Analysis Overview

score

10^/10

SHA256

76d763ed76ecb51ee2a4c771bee99a95e658a4b4abdfd05666ddf7799245f66e

Threat Level: Known bad

The file 7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

miner upx xmrig

XMRig Miner payload

Xmrig family

xmrig

XMRig Miner payload

Loads dropped DLL

UPX packed file

Executes dropped EXE

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 13:20

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Xmrig family

xmrig

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 13:20

Reported

2024-06-13 13:23

Platform

win7-20240611-en

Max time kernel

150s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\WNDzlLK.exe	N/A
N/A	N/A	C:\Windows\System\isiefjQ.exe	N/A
N/A	N/A	C:\Windows\System\ryvjvCM.exe	N/A
N/A	N/A	C:\Windows\System\ibxgIeB.exe	N/A
N/A	N/A	C:\Windows\System\zBEiFfb.exe	N/A
N/A	N/A	C:\Windows\System\tMqynPc.exe	N/A
N/A	N/A	C:\Windows\System\RhdjJvs.exe	N/A
N/A	N/A	C:\Windows\System\XADKBeZ.exe	N/A
N/A	N/A	C:\Windows\System\glPctkI.exe	N/A
N/A	N/A	C:\Windows\System\kOnXUVo.exe	N/A
N/A	N/A	C:\Windows\System\SATmpUs.exe	N/A
N/A	N/A	C:\Windows\System\NSpRrEG.exe	N/A
N/A	N/A	C:\Windows\System\Dztlygr.exe	N/A
N/A	N/A	C:\Windows\System\ZomvtZz.exe	N/A
N/A	N/A	C:\Windows\System\sKKbVQu.exe	N/A
N/A	N/A	C:\Windows\System\hFutPDz.exe	N/A
N/A	N/A	C:\Windows\System\HFqRGXY.exe	N/A
N/A	N/A	C:\Windows\System\YejpHAj.exe	N/A
N/A	N/A	C:\Windows\System\eHKrcas.exe	N/A
N/A	N/A	C:\Windows\System\gdHnjtL.exe	N/A
N/A	N/A	C:\Windows\System\nqNeTFQ.exe	N/A
N/A	N/A	C:\Windows\System\WYYBYtw.exe	N/A
N/A	N/A	C:\Windows\System\XcHYKLz.exe	N/A
N/A	N/A	C:\Windows\System\CKHyePY.exe	N/A
N/A	N/A	C:\Windows\System\IZaiqUT.exe	N/A
N/A	N/A	C:\Windows\System\gPDvaQT.exe	N/A
N/A	N/A	C:\Windows\System\gUdEqgQ.exe	N/A
N/A	N/A	C:\Windows\System\XRoqtTj.exe	N/A
N/A	N/A	C:\Windows\System\ondRvSN.exe	N/A
N/A	N/A	C:\Windows\System\JFBbulZ.exe	N/A
N/A	N/A	C:\Windows\System\hPrKATV.exe	N/A
N/A	N/A	C:\Windows\System\eQDSzmu.exe	N/A
N/A	N/A	C:\Windows\System\TqkXGLW.exe	N/A
N/A	N/A	C:\Windows\System\UUrxvzC.exe	N/A
N/A	N/A	C:\Windows\System\erbxGzq.exe	N/A
N/A	N/A	C:\Windows\System\QyrUjrG.exe	N/A
N/A	N/A	C:\Windows\System\AolfSiJ.exe	N/A
N/A	N/A	C:\Windows\System\ieRxKve.exe	N/A
N/A	N/A	C:\Windows\System\rKIJQiH.exe	N/A
N/A	N/A	C:\Windows\System\pseCMvh.exe	N/A
N/A	N/A	C:\Windows\System\BChYQlv.exe	N/A
N/A	N/A	C:\Windows\System\ryxtwia.exe	N/A
N/A	N/A	C:\Windows\System\UxiSafO.exe	N/A
N/A	N/A	C:\Windows\System\nMFftjP.exe	N/A
N/A	N/A	C:\Windows\System\qBvYlmV.exe	N/A
N/A	N/A	C:\Windows\System\dPZtzDz.exe	N/A
N/A	N/A	C:\Windows\System\MPaMAtd.exe	N/A
N/A	N/A	C:\Windows\System\mUkbiMY.exe	N/A
N/A	N/A	C:\Windows\System\kNNqSKG.exe	N/A
N/A	N/A	C:\Windows\System\UxqXyIN.exe	N/A
N/A	N/A	C:\Windows\System\uMMobEo.exe	N/A
N/A	N/A	C:\Windows\System\qMEsgOf.exe	N/A
N/A	N/A	C:\Windows\System\dPTPKyy.exe	N/A
N/A	N/A	C:\Windows\System\HZNURIU.exe	N/A
N/A	N/A	C:\Windows\System\CzUBvrw.exe	N/A
N/A	N/A	C:\Windows\System\uKXJgAl.exe	N/A
N/A	N/A	C:\Windows\System\MpzynFk.exe	N/A
N/A	N/A	C:\Windows\System\GQyTmFB.exe	N/A
N/A	N/A	C:\Windows\System\ZFLlYmG.exe	N/A
N/A	N/A	C:\Windows\System\VXegDtG.exe	N/A
N/A	N/A	C:\Windows\System\TMPReGU.exe	N/A
N/A	N/A	C:\Windows\System\dCxiiNJ.exe	N/A
N/A	N/A	C:\Windows\System\UtVBOII.exe	N/A
N/A	N/A	C:\Windows\System\lryTSyY.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\gUdEqgQ.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TyUVXoh.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DYTspcG.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HQmSfLS.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xMgycLD.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cnsokRr.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VhwUpbE.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JccEkyK.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RjstIKR.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FcXMJbO.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cxmhpYc.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KtxVGTr.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sCWdHrk.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hmlClFW.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QvMjVgy.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vKbjbtv.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PkrFrDp.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gONvPqN.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mGmISjt.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sKKbVQu.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UOyLVQD.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FeaXcHQ.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DTgAuIO.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GOebcer.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ugGjNov.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lHggCPf.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lZcEkDK.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WpGaCVa.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hXBUfsu.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XJnXnLK.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uRtGKZD.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lignXow.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\anIVjsL.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kGBcMTn.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ohurtpi.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jwvdymk.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PHTacgU.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ogeWhlX.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RMnbDSl.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hTLKvPv.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iwQfJJE.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SuVEPTi.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MvBpOAQ.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pLgTyUP.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jSOHRdc.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ABHhwdo.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VbPxwls.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gHAWGoi.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XOjfGvm.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IneGgHl.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\guYOsrf.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xbUnSzf.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uwaTJjK.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WnJVsQK.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ODZgkmh.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\boSuRtY.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cqvkjmj.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cYHXciB.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FpyzEjk.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EWxBeJx.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ondRvSN.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZWjGwlz.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rVGjXwJ.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LDawCIy.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1752 wrote to memory of 2824	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\WNDzlLK.exe
PID 1752 wrote to memory of 2824	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\WNDzlLK.exe
PID 1752 wrote to memory of 2824	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\WNDzlLK.exe
PID 1752 wrote to memory of 2560	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\isiefjQ.exe
PID 1752 wrote to memory of 2560	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\isiefjQ.exe
PID 1752 wrote to memory of 2560	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\isiefjQ.exe
PID 1752 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\ryvjvCM.exe
PID 1752 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\ryvjvCM.exe
PID 1752 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\ryvjvCM.exe
PID 1752 wrote to memory of 2848	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\ibxgIeB.exe
PID 1752 wrote to memory of 2848	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\ibxgIeB.exe
PID 1752 wrote to memory of 2848	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\ibxgIeB.exe
PID 1752 wrote to memory of 2360	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\zBEiFfb.exe
PID 1752 wrote to memory of 2360	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\zBEiFfb.exe
PID 1752 wrote to memory of 2360	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\zBEiFfb.exe
PID 1752 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\tMqynPc.exe
PID 1752 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\tMqynPc.exe
PID 1752 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\tMqynPc.exe
PID 1752 wrote to memory of 2604	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\RhdjJvs.exe
PID 1752 wrote to memory of 2604	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\RhdjJvs.exe
PID 1752 wrote to memory of 2604	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\RhdjJvs.exe
PID 1752 wrote to memory of 2524	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\XADKBeZ.exe
PID 1752 wrote to memory of 2524	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\XADKBeZ.exe
PID 1752 wrote to memory of 2524	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\XADKBeZ.exe
PID 1752 wrote to memory of 1148	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\NSpRrEG.exe
PID 1752 wrote to memory of 1148	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\NSpRrEG.exe
PID 1752 wrote to memory of 1148	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\NSpRrEG.exe
PID 1752 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\glPctkI.exe
PID 1752 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\glPctkI.exe
PID 1752 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\glPctkI.exe
PID 1752 wrote to memory of 2952	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\Dztlygr.exe
PID 1752 wrote to memory of 2952	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\Dztlygr.exe
PID 1752 wrote to memory of 2952	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\Dztlygr.exe
PID 1752 wrote to memory of 2924	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\kOnXUVo.exe
PID 1752 wrote to memory of 2924	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\kOnXUVo.exe
PID 1752 wrote to memory of 2924	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\kOnXUVo.exe
PID 1752 wrote to memory of 332	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\ZomvtZz.exe
PID 1752 wrote to memory of 332	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\ZomvtZz.exe
PID 1752 wrote to memory of 332	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\ZomvtZz.exe
PID 1752 wrote to memory of 760	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\SATmpUs.exe
PID 1752 wrote to memory of 760	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\SATmpUs.exe
PID 1752 wrote to memory of 760	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\SATmpUs.exe
PID 1752 wrote to memory of 1932	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\hFutPDz.exe
PID 1752 wrote to memory of 1932	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\hFutPDz.exe
PID 1752 wrote to memory of 1932	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\hFutPDz.exe
PID 1752 wrote to memory of 2536	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\sKKbVQu.exe
PID 1752 wrote to memory of 2536	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\sKKbVQu.exe
PID 1752 wrote to memory of 2536	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\sKKbVQu.exe
PID 1752 wrote to memory of 2752	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\HFqRGXY.exe
PID 1752 wrote to memory of 2752	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\HFqRGXY.exe
PID 1752 wrote to memory of 2752	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\HFqRGXY.exe
PID 1752 wrote to memory of 2764	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\YejpHAj.exe
PID 1752 wrote to memory of 2764	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\YejpHAj.exe
PID 1752 wrote to memory of 2764	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\YejpHAj.exe
PID 1752 wrote to memory of 1316	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\eHKrcas.exe
PID 1752 wrote to memory of 1316	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\eHKrcas.exe
PID 1752 wrote to memory of 1316	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\eHKrcas.exe
PID 1752 wrote to memory of 1984	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\gdHnjtL.exe
PID 1752 wrote to memory of 1984	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\gdHnjtL.exe
PID 1752 wrote to memory of 1984	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\gdHnjtL.exe
PID 1752 wrote to memory of 1456	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\nqNeTFQ.exe
PID 1752 wrote to memory of 1456	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\nqNeTFQ.exe
PID 1752 wrote to memory of 1456	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\nqNeTFQ.exe
PID 1752 wrote to memory of 1676	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\WYYBYtw.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe"

