Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\frxoSEH.exe	N/A
N/A	N/A	C:\Windows\System\eJyWlyb.exe	N/A
N/A	N/A	C:\Windows\System\QgBdvqg.exe	N/A
N/A	N/A	C:\Windows\System\oEcVLJE.exe	N/A
N/A	N/A	C:\Windows\System\jYvZpTx.exe	N/A
N/A	N/A	C:\Windows\System\ARUVLaF.exe	N/A
N/A	N/A	C:\Windows\System\wZfxohE.exe	N/A
N/A	N/A	C:\Windows\System\pQwxTyH.exe	N/A
N/A	N/A	C:\Windows\System\wkyMohY.exe	N/A
N/A	N/A	C:\Windows\System\dGAabVk.exe	N/A
N/A	N/A	C:\Windows\System\yNAStIA.exe	N/A
N/A	N/A	C:\Windows\System\TYznzlq.exe	N/A
N/A	N/A	C:\Windows\System\SElGscP.exe	N/A
N/A	N/A	C:\Windows\System\AMfXrnU.exe	N/A
N/A	N/A	C:\Windows\System\LrdVikl.exe	N/A
N/A	N/A	C:\Windows\System\eIXcQsy.exe	N/A
N/A	N/A	C:\Windows\System\uFlKVLo.exe	N/A
N/A	N/A	C:\Windows\System\QfnWjDM.exe	N/A
N/A	N/A	C:\Windows\System\NacezXB.exe	N/A
N/A	N/A	C:\Windows\System\GhrFLSz.exe	N/A
N/A	N/A	C:\Windows\System\UZbGylY.exe	N/A
N/A	N/A	C:\Windows\System\bsnKHiP.exe	N/A
N/A	N/A	C:\Windows\System\hAHMgeI.exe	N/A
N/A	N/A	C:\Windows\System\hhbfbBh.exe	N/A
N/A	N/A	C:\Windows\System\wHjAbKq.exe	N/A
N/A	N/A	C:\Windows\System\IGyBBWL.exe	N/A
N/A	N/A	C:\Windows\System\SEyVndj.exe	N/A
N/A	N/A	C:\Windows\System\CNlqOVv.exe	N/A
N/A	N/A	C:\Windows\System\ItJhilz.exe	N/A
N/A	N/A	C:\Windows\System\nROhFDN.exe	N/A
N/A	N/A	C:\Windows\System\CDWpUQN.exe	N/A
N/A	N/A	C:\Windows\System\kNEGlLL.exe	N/A
N/A	N/A	C:\Windows\System\VLcZFfY.exe	N/A
N/A	N/A	C:\Windows\System\uKoEJIQ.exe	N/A
N/A	N/A	C:\Windows\System\zlhViDH.exe	N/A
N/A	N/A	C:\Windows\System\KHmSPvg.exe	N/A
N/A	N/A	C:\Windows\System\fSpeVqy.exe	N/A
N/A	N/A	C:\Windows\System\UHYlmBb.exe	N/A
N/A	N/A	C:\Windows\System\HZXLgus.exe	N/A
N/A	N/A	C:\Windows\System\AmdCYDz.exe	N/A
N/A	N/A	C:\Windows\System\fqkEIJk.exe	N/A
N/A	N/A	C:\Windows\System\LzUjvJl.exe	N/A
N/A	N/A	C:\Windows\System\EpadMSW.exe	N/A
N/A	N/A	C:\Windows\System\aryBPaI.exe	N/A
N/A	N/A	C:\Windows\System\PhVduhx.exe	N/A
N/A	N/A	C:\Windows\System\RkzyedB.exe	N/A
N/A	N/A	C:\Windows\System\LSxQyUF.exe	N/A
N/A	N/A	C:\Windows\System\lXWSrSf.exe	N/A
N/A	N/A	C:\Windows\System\QLPyvuw.exe	N/A
N/A	N/A	C:\Windows\System\ITvqRjy.exe	N/A
N/A	N/A	C:\Windows\System\hYfdVql.exe	N/A
N/A	N/A	C:\Windows\System\rQWTYga.exe	N/A
N/A	N/A	C:\Windows\System\NyLkCwo.exe	N/A
N/A	N/A	C:\Windows\System\ZtjfyvV.exe	N/A
N/A	N/A	C:\Windows\System\aKefCvW.exe	N/A
N/A	N/A	C:\Windows\System\pXOZEzw.exe	N/A
N/A	N/A	C:\Windows\System\CXymuEK.exe	N/A
N/A	N/A	C:\Windows\System\ndCnhYd.exe	N/A
N/A	N/A	C:\Windows\System\pLfTuaF.exe	N/A
N/A	N/A	C:\Windows\System\dmifWrY.exe	N/A
N/A	N/A	C:\Windows\System\grIBToh.exe	N/A
N/A	N/A	C:\Windows\System\dkzgTWv.exe	N/A
N/A	N/A	C:\Windows\System\adKqBRD.exe	N/A
N/A	N/A	C:\Windows\System\WlhokOb.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\jQQzukb.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hqdnUeG.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZVKEOBl.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lCMoEes.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eOQHPCo.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jaJskhY.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VAEOYAb.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tdSMXnh.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RNMttaO.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OhnrGJt.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HVxnpaA.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BYGkjSk.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WGbixCk.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vVKrvRI.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tKvkbpp.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bxGaRFZ.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lLCNJFm.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BkRvlCG.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IBJzPOi.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CKrNFEb.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TYDFJrC.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XiHQkPD.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YjCKWWO.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fKRUXUq.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZGlEGaY.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DbwQtwS.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KpIhThH.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CHIBybC.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FoyDVlr.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HbFLprt.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZjsKFUw.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XPnDtHO.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XSqitAH.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mUTGAcN.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VrKcLgj.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zzgBGjs.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FMNehWa.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cPXaoXK.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IJUyvjN.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZJgZidl.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yghjfGu.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iEuMcuQ.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QFWYQsR.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hqlSinc.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xTKZMKv.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TrtIies.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RpjfnCf.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XzFzzhK.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FQsHNjV.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OnwQFKp.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sDsbSLZ.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rigggpg.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\htxJFqi.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CAbqSSX.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XyZAyew.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vQPaIbr.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SkcPfZi.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qzqIVDs.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XeiIniR.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rAqilXG.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TwKDfRn.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nUvlcFX.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BanwnoL.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aSWbYQA.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 856 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 856 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 856 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 856 wrote to memory of 2112	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\frxoSEH.exe
PID 856 wrote to memory of 2112	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\frxoSEH.exe
PID 856 wrote to memory of 2112	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\frxoSEH.exe
PID 856 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\eJyWlyb.exe
PID 856 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\eJyWlyb.exe
PID 856 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\eJyWlyb.exe
PID 856 wrote to memory of 2612	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\QgBdvqg.exe
PID 856 wrote to memory of 2612	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\QgBdvqg.exe
PID 856 wrote to memory of 2612	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\QgBdvqg.exe
PID 856 wrote to memory of 2740	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\oEcVLJE.exe
PID 856 wrote to memory of 2740	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\oEcVLJE.exe
PID 856 wrote to memory of 2740	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\oEcVLJE.exe
PID 856 wrote to memory of 2808	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\jYvZpTx.exe
PID 856 wrote to memory of 2808	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\jYvZpTx.exe
PID 856 wrote to memory of 2808	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\jYvZpTx.exe
PID 856 wrote to memory of 2484	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\ARUVLaF.exe
PID 856 wrote to memory of 2484	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\ARUVLaF.exe
PID 856 wrote to memory of 2484	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\ARUVLaF.exe
PID 856 wrote to memory of 2592	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\wZfxohE.exe
PID 856 wrote to memory of 2592	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\wZfxohE.exe
PID 856 wrote to memory of 2592	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\wZfxohE.exe
PID 856 wrote to memory of 2504	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\pQwxTyH.exe
PID 856 wrote to memory of 2504	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\pQwxTyH.exe
PID 856 wrote to memory of 2504	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\pQwxTyH.exe
PID 856 wrote to memory of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\wkyMohY.exe
PID 856 wrote to memory of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\wkyMohY.exe
PID 856 wrote to memory of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\wkyMohY.exe
PID 856 wrote to memory of 2576	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\dGAabVk.exe
PID 856 wrote to memory of 2576	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\dGAabVk.exe
PID 856 wrote to memory of 2576	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\dGAabVk.exe
PID 856 wrote to memory of 2900	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\yNAStIA.exe
PID 856 wrote to memory of 2900	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\yNAStIA.exe
PID 856 wrote to memory of 2900	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\yNAStIA.exe
PID 856 wrote to memory of 292	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\TYznzlq.exe
PID 856 wrote to memory of 292	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\TYznzlq.exe
PID 856 wrote to memory of 292	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\TYznzlq.exe
PID 856 wrote to memory of 2764	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\SElGscP.exe
PID 856 wrote to memory of 2764	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\SElGscP.exe
PID 856 wrote to memory of 2764	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\SElGscP.exe
PID 856 wrote to memory of 2784	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\AMfXrnU.exe
PID 856 wrote to memory of 2784	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\AMfXrnU.exe
PID 856 wrote to memory of 2784	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\AMfXrnU.exe
PID 856 wrote to memory of 3000	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\LrdVikl.exe
PID 856 wrote to memory of 3000	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\LrdVikl.exe
PID 856 wrote to memory of 3000	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\LrdVikl.exe
PID 856 wrote to memory of 2088	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\eIXcQsy.exe
PID 856 wrote to memory of 2088	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\eIXcQsy.exe
PID 856 wrote to memory of 2088	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\eIXcQsy.exe
PID 856 wrote to memory of 2304	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\uFlKVLo.exe
PID 856 wrote to memory of 2304	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\uFlKVLo.exe
PID 856 wrote to memory of 2304	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\uFlKVLo.exe
PID 856 wrote to memory of 1828	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\QfnWjDM.exe
PID 856 wrote to memory of 1828	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\QfnWjDM.exe
PID 856 wrote to memory of 1828	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\QfnWjDM.exe
PID 856 wrote to memory of 1476	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\NacezXB.exe
PID 856 wrote to memory of 1476	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\NacezXB.exe
PID 856 wrote to memory of 1476	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\NacezXB.exe
PID 856 wrote to memory of 776	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\GhrFLSz.exe
PID 856 wrote to memory of 776	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\GhrFLSz.exe
PID 856 wrote to memory of 776	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\GhrFLSz.exe
PID 856 wrote to memory of 1700	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\UZbGylY.exe

