF7CD184000-memory.dmp

memory/3116-2145-0x00007FF738B30000-0x00007FF738E84000-memory.dmp

memory/2304-2146-0x00007FF705090000-0x00007FF7053E4000-memory.dmp

memory/3460-2147-0x00007FF68EB40000-0x00007FF68EE94000-memory.dmp

memory/684-2148-0x00007FF743320000-0x00007FF743674000-memory.dmp

memory/2240-2149-0x00007FF6DE7D0000-0x00007FF6DEB24000-memory.dmp

memory/3888-2150-0x00007FF6479F0000-0x00007FF647D44000-memory.dmp

memory/3080-2151-0x00007FF6E8450000-0x00007FF6E87A4000-memory.dmp

memory/3676-2152-0x00007FF7CCE30000-0x00007FF7CD184000-memory.dmp

memory/3116-2153-0x00007FF738B30000-0x00007FF738E84000-memory.dmp

memory/2392-2154-0x00007FF60FAD0000-0x00007FF60FE24000-memory.dmp

memory/2360-2156-0x00007FF7E1D50000-0x00007FF7E20A4000-memory.dmp

memory/3484-2155-0x00007FF6B64A0000-0x00007FF6B67F4000-memory.dmp

memory/2304-2157-0x00007FF705090000-0x00007FF7053E4000-memory.dmp

memory/684-2162-0x00007FF743320000-0x00007FF743674000-memory.dmp

memory/1520-2163-0x00007FF679BE0000-0x00007FF679F34000-memory.dmp

memory/1360-2161-0x00007FF6A9B90000-0x00007FF6A9EE4000-memory.dmp

memory/3460-2160-0x00007FF68EB40000-0x00007FF68EE94000-memory.dmp

memory/3080-2159-0x00007FF6E8450000-0x00007FF6E87A4000-memory.dmp

memory/2240-2158-0x00007FF6DE7D0000-0x00007FF6DEB24000-memory.dmp

memory/3888-2179-0x00007FF6479F0000-0x00007FF647D44000-memory.dmp

memory/4352-2178-0x00007FF648AC0000-0x00007FF648E14000-memory.dmp

memory/2660-2177-0x00007FF709480000-0x00007FF7097D4000-memory.dmp

memory/2552-2176-0x00007FF6F16F0000-0x00007FF6F1A44000-memory.dmp

memory/4652-2175-0x00007FF63B5A0000-0x00007FF63B8F4000-memory.dmp

memory/2700-2173-0x00007FF6248A0000-0x00007FF624BF4000-memory.dmp

memory/2096-2172-0x00007FF64FAE0000-0x00007FF64FE34000-memory.dmp

memory/1816-2171-0x00007FF6AFCA0000-0x00007FF6AFFF4000-memory.dmp

memory/972-2170-0x00007FF6C9DE0000-0x00007FF6CA134000-memory.dmp

memory/2624-2169-0x00007FF63ADB0000-0x00007FF63B104000-memory.dmp

memory/3652-2168-0x00007FF6E4570000-0x00007FF6E48C4000-memory.dmp

memory/2620-2167-0x00007FF796780000-0x00007FF796AD4000-memory.dmp

memory/984-2166-0x00007FF6FCB90000-0x00007FF6FCEE4000-memory.dmp

memory/2032-2165-0x00007FF7566B0000-0x00007FF756A04000-memory.dmp

memory/5008-2174-0x00007FF7A5C80000-0x00007FF7A5FD4000-memory.dmp

memory/4448-2164-0x00007FF68A1F0000-0x00007FF68A544000-memory.dmp

memory/2628-2180-0x00007FF7821E0000-0x00007FF782534000-memory.dmp

Sample ID	240613-rcgwkssaka
Target	8233a958f2233f8afd3c5390d9ca2940_NeikiAnalytics.exe
SHA256	8a1e5e1ddcf2e0e8f683d20a30b4c462bbb9dcc9f30fe2c6e72d046348f2f900
Tags	miner upx xmrig

Malware Analysis Report

2024-07-28 17:46

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files