C:\Windows\System\WNDzlLK.exe

C:\Windows\System\WNDzlLK.exe

C:\Windows\System\isiefjQ.exe

C:\Windows\System\isiefjQ.exe

C:\Windows\System\ryvjvCM.exe

C:\Windows\System\ryvjvCM.exe

C:\Windows\System\ibxgIeB.exe

C:\Windows\System\ibxgIeB.exe

C:\Windows\System\zBEiFfb.exe

C:\Windows\System\zBEiFfb.exe

C:\Windows\System\tMqynPc.exe

C:\Windows\System\tMqynPc.exe

C:\Windows\System\RhdjJvs.exe

C:\Windows\System\RhdjJvs.exe

C:\Windows\System\XADKBeZ.exe

C:\Windows\System\XADKBeZ.exe

C:\Windows\System\NSpRrEG.exe

C:\Windows\System\NSpRrEG.exe

C:\Windows\System\glPctkI.exe

C:\Windows\System\glPctkI.exe

C:\Windows\System\Dztlygr.exe

C:\Windows\System\Dztlygr.exe

C:\Windows\System\kOnXUVo.exe

C:\Windows\System\kOnXUVo.exe

C:\Windows\System\ZomvtZz.exe

C:\Windows\System\ZomvtZz.exe

C:\Windows\System\SATmpUs.exe

C:\Windows\System\SATmpUs.exe

C:\Windows\System\hFutPDz.exe

C:\Windows\System\hFutPDz.exe

C:\Windows\System\sKKbVQu.exe

C:\Windows\System\sKKbVQu.exe

C:\Windows\System\HFqRGXY.exe

C:\Windows\System\HFqRGXY.exe

C:\Windows\System\YejpHAj.exe

C:\Windows\System\YejpHAj.exe

C:\Windows\System\eHKrcas.exe

C:\Windows\System\eHKrcas.exe

C:\Windows\System\gdHnjtL.exe

C:\Windows\System\gdHnjtL.exe

C:\Windows\System\nqNeTFQ.exe

C:\Windows\System\nqNeTFQ.exe

C:\Windows\System\WYYBYtw.exe

C:\Windows\System\WYYBYtw.exe

C:\Windows\System\XcHYKLz.exe

C:\Windows\System\XcHYKLz.exe

C:\Windows\System\CKHyePY.exe

C:\Windows\System\CKHyePY.exe

C:\Windows\System\IZaiqUT.exe

C:\Windows\System\IZaiqUT.exe

C:\Windows\System\gPDvaQT.exe

C:\Windows\System\gPDvaQT.exe

C:\Windows\System\gUdEqgQ.exe

C:\Windows\System\gUdEqgQ.exe

C:\Windows\System\XRoqtTj.exe

C:\Windows\System\XRoqtTj.exe

C:\Windows\System\ondRvSN.exe

C:\Windows\System\ondRvSN.exe

C:\Windows\System\JFBbulZ.exe

C:\Windows\System\JFBbulZ.exe

C:\Windows\System\hPrKATV.exe

C:\Windows\System\hPrKATV.exe

C:\Windows\System\eQDSzmu.exe

C:\Windows\System\eQDSzmu.exe

C:\Windows\System\TqkXGLW.exe

C:\Windows\System\TqkXGLW.exe

C:\Windows\System\UUrxvzC.exe

C:\Windows\System\UUrxvzC.exe

C:\Windows\System\erbxGzq.exe

C:\Windows\System\erbxGzq.exe

C:\Windows\System\QyrUjrG.exe

C:\Windows\System\QyrUjrG.exe

C:\Windows\System\AolfSiJ.exe

C:\Windows\System\AolfSiJ.exe

C:\Windows\System\ieRxKve.exe

C:\Windows\System\ieRxKve.exe

C:\Windows\System\rKIJQiH.exe

C:\Windows\System\rKIJQiH.exe

C:\Windows\System\pseCMvh.exe

C:\Windows\System\pseCMvh.exe

C:\Windows\System\BChYQlv.exe

C:\Windows\System\BChYQlv.exe

C:\Windows\System\ryxtwia.exe

C:\Windows\System\ryxtwia.exe

C:\Windows\System\UxiSafO.exe

C:\Windows\System\UxiSafO.exe

C:\Windows\System\nMFftjP.exe

C:\Windows\System\nMFftjP.exe

C:\Windows\System\qBvYlmV.exe

C:\Windows\System\qBvYlmV.exe

C:\Windows\System\dPZtzDz.exe

C:\Windows\System\dPZtzDz.exe

C:\Windows\System\MPaMAtd.exe

C:\Windows\System\MPaMAtd.exe

C:\Windows\System\mUkbiMY.exe

C:\Windows\System\mUkbiMY.exe

C:\Windows\System\kNNqSKG.exe

C:\Windows\System\kNNqSKG.exe

C:\Windows\System\UxqXyIN.exe

C:\Windows\System\UxqXyIN.exe

C:\Windows\System\uMMobEo.exe

C:\Windows\System\uMMobEo.exe

C:\Windows\System\qMEsgOf.exe

C:\Windows\System\qMEsgOf.exe

C:\Windows\System\dPTPKyy.exe

C:\Windows\System\dPTPKyy.exe

C:\Windows\System\HZNURIU.exe

C:\Windows\System\HZNURIU.exe

C:\Windows\System\CzUBvrw.exe

C:\Windows\System\CzUBvrw.exe

C:\Windows\System\uKXJgAl.exe

C:\Windows\System\uKXJgAl.exe

C:\Windows\System\MpzynFk.exe

C:\Windows\System\MpzynFk.exe

C:\Windows\System\GQyTmFB.exe

C:\Windows\System\GQyTmFB.exe

C:\Windows\System\ZFLlYmG.exe

C:\Windows\System\ZFLlYmG.exe

C:\Windows\System\VXegDtG.exe

C:\Windows\System\VXegDtG.exe

C:\Windows\System\TMPReGU.exe

C:\Windows\System\TMPReGU.exe

C:\Windows\System\dCxiiNJ.exe

C:\Windows\System\dCxiiNJ.exe

C:\Windows\System\UtVBOII.exe

C:\Windows\System\UtVBOII.exe

C:\Windows\System\lryTSyY.exe

C:\Windows\System\lryTSyY.exe

C:\Windows\System\OiHKEzK.exe

C:\Windows\System\OiHKEzK.exe

C:\Windows\System\vERCKQq.exe

C:\Windows\System\vERCKQq.exe

C:\Windows\System\YgDqwlj.exe

C:\Windows\System\YgDqwlj.exe

C:\Windows\System\ORGmKgM.exe

C:\Windows\System\ORGmKgM.exe

C:\Windows\System\TnaSolx.exe

C:\Windows\System\TnaSolx.exe

C:\Windows\System\QUtjZOB.exe

C:\Windows\System\QUtjZOB.exe

C:\Windows\System\RZjZCnO.exe

C:\Windows\System\RZjZCnO.exe

C:\Windows\System\KuwGszp.exe

C:\Windows\System\KuwGszp.exe

C:\Windows\System\YaYHjLh.exe

C:\Windows\System\YaYHjLh.exe

C:\Windows\System\OMdNywo.exe

C:\Windows\System\OMdNywo.exe

C:\Windows\System\fajNsAX.exe

C:\Windows\System\fajNsAX.exe

C:\Windows\System\qpvleHJ.exe

C:\Windows\System\qpvleHJ.exe

C:\Windows\System\ouUovfN.exe

C:\Windows\System\ouUovfN.exe

C:\Windows\System\DaUwGiO.exe

C:\Windows\System\DaUwGiO.exe

C:\Windows\System\ffRziIN.exe

C:\Windows\System\ffRziIN.exe

C:\Windows\System\MTPrzwV.exe

C:\Windows\System\MTPrzwV.exe

C:\Windows\System\xHRMjku.exe

C:\Windows\System\xHRMjku.exe

C:\Windows\System\bbsmqaV.exe

C:\Windows\System\bbsmqaV.exe

C:\Windows\System\JbxTOsc.exe

C:\Windows\System\JbxTOsc.exe

C:\Windows\System\kJFqQZx.exe

C:\Windows\System\kJFqQZx.exe

C:\Windows\System\jhLEAMh.exe

C:\Windows\System\jhLEAMh.exe

C:\Windows\System\IoqVPFC.exe

C:\Windows\System\IoqVPFC.exe

C:\Windows\System\nudSlQG.exe

C:\Windows\System\nudSlQG.exe

C:\Windows\System\KVgaFOI.exe

C:\Windows\System\KVgaFOI.exe

C:\Windows\System\jnhIgdA.exe

C:\Windows\System\jnhIgdA.exe

C:\Windows\System\kYPJfis.exe

C:\Windows\System\kYPJfis.exe

C:\Windows\System\jkxaZuF.exe

C:\Windows\System\jkxaZuF.exe

C:\Windows\System\lhbxiYu.exe

C:\Windows\System\lhbxiYu.exe

C:\Windows\System\ASEClZr.exe

C:\Windows\System\ASEClZr.exe

C:\Windows\System\dheWtJJ.exe

C:\Windows\System\dheWtJJ.exe

C:\Windows\System\RmoDNhk.exe

C:\Windows\System\RmoDNhk.exe

C:\Windows\System\qVMaDmM.exe

C:\Windows\System\qVMaDmM.exe

C:\Windows\System\rSfvyrf.exe

C:\Windows\System\rSfvyrf.exe

C:\Windows\System\moPzHQx.exe

C:\Windows\System\moPzHQx.exe

C:\Windows\System\WkbaFHX.exe

C:\Windows\System\WkbaFHX.exe

C:\Windows\System\iHUjiAF.exe

C:\Windows\System\iHUjiAF.exe

C:\Windows\System\SFJaAXL.exe

C:\Windows\System\SFJaAXL.exe

C:\Windows\System\ExXbQCw.exe

C:\Windows\System\ExXbQCw.exe

C:\Windows\System\gcLuTXj.exe

C:\Windows\System\gcLuTXj.exe

C:\Windows\System\MmfgEFP.exe

C:\Windows\System\MmfgEFP.exe

C:\Windows\System\SvqNuaU.exe

C:\Windows\System\SvqNuaU.exe

C:\Windows\System\vTpWPke.exe

C:\Windows\System\vTpWPke.exe

C:\Windows\System\iRmvTaO.exe

C:\Windows\System\iRmvTaO.exe

C:\Windows\System\OYecmrS.exe

C:\Windows\System\OYecmrS.exe

C:\Windows\System\hHhLhdh.exe

C:\Windows\System\hHhLhdh.exe

C:\Windows\System\zSjPaKH.exe

C:\Windows\System\zSjPaKH.exe

C:\Windows\System\dgEzTqT.exe

C:\Windows\System\dgEzTqT.exe

C:\Windows\System\ADjoXCX.exe

C:\Windows\System\ADjoXCX.exe

C:\Windows\System\yaMKaPN.exe

C:\Windows\System\yaMKaPN.exe

C:\Windows\System\TyPyOGx.exe

C:\Windows\System\TyPyOGx.exe

C:\Windows\System\GcgzyPe.exe

C:\Windows\System\GcgzyPe.exe

C:\Windows\System\REixCmZ.exe

C:\Windows\System\REixCmZ.exe

C:\Windows\System\nvzlCzD.exe

C:\Windows\System\nvzlCzD.exe

C:\Windows\System\UBzKAMv.exe

C:\Windows\System\UBzKAMv.exe

C:\Windows\System\nWrXALu.exe

C:\Windows\System\nWrXALu.exe

C:\Windows\System\iJeHDwi.exe

C:\Windows\System\iJeHDwi.exe

C:\Windows\System\ksnMTog.exe

C:\Windows\System\ksnMTog.exe

C:\Windows\System\obkhyKV.exe

C:\Windows\System\obkhyKV.exe

C:\Windows\System\ZzpjKkb.exe

C:\Windows\System\ZzpjKkb.exe

C:\Windows\System\kjrtOrL.exe

C:\Windows\System\kjrtOrL.exe

C:\Windows\System\PTbENiQ.exe

C:\Windows\System\PTbENiQ.exe

C:\Windows\System\rqrInrc.exe

C:\Windows\System\rqrInrc.exe

C:\Windows\System\naOkPiw.exe

C:\Windows\System\naOkPiw.exe

C:\Windows\System\bxpPZxC.exe

C:\Windows\System\bxpPZxC.exe

C:\Windows\System\JlqbMXw.exe

C:\Windows\System\JlqbMXw.exe

C:\Windows\System\xQpnruo.exe

C:\Windows\System\xQpnruo.exe

C:\Windows\System\UJkVnCx.exe

C:\Windows\System\UJkVnCx.exe

C:\Windows\System\IkXiVxP.exe

C:\Windows\System\IkXiVxP.exe

C:\Windows\System\ohQBdYX.exe

C:\Windows\System\ohQBdYX.exe

C:\Windows\System\ZWjGwlz.exe

C:\Windows\System\ZWjGwlz.exe

C:\Windows\System\UwsYHiM.exe

C:\Windows\System\UwsYHiM.exe

C:\Windows\System\cMJnBhB.exe

C:\Windows\System\cMJnBhB.exe

C:\Windows\System\WsKbHKZ.exe

C:\Windows\System\WsKbHKZ.exe

C:\Windows\System\dPXrAiz.exe

C:\Windows\System\dPXrAiz.exe

C:\Windows\System\gfGXYWq.exe

C:\Windows\System\gfGXYWq.exe

C:\Windows\System\TluBhNC.exe

C:\Windows\System\TluBhNC.exe

C:\Windows\System\zXjVozr.exe

C:\Windows\System\zXjVozr.exe

C:\Windows\System\iuZdDTa.exe

C:\Windows\System\iuZdDTa.exe

C:\Windows\System\iaLjyJL.exe

C:\Windows\System\iaLjyJL.exe

C:\Windows\System\FEcsfGc.exe

C:\Windows\System\FEcsfGc.exe

C:\Windows\System\afqxgYR.exe

C:\Windows\System\afqxgYR.exe

C:\Windows\System\OnVDOlq.exe

C:\Windows\System\OnVDOlq.exe

C:\Windows\System\VzdsvNU.exe

C:\Windows\System\VzdsvNU.exe

C:\Windows\System\qbCQCiE.exe

C:\Windows\System\qbCQCiE.exe

C:\Windows\System\zPtbsct.exe

C:\Windows\System\zPtbsct.exe

C:\Windows\System\XuHcGpS.exe

C:\Windows\System\XuHcGpS.exe

C:\Windows\System\luVXEKP.exe

C:\Windows\System\luVXEKP.exe

C:\Windows\System\BIHExCv.exe

C:\Windows\System\BIHExCv.exe

C:\Windows\System\kHfFdaX.exe

C:\Windows\System\kHfFdaX.exe

C:\Windows\System\YpkwqyY.exe

C:\Windows\System\YpkwqyY.exe

C:\Windows\System\xbbgCjN.exe

C:\Windows\System\xbbgCjN.exe

C:\Windows\System\hmqayTi.exe

C:\Windows\System\hmqayTi.exe

C:\Windows\System\wFkzKKZ.exe

C:\Windows\System\wFkzKKZ.exe

C:\Windows\System\sWSfFwL.exe

C:\Windows\System\sWSfFwL.exe

C:\Windows\System\fpJXtPQ.exe

C:\Windows\System\fpJXtPQ.exe

C:\Windows\System\OhiupUW.exe

C:\Windows\System\OhiupUW.exe

C:\Windows\System\oUaCauF.exe

C:\Windows\System\oUaCauF.exe

C:\Windows\System\YDQSBXU.exe

C:\Windows\System\YDQSBXU.exe

C:\Windows\System\vhJXBdy.exe

C:\Windows\System\vhJXBdy.exe

C:\Windows\System\bFIYFZK.exe

C:\Windows\System\bFIYFZK.exe

C:\Windows\System\oBezgJs.exe

C:\Windows\System\oBezgJs.exe

C:\Windows\System\wyhPjBS.exe

C:\Windows\System\wyhPjBS.exe

C:\Windows\System\MvBpOAQ.exe

C:\Windows\System\MvBpOAQ.exe

C:\Windows\System\iExDmsA.exe

C:\Windows\System\iExDmsA.exe

C:\Windows\System\kGBcMTn.exe

C:\Windows\System\kGBcMTn.exe

C:\Windows\System\vgzUVJU.exe

C:\Windows\System\vgzUVJU.exe

C:\Windows\System\EhQlWGx.exe

C:\Windows\System\EhQlWGx.exe

C:\Windows\System\UVvYuHK.exe

C:\Windows\System\UVvYuHK.exe

C:\Windows\System\YAZmHtM.exe

C:\Windows\System\YAZmHtM.exe

C:\Windows\System\zOxnCNR.exe

C:\Windows\System\zOxnCNR.exe

C:\Windows\System\Eiysyiq.exe

C:\Windows\System\Eiysyiq.exe

C:\Windows\System\OlDVmzt.exe

C:\Windows\System\OlDVmzt.exe

C:\Windows\System\ipNxrPQ.exe

C:\Windows\System\ipNxrPQ.exe

C:\Windows\System\ebtBInA.exe

C:\Windows\System\ebtBInA.exe

C:\Windows\System\tQVfEcj.exe

C:\Windows\System\tQVfEcj.exe

C:\Windows\System\vszUUOR.exe

C:\Windows\System\vszUUOR.exe

C:\Windows\System\ZbMZdKv.exe

C:\Windows\System\ZbMZdKv.exe

C:\Windows\System\XCPSfkv.exe

C:\Windows\System\XCPSfkv.exe

C:\Windows\System\KmOiduF.exe

C:\Windows\System\KmOiduF.exe

C:\Windows\System\FLhzpsv.exe

C:\Windows\System\FLhzpsv.exe

C:\Windows\System\iwzAvfV.exe

C:\Windows\System\iwzAvfV.exe

C:\Windows\System\PGoJgto.exe

C:\Windows\System\PGoJgto.exe

C:\Windows\System\yJByZjC.exe

C:\Windows\System\yJByZjC.exe

C:\Windows\System\hacCcVK.exe

C:\Windows\System\hacCcVK.exe

C:\Windows\System\zJQoHEP.exe

C:\Windows\System\zJQoHEP.exe

C:\Windows\System\yIpAZcA.exe

C:\Windows\System\yIpAZcA.exe

C:\Windows\System\ttudDnM.exe

C:\Windows\System\ttudDnM.exe

C:\Windows\System\RMZAviX.exe

C:\Windows\System\RMZAviX.exe

C:\Windows\System\tKEYwmL.exe

C:\Windows\System\tKEYwmL.exe

C:\Windows\System\rHCZaBY.exe

C:\Windows\System\rHCZaBY.exe

C:\Windows\System\xSOFxkm.exe

C:\Windows\System\xSOFxkm.exe

C:\Windows\System\gueBYuo.exe

C:\Windows\System\gueBYuo.exe

C:\Windows\System\YTTagiE.exe

C:\Windows\System\YTTagiE.exe

C:\Windows\System\JNEouoW.exe

C:\Windows\System\JNEouoW.exe

C:\Windows\System\ZwcvERn.exe

C:\Windows\System\ZwcvERn.exe

C:\Windows\System\jOQNoqn.exe

C:\Windows\System\jOQNoqn.exe

C:\Windows\System\pIDWHAS.exe

C:\Windows\System\pIDWHAS.exe

C:\Windows\System\LiXlpFV.exe

C:\Windows\System\LiXlpFV.exe

C:\Windows\System\kdCFKCB.exe

C:\Windows\System\kdCFKCB.exe

C:\Windows\System\FDswfDt.exe

C:\Windows\System\FDswfDt.exe

C:\Windows\System\yFDnUwc.exe

C:\Windows\System\yFDnUwc.exe

C:\Windows\System\njEcZAi.exe

C:\Windows\System\njEcZAi.exe

C:\Windows\System\kwcSJFn.exe

C:\Windows\System\kwcSJFn.exe

C:\Windows\System\BwjONRW.exe

C:\Windows\System\BwjONRW.exe

C:\Windows\System\hkLBYgx.exe

C:\Windows\System\hkLBYgx.exe

C:\Windows\System\FwAENSa.exe

C:\Windows\System\FwAENSa.exe

C:\Windows\System\QPLSWin.exe

C:\Windows\System\QPLSWin.exe

C:\Windows\System\PLztkxk.exe

C:\Windows\System\PLztkxk.exe

C:\Windows\System\kghzlxR.exe

C:\Windows\System\kghzlxR.exe

C:\Windows\System\hafFCZu.exe

C:\Windows\System\hafFCZu.exe

C:\Windows\System\Brxynzp.exe

C:\Windows\System\Brxynzp.exe

C:\Windows\System\FbbFkoG.exe

C:\Windows\System\FbbFkoG.exe

C:\Windows\System\jUYQoma.exe

C:\Windows\System\jUYQoma.exe

C:\Windows\System\ASWXEXf.exe

C:\Windows\System\ASWXEXf.exe

C:\Windows\System\TPpDdEo.exe

C:\Windows\System\TPpDdEo.exe

C:\Windows\System\PhEpjjv.exe

C:\Windows\System\PhEpjjv.exe

C:\Windows\System\YPydslS.exe

C:\Windows\System\YPydslS.exe

C:\Windows\System\pJFzYfl.exe

C:\Windows\System\pJFzYfl.exe

C:\Windows\System\MDBGxIZ.exe

C:\Windows\System\MDBGxIZ.exe

C:\Windows\System\PptjWsq.exe

C:\Windows\System\PptjWsq.exe

C:\Windows\System\McsciZR.exe

C:\Windows\System\McsciZR.exe

C:\Windows\System\KTSSGcb.exe

C:\Windows\System\KTSSGcb.exe

C:\Windows\System\TyUVXoh.exe

C:\Windows\System\TyUVXoh.exe

C:\Windows\System\fGvYPuL.exe

C:\Windows\System\fGvYPuL.exe

C:\Windows\System\CIcTqFN.exe

C:\Windows\System\CIcTqFN.exe

C:\Windows\System\HoqCRIm.exe

C:\Windows\System\HoqCRIm.exe

C:\Windows\System\WIvrBxe.exe

C:\Windows\System\WIvrBxe.exe

C:\Windows\System\dNRTuZs.exe

C:\Windows\System\dNRTuZs.exe

C:\Windows\System\xbUnSzf.exe

C:\Windows\System\xbUnSzf.exe

C:\Windows\System\gAxGxmK.exe

C:\Windows\System\gAxGxmK.exe

C:\Windows\System\HgDHAkG.exe

C:\Windows\System\HgDHAkG.exe

C:\Windows\System\PbLmPmz.exe

C:\Windows\System\PbLmPmz.exe

C:\Windows\System\rNGrfLr.exe

C:\Windows\System\rNGrfLr.exe

C:\Windows\System\GBKVFoo.exe

C:\Windows\System\GBKVFoo.exe

C:\Windows\System\AWSleev.exe

C:\Windows\System\AWSleev.exe

C:\Windows\System\xcsfTxW.exe

C:\Windows\System\xcsfTxW.exe

C:\Windows\System\ktJiAjp.exe

C:\Windows\System\ktJiAjp.exe

C:\Windows\System\JbgpPUK.exe

C:\Windows\System\JbgpPUK.exe

C:\Windows\System\xQLHIjA.exe

C:\Windows\System\xQLHIjA.exe

C:\Windows\System\LTiCimJ.exe

C:\Windows\System\LTiCimJ.exe

C:\Windows\System\znWtVSm.exe

C:\Windows\System\znWtVSm.exe

C:\Windows\System\PkfJioT.exe

C:\Windows\System\PkfJioT.exe

C:\Windows\System\zNnhnQN.exe

C:\Windows\System\zNnhnQN.exe

C:\Windows\System\ZGKHtLj.exe

C:\Windows\System\ZGKHtLj.exe

C:\Windows\System\COlzThr.exe

C:\Windows\System\COlzThr.exe

C:\Windows\System\lEkQlRf.exe

C:\Windows\System\lEkQlRf.exe

C:\Windows\System\GCipzzh.exe

C:\Windows\System\GCipzzh.exe

C:\Windows\System\oirsryd.exe

C:\Windows\System\oirsryd.exe

C:\Windows\System\jrWoqsV.exe

C:\Windows\System\jrWoqsV.exe

C:\Windows\System\kwCcuVy.exe

C:\Windows\System\kwCcuVy.exe

C:\Windows\System\IxaRIQq.exe

C:\Windows\System\IxaRIQq.exe

C:\Windows\System\kinFjNP.exe

C:\Windows\System\kinFjNP.exe

C:\Windows\System\gFZCjNn.exe

C:\Windows\System\gFZCjNn.exe

C:\Windows\System\GeJrEzg.exe

C:\Windows\System\GeJrEzg.exe

C:\Windows\System\eCZpsEW.exe

C:\Windows\System\eCZpsEW.exe

C:\Windows\System\mpNDPia.exe

C:\Windows\System\mpNDPia.exe

C:\Windows\System\ggQXFFw.exe

C:\Windows\System\ggQXFFw.exe

C:\Windows\System\aOlEoHa.exe

C:\Windows\System\aOlEoHa.exe

C:\Windows\System\IKDYtgY.exe

C:\Windows\System\IKDYtgY.exe

C:\Windows\System\eLcfdAN.exe

C:\Windows\System\eLcfdAN.exe

C:\Windows\System\DCkbvSg.exe

C:\Windows\System\DCkbvSg.exe

C:\Windows\System\JccEkyK.exe

C:\Windows\System\JccEkyK.exe

C:\Windows\System\JirkfDi.exe

C:\Windows\System\JirkfDi.exe

C:\Windows\System\WuqWiUl.exe

C:\Windows\System\WuqWiUl.exe

C:\Windows\System\VepVBns.exe

C:\Windows\System\VepVBns.exe

C:\Windows\System\rqzWOJE.exe

C:\Windows\System\rqzWOJE.exe

C:\Windows\System\YuEYtxQ.exe

C:\Windows\System\YuEYtxQ.exe

C:\Windows\System\BYGlZiW.exe

C:\Windows\System\BYGlZiW.exe

C:\Windows\System\rXrYNUD.exe

C:\Windows\System\rXrYNUD.exe

C:\Windows\System\cUXyWJa.exe

C:\Windows\System\cUXyWJa.exe

C:\Windows\System\YymVzSx.exe

C:\Windows\System\YymVzSx.exe

C:\Windows\System\qcWkeBt.exe

C:\Windows\System\qcWkeBt.exe

C:\Windows\System\ESyjBdX.exe

C:\Windows\System\ESyjBdX.exe

C:\Windows\System\NkidJdr.exe

C:\Windows\System\NkidJdr.exe

C:\Windows\System\EDEvrLT.exe

C:\Windows\System\EDEvrLT.exe

C:\Windows\System\FNUvYDf.exe

C:\Windows\System\FNUvYDf.exe

C:\Windows\System\trormun.exe

C:\Windows\System\trormun.exe

C:\Windows\System\BSdnviJ.exe

C:\Windows\System\BSdnviJ.exe

C:\Windows\System\mmFrCwC.exe

C:\Windows\System\mmFrCwC.exe

C:\Windows\System\AexPweN.exe

C:\Windows\System\AexPweN.exe

C:\Windows\System\IFIkVlN.exe

C:\Windows\System\IFIkVlN.exe

C:\Windows\System\MNTWghJ.exe

C:\Windows\System\MNTWghJ.exe

C:\Windows\System\qOMDiQb.exe

C:\Windows\System\qOMDiQb.exe

C:\Windows\System\zxkdJdu.exe

C:\Windows\System\zxkdJdu.exe

C:\Windows\System\xRUMVYF.exe

C:\Windows\System\xRUMVYF.exe

C:\Windows\System\FiNuIac.exe

C:\Windows\System\FiNuIac.exe

C:\Windows\System\UCoQMxj.exe

C:\Windows\System\UCoQMxj.exe

C:\Windows\System\QPFHbbt.exe

C:\Windows\System\QPFHbbt.exe

C:\Windows\System\lfHZWvg.exe

C:\Windows\System\lfHZWvg.exe

C:\Windows\System\TcqszGa.exe

C:\Windows\System\TcqszGa.exe

C:\Windows\System\SyoDhSJ.exe

C:\Windows\System\SyoDhSJ.exe

C:\Windows\System\wqpEUwT.exe

C:\Windows\System\wqpEUwT.exe

C:\Windows\System\QBaTQfT.exe

C:\Windows\System\QBaTQfT.exe

C:\Windows\System\MQMdreL.exe

C:\Windows\System\MQMdreL.exe

C:\Windows\System\drLGzYD.exe

C:\Windows\System\drLGzYD.exe

C:\Windows\System\BzRrYlW.exe

C:\Windows\System\BzRrYlW.exe

C:\Windows\System\eGAntzQ.exe

C:\Windows\System\eGAntzQ.exe

C:\Windows\System\WYSThXA.exe

C:\Windows\System\WYSThXA.exe

C:\Windows\System\zMyQBGM.exe

C:\Windows\System\zMyQBGM.exe

C:\Windows\System\DpyevJf.exe

C:\Windows\System\DpyevJf.exe

C:\Windows\System\FmdmZXj.exe

C:\Windows\System\FmdmZXj.exe

C:\Windows\System\EaRVlEn.exe

C:\Windows\System\EaRVlEn.exe

C:\Windows\System\xrikqPr.exe

C:\Windows\System\xrikqPr.exe

C:\Windows\System\AHRawBP.exe

C:\Windows\System\AHRawBP.exe

C:\Windows\System\aiCxIss.exe

C:\Windows\System\aiCxIss.exe

C:\Windows\System\TQmWqzJ.exe

C:\Windows\System\TQmWqzJ.exe

C:\Windows\System\HpsuQfT.exe

C:\Windows\System\HpsuQfT.exe

C:\Windows\System\hUvHuzu.exe

C:\Windows\System\hUvHuzu.exe

C:\Windows\System\kybYPSK.exe

C:\Windows\System\kybYPSK.exe

C:\Windows\System\oiWBzfV.exe

C:\Windows\System\oiWBzfV.exe

C:\Windows\System\DHAFnCO.exe

C:\Windows\System\DHAFnCO.exe

C:\Windows\System\KjaiyXS.exe

C:\Windows\System\KjaiyXS.exe

C:\Windows\System\PVlVodS.exe

C:\Windows\System\PVlVodS.exe

C:\Windows\System\oJyOAhw.exe

C:\Windows\System\oJyOAhw.exe

C:\Windows\System\avMAgVZ.exe

C:\Windows\System\avMAgVZ.exe

C:\Windows\System\isJDIhW.exe

C:\Windows\System\isJDIhW.exe

C:\Windows\System\dxlUAvw.exe

C:\Windows\System\dxlUAvw.exe

C:\Windows\System\YpZNXaz.exe

C:\Windows\System\YpZNXaz.exe

C:\Windows\System\mieGyei.exe

C:\Windows\System\mieGyei.exe

C:\Windows\System\TlzzeLB.exe

C:\Windows\System\TlzzeLB.exe

C:\Windows\System\xNhNBRn.exe

C:\Windows\System\xNhNBRn.exe

C:\Windows\System\SdIDTpz.exe

C:\Windows\System\SdIDTpz.exe

C:\Windows\System\BVpMLSO.exe

C:\Windows\System\BVpMLSO.exe

C:\Windows\System\cMZmYLq.exe

C:\Windows\System\cMZmYLq.exe

C:\Windows\System\fJHbDAk.exe

C:\Windows\System\fJHbDAk.exe

C:\Windows\System\UOyLVQD.exe

C:\Windows\System\UOyLVQD.exe

C:\Windows\System\FzFLpRu.exe

C:\Windows\System\FzFLpRu.exe

C:\Windows\System\xHWydJK.exe

C:\Windows\System\xHWydJK.exe

C:\Windows\System\APjMQLn.exe

C:\Windows\System\APjMQLn.exe

C:\Windows\System\dLUrMJS.exe

C:\Windows\System\dLUrMJS.exe

C:\Windows\System\OjooYcK.exe

C:\Windows\System\OjooYcK.exe

C:\Windows\System\OwHQsRO.exe

C:\Windows\System\OwHQsRO.exe

C:\Windows\System\WzedSkZ.exe

C:\Windows\System\WzedSkZ.exe

C:\Windows\System\PHIdxtI.exe

C:\Windows\System\PHIdxtI.exe

C:\Windows\System\cJlwaXO.exe

C:\Windows\System\cJlwaXO.exe

C:\Windows\System\LvpKcMj.exe

C:\Windows\System\LvpKcMj.exe

C:\Windows\System\AfLYfex.exe

C:\Windows\System\AfLYfex.exe

C:\Windows\System\TTxYwUS.exe

C:\Windows\System\TTxYwUS.exe

C:\Windows\System\YbikKfz.exe

C:\Windows\System\YbikKfz.exe

C:\Windows\System\duGmbIY.exe

C:\Windows\System\duGmbIY.exe

C:\Windows\System\MznLMWN.exe

C:\Windows\System\MznLMWN.exe

C:\Windows\System\JWuARDi.exe

C:\Windows\System\JWuARDi.exe

C:\Windows\System\AwdoZBz.exe

C:\Windows\System\AwdoZBz.exe

C:\Windows\System\yBlEpVY.exe

C:\Windows\System\yBlEpVY.exe

C:\Windows\System\wvcjMnM.exe

C:\Windows\System\wvcjMnM.exe

C:\Windows\System\JTtjUca.exe

C:\Windows\System\JTtjUca.exe

C:\Windows\System\njmDbRH.exe

C:\Windows\System\njmDbRH.exe

C:\Windows\System\kFOXqoc.exe

C:\Windows\System\kFOXqoc.exe

C:\Windows\System\ZIwfeaz.exe

C:\Windows\System\ZIwfeaz.exe

C:\Windows\System\jANHhCM.exe

C:\Windows\System\jANHhCM.exe

C:\Windows\System\FmtfqQc.exe

C:\Windows\System\FmtfqQc.exe

C:\Windows\System\LrapunV.exe

C:\Windows\System\LrapunV.exe

C:\Windows\System\MeLzZuT.exe

C:\Windows\System\MeLzZuT.exe

C:\Windows\System\KWRASgY.exe

C:\Windows\System\KWRASgY.exe