Processes

C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\frxoSEH.exe

C:\Windows\System\frxoSEH.exe

C:\Windows\System\eJyWlyb.exe

C:\Windows\System\eJyWlyb.exe

C:\Windows\System\QgBdvqg.exe

C:\Windows\System\QgBdvqg.exe

C:\Windows\System\oEcVLJE.exe

C:\Windows\System\oEcVLJE.exe

C:\Windows\System\jYvZpTx.exe

C:\Windows\System\jYvZpTx.exe

C:\Windows\System\ARUVLaF.exe

C:\Windows\System\ARUVLaF.exe

C:\Windows\System\wZfxohE.exe

C:\Windows\System\wZfxohE.exe

C:\Windows\System\pQwxTyH.exe

C:\Windows\System\pQwxTyH.exe

C:\Windows\System\wkyMohY.exe

C:\Windows\System\wkyMohY.exe

C:\Windows\System\dGAabVk.exe

C:\Windows\System\dGAabVk.exe

C:\Windows\System\yNAStIA.exe

C:\Windows\System\yNAStIA.exe

C:\Windows\System\TYznzlq.exe

C:\Windows\System\TYznzlq.exe

C:\Windows\System\SElGscP.exe

C:\Windows\System\SElGscP.exe

C:\Windows\System\AMfXrnU.exe

C:\Windows\System\AMfXrnU.exe

C:\Windows\System\LrdVikl.exe

C:\Windows\System\LrdVikl.exe

C:\Windows\System\eIXcQsy.exe

C:\Windows\System\eIXcQsy.exe

C:\Windows\System\uFlKVLo.exe

C:\Windows\System\uFlKVLo.exe

C:\Windows\System\QfnWjDM.exe

C:\Windows\System\QfnWjDM.exe

C:\Windows\System\NacezXB.exe

C:\Windows\System\NacezXB.exe

C:\Windows\System\GhrFLSz.exe

C:\Windows\System\GhrFLSz.exe

C:\Windows\System\UZbGylY.exe

C:\Windows\System\UZbGylY.exe

C:\Windows\System\SEyVndj.exe

C:\Windows\System\SEyVndj.exe

C:\Windows\System\bsnKHiP.exe

C:\Windows\System\bsnKHiP.exe

C:\Windows\System\CNlqOVv.exe

C:\Windows\System\CNlqOVv.exe

C:\Windows\System\hAHMgeI.exe

C:\Windows\System\hAHMgeI.exe

C:\Windows\System\ItJhilz.exe

C:\Windows\System\ItJhilz.exe

C:\Windows\System\hhbfbBh.exe

C:\Windows\System\hhbfbBh.exe

C:\Windows\System\nROhFDN.exe

C:\Windows\System\nROhFDN.exe

C:\Windows\System\wHjAbKq.exe

C:\Windows\System\wHjAbKq.exe

C:\Windows\System\kNEGlLL.exe

C:\Windows\System\kNEGlLL.exe

C:\Windows\System\IGyBBWL.exe

C:\Windows\System\IGyBBWL.exe

C:\Windows\System\VLcZFfY.exe

C:\Windows\System\VLcZFfY.exe

C:\Windows\System\CDWpUQN.exe

C:\Windows\System\CDWpUQN.exe

C:\Windows\System\uKoEJIQ.exe

C:\Windows\System\uKoEJIQ.exe

C:\Windows\System\zlhViDH.exe

C:\Windows\System\zlhViDH.exe

C:\Windows\System\KHmSPvg.exe

C:\Windows\System\KHmSPvg.exe

C:\Windows\System\fSpeVqy.exe

C:\Windows\System\fSpeVqy.exe

C:\Windows\System\UHYlmBb.exe

C:\Windows\System\UHYlmBb.exe

C:\Windows\System\HZXLgus.exe

C:\Windows\System\HZXLgus.exe

C:\Windows\System\AmdCYDz.exe

C:\Windows\System\AmdCYDz.exe

C:\Windows\System\fqkEIJk.exe

C:\Windows\System\fqkEIJk.exe

C:\Windows\System\LzUjvJl.exe

C:\Windows\System\LzUjvJl.exe

C:\Windows\System\EpadMSW.exe

C:\Windows\System\EpadMSW.exe

C:\Windows\System\aryBPaI.exe

C:\Windows\System\aryBPaI.exe

C:\Windows\System\PhVduhx.exe

C:\Windows\System\PhVduhx.exe

C:\Windows\System\RkzyedB.exe

C:\Windows\System\RkzyedB.exe

C:\Windows\System\LSxQyUF.exe

C:\Windows\System\LSxQyUF.exe

C:\Windows\System\lXWSrSf.exe

C:\Windows\System\lXWSrSf.exe

C:\Windows\System\QLPyvuw.exe

C:\Windows\System\QLPyvuw.exe

C:\Windows\System\ITvqRjy.exe

C:\Windows\System\ITvqRjy.exe

C:\Windows\System\hYfdVql.exe

C:\Windows\System\hYfdVql.exe

C:\Windows\System\rQWTYga.exe

C:\Windows\System\rQWTYga.exe

C:\Windows\System\NyLkCwo.exe

C:\Windows\System\NyLkCwo.exe

C:\Windows\System\ZtjfyvV.exe

C:\Windows\System\ZtjfyvV.exe

C:\Windows\System\aKefCvW.exe

C:\Windows\System\aKefCvW.exe

C:\Windows\System\pXOZEzw.exe

C:\Windows\System\pXOZEzw.exe

C:\Windows\System\CXymuEK.exe

C:\Windows\System\CXymuEK.exe

C:\Windows\System\ndCnhYd.exe

C:\Windows\System\ndCnhYd.exe

C:\Windows\System\pLfTuaF.exe

C:\Windows\System\pLfTuaF.exe

C:\Windows\System\dmifWrY.exe

C:\Windows\System\dmifWrY.exe

C:\Windows\System\grIBToh.exe

C:\Windows\System\grIBToh.exe

C:\Windows\System\dkzgTWv.exe

C:\Windows\System\dkzgTWv.exe

C:\Windows\System\adKqBRD.exe

C:\Windows\System\adKqBRD.exe

C:\Windows\System\WlhokOb.exe

C:\Windows\System\WlhokOb.exe

C:\Windows\System\qlVBvke.exe

C:\Windows\System\qlVBvke.exe

C:\Windows\System\PPJXfSQ.exe

C:\Windows\System\PPJXfSQ.exe

C:\Windows\System\CGZdFER.exe

C:\Windows\System\CGZdFER.exe

C:\Windows\System\RXKyYuc.exe

C:\Windows\System\RXKyYuc.exe

C:\Windows\System\XwJbZGu.exe

C:\Windows\System\XwJbZGu.exe

C:\Windows\System\xALbKIv.exe

C:\Windows\System\xALbKIv.exe

C:\Windows\System\pGESYzR.exe

C:\Windows\System\pGESYzR.exe

C:\Windows\System\aSWbYQA.exe

C:\Windows\System\aSWbYQA.exe

C:\Windows\System\PUSJTLA.exe

C:\Windows\System\PUSJTLA.exe

C:\Windows\System\HmshmVy.exe

C:\Windows\System\HmshmVy.exe

C:\Windows\System\fFCAFVm.exe

C:\Windows\System\fFCAFVm.exe

C:\Windows\System\tEOkHoo.exe

C:\Windows\System\tEOkHoo.exe

C:\Windows\System\FiktVKu.exe

C:\Windows\System\FiktVKu.exe

C:\Windows\System\YEJLHOd.exe

C:\Windows\System\YEJLHOd.exe

C:\Windows\System\SaAUFHQ.exe

C:\Windows\System\SaAUFHQ.exe

C:\Windows\System\jzFmYUX.exe

C:\Windows\System\jzFmYUX.exe

C:\Windows\System\ACMTEYv.exe

C:\Windows\System\ACMTEYv.exe

C:\Windows\System\TGeJAHV.exe

C:\Windows\System\TGeJAHV.exe

C:\Windows\System\swmGann.exe

C:\Windows\System\swmGann.exe

C:\Windows\System\eqOIICs.exe

C:\Windows\System\eqOIICs.exe

C:\Windows\System\FtbgIbg.exe

C:\Windows\System\FtbgIbg.exe

C:\Windows\System\hGYyEMM.exe

C:\Windows\System\hGYyEMM.exe

C:\Windows\System\ngQzOqk.exe

C:\Windows\System\ngQzOqk.exe

C:\Windows\System\VRixtwE.exe

C:\Windows\System\VRixtwE.exe

C:\Windows\System\KgeVPGN.exe

C:\Windows\System\KgeVPGN.exe

C:\Windows\System\ukJYEqe.exe

C:\Windows\System\ukJYEqe.exe

C:\Windows\System\qXqQbPE.exe

C:\Windows\System\qXqQbPE.exe

C:\Windows\System\kGxZEsP.exe

C:\Windows\System\kGxZEsP.exe

C:\Windows\System\UGxRSYl.exe

C:\Windows\System\UGxRSYl.exe

C:\Windows\System\eBajUMc.exe

C:\Windows\System\eBajUMc.exe

C:\Windows\System\VlEWWuJ.exe

C:\Windows\System\VlEWWuJ.exe

C:\Windows\System\ImUIrqE.exe

C:\Windows\System\ImUIrqE.exe

C:\Windows\System\DCKfgsa.exe

C:\Windows\System\DCKfgsa.exe

C:\Windows\System\RVYXfLn.exe

C:\Windows\System\RVYXfLn.exe

C:\Windows\System\DIqGffi.exe

C:\Windows\System\DIqGffi.exe

C:\Windows\System\pOAMmBt.exe

C:\Windows\System\pOAMmBt.exe

C:\Windows\System\jBGEmJD.exe

C:\Windows\System\jBGEmJD.exe

C:\Windows\System\LzbvczV.exe

C:\Windows\System\LzbvczV.exe

C:\Windows\System\DPKDInv.exe

C:\Windows\System\DPKDInv.exe

C:\Windows\System\neTefvZ.exe

C:\Windows\System\neTefvZ.exe

C:\Windows\System\doGgYPL.exe

C:\Windows\System\doGgYPL.exe

C:\Windows\System\qTbSnFL.exe

C:\Windows\System\qTbSnFL.exe

C:\Windows\System\eBPnJHQ.exe

C:\Windows\System\eBPnJHQ.exe

C:\Windows\System\gOokPYB.exe

C:\Windows\System\gOokPYB.exe

C:\Windows\System\kjxCSFR.exe

C:\Windows\System\kjxCSFR.exe

C:\Windows\System\JmTtzPp.exe

C:\Windows\System\JmTtzPp.exe

C:\Windows\System\jeAzwII.exe

C:\Windows\System\jeAzwII.exe

C:\Windows\System\joTLgqA.exe

C:\Windows\System\joTLgqA.exe

C:\Windows\System\OVhUlNz.exe

C:\Windows\System\OVhUlNz.exe

C:\Windows\System\hEmKmxF.exe

C:\Windows\System\hEmKmxF.exe

C:\Windows\System\KztyXUK.exe

C:\Windows\System\KztyXUK.exe

C:\Windows\System\BAFKXSI.exe

C:\Windows\System\BAFKXSI.exe

C:\Windows\System\nGLbBig.exe

C:\Windows\System\nGLbBig.exe

C:\Windows\System\hkxtarX.exe

C:\Windows\System\hkxtarX.exe

C:\Windows\System\VdtDJrG.exe

C:\Windows\System\VdtDJrG.exe

C:\Windows\System\agEWvEr.exe

C:\Windows\System\agEWvEr.exe

C:\Windows\System\mxcOlwB.exe

C:\Windows\System\mxcOlwB.exe

C:\Windows\System\hjtJMtA.exe

C:\Windows\System\hjtJMtA.exe

C:\Windows\System\SZoEOMA.exe

C:\Windows\System\SZoEOMA.exe

C:\Windows\System\hdLHlPR.exe

C:\Windows\System\hdLHlPR.exe

C:\Windows\System\LnPjewh.exe

C:\Windows\System\LnPjewh.exe

C:\Windows\System\LuXjiGf.exe

C:\Windows\System\LuXjiGf.exe

C:\Windows\System\gXoYheu.exe

C:\Windows\System\gXoYheu.exe

C:\Windows\System\OPJDrJT.exe

C:\Windows\System\OPJDrJT.exe

C:\Windows\System\gcosepr.exe

C:\Windows\System\gcosepr.exe

C:\Windows\System\cDaXISJ.exe

C:\Windows\System\cDaXISJ.exe

C:\Windows\System\pDqwiSl.exe

C:\Windows\System\pDqwiSl.exe

C:\Windows\System\dHfVlcV.exe

C:\Windows\System\dHfVlcV.exe

C:\Windows\System\YKpQIOT.exe

C:\Windows\System\YKpQIOT.exe

C:\Windows\System\hMhKvDm.exe

C:\Windows\System\hMhKvDm.exe

C:\Windows\System\FKstQDf.exe

C:\Windows\System\FKstQDf.exe

C:\Windows\System\PzJArHU.exe

C:\Windows\System\PzJArHU.exe

C:\Windows\System\dfRbbLu.exe

C:\Windows\System\dfRbbLu.exe

C:\Windows\System\qZqwrFT.exe

C:\Windows\System\qZqwrFT.exe

C:\Windows\System\JgumvLB.exe

C:\Windows\System\JgumvLB.exe

C:\Windows\System\OVaNYsP.exe

C:\Windows\System\OVaNYsP.exe

C:\Windows\System\gNdTlDk.exe

C:\Windows\System\gNdTlDk.exe

C:\Windows\System\XjjREiM.exe

C:\Windows\System\XjjREiM.exe

C:\Windows\System\PunHtPd.exe

C:\Windows\System\PunHtPd.exe

C:\Windows\System\yvULOko.exe

C:\Windows\System\yvULOko.exe

C:\Windows\System\nLiFVjQ.exe

C:\Windows\System\nLiFVjQ.exe

C:\Windows\System\KojKILi.exe

C:\Windows\System\KojKILi.exe

C:\Windows\System\bABhrHF.exe

C:\Windows\System\bABhrHF.exe

C:\Windows\System\KvwQKAH.exe

C:\Windows\System\KvwQKAH.exe

C:\Windows\System\fIJKRNk.exe

C:\Windows\System\fIJKRNk.exe

C:\Windows\System\HtSwjVr.exe

C:\Windows\System\HtSwjVr.exe

C:\Windows\System\qZsGJpn.exe

C:\Windows\System\qZsGJpn.exe

C:\Windows\System\gQtkiPd.exe

C:\Windows\System\gQtkiPd.exe

C:\Windows\System\eDeoyBn.exe

C:\Windows\System\eDeoyBn.exe

C:\Windows\System\kBTltTs.exe

C:\Windows\System\kBTltTs.exe

C:\Windows\System\bgOtNSc.exe

C:\Windows\System\bgOtNSc.exe

C:\Windows\System\wmMbIDv.exe

C:\Windows\System\wmMbIDv.exe

C:\Windows\System\lPeVJtv.exe

C:\Windows\System\lPeVJtv.exe

C:\Windows\System\UtMVcHM.exe

C:\Windows\System\UtMVcHM.exe

C:\Windows\System\EkmdswJ.exe

C:\Windows\System\EkmdswJ.exe

C:\Windows\System\nnmZvuw.exe

C:\Windows\System\nnmZvuw.exe

C:\Windows\System\KwZTdTs.exe

C:\Windows\System\KwZTdTs.exe

C:\Windows\System\YKekTRu.exe

C:\Windows\System\YKekTRu.exe

C:\Windows\System\kClPfzb.exe

C:\Windows\System\kClPfzb.exe

C:\Windows\System\OaJXuUk.exe

C:\Windows\System\OaJXuUk.exe

C:\Windows\System\YmtQTYY.exe

C:\Windows\System\YmtQTYY.exe

C:\Windows\System\IOKfuni.exe

C:\Windows\System\IOKfuni.exe

C:\Windows\System\LSkfUmI.exe

C:\Windows\System\LSkfUmI.exe

C:\Windows\System\SfkoRcc.exe

C:\Windows\System\SfkoRcc.exe

C:\Windows\System\uKfdMOo.exe

C:\Windows\System\uKfdMOo.exe

C:\Windows\System\hZAsZZY.exe

C:\Windows\System\hZAsZZY.exe

C:\Windows\System\xOGQNwP.exe

C:\Windows\System\xOGQNwP.exe

C:\Windows\System\gJNMlsf.exe

C:\Windows\System\gJNMlsf.exe

C:\Windows\System\RzfitIh.exe

C:\Windows\System\RzfitIh.exe

C:\Windows\System\eAXREbX.exe

C:\Windows\System\eAXREbX.exe

C:\Windows\System\aiHreda.exe

C:\Windows\System\aiHreda.exe

C:\Windows\System\SEVMAax.exe

C:\Windows\System\SEVMAax.exe

C:\Windows\System\jCfOkdd.exe

C:\Windows\System\jCfOkdd.exe

C:\Windows\System\CvgqlfA.exe

C:\Windows\System\CvgqlfA.exe

C:\Windows\System\XjlnTWa.exe

C:\Windows\System\XjlnTWa.exe

C:\Windows\System\aBDqTds.exe

C:\Windows\System\aBDqTds.exe

C:\Windows\System\NoMYDVQ.exe

C:\Windows\System\NoMYDVQ.exe

C:\Windows\System\oOeIGRv.exe

C:\Windows\System\oOeIGRv.exe

C:\Windows\System\fkTMgIz.exe

C:\Windows\System\fkTMgIz.exe

C:\Windows\System\XIkubFl.exe

C:\Windows\System\XIkubFl.exe

C:\Windows\System\qnJfomm.exe

C:\Windows\System\qnJfomm.exe

C:\Windows\System\DjeaWyi.exe

C:\Windows\System\DjeaWyi.exe

C:\Windows\System\PNTrabj.exe

C:\Windows\System\PNTrabj.exe

C:\Windows\System\ojwjyJk.exe

C:\Windows\System\ojwjyJk.exe

C:\Windows\System\DNsJjTh.exe

C:\Windows\System\DNsJjTh.exe

C:\Windows\System\MMPnrEO.exe

C:\Windows\System\MMPnrEO.exe

C:\Windows\System\FuygZuP.exe

C:\Windows\System\FuygZuP.exe

C:\Windows\System\VnxUAUG.exe

C:\Windows\System\VnxUAUG.exe

C:\Windows\System\FqfoxxS.exe

C:\Windows\System\FqfoxxS.exe

C:\Windows\System\WGhOELi.exe

C:\Windows\System\WGhOELi.exe

C:\Windows\System\AJijeoR.exe

C:\Windows\System\AJijeoR.exe

C:\Windows\System\fMlcYls.exe

C:\Windows\System\fMlcYls.exe

C:\Windows\System\JCucaFX.exe

C:\Windows\System\JCucaFX.exe

C:\Windows\System\MHgqfAs.exe

C:\Windows\System\MHgqfAs.exe

C:\Windows\System\QXxQNJL.exe

C:\Windows\System\QXxQNJL.exe

C:\Windows\System\kuOcIDY.exe

C:\Windows\System\kuOcIDY.exe

C:\Windows\System\tzcekmt.exe

C:\Windows\System\tzcekmt.exe

C:\Windows\System\GGVuuVg.exe

C:\Windows\System\GGVuuVg.exe

C:\Windows\System\IArqMYn.exe

C:\Windows\System\IArqMYn.exe

C:\Windows\System\lqxQxzI.exe

C:\Windows\System\lqxQxzI.exe

C:\Windows\System\DuzhrRq.exe

C:\Windows\System\DuzhrRq.exe

C:\Windows\System\oPtwehx.exe

C:\Windows\System\oPtwehx.exe

C:\Windows\System\IaCYeqv.exe

C:\Windows\System\IaCYeqv.exe

C:\Windows\System\puSnHJp.exe

C:\Windows\System\puSnHJp.exe

C:\Windows\System\CNEUmVS.exe

C:\Windows\System\CNEUmVS.exe

C:\Windows\System\GcNAuQW.exe

C:\Windows\System\GcNAuQW.exe

C:\Windows\System\KqRbrDP.exe

C:\Windows\System\KqRbrDP.exe

C:\Windows\System\UkaxksI.exe

C:\Windows\System\UkaxksI.exe

C:\Windows\System\FRRLgsz.exe

C:\Windows\System\FRRLgsz.exe

C:\Windows\System\bcfctQg.exe

C:\Windows\System\bcfctQg.exe

C:\Windows\System\XlVlJFf.exe

C:\Windows\System\XlVlJFf.exe

C:\Windows\System\kgyyaWh.exe

C:\Windows\System\kgyyaWh.exe

C:\Windows\System\BzpLimT.exe

C:\Windows\System\BzpLimT.exe

C:\Windows\System\HpHuIkm.exe

C:\Windows\System\HpHuIkm.exe

C:\Windows\System\tjnIZoO.exe

C:\Windows\System\tjnIZoO.exe

C:\Windows\System\KvbChtZ.exe

C:\Windows\System\KvbChtZ.exe

C:\Windows\System\LmXASvw.exe

C:\Windows\System\LmXASvw.exe

C:\Windows\System\fFmgxNR.exe

C:\Windows\System\fFmgxNR.exe

C:\Windows\System\ebjtzYn.exe

C:\Windows\System\ebjtzYn.exe

C:\Windows\System\TCqiKND.exe

C:\Windows\System\TCqiKND.exe

C:\Windows\System\ovPnWQP.exe

C:\Windows\System\ovPnWQP.exe

C:\Windows\System\MCqtGTc.exe

C:\Windows\System\MCqtGTc.exe

C:\Windows\System\ixZnWYh.exe

C:\Windows\System\ixZnWYh.exe

C:\Windows\System\SjqkDyo.exe

C:\Windows\System\SjqkDyo.exe

C:\Windows\System\SWJkGoZ.exe

C:\Windows\System\SWJkGoZ.exe

C:\Windows\System\kGcghyU.exe

C:\Windows\System\kGcghyU.exe

C:\Windows\System\UBSxxLD.exe

C:\Windows\System\UBSxxLD.exe

C:\Windows\System\CXyWqmO.exe

C:\Windows\System\CXyWqmO.exe

C:\Windows\System\SDIHBbK.exe

C:\Windows\System\SDIHBbK.exe

C:\Windows\System\RQaSSeF.exe

C:\Windows\System\RQaSSeF.exe

C:\Windows\System\AJygTiE.exe

C:\Windows\System\AJygTiE.exe

C:\Windows\System\zIGdfWX.exe

C:\Windows\System\zIGdfWX.exe

C:\Windows\System\DiGJPYV.exe

C:\Windows\System\DiGJPYV.exe

C:\Windows\System\jyWuqdK.exe

C:\Windows\System\jyWuqdK.exe

C:\Windows\System\UuNZpxR.exe

C:\Windows\System\UuNZpxR.exe

C:\Windows\System\tCVsuvZ.exe

C:\Windows\System\tCVsuvZ.exe

C:\Windows\System\XEYqrfI.exe

C:\Windows\System\XEYqrfI.exe

C:\Windows\System\sHHgbWy.exe

C:\Windows\System\sHHgbWy.exe

C:\Windows\System\Jqeqzhl.exe

C:\Windows\System\Jqeqzhl.exe

C:\Windows\System\ZfhYEet.exe

C:\Windows\System\ZfhYEet.exe

C:\Windows\System\MwGhIfL.exe

C:\Windows\System\MwGhIfL.exe

C:\Windows\System\lZncwZl.exe

C:\Windows\System\lZncwZl.exe

C:\Windows\System\EuBKAoC.exe

C:\Windows\System\EuBKAoC.exe

C:\Windows\System\ZdiGXGD.exe

C:\Windows\System\ZdiGXGD.exe

C:\Windows\System\gBGNoeV.exe

C:\Windows\System\gBGNoeV.exe

C:\Windows\System\qWUObDs.exe

C:\Windows\System\qWUObDs.exe

C:\Windows\System\RrbikFG.exe

C:\Windows\System\RrbikFG.exe

C:\Windows\System\JSJRTqJ.exe

C:\Windows\System\JSJRTqJ.exe

C:\Windows\System\zJHCcDI.exe

C:\Windows\System\zJHCcDI.exe

C:\Windows\System\rCmdgVi.exe

C:\Windows\System\rCmdgVi.exe

C:\Windows\System\opvMGjl.exe

C:\Windows\System\opvMGjl.exe

C:\Windows\System\qBMAgAG.exe

C:\Windows\System\qBMAgAG.exe

C:\Windows\System\IBihcrr.exe

C:\Windows\System\IBihcrr.exe

C:\Windows\System\Iahpuzu.exe

C:\Windows\System\Iahpuzu.exe

C:\Windows\System\AOTQUyQ.exe

C:\Windows\System\AOTQUyQ.exe

C:\Windows\System\MkZFHcx.exe

C:\Windows\System\MkZFHcx.exe

C:\Windows\System\XxpYCoA.exe

C:\Windows\System\XxpYCoA.exe

C:\Windows\System\RfColgy.exe

C:\Windows\System\RfColgy.exe

C:\Windows\System\RIBIKRw.exe

C:\Windows\System\RIBIKRw.exe

C:\Windows\System\iXlvkqM.exe

C:\Windows\System\iXlvkqM.exe

C:\Windows\System\YDjqRWe.exe

C:\Windows\System\YDjqRWe.exe

C:\Windows\System\uByftOJ.exe

C:\Windows\System\uByftOJ.exe

C:\Windows\System\XOSyIWM.exe

C:\Windows\System\XOSyIWM.exe

C:\Windows\System\APjsokb.exe

C:\Windows\System\APjsokb.exe

C:\Windows\System\kWPtMOP.exe

C:\Windows\System\kWPtMOP.exe

C:\Windows\System\obunYqv.exe

C:\Windows\System\obunYqv.exe

C:\Windows\System\aWEyXbr.exe

C:\Windows\System\aWEyXbr.exe

C:\Windows\System\MfouHBx.exe

C:\Windows\System\MfouHBx.exe

C:\Windows\System\WLVULwO.exe

C:\Windows\System\WLVULwO.exe

C:\Windows\System\mKZcbcS.exe

C:\Windows\System\mKZcbcS.exe

C:\Windows\System\quUkKIA.exe

C:\Windows\System\quUkKIA.exe

C:\Windows\System\xJwHHze.exe

C:\Windows\System\xJwHHze.exe

C:\Windows\System\VkrceqH.exe

C:\Windows\System\VkrceqH.exe

C:\Windows\System\OfclRVW.exe

C:\Windows\System\OfclRVW.exe

C:\Windows\System\nahGKMN.exe