C:\Windows\System\UDsyIiO.exe

C:\Windows\System\UDsyIiO.exe

C:\Windows\System\nDKFxFR.exe

C:\Windows\System\nDKFxFR.exe

C:\Windows\System\QNznjae.exe

C:\Windows\System\QNznjae.exe

C:\Windows\System\twpprDP.exe

C:\Windows\System\twpprDP.exe

C:\Windows\System\gBwmhuT.exe

C:\Windows\System\gBwmhuT.exe

C:\Windows\System\ZJPDdIt.exe

C:\Windows\System\ZJPDdIt.exe

C:\Windows\System\yrzxuIt.exe

C:\Windows\System\yrzxuIt.exe

C:\Windows\System\FmpnpRC.exe

C:\Windows\System\FmpnpRC.exe

C:\Windows\System\svFBJNX.exe

C:\Windows\System\svFBJNX.exe

C:\Windows\System\uPGNkCe.exe

C:\Windows\System\uPGNkCe.exe

C:\Windows\System\fywMOqy.exe

C:\Windows\System\fywMOqy.exe

C:\Windows\System\MeGemBn.exe

C:\Windows\System\MeGemBn.exe

C:\Windows\System\hRPRihC.exe

C:\Windows\System\hRPRihC.exe

C:\Windows\System\sVYOKYW.exe

C:\Windows\System\sVYOKYW.exe

C:\Windows\System\YgKyJMK.exe

C:\Windows\System\YgKyJMK.exe

C:\Windows\System\webOhWh.exe

C:\Windows\System\webOhWh.exe

C:\Windows\System\trLumBV.exe

C:\Windows\System\trLumBV.exe

C:\Windows\System\xVCUSZg.exe

C:\Windows\System\xVCUSZg.exe

C:\Windows\System\FHYEUoz.exe

C:\Windows\System\FHYEUoz.exe

C:\Windows\System\mUdacnV.exe

C:\Windows\System\mUdacnV.exe

C:\Windows\System\nLoqmyT.exe

C:\Windows\System\nLoqmyT.exe

C:\Windows\System\FHkqVsw.exe

C:\Windows\System\FHkqVsw.exe

C:\Windows\System\vrGiQXD.exe

C:\Windows\System\vrGiQXD.exe

C:\Windows\System\TglCSZE.exe

C:\Windows\System\TglCSZE.exe

C:\Windows\System\deGFZNl.exe

C:\Windows\System\deGFZNl.exe

C:\Windows\System\RdJmIDZ.exe

C:\Windows\System\RdJmIDZ.exe

C:\Windows\System\giRswle.exe

C:\Windows\System\giRswle.exe

C:\Windows\System\CPFFNaA.exe

C:\Windows\System\CPFFNaA.exe

C:\Windows\System\zyAkOFc.exe

C:\Windows\System\zyAkOFc.exe

C:\Windows\System\NoIpFil.exe

C:\Windows\System\NoIpFil.exe

C:\Windows\System\dKAbajh.exe

C:\Windows\System\dKAbajh.exe

C:\Windows\System\gBjZpWa.exe

C:\Windows\System\gBjZpWa.exe

C:\Windows\System\MyzukEd.exe

C:\Windows\System\MyzukEd.exe

C:\Windows\System\PYDNqgS.exe

C:\Windows\System\PYDNqgS.exe

C:\Windows\System\lhmujFE.exe

C:\Windows\System\lhmujFE.exe

C:\Windows\System\rnZrEkm.exe

C:\Windows\System\rnZrEkm.exe

C:\Windows\System\ujtLyGi.exe

C:\Windows\System\ujtLyGi.exe

C:\Windows\System\uimBYuo.exe

C:\Windows\System\uimBYuo.exe

C:\Windows\System\zvrQOVd.exe

C:\Windows\System\zvrQOVd.exe

C:\Windows\System\AhtyCZu.exe

C:\Windows\System\AhtyCZu.exe

C:\Windows\System\qBqPQQi.exe

C:\Windows\System\qBqPQQi.exe

C:\Windows\System\DflfsJt.exe

C:\Windows\System\DflfsJt.exe

C:\Windows\System\fVpwXLN.exe

C:\Windows\System\fVpwXLN.exe

C:\Windows\System\zWudGfG.exe

C:\Windows\System\zWudGfG.exe

C:\Windows\System\IQqIneq.exe

C:\Windows\System\IQqIneq.exe

C:\Windows\System\dMWKWrD.exe

C:\Windows\System\dMWKWrD.exe

C:\Windows\System\JHeBjIW.exe

C:\Windows\System\JHeBjIW.exe

C:\Windows\System\QfyNUCm.exe

C:\Windows\System\QfyNUCm.exe

C:\Windows\System\DOjHCrR.exe

C:\Windows\System\DOjHCrR.exe

C:\Windows\System\tgKisOT.exe

C:\Windows\System\tgKisOT.exe

C:\Windows\System\CxJHitc.exe

C:\Windows\System\CxJHitc.exe

C:\Windows\System\ixTBICu.exe

C:\Windows\System\ixTBICu.exe

C:\Windows\System\vLflKsn.exe

C:\Windows\System\vLflKsn.exe

C:\Windows\System\KpdMWzA.exe

C:\Windows\System\KpdMWzA.exe

C:\Windows\System\dgVvNWq.exe

C:\Windows\System\dgVvNWq.exe

C:\Windows\System\NfdHzVo.exe

C:\Windows\System\NfdHzVo.exe

C:\Windows\System\NBEygNT.exe

C:\Windows\System\NBEygNT.exe

C:\Windows\System\NwcqdVy.exe

C:\Windows\System\NwcqdVy.exe

C:\Windows\System\XQfcyUS.exe

C:\Windows\System\XQfcyUS.exe

C:\Windows\System\BGydvnY.exe

C:\Windows\System\BGydvnY.exe

C:\Windows\System\aNDnbAY.exe

C:\Windows\System\aNDnbAY.exe

C:\Windows\System\ZoHZhiS.exe

C:\Windows\System\ZoHZhiS.exe

C:\Windows\System\apsdxLc.exe

C:\Windows\System\apsdxLc.exe

C:\Windows\System\LFjfBRj.exe

C:\Windows\System\LFjfBRj.exe

C:\Windows\System\YxqgwRX.exe

C:\Windows\System\YxqgwRX.exe

C:\Windows\System\uPtOvjP.exe

C:\Windows\System\uPtOvjP.exe

C:\Windows\System\DuXBRtJ.exe

C:\Windows\System\DuXBRtJ.exe

C:\Windows\System\hfDuJKO.exe

C:\Windows\System\hfDuJKO.exe

C:\Windows\System\jgueRZL.exe

C:\Windows\System\jgueRZL.exe

C:\Windows\System\TBhZGCC.exe

C:\Windows\System\TBhZGCC.exe

C:\Windows\System\ZjDXIDd.exe

C:\Windows\System\ZjDXIDd.exe

C:\Windows\System\GVEBxiI.exe

C:\Windows\System\GVEBxiI.exe

C:\Windows\System\QILZRUn.exe

C:\Windows\System\QILZRUn.exe

C:\Windows\System\JMmFYdt.exe

C:\Windows\System\JMmFYdt.exe

C:\Windows\System\DWpZTla.exe

C:\Windows\System\DWpZTla.exe

C:\Windows\System\PpFIooq.exe

C:\Windows\System\PpFIooq.exe

C:\Windows\System\tkAzxRc.exe

C:\Windows\System\tkAzxRc.exe

C:\Windows\System\awRbFfa.exe

C:\Windows\System\awRbFfa.exe

C:\Windows\System\rjEEshm.exe

C:\Windows\System\rjEEshm.exe

C:\Windows\System\PaQZdIZ.exe

C:\Windows\System\PaQZdIZ.exe

C:\Windows\System\EKKAzCB.exe

C:\Windows\System\EKKAzCB.exe

C:\Windows\System\pSOKsAK.exe

C:\Windows\System\pSOKsAK.exe

C:\Windows\System\XiYvsFQ.exe

C:\Windows\System\XiYvsFQ.exe

C:\Windows\System\pRZTngp.exe

C:\Windows\System\pRZTngp.exe

C:\Windows\System\MHAsmjr.exe

C:\Windows\System\MHAsmjr.exe

C:\Windows\System\GXdtskr.exe

C:\Windows\System\GXdtskr.exe

C:\Windows\System\YYzwegL.exe

C:\Windows\System\YYzwegL.exe

C:\Windows\System\HIXFAJk.exe

C:\Windows\System\HIXFAJk.exe

C:\Windows\System\rsDheFO.exe

C:\Windows\System\rsDheFO.exe

C:\Windows\System\gCKtWmq.exe

C:\Windows\System\gCKtWmq.exe

C:\Windows\System\xObfgTh.exe

C:\Windows\System\xObfgTh.exe

C:\Windows\System\pVHotIe.exe

C:\Windows\System\pVHotIe.exe

C:\Windows\System\kJWqzCS.exe

C:\Windows\System\kJWqzCS.exe

C:\Windows\System\OPAjNmy.exe

C:\Windows\System\OPAjNmy.exe

C:\Windows\System\CCYeGvm.exe

C:\Windows\System\CCYeGvm.exe

C:\Windows\System\ffZVgYl.exe

C:\Windows\System\ffZVgYl.exe

C:\Windows\System\ZVfviCt.exe

C:\Windows\System\ZVfviCt.exe

C:\Windows\System\rcWtBzB.exe

C:\Windows\System\rcWtBzB.exe

C:\Windows\System\pDwLwSu.exe

C:\Windows\System\pDwLwSu.exe

C:\Windows\System\JIFoRlV.exe

C:\Windows\System\JIFoRlV.exe

C:\Windows\System\DTartoB.exe

C:\Windows\System\DTartoB.exe

C:\Windows\System\dOMqriD.exe

C:\Windows\System\dOMqriD.exe

C:\Windows\System\nXEURtr.exe

C:\Windows\System\nXEURtr.exe

C:\Windows\System\iBVIMFv.exe

C:\Windows\System\iBVIMFv.exe

C:\Windows\System\ZcEFoCC.exe

C:\Windows\System\ZcEFoCC.exe

C:\Windows\System\waMUvLo.exe

C:\Windows\System\waMUvLo.exe

C:\Windows\System\nRejhhJ.exe

C:\Windows\System\nRejhhJ.exe

C:\Windows\System\CFqpKDT.exe

C:\Windows\System\CFqpKDT.exe

C:\Windows\System\gKkcPma.exe

C:\Windows\System\gKkcPma.exe

C:\Windows\System\vinRxNn.exe

C:\Windows\System\vinRxNn.exe

C:\Windows\System\OvrHhIG.exe

C:\Windows\System\OvrHhIG.exe

C:\Windows\System\uCGBkYK.exe

C:\Windows\System\uCGBkYK.exe

C:\Windows\System\UOfsmOv.exe

C:\Windows\System\UOfsmOv.exe

C:\Windows\System\FNyibPG.exe

C:\Windows\System\FNyibPG.exe

C:\Windows\System\xBHxJAc.exe

C:\Windows\System\xBHxJAc.exe

C:\Windows\System\LwOrKCy.exe

C:\Windows\System\LwOrKCy.exe

C:\Windows\System\ugGjNov.exe

C:\Windows\System\ugGjNov.exe

C:\Windows\System\hOfmvlS.exe

C:\Windows\System\hOfmvlS.exe

C:\Windows\System\pxjXADz.exe

C:\Windows\System\pxjXADz.exe

C:\Windows\System\mINVvfj.exe

C:\Windows\System\mINVvfj.exe

C:\Windows\System\ixwLMsB.exe

C:\Windows\System\ixwLMsB.exe

C:\Windows\System\iLHKuXD.exe

C:\Windows\System\iLHKuXD.exe

C:\Windows\System\DztACOO.exe

C:\Windows\System\DztACOO.exe

C:\Windows\System\sgEHMSe.exe

C:\Windows\System\sgEHMSe.exe

C:\Windows\System\jAyEeGz.exe

C:\Windows\System\jAyEeGz.exe

C:\Windows\System\IeOnYNw.exe

C:\Windows\System\IeOnYNw.exe

C:\Windows\System\JTflcql.exe

C:\Windows\System\JTflcql.exe

C:\Windows\System\WVoZPqr.exe

C:\Windows\System\WVoZPqr.exe

C:\Windows\System\vklQDlR.exe

C:\Windows\System\vklQDlR.exe

C:\Windows\System\tPRRkSk.exe

C:\Windows\System\tPRRkSk.exe

C:\Windows\System\FRTNkwh.exe

C:\Windows\System\FRTNkwh.exe

C:\Windows\System\emufdSE.exe

C:\Windows\System\emufdSE.exe

C:\Windows\System\mlJfDOh.exe

C:\Windows\System\mlJfDOh.exe

C:\Windows\System\HStRHEz.exe

C:\Windows\System\HStRHEz.exe

C:\Windows\System\dboVhXD.exe

C:\Windows\System\dboVhXD.exe

C:\Windows\System\dGZCZsA.exe

C:\Windows\System\dGZCZsA.exe

C:\Windows\System\pyUoFKs.exe

C:\Windows\System\pyUoFKs.exe

C:\Windows\System\AAcSNCS.exe

C:\Windows\System\AAcSNCS.exe

C:\Windows\System\GZGRIHz.exe

C:\Windows\System\GZGRIHz.exe

C:\Windows\System\zvRqMUQ.exe

C:\Windows\System\zvRqMUQ.exe

C:\Windows\System\JSXOZWp.exe

C:\Windows\System\JSXOZWp.exe

C:\Windows\System\CdxkPpP.exe

C:\Windows\System\CdxkPpP.exe

C:\Windows\System\SpajVUW.exe

C:\Windows\System\SpajVUW.exe

C:\Windows\System\BvIehOy.exe

C:\Windows\System\BvIehOy.exe

C:\Windows\System\aXUdRQO.exe

C:\Windows\System\aXUdRQO.exe

C:\Windows\System\NrLlthq.exe

C:\Windows\System\NrLlthq.exe

C:\Windows\System\UePQNyL.exe

C:\Windows\System\UePQNyL.exe

C:\Windows\System\sCWdHrk.exe

C:\Windows\System\sCWdHrk.exe

C:\Windows\System\xTRqoSy.exe

C:\Windows\System\xTRqoSy.exe

C:\Windows\System\aaFaXwP.exe

C:\Windows\System\aaFaXwP.exe

C:\Windows\System\cQybmKN.exe

C:\Windows\System\cQybmKN.exe

C:\Windows\System\BKEHGwm.exe

C:\Windows\System\BKEHGwm.exe

C:\Windows\System\farkrkU.exe

C:\Windows\System\farkrkU.exe

C:\Windows\System\PyIFnrm.exe

C:\Windows\System\PyIFnrm.exe

C:\Windows\System\IXdwIoa.exe

C:\Windows\System\IXdwIoa.exe

C:\Windows\System\PCKJGUW.exe

C:\Windows\System\PCKJGUW.exe

C:\Windows\System\mgOpDtz.exe

C:\Windows\System\mgOpDtz.exe

C:\Windows\System\sZvvYBB.exe

C:\Windows\System\sZvvYBB.exe

C:\Windows\System\vKRqjwG.exe

C:\Windows\System\vKRqjwG.exe

C:\Windows\System\JDmgXVK.exe

C:\Windows\System\JDmgXVK.exe

C:\Windows\System\cFbygni.exe

C:\Windows\System\cFbygni.exe

C:\Windows\System\icaqXMf.exe

C:\Windows\System\icaqXMf.exe

C:\Windows\System\bPIPtjJ.exe

C:\Windows\System\bPIPtjJ.exe

C:\Windows\System\EVTBhxv.exe

C:\Windows\System\EVTBhxv.exe

C:\Windows\System\wvvYmLr.exe

C:\Windows\System\wvvYmLr.exe

C:\Windows\System\mYauaVD.exe

C:\Windows\System\mYauaVD.exe

C:\Windows\System\TathLmb.exe

C:\Windows\System\TathLmb.exe

C:\Windows\System\KjAQOIl.exe

C:\Windows\System\KjAQOIl.exe

C:\Windows\System\NCdloBD.exe

C:\Windows\System\NCdloBD.exe

C:\Windows\System\tUNFvCl.exe

C:\Windows\System\tUNFvCl.exe

C:\Windows\System\leeQefz.exe

C:\Windows\System\leeQefz.exe

C:\Windows\System\mLOxLEP.exe

C:\Windows\System\mLOxLEP.exe

C:\Windows\System\AEQJwUY.exe

C:\Windows\System\AEQJwUY.exe

C:\Windows\System\qujvnDd.exe

C:\Windows\System\qujvnDd.exe

C:\Windows\System\rPEGVaR.exe

C:\Windows\System\rPEGVaR.exe

C:\Windows\System\veenses.exe

C:\Windows\System\veenses.exe

C:\Windows\System\LMDtZCC.exe

C:\Windows\System\LMDtZCC.exe

C:\Windows\System\hlYXwRM.exe

C:\Windows\System\hlYXwRM.exe

C:\Windows\System\vCUJQOh.exe

C:\Windows\System\vCUJQOh.exe

C:\Windows\System\omhySHI.exe

C:\Windows\System\omhySHI.exe

C:\Windows\System\VKytnWJ.exe

C:\Windows\System\VKytnWJ.exe

C:\Windows\System\yOtXovZ.exe

C:\Windows\System\yOtXovZ.exe

C:\Windows\System\eBSgNmk.exe

C:\Windows\System\eBSgNmk.exe

C:\Windows\System\SHsmYwU.exe

C:\Windows\System\SHsmYwU.exe

C:\Windows\System\pLgTyUP.exe

C:\Windows\System\pLgTyUP.exe

C:\Windows\System\fdoydub.exe

C:\Windows\System\fdoydub.exe

C:\Windows\System\aKnjTzH.exe

C:\Windows\System\aKnjTzH.exe

C:\Windows\System\fJQCfGk.exe

C:\Windows\System\fJQCfGk.exe

C:\Windows\System\cDPtTJV.exe

C:\Windows\System\cDPtTJV.exe

C:\Windows\System\OfFJYMT.exe

C:\Windows\System\OfFJYMT.exe

C:\Windows\System\soClpmJ.exe

C:\Windows\System\soClpmJ.exe

C:\Windows\System\bEVVeXx.exe

C:\Windows\System\bEVVeXx.exe

C:\Windows\System\DdqbrMh.exe

C:\Windows\System\DdqbrMh.exe

C:\Windows\System\VXKQjYf.exe

C:\Windows\System\VXKQjYf.exe

C:\Windows\System\kutVSWi.exe

C:\Windows\System\kutVSWi.exe

C:\Windows\System\PhBUAwt.exe

C:\Windows\System\PhBUAwt.exe

C:\Windows\System\FfVEHYu.exe

C:\Windows\System\FfVEHYu.exe

C:\Windows\System\ZlkRkCW.exe

C:\Windows\System\ZlkRkCW.exe

C:\Windows\System\EGzkMWK.exe

C:\Windows\System\EGzkMWK.exe

C:\Windows\System\mgSONZo.exe

C:\Windows\System\mgSONZo.exe

C:\Windows\System\hmlClFW.exe

C:\Windows\System\hmlClFW.exe

C:\Windows\System\rhjLBEL.exe

C:\Windows\System\rhjLBEL.exe

C:\Windows\System\zhOjGRx.exe

C:\Windows\System\zhOjGRx.exe

C:\Windows\System\fKxxbWq.exe

C:\Windows\System\fKxxbWq.exe

C:\Windows\System\tjHFAph.exe

C:\Windows\System\tjHFAph.exe

C:\Windows\System\hUpnOTN.exe

C:\Windows\System\hUpnOTN.exe

C:\Windows\System\JeaqxNo.exe

C:\Windows\System\JeaqxNo.exe

C:\Windows\System\cSAKRcZ.exe

C:\Windows\System\cSAKRcZ.exe

C:\Windows\System\qdloLgc.exe

C:\Windows\System\qdloLgc.exe

C:\Windows\System\VQlsLwJ.exe

C:\Windows\System\VQlsLwJ.exe

C:\Windows\System\zFtISSq.exe

C:\Windows\System\zFtISSq.exe

C:\Windows\System\ryskKDC.exe

C:\Windows\System\ryskKDC.exe

C:\Windows\System\qGQARfQ.exe

C:\Windows\System\qGQARfQ.exe

C:\Windows\System\kyQKWrc.exe

C:\Windows\System\kyQKWrc.exe

C:\Windows\System\plFvZRn.exe

C:\Windows\System\plFvZRn.exe

C:\Windows\System\aaUDcjN.exe

C:\Windows\System\aaUDcjN.exe

C:\Windows\System\FrqFkzf.exe

C:\Windows\System\FrqFkzf.exe

C:\Windows\System\yKLNtZi.exe

C:\Windows\System\yKLNtZi.exe

C:\Windows\System\xFagdNL.exe

C:\Windows\System\xFagdNL.exe

C:\Windows\System\GUOOuJR.exe

C:\Windows\System\GUOOuJR.exe

C:\Windows\System\bSPgJpW.exe

C:\Windows\System\bSPgJpW.exe

C:\Windows\System\dkZlkHo.exe

C:\Windows\System\dkZlkHo.exe

C:\Windows\System\kJjqfzq.exe

C:\Windows\System\kJjqfzq.exe

C:\Windows\System\dkeJmZw.exe

C:\Windows\System\dkeJmZw.exe

C:\Windows\System\mziNSPw.exe

C:\Windows\System\mziNSPw.exe

C:\Windows\System\JzIzTCg.exe

C:\Windows\System\JzIzTCg.exe

C:\Windows\System\zdgiRbl.exe

C:\Windows\System\zdgiRbl.exe

C:\Windows\System\HBtriiQ.exe

C:\Windows\System\HBtriiQ.exe

C:\Windows\System\puOqFsY.exe

C:\Windows\System\puOqFsY.exe

C:\Windows\System\dknFixF.exe

C:\Windows\System\dknFixF.exe

C:\Windows\System\KuEzDBD.exe

C:\Windows\System\KuEzDBD.exe

C:\Windows\System\sKenIbI.exe

C:\Windows\System\sKenIbI.exe

C:\Windows\System\QEtngfm.exe

C:\Windows\System\QEtngfm.exe

C:\Windows\System\eSiWyPx.exe

C:\Windows\System\eSiWyPx.exe

C:\Windows\System\VdaUwNu.exe

C:\Windows\System\VdaUwNu.exe

C:\Windows\System\OKDPvny.exe

C:\Windows\System\OKDPvny.exe

C:\Windows\System\thMbsMG.exe

C:\Windows\System\thMbsMG.exe

C:\Windows\System\PrWzyYo.exe

C:\Windows\System\PrWzyYo.exe

C:\Windows\System\MyGpDFH.exe

C:\Windows\System\MyGpDFH.exe

C:\Windows\System\NbZloQU.exe

C:\Windows\System\NbZloQU.exe

C:\Windows\System\cbFXRQL.exe

C:\Windows\System\cbFXRQL.exe

C:\Windows\System\WynwIsJ.exe

C:\Windows\System\WynwIsJ.exe

C:\Windows\System\XxbsCUP.exe

C:\Windows\System\XxbsCUP.exe

C:\Windows\System\dxSxAaa.exe

C:\Windows\System\dxSxAaa.exe

C:\Windows\System\kjjALCD.exe

C:\Windows\System\kjjALCD.exe

C:\Windows\System\xfSyqks.exe

C:\Windows\System\xfSyqks.exe

C:\Windows\System\LSvGpHn.exe

C:\Windows\System\LSvGpHn.exe

C:\Windows\System\HQOWsVt.exe

C:\Windows\System\HQOWsVt.exe

C:\Windows\System\mOmVHPD.exe

C:\Windows\System\mOmVHPD.exe

C:\Windows\System\YDtWKMH.exe

C:\Windows\System\YDtWKMH.exe

C:\Windows\System\GwTMLYl.exe

C:\Windows\System\GwTMLYl.exe

C:\Windows\System\mGFNIRh.exe

C:\Windows\System\mGFNIRh.exe

C:\Windows\System\apcHeOe.exe

C:\Windows\System\apcHeOe.exe

C:\Windows\System\ukftsjX.exe

C:\Windows\System\ukftsjX.exe

C:\Windows\System\rqvFEkY.exe

C:\Windows\System\rqvFEkY.exe

C:\Windows\System\ygMMxPz.exe

C:\Windows\System\ygMMxPz.exe

C:\Windows\System\CwmUbue.exe

C:\Windows\System\CwmUbue.exe

C:\Windows\System\IOcLneK.exe

C:\Windows\System\IOcLneK.exe

C:\Windows\System\NkzHlMN.exe

C:\Windows\System\NkzHlMN.exe

C:\Windows\System\kTPvFIa.exe

C:\Windows\System\kTPvFIa.exe

C:\Windows\System\UMXiRwj.exe

C:\Windows\System\UMXiRwj.exe

C:\Windows\System\mRLXiTy.exe

C:\Windows\System\mRLXiTy.exe

C:\Windows\System\AlmMAZX.exe

C:\Windows\System\AlmMAZX.exe

C:\Windows\System\pwdMVhu.exe

C:\Windows\System\pwdMVhu.exe

C:\Windows\System\SssaNyF.exe

C:\Windows\System\SssaNyF.exe

C:\Windows\System\WMatzoL.exe

C:\Windows\System\WMatzoL.exe

C:\Windows\System\OrKQAbF.exe

C:\Windows\System\OrKQAbF.exe

C:\Windows\System\nXTFXKX.exe

C:\Windows\System\nXTFXKX.exe

C:\Windows\System\WBPpwhI.exe

C:\Windows\System\WBPpwhI.exe

C:\Windows\System\hYTcUIB.exe

C:\Windows\System\hYTcUIB.exe

C:\Windows\System\wzfxSXO.exe

C:\Windows\System\wzfxSXO.exe

C:\Windows\System\KSSkRdA.exe

C:\Windows\System\KSSkRdA.exe

C:\Windows\System\oxVapRj.exe

C:\Windows\System\oxVapRj.exe

C:\Windows\System\KQEUTMc.exe

C:\Windows\System\KQEUTMc.exe

C:\Windows\System\LIiXiij.exe

C:\Windows\System\LIiXiij.exe

C:\Windows\System\eaXMEpY.exe

C:\Windows\System\eaXMEpY.exe

C:\Windows\System\DtYEANy.exe

C:\Windows\System\DtYEANy.exe

C:\Windows\System\gQCVGGi.exe

C:\Windows\System\gQCVGGi.exe

C:\Windows\System\iwuHxaA.exe

C:\Windows\System\iwuHxaA.exe

C:\Windows\System\xzEfLBp.exe

C:\Windows\System\xzEfLBp.exe

C:\Windows\System\dRsZteo.exe

C:\Windows\System\dRsZteo.exe

C:\Windows\System\VKXWpad.exe

C:\Windows\System\VKXWpad.exe

C:\Windows\System\FtWfVam.exe

C:\Windows\System\FtWfVam.exe

C:\Windows\System\pIvEhIH.exe

C:\Windows\System\pIvEhIH.exe

C:\Windows\System\cUJgSHV.exe

C:\Windows\System\cUJgSHV.exe

C:\Windows\System\kRzLUqJ.exe

C:\Windows\System\kRzLUqJ.exe

C:\Windows\System\hRSDdwc.exe

C:\Windows\System\hRSDdwc.exe

C:\Windows\System\EHZNtGj.exe

C:\Windows\System\EHZNtGj.exe

C:\Windows\System\uHfFYov.exe

C:\Windows\System\uHfFYov.exe

C:\Windows\System\xWyxpFt.exe

C:\Windows\System\xWyxpFt.exe

C:\Windows\System\uYXHGXe.exe

C:\Windows\System\uYXHGXe.exe

C:\Windows\System\fhFuiwo.exe

C:\Windows\System\fhFuiwo.exe

C:\Windows\System\etyxiHA.exe

C:\Windows\System\etyxiHA.exe

C:\Windows\System\rRbWpMP.exe

C:\Windows\System\rRbWpMP.exe

C:\Windows\System\uglhdiV.exe

C:\Windows\System\uglhdiV.exe

C:\Windows\System\NmLFXtB.exe

C:\Windows\System\NmLFXtB.exe

C:\Windows\System\kBghlAi.exe

C:\Windows\System\kBghlAi.exe

C:\Windows\System\XwIIHax.exe

C:\Windows\System\XwIIHax.exe

C:\Windows\System\jCRKBHm.exe

C:\Windows\System\jCRKBHm.exe

C:\Windows\System\avaRULc.exe

C:\Windows\System\avaRULc.exe

C:\Windows\System\tqJBSNT.exe

C:\Windows\System\tqJBSNT.exe

C:\Windows\System\jHgyVNs.exe

C:\Windows\System\jHgyVNs.exe

C:\Windows\System\BFaFcCd.exe

C:\Windows\System\BFaFcCd.exe

C:\Windows\System\aafkwNE.exe

C:\Windows\System\aafkwNE.exe

C:\Windows\System\nAfJFKQ.exe

C:\Windows\System\nAfJFKQ.exe

C:\Windows\System\KSiWVpC.exe

C:\Windows\System\KSiWVpC.exe

C:\Windows\System\BKSORWe.exe

C:\Windows\System\BKSORWe.exe

C:\Windows\System\WfERkvL.exe

C:\Windows\System\WfERkvL.exe

C:\Windows\System\HoSXgfE.exe

C:\Windows\System\HoSXgfE.exe

C:\Windows\System\yhVwbRR.exe

C:\Windows\System\yhVwbRR.exe

C:\Windows\System\AhQAiZy.exe

C:\Windows\System\AhQAiZy.exe

C:\Windows\System\XeTdkdM.exe

C:\Windows\System\XeTdkdM.exe

C:\Windows\System\NPEmoRY.exe

C:\Windows\System\NPEmoRY.exe

C:\Windows\System\FUsgGLN.exe

C:\Windows\System\FUsgGLN.exe

C:\Windows\System\prfIkAw.exe

C:\Windows\System\prfIkAw.exe

C:\Windows\System\tzXSbFN.exe

C:\Windows\System\tzXSbFN.exe

C:\Windows\System\jjLtUpn.exe

C:\Windows\System\jjLtUpn.exe

C:\Windows\System\cAgPjtM.exe

C:\Windows\System\cAgPjtM.exe

C:\Windows\System\WiZixbm.exe

C:\Windows\System\WiZixbm.exe

C:\Windows\System\LVzdcXe.exe

C:\Windows\System\LVzdcXe.exe

C:\Windows\System\GUucfcY.exe

C:\Windows\System\GUucfcY.exe

C:\Windows\System\MpTvCrk.exe

C:\Windows\System\MpTvCrk.exe

C:\Windows\System\xAHXguF.exe

C:\Windows\System\xAHXguF.exe

C:\Windows\System\SFRePVC.exe

C:\Windows\System\SFRePVC.exe

C:\Windows\System\jkZhlei.exe

C:\Windows\System\jkZhlei.exe

C:\Windows\System\EDgznor.exe

C:\Windows\System\EDgznor.exe

C:\Windows\System\UUDhYbP.exe

C:\Windows\System\UUDhYbP.exe

C:\Windows\System\qhcNmFJ.exe

C:\Windows\System\qhcNmFJ.exe

C:\Windows\System\ujzluMR.exe

C:\Windows\System\ujzluMR.exe

C:\Windows\System\FYLIvZK.exe

C:\Windows\System\FYLIvZK.exe

C:\Windows\System\viogpkh.exe

C:\Windows\System\viogpkh.exe

C:\Windows\System\TFaZKLS.exe

C:\Windows\System\TFaZKLS.exe

C:\Windows\System\CVdyLjy.exe

C:\Windows\System\CVdyLjy.exe

C:\Windows\System\wilAHVt.exe

C:\Windows\System\wilAHVt.exe

C:\Windows\System\fMhiVbf.exe

C:\Windows\System\fMhiVbf.exe

C:\Windows\System\iITNtGd.exe

C:\Windows\System\iITNtGd.exe

C:\Windows\System\VHIjHVb.exe

C:\Windows\System\VHIjHVb.exe

C:\Windows\System\aLdQKuW.exe

C:\Windows\System\aLdQKuW.exe

C:\Windows\System\LCPwbpp.exe

C:\Windows\System\LCPwbpp.exe

C:\Windows\System\xyggrVw.exe

C:\Windows\System\xyggrVw.exe

C:\Windows\System\VkxPIhu.exe

C:\Windows\System\VkxPIhu.exe

C:\Windows\System\GrrCVdl.exe

C:\Windows\System\GrrCVdl.exe

C:\Windows\System\XEMHchw.exe

C:\Windows\System\XEMHchw.exe

C:\Windows\System\mWyIlvS.exe

C:\Windows\System\mWyIlvS.exe

C:\Windows\System\rVGjXwJ.exe

C:\Windows\System\rVGjXwJ.exe

C:\Windows\System\pmcEQgT.exe

C:\Windows\System\pmcEQgT.exe

C:\Windows\System\iHFMWeq.exe

C:\Windows\System\iHFMWeq.exe

C:\Windows\System\gNmWNtx.exe

C:\Windows\System\gNmWNtx.exe

C:\Windows\System\CqZRkrb.exe

C:\Windows\System\CqZRkrb.exe

C:\Windows\System\RbzLHoH.exe

C:\Windows\System\RbzLHoH.exe

C:\Windows\System\yfWwZum.exe

C:\Windows\System\yfWwZum.exe

C:\Windows\System\kjjoEJv.exe

C:\Windows\System\kjjoEJv.exe

C:\Windows\System\nYwdSEc.exe

C:\Windows\System\nYwdSEc.exe

C:\Windows\System\QJSLdXs.exe

C:\Windows\System\QJSLdXs.exe

C:\Windows\System\GBafvqE.exe

C:\Windows\System\GBafvqE.exe

C:\Windows\System\qxOdowH.exe

C:\Windows\System\qxOdowH.exe

C:\Windows\System\TzDUmQf.exe

C:\Windows\System\TzDUmQf.exe

C:\Windows\System\CXmiNiT.exe

C:\Windows\System\CXmiNiT.exe

C:\Windows\System\SXWQVUT.exe

C:\Windows\System\SXWQVUT.exe

C:\Windows\System\LhIRtDS.exe

C:\Windows\System\LhIRtDS.exe

C:\Windows\System\DrSpFBn.exe

C:\Windows\System\DrSpFBn.exe

C:\Windows\System\lxMvKCo.exe

C:\Windows\System\lxMvKCo.exe

C:\Windows\System\HsDLTQX.exe

C:\Windows\System\HsDLTQX.exe

C:\Windows\System\mgNzkNN.exe

C:\Windows\System\mgNzkNN.exe

C:\Windows\System\CzUQhIa.exe

C:\Windows\System\CzUQhIa.exe

C:\Windows\System\QPKrsyN.exe

C:\Windows\System\QPKrsyN.exe

C:\Windows\System\GIiSnJZ.exe

C:\Windows\System\GIiSnJZ.exe

C:\Windows\System\BjILIlF.exe

C:\Windows\System\BjILIlF.exe

C:\Windows\System\EvEZmgn.exe

C:\Windows\System\EvEZmgn.exe

C:\Windows\System\vdHZZUN.exe

C:\Windows\System\vdHZZUN.exe

C:\Windows\System\BwIDArH.exe

C:\Windows\System\BwIDArH.exe

C:\Windows\System\ccfRfCv.exe

C:\Windows\System\ccfRfCv.exe

C:\Windows\System\XEFQYCY.exe

C:\Windows\System\XEFQYCY.exe

C:\Windows\System\ZZEdVWv.exe

C:\Windows\System\ZZEdVWv.exe

C:\Windows\System\dtunKUz.exe

C:\Windows\System\dtunKUz.exe

C:\Windows\System\xdHGRVU.exe

C:\Windows\System\xdHGRVU.exe

C:\Windows\System\LuBaKHq.exe

C:\Windows\System\LuBaKHq.exe

C:\Windows\System\fWseXEa.exe

C:\Windows\System\fWseXEa.exe

C:\Windows\System\NXFDNQk.exe

C:\Windows\System\NXFDNQk.exe

C:\Windows\System\cnBOxiI.exe

C:\Windows\System\cnBOxiI.exe

C:\Windows\System\xFfwTRb.exe

C:\Windows\System\xFfwTRb.exe

C:\Windows\System\AZkdviK.exe

C:\Windows\System\AZkdviK.exe

C:\Windows\System\ivzsgcw.exe

C:\Windows\System\ivzsgcw.exe

C:\Windows\System\rlpqEPH.exe

C:\Windows\System\rlpqEPH.exe

C:\Windows\System\BKYTzSf.exe

C:\Windows\System\BKYTzSf.exe

C:\Windows\System\rHvQgVp.exe

C:\Windows\System\rHvQgVp.exe

C:\Windows\System\GenaXHt.exe

C:\Windows\System\GenaXHt.exe

C:\Windows\System\XmclIIo.exe

C:\Windows\System\XmclIIo.exe

C:\Windows\System\LlBJcFp.exe

C:\Windows\System\LlBJcFp.exe

C:\Windows\System\luJDlIy.exe

C:\Windows\System\luJDlIy.exe

C:\Windows\System\syVWRiG.exe

C:\Windows\System\syVWRiG.exe

C:\Windows\System\OhqVyJh.exe

C:\Windows\System\OhqVyJh.exe

C:\Windows\System\UYNmWhS.exe

C:\Windows\System\UYNmWhS.exe

C:\Windows\System\JTWzVEp.exe

C:\Windows\System\JTWzVEp.exe

C:\Windows\System\KbpWPdj.exe

C:\Windows\System\KbpWPdj.exe

C:\Windows\System\zqrCLqh.exe

C:\Windows\System\zqrCLqh.exe

C:\Windows\System\jKpvgbw.exe

C:\Windows\System\jKpvgbw.exe

C:\Windows\System\USSvOmz.exe

C:\Windows\System\USSvOmz.exe

C:\Windows\System\bJkPvJv.exe

C:\Windows\System\bJkPvJv.exe

C:\Windows\System\kAwVNbD.exe

C:\Windows\System\kAwVNbD.exe

C:\Windows\System\jSOHRdc.exe

C:\Windows\System\jSOHRdc.exe

C:\Windows\System\rveJaKP.exe

C:\Windows\System\rveJaKP.exe

C:\Windows\System\oBKMZgc.exe

C:\Windows\System\oBKMZgc.exe

C:\Windows\System\FdxssKk.exe

C:\Windows\System\FdxssKk.exe

C:\Windows\System\ieDsDPO.exe

C:\Windows\System\ieDsDPO.exe

C:\Windows\System\OoMqBnS.exe

C:\Windows\System\OoMqBnS.exe

C:\Windows\System\QjzwwGr.exe

C:\Windows\System\QjzwwGr.exe

C:\Windows\System\RXEBghE.exe

C:\Windows\System\RXEBghE.exe

C:\Windows\System\oGuAAqY.exe

C:\Windows\System\oGuAAqY.exe

C:\Windows\System\clHSVLE.exe

C:\Windows\System\clHSVLE.exe

C:\Windows\System\OzPkLqD.exe

C:\Windows\System\OzPkLqD.exe

C:\Windows\System\nNtdrnS.exe

C:\Windows\System\nNtdrnS.exe

C:\Windows\System\MzxmBkV.exe

C:\Windows\System\MzxmBkV.exe

C:\Windows\System\gPPdPpG.exe

C:\Windows\System\gPPdPpG.exe

C:\Windows\System\wGISwSH.exe

C:\Windows\System\wGISwSH.exe

C:\Windows\System\jhcujZI.exe

C:\Windows\System\jhcujZI.exe

C:\Windows\System\rvJjUzZ.exe

C:\Windows\System\rvJjUzZ.exe

C:\Windows\System\UrDmbyf.exe

C:\Windows\System\UrDmbyf.exe

C:\Windows\System\xnfhApI.exe

C:\Windows\System\xnfhApI.exe

C:\Windows\System\pEYxQeh.exe

C:\Windows\System\pEYxQeh.exe

C:\Windows\System\tpuLDah.exe

C:\Windows\System\tpuLDah.exe

C:\Windows\System\AUZtotQ.exe

C:\Windows\System\AUZtotQ.exe

C:\Windows\System\SJMrHwo.exe

C:\Windows\System\SJMrHwo.exe

C:\Windows\System\HBLoYhd.exe

C:\Windows\System\HBLoYhd.exe

C:\Windows\System\MHXYNuN.exe

C:\Windows\System\MHXYNuN.exe

C:\Windows\System\uWVTvEl.exe

C:\Windows\System\uWVTvEl.exe

C:\Windows\System\JUMaJpd.exe

C:\Windows\System\JUMaJpd.exe

C:\Windows\System\WpGaCVa.exe

C:\Windows\System\WpGaCVa.exe

C:\Windows\System\yfgLroF.exe

C:\Windows\System\yfgLroF.exe

C:\Windows\System\keeYjHr.exe

C:\Windows\System\keeYjHr.exe

C:\Windows\System\gCQbHph.exe

C:\Windows\System\gCQbHph.exe

C:\Windows\System\WSUEdSc.exe

C:\Windows\System\WSUEdSc.exe

C:\Windows\System\cXIYaKD.exe

C:\Windows\System\cXIYaKD.exe

C:\Windows\System\AgdYHYf.exe

C:\Windows\System\AgdYHYf.exe

C:\Windows\System\vENWsQN.exe

C:\Windows\System\vENWsQN.exe

C:\Windows\System\JxLKPqe.exe

C:\Windows\System\JxLKPqe.exe

C:\Windows\System\CAigSST.exe

C:\Windows\System\CAigSST.exe

C:\Windows\System\uPWcrWG.exe

C:\Windows\System\uPWcrWG.exe

C:\Windows\System\msCTzJQ.exe

C:\Windows\System\msCTzJQ.exe

C:\Windows\System\JvClFAk.exe

C:\Windows\System\JvClFAk.exe

C:\Windows\System\imNYPtC.exe

C:\Windows\System\imNYPtC.exe

C:\Windows\System\QfNEbSz.exe

C:\Windows\System\QfNEbSz.exe

C:\Windows\System\UdvkSga.exe

C:\Windows\System\UdvkSga.exe

C:\Windows\System\PbZQYlq.exe

C:\Windows\System\PbZQYlq.exe

C:\Windows\System\TCwsJzd.exe

C:\Windows\System\TCwsJzd.exe

C:\Windows\System\icbcHAO.exe

C:\Windows\System\icbcHAO.exe

C:\Windows\System\hjfCJTI.exe

C:\Windows\System\hjfCJTI.exe

C:\Windows\System\kdOEnGl.exe

C:\Windows\System\kdOEnGl.exe

C:\Windows\System\yiaZosf.exe

C:\Windows\System\yiaZosf.exe

C:\Windows\System\TNsuvJN.exe

C:\Windows\System\TNsuvJN.exe

C:\Windows\System\iVyMDIz.exe

C:\Windows\System\iVyMDIz.exe

C:\Windows\System\hzcRvxu.exe

C:\Windows\System\hzcRvxu.exe

C:\Windows\System\yACMgyL.exe

C:\Windows\System\yACMgyL.exe

C:\Windows\System\kghVHsx.exe

C:\Windows\System\kghVHsx.exe

C:\Windows\System\JggAwix.exe

C:\Windows\System\JggAwix.exe

C:\Windows\System\XBLrjhK.exe

C:\Windows\System\XBLrjhK.exe

C:\Windows\System\UPlOzNV.exe

C:\Windows\System\UPlOzNV.exe

C:\Windows\System\waNyVla.exe

C:\Windows\System\waNyVla.exe

C:\Windows\System\vymnJue.exe

C:\Windows\System\vymnJue.exe

C:\Windows\System\HbkImuD.exe

C:\Windows\System\HbkImuD.exe

C:\Windows\System\YqJprsc.exe

C:\Windows\System\YqJprsc.exe

C:\Windows\System\nXyhFGZ.exe

C:\Windows\System\nXyhFGZ.exe

C:\Windows\System\ihpAXsO.exe

C:\Windows\System\ihpAXsO.exe

C:\Windows\System\gNEraLW.exe

C:\Windows\System\gNEraLW.exe

C:\Windows\System\DjEREgz.exe

C:\Windows\System\DjEREgz.exe

C:\Windows\System\EqxeBLz.exe

C:\Windows\System\EqxeBLz.exe

C:\Windows\System\TNNmSrY.exe

C:\Windows\System\TNNmSrY.exe

C:\Windows\System\oIQWcFS.exe

C:\Windows\System\oIQWcFS.exe

C:\Windows\System\QXCdtiA.exe

C:\Windows\System\QXCdtiA.exe

C:\Windows\System\gLoNBVY.exe

C:\Windows\System\gLoNBVY.exe

C:\Windows\System\dGLKbYi.exe

C:\Windows\System\dGLKbYi.exe

C:\Windows\System\WRJfOqw.exe

C:\Windows\System\WRJfOqw.exe

C:\Windows\System\OVOseUk.exe

C:\Windows\System\OVOseUk.exe

C:\Windows\System\kjCRLQI.exe

C:\Windows\System\kjCRLQI.exe

C:\Windows\System\AIhqICN.exe

C:\Windows\System\AIhqICN.exe

C:\Windows\System\PcCJETR.exe

C:\Windows\System\PcCJETR.exe

C:\Windows\System\GsfUbid.exe

C:\Windows\System\GsfUbid.exe

C:\Windows\System\ikSuHeC.exe

C:\Windows\System\ikSuHeC.exe

C:\Windows\System\NwWhgMH.exe

C:\Windows\System\NwWhgMH.exe

C:\Windows\System\fBhCLwy.exe

C:\Windows\System\fBhCLwy.exe

C:\Windows\System\xvQQnHo.exe

C:\Windows\System\xvQQnHo.exe

C:\Windows\System\MBIKbOZ.exe

C:\Windows\System\MBIKbOZ.exe

C:\Windows\System\yXYSycE.exe

C:\Windows\System\yXYSycE.exe

C:\Windows\System\lXrGCtn.exe

C:\Windows\System\lXrGCtn.exe

C:\Windows\System\CHxUXhL.exe

C:\Windows\System\CHxUXhL.exe

C:\Windows\System\EqiOcyh.exe

C:\Windows\System\EqiOcyh.exe

C:\Windows\System\LHMrzpM.exe

C:\Windows\System\LHMrzpM.exe

C:\Windows\System\immGvqY.exe

C:\Windows\System\immGvqY.exe

C:\Windows\System\nYoZuLs.exe

C:\Windows\System\nYoZuLs.exe

C:\Windows\System\EHqfXnW.exe

C:\Windows\System\EHqfXnW.exe

C:\Windows\System\VtUQfVl.exe

C:\Windows\System\VtUQfVl.exe

C:\Windows\System\SikySON.exe

C:\Windows\System\SikySON.exe

C:\Windows\System\fDkDoLE.exe

C:\Windows\System\fDkDoLE.exe

C:\Windows\System\mOeWSTu.exe

C:\Windows\System\mOeWSTu.exe

C:\Windows\System\dAfdKvo.exe

C:\Windows\System\dAfdKvo.exe

C:\Windows\System\daPftWP.exe

C:\Windows\System\daPftWP.exe

C:\Windows\System\ptHFWrc.exe

C:\Windows\System\ptHFWrc.exe

C:\Windows\System\EPlcGuN.exe

C:\Windows\System\EPlcGuN.exe

C:\Windows\System\fVqwTNj.exe

C:\Windows\System\fVqwTNj.exe

C:\Windows\System\PioAOog.exe

C:\Windows\System\PioAOog.exe

C:\Windows\System\OAvaSIp.exe

C:\Windows\System\OAvaSIp.exe

C:\Windows\System\JPIewVq.exe

C:\Windows\System\JPIewVq.exe

C:\Windows\System\jODvbgI.exe

C:\Windows\System\jODvbgI.exe

C:\Windows\System\PmtTyDS.exe

C:\Windows\System\PmtTyDS.exe

C:\Windows\System\cAohlya.exe

C:\Windows\System\cAohlya.exe

C:\Windows\System\SLvHRuz.exe

C:\Windows\System\SLvHRuz.exe

C:\Windows\System\xRMoPbx.exe

C:\Windows\System\xRMoPbx.exe

C:\Windows\System\GOzGyCo.exe

C:\Windows\System\GOzGyCo.exe

C:\Windows\System\VvyYQSf.exe

C:\Windows\System\VvyYQSf.exe

C:\Windows\System\HEaHQhm.exe

C:\Windows\System\HEaHQhm.exe

C:\Windows\System\NHFScLL.exe

C:\Windows\System\NHFScLL.exe

C:\Windows\System\AMSqnJQ.exe

C:\Windows\System\AMSqnJQ.exe

C:\Windows\System\VbPxwls.exe

C:\Windows\System\VbPxwls.exe

C:\Windows\System\XDzgkGx.exe

C:\Windows\System\XDzgkGx.exe

C:\Windows\System\ICQUKhy.exe

C:\Windows\System\ICQUKhy.exe

C:\Windows\System\ugKecvP.exe

C:\Windows\System\ugKecvP.exe

C:\Windows\System\yAEtXko.exe

C:\Windows\System\yAEtXko.exe

C:\Windows\System\kiotVAN.exe

C:\Windows\System\kiotVAN.exe

C:\Windows\System\hxAqlRH.exe

C:\Windows\System\hxAqlRH.exe

C:\Windows\System\nkDYMog.exe

C:\Windows\System\nkDYMog.exe

C:\Windows\System\ODZgkmh.exe

C:\Windows\System\ODZgkmh.exe

C:\Windows\System\cMRzEza.exe

C:\Windows\System\cMRzEza.exe

C:\Windows\System\DGRKDOG.exe

C:\Windows\System\DGRKDOG.exe

C:\Windows\System\HnaWzgY.exe

C:\Windows\System\HnaWzgY.exe

C:\Windows\System\FeaXcHQ.exe

C:\Windows\System\FeaXcHQ.exe

C:\Windows\System\YGFtUyN.exe

C:\Windows\System\YGFtUyN.exe

C:\Windows\System\mEKqZIJ.exe

C:\Windows\System\mEKqZIJ.exe

C:\Windows\System\GcfgyTm.exe

C:\Windows\System\GcfgyTm.exe

C:\Windows\System\KaRxKHm.exe

C:\Windows\System\KaRxKHm.exe

C:\Windows\System\NkplOCa.exe

C:\Windows\System\NkplOCa.exe

C:\Windows\System\srvPTSy.exe

C:\Windows\System\srvPTSy.exe

C:\Windows\System\ErwAtOE.exe

C:\Windows\System\ErwAtOE.exe

C:\Windows\System\FBafkjm.exe

C:\Windows\System\FBafkjm.exe

C:\Windows\System\xXiapnS.exe

C:\Windows\System\xXiapnS.exe

C:\Windows\System\DshtkHD.exe

C:\Windows\System\DshtkHD.exe

C:\Windows\System\NlBBJvg.exe

C:\Windows\System\NlBBJvg.exe

C:\Windows\System\rSZaMpV.exe

C:\Windows\System\rSZaMpV.exe

C:\Windows\System\baXwovX.exe

C:\Windows\System\baXwovX.exe

C:\Windows\System\sSdTNhk.exe

C:\Windows\System\sSdTNhk.exe

C:\Windows\System\WgkhilQ.exe

C:\Windows\System\WgkhilQ.exe

C:\Windows\System\khxzQPw.exe

C:\Windows\System\khxzQPw.exe

C:\Windows\System\xMgycLD.exe

C:\Windows\System\xMgycLD.exe

C:\Windows\System\nVioafC.exe

C:\Windows\System\nVioafC.exe

C:\Windows\System\iqMEvPC.exe

C:\Windows\System\iqMEvPC.exe

C:\Windows\System\SFqvNOc.exe

C:\Windows\System\SFqvNOc.exe

C:\Windows\System\gHAWGoi.exe

C:\Windows\System\gHAWGoi.exe

C:\Windows\System\VxniDGC.exe

C:\Windows\System\VxniDGC.exe

C:\Windows\System\RBTHuOX.exe

C:\Windows\System\RBTHuOX.exe

C:\Windows\System\MMSpUvX.exe

C:\Windows\System\MMSpUvX.exe

C:\Windows\System\eivWYcF.exe

C:\Windows\System\eivWYcF.exe

C:\Windows\System\jMMgaIQ.exe

C:\Windows\System\jMMgaIQ.exe

C:\Windows\System\vaIiGHx.exe

C:\Windows\System\vaIiGHx.exe

C:\Windows\System\MHvNDnM.exe

C:\Windows\System\MHvNDnM.exe

C:\Windows\System\SzlTktu.exe

C:\Windows\System\SzlTktu.exe

C:\Windows\System\wADJlFx.exe

C:\Windows\System\wADJlFx.exe

C:\Windows\System\LKbzINU.exe

C:\Windows\System\LKbzINU.exe

C:\Windows\System\IquAOOt.exe

C:\Windows\System\IquAOOt.exe

C:\Windows\System\mbQkViH.exe

C:\Windows\System\mbQkViH.exe

C:\Windows\System\XeXMTnO.exe

C:\Windows\System\XeXMTnO.exe

C:\Windows\System\yHCKqpE.exe

C:\Windows\System\yHCKqpE.exe

C:\Windows\System\xwFZfsS.exe

C:\Windows\System\xwFZfsS.exe

C:\Windows\System\aJpkwGy.exe

C:\Windows\System\aJpkwGy.exe

C:\Windows\System\GoxMCFP.exe

C:\Windows\System\GoxMCFP.exe

C:\Windows\System\MqDivLi.exe

C:\Windows\System\MqDivLi.exe

C:\Windows\System\CHSkBIr.exe

C:\Windows\System\CHSkBIr.exe

C:\Windows\System\XkQOrRU.exe

C:\Windows\System\XkQOrRU.exe

C:\Windows\System\VgBsxFz.exe

C:\Windows\System\VgBsxFz.exe

C:\Windows\System\PjaULqS.exe

C:\Windows\System\PjaULqS.exe

C:\Windows\System\rjLRXfY.exe

C:\Windows\System\rjLRXfY.exe

C:\Windows\System\ojmzlPW.exe

C:\Windows\System\ojmzlPW.exe

C:\Windows\System\APgqUeQ.exe

C:\Windows\System\APgqUeQ.exe

C:\Windows\System\ipRwWQM.exe

C:\Windows\System\ipRwWQM.exe

C:\Windows\System\nLJBKMM.exe

C:\Windows\System\nLJBKMM.exe

C:\Windows\System\ROHIkNM.exe

C:\Windows\System\ROHIkNM.exe

C:\Windows\System\IunBiRy.exe

C:\Windows\System\IunBiRy.exe

C:\Windows\System\mQNxCow.exe

C:\Windows\System\mQNxCow.exe

C:\Windows\System\COHDBZf.exe

C:\Windows\System\COHDBZf.exe

C:\Windows\System\zMqOYtH.exe

C:\Windows\System\zMqOYtH.exe

C:\Windows\System\gMJblJv.exe

C:\Windows\System\gMJblJv.exe

C:\Windows\System\IIBQTPn.exe

C:\Windows\System\IIBQTPn.exe

C:\Windows\System\iPnuIgM.exe

C:\Windows\System\iPnuIgM.exe

C:\Windows\System\bnaIbbj.exe

C:\Windows\System\bnaIbbj.exe

C:\Windows\System\teFltBT.exe

C:\Windows\System\teFltBT.exe

C:\Windows\System\hYXAMfI.exe

C:\Windows\System\hYXAMfI.exe

C:\Windows\System\ClxKkit.exe

C:\Windows\System\ClxKkit.exe

C:\Windows\System\sCTEAjS.exe

C:\Windows\System\sCTEAjS.exe

C:\Windows\System\UAoVZOL.exe

C:\Windows\System\UAoVZOL.exe

C:\Windows\System\QHWhawN.exe

C:\Windows\System\QHWhawN.exe

C:\Windows\System\KhhCMgL.exe

C:\Windows\System\KhhCMgL.exe

C:\Windows\System\DujoAtG.exe

C:\Windows\System\DujoAtG.exe

C:\Windows\System\dgxxJDC.exe

C:\Windows\System\dgxxJDC.exe

C:\Windows\System\OEBYPyI.exe

C:\Windows\System\OEBYPyI.exe

C:\Windows\System\fWMRJab.exe

C:\Windows\System\fWMRJab.exe

C:\Windows\System\GTuDpCU.exe

C:\Windows\System\GTuDpCU.exe

C:\Windows\System\UjInVQM.exe

C:\Windows\System\UjInVQM.exe

C:\Windows\System\MFleZYN.exe

C:\Windows\System\MFleZYN.exe

C:\Windows\System\HCXZRaz.exe

C:\Windows\System\HCXZRaz.exe

C:\Windows\System\XtACpEi.exe

C:\Windows\System\XtACpEi.exe

C:\Windows\System\gKbwbJk.exe

C:\Windows\System\gKbwbJk.exe

C:\Windows\System\WWIVQom.exe

C:\Windows\System\WWIVQom.exe

C:\Windows\System\ysCDmKH.exe

C:\Windows\System\ysCDmKH.exe

C:\Windows\System\vflAfXO.exe

C:\Windows\System\vflAfXO.exe

C:\Windows\System\mjVPCvt.exe

C:\Windows\System\mjVPCvt.exe

C:\Windows\System\eiXKvAC.exe

C:\Windows\System\eiXKvAC.exe

C:\Windows\System\eFxmjJz.exe

C:\Windows\System\eFxmjJz.exe

C:\Windows\System\fkFsoYh.exe

C:\Windows\System\fkFsoYh.exe

C:\Windows\System\RmzUjHw.exe

C:\Windows\System\RmzUjHw.exe

C:\Windows\System\LtjRSJG.exe

C:\Windows\System\LtjRSJG.exe

C:\Windows\System\QpgZQkl.exe

C:\Windows\System\QpgZQkl.exe

C:\Windows\System\YsYLaIC.exe

C:\Windows\System\YsYLaIC.exe

C:\Windows\System\OEuUNIR.exe

C:\Windows\System\OEuUNIR.exe

C:\Windows\System\cnsokRr.exe

C:\Windows\System\cnsokRr.exe

C:\Windows\System\CpbCYmT.exe

C:\Windows\System\CpbCYmT.exe

C:\Windows\System\ejyoFRl.exe

C:\Windows\System\ejyoFRl.exe

C:\Windows\System\wNCtmpO.exe

C:\Windows\System\wNCtmpO.exe

C:\Windows\System\OPVZMbn.exe

C:\Windows\System\OPVZMbn.exe

C:\Windows\System\jcaHUyJ.exe

C:\Windows\System\jcaHUyJ.exe

C:\Windows\System\XLFVcfm.exe

C:\Windows\System\XLFVcfm.exe

C:\Windows\System\AphNERL.exe

C:\Windows\System\AphNERL.exe

C:\Windows\System\TajYRqy.exe

C:\Windows\System\TajYRqy.exe

C:\Windows\System\RiFeywJ.exe

C:\Windows\System\RiFeywJ.exe

C:\Windows\System\YWyYsWU.exe

C:\Windows\System\YWyYsWU.exe

C:\Windows\System\RvILyUX.exe

C:\Windows\System\RvILyUX.exe

C:\Windows\System\OrLPCxm.exe

C:\Windows\System\OrLPCxm.exe

C:\Windows\System\PdmYYkN.exe

C:\Windows\System\PdmYYkN.exe

C:\Windows\System\TjGKsvN.exe

C:\Windows\System\TjGKsvN.exe

C:\Windows\System\TlUjWtc.exe

C:\Windows\System\TlUjWtc.exe

C:\Windows\System\WiixtUy.exe

C:\Windows\System\WiixtUy.exe

C:\Windows\System\ueiHBpv.exe

C:\Windows\System\ueiHBpv.exe

C:\Windows\System\iizNJQK.exe

C:\Windows\System\iizNJQK.exe

C:\Windows\System\WSEJNPd.exe

C:\Windows\System\WSEJNPd.exe

C:\Windows\System\eljYURW.exe

C:\Windows\System\eljYURW.exe

C:\Windows\System\xQIbtYK.exe

C:\Windows\System\xQIbtYK.exe

C:\Windows\System\KLOcTDP.exe

C:\Windows\System\KLOcTDP.exe

C:\Windows\System\RaHHZRx.exe

C:\Windows\System\RaHHZRx.exe

C:\Windows\System\RoIjfIU.exe

C:\Windows\System\RoIjfIU.exe

C:\Windows\System\FDpuGeY.exe

C:\Windows\System\FDpuGeY.exe

C:\Windows\System\mqcwwOf.exe

C:\Windows\System\mqcwwOf.exe

C:\Windows\System\MRuFGdk.exe

C:\Windows\System\MRuFGdk.exe

C:\Windows\System\xurYmiJ.exe

C:\Windows\System\xurYmiJ.exe

C:\Windows\System\OKOoqWG.exe

C:\Windows\System\OKOoqWG.exe

C:\Windows\System\vRzqhKV.exe

C:\Windows\System\vRzqhKV.exe

C:\Windows\System\iIFhxUs.exe

C:\Windows\System\iIFhxUs.exe

C:\Windows\System\qwhSBMz.exe

C:\Windows\System\qwhSBMz.exe

C:\Windows\System\FGLszGE.exe

C:\Windows\System\FGLszGE.exe

C:\Windows\System\tNXmBuS.exe

C:\Windows\System\tNXmBuS.exe

C:\Windows\System\uDDNjWf.exe

C:\Windows\System\uDDNjWf.exe

C:\Windows\System\VmFCmdo.exe

C:\Windows\System\VmFCmdo.exe

C:\Windows\System\kkDWxZn.exe

C:\Windows\System\kkDWxZn.exe

C:\Windows\System\kUhBTBB.exe

C:\Windows\System\kUhBTBB.exe

C:\Windows\System\QAStYxZ.exe

C:\Windows\System\QAStYxZ.exe

C:\Windows\System\lDPcgSQ.exe

C:\Windows\System\lDPcgSQ.exe

C:\Windows\System\bAEWRWw.exe

C:\Windows\System\bAEWRWw.exe

C:\Windows\System\AsNhTAw.exe

C:\Windows\System\AsNhTAw.exe

C:\Windows\System\tzIBzvD.exe

C:\Windows\System\tzIBzvD.exe

C:\Windows\System\dTCGQBi.exe

C:\Windows\System\dTCGQBi.exe

C:\Windows\System\aUbrfER.exe

C:\Windows\System\aUbrfER.exe

C:\Windows\System\bQwXych.exe

C:\Windows\System\bQwXych.exe

C:\Windows\System\ahkVSdM.exe

C:\Windows\System\ahkVSdM.exe

C:\Windows\System\EnjBzcp.exe

C:\Windows\System\EnjBzcp.exe

C:\Windows\System\pveEcCP.exe

C:\Windows\System\pveEcCP.exe

C:\Windows\System\gcBoddj.exe

C:\Windows\System\gcBoddj.exe

C:\Windows\System\ywnMMgD.exe

C:\Windows\System\ywnMMgD.exe

C:\Windows\System\GyGcDkF.exe

C:\Windows\System\GyGcDkF.exe

C:\Windows\System\uMHawWK.exe

C:\Windows\System\uMHawWK.exe

Network

N/A

Files

memory/1752-0-0x00000000001F0000-0x0000000000200000-memory.dmp

memory/1752-1-0x000000013F9F0000-0x000000013FD44000-memory.dmp

\Windows\system\WNDzlLK.exe

MD5	fef9d1a2f0f6344a916b2fe501ceb1de
SHA1	a4c740a35976fdc516c509ef5ea7c1cc0e746efe
SHA256	0011a2e4e3755212f5a8d4400c9a533af5fec72607473e758367a4f9267ed092
SHA512	d9bd8a3ce941d373cb04d6e315ad7929c9f7ebd52026cf35af68b6aec4d1ea06a292d616ec6c8a53d685f56a0dd6504870af77daa286bd11dfbc6d2a87e377ac

memory/2824-9-0x000000013F690000-0x000000013F9E4000-memory.dmp

memory/1752-8-0x000000013F690000-0x000000013F9E4000-memory.dmp

\Windows\system\isiefjQ.exe

MD5	1398a2b218edb10ec17e535fda739d39
SHA1	22c772c5bf2a3d66b12b145f3a66d9da56867599
SHA256	464af8bdee57be965f70b3f1331c3d7e3c1036f3c6470163deca397585065122
SHA512	d22f96f188e82f06c18f8b84aa67d9cfa86df1b3b62532929b465e931544480c38db9bbe46d652fd16b0ec8ff85668f2eba8a7d940d842dfda085c23c620c021

memory/1752-15-0x000000013FF90000-0x00000001402E4000-memory.dmp

C:\Windows\system\ryvjvCM.exe

MD5	7f685a05e939df75f56c1ac5e6ec247c
SHA1	d8975534e13b415678fb4ebc88df7f01d986fd1d
SHA256	b0d1fc6c9c76413aec889a3c6feeee76c08b73d0fce7ae6931111fcbf68ef5ac
SHA512	cccfbe783921d7018a65e3722f91360cab838c0a8bf99b63458599d3e03f5a6508d14bfde36423cacfdd4b51c4801ee833b08335d1477525143ae8dca441c5e9

C:\Windows\system\ibxgIeB.exe

MD5	7d0c44b9fc88d35abcde10f4dec982a9
SHA1	acc266ec1b5ddee148d7dc3d41bbbd9c8e03955d
SHA256	c24673e0033935dfb57e0fe0019f5137ebcbf5bd37695cdbeb19d70506fd618c
SHA512	afe0bd9117175245be527e6e6b5b5b2dff969e702ec94dbc151891e4df155b55129554fd40908e2ae0ba18e9379d45bdb3ba06791dbced576f6ba441939c9634

\Windows\system\zBEiFfb.exe

MD5	883228523a2e00cc5e98a1120f059696
SHA1	e718dcc0019e45da645462e3e2ebdea8e83e5d20
SHA256	d5999afb9924bf61c4c2f735a8cc8623ad370c1cafc3a6972b7bc3b66de47d94
SHA512	5bb985fdfd86c0ccfa7040dd885a70e1b187d5e0a1eb375ac9d32540ef00fefb9f36dc6683b492763e0cda0b1bb2c3a5089c36b19be20e3485ca47e07c28d156

memory/1752-31-0x0000000001FE0000-0x0000000002334000-memory.dmp

memory/1752-33-0x000000013FD50000-0x00000001400A4000-memory.dmp

memory/2360-37-0x000000013FD50000-0x00000001400A4000-memory.dmp

memory/2672-36-0x000000013F520000-0x000000013F874000-memory.dmp

memory/1752-35-0x000000013F520000-0x000000013F874000-memory.dmp

memory/2560-34-0x000000013FF90000-0x00000001402E4000-memory.dmp

memory/2848-32-0x000000013F9E0000-0x000000013FD34000-memory.dmp

C:\Windows\system\tMqynPc.exe

MD5	970c7ca642a1bf5d40dec2a78a2dafcb
SHA1	aa35f18ca562849fd20e448743aad773dddfcd83
SHA256	d17bfce8b685142c70c16aea1e8ceed96264ebbf1fb8465d619e6ace76bdd02d
SHA512	4368486b35fda2690591fac19e814efd4dac5f08d5c6c3521d35ea1d99aac668ba25946839b0143aab5f1a8d6d788284635b8223148c0611ee4157975ae89350

memory/1752-42-0x000000013F410000-0x000000013F764000-memory.dmp

memory/2792-44-0x000000013F410000-0x000000013F764000-memory.dmp

C:\Windows\system\RhdjJvs.exe

MD5	9a0975cc68fa642ad090d997902a3ad0
SHA1	c3eb4154f1294efe6cae8dc3776029a3274e2b4c
SHA256	7f28f17af432ca711f0b2adf97218af3f81e8a7c7c4f23a51ec62753190e6dcd
SHA512	14999e39e82d157a3601f0f1523acfe92c7e3090118084b0d4bfee8dc4031697b6edd1323174a3616a5ee119d85976d0fda175c7fea01b008d6b6f515dbce340