C:\Windows\System\nahGKMN.exe

C:\Windows\System\cecPJlN.exe

C:\Windows\System\cecPJlN.exe

C:\Windows\System\nLXofFY.exe

C:\Windows\System\nLXofFY.exe

C:\Windows\System\uaIyudg.exe

C:\Windows\System\uaIyudg.exe

C:\Windows\System\QYfydTt.exe

C:\Windows\System\QYfydTt.exe

C:\Windows\System\fEembsc.exe

C:\Windows\System\fEembsc.exe

C:\Windows\System\mbzGBgS.exe

C:\Windows\System\mbzGBgS.exe

C:\Windows\System\SdXMyEY.exe

C:\Windows\System\SdXMyEY.exe

C:\Windows\System\vCNaOSO.exe

C:\Windows\System\vCNaOSO.exe

C:\Windows\System\skXeLpu.exe

C:\Windows\System\skXeLpu.exe

C:\Windows\System\FtSJwTF.exe

C:\Windows\System\FtSJwTF.exe

C:\Windows\System\lXPBQyK.exe

C:\Windows\System\lXPBQyK.exe

C:\Windows\System\EjLWrse.exe

C:\Windows\System\EjLWrse.exe

C:\Windows\System\cvjxIWt.exe

C:\Windows\System\cvjxIWt.exe

C:\Windows\System\gTrboHJ.exe

C:\Windows\System\gTrboHJ.exe

C:\Windows\System\CquKVff.exe

C:\Windows\System\CquKVff.exe

C:\Windows\System\FQwYjbL.exe

C:\Windows\System\FQwYjbL.exe

C:\Windows\System\OVFnKvA.exe

C:\Windows\System\OVFnKvA.exe

C:\Windows\System\sRZujLW.exe

C:\Windows\System\sRZujLW.exe

C:\Windows\System\JKFiGeV.exe

C:\Windows\System\JKFiGeV.exe

C:\Windows\System\XbTjQAW.exe

C:\Windows\System\XbTjQAW.exe

C:\Windows\System\YLOYRCh.exe

C:\Windows\System\YLOYRCh.exe

C:\Windows\System\qOLzzAs.exe

C:\Windows\System\qOLzzAs.exe

C:\Windows\System\OEtcgxf.exe

C:\Windows\System\OEtcgxf.exe

C:\Windows\System\MqPrgjC.exe

C:\Windows\System\MqPrgjC.exe

C:\Windows\System\xeryDrJ.exe

C:\Windows\System\xeryDrJ.exe

C:\Windows\System\FmazzMN.exe

C:\Windows\System\FmazzMN.exe

C:\Windows\System\jezSrEc.exe

C:\Windows\System\jezSrEc.exe

C:\Windows\System\HwmhJjY.exe

C:\Windows\System\HwmhJjY.exe

C:\Windows\System\zkbTlKA.exe

C:\Windows\System\zkbTlKA.exe

C:\Windows\System\feKUjGC.exe

C:\Windows\System\feKUjGC.exe

C:\Windows\System\mUwFlXo.exe

C:\Windows\System\mUwFlXo.exe

C:\Windows\System\ftnZtKP.exe

C:\Windows\System\ftnZtKP.exe

C:\Windows\System\MwxERMx.exe

C:\Windows\System\MwxERMx.exe

C:\Windows\System\VzWYdgd.exe

C:\Windows\System\VzWYdgd.exe

C:\Windows\System\KiFhyNZ.exe

C:\Windows\System\KiFhyNZ.exe

C:\Windows\System\AXKoQoE.exe

C:\Windows\System\AXKoQoE.exe

C:\Windows\System\GNNrQcX.exe

C:\Windows\System\GNNrQcX.exe

C:\Windows\System\cbflLfU.exe

C:\Windows\System\cbflLfU.exe

C:\Windows\System\JsREBcj.exe

C:\Windows\System\JsREBcj.exe

C:\Windows\System\GFUOUGS.exe

C:\Windows\System\GFUOUGS.exe

C:\Windows\System\vusMnTE.exe

C:\Windows\System\vusMnTE.exe

C:\Windows\System\aUEjwrB.exe

C:\Windows\System\aUEjwrB.exe

C:\Windows\System\ThLeHUp.exe

C:\Windows\System\ThLeHUp.exe

C:\Windows\System\FMlZotn.exe

C:\Windows\System\FMlZotn.exe

C:\Windows\System\UQKDaFY.exe

C:\Windows\System\UQKDaFY.exe

C:\Windows\System\aKWeNQr.exe

C:\Windows\System\aKWeNQr.exe

C:\Windows\System\ZjUCKWT.exe

C:\Windows\System\ZjUCKWT.exe

C:\Windows\System\RhNeogw.exe

C:\Windows\System\RhNeogw.exe

C:\Windows\System\BCKxvlQ.exe

C:\Windows\System\BCKxvlQ.exe

C:\Windows\System\NjFcrNt.exe

C:\Windows\System\NjFcrNt.exe

C:\Windows\System\TecbiaG.exe

C:\Windows\System\TecbiaG.exe

C:\Windows\System\jXGVGgd.exe

C:\Windows\System\jXGVGgd.exe

C:\Windows\System\sEhdjzL.exe

C:\Windows\System\sEhdjzL.exe

C:\Windows\System\FbNNwMs.exe

C:\Windows\System\FbNNwMs.exe

C:\Windows\System\yMLECqj.exe

C:\Windows\System\yMLECqj.exe

C:\Windows\System\YqatxqZ.exe

C:\Windows\System\YqatxqZ.exe

C:\Windows\System\YGZNVSA.exe

C:\Windows\System\YGZNVSA.exe

C:\Windows\System\OxSyCaM.exe

C:\Windows\System\OxSyCaM.exe

C:\Windows\System\biOvjtO.exe

C:\Windows\System\biOvjtO.exe

C:\Windows\System\HowBfYR.exe

C:\Windows\System\HowBfYR.exe

C:\Windows\System\wrRPHrC.exe

C:\Windows\System\wrRPHrC.exe

C:\Windows\System\QpGTfpJ.exe

C:\Windows\System\QpGTfpJ.exe

C:\Windows\System\gSgyNAO.exe

C:\Windows\System\gSgyNAO.exe

C:\Windows\System\BTcwLZM.exe

C:\Windows\System\BTcwLZM.exe

C:\Windows\System\xbAPHFg.exe

C:\Windows\System\xbAPHFg.exe

C:\Windows\System\fDSmkOz.exe

C:\Windows\System\fDSmkOz.exe

C:\Windows\System\SmbBvKN.exe

C:\Windows\System\SmbBvKN.exe

C:\Windows\System\XzQIeSX.exe

C:\Windows\System\XzQIeSX.exe

C:\Windows\System\GhMXtKF.exe

C:\Windows\System\GhMXtKF.exe

C:\Windows\System\JGsMDKf.exe

C:\Windows\System\JGsMDKf.exe

C:\Windows\System\rhUZwKk.exe

C:\Windows\System\rhUZwKk.exe

C:\Windows\System\qZtUWnr.exe

C:\Windows\System\qZtUWnr.exe

C:\Windows\System\NIiyPwV.exe

C:\Windows\System\NIiyPwV.exe

C:\Windows\System\wUUresA.exe

C:\Windows\System\wUUresA.exe

C:\Windows\System\izOgMtc.exe

C:\Windows\System\izOgMtc.exe

C:\Windows\System\HmeofRn.exe

C:\Windows\System\HmeofRn.exe

C:\Windows\System\RnvgGUR.exe

C:\Windows\System\RnvgGUR.exe

C:\Windows\System\PnWRobY.exe

C:\Windows\System\PnWRobY.exe

C:\Windows\System\DCHxdBB.exe

C:\Windows\System\DCHxdBB.exe

C:\Windows\System\kDusZox.exe

C:\Windows\System\kDusZox.exe

C:\Windows\System\DpSCcUZ.exe

C:\Windows\System\DpSCcUZ.exe

C:\Windows\System\FcZChdL.exe

C:\Windows\System\FcZChdL.exe

C:\Windows\System\yKLmUSu.exe

C:\Windows\System\yKLmUSu.exe

C:\Windows\System\ArDaAaf.exe

C:\Windows\System\ArDaAaf.exe

C:\Windows\System\QiSjwAQ.exe

C:\Windows\System\QiSjwAQ.exe

C:\Windows\System\JpdkWor.exe

C:\Windows\System\JpdkWor.exe

C:\Windows\System\QmAoPge.exe

C:\Windows\System\QmAoPge.exe

C:\Windows\System\fbZegzk.exe

C:\Windows\System\fbZegzk.exe

C:\Windows\System\aEGojYQ.exe

C:\Windows\System\aEGojYQ.exe

C:\Windows\System\aXPhoDr.exe

C:\Windows\System\aXPhoDr.exe

C:\Windows\System\joRnCXt.exe

C:\Windows\System\joRnCXt.exe

C:\Windows\System\GzHLVmz.exe

C:\Windows\System\GzHLVmz.exe

C:\Windows\System\glgnLLJ.exe

C:\Windows\System\glgnLLJ.exe

C:\Windows\System\PegDNEN.exe

C:\Windows\System\PegDNEN.exe

C:\Windows\System\YnFsIMA.exe

C:\Windows\System\YnFsIMA.exe

C:\Windows\System\lAIpjKV.exe

C:\Windows\System\lAIpjKV.exe

C:\Windows\System\ziBuGJu.exe

C:\Windows\System\ziBuGJu.exe

C:\Windows\System\hRWgnYv.exe

C:\Windows\System\hRWgnYv.exe

C:\Windows\System\qJCwoue.exe

C:\Windows\System\qJCwoue.exe

C:\Windows\System\zZBhbLO.exe

C:\Windows\System\zZBhbLO.exe

C:\Windows\System\MBtrztm.exe

C:\Windows\System\MBtrztm.exe

C:\Windows\System\JrJIIXe.exe

C:\Windows\System\JrJIIXe.exe

C:\Windows\System\JfAfzIy.exe

C:\Windows\System\JfAfzIy.exe

C:\Windows\System\aIdhCQH.exe

C:\Windows\System\aIdhCQH.exe

C:\Windows\System\chVfkPr.exe

C:\Windows\System\chVfkPr.exe

C:\Windows\System\OvdGNid.exe

C:\Windows\System\OvdGNid.exe

C:\Windows\System\zJrrLUV.exe

C:\Windows\System\zJrrLUV.exe

C:\Windows\System\WFiRgra.exe

C:\Windows\System\WFiRgra.exe

C:\Windows\System\eFuiOcE.exe

C:\Windows\System\eFuiOcE.exe

C:\Windows\System\pMkcPkH.exe

C:\Windows\System\pMkcPkH.exe

C:\Windows\System\XrVyBRZ.exe

C:\Windows\System\XrVyBRZ.exe

C:\Windows\System\vOIovoY.exe

C:\Windows\System\vOIovoY.exe

C:\Windows\System\pvYWgVn.exe

C:\Windows\System\pvYWgVn.exe

C:\Windows\System\xTXDWWp.exe

C:\Windows\System\xTXDWWp.exe

C:\Windows\System\ExgLCzl.exe

C:\Windows\System\ExgLCzl.exe

C:\Windows\System\YqxODSm.exe

C:\Windows\System\YqxODSm.exe

C:\Windows\System\kRzHmoC.exe

C:\Windows\System\kRzHmoC.exe

C:\Windows\System\eLwUOuZ.exe

C:\Windows\System\eLwUOuZ.exe

C:\Windows\System\bYzWCzB.exe

C:\Windows\System\bYzWCzB.exe

C:\Windows\System\IjEBrPk.exe

C:\Windows\System\IjEBrPk.exe

C:\Windows\System\BbDSiKM.exe

C:\Windows\System\BbDSiKM.exe

C:\Windows\System\ganwpGL.exe

C:\Windows\System\ganwpGL.exe

C:\Windows\System\RYJdZSx.exe

C:\Windows\System\RYJdZSx.exe

C:\Windows\System\poKQfNh.exe

C:\Windows\System\poKQfNh.exe

C:\Windows\System\CsOPPaI.exe

C:\Windows\System\CsOPPaI.exe

C:\Windows\System\doqdasc.exe

C:\Windows\System\doqdasc.exe

C:\Windows\System\AldZyar.exe

C:\Windows\System\AldZyar.exe

C:\Windows\System\KEkKJEe.exe

C:\Windows\System\KEkKJEe.exe

C:\Windows\System\nedaLIH.exe

C:\Windows\System\nedaLIH.exe

C:\Windows\System\uvHVhig.exe

C:\Windows\System\uvHVhig.exe

C:\Windows\System\vXDraIu.exe

C:\Windows\System\vXDraIu.exe

C:\Windows\System\mJmFvVF.exe

C:\Windows\System\mJmFvVF.exe

C:\Windows\System\IfKufZX.exe

C:\Windows\System\IfKufZX.exe

C:\Windows\System\BPKQkcH.exe

C:\Windows\System\BPKQkcH.exe

C:\Windows\System\rxsvnea.exe

C:\Windows\System\rxsvnea.exe

C:\Windows\System\XZmnXGS.exe

C:\Windows\System\XZmnXGS.exe

C:\Windows\System\LtmUlMf.exe

C:\Windows\System\LtmUlMf.exe

C:\Windows\System\SDlPlQQ.exe

C:\Windows\System\SDlPlQQ.exe

C:\Windows\System\kYeqTXB.exe

C:\Windows\System\kYeqTXB.exe

C:\Windows\System\HsTqCZf.exe

C:\Windows\System\HsTqCZf.exe

C:\Windows\System\JMvTgMq.exe

C:\Windows\System\JMvTgMq.exe

C:\Windows\System\fJbqrzv.exe

C:\Windows\System\fJbqrzv.exe

C:\Windows\System\rKoJuCQ.exe

C:\Windows\System\rKoJuCQ.exe

C:\Windows\System\aaPVoEF.exe

C:\Windows\System\aaPVoEF.exe

C:\Windows\System\pfVVQqy.exe

C:\Windows\System\pfVVQqy.exe

C:\Windows\System\oWRbMcO.exe

C:\Windows\System\oWRbMcO.exe

C:\Windows\System\kNdJxvJ.exe

C:\Windows\System\kNdJxvJ.exe

C:\Windows\System\kZUHeYz.exe

C:\Windows\System\kZUHeYz.exe

C:\Windows\System\vtCsUsR.exe

C:\Windows\System\vtCsUsR.exe

C:\Windows\System\BiZcgES.exe

C:\Windows\System\BiZcgES.exe

C:\Windows\System\YJmArkS.exe

C:\Windows\System\YJmArkS.exe

C:\Windows\System\MfGXVtU.exe

C:\Windows\System\MfGXVtU.exe

C:\Windows\System\rQbKppn.exe

C:\Windows\System\rQbKppn.exe

C:\Windows\System\FpzYxXf.exe

C:\Windows\System\FpzYxXf.exe

C:\Windows\System\rDVzLGC.exe

C:\Windows\System\rDVzLGC.exe

C:\Windows\System\mYlYJlF.exe

C:\Windows\System\mYlYJlF.exe

C:\Windows\System\rLNUqPT.exe

C:\Windows\System\rLNUqPT.exe

C:\Windows\System\YYgJCLX.exe

C:\Windows\System\YYgJCLX.exe

C:\Windows\System\WmFvDuD.exe

C:\Windows\System\WmFvDuD.exe

C:\Windows\System\tYlfhwx.exe

C:\Windows\System\tYlfhwx.exe

C:\Windows\System\PyTTNnP.exe

C:\Windows\System\PyTTNnP.exe

C:\Windows\System\fzqipHC.exe

C:\Windows\System\fzqipHC.exe

C:\Windows\System\rJFBVkD.exe

C:\Windows\System\rJFBVkD.exe

C:\Windows\System\khrWZOP.exe

C:\Windows\System\khrWZOP.exe

C:\Windows\System\mgFEajb.exe

C:\Windows\System\mgFEajb.exe

C:\Windows\System\bqMbUvd.exe

C:\Windows\System\bqMbUvd.exe

C:\Windows\System\AlyMmjz.exe

C:\Windows\System\AlyMmjz.exe

C:\Windows\System\FjdlNsX.exe

C:\Windows\System\FjdlNsX.exe

C:\Windows\System\rBExIrB.exe

C:\Windows\System\rBExIrB.exe

C:\Windows\System\aqDbquG.exe

C:\Windows\System\aqDbquG.exe

C:\Windows\System\XYATJRf.exe

C:\Windows\System\XYATJRf.exe

C:\Windows\System\IUYUyeY.exe

C:\Windows\System\IUYUyeY.exe

C:\Windows\System\jRmfrhS.exe

C:\Windows\System\jRmfrhS.exe

C:\Windows\System\ZFQJTXy.exe

C:\Windows\System\ZFQJTXy.exe

C:\Windows\System\QnWWIHN.exe

C:\Windows\System\QnWWIHN.exe

C:\Windows\System\ErPAmjf.exe

C:\Windows\System\ErPAmjf.exe

C:\Windows\System\lyzDMkq.exe

C:\Windows\System\lyzDMkq.exe

C:\Windows\System\krVKNtH.exe

C:\Windows\System\krVKNtH.exe

C:\Windows\System\GOiBIzF.exe

C:\Windows\System\GOiBIzF.exe

C:\Windows\System\xftXWgT.exe

C:\Windows\System\xftXWgT.exe

C:\Windows\System\SaxOCvl.exe

C:\Windows\System\SaxOCvl.exe

C:\Windows\System\cldODMZ.exe

C:\Windows\System\cldODMZ.exe

C:\Windows\System\bQMimOQ.exe

C:\Windows\System\bQMimOQ.exe

C:\Windows\System\jDlWWyp.exe

C:\Windows\System\jDlWWyp.exe

C:\Windows\System\GfubGLH.exe

C:\Windows\System\GfubGLH.exe

C:\Windows\System\JRvscsI.exe

C:\Windows\System\JRvscsI.exe

C:\Windows\System\gYOjGTw.exe

C:\Windows\System\gYOjGTw.exe

C:\Windows\System\DbhDWim.exe

C:\Windows\System\DbhDWim.exe

C:\Windows\System\zmHMQHX.exe

C:\Windows\System\zmHMQHX.exe

C:\Windows\System\muBvgeC.exe

C:\Windows\System\muBvgeC.exe

C:\Windows\System\TgQNThi.exe

C:\Windows\System\TgQNThi.exe

C:\Windows\System\WimSvyg.exe

C:\Windows\System\WimSvyg.exe

C:\Windows\System\RuMMRkq.exe

C:\Windows\System\RuMMRkq.exe

C:\Windows\System\LEVpQbu.exe

C:\Windows\System\LEVpQbu.exe

C:\Windows\System\gXVMkOi.exe

C:\Windows\System\gXVMkOi.exe

C:\Windows\System\joXMScG.exe

C:\Windows\System\joXMScG.exe

C:\Windows\System\ZALNGPb.exe

C:\Windows\System\ZALNGPb.exe

C:\Windows\System\NbjcUqD.exe

C:\Windows\System\NbjcUqD.exe

C:\Windows\System\VasbuUJ.exe

C:\Windows\System\VasbuUJ.exe

C:\Windows\System\IsOIAKu.exe

C:\Windows\System\IsOIAKu.exe

C:\Windows\System\WJodnkV.exe

C:\Windows\System\WJodnkV.exe

C:\Windows\System\mWCYFlP.exe

C:\Windows\System\mWCYFlP.exe

C:\Windows\System\XUYccyd.exe

C:\Windows\System\XUYccyd.exe

C:\Windows\System\nQOeXGT.exe

C:\Windows\System\nQOeXGT.exe

C:\Windows\System\HUnYjPM.exe

C:\Windows\System\HUnYjPM.exe

C:\Windows\System\zZiTAqa.exe

C:\Windows\System\zZiTAqa.exe

C:\Windows\System\KmFqQhQ.exe

C:\Windows\System\KmFqQhQ.exe

C:\Windows\System\mxQYASy.exe

C:\Windows\System\mxQYASy.exe

C:\Windows\System\vsGzkzy.exe

C:\Windows\System\vsGzkzy.exe

C:\Windows\System\uMkdsOz.exe

C:\Windows\System\uMkdsOz.exe

C:\Windows\System\bBOjNkp.exe

C:\Windows\System\bBOjNkp.exe

C:\Windows\System\OonEziE.exe

C:\Windows\System\OonEziE.exe

C:\Windows\System\URVdQuf.exe

C:\Windows\System\URVdQuf.exe

C:\Windows\System\NRnAEQQ.exe

C:\Windows\System\NRnAEQQ.exe

C:\Windows\System\DbIaHCA.exe

C:\Windows\System\DbIaHCA.exe

C:\Windows\System\MfHdLKC.exe

C:\Windows\System\MfHdLKC.exe

C:\Windows\System\gKVmSae.exe

C:\Windows\System\gKVmSae.exe

C:\Windows\System\LgzInKB.exe

C:\Windows\System\LgzInKB.exe

C:\Windows\System\IYbuoVD.exe

C:\Windows\System\IYbuoVD.exe

C:\Windows\System\GAJInTD.exe

C:\Windows\System\GAJInTD.exe

C:\Windows\System\tNFSlFr.exe

C:\Windows\System\tNFSlFr.exe

C:\Windows\System\SxFmNCd.exe

C:\Windows\System\SxFmNCd.exe

C:\Windows\System\WWwYmna.exe

C:\Windows\System\WWwYmna.exe

C:\Windows\System\gLKRwpf.exe

C:\Windows\System\gLKRwpf.exe

C:\Windows\System\UgLGncf.exe

C:\Windows\System\UgLGncf.exe

C:\Windows\System\vhRhvLz.exe

C:\Windows\System\vhRhvLz.exe

C:\Windows\System\NUqucqX.exe

C:\Windows\System\NUqucqX.exe

C:\Windows\System\IMGRKpl.exe

C:\Windows\System\IMGRKpl.exe

C:\Windows\System\CLcuRQq.exe

C:\Windows\System\CLcuRQq.exe

C:\Windows\System\iiZkzfj.exe

C:\Windows\System\iiZkzfj.exe

C:\Windows\System\OoIuCUR.exe

C:\Windows\System\OoIuCUR.exe

C:\Windows\System\zHlRJBo.exe

C:\Windows\System\zHlRJBo.exe

C:\Windows\System\ZUNKCXS.exe

C:\Windows\System\ZUNKCXS.exe

C:\Windows\System\DxcgUVp.exe

C:\Windows\System\DxcgUVp.exe

C:\Windows\System\MFDyyOy.exe

C:\Windows\System\MFDyyOy.exe

C:\Windows\System\rlLeSNS.exe

C:\Windows\System\rlLeSNS.exe

C:\Windows\System\jmNwYFB.exe

C:\Windows\System\jmNwYFB.exe

C:\Windows\System\hEygeXF.exe

C:\Windows\System\hEygeXF.exe

C:\Windows\System\cAmUMby.exe

C:\Windows\System\cAmUMby.exe

C:\Windows\System\IgBxCsP.exe

C:\Windows\System\IgBxCsP.exe

C:\Windows\System\NIRzTwQ.exe

C:\Windows\System\NIRzTwQ.exe

C:\Windows\System\qQqHJae.exe

C:\Windows\System\qQqHJae.exe

C:\Windows\System\lhxXxQE.exe

C:\Windows\System\lhxXxQE.exe

C:\Windows\System\XuSQkaP.exe

C:\Windows\System\XuSQkaP.exe

C:\Windows\System\jgeSfRi.exe

C:\Windows\System\jgeSfRi.exe

C:\Windows\System\DVHbOGp.exe

C:\Windows\System\DVHbOGp.exe

C:\Windows\System\xRnCLQI.exe

C:\Windows\System\xRnCLQI.exe

C:\Windows\System\cQuMaEP.exe

C:\Windows\System\cQuMaEP.exe

C:\Windows\System\MMczEIN.exe

C:\Windows\System\MMczEIN.exe

C:\Windows\System\YPXVcca.exe

C:\Windows\System\YPXVcca.exe

C:\Windows\System\DbwQtwS.exe

C:\Windows\System\DbwQtwS.exe

C:\Windows\System\dvitfqp.exe

C:\Windows\System\dvitfqp.exe

C:\Windows\System\CsDfWqz.exe

C:\Windows\System\CsDfWqz.exe

C:\Windows\System\zxNnkpj.exe

C:\Windows\System\zxNnkpj.exe

C:\Windows\System\kDoLZXX.exe

C:\Windows\System\kDoLZXX.exe

C:\Windows\System\ZfxEmFp.exe

C:\Windows\System\ZfxEmFp.exe

C:\Windows\System\QRZVyIE.exe

C:\Windows\System\QRZVyIE.exe

C:\Windows\System\bYemHre.exe

C:\Windows\System\bYemHre.exe

C:\Windows\System\mJNoZjG.exe

C:\Windows\System\mJNoZjG.exe

C:\Windows\System\cBMnoDH.exe

C:\Windows\System\cBMnoDH.exe

C:\Windows\System\cuYOeLF.exe

C:\Windows\System\cuYOeLF.exe

C:\Windows\System\qMBPOJn.exe

C:\Windows\System\qMBPOJn.exe

C:\Windows\System\uaMnykS.exe

C:\Windows\System\uaMnykS.exe

C:\Windows\System\fIJlqdM.exe

C:\Windows\System\fIJlqdM.exe

C:\Windows\System\FjkqGAe.exe

C:\Windows\System\FjkqGAe.exe

C:\Windows\System\ViHWhJi.exe

C:\Windows\System\ViHWhJi.exe

C:\Windows\System\KiQsFda.exe

C:\Windows\System\KiQsFda.exe

C:\Windows\System\sWeePfL.exe

C:\Windows\System\sWeePfL.exe

C:\Windows\System\gNWGPnM.exe

C:\Windows\System\gNWGPnM.exe

C:\Windows\System\ojzSwyV.exe

C:\Windows\System\ojzSwyV.exe

C:\Windows\System\vbNNGiG.exe

C:\Windows\System\vbNNGiG.exe

C:\Windows\System\VcUDcON.exe

C:\Windows\System\VcUDcON.exe

C:\Windows\System\WaEdlFL.exe

C:\Windows\System\WaEdlFL.exe

C:\Windows\System\TPrFcWx.exe

C:\Windows\System\TPrFcWx.exe

C:\Windows\System\mLognoE.exe

C:\Windows\System\mLognoE.exe

C:\Windows\System\gDLPSsf.exe

C:\Windows\System\gDLPSsf.exe

C:\Windows\System\owEApLn.exe

C:\Windows\System\owEApLn.exe

C:\Windows\System\aGyieYZ.exe

C:\Windows\System\aGyieYZ.exe

C:\Windows\System\paChgnI.exe

C:\Windows\System\paChgnI.exe