C:\Windows\system\XADKBeZ.exe

MD5	9624b732aaf766549bb1594908916889
SHA1	fd768280fad684883175bfa11a881aacdb95636b
SHA256	3c579c93c9b52bea2a461bc84af470ce2c574fbd5f1860a3c74d41189b0a60a4
SHA512	a431e2433c0cfeead2df59eaeb64bb2730e8d507ba5959cebef6e023e1510b5f61ebcde4af373dcaf8624b7dc2041d8750b2e4bc0a26cc69e9356b8e29c32d41

memory/2604-56-0x000000013FED0000-0x0000000140224000-memory.dmp

\Windows\system\glPctkI.exe

MD5	cf633bf4cdc8353b0769ddba6c07cd03
SHA1	e1ea364c4b2234be05412663d77a3bcd6c290635
SHA256	a71265518f8c15b45aaf647daf0169cb62dbc646d44972f69a3fed2a4b84cb3d
SHA512	d3ca2ab4af88b996cd611efc3cec0c8843d2b6824c36d50afb54359b0dafc6ffae2a412ed843e1555a72f32e6e3caff5b4434ae2f1df4e59a38477dc2875790f

\Windows\system\kOnXUVo.exe

MD5	80f1c5bd0b712d80e60334b8833f73a8
SHA1	dc2c311db9005065c528fe2e9a71b7a554e3155b
SHA256	122d7ec0025f95a05a226dcb6471cd34363a113085f49fa0dd04bf2e37210f4f
SHA512	7bc492231c3518e92462fd2611c1f9782abaa9c6254406179ec36d792dd511473de8c12aa2baa79ad2fce8d8eeef27441db3c9e70a1354a1116cdfb07feb6170

memory/1752-76-0x000000013F0F0000-0x000000013F444000-memory.dmp

memory/1752-74-0x000000013F230000-0x000000013F584000-memory.dmp

\Windows\system\Dztlygr.exe

MD5	21f5cb724beaafb8be0cf6f5ca718cdd
SHA1	438381e7cd237f5424721f8cc5b761e65ce05665
SHA256	4a768228414d364961ba596b559742a8e00923e3768a06294ca9ffacd47c0899
SHA512	7e27a108e12fad9776f8346596e88a647208cdae7a711952d179e3effe7d2e1ebadcfd82602d2d52e14a3e8faa21d4786270d5ba14058f457634622e9c726de9

memory/760-96-0x000000013F4B0000-0x000000013F804000-memory.dmp

memory/1148-98-0x000000013F0F0000-0x000000013F444000-memory.dmp

memory/1752-100-0x000000013F510000-0x000000013F864000-memory.dmp

\Windows\system\XRoqtTj.exe

MD5	b7fb44a78e23626a4360371cbb043fc1
SHA1	30fd1ddfe3d5467a91e5543b61824312c5bcc4b5
SHA256	eef851830b3eba725d38b6f5a72d34ac12e6b8ea80cd5371ec2b8f507a2f3be9
SHA512	f45b8fa1294a24a43ace8e2e3c96c03e2f104fff804aded5b999e0d2e16fb1fb9341f8ab9b65ca20193a1cd1831f39d0cd111a38f60088115958358b392ad139

C:\Windows\system\JFBbulZ.exe

MD5	c3511e6d4c02c078a8ea1f2544a88859
SHA1	770df24e400a17321e302fa81db57f456af60a52
SHA256	0d0d3233e2f1c9f541d67f4959522eac4e3652157a3e15c1e6ed5ca3d89b88f3
SHA512	fc98a4aaf03684dd52e4a0efe409e98f9d377142ed55d756514af944c24cb3184bb7ecdf483963d4ddc67b3b29c449f8f89a3b33d263321b508276347466ec7c

C:\Windows\system\hPrKATV.exe

MD5	22c66b52f3e544268652550e46bda47f
SHA1	b941f9256f28ce3d75b012968f3b1821d6491cb4
SHA256	478e3f89730497017ef6fa4af2920cf8e0357faa1e350c4b48ab7ce182ea0658
SHA512	f052697c834fe07089919553490247a5e68cee5a26380eb3699d4c1d0d8283c659de5dc003fc272a1a3fa8061ca60cc2cec1d10717ded29aaa52b505a363b30d

C:\Windows\system\eQDSzmu.exe

MD5	cc859be87fcc05221548b9c9110aba2e
SHA1	4b7f305a97a434ec046f922d8d78ad7a6bf9277e
SHA256	88f41e945fd04c5af4da9f57d50a355cb78f198a1e511de8bb1a22c39aaf39bc
SHA512	f14747c99a511eff528c6fb895f8ba15e5e56dea5214ed5461c85567104c52325939011c405b5e7647a9155a43112ea8967b99816dabd1bb00b45ef48fbb6684

C:\Windows\system\ondRvSN.exe

MD5	84abcaec80bf039dcd63795a633b5735
SHA1	a0b800ad4386d501eb592c76071b55be8440decf
SHA256	e35388067b25fc36bc34cb0578a77e01496a81ff4943286872426b6862517f13
SHA512	bf436ce96e671e8dc50689aa4c5e54bdbfd07769de276505ab755c17da6b90df93ae82164094e211a89f635493144a88cce1f5ab87838414274a656e60337b41

C:\Windows\system\gUdEqgQ.exe

MD5	29c279a189549176f3d60c171876d858
SHA1	34de718cb35362e1d364792a1e35d8eab0fd020b
SHA256	18aeab43e43ae25be286407a7ed20d79a6445c1321b06c6acb8c82ea3a7bff48
SHA512	c48adb18be499831fc3d39912628945cff73a30e4bb45e9e6397729f0bb74abde907ae291d0f3ce4a9a691539fc4f54ff849712d61c1ac798c39aaef3a0444b7

memory/1752-194-0x0000000001FE0000-0x0000000002334000-memory.dmp

memory/1752-193-0x000000013FF90000-0x00000001402E4000-memory.dmp

C:\Windows\system\IZaiqUT.exe

MD5	1f269f6f55c3381eb1947dab1c70347e
SHA1	58a2ba22d79777d71f7e2a0e5de85afc9b1720ff
SHA256	4a7b0c40cf49db4d3aefed55d95c96ad11639bfbe0e4a8e1d1bf97466e606770
SHA512	886ece2658be108e16e2bcd72c474ec5b725b01d90812f52868a6ba07bff8aa0b91d1ec397be66bab9efe60aa698b0e29f0600eec057b94f6d3610bd511b9bdc

C:\Windows\system\gPDvaQT.exe

MD5	e08e7f670dfd193aa75ae8c64dfe5d50
SHA1	6ad14ad4dcced4c49782c6e0240bd0b5912e3a0f
SHA256	d72a5e324014c0a87123275f59465d94655e014dbe983695b0e9a22fb29fb30f
SHA512	cd9faafd1c28b6e0cb12d27dedd05aadf66c90610e6edc5fc64979c98612aa983aa851d591a9eb027b7065d3086264654983b05c40494abe7f6f7b144f5d0f50

C:\Windows\system\CKHyePY.exe

MD5	b940f6e80387b6f2360ae630e1dc3ad5
SHA1	ebb5002b015be151e4526c22958412ab8495eca4
SHA256	a2256445572c09a868b818221f0090dc1daefbae3278e3c33ec97914a0e716b5
SHA512	d48f9d343018596869355bae661bb5b6f458c9dbb226aca32a2b3791510cc86243102e8b1e12455006981c514f9cac980e973651f43c3b696ad0c17a5b8124a8

C:\Windows\system\XcHYKLz.exe

MD5	e6fe6795247a2eb9c6c6fb55427c6164
SHA1	4adad3f38f28ae63c68fe45b6e2efa6dbf3b93e6
SHA256	938c6742a22c7deb01b0ad223bd852f81024630cfb859191674f6e8ab416cd82
SHA512	2bc62b94061bdaf039ddc2be81c65e1a4cefb0967ed69b6619b72dd672d252ef974fc6653d8c34e8e321f09ab057e2ca11b7a7a635d14b85895c67e5f2a003ad

memory/2792-402-0x000000013F410000-0x000000013F764000-memory.dmp

C:\Windows\system\nqNeTFQ.exe

MD5	87025bc9df619fc84844e7912134c8bf
SHA1	e0ac99f06b4b435a3158108b6c1743ae22aeb580
SHA256	71635ac4a34f721261e96135ae5d2f358acab6c4664b0aff84b4760624706837
SHA512	734a6d1daa7d9111ef1f1b1073cda957439c2e22e448198944a4f60b5363187842c64a6771864347c666335ea503d9bc7a7316a163e4cccba5b73eaca73d5212

C:\Windows\system\WYYBYtw.exe

MD5	fb296a21aaf24e3658169526eb597ff6
SHA1	3d8441c5bdfa2762fe5b02b1e5090e97e92751bd
SHA256	9461b1fc932615ea9fced7a440849cc4893f6899a91d200715b7c5c0909cb391
SHA512	331bced0344f3a5f2db1f70aef18f523aba95b1d02bdd4849946954c593aca643c53f51b79b493f34060d1eb064cd66fe03d90db02db0dd77cf7495a2c591ac4

C:\Windows\system\eHKrcas.exe

MD5	858d8eb85de1e87858629c9fdc4c5791
SHA1	280bea56f63f2a4b738aa61ed5e1be3c7aea25a9
SHA256	f253fc5c463ef6ba35356e708b9d1107526bd6eab6a37d5cfb538995febc9cd0
SHA512	0b9b8c5215e5ae04c90cd4c5470ceae01c813d37dd771a246f4d6ff2ba36206a645d48fd2085cffed225055aa47cff8251dfb06e94e7eb8a82620851dd22f725

C:\Windows\system\HFqRGXY.exe

MD5	d56a35958961898d1689cce429cd1b80
SHA1	d99e42db1bc9f7c20c848a6447d0cffa31aca30f
SHA256	76ddb3a955d2165efed332f47a3b43f782a527eb40fb07d7171be35ef360dc7b
SHA512	a771c17894f66377eef918e3fa339c44d48cd9a2cfee3cbb52e4276c3d885d6a7154ba417562078eb82589c53527190554d2591e9c759e9493a3148512c1d665

C:\Windows\system\hFutPDz.exe

MD5	124981c9544a30770048458574d26520
SHA1	92db66eb2d827f6e287fb5db9a878d878cdbc88f
SHA256	c78f8f6dc562b846efdfbb2ac5f78440ec04b0d2f4f8e7d9e037284eb5303614
SHA512	86bd00ffc0ee3b5b0c168961de1e7a883c6b085c21fbf0df97b39426c65df29eaf105f0ffa23c3a3fa683c0e902df87a1b1c6890f4a3c16d9bed51c64e1d3f74

C:\Windows\system\gdHnjtL.exe

MD5	032175ef99e3a73193bb1c91f04f7c7f
SHA1	a5bc1a5b3f0448f9cfa3328f0a87ffce3a924ee4
SHA256	051f43064f5156f33285d6643faf6fe6c47b2af566f378d18817b95c6b19e342
SHA512	05b7655d7af63e49da4112bd368b0fbf8aa74d573f98f5f1d22bcd9420da3d4360a5046027c662117fdd46bd4f640e7e01a1090b8d7c017b5e18093bf08e18d8

C:\Windows\system\YejpHAj.exe

MD5	35749925caa5f67b988424aa4f895537
SHA1	0dc667b72fef9f43b3b8390269c74270464fb19d
SHA256	9eab97ed0f0972742a6f5150f79e6125c65b8bd6ba360ab4181300124c9ccaeb
SHA512	7d706376673002c88018e7a6e0d88b0de1c1d7d245ce776efb80fe645e09afdc92769f7c55e466797364b5513e885bd38efc2b0e06fb25241e9eab92debf53ea

memory/1752-93-0x000000013F510000-0x000000013F864000-memory.dmp

memory/1752-81-0x0000000001FE0000-0x0000000002334000-memory.dmp

memory/1752-80-0x000000013FD80000-0x00000001400D4000-memory.dmp

\Windows\system\ZomvtZz.exe

MD5	6136b8af418570ae44d5c831933ce44c
SHA1	10042586dd8939530a2e9d4aca79c773533fa05c
SHA256	fb50056242a3740b1dcf552c48be84494bcad7651519f74514e416441bd8b9d6
SHA512	7db4621b8c689e4648baa79115ba9782962aee92d6f29a647e75e85dbb17c6f779dbe4d4b9f2bf95f88a87db0ba1e925b400c9d8b3b2764d8545ce9010a59fa3

C:\Windows\system\sKKbVQu.exe

MD5	f1cc87c36736ebf9844a19d02df98634
SHA1	10e4ec1869681e182eb771dc7233b706d9380a7f
SHA256	6642b07c4e8b45b5cceff8387d3953021b4d7ecc14fe3b60da911b58d2bb1471
SHA512	ff8b1d0812cd6cbabc57359ac9a78f90e0a963c26484b9e332205863d913b563f9aa94581efd4a13b4ab7197f81488a96173494416dd70fcffc1bf27b9d790a5

memory/2540-69-0x000000013FD80000-0x00000001400D4000-memory.dmp

memory/2952-99-0x000000013F720000-0x000000013FA74000-memory.dmp

memory/1752-97-0x000000013F520000-0x000000013F874000-memory.dmp

C:\Windows\system\NSpRrEG.exe

MD5	4ae29c0159c4d10258f8e263b8202452
SHA1	1e77486448f45b581340d3b157ac8e58b26201e9
SHA256	954b2d2033a8caa1fc43ba71a0166878d329f9202e7cf180c7f3f8e9c55685ce
SHA512	6016d93e7dc4d50508402c4c9854e0d1c0d13e656f39219882c73e73da0549cbb7cdcb639ae2269629abed17fa5deee51bfc5cc544592d5fe03a0cacd3123fdd

C:\Windows\system\SATmpUs.exe

MD5	5223a473bee206db467f672f4cf84597
SHA1	ea50420bbc0dcef198f7ae9e0c603ec0e4e78d29
SHA256	b2e050536d48427fe95fcde7d7685d505b7b3699ed8fdbfe36430dc69b65c38d
SHA512	4226298b898da1ffd444fec949e4b88f44e1e859b1bf2a7b9e79d7c882cd09bd4bbd9be05ad2816235062d3f54130ec350b46b05c64a8c82496fe9a31dd9646a

memory/2924-85-0x000000013F230000-0x000000013F584000-memory.dmp

memory/2524-64-0x000000013F5E0000-0x000000013F934000-memory.dmp

memory/1752-592-0x000000013F5E0000-0x000000013F934000-memory.dmp

memory/2540-593-0x000000013FD80000-0x00000001400D4000-memory.dmp

memory/1752-55-0x000000013F9F0000-0x000000013FD44000-memory.dmp

memory/1752-1201-0x0000000001FE0000-0x0000000002334000-memory.dmp

memory/2952-1348-0x000000013F720000-0x000000013FA74000-memory.dmp

memory/2824-2073-0x000000013F690000-0x000000013F9E4000-memory.dmp

memory/2560-2090-0x000000013FF90000-0x00000001402E4000-memory.dmp

memory/2848-2105-0x000000013F9E0000-0x000000013FD34000-memory.dmp

memory/2672-2114-0x000000013F520000-0x000000013F874000-memory.dmp

memory/2360-2118-0x000000013FD50000-0x00000001400A4000-memory.dmp

memory/2792-2204-0x000000013F410000-0x000000013F764000-memory.dmp

memory/2604-2268-0x000000013FED0000-0x0000000140224000-memory.dmp

memory/2524-2267-0x000000013F5E0000-0x000000013F934000-memory.dmp

memory/2540-2274-0x000000013FD80000-0x00000001400D4000-memory.dmp

memory/2924-2286-0x000000013F230000-0x000000013F584000-memory.dmp

memory/760-2298-0x000000013F4B0000-0x000000013F804000-memory.dmp

memory/1148-2304-0x000000013F0F0000-0x000000013F444000-memory.dmp

memory/2952-2907-0x000000013F720000-0x000000013FA74000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 13:20

Reported

2024-06-13 13:23

Platform

win10v2004-20240611-en

Max time kernel

114s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\JnKVWQo.exe	N/A
N/A	N/A	C:\Windows\System\MIHOWOI.exe	N/A
N/A	N/A	C:\Windows\System\YfaPnMA.exe	N/A
N/A	N/A	C:\Windows\System\fhQDYRo.exe	N/A
N/A	N/A	C:\Windows\System\STaicXz.exe	N/A
N/A	N/A	C:\Windows\System\cKYvbsf.exe	N/A
N/A	N/A	C:\Windows\System\dFoDxAQ.exe	N/A
N/A	N/A	C:\Windows\System\tHCSFFb.exe	N/A
N/A	N/A	C:\Windows\System\FkPAKUG.exe	N/A
N/A	N/A	C:\Windows\System\VaGmJUw.exe	N/A
N/A	N/A	C:\Windows\System\KwVGqQM.exe	N/A
N/A	N/A	C:\Windows\System\kWERowy.exe	N/A
N/A	N/A	C:\Windows\System\HGRsIvn.exe	N/A
N/A	N/A	C:\Windows\System\JXxTIAX.exe	N/A
N/A	N/A	C:\Windows\System\uwLLSFU.exe	N/A
N/A	N/A	C:\Windows\System\IDNCknz.exe	N/A
N/A	N/A	C:\Windows\System\suDRPqv.exe	N/A
N/A	N/A	C:\Windows\System\bkYibNE.exe	N/A
N/A	N/A	C:\Windows\System\dsRsyDL.exe	N/A
N/A	N/A	C:\Windows\System\ffcYFHr.exe	N/A
N/A	N/A	C:\Windows\System\tQqGwVs.exe	N/A
N/A	N/A	C:\Windows\System\SVIKUGj.exe	N/A
N/A	N/A	C:\Windows\System\PbObsYJ.exe	N/A
N/A	N/A	C:\Windows\System\JdNGYTA.exe	N/A
N/A	N/A	C:\Windows\System\XizVLQV.exe	N/A
N/A	N/A	C:\Windows\System\BNafUaZ.exe	N/A
N/A	N/A	C:\Windows\System\ktwOxzu.exe	N/A
N/A	N/A	C:\Windows\System\GIcAkgu.exe	N/A
N/A	N/A	C:\Windows\System\ecIiBRO.exe	N/A
N/A	N/A	C:\Windows\System\NeOcQeP.exe	N/A
N/A	N/A	C:\Windows\System\xCgrtTR.exe	N/A
N/A	N/A	C:\Windows\System\UNEqIUz.exe	N/A
N/A	N/A	C:\Windows\System\FLMYWDR.exe	N/A
N/A	N/A	C:\Windows\System\dkHMxWi.exe	N/A
N/A	N/A	C:\Windows\System\tsmRRFD.exe	N/A
N/A	N/A	C:\Windows\System\hsRHLxJ.exe	N/A
N/A	N/A	C:\Windows\System\lnuZgZv.exe	N/A
N/A	N/A	C:\Windows\System\trTjiyr.exe	N/A
N/A	N/A	C:\Windows\System\xuPkgtT.exe	N/A
N/A	N/A	C:\Windows\System\RtrMeHU.exe	N/A
N/A	N/A	C:\Windows\System\pSjvMsl.exe	N/A
N/A	N/A	C:\Windows\System\lwHNSYG.exe	N/A
N/A	N/A	C:\Windows\System\QGnLFFM.exe	N/A
N/A	N/A	C:\Windows\System\CkiJrYj.exe	N/A
N/A	N/A	C:\Windows\System\peZaQYw.exe	N/A
N/A	N/A	C:\Windows\System\FzLyYNF.exe	N/A
N/A	N/A	C:\Windows\System\eWebiGb.exe	N/A
N/A	N/A	C:\Windows\System\WMqggSt.exe	N/A
N/A	N/A	C:\Windows\System\FvuUBtt.exe	N/A
N/A	N/A	C:\Windows\System\DlTjRGV.exe	N/A
N/A	N/A	C:\Windows\System\tgGewGf.exe	N/A
N/A	N/A	C:\Windows\System\xGweTLH.exe	N/A
N/A	N/A	C:\Windows\System\xJssblq.exe	N/A
N/A	N/A	C:\Windows\System\MisLYFE.exe	N/A
N/A	N/A	C:\Windows\System\MkGIaMd.exe	N/A
N/A	N/A	C:\Windows\System\XcnrFmU.exe	N/A
N/A	N/A	C:\Windows\System\CpjRlWr.exe	N/A
N/A	N/A	C:\Windows\System\pUaWQIM.exe	N/A
N/A	N/A	C:\Windows\System\ClpzSdw.exe	N/A
N/A	N/A	C:\Windows\System\bbmhlVa.exe	N/A
N/A	N/A	C:\Windows\System\qGnLlMn.exe	N/A
N/A	N/A	C:\Windows\System\naJmnLC.exe	N/A
N/A	N/A	C:\Windows\System\HAwDXhl.exe	N/A
N/A	N/A	C:\Windows\System\AJIEnOQ.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\ClpzSdw.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZcfwBjx.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tkVbyLi.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GBHneuo.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sRXvsPP.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hKoCySB.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lYObhFl.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LYmlTDc.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HmqfnUj.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iCMNYsI.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AoJnbqe.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NHeLNPZ.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VKCiuwb.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OKZrFDw.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JpAIxbq.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uTSlELP.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VbqTSHr.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LVGzUZE.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZZKJfsA.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vPtjMJz.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RWzflgG.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nHRaGQL.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JqHRVKk.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XxExGRo.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fNDpbSW.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\avelGHl.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zAzYuXY.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ljeIxZH.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tHCSFFb.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CkiJrYj.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KBZOFew.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GXwQXbd.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JrVHrLc.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EJYacwu.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HkbzSfx.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VkrVwHo.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fuRgEgq.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ObPQtBn.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kWERowy.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZHIHfTx.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oQjkGKg.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JAOjqfo.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LkEntIO.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xsLZZjC.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UTEskwp.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aOqOxZw.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OHZGtll.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ctuCTGJ.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RChtkNh.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YGihnJM.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bkMhFxf.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\criiJdw.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tHsfAgF.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QOAbgrj.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eaXgOWt.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OCRZwRA.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\waWavRa.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hNPGIXZ.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bsbGjWP.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VmGEmMd.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dXIpPXs.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SsfQwQW.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dCTGTuf.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FwamwwQ.exe	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1876 wrote to memory of 232	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\JnKVWQo.exe
PID 1876 wrote to memory of 232	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\JnKVWQo.exe
PID 1876 wrote to memory of 4968	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\MIHOWOI.exe
PID 1876 wrote to memory of 4968	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\MIHOWOI.exe
PID 1876 wrote to memory of 212	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\YfaPnMA.exe
PID 1876 wrote to memory of 212	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\YfaPnMA.exe
PID 1876 wrote to memory of 3556	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\STaicXz.exe
PID 1876 wrote to memory of 3556	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\STaicXz.exe
PID 1876 wrote to memory of 5104	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\fhQDYRo.exe
PID 1876 wrote to memory of 5104	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\fhQDYRo.exe
PID 1876 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\cKYvbsf.exe
PID 1876 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\cKYvbsf.exe
PID 1876 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\dFoDxAQ.exe
PID 1876 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\dFoDxAQ.exe
PID 1876 wrote to memory of 684	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\tHCSFFb.exe
PID 1876 wrote to memory of 684	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\tHCSFFb.exe
PID 1876 wrote to memory of 988	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\FkPAKUG.exe
PID 1876 wrote to memory of 988	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\FkPAKUG.exe
PID 1876 wrote to memory of 4692	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\VaGmJUw.exe
PID 1876 wrote to memory of 4692	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\VaGmJUw.exe
PID 1876 wrote to memory of 4748	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\KwVGqQM.exe
PID 1876 wrote to memory of 4748	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\KwVGqQM.exe
PID 1876 wrote to memory of 4076	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\kWERowy.exe
PID 1876 wrote to memory of 4076	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\kWERowy.exe
PID 1876 wrote to memory of 4996	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\HGRsIvn.exe
PID 1876 wrote to memory of 4996	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\HGRsIvn.exe
PID 1876 wrote to memory of 3124	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\JXxTIAX.exe
PID 1876 wrote to memory of 3124	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\JXxTIAX.exe
PID 1876 wrote to memory of 4544	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\uwLLSFU.exe
PID 1876 wrote to memory of 4544	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\uwLLSFU.exe
PID 1876 wrote to memory of 2388	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\IDNCknz.exe
PID 1876 wrote to memory of 2388	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\IDNCknz.exe
PID 1876 wrote to memory of 3116	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\suDRPqv.exe
PID 1876 wrote to memory of 3116	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\suDRPqv.exe
PID 1876 wrote to memory of 4940	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\bkYibNE.exe
PID 1876 wrote to memory of 4940	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\bkYibNE.exe
PID 1876 wrote to memory of 3988	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\dsRsyDL.exe
PID 1876 wrote to memory of 3988	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\dsRsyDL.exe
PID 1876 wrote to memory of 3104	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\ffcYFHr.exe
PID 1876 wrote to memory of 3104	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\ffcYFHr.exe
PID 1876 wrote to memory of 3976	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\tQqGwVs.exe
PID 1876 wrote to memory of 3976	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\tQqGwVs.exe
PID 1876 wrote to memory of 3904	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\SVIKUGj.exe
PID 1876 wrote to memory of 3904	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\SVIKUGj.exe
PID 1876 wrote to memory of 2332	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\PbObsYJ.exe
PID 1876 wrote to memory of 2332	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\PbObsYJ.exe
PID 1876 wrote to memory of 452	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\JdNGYTA.exe
PID 1876 wrote to memory of 452	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\JdNGYTA.exe
PID 1876 wrote to memory of 2336	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\XizVLQV.exe
PID 1876 wrote to memory of 2336	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\XizVLQV.exe
PID 1876 wrote to memory of 5012	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\BNafUaZ.exe
PID 1876 wrote to memory of 5012	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\BNafUaZ.exe
PID 1876 wrote to memory of 1000	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\ktwOxzu.exe
PID 1876 wrote to memory of 1000	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\ktwOxzu.exe
PID 1876 wrote to memory of 1424	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\GIcAkgu.exe
PID 1876 wrote to memory of 1424	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\GIcAkgu.exe
PID 1876 wrote to memory of 3916	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\ecIiBRO.exe
PID 1876 wrote to memory of 3916	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\ecIiBRO.exe
PID 1876 wrote to memory of 2304	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\NeOcQeP.exe
PID 1876 wrote to memory of 2304	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\NeOcQeP.exe
PID 1876 wrote to memory of 2820	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\xCgrtTR.exe
PID 1876 wrote to memory of 2820	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\xCgrtTR.exe
PID 1876 wrote to memory of 1176	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\UNEqIUz.exe
PID 1876 wrote to memory of 1176	N/A	C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe	C:\Windows\System\UNEqIUz.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe"