C:\Windows\System\DokbhIN.exe

C:\Windows\System\DokbhIN.exe

C:\Windows\System\zTZBZHc.exe

C:\Windows\System\zTZBZHc.exe

C:\Windows\System\EOTFlMk.exe

C:\Windows\System\EOTFlMk.exe

C:\Windows\System\pIeUOUj.exe

C:\Windows\System\pIeUOUj.exe

C:\Windows\System\vhXIXGl.exe

C:\Windows\System\vhXIXGl.exe

C:\Windows\System\yCNFxxQ.exe

C:\Windows\System\yCNFxxQ.exe

C:\Windows\System\zbEqzNq.exe

C:\Windows\System\zbEqzNq.exe

C:\Windows\System\hlHmnhk.exe

C:\Windows\System\hlHmnhk.exe

C:\Windows\System\GaexXbW.exe

C:\Windows\System\GaexXbW.exe

C:\Windows\System\dUFBUKH.exe

C:\Windows\System\dUFBUKH.exe

C:\Windows\System\rggQjGO.exe

C:\Windows\System\rggQjGO.exe

C:\Windows\System\LpBaKjT.exe

C:\Windows\System\LpBaKjT.exe

C:\Windows\System\xdSzJkh.exe

C:\Windows\System\xdSzJkh.exe

C:\Windows\System\MLLdtbr.exe

C:\Windows\System\MLLdtbr.exe

C:\Windows\System\pxEccTI.exe

C:\Windows\System\pxEccTI.exe

C:\Windows\System\iqZFGIB.exe

C:\Windows\System\iqZFGIB.exe

C:\Windows\System\PbkcpFz.exe

C:\Windows\System\PbkcpFz.exe

C:\Windows\System\NlQaPDI.exe

C:\Windows\System\NlQaPDI.exe

C:\Windows\System\wEIbTZS.exe

C:\Windows\System\wEIbTZS.exe

C:\Windows\System\psUwxzw.exe

C:\Windows\System\psUwxzw.exe

C:\Windows\System\ekoTtQf.exe

C:\Windows\System\ekoTtQf.exe

C:\Windows\System\RXUDaqy.exe

C:\Windows\System\RXUDaqy.exe

C:\Windows\System\DtpPoDD.exe

C:\Windows\System\DtpPoDD.exe

C:\Windows\System\KAiToeF.exe

C:\Windows\System\KAiToeF.exe

C:\Windows\System\qConanU.exe

C:\Windows\System\qConanU.exe

C:\Windows\System\HTjtAMO.exe

C:\Windows\System\HTjtAMO.exe

C:\Windows\System\BIzdxxj.exe

C:\Windows\System\BIzdxxj.exe

C:\Windows\System\gjqPUtX.exe

C:\Windows\System\gjqPUtX.exe

C:\Windows\System\NDRXBMq.exe

C:\Windows\System\NDRXBMq.exe

C:\Windows\System\WxDXUcN.exe

C:\Windows\System\WxDXUcN.exe

C:\Windows\System\zjjjQFR.exe

C:\Windows\System\zjjjQFR.exe

C:\Windows\System\mSfLggb.exe

C:\Windows\System\mSfLggb.exe

C:\Windows\System\sVuTmjE.exe

C:\Windows\System\sVuTmjE.exe

C:\Windows\System\vDqdVhM.exe

C:\Windows\System\vDqdVhM.exe

C:\Windows\System\qpXrhqW.exe

C:\Windows\System\qpXrhqW.exe

C:\Windows\System\aTYTPJo.exe

C:\Windows\System\aTYTPJo.exe

C:\Windows\System\QCUGvDJ.exe

C:\Windows\System\QCUGvDJ.exe

C:\Windows\System\ABvPETO.exe

C:\Windows\System\ABvPETO.exe

C:\Windows\System\uLKvMoV.exe

C:\Windows\System\uLKvMoV.exe

C:\Windows\System\wffVMeV.exe

C:\Windows\System\wffVMeV.exe

C:\Windows\System\CAbqSSX.exe

C:\Windows\System\CAbqSSX.exe

C:\Windows\System\jefSGPW.exe

C:\Windows\System\jefSGPW.exe

C:\Windows\System\KNzEecA.exe

C:\Windows\System\KNzEecA.exe

C:\Windows\System\stmEkRq.exe

C:\Windows\System\stmEkRq.exe

C:\Windows\System\JxwJAmA.exe

C:\Windows\System\JxwJAmA.exe

C:\Windows\System\WzZzrRA.exe

C:\Windows\System\WzZzrRA.exe

C:\Windows\System\gggBXfv.exe

C:\Windows\System\gggBXfv.exe

C:\Windows\System\avjVyOB.exe

C:\Windows\System\avjVyOB.exe

C:\Windows\System\MrZYxWA.exe

C:\Windows\System\MrZYxWA.exe

C:\Windows\System\JLRSJkj.exe

C:\Windows\System\JLRSJkj.exe

C:\Windows\System\LNgFeaw.exe

C:\Windows\System\LNgFeaw.exe

C:\Windows\System\WCJYrlm.exe

C:\Windows\System\WCJYrlm.exe

C:\Windows\System\VGsEdgC.exe

C:\Windows\System\VGsEdgC.exe

C:\Windows\System\PWpdLqa.exe

C:\Windows\System\PWpdLqa.exe

C:\Windows\System\JnwtPfL.exe

C:\Windows\System\JnwtPfL.exe

C:\Windows\System\SvdAUmW.exe

C:\Windows\System\SvdAUmW.exe

C:\Windows\System\XMkYdUx.exe

C:\Windows\System\XMkYdUx.exe

C:\Windows\System\CPoxSzG.exe

C:\Windows\System\CPoxSzG.exe

C:\Windows\System\qxudZZJ.exe

C:\Windows\System\qxudZZJ.exe

C:\Windows\System\tYIYYVK.exe

C:\Windows\System\tYIYYVK.exe

C:\Windows\System\zLRCAev.exe

C:\Windows\System\zLRCAev.exe

C:\Windows\System\rsCQvFh.exe

C:\Windows\System\rsCQvFh.exe

C:\Windows\System\wZjsQoH.exe

C:\Windows\System\wZjsQoH.exe

C:\Windows\System\xRPVCOV.exe

C:\Windows\System\xRPVCOV.exe

C:\Windows\System\olcPfFi.exe

C:\Windows\System\olcPfFi.exe

C:\Windows\System\SmDwfUS.exe

C:\Windows\System\SmDwfUS.exe

C:\Windows\System\ogOksrt.exe

C:\Windows\System\ogOksrt.exe

C:\Windows\System\PBPpsnf.exe

C:\Windows\System\PBPpsnf.exe

C:\Windows\System\FxCiGya.exe

C:\Windows\System\FxCiGya.exe

C:\Windows\System\FcRVqDA.exe

C:\Windows\System\FcRVqDA.exe

C:\Windows\System\mgUeTML.exe

C:\Windows\System\mgUeTML.exe

C:\Windows\System\exWoMGv.exe

C:\Windows\System\exWoMGv.exe

C:\Windows\System\Xqaybnz.exe

C:\Windows\System\Xqaybnz.exe

C:\Windows\System\bKkbDAr.exe

C:\Windows\System\bKkbDAr.exe

C:\Windows\System\tfKZvOy.exe

C:\Windows\System\tfKZvOy.exe

C:\Windows\System\mcZNvNb.exe

C:\Windows\System\mcZNvNb.exe

C:\Windows\System\rrhtPoS.exe

C:\Windows\System\rrhtPoS.exe

C:\Windows\System\WLJVSAR.exe

C:\Windows\System\WLJVSAR.exe

C:\Windows\System\xlRkMUC.exe

C:\Windows\System\xlRkMUC.exe

C:\Windows\System\hJWCXZT.exe

C:\Windows\System\hJWCXZT.exe

C:\Windows\System\ySTDOzf.exe

C:\Windows\System\ySTDOzf.exe

C:\Windows\System\hIgJPzd.exe

C:\Windows\System\hIgJPzd.exe

C:\Windows\System\fodyGkY.exe

C:\Windows\System\fodyGkY.exe

C:\Windows\System\QNqNfRK.exe

C:\Windows\System\QNqNfRK.exe

C:\Windows\System\xNvzfjo.exe

C:\Windows\System\xNvzfjo.exe

C:\Windows\System\OsPutCs.exe

C:\Windows\System\OsPutCs.exe

C:\Windows\System\sQmKokt.exe

C:\Windows\System\sQmKokt.exe

C:\Windows\System\PpCEWCx.exe

C:\Windows\System\PpCEWCx.exe

C:\Windows\System\TzduEco.exe

C:\Windows\System\TzduEco.exe

C:\Windows\System\VVUnUAA.exe

C:\Windows\System\VVUnUAA.exe

C:\Windows\System\QJLAiyK.exe

C:\Windows\System\QJLAiyK.exe

C:\Windows\System\oTxriKu.exe

C:\Windows\System\oTxriKu.exe

C:\Windows\System\MeGdkCi.exe

C:\Windows\System\MeGdkCi.exe

C:\Windows\System\UTDqCCq.exe

C:\Windows\System\UTDqCCq.exe

C:\Windows\System\PnpuFbo.exe

C:\Windows\System\PnpuFbo.exe

C:\Windows\System\mrGGCWr.exe

C:\Windows\System\mrGGCWr.exe

C:\Windows\System\qdKonhh.exe

C:\Windows\System\qdKonhh.exe

C:\Windows\System\SlTTQPh.exe

C:\Windows\System\SlTTQPh.exe

C:\Windows\System\jPGiGKs.exe

C:\Windows\System\jPGiGKs.exe

C:\Windows\System\jyVucuK.exe

C:\Windows\System\jyVucuK.exe

C:\Windows\System\gngulhE.exe

C:\Windows\System\gngulhE.exe

C:\Windows\System\gLvgXWG.exe

C:\Windows\System\gLvgXWG.exe

C:\Windows\System\RvJeRsp.exe

C:\Windows\System\RvJeRsp.exe

C:\Windows\System\nyCEHAp.exe

C:\Windows\System\nyCEHAp.exe

C:\Windows\System\dCllCir.exe

C:\Windows\System\dCllCir.exe

C:\Windows\System\HSzqBHv.exe

C:\Windows\System\HSzqBHv.exe

C:\Windows\System\vJzTvgj.exe

C:\Windows\System\vJzTvgj.exe

C:\Windows\System\DTNOmPx.exe

C:\Windows\System\DTNOmPx.exe

C:\Windows\System\gbRGnqQ.exe

C:\Windows\System\gbRGnqQ.exe

C:\Windows\System\bBRigFp.exe

C:\Windows\System\bBRigFp.exe

C:\Windows\System\aiBiiVa.exe

C:\Windows\System\aiBiiVa.exe

C:\Windows\System\wkCMbrS.exe

C:\Windows\System\wkCMbrS.exe

C:\Windows\System\QDsgMFp.exe

C:\Windows\System\QDsgMFp.exe

C:\Windows\System\JpUYOIE.exe

C:\Windows\System\JpUYOIE.exe

C:\Windows\System\DwAOoqf.exe

C:\Windows\System\DwAOoqf.exe

C:\Windows\System\GUQvRsN.exe

C:\Windows\System\GUQvRsN.exe

C:\Windows\System\jpECORl.exe

C:\Windows\System\jpECORl.exe

C:\Windows\System\SnflUKF.exe

C:\Windows\System\SnflUKF.exe

C:\Windows\System\zNQORPJ.exe

C:\Windows\System\zNQORPJ.exe

C:\Windows\System\BklFAPH.exe

C:\Windows\System\BklFAPH.exe

C:\Windows\System\jwkRGgX.exe

C:\Windows\System\jwkRGgX.exe

C:\Windows\System\SmdodZS.exe

C:\Windows\System\SmdodZS.exe

C:\Windows\System\gEsnSND.exe

C:\Windows\System\gEsnSND.exe

C:\Windows\System\yDVLkGV.exe

C:\Windows\System\yDVLkGV.exe

C:\Windows\System\OJMoxNe.exe

C:\Windows\System\OJMoxNe.exe

C:\Windows\System\YAcxZSQ.exe

C:\Windows\System\YAcxZSQ.exe

C:\Windows\System\fOeRgFw.exe

C:\Windows\System\fOeRgFw.exe

C:\Windows\System\YYMiYPk.exe

C:\Windows\System\YYMiYPk.exe

C:\Windows\System\cWcEPjB.exe

C:\Windows\System\cWcEPjB.exe

C:\Windows\System\leeVYhk.exe

C:\Windows\System\leeVYhk.exe

C:\Windows\System\OPFIYwg.exe

C:\Windows\System\OPFIYwg.exe

C:\Windows\System\ZJlqMKW.exe

C:\Windows\System\ZJlqMKW.exe

C:\Windows\System\jnHYwtP.exe

C:\Windows\System\jnHYwtP.exe

C:\Windows\System\XqAnffc.exe

C:\Windows\System\XqAnffc.exe

C:\Windows\System\pHagqTo.exe

C:\Windows\System\pHagqTo.exe

C:\Windows\System\GQRYVRY.exe

C:\Windows\System\GQRYVRY.exe

C:\Windows\System\lNiwYmK.exe

C:\Windows\System\lNiwYmK.exe

C:\Windows\System\ZiRlZOv.exe

C:\Windows\System\ZiRlZOv.exe

C:\Windows\System\BlZXvpw.exe

C:\Windows\System\BlZXvpw.exe

C:\Windows\System\JuvvaXu.exe

C:\Windows\System\JuvvaXu.exe

C:\Windows\System\mAVKDTy.exe

C:\Windows\System\mAVKDTy.exe

C:\Windows\System\WqDWYUR.exe

C:\Windows\System\WqDWYUR.exe

C:\Windows\System\yEGaPgm.exe

C:\Windows\System\yEGaPgm.exe

C:\Windows\System\eAfjosa.exe

C:\Windows\System\eAfjosa.exe

C:\Windows\System\UOebrsR.exe

C:\Windows\System\UOebrsR.exe

C:\Windows\System\GmpLWbx.exe

C:\Windows\System\GmpLWbx.exe

C:\Windows\System\wfZfaJc.exe

C:\Windows\System\wfZfaJc.exe

C:\Windows\System\CkVtkqv.exe

C:\Windows\System\CkVtkqv.exe

C:\Windows\System\SFPqXWB.exe

C:\Windows\System\SFPqXWB.exe

C:\Windows\System\KxxTgUh.exe

C:\Windows\System\KxxTgUh.exe

C:\Windows\System\XGUbScb.exe

C:\Windows\System\XGUbScb.exe

C:\Windows\System\fluxbgk.exe

C:\Windows\System\fluxbgk.exe

C:\Windows\System\DFjGxvp.exe

C:\Windows\System\DFjGxvp.exe

C:\Windows\System\bdOkWUd.exe

C:\Windows\System\bdOkWUd.exe

C:\Windows\System\ZCvJUlz.exe

C:\Windows\System\ZCvJUlz.exe

C:\Windows\System\xEpqDzA.exe

C:\Windows\System\xEpqDzA.exe

C:\Windows\System\MYYLexw.exe

C:\Windows\System\MYYLexw.exe

C:\Windows\System\gtbiRKY.exe

C:\Windows\System\gtbiRKY.exe

C:\Windows\System\oeMcwGr.exe

C:\Windows\System\oeMcwGr.exe

C:\Windows\System\MEANICk.exe

C:\Windows\System\MEANICk.exe

C:\Windows\System\MOqNFgd.exe

C:\Windows\System\MOqNFgd.exe

C:\Windows\System\ChpNGEP.exe

C:\Windows\System\ChpNGEP.exe

C:\Windows\System\yugqRRj.exe

C:\Windows\System\yugqRRj.exe

C:\Windows\System\TTxMzsj.exe

C:\Windows\System\TTxMzsj.exe

C:\Windows\System\RBSZqma.exe

C:\Windows\System\RBSZqma.exe

C:\Windows\System\gVaCOjf.exe

C:\Windows\System\gVaCOjf.exe

C:\Windows\System\gNqEOXO.exe

C:\Windows\System\gNqEOXO.exe

C:\Windows\System\oSoNrAr.exe

C:\Windows\System\oSoNrAr.exe

C:\Windows\System\fUeKDAA.exe

C:\Windows\System\fUeKDAA.exe

C:\Windows\System\YPtgGsN.exe

C:\Windows\System\YPtgGsN.exe

C:\Windows\System\rGTIYeL.exe

C:\Windows\System\rGTIYeL.exe

C:\Windows\System\zUGoOiM.exe

C:\Windows\System\zUGoOiM.exe

C:\Windows\System\qDEnNZo.exe

C:\Windows\System\qDEnNZo.exe

C:\Windows\System\qfJKuYM.exe

C:\Windows\System\qfJKuYM.exe

C:\Windows\System\dhESwII.exe

C:\Windows\System\dhESwII.exe

C:\Windows\System\NddMBlQ.exe

C:\Windows\System\NddMBlQ.exe

C:\Windows\System\HTypYfv.exe

C:\Windows\System\HTypYfv.exe

C:\Windows\System\yeQGShM.exe

C:\Windows\System\yeQGShM.exe

C:\Windows\System\mwbbSYY.exe

C:\Windows\System\mwbbSYY.exe

C:\Windows\System\XNJwdLk.exe

C:\Windows\System\XNJwdLk.exe

C:\Windows\System\KxhbGvI.exe

C:\Windows\System\KxhbGvI.exe

C:\Windows\System\KkZbRxa.exe

C:\Windows\System\KkZbRxa.exe

C:\Windows\System\KCBLhDS.exe

C:\Windows\System\KCBLhDS.exe

C:\Windows\System\OlAzkmi.exe

C:\Windows\System\OlAzkmi.exe

C:\Windows\System\eXvcNyf.exe

C:\Windows\System\eXvcNyf.exe

C:\Windows\System\bakfnPp.exe

C:\Windows\System\bakfnPp.exe

C:\Windows\System\gnqGMDS.exe

C:\Windows\System\gnqGMDS.exe

C:\Windows\System\iUgGWwb.exe

C:\Windows\System\iUgGWwb.exe

C:\Windows\System\OqhhIHh.exe

C:\Windows\System\OqhhIHh.exe

C:\Windows\System\UvKXcpV.exe

C:\Windows\System\UvKXcpV.exe

C:\Windows\System\GaqhWSI.exe

C:\Windows\System\GaqhWSI.exe

C:\Windows\System\hfgQbCA.exe

C:\Windows\System\hfgQbCA.exe

C:\Windows\System\yHznnYZ.exe

C:\Windows\System\yHznnYZ.exe

C:\Windows\System\JNrCbzt.exe

C:\Windows\System\JNrCbzt.exe

C:\Windows\System\WFwcIcE.exe

C:\Windows\System\WFwcIcE.exe

C:\Windows\System\hzNqDut.exe

C:\Windows\System\hzNqDut.exe

C:\Windows\System\iTWlkQT.exe

C:\Windows\System\iTWlkQT.exe

C:\Windows\System\fJjNkqf.exe

C:\Windows\System\fJjNkqf.exe

C:\Windows\System\dQKiUfw.exe

C:\Windows\System\dQKiUfw.exe

C:\Windows\System\YovSPmS.exe

C:\Windows\System\YovSPmS.exe

C:\Windows\System\nFJHNjG.exe

C:\Windows\System\nFJHNjG.exe

C:\Windows\System\wEfBBsu.exe

C:\Windows\System\wEfBBsu.exe

C:\Windows\System\YMmGIGA.exe

C:\Windows\System\YMmGIGA.exe

C:\Windows\System\VVKoEOt.exe

C:\Windows\System\VVKoEOt.exe

C:\Windows\System\VnmtCDV.exe

C:\Windows\System\VnmtCDV.exe

C:\Windows\System\wSJhaZS.exe

C:\Windows\System\wSJhaZS.exe

C:\Windows\System\npeoYhn.exe

C:\Windows\System\npeoYhn.exe

C:\Windows\System\qLfyWWH.exe

C:\Windows\System\qLfyWWH.exe

C:\Windows\System\gWshpCM.exe

C:\Windows\System\gWshpCM.exe

C:\Windows\System\zNBpPAN.exe

C:\Windows\System\zNBpPAN.exe

C:\Windows\System\NzgJzAK.exe

C:\Windows\System\NzgJzAK.exe

C:\Windows\System\mSDMrEQ.exe

C:\Windows\System\mSDMrEQ.exe

C:\Windows\System\PudJLOl.exe

C:\Windows\System\PudJLOl.exe

C:\Windows\System\YqHNYvG.exe

C:\Windows\System\YqHNYvG.exe

C:\Windows\System\epYHkAg.exe

C:\Windows\System\epYHkAg.exe

C:\Windows\System\FWJXGBP.exe

C:\Windows\System\FWJXGBP.exe

C:\Windows\System\BnAkgYz.exe

C:\Windows\System\BnAkgYz.exe

C:\Windows\System\SXWkHoK.exe

C:\Windows\System\SXWkHoK.exe

C:\Windows\System\FvHeGHd.exe

C:\Windows\System\FvHeGHd.exe

C:\Windows\System\mQvMXcJ.exe

C:\Windows\System\mQvMXcJ.exe

C:\Windows\System\FXEzrMv.exe

C:\Windows\System\FXEzrMv.exe

C:\Windows\System\rrmugQQ.exe

C:\Windows\System\rrmugQQ.exe

C:\Windows\System\tCdyKox.exe

C:\Windows\System\tCdyKox.exe

C:\Windows\System\xhjSfoY.exe

C:\Windows\System\xhjSfoY.exe

C:\Windows\System\HjlUDWu.exe

C:\Windows\System\HjlUDWu.exe

C:\Windows\System\HrJpHZk.exe

C:\Windows\System\HrJpHZk.exe

C:\Windows\System\EljTHNg.exe

C:\Windows\System\EljTHNg.exe

C:\Windows\System\lNxKRVM.exe

C:\Windows\System\lNxKRVM.exe

C:\Windows\System\WKSnyvV.exe

C:\Windows\System\WKSnyvV.exe

C:\Windows\System\ZEdBGXb.exe

C:\Windows\System\ZEdBGXb.exe

C:\Windows\System\YJBZRWi.exe

C:\Windows\System\YJBZRWi.exe

C:\Windows\System\MWCujOO.exe

C:\Windows\System\MWCujOO.exe

C:\Windows\System\QGDHdUn.exe

C:\Windows\System\QGDHdUn.exe

C:\Windows\System\hiweWkp.exe

C:\Windows\System\hiweWkp.exe

C:\Windows\System\NTXyFKW.exe

C:\Windows\System\NTXyFKW.exe

C:\Windows\System\LKMhlUH.exe

C:\Windows\System\LKMhlUH.exe

C:\Windows\System\aZceJxb.exe

C:\Windows\System\aZceJxb.exe

C:\Windows\System\YFAjIUI.exe

C:\Windows\System\YFAjIUI.exe

C:\Windows\System\sPclojb.exe

C:\Windows\System\sPclojb.exe

C:\Windows\System\AGnpLun.exe

C:\Windows\System\AGnpLun.exe

C:\Windows\System\hbUjIGk.exe

C:\Windows\System\hbUjIGk.exe

C:\Windows\System\sEvPkRY.exe

C:\Windows\System\sEvPkRY.exe

C:\Windows\System\oErKhEy.exe

C:\Windows\System\oErKhEy.exe

C:\Windows\System\NDztfLn.exe

C:\Windows\System\NDztfLn.exe

C:\Windows\System\ZgMTFMu.exe

C:\Windows\System\ZgMTFMu.exe

C:\Windows\System\iqzlwat.exe

C:\Windows\System\iqzlwat.exe

C:\Windows\System\ZQEvLEv.exe

C:\Windows\System\ZQEvLEv.exe

C:\Windows\System\NSreIQf.exe

C:\Windows\System\NSreIQf.exe

C:\Windows\System\sTacjyY.exe

C:\Windows\System\sTacjyY.exe

C:\Windows\System\FtQljyA.exe

C:\Windows\System\FtQljyA.exe

C:\Windows\System\sqTyfIL.exe

C:\Windows\System\sqTyfIL.exe

C:\Windows\System\UbJEaNg.exe

C:\Windows\System\UbJEaNg.exe

C:\Windows\System\fwUBSuT.exe

C:\Windows\System\fwUBSuT.exe

C:\Windows\System\HjIHcCw.exe

C:\Windows\System\HjIHcCw.exe

C:\Windows\System\pHscMuI.exe

C:\Windows\System\pHscMuI.exe

C:\Windows\System\NygIOzG.exe

C:\Windows\System\NygIOzG.exe

C:\Windows\System\LQmObnL.exe

C:\Windows\System\LQmObnL.exe

C:\Windows\System\SCSqZgS.exe

C:\Windows\System\SCSqZgS.exe

C:\Windows\System\BcKqBNN.exe

C:\Windows\System\BcKqBNN.exe

C:\Windows\System\NXaMgNw.exe

C:\Windows\System\NXaMgNw.exe

C:\Windows\System\tNugHEH.exe

C:\Windows\System\tNugHEH.exe

C:\Windows\System\izqVLSX.exe

C:\Windows\System\izqVLSX.exe

C:\Windows\System\CDbPUOg.exe

C:\Windows\System\CDbPUOg.exe

C:\Windows\System\iolQiVW.exe

C:\Windows\System\iolQiVW.exe

C:\Windows\System\bFwDTCj.exe

C:\Windows\System\bFwDTCj.exe

C:\Windows\System\cxXlILw.exe

C:\Windows\System\cxXlILw.exe

C:\Windows\System\qzIauBN.exe

C:\Windows\System\qzIauBN.exe

C:\Windows\System\yyXVYUX.exe

C:\Windows\System\yyXVYUX.exe

C:\Windows\System\hUJwXzd.exe

C:\Windows\System\hUJwXzd.exe

C:\Windows\System\VeelERt.exe

C:\Windows\System\VeelERt.exe

C:\Windows\System\pwLdwOH.exe

C:\Windows\System\pwLdwOH.exe

C:\Windows\System\dWfpJVF.exe

C:\Windows\System\dWfpJVF.exe

C:\Windows\System\mTefEim.exe

C:\Windows\System\mTefEim.exe

C:\Windows\System\ZXSWmUR.exe

C:\Windows\System\ZXSWmUR.exe

C:\Windows\System\sLLAIJV.exe

C:\Windows\System\sLLAIJV.exe

C:\Windows\System\ShaLhlV.exe

C:\Windows\System\ShaLhlV.exe

C:\Windows\System\sqxmYBt.exe

C:\Windows\System\sqxmYBt.exe

C:\Windows\System\MPgYUpS.exe

C:\Windows\System\MPgYUpS.exe

C:\Windows\System\VnajgtN.exe

C:\Windows\System\VnajgtN.exe

C:\Windows\System\ODPbUkh.exe