C:\Windows\System\JnKVWQo.exe

C:\Windows\System\JnKVWQo.exe

C:\Windows\System\MIHOWOI.exe

C:\Windows\System\MIHOWOI.exe

C:\Windows\System\YfaPnMA.exe

C:\Windows\System\YfaPnMA.exe

C:\Windows\System\STaicXz.exe

C:\Windows\System\STaicXz.exe

C:\Windows\System\fhQDYRo.exe

C:\Windows\System\fhQDYRo.exe

C:\Windows\System\cKYvbsf.exe

C:\Windows\System\cKYvbsf.exe

C:\Windows\System\dFoDxAQ.exe

C:\Windows\System\dFoDxAQ.exe

C:\Windows\System\tHCSFFb.exe

C:\Windows\System\tHCSFFb.exe

C:\Windows\System\FkPAKUG.exe

C:\Windows\System\FkPAKUG.exe

C:\Windows\System\VaGmJUw.exe

C:\Windows\System\VaGmJUw.exe

C:\Windows\System\KwVGqQM.exe

C:\Windows\System\KwVGqQM.exe

C:\Windows\System\kWERowy.exe

C:\Windows\System\kWERowy.exe

C:\Windows\System\HGRsIvn.exe

C:\Windows\System\HGRsIvn.exe

C:\Windows\System\JXxTIAX.exe

C:\Windows\System\JXxTIAX.exe

C:\Windows\System\uwLLSFU.exe

C:\Windows\System\uwLLSFU.exe

C:\Windows\System\IDNCknz.exe

C:\Windows\System\IDNCknz.exe

C:\Windows\System\suDRPqv.exe

C:\Windows\System\suDRPqv.exe

C:\Windows\System\bkYibNE.exe

C:\Windows\System\bkYibNE.exe

C:\Windows\System\dsRsyDL.exe

C:\Windows\System\dsRsyDL.exe

C:\Windows\System\ffcYFHr.exe

C:\Windows\System\ffcYFHr.exe

C:\Windows\System\tQqGwVs.exe

C:\Windows\System\tQqGwVs.exe

C:\Windows\System\SVIKUGj.exe

C:\Windows\System\SVIKUGj.exe

C:\Windows\System\PbObsYJ.exe

C:\Windows\System\PbObsYJ.exe

C:\Windows\System\JdNGYTA.exe

C:\Windows\System\JdNGYTA.exe

C:\Windows\System\XizVLQV.exe

C:\Windows\System\XizVLQV.exe

C:\Windows\System\BNafUaZ.exe

C:\Windows\System\BNafUaZ.exe

C:\Windows\System\ktwOxzu.exe

C:\Windows\System\ktwOxzu.exe

C:\Windows\System\GIcAkgu.exe

C:\Windows\System\GIcAkgu.exe

C:\Windows\System\ecIiBRO.exe

C:\Windows\System\ecIiBRO.exe

C:\Windows\System\NeOcQeP.exe

C:\Windows\System\NeOcQeP.exe

C:\Windows\System\xCgrtTR.exe

C:\Windows\System\xCgrtTR.exe

C:\Windows\System\UNEqIUz.exe

C:\Windows\System\UNEqIUz.exe

C:\Windows\System\FLMYWDR.exe

C:\Windows\System\FLMYWDR.exe

C:\Windows\System\dkHMxWi.exe

C:\Windows\System\dkHMxWi.exe

C:\Windows\System\tsmRRFD.exe

C:\Windows\System\tsmRRFD.exe

C:\Windows\System\hsRHLxJ.exe

C:\Windows\System\hsRHLxJ.exe

C:\Windows\System\lnuZgZv.exe

C:\Windows\System\lnuZgZv.exe

C:\Windows\System\trTjiyr.exe

C:\Windows\System\trTjiyr.exe

C:\Windows\System\xuPkgtT.exe

C:\Windows\System\xuPkgtT.exe

C:\Windows\System\RtrMeHU.exe

C:\Windows\System\RtrMeHU.exe

C:\Windows\System\pSjvMsl.exe

C:\Windows\System\pSjvMsl.exe

C:\Windows\System\lwHNSYG.exe

C:\Windows\System\lwHNSYG.exe

C:\Windows\System\QGnLFFM.exe

C:\Windows\System\QGnLFFM.exe

C:\Windows\System\CkiJrYj.exe

C:\Windows\System\CkiJrYj.exe

C:\Windows\System\peZaQYw.exe

C:\Windows\System\peZaQYw.exe

C:\Windows\System\FzLyYNF.exe

C:\Windows\System\FzLyYNF.exe

C:\Windows\System\eWebiGb.exe

C:\Windows\System\eWebiGb.exe

C:\Windows\System\WMqggSt.exe

C:\Windows\System\WMqggSt.exe

C:\Windows\System\FvuUBtt.exe

C:\Windows\System\FvuUBtt.exe

C:\Windows\System\DlTjRGV.exe

C:\Windows\System\DlTjRGV.exe

C:\Windows\System\tgGewGf.exe

C:\Windows\System\tgGewGf.exe

C:\Windows\System\xGweTLH.exe

C:\Windows\System\xGweTLH.exe

C:\Windows\System\xJssblq.exe

C:\Windows\System\xJssblq.exe

C:\Windows\System\MisLYFE.exe

C:\Windows\System\MisLYFE.exe

C:\Windows\System\MkGIaMd.exe

C:\Windows\System\MkGIaMd.exe

C:\Windows\System\XcnrFmU.exe

C:\Windows\System\XcnrFmU.exe

C:\Windows\System\CpjRlWr.exe

C:\Windows\System\CpjRlWr.exe

C:\Windows\System\pUaWQIM.exe

C:\Windows\System\pUaWQIM.exe

C:\Windows\System\ClpzSdw.exe

C:\Windows\System\ClpzSdw.exe

C:\Windows\System\bbmhlVa.exe

C:\Windows\System\bbmhlVa.exe

C:\Windows\System\qGnLlMn.exe

C:\Windows\System\qGnLlMn.exe

C:\Windows\System\naJmnLC.exe

C:\Windows\System\naJmnLC.exe

C:\Windows\System\HAwDXhl.exe

C:\Windows\System\HAwDXhl.exe

C:\Windows\System\AJIEnOQ.exe

C:\Windows\System\AJIEnOQ.exe

C:\Windows\System\dtFsLVA.exe

C:\Windows\System\dtFsLVA.exe

C:\Windows\System\JLXQIWL.exe

C:\Windows\System\JLXQIWL.exe

C:\Windows\System\DszCHBz.exe

C:\Windows\System\DszCHBz.exe

C:\Windows\System\QrLuXbs.exe

C:\Windows\System\QrLuXbs.exe

C:\Windows\System\QjBEPxs.exe

C:\Windows\System\QjBEPxs.exe

C:\Windows\System\NLKairm.exe

C:\Windows\System\NLKairm.exe

C:\Windows\System\KtgXwMY.exe

C:\Windows\System\KtgXwMY.exe

C:\Windows\System\BtIeysj.exe

C:\Windows\System\BtIeysj.exe

C:\Windows\System\xPPtQZT.exe

C:\Windows\System\xPPtQZT.exe

C:\Windows\System\LunclhE.exe

C:\Windows\System\LunclhE.exe

C:\Windows\System\SnOaAVL.exe

C:\Windows\System\SnOaAVL.exe

C:\Windows\System\poONsSg.exe

C:\Windows\System\poONsSg.exe

C:\Windows\System\gKhLwlm.exe

C:\Windows\System\gKhLwlm.exe

C:\Windows\System\NzwozOF.exe

C:\Windows\System\NzwozOF.exe

C:\Windows\System\EsmLBQv.exe

C:\Windows\System\EsmLBQv.exe

C:\Windows\System\KBZOFew.exe

C:\Windows\System\KBZOFew.exe

C:\Windows\System\cQmXaCy.exe

C:\Windows\System\cQmXaCy.exe

C:\Windows\System\CLfwalp.exe

C:\Windows\System\CLfwalp.exe

C:\Windows\System\VcfYxbG.exe

C:\Windows\System\VcfYxbG.exe

C:\Windows\System\zFmBFlq.exe

C:\Windows\System\zFmBFlq.exe

C:\Windows\System\QOQObdB.exe

C:\Windows\System\QOQObdB.exe

C:\Windows\System\rBewIZQ.exe

C:\Windows\System\rBewIZQ.exe

C:\Windows\System\RFOsHVh.exe

C:\Windows\System\RFOsHVh.exe

C:\Windows\System\nnqdOSZ.exe

C:\Windows\System\nnqdOSZ.exe

C:\Windows\System\caBSsrx.exe

C:\Windows\System\caBSsrx.exe

C:\Windows\System\Smraaxb.exe

C:\Windows\System\Smraaxb.exe

C:\Windows\System\DuKDJts.exe

C:\Windows\System\DuKDJts.exe

C:\Windows\System\kvTQATg.exe

C:\Windows\System\kvTQATg.exe

C:\Windows\System\BJyEScf.exe

C:\Windows\System\BJyEScf.exe

C:\Windows\System\KDGRCnK.exe

C:\Windows\System\KDGRCnK.exe

C:\Windows\System\opIGujj.exe

C:\Windows\System\opIGujj.exe

C:\Windows\System\ADCklrw.exe

C:\Windows\System\ADCklrw.exe

C:\Windows\System\gGVLKCk.exe

C:\Windows\System\gGVLKCk.exe

C:\Windows\System\dxizLiG.exe

C:\Windows\System\dxizLiG.exe

C:\Windows\System\HQiatiX.exe

C:\Windows\System\HQiatiX.exe

C:\Windows\System\ZBUjJPe.exe

C:\Windows\System\ZBUjJPe.exe

C:\Windows\System\QyMiejR.exe

C:\Windows\System\QyMiejR.exe

C:\Windows\System\ddErDUO.exe

C:\Windows\System\ddErDUO.exe

C:\Windows\System\JWHfVaR.exe

C:\Windows\System\JWHfVaR.exe

C:\Windows\System\oKlpnuI.exe

C:\Windows\System\oKlpnuI.exe

C:\Windows\System\VUUzGmL.exe

C:\Windows\System\VUUzGmL.exe

C:\Windows\System\IsSDUrY.exe

C:\Windows\System\IsSDUrY.exe

C:\Windows\System\wXHHBLS.exe

C:\Windows\System\wXHHBLS.exe

C:\Windows\System\TttHcSy.exe

C:\Windows\System\TttHcSy.exe

C:\Windows\System\VJsWxGo.exe

C:\Windows\System\VJsWxGo.exe

C:\Windows\System\VfmlHFt.exe

C:\Windows\System\VfmlHFt.exe

C:\Windows\System\TCQkjwu.exe

C:\Windows\System\TCQkjwu.exe

C:\Windows\System\ZHIHfTx.exe

C:\Windows\System\ZHIHfTx.exe

C:\Windows\System\IKLubVX.exe

C:\Windows\System\IKLubVX.exe

C:\Windows\System\uTSlELP.exe

C:\Windows\System\uTSlELP.exe

C:\Windows\System\QOAbgrj.exe

C:\Windows\System\QOAbgrj.exe

C:\Windows\System\zlyEakg.exe

C:\Windows\System\zlyEakg.exe

C:\Windows\System\ZcfwBjx.exe

C:\Windows\System\ZcfwBjx.exe

C:\Windows\System\MxdWIDs.exe

C:\Windows\System\MxdWIDs.exe

C:\Windows\System\Vtjjyrn.exe

C:\Windows\System\Vtjjyrn.exe

C:\Windows\System\hJvLnSu.exe

C:\Windows\System\hJvLnSu.exe

C:\Windows\System\zZNtjuR.exe

C:\Windows\System\zZNtjuR.exe

C:\Windows\System\IuVYYJF.exe

C:\Windows\System\IuVYYJF.exe

C:\Windows\System\SLtYQBc.exe

C:\Windows\System\SLtYQBc.exe

C:\Windows\System\RqZfVFB.exe

C:\Windows\System\RqZfVFB.exe

C:\Windows\System\wZRGuyY.exe

C:\Windows\System\wZRGuyY.exe

C:\Windows\System\gzCZesa.exe

C:\Windows\System\gzCZesa.exe

C:\Windows\System\Pknobvz.exe

C:\Windows\System\Pknobvz.exe

C:\Windows\System\dfMqpHQ.exe

C:\Windows\System\dfMqpHQ.exe

C:\Windows\System\NnpvaCf.exe

C:\Windows\System\NnpvaCf.exe

C:\Windows\System\IvudSOc.exe

C:\Windows\System\IvudSOc.exe

C:\Windows\System\wLvQLjI.exe

C:\Windows\System\wLvQLjI.exe

C:\Windows\System\ymEXJQR.exe

C:\Windows\System\ymEXJQR.exe

C:\Windows\System\MwkxPRl.exe

C:\Windows\System\MwkxPRl.exe

C:\Windows\System\nHRaGQL.exe

C:\Windows\System\nHRaGQL.exe

C:\Windows\System\bFIIemj.exe

C:\Windows\System\bFIIemj.exe

C:\Windows\System\zkxYnmQ.exe

C:\Windows\System\zkxYnmQ.exe

C:\Windows\System\ttRHkwb.exe

C:\Windows\System\ttRHkwb.exe

C:\Windows\System\PDTVNyi.exe

C:\Windows\System\PDTVNyi.exe

C:\Windows\System\ABvyydL.exe

C:\Windows\System\ABvyydL.exe

C:\Windows\System\zlteupJ.exe

C:\Windows\System\zlteupJ.exe

C:\Windows\System\roIAdmi.exe

C:\Windows\System\roIAdmi.exe

C:\Windows\System\anExHLn.exe

C:\Windows\System\anExHLn.exe

C:\Windows\System\zeiltxB.exe

C:\Windows\System\zeiltxB.exe

C:\Windows\System\LldQWxP.exe

C:\Windows\System\LldQWxP.exe

C:\Windows\System\YGihnJM.exe

C:\Windows\System\YGihnJM.exe

C:\Windows\System\EwIUNyn.exe

C:\Windows\System\EwIUNyn.exe

C:\Windows\System\HFoHgYy.exe

C:\Windows\System\HFoHgYy.exe

C:\Windows\System\HmqfnUj.exe

C:\Windows\System\HmqfnUj.exe

C:\Windows\System\JaxBzVC.exe

C:\Windows\System\JaxBzVC.exe

C:\Windows\System\hlaXnqR.exe

C:\Windows\System\hlaXnqR.exe

C:\Windows\System\iCMNYsI.exe

C:\Windows\System\iCMNYsI.exe

C:\Windows\System\MLKrYZz.exe

C:\Windows\System\MLKrYZz.exe

C:\Windows\System\tlwczTp.exe

C:\Windows\System\tlwczTp.exe

C:\Windows\System\etXEMQy.exe

C:\Windows\System\etXEMQy.exe

C:\Windows\System\wZSfNTS.exe

C:\Windows\System\wZSfNTS.exe

C:\Windows\System\StMplUt.exe

C:\Windows\System\StMplUt.exe

C:\Windows\System\PPMNgSU.exe

C:\Windows\System\PPMNgSU.exe

C:\Windows\System\kAciKhP.exe

C:\Windows\System\kAciKhP.exe

C:\Windows\System\GHpPNss.exe

C:\Windows\System\GHpPNss.exe

C:\Windows\System\auURZCf.exe

C:\Windows\System\auURZCf.exe

C:\Windows\System\GSXCsuz.exe

C:\Windows\System\GSXCsuz.exe

C:\Windows\System\bkMhFxf.exe

C:\Windows\System\bkMhFxf.exe

C:\Windows\System\HVCwSvs.exe

C:\Windows\System\HVCwSvs.exe

C:\Windows\System\SqwgWri.exe

C:\Windows\System\SqwgWri.exe

C:\Windows\System\skBBPBB.exe

C:\Windows\System\skBBPBB.exe

C:\Windows\System\VbqTSHr.exe

C:\Windows\System\VbqTSHr.exe

C:\Windows\System\CWsmrdS.exe

C:\Windows\System\CWsmrdS.exe

C:\Windows\System\pceAwop.exe

C:\Windows\System\pceAwop.exe

C:\Windows\System\ZaOWfOV.exe

C:\Windows\System\ZaOWfOV.exe

C:\Windows\System\RiornNQ.exe

C:\Windows\System\RiornNQ.exe

C:\Windows\System\DVZKNJN.exe

C:\Windows\System\DVZKNJN.exe

C:\Windows\System\krAyTvx.exe

C:\Windows\System\krAyTvx.exe

C:\Windows\System\XeDBxXU.exe

C:\Windows\System\XeDBxXU.exe

C:\Windows\System\SGvwhWY.exe

C:\Windows\System\SGvwhWY.exe

C:\Windows\System\rXvSzbE.exe

C:\Windows\System\rXvSzbE.exe

C:\Windows\System\vQpwSQu.exe

C:\Windows\System\vQpwSQu.exe

C:\Windows\System\euiVjCg.exe

C:\Windows\System\euiVjCg.exe

C:\Windows\System\KuvzvnF.exe

C:\Windows\System\KuvzvnF.exe

C:\Windows\System\JaZEPfL.exe

C:\Windows\System\JaZEPfL.exe

C:\Windows\System\pwgKDKZ.exe

C:\Windows\System\pwgKDKZ.exe

C:\Windows\System\XZWGSUp.exe

C:\Windows\System\XZWGSUp.exe

C:\Windows\System\oGzhGXd.exe

C:\Windows\System\oGzhGXd.exe

C:\Windows\System\feRSNGz.exe

C:\Windows\System\feRSNGz.exe

C:\Windows\System\kceOlJw.exe

C:\Windows\System\kceOlJw.exe

C:\Windows\System\pEsxYjG.exe

C:\Windows\System\pEsxYjG.exe

C:\Windows\System\AyWeMlP.exe

C:\Windows\System\AyWeMlP.exe

C:\Windows\System\JCjbTZy.exe

C:\Windows\System\JCjbTZy.exe

C:\Windows\System\EUiCcPg.exe

C:\Windows\System\EUiCcPg.exe

C:\Windows\System\FCLtrIq.exe

C:\Windows\System\FCLtrIq.exe

C:\Windows\System\GXwQXbd.exe

C:\Windows\System\GXwQXbd.exe

C:\Windows\System\kxeAFvX.exe

C:\Windows\System\kxeAFvX.exe

C:\Windows\System\snHmYIl.exe

C:\Windows\System\snHmYIl.exe

C:\Windows\System\ycGjnyB.exe

C:\Windows\System\ycGjnyB.exe

C:\Windows\System\JpMwcpy.exe

C:\Windows\System\JpMwcpy.exe

C:\Windows\System\AXTAAwx.exe

C:\Windows\System\AXTAAwx.exe

C:\Windows\System\ExPYlyo.exe

C:\Windows\System\ExPYlyo.exe

C:\Windows\System\xCnbzQQ.exe

C:\Windows\System\xCnbzQQ.exe

C:\Windows\System\JPGewyQ.exe

C:\Windows\System\JPGewyQ.exe

C:\Windows\System\YhyVZJu.exe

C:\Windows\System\YhyVZJu.exe

C:\Windows\System\rBOZUAp.exe

C:\Windows\System\rBOZUAp.exe

C:\Windows\System\RDEZCQa.exe

C:\Windows\System\RDEZCQa.exe

C:\Windows\System\JqHRVKk.exe

C:\Windows\System\JqHRVKk.exe

C:\Windows\System\UTEskwp.exe

C:\Windows\System\UTEskwp.exe

C:\Windows\System\keNjSCZ.exe

C:\Windows\System\keNjSCZ.exe

C:\Windows\System\YfPMhvv.exe

C:\Windows\System\YfPMhvv.exe

C:\Windows\System\aOqOxZw.exe

C:\Windows\System\aOqOxZw.exe

C:\Windows\System\JpAPELb.exe

C:\Windows\System\JpAPELb.exe

C:\Windows\System\qbwtnQK.exe

C:\Windows\System\qbwtnQK.exe

C:\Windows\System\RvnsvZE.exe

C:\Windows\System\RvnsvZE.exe

C:\Windows\System\cihrIie.exe

C:\Windows\System\cihrIie.exe

C:\Windows\System\DkNdwMv.exe

C:\Windows\System\DkNdwMv.exe

C:\Windows\System\PDLxLdz.exe

C:\Windows\System\PDLxLdz.exe

C:\Windows\System\IImbjgl.exe

C:\Windows\System\IImbjgl.exe

C:\Windows\System\LVGzUZE.exe

C:\Windows\System\LVGzUZE.exe

C:\Windows\System\UWnvfNm.exe

C:\Windows\System\UWnvfNm.exe

C:\Windows\System\KQxICwG.exe

C:\Windows\System\KQxICwG.exe

C:\Windows\System\yEYKVpY.exe

C:\Windows\System\yEYKVpY.exe

C:\Windows\System\YlSJrej.exe

C:\Windows\System\YlSJrej.exe

C:\Windows\System\Epauhwa.exe

C:\Windows\System\Epauhwa.exe

C:\Windows\System\pzVupOp.exe

C:\Windows\System\pzVupOp.exe

C:\Windows\System\KHtZdEe.exe

C:\Windows\System\KHtZdEe.exe

C:\Windows\System\iAOkwoo.exe

C:\Windows\System\iAOkwoo.exe

C:\Windows\System\ZZyUKyp.exe

C:\Windows\System\ZZyUKyp.exe

C:\Windows\System\avUQeoj.exe

C:\Windows\System\avUQeoj.exe

C:\Windows\System\MZfSUZM.exe

C:\Windows\System\MZfSUZM.exe

C:\Windows\System\wJiJvgm.exe

C:\Windows\System\wJiJvgm.exe

C:\Windows\System\qhxJioT.exe

C:\Windows\System\qhxJioT.exe

C:\Windows\System\OHZGtll.exe

C:\Windows\System\OHZGtll.exe

C:\Windows\System\PWZbFmS.exe

C:\Windows\System\PWZbFmS.exe

C:\Windows\System\hthMUAz.exe

C:\Windows\System\hthMUAz.exe

C:\Windows\System\HNKiQta.exe

C:\Windows\System\HNKiQta.exe

C:\Windows\System\MclyCuE.exe

C:\Windows\System\MclyCuE.exe

C:\Windows\System\tkVbyLi.exe

C:\Windows\System\tkVbyLi.exe

C:\Windows\System\ImIORzN.exe

C:\Windows\System\ImIORzN.exe

C:\Windows\System\AAbnyaZ.exe

C:\Windows\System\AAbnyaZ.exe

C:\Windows\System\CIdFxYf.exe

C:\Windows\System\CIdFxYf.exe

C:\Windows\System\LYomycm.exe

C:\Windows\System\LYomycm.exe

C:\Windows\System\LuZIAhf.exe

C:\Windows\System\LuZIAhf.exe

C:\Windows\System\MvDYtoF.exe

C:\Windows\System\MvDYtoF.exe

C:\Windows\System\rWONtJQ.exe

C:\Windows\System\rWONtJQ.exe

C:\Windows\System\tpWkupc.exe

C:\Windows\System\tpWkupc.exe

C:\Windows\System\hTbXWDV.exe

C:\Windows\System\hTbXWDV.exe

C:\Windows\System\UroHzOl.exe

C:\Windows\System\UroHzOl.exe

C:\Windows\System\DTMBeaR.exe

C:\Windows\System\DTMBeaR.exe

C:\Windows\System\vrAXApO.exe

C:\Windows\System\vrAXApO.exe

C:\Windows\System\gQjxukY.exe

C:\Windows\System\gQjxukY.exe

C:\Windows\System\NyxSdIH.exe

C:\Windows\System\NyxSdIH.exe

C:\Windows\System\aUpIXrM.exe

C:\Windows\System\aUpIXrM.exe

C:\Windows\System\SKRlHWf.exe

C:\Windows\System\SKRlHWf.exe

C:\Windows\System\TeLBRJq.exe

C:\Windows\System\TeLBRJq.exe

C:\Windows\System\RXgJFog.exe

C:\Windows\System\RXgJFog.exe

C:\Windows\System\yuwaRCl.exe

C:\Windows\System\yuwaRCl.exe

C:\Windows\System\gFvaJGx.exe

C:\Windows\System\gFvaJGx.exe

C:\Windows\System\APzcOEz.exe

C:\Windows\System\APzcOEz.exe

C:\Windows\System\FZaydhn.exe

C:\Windows\System\FZaydhn.exe

C:\Windows\System\ZZKJfsA.exe

C:\Windows\System\ZZKJfsA.exe

C:\Windows\System\upYjiby.exe

C:\Windows\System\upYjiby.exe

C:\Windows\System\kYqSWoB.exe

C:\Windows\System\kYqSWoB.exe

C:\Windows\System\ZlyehQY.exe

C:\Windows\System\ZlyehQY.exe

C:\Windows\System\DsjOyDn.exe

C:\Windows\System\DsjOyDn.exe

C:\Windows\System\dtEtmnf.exe

C:\Windows\System\dtEtmnf.exe

C:\Windows\System\jyXfxCc.exe

C:\Windows\System\jyXfxCc.exe

C:\Windows\System\tYRwjyn.exe

C:\Windows\System\tYRwjyn.exe

C:\Windows\System\JclQhlY.exe

C:\Windows\System\JclQhlY.exe

C:\Windows\System\lBjcWLU.exe

C:\Windows\System\lBjcWLU.exe

C:\Windows\System\KSNbeiD.exe

C:\Windows\System\KSNbeiD.exe

C:\Windows\System\iYTFigA.exe

C:\Windows\System\iYTFigA.exe

C:\Windows\System\SzPFQxF.exe

C:\Windows\System\SzPFQxF.exe

C:\Windows\System\vxQjeYF.exe

C:\Windows\System\vxQjeYF.exe

C:\Windows\System\XxExGRo.exe

C:\Windows\System\XxExGRo.exe

C:\Windows\System\MKfRhvw.exe

C:\Windows\System\MKfRhvw.exe

C:\Windows\System\qGSkIev.exe

C:\Windows\System\qGSkIev.exe

C:\Windows\System\tPNAliY.exe

C:\Windows\System\tPNAliY.exe

C:\Windows\System\KSlsvWm.exe

C:\Windows\System\KSlsvWm.exe

C:\Windows\System\VEoVMHJ.exe

C:\Windows\System\VEoVMHJ.exe

C:\Windows\System\wPdsdIH.exe

C:\Windows\System\wPdsdIH.exe

C:\Windows\System\JrVHrLc.exe

C:\Windows\System\JrVHrLc.exe

C:\Windows\System\NsYHHJP.exe

C:\Windows\System\NsYHHJP.exe

C:\Windows\System\rKDNlPT.exe

C:\Windows\System\rKDNlPT.exe

C:\Windows\System\XLbrpnG.exe

C:\Windows\System\XLbrpnG.exe

C:\Windows\System\gKllhhq.exe

C:\Windows\System\gKllhhq.exe

C:\Windows\System\EnowFkZ.exe

C:\Windows\System\EnowFkZ.exe

C:\Windows\System\FTRgOpX.exe

C:\Windows\System\FTRgOpX.exe

C:\Windows\System\QlkwTuk.exe

C:\Windows\System\QlkwTuk.exe

C:\Windows\System\AoJnbqe.exe

C:\Windows\System\AoJnbqe.exe

C:\Windows\System\scOKQRU.exe

C:\Windows\System\scOKQRU.exe

C:\Windows\System\MvZqOzs.exe

C:\Windows\System\MvZqOzs.exe

C:\Windows\System\gNQHEPU.exe

C:\Windows\System\gNQHEPU.exe

C:\Windows\System\DjkjuVN.exe

C:\Windows\System\DjkjuVN.exe

C:\Windows\System\KDvZVDh.exe

C:\Windows\System\KDvZVDh.exe

C:\Windows\System\yJcpLUG.exe

C:\Windows\System\yJcpLUG.exe

C:\Windows\System\OjMoFAD.exe

C:\Windows\System\OjMoFAD.exe

C:\Windows\System\TTQkPno.exe

C:\Windows\System\TTQkPno.exe

C:\Windows\System\BmxhbXT.exe

C:\Windows\System\BmxhbXT.exe

C:\Windows\System\AUNjDrp.exe

C:\Windows\System\AUNjDrp.exe

C:\Windows\System\xGUzjnb.exe

C:\Windows\System\xGUzjnb.exe

C:\Windows\System\ZFOwYuu.exe

C:\Windows\System\ZFOwYuu.exe

C:\Windows\System\KnAwkBr.exe

C:\Windows\System\KnAwkBr.exe

C:\Windows\System\HaIDeka.exe

C:\Windows\System\HaIDeka.exe

C:\Windows\System\jkrBMsg.exe

C:\Windows\System\jkrBMsg.exe

C:\Windows\System\ZYFOCox.exe

C:\Windows\System\ZYFOCox.exe

C:\Windows\System\AIUBOGc.exe

C:\Windows\System\AIUBOGc.exe

C:\Windows\System\JTcrdjm.exe

C:\Windows\System\JTcrdjm.exe

C:\Windows\System\MKBbIhE.exe

C:\Windows\System\MKBbIhE.exe

C:\Windows\System\frWQHBE.exe

C:\Windows\System\frWQHBE.exe

C:\Windows\System\mOPimCG.exe