C:\Windows\System\ODPbUkh.exe

C:\Windows\System\CJIGXUf.exe

C:\Windows\System\CJIGXUf.exe

C:\Windows\System\GTncLcO.exe

C:\Windows\System\GTncLcO.exe

C:\Windows\System\gAnRlnk.exe

C:\Windows\System\gAnRlnk.exe

C:\Windows\System\YiGRZan.exe

C:\Windows\System\YiGRZan.exe

C:\Windows\System\RxmDyil.exe

C:\Windows\System\RxmDyil.exe

C:\Windows\System\tVeAYYx.exe

C:\Windows\System\tVeAYYx.exe

C:\Windows\System\PxQDHnn.exe

C:\Windows\System\PxQDHnn.exe

C:\Windows\System\QWQcLUV.exe

C:\Windows\System\QWQcLUV.exe

C:\Windows\System\CJEgCaA.exe

C:\Windows\System\CJEgCaA.exe

C:\Windows\System\cvCkOTl.exe

C:\Windows\System\cvCkOTl.exe

C:\Windows\System\dsRVqgT.exe

C:\Windows\System\dsRVqgT.exe

C:\Windows\System\LrYCyfZ.exe

C:\Windows\System\LrYCyfZ.exe

C:\Windows\System\YKHooZf.exe

C:\Windows\System\YKHooZf.exe

C:\Windows\System\eCXdDUc.exe

C:\Windows\System\eCXdDUc.exe

C:\Windows\System\xnByqyi.exe

C:\Windows\System\xnByqyi.exe

C:\Windows\System\uynpImL.exe

C:\Windows\System\uynpImL.exe

C:\Windows\System\McnWXmr.exe

C:\Windows\System\McnWXmr.exe

C:\Windows\System\bkZDQcK.exe

C:\Windows\System\bkZDQcK.exe

C:\Windows\System\Hoekrka.exe

C:\Windows\System\Hoekrka.exe

C:\Windows\System\EngtPqR.exe

C:\Windows\System\EngtPqR.exe

C:\Windows\System\KtClgJy.exe

C:\Windows\System\KtClgJy.exe

C:\Windows\System\wrfdrrO.exe

C:\Windows\System\wrfdrrO.exe

C:\Windows\System\UQnfAaF.exe

C:\Windows\System\UQnfAaF.exe

C:\Windows\System\yjsTCRd.exe

C:\Windows\System\yjsTCRd.exe

C:\Windows\System\xsaGhPW.exe

C:\Windows\System\xsaGhPW.exe

C:\Windows\System\OBufBSk.exe

C:\Windows\System\OBufBSk.exe

C:\Windows\System\sseBcSy.exe

C:\Windows\System\sseBcSy.exe

C:\Windows\System\TYDFJrC.exe

C:\Windows\System\TYDFJrC.exe

C:\Windows\System\hMoOmWc.exe

C:\Windows\System\hMoOmWc.exe

C:\Windows\System\EDQpylV.exe

C:\Windows\System\EDQpylV.exe

C:\Windows\System\phBiZQk.exe

C:\Windows\System\phBiZQk.exe

C:\Windows\System\LjuqCQB.exe

C:\Windows\System\LjuqCQB.exe

C:\Windows\System\EHIFHdf.exe

C:\Windows\System\EHIFHdf.exe

C:\Windows\System\HKXZqki.exe

C:\Windows\System\HKXZqki.exe

C:\Windows\System\dtdfqjB.exe

C:\Windows\System\dtdfqjB.exe

C:\Windows\System\aYHwiuF.exe

C:\Windows\System\aYHwiuF.exe

C:\Windows\System\AtBlbxZ.exe

C:\Windows\System\AtBlbxZ.exe

C:\Windows\System\AUpTUpE.exe

C:\Windows\System\AUpTUpE.exe

C:\Windows\System\CnfWcrk.exe

C:\Windows\System\CnfWcrk.exe

C:\Windows\System\QRkUeOu.exe

C:\Windows\System\QRkUeOu.exe

C:\Windows\System\nVpGUki.exe

C:\Windows\System\nVpGUki.exe

C:\Windows\System\ExihyiD.exe

C:\Windows\System\ExihyiD.exe

C:\Windows\System\rzYtnFx.exe

C:\Windows\System\rzYtnFx.exe

C:\Windows\System\lVmiUNG.exe

C:\Windows\System\lVmiUNG.exe

C:\Windows\System\BRYzhjv.exe

C:\Windows\System\BRYzhjv.exe

C:\Windows\System\kxUCyRp.exe

C:\Windows\System\kxUCyRp.exe

C:\Windows\System\DICubCD.exe

C:\Windows\System\DICubCD.exe

C:\Windows\System\OsajRGc.exe

C:\Windows\System\OsajRGc.exe

C:\Windows\System\SNeZJTb.exe

C:\Windows\System\SNeZJTb.exe

C:\Windows\System\AUFXStS.exe

C:\Windows\System\AUFXStS.exe

C:\Windows\System\PKhwQTs.exe

C:\Windows\System\PKhwQTs.exe

C:\Windows\System\DWOcXPd.exe

C:\Windows\System\DWOcXPd.exe

C:\Windows\System\tvyTcXI.exe

C:\Windows\System\tvyTcXI.exe

C:\Windows\System\pTTRsWa.exe

C:\Windows\System\pTTRsWa.exe

C:\Windows\System\nGKBDDX.exe

C:\Windows\System\nGKBDDX.exe

C:\Windows\System\jhvecnN.exe

C:\Windows\System\jhvecnN.exe

C:\Windows\System\UzInbBs.exe

C:\Windows\System\UzInbBs.exe

C:\Windows\System\UqsFQBJ.exe

C:\Windows\System\UqsFQBJ.exe

C:\Windows\System\pTmVxge.exe

C:\Windows\System\pTmVxge.exe

C:\Windows\System\ebOBGbN.exe

C:\Windows\System\ebOBGbN.exe

C:\Windows\System\XXunARV.exe

C:\Windows\System\XXunARV.exe

C:\Windows\System\sBqQeGD.exe

C:\Windows\System\sBqQeGD.exe

C:\Windows\System\qTpFKCh.exe

C:\Windows\System\qTpFKCh.exe

C:\Windows\System\hIqbUgc.exe

C:\Windows\System\hIqbUgc.exe

C:\Windows\System\OjxWWZJ.exe

C:\Windows\System\OjxWWZJ.exe

C:\Windows\System\fZaCVVq.exe

C:\Windows\System\fZaCVVq.exe

C:\Windows\System\ZhlopIt.exe

C:\Windows\System\ZhlopIt.exe

C:\Windows\System\eCjJtno.exe

C:\Windows\System\eCjJtno.exe

C:\Windows\System\jIpikBz.exe

C:\Windows\System\jIpikBz.exe

C:\Windows\System\SLEvkac.exe

C:\Windows\System\SLEvkac.exe

C:\Windows\System\FuYamGB.exe

C:\Windows\System\FuYamGB.exe

C:\Windows\System\OfSHHqj.exe

C:\Windows\System\OfSHHqj.exe

C:\Windows\System\rSWVKMs.exe

C:\Windows\System\rSWVKMs.exe

C:\Windows\System\KdFPgtR.exe

C:\Windows\System\KdFPgtR.exe

C:\Windows\System\cHndCIT.exe

C:\Windows\System\cHndCIT.exe

C:\Windows\System\GKMRFNN.exe

C:\Windows\System\GKMRFNN.exe

C:\Windows\System\OLZBlnc.exe

C:\Windows\System\OLZBlnc.exe

C:\Windows\System\RhpjUUK.exe

C:\Windows\System\RhpjUUK.exe

C:\Windows\System\LXiFHuB.exe

C:\Windows\System\LXiFHuB.exe

C:\Windows\System\jWJlaBN.exe

C:\Windows\System\jWJlaBN.exe

C:\Windows\System\KiYCWaK.exe

C:\Windows\System\KiYCWaK.exe

C:\Windows\System\mozklNe.exe

C:\Windows\System\mozklNe.exe

C:\Windows\System\iStweUk.exe

C:\Windows\System\iStweUk.exe

C:\Windows\System\CptQLFP.exe

C:\Windows\System\CptQLFP.exe

C:\Windows\System\XLyWqxN.exe

C:\Windows\System\XLyWqxN.exe

C:\Windows\System\HBepTXR.exe

C:\Windows\System\HBepTXR.exe

C:\Windows\System\VaKhmJO.exe

C:\Windows\System\VaKhmJO.exe

C:\Windows\System\TxGeyVE.exe

C:\Windows\System\TxGeyVE.exe

C:\Windows\System\ckbOfzy.exe

C:\Windows\System\ckbOfzy.exe

C:\Windows\System\hvIvNez.exe

C:\Windows\System\hvIvNez.exe

C:\Windows\System\PEAuYGU.exe

C:\Windows\System\PEAuYGU.exe

C:\Windows\System\aKQdZCg.exe

C:\Windows\System\aKQdZCg.exe

C:\Windows\System\eXztVHJ.exe

C:\Windows\System\eXztVHJ.exe

C:\Windows\System\AsFROuf.exe

C:\Windows\System\AsFROuf.exe

C:\Windows\System\GEPUJZY.exe

C:\Windows\System\GEPUJZY.exe

C:\Windows\System\sckLkWd.exe

C:\Windows\System\sckLkWd.exe

C:\Windows\System\LDeXKBw.exe

C:\Windows\System\LDeXKBw.exe

C:\Windows\System\qWjxcuE.exe

C:\Windows\System\qWjxcuE.exe

C:\Windows\System\egNRejt.exe

C:\Windows\System\egNRejt.exe

C:\Windows\System\VLnUkou.exe

C:\Windows\System\VLnUkou.exe

C:\Windows\System\qMDrKsH.exe

C:\Windows\System\qMDrKsH.exe

C:\Windows\System\XoBtJSi.exe

C:\Windows\System\XoBtJSi.exe

C:\Windows\System\WtAfGEs.exe

C:\Windows\System\WtAfGEs.exe

C:\Windows\System\OcbCTIX.exe

C:\Windows\System\OcbCTIX.exe

C:\Windows\System\xbjECTj.exe

C:\Windows\System\xbjECTj.exe

C:\Windows\System\uOwblsT.exe

C:\Windows\System\uOwblsT.exe

C:\Windows\System\wCpZtDe.exe

C:\Windows\System\wCpZtDe.exe

C:\Windows\System\ypKnaVI.exe

C:\Windows\System\ypKnaVI.exe

C:\Windows\System\aPXNtjm.exe

C:\Windows\System\aPXNtjm.exe

C:\Windows\System\UIqQFFc.exe

C:\Windows\System\UIqQFFc.exe

C:\Windows\System\sbeplqr.exe

C:\Windows\System\sbeplqr.exe

C:\Windows\System\AwbkquT.exe

C:\Windows\System\AwbkquT.exe

C:\Windows\System\vFkfsuM.exe

C:\Windows\System\vFkfsuM.exe

C:\Windows\System\ZcMRabw.exe

C:\Windows\System\ZcMRabw.exe

C:\Windows\System\GOGSICg.exe

C:\Windows\System\GOGSICg.exe

C:\Windows\System\xwmjNdL.exe

C:\Windows\System\xwmjNdL.exe

C:\Windows\System\edZwSbm.exe

C:\Windows\System\edZwSbm.exe

C:\Windows\System\zHMTQyY.exe

C:\Windows\System\zHMTQyY.exe

C:\Windows\System\upjMwMK.exe

C:\Windows\System\upjMwMK.exe

C:\Windows\System\LxaIYfz.exe

C:\Windows\System\LxaIYfz.exe

C:\Windows\System\ofhULqd.exe

C:\Windows\System\ofhULqd.exe

C:\Windows\System\zwVMhWE.exe

C:\Windows\System\zwVMhWE.exe

C:\Windows\System\RXAiwBg.exe

C:\Windows\System\RXAiwBg.exe

C:\Windows\System\IulVlBd.exe

C:\Windows\System\IulVlBd.exe

C:\Windows\System\yvRrzpI.exe

C:\Windows\System\yvRrzpI.exe

C:\Windows\System\SiKVvke.exe

C:\Windows\System\SiKVvke.exe

C:\Windows\System\StifgOh.exe

C:\Windows\System\StifgOh.exe

C:\Windows\System\bhUJAbd.exe

C:\Windows\System\bhUJAbd.exe

C:\Windows\System\IFxujdQ.exe

C:\Windows\System\IFxujdQ.exe

C:\Windows\System\gxrcCFO.exe

C:\Windows\System\gxrcCFO.exe

C:\Windows\System\xmstFwQ.exe

C:\Windows\System\xmstFwQ.exe

C:\Windows\System\VlehZdU.exe

C:\Windows\System\VlehZdU.exe

C:\Windows\System\JGmslAk.exe

C:\Windows\System\JGmslAk.exe

C:\Windows\System\lefLxaZ.exe

C:\Windows\System\lefLxaZ.exe

C:\Windows\System\xZaVshW.exe

C:\Windows\System\xZaVshW.exe

C:\Windows\System\PtbTEvP.exe

C:\Windows\System\PtbTEvP.exe

C:\Windows\System\TTgzGsi.exe

C:\Windows\System\TTgzGsi.exe

C:\Windows\System\ExqotrB.exe

C:\Windows\System\ExqotrB.exe

C:\Windows\System\aSEervx.exe

C:\Windows\System\aSEervx.exe

C:\Windows\System\RXFAHyt.exe

C:\Windows\System\RXFAHyt.exe

C:\Windows\System\FiSRNgp.exe

C:\Windows\System\FiSRNgp.exe

C:\Windows\System\aDnJGqy.exe

C:\Windows\System\aDnJGqy.exe

C:\Windows\System\VJGwtCU.exe

C:\Windows\System\VJGwtCU.exe

C:\Windows\System\niJKchB.exe

C:\Windows\System\niJKchB.exe

C:\Windows\System\HUnPdkN.exe

C:\Windows\System\HUnPdkN.exe

C:\Windows\System\tpLbRRJ.exe

C:\Windows\System\tpLbRRJ.exe

C:\Windows\System\dXndxjX.exe

C:\Windows\System\dXndxjX.exe

C:\Windows\System\ECtueXx.exe

C:\Windows\System\ECtueXx.exe

C:\Windows\System\YEXHiRX.exe

C:\Windows\System\YEXHiRX.exe

C:\Windows\System\Zcohvmi.exe

C:\Windows\System\Zcohvmi.exe

C:\Windows\System\yGHKSED.exe

C:\Windows\System\yGHKSED.exe

C:\Windows\System\iyXTuwA.exe

C:\Windows\System\iyXTuwA.exe

C:\Windows\System\VJcwBlP.exe

C:\Windows\System\VJcwBlP.exe

C:\Windows\System\lILhrzK.exe

C:\Windows\System\lILhrzK.exe

C:\Windows\System\UEuMpxr.exe

C:\Windows\System\UEuMpxr.exe

C:\Windows\System\CznTfax.exe

C:\Windows\System\CznTfax.exe

C:\Windows\System\bYeWbNO.exe

C:\Windows\System\bYeWbNO.exe

C:\Windows\System\YKCjeOn.exe

C:\Windows\System\YKCjeOn.exe

C:\Windows\System\PtiOHOs.exe

C:\Windows\System\PtiOHOs.exe

C:\Windows\System\MphxWCr.exe

C:\Windows\System\MphxWCr.exe

C:\Windows\System\ckIzPMa.exe

C:\Windows\System\ckIzPMa.exe

C:\Windows\System\hnMQopd.exe

C:\Windows\System\hnMQopd.exe

C:\Windows\System\VUekCKD.exe

C:\Windows\System\VUekCKD.exe

C:\Windows\System\QcQDkeT.exe

C:\Windows\System\QcQDkeT.exe

C:\Windows\System\JFWpozs.exe

C:\Windows\System\JFWpozs.exe

C:\Windows\System\WwlHWxp.exe

C:\Windows\System\WwlHWxp.exe

C:\Windows\System\QJDInVX.exe

C:\Windows\System\QJDInVX.exe

C:\Windows\System\isWwgLq.exe

C:\Windows\System\isWwgLq.exe

C:\Windows\System\WcNTokG.exe

C:\Windows\System\WcNTokG.exe

C:\Windows\System\VWXEHGH.exe

C:\Windows\System\VWXEHGH.exe

C:\Windows\System\zZyOkzI.exe

C:\Windows\System\zZyOkzI.exe

C:\Windows\System\ETJzQNW.exe

C:\Windows\System\ETJzQNW.exe

C:\Windows\System\AcQrEvZ.exe

C:\Windows\System\AcQrEvZ.exe

C:\Windows\System\LPsvxQJ.exe

C:\Windows\System\LPsvxQJ.exe

C:\Windows\System\vZhMlKt.exe

C:\Windows\System\vZhMlKt.exe

C:\Windows\System\ZgUBuTg.exe

C:\Windows\System\ZgUBuTg.exe

C:\Windows\System\ceqHwDW.exe

C:\Windows\System\ceqHwDW.exe

C:\Windows\System\XXRutKm.exe

C:\Windows\System\XXRutKm.exe

C:\Windows\System\HNWybnb.exe

C:\Windows\System\HNWybnb.exe

C:\Windows\System\AEIZFYs.exe

C:\Windows\System\AEIZFYs.exe

C:\Windows\System\wERwkHg.exe

C:\Windows\System\wERwkHg.exe

C:\Windows\System\cfICAkk.exe

C:\Windows\System\cfICAkk.exe

C:\Windows\System\iWNKcJt.exe

C:\Windows\System\iWNKcJt.exe

C:\Windows\System\tUVjIRb.exe

C:\Windows\System\tUVjIRb.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp

Files

\Windows\system\frxoSEH.exe

MD5	973b9d4a9cbff3d75051fddd5a0755b9
SHA1	b46f017e6e3f5b55db047b152c659b83b7d1eda6
SHA256	c651e4c264c16323e5a6502cbb9cf004789619191065aa12b088f64bed502e8f
SHA512	0db298a2108ef939d26db44ddc6c2d41baa2f0daedf3deaedbc0918b11dd5652066cecb1b1aec3b82372b1b0bab46dcd9cd76219fde11535a1abd8a958347e0e

memory/856-8-0x000000013F140000-0x000000013F536000-memory.dmp

memory/2540-15-0x000007FEF5D1E000-0x000007FEF5D1F000-memory.dmp

C:\Windows\system\QgBdvqg.exe

MD5	1ac07d3ec5656cbe268847f26219e6c2
SHA1	85cfee051bf60bfe3e71df7d5fbe2b02212cc6ac
SHA256	ac9373e7f1fe1516648e8d9704c473ab643dceac1bd79cc503412410e8d45429
SHA512	7cc113ec5ca586f96fa98d106e00cc385d0b3562c32ea1a44d1cbf0892b17adce4876332b07c52785963db71417263975ea7a578e83ebed315c4a3b5736c35b4

\Windows\system\jYvZpTx.exe

MD5	ebf6c4f1ea75ab6077db2aa3555a411d
SHA1	5594378451a73ae58d3f6c7d0001fbb05fcdd688
SHA256	80e5cf08c0e9cd5f246c1b8837313bc1812e2ddb8e7ec14729160edcdd33a171
SHA512	c1ed24be6a737374b7fa5accc96f7b833d8ec090314f2c83df16031bd46736467a2e86c9933cdadfd4538723f0874d545d66a70da37660de1b22a3f18fc6de46

C:\Windows\system\pQwxTyH.exe

MD5	324fa94b6e7989ad997b4b1937c99060
SHA1	01cd9b9a7463ae62760730eb38ee94240134ada2
SHA256	ab4d9801b884bc02ea401e726f31491af6dbf0bed23d64a0354c4ab966691834
SHA512	fba306e417887414b9c888040cde46a5fa0ac4662824d3a1cb471bb7c7e00f5672963954db89af1abab8d65f66b38159b2bf2b156f14d0b71d1fb7a6ee17e8d9

C:\Windows\system\dGAabVk.exe

MD5	4f7bdf6edebda683cc43e8c4b4987765
SHA1	933c9987d88d871544ea0b77a8786c8219fae64b
SHA256	7a53d27b7f13f3c08f27ad67e0f9c20565f4eab0b59200008231e7a893e25b9e
SHA512	c98d149ef2c4bb596d1f9aa2bbefb4181550fa1cbccdc9c1646d406b4504376c45a9b84a504a23407fb09f5e9c4a1521650dc07ada1e2a66e8c70a6c2b691ae3

C:\Windows\system\TYznzlq.exe

MD5	863e9aa27e33496d18ad80e2ede652a0
SHA1	dacd7015654d021eeb530f2c6b8b154165274d66
SHA256	f093c1944ac032717417cd40de21c225d8f11fce42fef8774c233e192af9e2e8
SHA512	17abfb7d6360680842f80ae35a6edf24c012242b8f9863ab2571fe70c4db27ee67dde612aa59a72cd7c4d193b017204a50d229b445bbe89c63aa270b901ec677

C:\Windows\system\LrdVikl.exe

MD5	0558a63688ab2ef5853737660a5cdc2b
SHA1	efe5105c507f1c0dc01047661c8c7d3588d92d09
SHA256	1eb506a86c1540778e7e9f5bf5baeb20c6c94f2186cb0c4d19ec7f8fdbd32ce4
SHA512	c6847a032a8faae04cd1b1accdd8599b202926bbae3df7fcfeaf4d92c98f17849c6dfd4e222e78284ed1eba82e3c67e1e05d24cb47d58662e3d342fc3d863318

C:\Windows\system\uFlKVLo.exe

MD5	5ccb35f1bb9d3f572c7f440e04962bd4
SHA1	39357346f323ad5ca97bf7331539b15f9cf46657
SHA256	b8b1d5d5d866672873b3caddad0c02682c0526e7bff25865bba824e77121f680
SHA512	9fc95548b5459c17e9f99f20e068da942f068108b1c05e08c460b90495510c22b062616f254bc664f21d73e4acfa5a100faca3b233fc5ca4196a5b1d8ca3b820

C:\Windows\system\QfnWjDM.exe

MD5	66583fefb4615e1ff9ac0eab9c846085
SHA1	b49a5d2f389ac92dbe3efb74b700a2c5bf7684e5
SHA256	8d9366b10f1477cdbaf3c93e70067fa6ca0183f54c74891c4e6a8cb98e1c8696
SHA512	eab53e4f2ffecaec8d71e0cc06e6955d1ae0a5462decaf20124b96fbb928dc1f6d38ce86398a60c7d5631da0db2d0b87cae7bc39d3296f90703f4fcbe4d69efd

C:\Windows\system\NacezXB.exe

MD5	de5552bd038b1dd3e7f700deba726776
SHA1	4a97a43775c3592beb64d6e833dc14d0f0670d90
SHA256	b3bd6fdf64c2a79a842cca492d8080e05a6d5e17fc0fefe920857c726f6239fc
SHA512	c24f25302692402fa3ab941e753b57fe1fa6749af50bd639cf889a704db109192d74e13e50cd16fbbc1ecfe5839814e0d350426614c25d7dbd8683dcc6b4e594

C:\Windows\system\UZbGylY.exe

MD5	dc00839ee4a9ad0c408de649d0cfb62a
SHA1	5a62baab852946e1fc5d68d78a08a718b7ccb799
SHA256	16bcebc28b27bb859cc5fc3e1660d3a5454bf7e73b562fad17c55e0aefeee9dd
SHA512	9841f625f7a8ffb6d08711d26d539c8e044a07ca429f911430074a2a016d6a50ae46532b505dec3856ac9779d95eacc924b85fa0fc667d71f3debfa5ef5d7348

\Windows\system\hAHMgeI.exe

MD5	99b1b468db214621c5adb5523ce1cf0b
SHA1	7f91a66842f141db674ca2d1df84ded40cf3cc02
SHA256	c8b2f81fdaad32546e14956d8220a96bef3ba73dc99eb192f2b79101ebda1c08
SHA512	dfc61067ef49a56e3eeab0972a273be1f1f4b7b9ff4fceefc92f3493691d051e4c697170f937e7f257269debff8649b1b4a2a4a241d3a0500523da73ec50757c

memory/2740-146-0x000000013F0B0000-0x000000013F4A6000-memory.dmp

memory/2484-160-0x000000013FFC0000-0x00000001403B6000-memory.dmp

C:\Windows\system\IGyBBWL.exe

MD5	134124a41eb1056345b14e26f8c03130
SHA1	3b762eae67ecd0cab2034360af09054291d20078
SHA256	3b935c5bbfe8e13822c0f98de141a5500addbba7d847027670a4842d07161714
SHA512	19b900f316e45719fa143fe3ba83af4a0d55ff341e04cc21922736a916c3b807ee547b789b82b3f4019102ce077681ca434db3d08366974cbd90b6944e6364cf

memory/2900-189-0x000000013F610000-0x000000013FA06000-memory.dmp

memory/856-193-0x00000000031E0000-0x00000000035D6000-memory.dmp

memory/2540-1118-0x0000000001F80000-0x0000000001F88000-memory.dmp

memory/2540-685-0x000000001B620000-0x000000001B902000-memory.dmp

memory/856-182-0x00000000031E0000-0x00000000035D6000-memory.dmp

memory/2472-181-0x000000013F100000-0x000000013F4F6000-memory.dmp

C:\Windows\system\nROhFDN.exe

MD5	5b81e767819ac657bd2ad74212f9ed4d
SHA1	2402da6c2d609224ac59dad92da517e4cce341b2
SHA256	43d9b75b2e2287e7fd1d4f851b82e667214e58a167083c503f4fff0376a07a79
SHA512	57498d56f5a52b0f99184663e38507de906c4b9d0df0eed1c373e051a4e5857135e575fcddedde0824fb1160403d05d5e1374f8762afa23897298c935a585bca

C:\Windows\system\ItJhilz.exe

MD5	d18046806d3baf4d3d55f06c017388a7
SHA1	b0628112b7d99683810be9f5b8c86899c945065c
SHA256	fb9374960fc49412fc2dec86c7d177c4e21fdfb0b30499c16ffa09767d46e6a7
SHA512	5ad24b4ef27c2ddce74504eb5a6dabe7b0701a0ba58ed477359303aed837023664f9bfd70585023654141a6b46ac97f49f9ef935ff6ff0128051df69d7788e0a

C:\Windows\system\CNlqOVv.exe

MD5	87e1fa04e2430eae50c705a7ac984909
SHA1	9e0bad7c54173310b498d3f32b5f4ec36ffc90d0
SHA256	3e5dfafbe39aa1e4c0a296c543fb799d953b568dfe7aababff9a2dd7ba9bc93f
SHA512	6c569116c2d707eff92a778ea1e480db014fd6a03af1ef149a77d6d5c4cf3f316c62e83aaa48c115bfb7cff2d3317498ab80dca451fc99a8a1bc67ed4696ac31