C:\Windows\System\mOPimCG.exe

C:\Windows\System\tmTsySP.exe

C:\Windows\System\tmTsySP.exe

C:\Windows\System\tBMgTjY.exe

C:\Windows\System\tBMgTjY.exe

C:\Windows\System\GbRyqGs.exe

C:\Windows\System\GbRyqGs.exe

C:\Windows\System\UpnBwPi.exe

C:\Windows\System\UpnBwPi.exe

C:\Windows\System\UChfrDa.exe

C:\Windows\System\UChfrDa.exe

C:\Windows\System\eaXgOWt.exe

C:\Windows\System\eaXgOWt.exe

C:\Windows\System\bsbGjWP.exe

C:\Windows\System\bsbGjWP.exe

C:\Windows\System\cFebVBn.exe

C:\Windows\System\cFebVBn.exe

C:\Windows\System\syhqfbk.exe

C:\Windows\System\syhqfbk.exe

C:\Windows\System\tfbqbHS.exe

C:\Windows\System\tfbqbHS.exe

C:\Windows\System\MxLZDEp.exe

C:\Windows\System\MxLZDEp.exe

C:\Windows\System\eDLdLKV.exe

C:\Windows\System\eDLdLKV.exe

C:\Windows\System\ydIssoS.exe

C:\Windows\System\ydIssoS.exe

C:\Windows\System\wMjeTcj.exe

C:\Windows\System\wMjeTcj.exe

C:\Windows\System\fNDpbSW.exe

C:\Windows\System\fNDpbSW.exe

C:\Windows\System\iJmWsuR.exe

C:\Windows\System\iJmWsuR.exe

C:\Windows\System\VZbbVAw.exe

C:\Windows\System\VZbbVAw.exe

C:\Windows\System\ZKwpiQR.exe

C:\Windows\System\ZKwpiQR.exe

C:\Windows\System\SPxxqyc.exe

C:\Windows\System\SPxxqyc.exe

C:\Windows\System\ZRSpgvn.exe

C:\Windows\System\ZRSpgvn.exe

C:\Windows\System\GfVXzhA.exe

C:\Windows\System\GfVXzhA.exe

C:\Windows\System\pcPunWE.exe

C:\Windows\System\pcPunWE.exe

C:\Windows\System\KOsDUaO.exe

C:\Windows\System\KOsDUaO.exe

C:\Windows\System\oQjkGKg.exe

C:\Windows\System\oQjkGKg.exe

C:\Windows\System\iaJMRGI.exe

C:\Windows\System\iaJMRGI.exe

C:\Windows\System\vPtjMJz.exe

C:\Windows\System\vPtjMJz.exe

C:\Windows\System\sfYwzxh.exe

C:\Windows\System\sfYwzxh.exe

C:\Windows\System\IIUkNyn.exe

C:\Windows\System\IIUkNyn.exe

C:\Windows\System\bASIQhE.exe

C:\Windows\System\bASIQhE.exe

C:\Windows\System\NbrWdQd.exe

C:\Windows\System\NbrWdQd.exe

C:\Windows\System\Sspgsxr.exe

C:\Windows\System\Sspgsxr.exe

C:\Windows\System\uThUqpo.exe

C:\Windows\System\uThUqpo.exe

C:\Windows\System\VebELyk.exe

C:\Windows\System\VebELyk.exe

C:\Windows\System\wLlkhYZ.exe

C:\Windows\System\wLlkhYZ.exe

C:\Windows\System\ZrbGryJ.exe

C:\Windows\System\ZrbGryJ.exe

C:\Windows\System\ATzAIHp.exe

C:\Windows\System\ATzAIHp.exe

C:\Windows\System\ZGkksHU.exe

C:\Windows\System\ZGkksHU.exe

C:\Windows\System\eoYIjJX.exe

C:\Windows\System\eoYIjJX.exe

C:\Windows\System\BgzFqyD.exe

C:\Windows\System\BgzFqyD.exe

C:\Windows\System\OCRZwRA.exe

C:\Windows\System\OCRZwRA.exe

C:\Windows\System\VKcHayJ.exe

C:\Windows\System\VKcHayJ.exe

C:\Windows\System\eCLPLgn.exe

C:\Windows\System\eCLPLgn.exe

C:\Windows\System\MvwYofH.exe

C:\Windows\System\MvwYofH.exe

C:\Windows\System\ygDBOsL.exe

C:\Windows\System\ygDBOsL.exe

C:\Windows\System\fJVIXZv.exe

C:\Windows\System\fJVIXZv.exe

C:\Windows\System\RWzflgG.exe

C:\Windows\System\RWzflgG.exe

C:\Windows\System\uqhIKep.exe

C:\Windows\System\uqhIKep.exe

C:\Windows\System\XfbmQNm.exe

C:\Windows\System\XfbmQNm.exe

C:\Windows\System\RMBYsMb.exe

C:\Windows\System\RMBYsMb.exe

C:\Windows\System\PHjbEIB.exe

C:\Windows\System\PHjbEIB.exe

C:\Windows\System\WhfwBnT.exe

C:\Windows\System\WhfwBnT.exe

C:\Windows\System\NHeLNPZ.exe

C:\Windows\System\NHeLNPZ.exe

C:\Windows\System\eDmIoqn.exe

C:\Windows\System\eDmIoqn.exe

C:\Windows\System\RZeuwMo.exe

C:\Windows\System\RZeuwMo.exe

C:\Windows\System\maniLHB.exe

C:\Windows\System\maniLHB.exe

C:\Windows\System\xiTQKPm.exe

C:\Windows\System\xiTQKPm.exe

C:\Windows\System\dckuDog.exe

C:\Windows\System\dckuDog.exe

C:\Windows\System\hcWydRU.exe

C:\Windows\System\hcWydRU.exe

C:\Windows\System\lSVlHtR.exe

C:\Windows\System\lSVlHtR.exe

C:\Windows\System\FzYCOwx.exe

C:\Windows\System\FzYCOwx.exe

C:\Windows\System\SGyOjvd.exe

C:\Windows\System\SGyOjvd.exe

C:\Windows\System\AwQNvgY.exe

C:\Windows\System\AwQNvgY.exe

C:\Windows\System\yRYgabD.exe

C:\Windows\System\yRYgabD.exe

C:\Windows\System\JSGHJeU.exe

C:\Windows\System\JSGHJeU.exe

C:\Windows\System\YfyBSQL.exe

C:\Windows\System\YfyBSQL.exe

C:\Windows\System\YzqUHPu.exe

C:\Windows\System\YzqUHPu.exe

C:\Windows\System\qIpYMLH.exe

C:\Windows\System\qIpYMLH.exe

C:\Windows\System\oSViEUL.exe

C:\Windows\System\oSViEUL.exe

C:\Windows\System\iaLMwcc.exe

C:\Windows\System\iaLMwcc.exe

C:\Windows\System\gWTfgYS.exe

C:\Windows\System\gWTfgYS.exe

C:\Windows\System\VmGEmMd.exe

C:\Windows\System\VmGEmMd.exe

C:\Windows\System\XJNMyIk.exe

C:\Windows\System\XJNMyIk.exe

C:\Windows\System\IKdNmGc.exe

C:\Windows\System\IKdNmGc.exe

C:\Windows\System\kEjPUea.exe

C:\Windows\System\kEjPUea.exe

C:\Windows\System\PjCAoNa.exe

C:\Windows\System\PjCAoNa.exe

C:\Windows\System\ciNiidB.exe

C:\Windows\System\ciNiidB.exe

C:\Windows\System\rwuaoBR.exe

C:\Windows\System\rwuaoBR.exe

C:\Windows\System\ixICWsg.exe

C:\Windows\System\ixICWsg.exe

C:\Windows\System\cVXynmF.exe

C:\Windows\System\cVXynmF.exe

C:\Windows\System\VUyhfwL.exe

C:\Windows\System\VUyhfwL.exe

C:\Windows\System\eOIPWMR.exe

C:\Windows\System\eOIPWMR.exe

C:\Windows\System\gIewMMu.exe

C:\Windows\System\gIewMMu.exe

C:\Windows\System\GCpUyAp.exe

C:\Windows\System\GCpUyAp.exe

C:\Windows\System\MMhzcqd.exe

C:\Windows\System\MMhzcqd.exe

C:\Windows\System\zlyyBdo.exe

C:\Windows\System\zlyyBdo.exe

C:\Windows\System\AaJjsXx.exe

C:\Windows\System\AaJjsXx.exe

C:\Windows\System\iPHHckC.exe

C:\Windows\System\iPHHckC.exe

C:\Windows\System\twjMvpy.exe

C:\Windows\System\twjMvpy.exe

C:\Windows\System\AxfuEdV.exe

C:\Windows\System\AxfuEdV.exe

C:\Windows\System\ZPkmvbN.exe

C:\Windows\System\ZPkmvbN.exe

C:\Windows\System\kQwcXZR.exe

C:\Windows\System\kQwcXZR.exe

C:\Windows\System\diIjxZi.exe

C:\Windows\System\diIjxZi.exe

C:\Windows\System\ixvAlQj.exe

C:\Windows\System\ixvAlQj.exe

C:\Windows\System\GBHneuo.exe

C:\Windows\System\GBHneuo.exe

C:\Windows\System\voFVqaW.exe

C:\Windows\System\voFVqaW.exe

C:\Windows\System\ISrfSEf.exe

C:\Windows\System\ISrfSEf.exe

C:\Windows\System\nqIyfBR.exe

C:\Windows\System\nqIyfBR.exe

C:\Windows\System\ZrpIMCz.exe

C:\Windows\System\ZrpIMCz.exe

C:\Windows\System\qltXXYz.exe

C:\Windows\System\qltXXYz.exe

C:\Windows\System\mlztAPa.exe

C:\Windows\System\mlztAPa.exe

C:\Windows\System\fFSAyRT.exe

C:\Windows\System\fFSAyRT.exe

C:\Windows\System\DnpFCuC.exe

C:\Windows\System\DnpFCuC.exe

C:\Windows\System\bmLRagY.exe

C:\Windows\System\bmLRagY.exe

C:\Windows\System\uXSdDrk.exe

C:\Windows\System\uXSdDrk.exe

C:\Windows\System\jTtCvbp.exe

C:\Windows\System\jTtCvbp.exe

C:\Windows\System\hDISRMw.exe

C:\Windows\System\hDISRMw.exe

C:\Windows\System\OkroSsY.exe

C:\Windows\System\OkroSsY.exe

C:\Windows\System\kLZpGlZ.exe

C:\Windows\System\kLZpGlZ.exe

C:\Windows\System\CKHzvEM.exe

C:\Windows\System\CKHzvEM.exe

C:\Windows\System\vnpbWqp.exe

C:\Windows\System\vnpbWqp.exe

C:\Windows\System\pYsOFVo.exe

C:\Windows\System\pYsOFVo.exe

C:\Windows\System\JAOjqfo.exe

C:\Windows\System\JAOjqfo.exe

C:\Windows\System\SshFVQg.exe

C:\Windows\System\SshFVQg.exe

C:\Windows\System\rHUnxTd.exe

C:\Windows\System\rHUnxTd.exe

C:\Windows\System\vRAyXnX.exe

C:\Windows\System\vRAyXnX.exe

C:\Windows\System\tLkZdJX.exe

C:\Windows\System\tLkZdJX.exe

C:\Windows\System\XtfFXDJ.exe

C:\Windows\System\XtfFXDJ.exe

C:\Windows\System\vSUwyYB.exe

C:\Windows\System\vSUwyYB.exe

C:\Windows\System\LbasItj.exe

C:\Windows\System\LbasItj.exe

C:\Windows\System\XGajBYG.exe

C:\Windows\System\XGajBYG.exe

C:\Windows\System\wxrPgFU.exe

C:\Windows\System\wxrPgFU.exe

C:\Windows\System\DgSfpQX.exe

C:\Windows\System\DgSfpQX.exe

C:\Windows\System\EJYacwu.exe

C:\Windows\System\EJYacwu.exe

C:\Windows\System\GhNUoAl.exe

C:\Windows\System\GhNUoAl.exe

C:\Windows\System\zZOObtA.exe

C:\Windows\System\zZOObtA.exe

C:\Windows\System\zLOhzou.exe

C:\Windows\System\zLOhzou.exe

C:\Windows\System\dXIpPXs.exe

C:\Windows\System\dXIpPXs.exe

C:\Windows\System\ioQXRcD.exe

C:\Windows\System\ioQXRcD.exe

C:\Windows\System\CuDfSrc.exe

C:\Windows\System\CuDfSrc.exe

C:\Windows\System\XAxZsrw.exe

C:\Windows\System\XAxZsrw.exe

C:\Windows\System\MXExGnQ.exe

C:\Windows\System\MXExGnQ.exe

C:\Windows\System\JOjMfPs.exe

C:\Windows\System\JOjMfPs.exe

C:\Windows\System\ctuCTGJ.exe

C:\Windows\System\ctuCTGJ.exe

C:\Windows\System\ArDxLZR.exe

C:\Windows\System\ArDxLZR.exe

C:\Windows\System\bQSHPfj.exe

C:\Windows\System\bQSHPfj.exe

C:\Windows\System\RXjsfvr.exe

C:\Windows\System\RXjsfvr.exe

C:\Windows\System\LkEntIO.exe

C:\Windows\System\LkEntIO.exe

C:\Windows\System\zNhUDWR.exe

C:\Windows\System\zNhUDWR.exe

C:\Windows\System\wbzEiSt.exe

C:\Windows\System\wbzEiSt.exe

C:\Windows\System\qJHgTfd.exe

C:\Windows\System\qJHgTfd.exe

C:\Windows\System\obemDvu.exe

C:\Windows\System\obemDvu.exe

C:\Windows\System\xsLZZjC.exe

C:\Windows\System\xsLZZjC.exe

C:\Windows\System\VZkJgEk.exe

C:\Windows\System\VZkJgEk.exe

C:\Windows\System\TIEPOOt.exe

C:\Windows\System\TIEPOOt.exe

C:\Windows\System\qtYCDQc.exe

C:\Windows\System\qtYCDQc.exe

C:\Windows\System\eNRUUZS.exe

C:\Windows\System\eNRUUZS.exe

C:\Windows\System\suspfqk.exe

C:\Windows\System\suspfqk.exe

C:\Windows\System\KiiyPrn.exe

C:\Windows\System\KiiyPrn.exe

C:\Windows\System\ZTUyObj.exe

C:\Windows\System\ZTUyObj.exe

C:\Windows\System\VKCiuwb.exe

C:\Windows\System\VKCiuwb.exe

C:\Windows\System\PbKYHWK.exe

C:\Windows\System\PbKYHWK.exe

C:\Windows\System\rJjaMAk.exe

C:\Windows\System\rJjaMAk.exe

C:\Windows\System\wDvyGXb.exe

C:\Windows\System\wDvyGXb.exe

C:\Windows\System\vfVCYHm.exe

C:\Windows\System\vfVCYHm.exe

C:\Windows\System\RaWngEX.exe

C:\Windows\System\RaWngEX.exe

C:\Windows\System\qcqboib.exe

C:\Windows\System\qcqboib.exe

C:\Windows\System\RChtkNh.exe

C:\Windows\System\RChtkNh.exe

C:\Windows\System\xdresnc.exe

C:\Windows\System\xdresnc.exe

C:\Windows\System\ETrqGQT.exe

C:\Windows\System\ETrqGQT.exe

C:\Windows\System\QjIwVTa.exe

C:\Windows\System\QjIwVTa.exe

C:\Windows\System\oXZOzDe.exe

C:\Windows\System\oXZOzDe.exe

C:\Windows\System\aKzdJyc.exe

C:\Windows\System\aKzdJyc.exe

C:\Windows\System\NtiHnGG.exe

C:\Windows\System\NtiHnGG.exe

C:\Windows\System\gDcrdAu.exe

C:\Windows\System\gDcrdAu.exe

C:\Windows\System\igSEKcm.exe

C:\Windows\System\igSEKcm.exe

C:\Windows\System\SDkUkoB.exe

C:\Windows\System\SDkUkoB.exe

C:\Windows\System\IjrKkhT.exe

C:\Windows\System\IjrKkhT.exe

C:\Windows\System\cutsGzF.exe

C:\Windows\System\cutsGzF.exe

C:\Windows\System\vChboHl.exe

C:\Windows\System\vChboHl.exe

C:\Windows\System\criiJdw.exe

C:\Windows\System\criiJdw.exe

C:\Windows\System\SeoGcdv.exe

C:\Windows\System\SeoGcdv.exe

C:\Windows\System\SactFXC.exe

C:\Windows\System\SactFXC.exe

C:\Windows\System\xfxWdVR.exe

C:\Windows\System\xfxWdVR.exe

C:\Windows\System\cTOhczq.exe

C:\Windows\System\cTOhczq.exe

C:\Windows\System\YFchNGS.exe

C:\Windows\System\YFchNGS.exe

C:\Windows\System\GTYRFxD.exe

C:\Windows\System\GTYRFxD.exe

C:\Windows\System\htdNivn.exe

C:\Windows\System\htdNivn.exe

C:\Windows\System\cGuHZzt.exe

C:\Windows\System\cGuHZzt.exe

C:\Windows\System\OKZrFDw.exe

C:\Windows\System\OKZrFDw.exe

C:\Windows\System\ajEQjxc.exe

C:\Windows\System\ajEQjxc.exe

C:\Windows\System\ZHCgAaZ.exe

C:\Windows\System\ZHCgAaZ.exe

C:\Windows\System\usYVkFg.exe

C:\Windows\System\usYVkFg.exe

C:\Windows\System\XHqPIlo.exe

C:\Windows\System\XHqPIlo.exe

C:\Windows\System\XobNoZQ.exe

C:\Windows\System\XobNoZQ.exe

C:\Windows\System\lbhvwtV.exe

C:\Windows\System\lbhvwtV.exe

C:\Windows\System\ZofhDsJ.exe

C:\Windows\System\ZofhDsJ.exe

C:\Windows\System\kiSitgo.exe

C:\Windows\System\kiSitgo.exe

C:\Windows\System\vzLWUNM.exe

C:\Windows\System\vzLWUNM.exe

C:\Windows\System\lYObhFl.exe

C:\Windows\System\lYObhFl.exe

C:\Windows\System\zAzYuXY.exe

C:\Windows\System\zAzYuXY.exe

C:\Windows\System\ExwHyIR.exe

C:\Windows\System\ExwHyIR.exe

C:\Windows\System\qPVqYbD.exe

C:\Windows\System\qPVqYbD.exe

C:\Windows\System\lSHxKFO.exe

C:\Windows\System\lSHxKFO.exe

C:\Windows\System\BNRCoyM.exe

C:\Windows\System\BNRCoyM.exe

C:\Windows\System\BoPpRah.exe

C:\Windows\System\BoPpRah.exe

C:\Windows\System\BuraLqc.exe

C:\Windows\System\BuraLqc.exe

C:\Windows\System\bsmtvbq.exe

C:\Windows\System\bsmtvbq.exe

C:\Windows\System\yCTBKyR.exe

C:\Windows\System\yCTBKyR.exe

C:\Windows\System\gBvyiBs.exe

C:\Windows\System\gBvyiBs.exe

C:\Windows\System\crACMmC.exe

C:\Windows\System\crACMmC.exe

C:\Windows\System\EoOTgul.exe

C:\Windows\System\EoOTgul.exe

C:\Windows\System\adXKpoT.exe

C:\Windows\System\adXKpoT.exe

C:\Windows\System\PsAkMaU.exe

C:\Windows\System\PsAkMaU.exe

C:\Windows\System\kUPnjis.exe

C:\Windows\System\kUPnjis.exe

C:\Windows\System\VpLRgrC.exe

C:\Windows\System\VpLRgrC.exe

C:\Windows\System\rYGuFWx.exe

C:\Windows\System\rYGuFWx.exe

C:\Windows\System\SsfQwQW.exe

C:\Windows\System\SsfQwQW.exe

C:\Windows\System\biyjETV.exe

C:\Windows\System\biyjETV.exe

C:\Windows\System\sRXvsPP.exe

C:\Windows\System\sRXvsPP.exe

C:\Windows\System\RGdAHsZ.exe

C:\Windows\System\RGdAHsZ.exe

C:\Windows\System\AUGmHvw.exe

C:\Windows\System\AUGmHvw.exe

C:\Windows\System\ZIQVouL.exe

C:\Windows\System\ZIQVouL.exe

C:\Windows\System\WFvjUvZ.exe

C:\Windows\System\WFvjUvZ.exe

C:\Windows\System\HrCwAoj.exe

C:\Windows\System\HrCwAoj.exe

C:\Windows\System\sbGlYzh.exe

C:\Windows\System\sbGlYzh.exe

C:\Windows\System\MQmPlqU.exe

C:\Windows\System\MQmPlqU.exe

C:\Windows\System\TyHOZNO.exe

C:\Windows\System\TyHOZNO.exe

C:\Windows\System\xeTiakR.exe

C:\Windows\System\xeTiakR.exe

C:\Windows\System\JpAIxbq.exe

C:\Windows\System\JpAIxbq.exe

C:\Windows\System\otdwpcw.exe

C:\Windows\System\otdwpcw.exe

C:\Windows\System\xPUqavW.exe

C:\Windows\System\xPUqavW.exe

C:\Windows\System\fLRkFvh.exe

C:\Windows\System\fLRkFvh.exe

C:\Windows\System\ljeIxZH.exe

C:\Windows\System\ljeIxZH.exe

C:\Windows\System\rhBsVxT.exe

C:\Windows\System\rhBsVxT.exe

C:\Windows\System\eGxpIpN.exe

C:\Windows\System\eGxpIpN.exe

C:\Windows\System\aNxLnbU.exe

C:\Windows\System\aNxLnbU.exe

C:\Windows\System\PPaybXy.exe

C:\Windows\System\PPaybXy.exe

C:\Windows\System\flLWZDR.exe

C:\Windows\System\flLWZDR.exe

C:\Windows\System\gHWVwRs.exe

C:\Windows\System\gHWVwRs.exe

C:\Windows\System\XwLJjFS.exe

C:\Windows\System\XwLJjFS.exe

C:\Windows\System\OotnZfe.exe

C:\Windows\System\OotnZfe.exe

C:\Windows\System\kCACZsP.exe

C:\Windows\System\kCACZsP.exe

C:\Windows\System\didzNey.exe

C:\Windows\System\didzNey.exe

C:\Windows\System\fwlaPzg.exe

C:\Windows\System\fwlaPzg.exe

C:\Windows\System\USJnuBk.exe

C:\Windows\System\USJnuBk.exe

C:\Windows\System\MIsmVPu.exe

C:\Windows\System\MIsmVPu.exe

C:\Windows\System\tHsfAgF.exe

C:\Windows\System\tHsfAgF.exe

C:\Windows\System\bEKhhff.exe

C:\Windows\System\bEKhhff.exe

C:\Windows\System\jWRYAZP.exe

C:\Windows\System\jWRYAZP.exe

C:\Windows\System\dohPouH.exe

C:\Windows\System\dohPouH.exe

C:\Windows\System\WNQjLmf.exe

C:\Windows\System\WNQjLmf.exe

C:\Windows\System\FZNragY.exe

C:\Windows\System\FZNragY.exe

C:\Windows\System\jxMmIOj.exe

C:\Windows\System\jxMmIOj.exe

C:\Windows\System\WDgMTOE.exe

C:\Windows\System\WDgMTOE.exe

C:\Windows\System\eZybgKx.exe

C:\Windows\System\eZybgKx.exe

C:\Windows\System\cQnQGJo.exe

C:\Windows\System\cQnQGJo.exe

C:\Windows\System\YPzLGSg.exe

C:\Windows\System\YPzLGSg.exe

C:\Windows\System\dAHxDda.exe

C:\Windows\System\dAHxDda.exe

C:\Windows\System\FfeqBgG.exe

C:\Windows\System\FfeqBgG.exe

C:\Windows\System\vLBUnqj.exe

C:\Windows\System\vLBUnqj.exe

C:\Windows\System\nYcEebk.exe

C:\Windows\System\nYcEebk.exe

C:\Windows\System\AcrJqYS.exe

C:\Windows\System\AcrJqYS.exe

C:\Windows\System\aScIyym.exe

C:\Windows\System\aScIyym.exe

C:\Windows\System\NifBKJY.exe

C:\Windows\System\NifBKJY.exe

C:\Windows\System\rWNeTfd.exe

C:\Windows\System\rWNeTfd.exe

C:\Windows\System\TgRPwFt.exe

C:\Windows\System\TgRPwFt.exe

C:\Windows\System\HPLtDHp.exe

C:\Windows\System\HPLtDHp.exe

C:\Windows\System\cyzsmis.exe

C:\Windows\System\cyzsmis.exe

C:\Windows\System\oWEfbNI.exe

C:\Windows\System\oWEfbNI.exe

C:\Windows\System\KREdysu.exe

C:\Windows\System\KREdysu.exe

C:\Windows\System\yqvIuMF.exe

C:\Windows\System\yqvIuMF.exe

C:\Windows\System\eadYNTb.exe

C:\Windows\System\eadYNTb.exe

C:\Windows\System\GWBubzs.exe

C:\Windows\System\GWBubzs.exe

C:\Windows\System\NopLVoX.exe

C:\Windows\System\NopLVoX.exe

C:\Windows\System\PpPbXQd.exe

C:\Windows\System\PpPbXQd.exe

C:\Windows\System\RdvxMfY.exe

C:\Windows\System\RdvxMfY.exe

C:\Windows\System\cyFijKt.exe

C:\Windows\System\cyFijKt.exe

C:\Windows\System\DKMaNyS.exe

C:\Windows\System\DKMaNyS.exe

C:\Windows\System\XUNqPJi.exe

C:\Windows\System\XUNqPJi.exe

C:\Windows\System\XisyhwF.exe

C:\Windows\System\XisyhwF.exe

C:\Windows\System\njTfiVq.exe

C:\Windows\System\njTfiVq.exe

C:\Windows\System\ZZzGnYF.exe

C:\Windows\System\ZZzGnYF.exe

C:\Windows\System\FzavqtD.exe

C:\Windows\System\FzavqtD.exe

C:\Windows\System\ATLxrwU.exe

C:\Windows\System\ATLxrwU.exe

C:\Windows\System\nMjMjRh.exe

C:\Windows\System\nMjMjRh.exe

C:\Windows\System\zdrxXub.exe

C:\Windows\System\zdrxXub.exe

C:\Windows\System\YXbkIYe.exe

C:\Windows\System\YXbkIYe.exe

C:\Windows\System\MyFFaDz.exe

C:\Windows\System\MyFFaDz.exe

C:\Windows\System\tvITupT.exe

C:\Windows\System\tvITupT.exe

C:\Windows\System\LAQyWIF.exe

C:\Windows\System\LAQyWIF.exe

C:\Windows\System\IWCTQKa.exe

C:\Windows\System\IWCTQKa.exe

C:\Windows\System\XZKrvzQ.exe

C:\Windows\System\XZKrvzQ.exe

C:\Windows\System\zWNYvCS.exe

C:\Windows\System\zWNYvCS.exe

C:\Windows\System\hzNaZgr.exe

C:\Windows\System\hzNaZgr.exe

C:\Windows\System\ErJTdfe.exe

C:\Windows\System\ErJTdfe.exe

C:\Windows\System\OaTpbgQ.exe

C:\Windows\System\OaTpbgQ.exe

C:\Windows\System\mmabZeT.exe

C:\Windows\System\mmabZeT.exe

C:\Windows\System\vJsCBnN.exe

C:\Windows\System\vJsCBnN.exe

C:\Windows\System\PSMuIjo.exe

C:\Windows\System\PSMuIjo.exe

C:\Windows\System\XAdJcer.exe

C:\Windows\System\XAdJcer.exe

C:\Windows\System\byRjUYc.exe

C:\Windows\System\byRjUYc.exe

C:\Windows\System\eialOLb.exe

C:\Windows\System\eialOLb.exe

C:\Windows\System\XxUuEEl.exe

C:\Windows\System\XxUuEEl.exe

C:\Windows\System\jTFlixc.exe

C:\Windows\System\jTFlixc.exe

C:\Windows\System\YFwVjGQ.exe

C:\Windows\System\YFwVjGQ.exe

C:\Windows\System\nkuakom.exe

C:\Windows\System\nkuakom.exe

C:\Windows\System\NMUKWWh.exe

C:\Windows\System\NMUKWWh.exe

C:\Windows\System\OzBTQfj.exe

C:\Windows\System\OzBTQfj.exe

C:\Windows\System\QEQGdBZ.exe

C:\Windows\System\QEQGdBZ.exe

C:\Windows\System\fuRgEgq.exe

C:\Windows\System\fuRgEgq.exe

C:\Windows\System\MHhfPBw.exe

C:\Windows\System\MHhfPBw.exe

C:\Windows\System\cLOxLoO.exe

C:\Windows\System\cLOxLoO.exe

C:\Windows\System\ObPQtBn.exe

C:\Windows\System\ObPQtBn.exe

C:\Windows\System\qqmXPPw.exe

C:\Windows\System\qqmXPPw.exe

C:\Windows\System\FSFQYxE.exe

C:\Windows\System\FSFQYxE.exe