C:\Windows\system\SEyVndj.exe

MD5	c2e069fcab36408c69bee828758750bd
SHA1	2c192673b22786481c23962a6bd5648284e61b10
SHA256	bd039837d45b4c8f4e0dd39fa2f8947c6136607a47f9ec604bf1fcbfdf4c189b
SHA512	e055b14578391eb442d3c1c270f606c8875096f824b134bbbd9e7dd15cf95707dd66ae6d3543b71a29097bc37a419b534648736470f5d5f5d16b5a0365e308f0

memory/856-168-0x000000013F100000-0x000000013F4F6000-memory.dmp

memory/2504-167-0x000000013F3E0000-0x000000013F7D6000-memory.dmp

memory/856-166-0x000000013F3E0000-0x000000013F7D6000-memory.dmp

memory/2592-165-0x000000013F810000-0x000000013FC06000-memory.dmp

memory/856-164-0x00000000031E0000-0x00000000035D6000-memory.dmp

\Windows\system\VLcZFfY.exe

MD5	3e283587f49d7574344f55a308dc0ee3
SHA1	907313e6290ba974578e5848df07dfda2bca6956
SHA256	7246d4544b7a2bbec4200c9d80e25e62e3125e5cf028ff056ccd05897de763dc
SHA512	3844376b7db04f7b30b857bf313e0c77ca00baedf2f4c9d7c4f250e891b89aa11d785dc8eb8feb5e62051d2e7b95746eeb43e8740085ec38eb511cb3b9bdb8ab

memory/2808-154-0x000000013F710000-0x000000013FB06000-memory.dmp

\Windows\system\kNEGlLL.exe

MD5	180f2b376290e37147fa5afd5e444ff8
SHA1	984cf8d8964c715021bf2b9de1c54737a14b5638
SHA256	d78f3aee921a1635f2a806a7efe36c0eb50658821de03a60018bc9b91a009c77
SHA512	87f728f518666e003c77b17f5c9f57850fc9a57d1fee654a072e215de3ad8a6a23bf310d52d306a726b908eb23ced5171b02bca9c6a5b5fcd0d75edadf2e10e4

memory/856-136-0x000000013F0B0000-0x000000013F4A6000-memory.dmp

memory/2612-129-0x000000013F750000-0x000000013FB46000-memory.dmp

memory/856-126-0x00000000031E0000-0x00000000035D6000-memory.dmp

C:\Windows\system\bsnKHiP.exe

MD5	e1c3d3e9030ed458e903e42b809fbdd9
SHA1	2a201e3b855b160e4c5d241e62636912d3edc603
SHA256	3f9837ac70a74d2260e65b09e983c94e51fe42cf53c4b60d92ca4cdbe5252a3a
SHA512	f826748cf58ea973ce9a2be4c37753ebb709a129a55f98d2286afedbd49933d5cfa3238a0c98a6ebec98602906f25e62241c99828944fcae547048cc42e71c7f

memory/2684-124-0x000000013F6A0000-0x000000013FA96000-memory.dmp

memory/2540-116-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

memory/292-192-0x000000013FA70000-0x000000013FE66000-memory.dmp

memory/856-190-0x00000000031E0000-0x00000000035D6000-memory.dmp

C:\Windows\system\CDWpUQN.exe

MD5	de076beac3edafcc17544f59135f6865
SHA1	7d6eecbbcf6c3c5bb918cc295596731f76d81c78
SHA256	a76ead051ca71d62a38975452b80dbaaa9ae94428ef3a6263850ccaa5e6e03a3
SHA512	de7c7eecd507cbb47670136f3d294b1ae87d6e9057c1b223028a14e0bfd400982677c11c97ee746044ed845e89303fff0fc51d1c37609d9d1b90b5b762c55293

memory/856-185-0x00000000031E0000-0x00000000035D6000-memory.dmp

memory/2576-184-0x000000013F930000-0x000000013FD26000-memory.dmp

C:\Windows\system\GhrFLSz.exe

MD5	2f60a97501027a3df0b2d7447fbe4ab2
SHA1	899b27e535c4863a00ae6808862f01b849f3564f
SHA256	3713ee780db847a76195b5d9621a83716fcd22ad3e143ccc7abf86fb1a539d04
SHA512	2519e1d93bf5013104cdb1732145da2ed870c402e094aaa650d52c656e762e04b744445e9c46505356205e4674524f87d7c58858dae69d1ded0ac53e86e1b060

memory/856-158-0x000000013FFC0000-0x00000001403B6000-memory.dmp

C:\Windows\system\wHjAbKq.exe

MD5	425a26589fae569694141b748e114c62
SHA1	96621257c69e5caefdb904d7f6a9564900ec6446
SHA256	1889451357ba7ef5dc79db70a81f3e9b5a6a92102f8a4505899d55276a0c6eff
SHA512	a56466853fd7ba12202afaee984dda33d36c6db7100cee05c004a069feee0cb304306b6f832fa46595056bc8b95a14f30bd84842a7fc39e03b1a77592564854a

memory/856-147-0x00000000031E0000-0x00000000035D6000-memory.dmp

C:\Windows\system\hhbfbBh.exe

MD5	09a8e606c48bae315f8313e22f6f61c7
SHA1	08cbb4dda0063eb3f8811c2c2945bf4c4095c83f
SHA256	3b7489fd9bfb469b957a3bb5880aba8e2428d08c232387122f382e9b985a80c7
SHA512	814894e28f25bf0ff4cc15b23955e53dd28c2af6c0580ce63a175f21b3990356e128b8b397306d661b5e2e46e3681f987677457a440653a8b33d83c3fff6a4b1

C:\Windows\system\eIXcQsy.exe

MD5	58a18ffc94490e7465ae2a9aa5423891
SHA1	5442d0ac639c25479ae77e0cfed1c9fd7cd016be
SHA256	a6228054a043fd315f855c8fce8855439f1b59b692f23c34b96b67c5af3ae070
SHA512	6eca0c86d45eac4766227697d5d216c83463f2b54329442f9e444e45563fb37958f10540596047ae67b545d10a986bd60e90d8e0cf5026f58e9859c7dcdab3d3

C:\Windows\system\AMfXrnU.exe

MD5	a80e24e8b205efd8c1da731208f86f82
SHA1	b878b2fdef7e19cdc9cddbd6fdb4078bc92171a8
SHA256	e19c62b119b63664990d76dcd1d623f77ccc6f2fcd683d1c37627eb0c27309c5
SHA512	d5ec30f54424210d401bbcad00b1c863259a6b000751af9e1f0604d1c82570cf0fb4667fc00eb00d09a26af18b5323589f2238d7a624dc15fd5f305e963c50d4

C:\Windows\system\SElGscP.exe

MD5	d08733f9f807f01eab57499871894ddf
SHA1	0ae79ba5a950af572d657c12602daff8d486ff14
SHA256	fc97e6ec2b62562f75520bb83daa2773d7fd625adba49f14a1f2aa05adab8fbe
SHA512	24806b938b1b2447955a4e442e3082f1cdadeb703ed860f838386930442318f2f6097154ef9fe6d620ee3a5a28b777a0746ad1b5cc6dad4a49f0b967c2aeb60e

C:\Windows\system\yNAStIA.exe

MD5	e1f4fdf6e3f4948f9abfb554d54dd0ef
SHA1	a60fa3a8fcc996cee8e30854e744712541c44faf
SHA256	e124592523f6ce22a2f3cf298808ffc14f1714b0ed1be2051e1e468d3a209ee4
SHA512	2f2f0807be45833f7b0e8383093cfb038d69fefa86d3540f53179687285e21a859c89cac45e564355976e488f6c743f026721acb2331d1341dfbbde88eee89ea

C:\Windows\system\wkyMohY.exe

MD5	e1dc8b9db721ebea5002701fd261fcac
SHA1	393b79df4c15c27f052f40a3fc789a3e507f6142
SHA256	af668be67cad3b31896dffc8d8353387d76fd2e5b55d14ec6d44062568bc7a6a
SHA512	10db271a7794c2acd840bb4d58f0a9b660ee4869118fb6500e7d160be6cd0881aa753de675dd3add5ffbaca719b1fb3438de0bb513eae2e8e0303677bf6e9637

C:\Windows\system\wZfxohE.exe

MD5	afb9282383a19002ec0c4ae2e284839d
SHA1	66f0f6030501b8016ec3600e53a50961853a1d41
SHA256	0ebdc3388ec87f38aa0177f3630f19683415a1a1e067c15aefc84b82a364ee1d
SHA512	692c034f0ab048187e88e18fb70c4fe446f1f13ff20845ff00f78189143125bb92b1e68cc5f0d7d4a0c7d36d7760a9978b4f11a54039c5f9527ddf5417c7f301

C:\Windows\system\ARUVLaF.exe

MD5	5702d54b516d7039ea08bfb7367a5c40
SHA1	d1dabbf8cfb8277670b1bbfed65ef92c4b63fe2d
SHA256	d4e0f4f85ced60860841bbf625bd284cde04ab8dcd186b42b4518c6133f329ac
SHA512	6294eb7d38c64aefa0f40ea7e7a35d26b7d7467c158756eff5dc22e2dc28029c6cb81014103338a2b564fa063c70f85842c216b572de69e4ac76574ea853fe76

C:\Windows\system\oEcVLJE.exe

MD5	47874c1410527a779681306b93ebe648
SHA1	fa1548ba91f3fcc6a420319fb1ca0818e85d745c
SHA256	806a7833ed98869285d60fbb3c49334bc514643b281e381cea9017c04bdc341f
SHA512	d186f0fa4bc0b53d0f0f0d8df65c18de903d376765faeb9f9e5b867d3be5287e1352c46617ae63208848869f94d7e340fef9571128ebf0b04f1d75b2511167f9

C:\Windows\system\eJyWlyb.exe

MD5	9979d88be407aeec8e8e895dfcc92a01
SHA1	384c07929f3d51ec66a7298768b09f6910b66e1d
SHA256	a0c8f42197fd950653c7c1e2f6683c1e551e7325dc73f1636fa6f963d9fc7e3c
SHA512	3a0c15919d60791fd4cab065c3712d863288e9ab4c73ed6dc64f52868a1ff7256762895f5ff11e6d9a4529ce462ea151482818d93f219c33812df1632cd45457

memory/2540-14-0x0000000002D10000-0x0000000002D90000-memory.dmp

memory/2112-13-0x000000013F140000-0x000000013F536000-memory.dmp

memory/856-1-0x000000013FA00000-0x000000013FDF6000-memory.dmp

memory/856-0-0x00000000000F0000-0x0000000000100000-memory.dmp

memory/2540-2786-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

memory/856-3532-0x000000013FA00000-0x000000013FDF6000-memory.dmp

memory/856-3839-0x00000000031E0000-0x00000000035D6000-memory.dmp

memory/2740-6406-0x000000013F0B0000-0x000000013F4A6000-memory.dmp

memory/2504-6413-0x000000013F3E0000-0x000000013F7D6000-memory.dmp

memory/2576-6415-0x000000013F930000-0x000000013FD26000-memory.dmp

memory/2472-6414-0x000000013F100000-0x000000013F4F6000-memory.dmp

memory/2484-6412-0x000000013FFC0000-0x00000001403B6000-memory.dmp

memory/2900-6423-0x000000013F610000-0x000000013FA06000-memory.dmp

memory/292-6422-0x000000013FA70000-0x000000013FE66000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 21:48

Reported

2024-06-13 21:51

Platform

win10v2004-20240226-en

Max time kernel

153s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Blocklisted process makes network request

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\LhypVWS.exe	N/A
N/A	N/A	C:\Windows\System\WmXPKQn.exe	N/A
N/A	N/A	C:\Windows\System\MEcvQLW.exe	N/A
N/A	N/A	C:\Windows\System\ImUfHfE.exe	N/A
N/A	N/A	C:\Windows\System\OMAxBBK.exe	N/A
N/A	N/A	C:\Windows\System\GIFhqcs.exe	N/A
N/A	N/A	C:\Windows\System\srczSVb.exe	N/A
N/A	N/A	C:\Windows\System\tRLTlKz.exe	N/A
N/A	N/A	C:\Windows\System\XaQqDBs.exe	N/A
N/A	N/A	C:\Windows\System\CIjrHjl.exe	N/A
N/A	N/A	C:\Windows\System\jLyPxbI.exe	N/A
N/A	N/A	C:\Windows\System\UYCaLPn.exe	N/A
N/A	N/A	C:\Windows\System\OyBbGZx.exe	N/A
N/A	N/A	C:\Windows\System\cYQyQuI.exe	N/A
N/A	N/A	C:\Windows\System\WFvBpgU.exe	N/A
N/A	N/A	C:\Windows\System\QhUfLId.exe	N/A
N/A	N/A	C:\Windows\System\lLVWHfp.exe	N/A
N/A	N/A	C:\Windows\System\UgURamg.exe	N/A
N/A	N/A	C:\Windows\System\sENfjPK.exe	N/A
N/A	N/A	C:\Windows\System\kGLNWtr.exe	N/A
N/A	N/A	C:\Windows\System\rTenzjm.exe	N/A
N/A	N/A	C:\Windows\System\tWybpcS.exe	N/A
N/A	N/A	C:\Windows\System\cuElRPw.exe	N/A
N/A	N/A	C:\Windows\System\ImbLuCI.exe	N/A
N/A	N/A	C:\Windows\System\hLqEvWX.exe	N/A
N/A	N/A	C:\Windows\System\xjMcygh.exe	N/A
N/A	N/A	C:\Windows\System\XUtvdMS.exe	N/A
N/A	N/A	C:\Windows\System\JBmESVo.exe	N/A
N/A	N/A	C:\Windows\System\LEesgnW.exe	N/A
N/A	N/A	C:\Windows\System\VyYLlyM.exe	N/A
N/A	N/A	C:\Windows\System\bMarfHM.exe	N/A
N/A	N/A	C:\Windows\System\PCjSYyb.exe	N/A
N/A	N/A	C:\Windows\System\PGzReGl.exe	N/A
N/A	N/A	C:\Windows\System\pRymjlD.exe	N/A
N/A	N/A	C:\Windows\System\XxdVrak.exe	N/A
N/A	N/A	C:\Windows\System\jBZcLDw.exe	N/A
N/A	N/A	C:\Windows\System\omeQXPs.exe	N/A
N/A	N/A	C:\Windows\System\cbutewD.exe	N/A
N/A	N/A	C:\Windows\System\oZKXViU.exe	N/A
N/A	N/A	C:\Windows\System\IodNKjt.exe	N/A
N/A	N/A	C:\Windows\System\XnxcyPT.exe	N/A
N/A	N/A	C:\Windows\System\SmSIhIN.exe	N/A
N/A	N/A	C:\Windows\System\QZsXLIt.exe	N/A
N/A	N/A	C:\Windows\System\gxCJeAd.exe	N/A
N/A	N/A	C:\Windows\System\RpfZkZb.exe	N/A
N/A	N/A	C:\Windows\System\CWphheu.exe	N/A
N/A	N/A	C:\Windows\System\AMMloiT.exe	N/A
N/A	N/A	C:\Windows\System\iuOMTsv.exe	N/A
N/A	N/A	C:\Windows\System\ZDpXYsR.exe	N/A
N/A	N/A	C:\Windows\System\KUgaVPu.exe	N/A
N/A	N/A	C:\Windows\System\DgfELnb.exe	N/A
N/A	N/A	C:\Windows\System\hAIZzrx.exe	N/A
N/A	N/A	C:\Windows\System\czsiXhZ.exe	N/A
N/A	N/A	C:\Windows\System\YtikUui.exe	N/A
N/A	N/A	C:\Windows\System\VtbBUUX.exe	N/A
N/A	N/A	C:\Windows\System\GPPryrc.exe	N/A
N/A	N/A	C:\Windows\System\YbuwAmJ.exe	N/A
N/A	N/A	C:\Windows\System\HfVPVdh.exe	N/A
N/A	N/A	C:\Windows\System\CHHavNb.exe	N/A
N/A	N/A	C:\Windows\System\ApYZyox.exe	N/A
N/A	N/A	C:\Windows\System\uUtjhuX.exe	N/A
N/A	N/A	C:\Windows\System\EkxyOzf.exe	N/A
N/A	N/A	C:\Windows\System\mmuRVKD.exe	N/A
N/A	N/A	C:\Windows\System\kCpnLmu.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	raw.githubusercontent.com	N/A	N/A
N/A	raw.githubusercontent.com	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\sLpkQOw.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iDAoVrW.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PNJmAsp.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\blhcZmY.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wgxutoI.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FUzcnBz.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ylsFxNm.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BbYSQBf.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nCMgEEU.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KtsrRcg.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CQzXmcD.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gxsFUtt.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uqFQTfh.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MzxzuYQ.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YRGqkqZ.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GPPryrc.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yfzeXgJ.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xssMwvM.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UZWuxjZ.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AegdfRj.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RKQihtC.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LSZylzl.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wsmdIeO.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QaqDfDw.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KUgaVPu.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DzPhEBv.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cGxlfoq.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PYgbAlE.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cuElRPw.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DBOGqBn.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cJVEmji.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MIOnOGz.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wymlEYZ.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bmryXxK.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZLHiHVw.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZHFpVLI.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tXYShKc.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Nwnrivj.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\weAjPFr.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bncFZer.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mdtiCGi.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WVPeuKX.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RbOtMnM.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hSNBrwT.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XlOBzkY.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CEVnOKq.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gWLmKXJ.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DVVFnGf.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OAmbrtk.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bKKffFM.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EJpFBRC.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MLJzLcZ.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JPJktQl.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mjWfXAs.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\URXQqJw.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GUzOcGf.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JCiHaQM.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FMPmCuH.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AhGFKyV.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gPZAnpo.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SydUcZW.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZQOXmSz.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\skzwMXO.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ieInPxe.exe	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4292 wrote to memory of 4104	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4292 wrote to memory of 4104	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4292 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\LhypVWS.exe
PID 4292 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\LhypVWS.exe
PID 4292 wrote to memory of 3604	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\WmXPKQn.exe
PID 4292 wrote to memory of 3604	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\WmXPKQn.exe
PID 4292 wrote to memory of 208	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\MEcvQLW.exe
PID 4292 wrote to memory of 208	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\MEcvQLW.exe
PID 4292 wrote to memory of 2320	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\ImUfHfE.exe
PID 4292 wrote to memory of 2320	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\ImUfHfE.exe
PID 4292 wrote to memory of 4860	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\OMAxBBK.exe
PID 4292 wrote to memory of 4860	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\OMAxBBK.exe
PID 4292 wrote to memory of 4252	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\GIFhqcs.exe
PID 4292 wrote to memory of 4252	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\GIFhqcs.exe
PID 4292 wrote to memory of 5036	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\srczSVb.exe
PID 4292 wrote to memory of 5036	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\srczSVb.exe
PID 4292 wrote to memory of 560	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\tRLTlKz.exe
PID 4292 wrote to memory of 560	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\tRLTlKz.exe
PID 4292 wrote to memory of 2004	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\XaQqDBs.exe
PID 4292 wrote to memory of 2004	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\XaQqDBs.exe
PID 4292 wrote to memory of 1192	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\CIjrHjl.exe
PID 4292 wrote to memory of 1192	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\CIjrHjl.exe
PID 4292 wrote to memory of 1816	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\jLyPxbI.exe
PID 4292 wrote to memory of 1816	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\jLyPxbI.exe
PID 4292 wrote to memory of 3624	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\UYCaLPn.exe
PID 4292 wrote to memory of 3624	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\UYCaLPn.exe
PID 4292 wrote to memory of 1964	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\OyBbGZx.exe
PID 4292 wrote to memory of 1964	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\OyBbGZx.exe
PID 4292 wrote to memory of 4068	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\cYQyQuI.exe
PID 4292 wrote to memory of 4068	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\cYQyQuI.exe
PID 4292 wrote to memory of 4332	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\WFvBpgU.exe
PID 4292 wrote to memory of 4332	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\WFvBpgU.exe
PID 4292 wrote to memory of 3608	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\QhUfLId.exe
PID 4292 wrote to memory of 3608	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\QhUfLId.exe
PID 4292 wrote to memory of 1560	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\lLVWHfp.exe
PID 4292 wrote to memory of 1560	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\lLVWHfp.exe
PID 4292 wrote to memory of 1120	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\UgURamg.exe
PID 4292 wrote to memory of 1120	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\UgURamg.exe
PID 4292 wrote to memory of 1860	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\sENfjPK.exe
PID 4292 wrote to memory of 1860	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\sENfjPK.exe
PID 4292 wrote to memory of 1772	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\kGLNWtr.exe
PID 4292 wrote to memory of 1772	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\kGLNWtr.exe
PID 4292 wrote to memory of 4300	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\rTenzjm.exe
PID 4292 wrote to memory of 4300	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\rTenzjm.exe
PID 4292 wrote to memory of 2800	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\tWybpcS.exe
PID 4292 wrote to memory of 2800	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\tWybpcS.exe
PID 4292 wrote to memory of 4356	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\cuElRPw.exe
PID 4292 wrote to memory of 4356	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\cuElRPw.exe
PID 4292 wrote to memory of 2248	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\ImbLuCI.exe
PID 4292 wrote to memory of 2248	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\ImbLuCI.exe
PID 4292 wrote to memory of 2964	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\hLqEvWX.exe
PID 4292 wrote to memory of 2964	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\hLqEvWX.exe
PID 4292 wrote to memory of 2300	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\xjMcygh.exe
PID 4292 wrote to memory of 2300	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\xjMcygh.exe
PID 4292 wrote to memory of 1968	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\XUtvdMS.exe
PID 4292 wrote to memory of 1968	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\XUtvdMS.exe
PID 4292 wrote to memory of 2364	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\JBmESVo.exe
PID 4292 wrote to memory of 2364	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\JBmESVo.exe
PID 4292 wrote to memory of 3584	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\LEesgnW.exe
PID 4292 wrote to memory of 3584	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\LEesgnW.exe
PID 4292 wrote to memory of 3376	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\VyYLlyM.exe
PID 4292 wrote to memory of 3376	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\VyYLlyM.exe
PID 4292 wrote to memory of 3528	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\bMarfHM.exe
PID 4292 wrote to memory of 3528	N/A	C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe	C:\Windows\System\bMarfHM.exe

Processes

C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\LhypVWS.exe

C:\Windows\System\LhypVWS.exe

C:\Windows\System\WmXPKQn.exe

C:\Windows\System\WmXPKQn.exe

C:\Windows\System\MEcvQLW.exe

C:\Windows\System\MEcvQLW.exe

C:\Windows\System\ImUfHfE.exe

C:\Windows\System\ImUfHfE.exe

C:\Windows\System\OMAxBBK.exe

C:\Windows\System\OMAxBBK.exe

C:\Windows\System\GIFhqcs.exe

C:\Windows\System\GIFhqcs.exe

C:\Windows\System\srczSVb.exe

C:\Windows\System\srczSVb.exe

C:\Windows\System\tRLTlKz.exe

C:\Windows\System\tRLTlKz.exe

C:\Windows\System\XaQqDBs.exe

C:\Windows\System\XaQqDBs.exe

C:\Windows\System\CIjrHjl.exe

C:\Windows\System\CIjrHjl.exe

C:\Windows\System\jLyPxbI.exe

C:\Windows\System\jLyPxbI.exe

C:\Windows\System\UYCaLPn.exe

C:\Windows\System\UYCaLPn.exe

C:\Windows\System\OyBbGZx.exe

C:\Windows\System\OyBbGZx.exe

C:\Windows\System\cYQyQuI.exe

C:\Windows\System\cYQyQuI.exe

C:\Windows\System\WFvBpgU.exe

C:\Windows\System\WFvBpgU.exe

C:\Windows\System\QhUfLId.exe

C:\Windows\System\QhUfLId.exe

C:\Windows\System\lLVWHfp.exe

C:\Windows\System\lLVWHfp.exe

C:\Windows\System\UgURamg.exe

C:\Windows\System\UgURamg.exe

C:\Windows\System\sENfjPK.exe

C:\Windows\System\sENfjPK.exe

C:\Windows\System\kGLNWtr.exe

C:\Windows\System\kGLNWtr.exe

C:\Windows\System\rTenzjm.exe

C:\Windows\System\rTenzjm.exe

C:\Windows\System\tWybpcS.exe

C:\Windows\System\tWybpcS.exe

C:\Windows\System\cuElRPw.exe

C:\Windows\System\cuElRPw.exe

C:\Windows\System\ImbLuCI.exe

C:\Windows\System\ImbLuCI.exe

C:\Windows\System\hLqEvWX.exe

C:\Windows\System\hLqEvWX.exe

C:\Windows\System\xjMcygh.exe

C:\Windows\System\xjMcygh.exe

C:\Windows\System\XUtvdMS.exe

C:\Windows\System\XUtvdMS.exe

C:\Windows\System\JBmESVo.exe

C:\Windows\System\JBmESVo.exe

C:\Windows\System\LEesgnW.exe

C:\Windows\System\LEesgnW.exe

C:\Windows\System\VyYLlyM.exe

C:\Windows\System\VyYLlyM.exe

C:\Windows\System\bMarfHM.exe

C:\Windows\System\bMarfHM.exe

C:\Windows\System\PCjSYyb.exe

C:\Windows\System\PCjSYyb.exe

C:\Windows\System\PGzReGl.exe

C:\Windows\System\PGzReGl.exe

C:\Windows\System\pRymjlD.exe

C:\Windows\System\pRymjlD.exe

C:\Windows\System\XxdVrak.exe

C:\Windows\System\XxdVrak.exe

C:\Windows\System\jBZcLDw.exe

C:\Windows\System\jBZcLDw.exe

C:\Windows\System\omeQXPs.exe

C:\Windows\System\omeQXPs.exe

C:\Windows\System\cbutewD.exe

C:\Windows\System\cbutewD.exe

C:\Windows\System\oZKXViU.exe

C:\Windows\System\oZKXViU.exe

C:\Windows\System\IodNKjt.exe

C:\Windows\System\IodNKjt.exe

C:\Windows\System\XnxcyPT.exe

C:\Windows\System\XnxcyPT.exe

C:\Windows\System\SmSIhIN.exe

C:\Windows\System\SmSIhIN.exe

C:\Windows\System\QZsXLIt.exe

C:\Windows\System\QZsXLIt.exe

C:\Windows\System\gxCJeAd.exe

C:\Windows\System\gxCJeAd.exe

C:\Windows\System\RpfZkZb.exe

C:\Windows\System\RpfZkZb.exe

C:\Windows\System\CWphheu.exe

C:\Windows\System\CWphheu.exe

C:\Windows\System\AMMloiT.exe

C:\Windows\System\AMMloiT.exe

C:\Windows\System\iuOMTsv.exe

C:\Windows\System\iuOMTsv.exe

C:\Windows\System\ZDpXYsR.exe

C:\Windows\System\ZDpXYsR.exe

C:\Windows\System\KUgaVPu.exe

C:\Windows\System\KUgaVPu.exe

C:\Windows\System\DgfELnb.exe

C:\Windows\System\DgfELnb.exe

C:\Windows\System\hAIZzrx.exe

C:\Windows\System\hAIZzrx.exe

C:\Windows\System\czsiXhZ.exe

C:\Windows\System\czsiXhZ.exe

C:\Windows\System\YtikUui.exe

C:\Windows\System\YtikUui.exe

C:\Windows\System\VtbBUUX.exe

C:\Windows\System\VtbBUUX.exe

C:\Windows\System\GPPryrc.exe

C:\Windows\System\GPPryrc.exe

C:\Windows\System\YbuwAmJ.exe

C:\Windows\System\YbuwAmJ.exe

C:\Windows\System\HfVPVdh.exe

C:\Windows\System\HfVPVdh.exe

C:\Windows\System\CHHavNb.exe

C:\Windows\System\CHHavNb.exe

C:\Windows\System\ApYZyox.exe

C:\Windows\System\ApYZyox.exe

C:\Windows\System\uUtjhuX.exe

C:\Windows\System\uUtjhuX.exe

C:\Windows\System\EkxyOzf.exe

C:\Windows\System\EkxyOzf.exe

C:\Windows\System\mmuRVKD.exe

C:\Windows\System\mmuRVKD.exe

C:\Windows\System\kCpnLmu.exe

C:\Windows\System\kCpnLmu.exe

C:\Windows\System\oxvAPBu.exe

C:\Windows\System\oxvAPBu.exe

C:\Windows\System\ojQSmGM.exe

C:\Windows\System\ojQSmGM.exe

C:\Windows\System\GabUhZj.exe

C:\Windows\System\GabUhZj.exe

C:\Windows\System\MqdBUXr.exe

C:\Windows\System\MqdBUXr.exe

C:\Windows\System\lZCfrTp.exe

C:\Windows\System\lZCfrTp.exe

C:\Windows\System\IuigKwx.exe

C:\Windows\System\IuigKwx.exe

C:\Windows\System\gdwqfKf.exe

C:\Windows\System\gdwqfKf.exe

C:\Windows\System\lhZyUKb.exe

C:\Windows\System\lhZyUKb.exe

C:\Windows\System\lXEHyuV.exe

C:\Windows\System\lXEHyuV.exe

C:\Windows\System\IwYPfOH.exe

C:\Windows\System\IwYPfOH.exe

C:\Windows\System\gRkPeEq.exe

C:\Windows\System\gRkPeEq.exe

C:\Windows\System\xDoXLvB.exe

C:\Windows\System\xDoXLvB.exe

C:\Windows\System\EmMvqBv.exe

C:\Windows\System\EmMvqBv.exe

C:\Windows\System\HqWFTHb.exe

C:\Windows\System\HqWFTHb.exe

C:\Windows\System\qJrDVtq.exe

C:\Windows\System\qJrDVtq.exe

C:\Windows\System\WfvHHgj.exe

C:\Windows\System\WfvHHgj.exe

C:\Windows\System\JrPaLad.exe

C:\Windows\System\JrPaLad.exe

C:\Windows\System\uxBVeND.exe

C:\Windows\System\uxBVeND.exe

C:\Windows\System\tcevDML.exe

C:\Windows\System\tcevDML.exe

C:\Windows\System\Nwnrivj.exe

C:\Windows\System\Nwnrivj.exe

C:\Windows\System\WIGSfsa.exe

C:\Windows\System\WIGSfsa.exe

C:\Windows\System\nMAzdIy.exe

C:\Windows\System\nMAzdIy.exe

C:\Windows\System\EsOKpYN.exe

C:\Windows\System\EsOKpYN.exe

C:\Windows\System\pnZrRvG.exe

C:\Windows\System\pnZrRvG.exe

C:\Windows\System\ngIPAlc.exe

C:\Windows\System\ngIPAlc.exe

C:\Windows\System\Vcxumhm.exe

C:\Windows\System\Vcxumhm.exe

C:\Windows\System\eLYJyvO.exe

C:\Windows\System\eLYJyvO.exe

C:\Windows\System\CMvLUDz.exe

C:\Windows\System\CMvLUDz.exe

C:\Windows\System\ShchgDa.exe

C:\Windows\System\ShchgDa.exe

C:\Windows\System\MUgwSJb.exe

C:\Windows\System\MUgwSJb.exe

C:\Windows\System\GbbWsoB.exe

C:\Windows\System\GbbWsoB.exe

C:\Windows\System\VEFjzeW.exe

C:\Windows\System\VEFjzeW.exe

C:\Windows\System\THAUtbf.exe

C:\Windows\System\THAUtbf.exe

C:\Windows\System\XEQSIfG.exe

C:\Windows\System\XEQSIfG.exe

C:\Windows\System\tNBXOED.exe

C:\Windows\System\tNBXOED.exe

C:\Windows\System\vDqOgNN.exe

C:\Windows\System\vDqOgNN.exe

C:\Windows\System\yTLdIOr.exe

C:\Windows\System\yTLdIOr.exe

C:\Windows\System\qjvbOjo.exe

C:\Windows\System\qjvbOjo.exe

C:\Windows\System\uuUkwnT.exe

C:\Windows\System\uuUkwnT.exe

C:\Windows\System\BPhJziT.exe

C:\Windows\System\BPhJziT.exe

C:\Windows\System\mCzeQti.exe

C:\Windows\System\mCzeQti.exe

C:\Windows\System\HiRLoFG.exe

C:\Windows\System\HiRLoFG.exe

C:\Windows\System\oHimHiX.exe

C:\Windows\System\oHimHiX.exe

C:\Windows\System\eTSHxhS.exe

C:\Windows\System\eTSHxhS.exe

C:\Windows\System\jnAKmQg.exe

C:\Windows\System\jnAKmQg.exe

C:\Windows\System\mvBGWgf.exe

C:\Windows\System\mvBGWgf.exe

C:\Windows\System\PmwSkNt.exe

C:\Windows\System\PmwSkNt.exe

C:\Windows\System\PhQHbWZ.exe

C:\Windows\System\PhQHbWZ.exe

C:\Windows\System\cPTHZta.exe

C:\Windows\System\cPTHZta.exe

C:\Windows\System\touvqhy.exe

C:\Windows\System\touvqhy.exe

C:\Windows\System\lWhRLPX.exe

C:\Windows\System\lWhRLPX.exe

C:\Windows\System\VEcuvkG.exe

C:\Windows\System\VEcuvkG.exe

C:\Windows\System\KEjPTsp.exe

C:\Windows\System\KEjPTsp.exe

C:\Windows\System\NcMfFgb.exe

C:\Windows\System\NcMfFgb.exe

C:\Windows\System\GXXbCVC.exe

C:\Windows\System\GXXbCVC.exe

C:\Windows\System\EKeAnXF.exe

C:\Windows\System\EKeAnXF.exe

C:\Windows\System\rfpAwZN.exe

C:\Windows\System\rfpAwZN.exe

C:\Windows\System\SYtMdQS.exe

C:\Windows\System\SYtMdQS.exe

C:\Windows\System\oDtXYls.exe

C:\Windows\System\oDtXYls.exe

C:\Windows\System\uovasOz.exe

C:\Windows\System\uovasOz.exe

C:\Windows\System\SLNWaJB.exe

C:\Windows\System\SLNWaJB.exe

C:\Windows\System\UaPpZON.exe

C:\Windows\System\UaPpZON.exe

C:\Windows\System\YbQzySN.exe

C:\Windows\System\YbQzySN.exe

C:\Windows\System\WROGhAu.exe

C:\Windows\System\WROGhAu.exe

C:\Windows\System\MLJzLcZ.exe

C:\Windows\System\MLJzLcZ.exe

C:\Windows\System\yYXuJDV.exe

C:\Windows\System\yYXuJDV.exe

C:\Windows\System\kIBieql.exe

C:\Windows\System\kIBieql.exe

C:\Windows\System\UCnXNjF.exe

C:\Windows\System\UCnXNjF.exe

C:\Windows\System\tDlHHAw.exe

C:\Windows\System\tDlHHAw.exe

C:\Windows\System\mXbjiYP.exe

C:\Windows\System\mXbjiYP.exe

C:\Windows\System\QBcgcWR.exe

C:\Windows\System\QBcgcWR.exe

C:\Windows\System\WWtCSMX.exe

C:\Windows\System\WWtCSMX.exe

C:\Windows\System\WKbXiwT.exe

C:\Windows\System\WKbXiwT.exe

C:\Windows\System\XkqAdYU.exe

C:\Windows\System\XkqAdYU.exe

C:\Windows\System\bTJtGgU.exe

C:\Windows\System\bTJtGgU.exe

C:\Windows\System\NQPfhgl.exe

C:\Windows\System\NQPfhgl.exe

C:\Windows\System\fXulMLF.exe

C:\Windows\System\fXulMLF.exe

C:\Windows\System\oztUfVP.exe

C:\Windows\System\oztUfVP.exe

C:\Windows\System\gfHMhOZ.exe

C:\Windows\System\gfHMhOZ.exe

C:\Windows\System\WDBUPXV.exe

C:\Windows\System\WDBUPXV.exe

C:\Windows\System\LtxKApM.exe

C:\Windows\System\LtxKApM.exe

C:\Windows\System\GzvrULt.exe

C:\Windows\System\GzvrULt.exe

C:\Windows\System\jNYxFgt.exe

C:\Windows\System\jNYxFgt.exe

C:\Windows\System\RpQDWuS.exe

C:\Windows\System\RpQDWuS.exe

C:\Windows\System\LcEuzZu.exe

C:\Windows\System\LcEuzZu.exe

C:\Windows\System\joieTpY.exe

C:\Windows\System\joieTpY.exe

C:\Windows\System\LpMuxmP.exe

C:\Windows\System\LpMuxmP.exe

C:\Windows\System\cYtlnGg.exe

C:\Windows\System\cYtlnGg.exe

C:\Windows\System\YsNFfwH.exe

C:\Windows\System\YsNFfwH.exe

C:\Windows\System\qysuFpK.exe

C:\Windows\System\qysuFpK.exe

C:\Windows\System\HPBtKkr.exe

C:\Windows\System\HPBtKkr.exe

C:\Windows\System\BbYSQBf.exe

C:\Windows\System\BbYSQBf.exe

C:\Windows\System\DaupmWv.exe

C:\Windows\System\DaupmWv.exe

C:\Windows\System\pxxEQYB.exe

C:\Windows\System\pxxEQYB.exe

C:\Windows\System\zeJsFCQ.exe

C:\Windows\System\zeJsFCQ.exe

C:\Windows\System\JPJktQl.exe

C:\Windows\System\JPJktQl.exe

C:\Windows\System\XylbZIH.exe

C:\Windows\System\XylbZIH.exe

C:\Windows\System\OvQrxHV.exe

C:\Windows\System\OvQrxHV.exe

C:\Windows\System\ImLKcEr.exe

C:\Windows\System\ImLKcEr.exe

C:\Windows\System\WgTQKID.exe

C:\Windows\System\WgTQKID.exe

C:\Windows\System\xtNEIsC.exe

C:\Windows\System\xtNEIsC.exe

C:\Windows\System\HhcuvVY.exe

C:\Windows\System\HhcuvVY.exe

C:\Windows\System\HemgMMo.exe

C:\Windows\System\HemgMMo.exe

C:\Windows\System\TieCvUq.exe

C:\Windows\System\TieCvUq.exe

C:\Windows\System\FZkAuzk.exe

C:\Windows\System\FZkAuzk.exe

C:\Windows\System\tbTvSYk.exe

C:\Windows\System\tbTvSYk.exe

C:\Windows\System\NGZPGnV.exe

C:\Windows\System\NGZPGnV.exe

C:\Windows\System\UALideK.exe

C:\Windows\System\UALideK.exe

C:\Windows\System\TniVSiQ.exe

C:\Windows\System\TniVSiQ.exe

C:\Windows\System\xWZCErv.exe

C:\Windows\System\xWZCErv.exe

C:\Windows\System\ZWBbxhi.exe

C:\Windows\System\ZWBbxhi.exe

C:\Windows\System\ZNFbSSw.exe

C:\Windows\System\ZNFbSSw.exe

C:\Windows\System\ezFLOPy.exe

C:\Windows\System\ezFLOPy.exe

C:\Windows\System\agqNjOP.exe

C:\Windows\System\agqNjOP.exe

C:\Windows\System\jxNMLWu.exe

C:\Windows\System\jxNMLWu.exe

C:\Windows\System\ZrBPMJO.exe

C:\Windows\System\ZrBPMJO.exe

C:\Windows\System\RRASGqJ.exe

C:\Windows\System\RRASGqJ.exe

C:\Windows\System\FeaSrHl.exe

C:\Windows\System\FeaSrHl.exe

C:\Windows\System\bjbpRTQ.exe

C:\Windows\System\bjbpRTQ.exe

C:\Windows\System\gJPGGZl.exe

C:\Windows\System\gJPGGZl.exe

C:\Windows\System\ayxMRVL.exe

C:\Windows\System\ayxMRVL.exe

C:\Windows\System\OSkXUJa.exe

C:\Windows\System\OSkXUJa.exe

C:\Windows\System\YPlukTR.exe

C:\Windows\System\YPlukTR.exe

C:\Windows\System\DBOGqBn.exe

C:\Windows\System\DBOGqBn.exe

C:\Windows\System\PGnSzvz.exe

C:\Windows\System\PGnSzvz.exe

C:\Windows\System\vWlTOBO.exe

C:\Windows\System\vWlTOBO.exe

C:\Windows\System\UvNxUyd.exe

C:\Windows\System\UvNxUyd.exe

C:\Windows\System\IPlivEV.exe

C:\Windows\System\IPlivEV.exe

C:\Windows\System\XsuSkMP.exe

C:\Windows\System\XsuSkMP.exe

C:\Windows\System\WiUIjrq.exe

C:\Windows\System\WiUIjrq.exe

C:\Windows\System\obkjVOv.exe

C:\Windows\System\obkjVOv.exe

C:\Windows\System\WcopoJg.exe

C:\Windows\System\WcopoJg.exe

C:\Windows\System\LVXhbnb.exe

C:\Windows\System\LVXhbnb.exe

C:\Windows\System\WSZxAZX.exe

C:\Windows\System\WSZxAZX.exe

C:\Windows\System\OoMWXkp.exe

C:\Windows\System\OoMWXkp.exe

C:\Windows\System\JIcAYVH.exe

C:\Windows\System\JIcAYVH.exe

C:\Windows\System\KnHbkjc.exe

C:\Windows\System\KnHbkjc.exe

C:\Windows\System\TlTsTtW.exe

C:\Windows\System\TlTsTtW.exe

C:\Windows\System\LnvcUiq.exe

C:\Windows\System\LnvcUiq.exe

C:\Windows\System\QJykkmI.exe

C:\Windows\System\QJykkmI.exe

C:\Windows\System\nBBxCEc.exe

C:\Windows\System\nBBxCEc.exe

C:\Windows\System\lOLOvcO.exe

C:\Windows\System\lOLOvcO.exe

C:\Windows\System\ONUJmon.exe

C:\Windows\System\ONUJmon.exe

C:\Windows\System\uLEzRhk.exe

C:\Windows\System\uLEzRhk.exe

C:\Windows\System\hhXGThF.exe

C:\Windows\System\hhXGThF.exe

C:\Windows\System\LpsKGjQ.exe

C:\Windows\System\LpsKGjQ.exe

C:\Windows\System\mqNNKqb.exe

C:\Windows\System\mqNNKqb.exe

C:\Windows\System\xdsIQBr.exe

C:\Windows\System\xdsIQBr.exe

C:\Windows\System\QicklrO.exe

C:\Windows\System\QicklrO.exe

C:\Windows\System\OfZdSqU.exe

C:\Windows\System\OfZdSqU.exe

C:\Windows\System\GwTOKRE.exe

C:\Windows\System\GwTOKRE.exe

C:\Windows\System\QyDoYIb.exe

C:\Windows\System\QyDoYIb.exe

C:\Windows\System\IqfiCwk.exe

C:\Windows\System\IqfiCwk.exe

C:\Windows\System\tAtEYDT.exe

C:\Windows\System\tAtEYDT.exe

C:\Windows\System\xzcLesI.exe

C:\Windows\System\xzcLesI.exe

C:\Windows\System\ULFUJwO.exe

C:\Windows\System\ULFUJwO.exe

C:\Windows\System\oElBMrn.exe

C:\Windows\System\oElBMrn.exe

C:\Windows\System\qdFYjMk.exe

C:\Windows\System\qdFYjMk.exe

C:\Windows\System\cnGyIxt.exe

C:\Windows\System\cnGyIxt.exe

C:\Windows\System\KOTwvSx.exe

C:\Windows\System\KOTwvSx.exe

C:\Windows\System\NFDxzOJ.exe

C:\Windows\System\NFDxzOJ.exe

C:\Windows\System\eUbpMWk.exe

C:\Windows\System\eUbpMWk.exe

C:\Windows\System\kLAfhrP.exe

C:\Windows\System\kLAfhrP.exe

C:\Windows\System\QnFhqEU.exe

C:\Windows\System\QnFhqEU.exe

C:\Windows\System\gIaFkkR.exe

C:\Windows\System\gIaFkkR.exe

C:\Windows\System\TCBfVlR.exe

C:\Windows\System\TCBfVlR.exe

C:\Windows\System\DQxfWyn.exe

C:\Windows\System\DQxfWyn.exe

C:\Windows\System\mKiRGkk.exe

C:\Windows\System\mKiRGkk.exe

C:\Windows\System\XRqWSmk.exe

C:\Windows\System\XRqWSmk.exe

C:\Windows\System\bIfWXmC.exe

C:\Windows\System\bIfWXmC.exe

C:\Windows\System\XCHxQXr.exe

C:\Windows\System\XCHxQXr.exe

C:\Windows\System\IflMekz.exe

C:\Windows\System\IflMekz.exe

C:\Windows\System\ADvRZOY.exe

C:\Windows\System\ADvRZOY.exe

C:\Windows\System\EtSGYqR.exe

C:\Windows\System\EtSGYqR.exe

C:\Windows\System\LQhUexF.exe

C:\Windows\System\LQhUexF.exe

C:\Windows\System\YJrYwBu.exe

C:\Windows\System\YJrYwBu.exe

C:\Windows\System\sRkmlNU.exe

C:\Windows\System\sRkmlNU.exe

C:\Windows\System\PUfNyus.exe

C:\Windows\System\PUfNyus.exe

C:\Windows\System\DYDsWXa.exe

C:\Windows\System\DYDsWXa.exe

C:\Windows\System\oglfTjZ.exe

C:\Windows\System\oglfTjZ.exe

C:\Windows\System\tXHnUKF.exe

C:\Windows\System\tXHnUKF.exe

C:\Windows\System\AGhRnSa.exe

C:\Windows\System\AGhRnSa.exe

C:\Windows\System\vprvtOk.exe

C:\Windows\System\vprvtOk.exe

C:\Windows\System\YdWDtSF.exe

C:\Windows\System\YdWDtSF.exe

C:\Windows\System\rUIobNX.exe

C:\Windows\System\rUIobNX.exe

C:\Windows\System\PMAEusX.exe

C:\Windows\System\PMAEusX.exe

C:\Windows\System\IAXajZm.exe

C:\Windows\System\IAXajZm.exe

C:\Windows\System\QxZyBAl.exe

C:\Windows\System\QxZyBAl.exe

C:\Windows\System\VKfwCki.exe

C:\Windows\System\VKfwCki.exe

C:\Windows\System\JpghgOU.exe

C:\Windows\System\JpghgOU.exe

C:\Windows\System\RtLvgGH.exe

C:\Windows\System\RtLvgGH.exe