C:\Windows\System\qHtBhYR.exe

C:\Windows\System\qHtBhYR.exe

C:\Windows\System\zVnoqhW.exe

C:\Windows\System\zVnoqhW.exe

C:\Windows\System\vKexpRb.exe

C:\Windows\System\vKexpRb.exe

C:\Windows\System\kKHfFEw.exe

C:\Windows\System\kKHfFEw.exe

C:\Windows\System\oiiukoJ.exe

C:\Windows\System\oiiukoJ.exe

C:\Windows\System\ZuJzOBs.exe

C:\Windows\System\ZuJzOBs.exe

C:\Windows\System\JNHsOZa.exe

C:\Windows\System\JNHsOZa.exe

C:\Windows\System\HkbzSfx.exe

C:\Windows\System\HkbzSfx.exe

C:\Windows\System\mthXsSH.exe

C:\Windows\System\mthXsSH.exe

C:\Windows\System\wEEerKg.exe

C:\Windows\System\wEEerKg.exe

C:\Windows\System\SRPlyVD.exe

C:\Windows\System\SRPlyVD.exe

C:\Windows\System\wsjmgla.exe

C:\Windows\System\wsjmgla.exe

C:\Windows\System\avelGHl.exe

C:\Windows\System\avelGHl.exe

C:\Windows\System\SugBGDw.exe

C:\Windows\System\SugBGDw.exe

C:\Windows\System\XLUHojH.exe

C:\Windows\System\XLUHojH.exe

C:\Windows\System\ibhcTAS.exe

C:\Windows\System\ibhcTAS.exe

C:\Windows\System\DvdqifO.exe

C:\Windows\System\DvdqifO.exe

C:\Windows\System\FmNjWwI.exe

C:\Windows\System\FmNjWwI.exe

C:\Windows\System\LYmlTDc.exe

C:\Windows\System\LYmlTDc.exe

C:\Windows\System\gsVYjcM.exe

C:\Windows\System\gsVYjcM.exe

C:\Windows\System\xIClMXN.exe

C:\Windows\System\xIClMXN.exe

C:\Windows\System\QWgSvog.exe

C:\Windows\System\QWgSvog.exe

C:\Windows\System\hKoCySB.exe

C:\Windows\System\hKoCySB.exe

C:\Windows\System\BojEWZu.exe

C:\Windows\System\BojEWZu.exe

C:\Windows\System\EZoYiQA.exe

C:\Windows\System\EZoYiQA.exe

C:\Windows\System\MLIbhRr.exe

C:\Windows\System\MLIbhRr.exe

C:\Windows\System\FMNmsgb.exe

C:\Windows\System\FMNmsgb.exe

C:\Windows\System\EdgjEAR.exe

C:\Windows\System\EdgjEAR.exe

C:\Windows\System\huhhYKK.exe

C:\Windows\System\huhhYKK.exe

C:\Windows\System\YqXvmEG.exe

C:\Windows\System\YqXvmEG.exe

C:\Windows\System\ljfXOlT.exe

C:\Windows\System\ljfXOlT.exe

C:\Windows\System\vDTtTkd.exe

C:\Windows\System\vDTtTkd.exe

C:\Windows\System\LTqzZeR.exe

C:\Windows\System\LTqzZeR.exe

C:\Windows\System\DFUyUJL.exe

C:\Windows\System\DFUyUJL.exe

C:\Windows\System\CWYqBXh.exe

C:\Windows\System\CWYqBXh.exe

C:\Windows\System\mQdGTyq.exe

C:\Windows\System\mQdGTyq.exe

C:\Windows\System\jvjAkTl.exe

C:\Windows\System\jvjAkTl.exe

C:\Windows\System\GOiuPlI.exe

C:\Windows\System\GOiuPlI.exe

C:\Windows\System\EKxBfCQ.exe

C:\Windows\System\EKxBfCQ.exe

C:\Windows\System\WYcgEfg.exe

C:\Windows\System\WYcgEfg.exe

C:\Windows\System\mgikOfn.exe

C:\Windows\System\mgikOfn.exe

C:\Windows\System\rxtKQtf.exe

C:\Windows\System\rxtKQtf.exe

C:\Windows\System\fvCgaae.exe

C:\Windows\System\fvCgaae.exe

C:\Windows\System\waWavRa.exe

C:\Windows\System\waWavRa.exe

C:\Windows\System\cXoEVoz.exe

C:\Windows\System\cXoEVoz.exe

C:\Windows\System\AIDOfhC.exe

C:\Windows\System\AIDOfhC.exe

C:\Windows\System\iXjsFYg.exe

C:\Windows\System\iXjsFYg.exe

C:\Windows\System\GIOKcMV.exe

C:\Windows\System\GIOKcMV.exe

C:\Windows\System\cGKUrKp.exe

C:\Windows\System\cGKUrKp.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	131.253.33.237:443	g.bing.com	tcp
BE	88.221.83.209:443	www.bing.com	tcp
US	8.8.8.8:53	237.33.253.131.in-addr.arpa	udp
US	8.8.8.8:53	68.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	209.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	187.77.117.104.in-addr.arpa	udp
US	8.8.8.8:53	155.77.117.104.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp

Files

memory/1876-0-0x00007FF79C500000-0x00007FF79C854000-memory.dmp

memory/1876-1-0x0000022FFB540000-0x0000022FFB550000-memory.dmp

C:\Windows\System\JnKVWQo.exe

MD5	1e9fd20d90d2919f0beb4648a7e5458e
SHA1	7d3d7d5020c9396d055177455008bd664ffae550
SHA256	962232bfbf06e70ac6e583e79c03e41c8c75ae3d58e71dc2d4fbdfe7cc29f8a2
SHA512	b1ad28833a22add5e866ea1f8d213ffee99772d56434ea8b1acbdd43f795c55c450d45c82ca165401a317eb9020dff2e643f95acfb79a2d150d9fd12b779f59a

memory/232-6-0x00007FF6A43C0000-0x00007FF6A4714000-memory.dmp

C:\Windows\System\YfaPnMA.exe

MD5	b4344fe8e02e19161c6393029a75da8c
SHA1	5358ce783725e7c8c3a7d4c7f6a25251180192c9
SHA256	b7dd07738a8864a9a786c61125afd4066313795c9ddf80a8123120e448967648
SHA512	b921cd14bc8469b0df0b95a887c7223341a9afc21b3669af136ea97028ac0f66b5cab470252093743edafc2288a78119312ac66de939890d834e55f78a0d77c5

C:\Windows\System\MIHOWOI.exe

MD5	27884d186962dfd56832f23b643a7970
SHA1	1712b3ad7049b3923fec343aef8256c30f4683ce
SHA256	eb897435a82ad89dd757b0694ba13dd2c3edec7d7dbf7acb1893276bf60de7be
SHA512	fd31b940ac9ad0489452494e70c7e40aeb215ea8b3054167add314e9efcc2264e90b1795ae8a7b9b3ff74998e4bc3276d91cc576aa105ff2dcd7ce9558b617af

memory/4968-14-0x00007FF646C30000-0x00007FF646F84000-memory.dmp

memory/3556-28-0x00007FF6445C0000-0x00007FF644914000-memory.dmp

C:\Windows\System\fhQDYRo.exe

MD5	4054b44a3043a04161278e0b26e36089
SHA1	e9c3ae798d7ea240b66a07ce68cc768e83aa5962
SHA256	0ab24b49f6db112a65a7629964aab35e82bb8751422ce57c25966c9b5aaccbba
SHA512	9a8e240d626201b392fe83ef17f03084451c202237d84048f91e649773c91dd968cd0ecc414b4376fa0e7d003fd26f21e1f10ad15a8a7c9679ae5c96093ff725

C:\Windows\System\dFoDxAQ.exe

MD5	8c0a37b80b736b2dd7be5e6f5ddb388d
SHA1	0f498133da5efea83acb0df44191d244b891b29d
SHA256	ce9a4c6742614ff4d4bf5b1feae325f06bb6b3de6781839207e1272dc77c7002
SHA512	2ec4447cbb313340fb99fb4ea7b75205a0afb0cb72d2a89ac48ec0bc31d5c0938fc559779e29aec455adee864d0831ddb7c6a158525d71d41719a184b49aace9

C:\Windows\System\cKYvbsf.exe

MD5	d3b3f72436679d8de9f498e0584e1442
SHA1	80dc26fc93aee591eb7a6d34b3fbfb2f98d8b155
SHA256	e791516fca1d0eac0ff152023b1ed47d460fe06f1db8198bbbfd48348b9dec07
SHA512	daf11ec34cd9218a8d54598c389b23b646a838dbe729641bf9547a03ccfd01509184e3b5b9b2ed6b5cb244bd0526cc607df6abe5e903114c2661194ebb55a9db

memory/2836-46-0x00007FF746970000-0x00007FF746CC4000-memory.dmp

C:\Windows\System\FkPAKUG.exe

MD5	9d2edd9991e1059a602926a117a6a575
SHA1	350e5aaac8927a1827f90600f35606f211c23c01
SHA256	4f663dc7217b15ebea239a58d3417c64e9009d41e348ed20efb5ab64832c6f0c
SHA512	f887d133cb93ea42ded2bfee0cb64eb11e960ae2ff99ccc20d9a45d10dc18cd3e2eb8b8fdf86f8bcaca2008988ff4c50fe94be77ea01e613ad83e9809f3b5a65

C:\Windows\System\VaGmJUw.exe

MD5	2cb9dc790cead15ddc8cddab33ddeaa7
SHA1	be10a282b63f6f642fa4fcfb8682841cedd73084
SHA256	45f7b7768507c4103ee6eec64c753d81b9cdc546320f605ab9794d213e7142a8
SHA512	ea6fce6eea67e31a5803711ac5e48271633739a94f6153bf34b6bb453c30d3130d15ce22ae46e50cde6ecc9ca05e8e84ff853580598960dc9548b70071cff2d0

C:\Windows\System\kWERowy.exe

MD5	bdbbb4b35d71ace362d473a26d86a740
SHA1	ae4b714f6fb4c3b1cd9caa8dfea5bc1374e9e6f6
SHA256	7fd3fa7a54606e09faaa82a793317a583522549026155c9b66c4632514758d89
SHA512	0915437216fda587d8b51ad7754e9f99e908029d2329314253dd6d9e286881bd76010eaedabe34c1ad42e836bdf739421c50c672935779602252071f73821fcb

C:\Windows\System\ffcYFHr.exe

MD5	4f7b0fde8f5b2053f56043e8984de22f
SHA1	d805499a093f625d317778b352721f10e934d867
SHA256	e735f5872362dedda2f88d57670ddebec2f159d6f11b9bcc148e99f37e26b8ae
SHA512	adff431af9aca4832802b92a41e676c1891247f852a9f888fa369960213891d8734c80585e651d5edd315e0e7e673a090c7f2300f3ebc24ad4c73391bd323356

C:\Windows\System\ecIiBRO.exe

MD5	bcd5580e676ef0517ac0fc90ebde1936
SHA1	2098bd0d58596c01398cc303f919d03df377f5d7
SHA256	9dcef5e29a5e02451e2bad5433e532a75cd2b0d76ce53d72dd02fa6958da232c
SHA512	5029b9d3a53872cb61369dd86099428932048d84adfba138eeb07e447be01049da203b613963696cfbda1d0a1d3cce7e8b946a779625fe4d37be5b5acd2fd276

C:\Windows\System\FLMYWDR.exe

MD5	0b1413afdd27e1f97fb8614304469973
SHA1	bbaea37a89f5eb805d9c8a8d1dd2f0760b2d4387
SHA256	8db66e19428c39f6f47215d785b23de187eaad2781c0393ce7438e0fabf4a679
SHA512	1582eef8cab73261bb0544e95ee2dba169a6203df8878f89bad9224e7cf98229e765b780eb52dc5a50543a03aeb990b2a2c83908ec4a6f9f16b72ae194b22fc7

C:\Windows\System\xCgrtTR.exe

MD5	ffc36b961c0b8ce187a33c486e4794f1
SHA1	799103c20e98c5f4ce3bb138f66a07da763246a0
SHA256	a93415363e8ad0be0fb47b098e0a452658c0ba86f14bd24372defa3c97913d78
SHA512	5910f70edabe882baba29fbd3093ab0310b1dc16db9ec959765c7277a25f17b1e56d239949c6eaef30e44907e46108aed6860e225ee622b4bad70e5bef48f395

C:\Windows\System\UNEqIUz.exe

MD5	5bbd745cafc6fe08eb79b4b13b60034f
SHA1	4d01da964930af66bfc77a021ed794e96af32bb6
SHA256	37313ad48a4e66c784d10f49fde21f59ce52fa35e5aedcef7be2cc0344d3ad88
SHA512	a51642a9fbe9b6fd51e08a6eb9ffdf0e3cdd4ac4277f4eea5cc36b16615388eae2ef34654f8412032f6093f0f8c78ebcdf116652cc3d6f212c4867e7565c7a99

C:\Windows\System\NeOcQeP.exe

MD5	844f0544a1f583859d4598c6b954c4c9
SHA1	92923b7b18045f594acf30ec72916262c9a5ebcf
SHA256	8884420cfccb377ee386b8fca1d872e2938f9cee5e98908fdff2e5ce1f894c75
SHA512	db058dbafd14aca652f2ca60197337959f8526269def44cca4f3fbb121596ac71b5319c66a717f9d6a634d7ff33f85789b70a10bd723c713f3f292073a8cba71

C:\Windows\System\GIcAkgu.exe

MD5	874ed165dcd784001168fdd464a3a1ee
SHA1	275d3f643e97a3464276df5798dd4719ee577c82
SHA256	6901d5b8249ad2400f9522a2f54151d46226eeac63e4e47727ecd1dd69eec3fc
SHA512	aea0fe19cb24b43344c0806c8219e5f3f5895d1f0fe07054c223e35c17c95306ba87a17097daa0839b3b0f6dd3107c173c708ab01f0f32a21d52dc39b72c1131

C:\Windows\System\ktwOxzu.exe

MD5	759937cc4e6a21911b1f3d6b50f726f4
SHA1	a182e999f5984b901b4a9bbdf7d3f3dbb52dcb23
SHA256	8eae2d42136dddef730d1746fd08df9d87748f022ee857fc0cbbb0b78bef86e1
SHA512	1df148e3cbfdac86493c1a668c2b12fc7083cf17b3793096cea3474669db98cb424da057998233e7e5927a95168b70070a60e4a337242f9089b3020721e6cdb8

C:\Windows\System\BNafUaZ.exe

MD5	fcb78afb6e5d1e8ecf818454b5604c98
SHA1	2ac320e417e88a58053a490410eba59e5a6b8a30
SHA256	578ecb3b66280cd0428d71535c67ecec1dc9742270947c285a9ab53e1eccba8a
SHA512	aeabe9c4747ab937496396493376502d6bfdad8ecde088e1ab2c1901d7868ca23ca4b01e0bba098b171fbaffa10bac8154d9e988fdf5dce3a5176d821774cccc

C:\Windows\System\XizVLQV.exe

MD5	24d835b5b06f8a8f18abe3ed15fee195
SHA1	b4f022fbdf8ffb2b1226ec8446547669ce05d4ad
SHA256	24c15cf9753b4e983f5b273de2d3ecf304a6da56ab71d24872fbf55c57fbf057
SHA512	a4d5b5b2dd9d081ffdcc2173423ca68080ff8441ccf530190cd93ea180eccd79d84452cf6ef6c74dc4e8c10805d55ad244c59534dc724c6ee6f98da23335019b

C:\Windows\System\JdNGYTA.exe

MD5	e06ff3a506010af1dd3cbc95c51805df
SHA1	455196c74ba6e79961b09e47dbecde6095118513
SHA256	1d69d9d69b7ab351f1048c73e91d48b9ddfc9105dfa2a65e1ded387d8aab21c5
SHA512	d1b040d3cd70691eb7b7332f3f51029d7bec4571eb6e7f88d09d63144359583aea88fb27c57386b4b1b065e6bcfc49d0a09395f1181ce68155375261e354fb13

C:\Windows\System\PbObsYJ.exe

MD5	a350f4e29e554f8b87f9d0d4c8c7a73c
SHA1	6df31f1e7a7bdd6fb125e589f6834122c3a4b13b
SHA256	a59aaf4ae82c0e3ef636e9aaba960e6381eda62b6286de9fd97332bec8332d53
SHA512	51608fd11b17ba67be7cf6ef17e35194b65126ff062c6180e5240a55b6b841641f6d142fc5ea476f5f80e77c1b445fc3eaa3da97f08df3160332148cbcab6d81

C:\Windows\System\SVIKUGj.exe

MD5	730472822f89243134075aa3232870c2
SHA1	f0689034713813b909e084ddaf43276d37ee41c4
SHA256	6594fc274b02bab9979f33083b227ab071e0a57c58e0b28a1d06ef9fd30658fe
SHA512	e9b9d3a5dc991fcfd773c32d96dd7b17a81907df797182d6bf3bc1893205bb5593fe832157b81043039f1f417901cd4d29ea1f438f8bca7b468f2905f60ad00c

C:\Windows\System\tQqGwVs.exe

MD5	fa301d4e451b06ed0b649da9b96fc11d
SHA1	770c1d4af68eb19b5a6b6efc7ce66020d9c1152e
SHA256	390c126dc709efacdeb872b3543c469035543754451d454b64b8c5cf3336b9f9
SHA512	77caa83699b1a35de7f317fd09aecae90dc12fc33f56800cde577027ce143fded833fea711da6b88e05c961395fe4ad2fa5f858cbd0b8dfdf390c6444d638c5a

C:\Windows\System\dsRsyDL.exe

MD5	2d2657b608b3db5f4260088b32677f66
SHA1	5a60c1a4d769fb5a75129480afaf35f24bf6bd77
SHA256	76a6e71e432a8dc791983360ee44dc0f46d3ed42b6e8733fa98d276bd69f445c
SHA512	ed5b53db4958d03543f86787a345be823e5411c40da44ceebf42ec3114ecd01a05bb1cb96d6b038381ac92a4bffccf8ef52dce93c2f2c69213642ae1f51c9e5d

C:\Windows\System\bkYibNE.exe

MD5	53f3ecfea903aacd51c9958b2ad947b7
SHA1	913e73f26ea6f37a14f319c92a996fbef9a1ce5c
SHA256	9107a0e9a670ff73aa625ebdb584b706a1804bf76d34a668fc226d3bfa4d514a
SHA512	8b57500b4ab8695a61e6ec71be650d1655bac57141b4318e4679fd8d451648e9cf74599859f8a870184279c2a50305022b5112366774d65ee54a82274f443c45

C:\Windows\System\suDRPqv.exe

MD5	af3c81062fff1466386acb19eeee52d3
SHA1	8329e02866265ddb13785ebcb21260a524e0460b
SHA256	560ac24bf403a79bd6f3ae313b93dcbff015cd898ba31dc103c020e38023b6b0
SHA512	60ef00165622e2984892ac6fed9bec574229d2a8c19ff77f9f6cfbe940529ad103b5f56297cfac3e19bc069da8972d6a72dca2c99b8b13342120d1448ea1658b

C:\Windows\System\IDNCknz.exe

MD5	de3a91b4ad4c9f72f1c2d60102cd7e60
SHA1	97620102eba8df8c97047236544da55cba86e862
SHA256	55a250c372d37b5a2be97414b2a549a93aa7859776e7667417ec031a184a799c
SHA512	864b3f80ff537ebc0ebc2902c974119e65bfce553ba0155e837cae7314aeb8326e5ce2f595b64ec9b59a36a443e7efde9c83b23110a69fece2a391ada649c463

C:\Windows\System\uwLLSFU.exe

MD5	e2096be543ae99761e5ee9dbfdaf9134
SHA1	4cc5de67ce1d0f75a7fb993e6711da22684c4347
SHA256	7726155ad14b7c694ccfdd55cfe2f0d869c14614057b4644359fa19fe0b708dc
SHA512	5fabd57be2b17ab0038d6f94d56fddd03a5dd04e5428fc7f9ab4954278e3836e4a627a49b0e674151ca10edbb2a14ec05bdb011727097cf200096eb18b4906aa

C:\Windows\System\JXxTIAX.exe

MD5	8d95cfb9c525f3e71f43705f6242e173
SHA1	10be3c79d3393a319d3724d69684c4bfa20f39dd
SHA256	84963acec0f4a7666cd7ca3cc191bd00c5ef5eb12bae7c5e4012d1a981874689
SHA512	3398e83585d483e8461f6d1c069f82a0700c88be5b07ba7b18fb4400c10be5b9ddfcb785a8392831b22ac7f8a12685ebc88990b93b748a8fe5bf21a4b6807c7f

C:\Windows\System\HGRsIvn.exe

MD5	36289d5df51fd48133b885a9dbe2e299
SHA1	fd6a80ae5a6bc594d756b50860b04e0758ece0ec
SHA256	6dea2ee0c38cf8a18196678154b50e1ab0cf227439b33acec09e0f92599b895a
SHA512	654bdfd4721527f7c7bb769f2f583e1a449533c27c9345cf88a948af5fe23993407303e0222bd86703b0d64e497e938e019dcd5db28b581d411ddac2fa6baff1

C:\Windows\System\KwVGqQM.exe

MD5	7f1e52240c79b1c500e731e27fa1c2c6
SHA1	160fd32a7ecb2da9dcf6ca3f8e19d5d2a703314d
SHA256	98afd51ab37e141ed1cd1326db098757f03e844ccef70955c45cb2607868eef7
SHA512	41866adf595eb87e2f2fb4da637519a11cda02f1a5709081e7f197948a54b1f0777a6a130a2d96cd6df0630af8084569ae9e1509308211bc4bfa1456da23c21a

memory/988-56-0x00007FF71D740000-0x00007FF71DA94000-memory.dmp

C:\Windows\System\tHCSFFb.exe

MD5	ccf08f2e0bae9fb11574216e2b7ade92
SHA1	4f538d3eda8f54601d5ecb6240bb4a4aa647df1b
SHA256	daa4cb534466a920d3c390fb54449b05a1c3b071bc5e1df4bcae469a6629d5e7
SHA512	18b5c4adbcebda055bf3a5c344401e384f9974cafafad347f7a1d92432ba26ea45a4d8f921f30161881cef2126ef04dbe95d9a8391dc04ae22edf4fbb3a05a83

memory/684-47-0x00007FF719DE0000-0x00007FF71A134000-memory.dmp

memory/2756-41-0x00007FF608880000-0x00007FF608BD4000-memory.dmp

memory/5104-32-0x00007FF6FFFD0000-0x00007FF700324000-memory.dmp

memory/212-26-0x00007FF6E0280000-0x00007FF6E05D4000-memory.dmp

C:\Windows\System\STaicXz.exe

MD5	6c431747acb10baccfa2a2bae5934908
SHA1	a605e55063a2cf49930ec6e6d147d2564eff058f
SHA256	4b766743ee1e38b6a59d4e6f24ddbe2f920b252f587a4860254311aa3d5ecf26
SHA512	c4cb53e06183f0b9fdc5664896931459b12659d464aa33b3ce9e7682ff8c1bd7f70f7dd3eaa36641edfc4b8984afb36c6503562ebe76dc9e3c959fead973a094

memory/3124-876-0x00007FF64D2B0000-0x00007FF64D604000-memory.dmp

memory/4076-864-0x00007FF6D54F0000-0x00007FF6D5844000-memory.dmp

memory/4748-853-0x00007FF6899F0000-0x00007FF689D44000-memory.dmp

memory/4692-850-0x00007FF7F45D0000-0x00007FF7F4924000-memory.dmp

memory/2388-892-0x00007FF6FDDA0000-0x00007FF6FE0F4000-memory.dmp

memory/3116-907-0x00007FF7CBD60000-0x00007FF7CC0B4000-memory.dmp

memory/4544-889-0x00007FF7AA080000-0x00007FF7AA3D4000-memory.dmp

memory/4996-872-0x00007FF744150000-0x00007FF7444A4000-memory.dmp

memory/3104-932-0x00007FF7AB910000-0x00007FF7ABC64000-memory.dmp

memory/3976-935-0x00007FF634C50000-0x00007FF634FA4000-memory.dmp

memory/3904-940-0x00007FF611520000-0x00007FF611874000-memory.dmp

memory/3988-927-0x00007FF71C390000-0x00007FF71C6E4000-memory.dmp

memory/4940-916-0x00007FF7A9630000-0x00007FF7A9984000-memory.dmp

memory/2332-950-0x00007FF769070000-0x00007FF7693C4000-memory.dmp

memory/452-953-0x00007FF71C100000-0x00007FF71C454000-memory.dmp

memory/1000-963-0x00007FF677AA0000-0x00007FF677DF4000-memory.dmp

memory/3916-969-0x00007FF61E0F0000-0x00007FF61E444000-memory.dmp

memory/1424-966-0x00007FF7C6D40000-0x00007FF7C7094000-memory.dmp

memory/5012-961-0x00007FF786CC0000-0x00007FF787014000-memory.dmp

memory/2336-957-0x00007FF601760000-0x00007FF601AB4000-memory.dmp

memory/1876-1824-0x00007FF79C500000-0x00007FF79C854000-memory.dmp

memory/232-2130-0x00007FF6A43C0000-0x00007FF6A4714000-memory.dmp

memory/212-2131-0x00007FF6E0280000-0x00007FF6E05D4000-memory.dmp

memory/3556-2132-0x00007FF6445C0000-0x00007FF644914000-memory.dmp

memory/5104-2133-0x00007FF6FFFD0000-0x00007FF700324000-memory.dmp

memory/2836-2134-0x00007FF746970000-0x00007FF746CC4000-memory.dmp

memory/2756-2135-0x00007FF608880000-0x00007FF608BD4000-memory.dmp

memory/684-2136-0x00007FF719DE0000-0x00007FF71A134000-memory.dmp

memory/988-2137-0x00007FF71D740000-0x00007FF71DA94000-memory.dmp

memory/232-2138-0x00007FF6A43C0000-0x00007FF6A4714000-memory.dmp

memory/4968-2139-0x00007FF646C30000-0x00007FF646F84000-memory.dmp

memory/3556-2140-0x00007FF6445C0000-0x00007FF644914000-memory.dmp

memory/212-2141-0x00007FF6E0280000-0x00007FF6E05D4000-memory.dmp

memory/5104-2142-0x00007FF6FFFD0000-0x00007FF700324000-memory.dmp

memory/2836-2143-0x00007FF746970000-0x00007FF746CC4000-memory.dmp

memory/2756-2144-0x00007FF608880000-0x00007FF608BD4000-memory.dmp

memory/684-2145-0x00007FF719DE0000-0x00007FF71A134000-memory.dmp

memory/3976-2155-0x00007FF634C50000-0x00007FF634FA4000-memory.dmp

memory/3904-2153-0x00007FF611520000-0x00007FF611874000-memory.dmp

memory/4996-2152-0x00007FF744150000-0x00007FF7444A4000-memory.dmp

memory/3116-2151-0x00007FF7CBD60000-0x00007FF7CC0B4000-memory.dmp

memory/3988-2150-0x00007FF71C390000-0x00007FF71C6E4000-memory.dmp

memory/3124-2149-0x00007FF64D2B0000-0x00007FF64D604000-memory.dmp

memory/4544-2147-0x00007FF7AA080000-0x00007FF7AA3D4000-memory.dmp

memory/4940-2146-0x00007FF7A9630000-0x00007FF7A9984000-memory.dmp

memory/452-2154-0x00007FF71C100000-0x00007FF71C454000-memory.dmp

memory/2388-2148-0x00007FF6FDDA0000-0x00007FF6FE0F4000-memory.dmp

memory/1424-2165-0x00007FF7C6D40000-0x00007FF7C7094000-memory.dmp

memory/3916-2166-0x00007FF61E0F0000-0x00007FF61E444000-memory.dmp

memory/5012-2164-0x00007FF786CC0000-0x00007FF787014000-memory.dmp

memory/4692-2163-0x00007FF7F45D0000-0x00007FF7F4924000-memory.dmp

memory/1000-2162-0x00007FF677AA0000-0x00007FF677DF4000-memory.dmp

memory/2336-2161-0x00007FF601760000-0x00007FF601AB4000-memory.dmp

memory/4076-2160-0x00007FF6D54F0000-0x00007FF6D5844000-memory.dmp

memory/988-2159-0x00007FF71D740000-0x00007FF71DA94000-memory.dmp

memory/3104-2158-0x00007FF7AB910000-0x00007FF7ABC64000-memory.dmp

memory/4748-2157-0x00007FF6899F0000-0x00007FF689D44000-memory.dmp

memory/2332-2156-0x00007FF769070000-0x00007FF7693C4000-memory.dmp

Sample ID	240613-qlkhdsvbqj
Target	7f7530be4bd7eaa7b4d26142aea85b20_NeikiAnalytics.exe
SHA256	76d763ed76ecb51ee2a4c771bee99a95e658a4b4abdfd05666ddf7799245f66e
Tags	miner upx xmrig

Malware Analysis Report

2024-07-28 19:49

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files