C:\Windows\System\bTWlIaN.exe

C:\Windows\System\bTWlIaN.exe

C:\Windows\System\hcfUGwK.exe

C:\Windows\System\hcfUGwK.exe

C:\Windows\System\vZzXYlf.exe

C:\Windows\System\vZzXYlf.exe

C:\Windows\System\ZXOdkkE.exe

C:\Windows\System\ZXOdkkE.exe

C:\Windows\System\URJGgLq.exe

C:\Windows\System\URJGgLq.exe

C:\Windows\System\FMqQGku.exe

C:\Windows\System\FMqQGku.exe

C:\Windows\System\aciqOvu.exe

C:\Windows\System\aciqOvu.exe

C:\Windows\System\cFcUImf.exe

C:\Windows\System\cFcUImf.exe

C:\Windows\System\NGgkQts.exe

C:\Windows\System\NGgkQts.exe

C:\Windows\System\aPyiWWn.exe

C:\Windows\System\aPyiWWn.exe

C:\Windows\System\Znadkgz.exe

C:\Windows\System\Znadkgz.exe

C:\Windows\System\brYhmuY.exe

C:\Windows\System\brYhmuY.exe

C:\Windows\System\mjWfXAs.exe

C:\Windows\System\mjWfXAs.exe

C:\Windows\System\lfDefPe.exe

C:\Windows\System\lfDefPe.exe

C:\Windows\System\RvKENIn.exe

C:\Windows\System\RvKENIn.exe

C:\Windows\System\fVBmNvz.exe

C:\Windows\System\fVBmNvz.exe

C:\Windows\System\kfuHfxP.exe

C:\Windows\System\kfuHfxP.exe

C:\Windows\System\mxqNWCT.exe

C:\Windows\System\mxqNWCT.exe

C:\Windows\System\CQjvfWX.exe

C:\Windows\System\CQjvfWX.exe

C:\Windows\System\usMGPTB.exe

C:\Windows\System\usMGPTB.exe

C:\Windows\System\vrQgsJe.exe

C:\Windows\System\vrQgsJe.exe

C:\Windows\System\zMacTZK.exe

C:\Windows\System\zMacTZK.exe

C:\Windows\System\xJLPqMq.exe

C:\Windows\System\xJLPqMq.exe

C:\Windows\System\buVBcUz.exe

C:\Windows\System\buVBcUz.exe

C:\Windows\System\NUHptQh.exe

C:\Windows\System\NUHptQh.exe

C:\Windows\System\vzdcfsg.exe

C:\Windows\System\vzdcfsg.exe

C:\Windows\System\QmEvlsj.exe

C:\Windows\System\QmEvlsj.exe

C:\Windows\System\gclShOi.exe

C:\Windows\System\gclShOi.exe

C:\Windows\System\WLOiDjo.exe

C:\Windows\System\WLOiDjo.exe

C:\Windows\System\fqKodrU.exe

C:\Windows\System\fqKodrU.exe

C:\Windows\System\OnSwcZS.exe

C:\Windows\System\OnSwcZS.exe

C:\Windows\System\nCMgEEU.exe

C:\Windows\System\nCMgEEU.exe

C:\Windows\System\kmzNPmN.exe

C:\Windows\System\kmzNPmN.exe

C:\Windows\System\zOsndll.exe

C:\Windows\System\zOsndll.exe

C:\Windows\System\ElvyXTT.exe

C:\Windows\System\ElvyXTT.exe

C:\Windows\System\WtaKaxb.exe

C:\Windows\System\WtaKaxb.exe

C:\Windows\System\BtKiOAG.exe

C:\Windows\System\BtKiOAG.exe

C:\Windows\System\CzBzGfo.exe

C:\Windows\System\CzBzGfo.exe

C:\Windows\System\zZWVABl.exe

C:\Windows\System\zZWVABl.exe

C:\Windows\System\yYLPFsF.exe

C:\Windows\System\yYLPFsF.exe

C:\Windows\System\qXvGkbG.exe

C:\Windows\System\qXvGkbG.exe

C:\Windows\System\MxorrSy.exe

C:\Windows\System\MxorrSy.exe

C:\Windows\System\beApsvL.exe

C:\Windows\System\beApsvL.exe

C:\Windows\System\nCaYWpV.exe

C:\Windows\System\nCaYWpV.exe

C:\Windows\System\UlaSAzP.exe

C:\Windows\System\UlaSAzP.exe

C:\Windows\System\iruLIQh.exe

C:\Windows\System\iruLIQh.exe

C:\Windows\System\FOyWAKx.exe

C:\Windows\System\FOyWAKx.exe

C:\Windows\System\bSCxize.exe

C:\Windows\System\bSCxize.exe

C:\Windows\System\VGIMqSV.exe

C:\Windows\System\VGIMqSV.exe

C:\Windows\System\kROhhEU.exe

C:\Windows\System\kROhhEU.exe

C:\Windows\System\eJHHEoF.exe

C:\Windows\System\eJHHEoF.exe

C:\Windows\System\YgbeYcS.exe

C:\Windows\System\YgbeYcS.exe

C:\Windows\System\KrCHjRl.exe

C:\Windows\System\KrCHjRl.exe

C:\Windows\System\ThlFeVC.exe

C:\Windows\System\ThlFeVC.exe

C:\Windows\System\WpXPvqi.exe

C:\Windows\System\WpXPvqi.exe

C:\Windows\System\KTUouea.exe

C:\Windows\System\KTUouea.exe

C:\Windows\System\mSHgjyy.exe

C:\Windows\System\mSHgjyy.exe

C:\Windows\System\YYUjadZ.exe

C:\Windows\System\YYUjadZ.exe

C:\Windows\System\BrymfCM.exe

C:\Windows\System\BrymfCM.exe

C:\Windows\System\ahPouoP.exe

C:\Windows\System\ahPouoP.exe

C:\Windows\System\LkkuSLV.exe

C:\Windows\System\LkkuSLV.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8

C:\Windows\System\QXJXAjs.exe

C:\Windows\System\QXJXAjs.exe

C:\Windows\System\zjDGHnB.exe

C:\Windows\System\zjDGHnB.exe

C:\Windows\System\ICRkAAU.exe

C:\Windows\System\ICRkAAU.exe

C:\Windows\System\crtIIUJ.exe

C:\Windows\System\crtIIUJ.exe

C:\Windows\System\TqRiBZD.exe

C:\Windows\System\TqRiBZD.exe

C:\Windows\System\lQlsQOM.exe

C:\Windows\System\lQlsQOM.exe

C:\Windows\System\vvZkKJW.exe

C:\Windows\System\vvZkKJW.exe

C:\Windows\System\xQbPxFp.exe

C:\Windows\System\xQbPxFp.exe

C:\Windows\System\tYwdQRa.exe

C:\Windows\System\tYwdQRa.exe

C:\Windows\System\ZNXzetu.exe

C:\Windows\System\ZNXzetu.exe

C:\Windows\System\dpFRFpY.exe

C:\Windows\System\dpFRFpY.exe

C:\Windows\System\aVrNYPY.exe

C:\Windows\System\aVrNYPY.exe

C:\Windows\System\wOSVpaY.exe

C:\Windows\System\wOSVpaY.exe

C:\Windows\System\rlPbLKp.exe

C:\Windows\System\rlPbLKp.exe

C:\Windows\System\NzWTveD.exe

C:\Windows\System\NzWTveD.exe

C:\Windows\System\Tddrkzz.exe

C:\Windows\System\Tddrkzz.exe

C:\Windows\System\DmDNkRx.exe

C:\Windows\System\DmDNkRx.exe

C:\Windows\System\ocIxRYP.exe

C:\Windows\System\ocIxRYP.exe

C:\Windows\System\nXtCBjF.exe

C:\Windows\System\nXtCBjF.exe

C:\Windows\System\PNJmAsp.exe

C:\Windows\System\PNJmAsp.exe

C:\Windows\System\ybxPunU.exe

C:\Windows\System\ybxPunU.exe

C:\Windows\System\hsMVnTy.exe

C:\Windows\System\hsMVnTy.exe

C:\Windows\System\Maixraj.exe

C:\Windows\System\Maixraj.exe

C:\Windows\System\FMNMwaA.exe

C:\Windows\System\FMNMwaA.exe

C:\Windows\System\DzPhEBv.exe

C:\Windows\System\DzPhEBv.exe

C:\Windows\System\DmZlreS.exe

C:\Windows\System\DmZlreS.exe

C:\Windows\System\EDUQQAg.exe

C:\Windows\System\EDUQQAg.exe

C:\Windows\System\rflswzM.exe

C:\Windows\System\rflswzM.exe

C:\Windows\System\hnnpZJR.exe

C:\Windows\System\hnnpZJR.exe

C:\Windows\System\pyKguIU.exe

C:\Windows\System\pyKguIU.exe

C:\Windows\System\RasTeDT.exe

C:\Windows\System\RasTeDT.exe

C:\Windows\System\DhbrekD.exe

C:\Windows\System\DhbrekD.exe

C:\Windows\System\blhcZmY.exe

C:\Windows\System\blhcZmY.exe

C:\Windows\System\EAOodmd.exe

C:\Windows\System\EAOodmd.exe

C:\Windows\System\qdFBdHO.exe

C:\Windows\System\qdFBdHO.exe

C:\Windows\System\HCRnjcJ.exe

C:\Windows\System\HCRnjcJ.exe

C:\Windows\System\ElewpwQ.exe

C:\Windows\System\ElewpwQ.exe

C:\Windows\System\bHNolvG.exe

C:\Windows\System\bHNolvG.exe

C:\Windows\System\BUDXtVf.exe

C:\Windows\System\BUDXtVf.exe

C:\Windows\System\iqYzgtr.exe

C:\Windows\System\iqYzgtr.exe

C:\Windows\System\wneWElv.exe

C:\Windows\System\wneWElv.exe

C:\Windows\System\dPoawBP.exe

C:\Windows\System\dPoawBP.exe

C:\Windows\System\QAmlwnU.exe

C:\Windows\System\QAmlwnU.exe

C:\Windows\System\AgzwZBB.exe

C:\Windows\System\AgzwZBB.exe

C:\Windows\System\gDeYRSO.exe

C:\Windows\System\gDeYRSO.exe

C:\Windows\System\gYdLTOp.exe

C:\Windows\System\gYdLTOp.exe

C:\Windows\System\fPQmCas.exe

C:\Windows\System\fPQmCas.exe

C:\Windows\System\vKLPjmJ.exe

C:\Windows\System\vKLPjmJ.exe

C:\Windows\System\xQfnySR.exe

C:\Windows\System\xQfnySR.exe

C:\Windows\System\mBnBSyv.exe

C:\Windows\System\mBnBSyv.exe

C:\Windows\System\jKjRqkl.exe

C:\Windows\System\jKjRqkl.exe

C:\Windows\System\KHzpeLA.exe

C:\Windows\System\KHzpeLA.exe

C:\Windows\System\cJVEmji.exe

C:\Windows\System\cJVEmji.exe

C:\Windows\System\KfVOqQy.exe

C:\Windows\System\KfVOqQy.exe

C:\Windows\System\mdtiCGi.exe

C:\Windows\System\mdtiCGi.exe

C:\Windows\System\LayPLQL.exe

C:\Windows\System\LayPLQL.exe

C:\Windows\System\FckFCmO.exe

C:\Windows\System\FckFCmO.exe

C:\Windows\System\HPmZFPH.exe

C:\Windows\System\HPmZFPH.exe

C:\Windows\System\IPQRoyq.exe

C:\Windows\System\IPQRoyq.exe

C:\Windows\System\tDOYIQi.exe

C:\Windows\System\tDOYIQi.exe

C:\Windows\System\gDYdfvW.exe

C:\Windows\System\gDYdfvW.exe

C:\Windows\System\ozbOPfx.exe

C:\Windows\System\ozbOPfx.exe

C:\Windows\System\ZLpErTd.exe

C:\Windows\System\ZLpErTd.exe

C:\Windows\System\WdsVoQY.exe

C:\Windows\System\WdsVoQY.exe

C:\Windows\System\McOkmxX.exe

C:\Windows\System\McOkmxX.exe

C:\Windows\System\fvRgXAj.exe

C:\Windows\System\fvRgXAj.exe

C:\Windows\System\WiOVGiL.exe

C:\Windows\System\WiOVGiL.exe

C:\Windows\System\psDmvPp.exe

C:\Windows\System\psDmvPp.exe

C:\Windows\System\jXHvZbj.exe

C:\Windows\System\jXHvZbj.exe

C:\Windows\System\cMBTMRp.exe

C:\Windows\System\cMBTMRp.exe

C:\Windows\System\qobhLwF.exe

C:\Windows\System\qobhLwF.exe

C:\Windows\System\weAjPFr.exe

C:\Windows\System\weAjPFr.exe

C:\Windows\System\usEjxop.exe

C:\Windows\System\usEjxop.exe

C:\Windows\System\LwpsvQl.exe

C:\Windows\System\LwpsvQl.exe

C:\Windows\System\pAlFfIe.exe

C:\Windows\System\pAlFfIe.exe

C:\Windows\System\MoIQvgF.exe

C:\Windows\System\MoIQvgF.exe

C:\Windows\System\qESsKiL.exe

C:\Windows\System\qESsKiL.exe

C:\Windows\System\vUuTOOj.exe

C:\Windows\System\vUuTOOj.exe

C:\Windows\System\cJHvzEl.exe

C:\Windows\System\cJHvzEl.exe

C:\Windows\System\cpcuSLg.exe

C:\Windows\System\cpcuSLg.exe

C:\Windows\System\jaVBLqz.exe

C:\Windows\System\jaVBLqz.exe

C:\Windows\System\KuvupFw.exe

C:\Windows\System\KuvupFw.exe

C:\Windows\System\adayJfd.exe

C:\Windows\System\adayJfd.exe

C:\Windows\System\CyndsSA.exe

C:\Windows\System\CyndsSA.exe

C:\Windows\System\aDTeYln.exe

C:\Windows\System\aDTeYln.exe

C:\Windows\System\ZQjpCHe.exe

C:\Windows\System\ZQjpCHe.exe

C:\Windows\System\aFleBQx.exe

C:\Windows\System\aFleBQx.exe

C:\Windows\System\JAOPFob.exe

C:\Windows\System\JAOPFob.exe

C:\Windows\System\YWJkMwv.exe

C:\Windows\System\YWJkMwv.exe

C:\Windows\System\wFkfptk.exe

C:\Windows\System\wFkfptk.exe

C:\Windows\System\IeizNQH.exe

C:\Windows\System\IeizNQH.exe

C:\Windows\System\mruovFG.exe

C:\Windows\System\mruovFG.exe

C:\Windows\System\zhNlgzF.exe

C:\Windows\System\zhNlgzF.exe

C:\Windows\System\zOKTSat.exe

C:\Windows\System\zOKTSat.exe

C:\Windows\System\ChtynjQ.exe

C:\Windows\System\ChtynjQ.exe

C:\Windows\System\oyBIqoM.exe

C:\Windows\System\oyBIqoM.exe

C:\Windows\System\YBvKQrB.exe

C:\Windows\System\YBvKQrB.exe

C:\Windows\System\mcvyfsL.exe

C:\Windows\System\mcvyfsL.exe

C:\Windows\System\gFDeHgG.exe

C:\Windows\System\gFDeHgG.exe

C:\Windows\System\XreAWhN.exe

C:\Windows\System\XreAWhN.exe

C:\Windows\System\ksfKWME.exe

C:\Windows\System\ksfKWME.exe

C:\Windows\System\KdKvtSx.exe

C:\Windows\System\KdKvtSx.exe

C:\Windows\System\IXulgUb.exe

C:\Windows\System\IXulgUb.exe

C:\Windows\System\htpDCvO.exe

C:\Windows\System\htpDCvO.exe

C:\Windows\System\jrZnMtr.exe

C:\Windows\System\jrZnMtr.exe

C:\Windows\System\DwefKuO.exe

C:\Windows\System\DwefKuO.exe

C:\Windows\System\CyIkhXq.exe

C:\Windows\System\CyIkhXq.exe

C:\Windows\System\qChHNtY.exe

C:\Windows\System\qChHNtY.exe

C:\Windows\System\LwUEAvw.exe

C:\Windows\System\LwUEAvw.exe

C:\Windows\System\yjHeOAD.exe

C:\Windows\System\yjHeOAD.exe

C:\Windows\System\JwEJiZm.exe

C:\Windows\System\JwEJiZm.exe

C:\Windows\System\tBVIICB.exe

C:\Windows\System\tBVIICB.exe

C:\Windows\System\hOKEvFi.exe

C:\Windows\System\hOKEvFi.exe

C:\Windows\System\mnkAVvw.exe

C:\Windows\System\mnkAVvw.exe

C:\Windows\System\ZgkFrfa.exe

C:\Windows\System\ZgkFrfa.exe

C:\Windows\System\smoIyVD.exe

C:\Windows\System\smoIyVD.exe

C:\Windows\System\XfMOsHa.exe

C:\Windows\System\XfMOsHa.exe

C:\Windows\System\TGufzMU.exe

C:\Windows\System\TGufzMU.exe

C:\Windows\System\NfZIaMP.exe

C:\Windows\System\NfZIaMP.exe

C:\Windows\System\nvfGNkT.exe

C:\Windows\System\nvfGNkT.exe

C:\Windows\System\ZQOXmSz.exe

C:\Windows\System\ZQOXmSz.exe

C:\Windows\System\ULEbzIq.exe

C:\Windows\System\ULEbzIq.exe

C:\Windows\System\aVNBbnc.exe

C:\Windows\System\aVNBbnc.exe

C:\Windows\System\gRURkxf.exe

C:\Windows\System\gRURkxf.exe

C:\Windows\System\ncAgolh.exe

C:\Windows\System\ncAgolh.exe

C:\Windows\System\xTePGfO.exe

C:\Windows\System\xTePGfO.exe

C:\Windows\System\RuptvkS.exe

C:\Windows\System\RuptvkS.exe

C:\Windows\System\URXQqJw.exe

C:\Windows\System\URXQqJw.exe

C:\Windows\System\qmFnaWe.exe

C:\Windows\System\qmFnaWe.exe

C:\Windows\System\XGAQgac.exe

C:\Windows\System\XGAQgac.exe

C:\Windows\System\PQseEwD.exe

C:\Windows\System\PQseEwD.exe

C:\Windows\System\AhGFKyV.exe

C:\Windows\System\AhGFKyV.exe

C:\Windows\System\jvsoXpk.exe

C:\Windows\System\jvsoXpk.exe

C:\Windows\System\RJOoufa.exe

C:\Windows\System\RJOoufa.exe

C:\Windows\System\bVvQXuP.exe

C:\Windows\System\bVvQXuP.exe

C:\Windows\System\fSKTKUn.exe

C:\Windows\System\fSKTKUn.exe

C:\Windows\System\sxLjyGZ.exe

C:\Windows\System\sxLjyGZ.exe

C:\Windows\System\syypFgG.exe

C:\Windows\System\syypFgG.exe

C:\Windows\System\QhGenof.exe

C:\Windows\System\QhGenof.exe

C:\Windows\System\bNPhBIi.exe

C:\Windows\System\bNPhBIi.exe

C:\Windows\System\PoaOMXY.exe

C:\Windows\System\PoaOMXY.exe

C:\Windows\System\bLXRICh.exe

C:\Windows\System\bLXRICh.exe

C:\Windows\System\VWqRLhE.exe

C:\Windows\System\VWqRLhE.exe

C:\Windows\System\vjQJBbv.exe

C:\Windows\System\vjQJBbv.exe

C:\Windows\System\sKdrZxi.exe

C:\Windows\System\sKdrZxi.exe

C:\Windows\System\MIOnOGz.exe

C:\Windows\System\MIOnOGz.exe

C:\Windows\System\gwjZbkf.exe

C:\Windows\System\gwjZbkf.exe

C:\Windows\System\XBDrDaL.exe

C:\Windows\System\XBDrDaL.exe

C:\Windows\System\QHCkjXZ.exe

C:\Windows\System\QHCkjXZ.exe

C:\Windows\System\PJgDYSB.exe

C:\Windows\System\PJgDYSB.exe

C:\Windows\System\ehqUPtn.exe

C:\Windows\System\ehqUPtn.exe

C:\Windows\System\ViniIeV.exe

C:\Windows\System\ViniIeV.exe

C:\Windows\System\KCCczlA.exe

C:\Windows\System\KCCczlA.exe

C:\Windows\System\caLlUtx.exe

C:\Windows\System\caLlUtx.exe

C:\Windows\System\WctVHFw.exe

C:\Windows\System\WctVHFw.exe

C:\Windows\System\nDEmhpN.exe

C:\Windows\System\nDEmhpN.exe

C:\Windows\System\rqDBwZe.exe

C:\Windows\System\rqDBwZe.exe

C:\Windows\System\yOLLJzq.exe

C:\Windows\System\yOLLJzq.exe

C:\Windows\System\dAlurBa.exe

C:\Windows\System\dAlurBa.exe

C:\Windows\System\jNHxUys.exe

C:\Windows\System\jNHxUys.exe

C:\Windows\System\OpHRibe.exe

C:\Windows\System\OpHRibe.exe

C:\Windows\System\oiodHvb.exe

C:\Windows\System\oiodHvb.exe

C:\Windows\System\FphqGkn.exe

C:\Windows\System\FphqGkn.exe

C:\Windows\System\gxsFUtt.exe

C:\Windows\System\gxsFUtt.exe

C:\Windows\System\jZVnktH.exe

C:\Windows\System\jZVnktH.exe

C:\Windows\System\zEFUSQY.exe

C:\Windows\System\zEFUSQY.exe

C:\Windows\System\hnvAOtA.exe

C:\Windows\System\hnvAOtA.exe

C:\Windows\System\QbjHWhr.exe

C:\Windows\System\QbjHWhr.exe

C:\Windows\System\Ecaewsn.exe

C:\Windows\System\Ecaewsn.exe

C:\Windows\System\IbnvMsI.exe

C:\Windows\System\IbnvMsI.exe

C:\Windows\System\DyviUfO.exe

C:\Windows\System\DyviUfO.exe

C:\Windows\System\CUpNlYD.exe

C:\Windows\System\CUpNlYD.exe

C:\Windows\System\BEeUdYM.exe

C:\Windows\System\BEeUdYM.exe

C:\Windows\System\yfzeXgJ.exe

C:\Windows\System\yfzeXgJ.exe

C:\Windows\System\srGRpzd.exe

C:\Windows\System\srGRpzd.exe

C:\Windows\System\qraBOqP.exe

C:\Windows\System\qraBOqP.exe

C:\Windows\System\vdbjXEr.exe

C:\Windows\System\vdbjXEr.exe

C:\Windows\System\BAhztlK.exe

C:\Windows\System\BAhztlK.exe

C:\Windows\System\HJhUaSB.exe

C:\Windows\System\HJhUaSB.exe

C:\Windows\System\skzwMXO.exe

C:\Windows\System\skzwMXO.exe

C:\Windows\System\ZTrHLQA.exe

C:\Windows\System\ZTrHLQA.exe

C:\Windows\System\dtYafCJ.exe

C:\Windows\System\dtYafCJ.exe

C:\Windows\System\ZdcrpsT.exe

C:\Windows\System\ZdcrpsT.exe

C:\Windows\System\rqwxsMO.exe

C:\Windows\System\rqwxsMO.exe

C:\Windows\System\qANOAYH.exe

C:\Windows\System\qANOAYH.exe

C:\Windows\System\TqDQPCI.exe

C:\Windows\System\TqDQPCI.exe

C:\Windows\System\CvGpHIs.exe

C:\Windows\System\CvGpHIs.exe

C:\Windows\System\JYzYwwI.exe

C:\Windows\System\JYzYwwI.exe

C:\Windows\System\hckKnHd.exe

C:\Windows\System\hckKnHd.exe

C:\Windows\System\OUzKhtL.exe

C:\Windows\System\OUzKhtL.exe

C:\Windows\System\qZgMHTI.exe

C:\Windows\System\qZgMHTI.exe

C:\Windows\System\FMPmCuH.exe

C:\Windows\System\FMPmCuH.exe

C:\Windows\System\EJNXmNZ.exe

C:\Windows\System\EJNXmNZ.exe

C:\Windows\System\tHXtahf.exe

C:\Windows\System\tHXtahf.exe

C:\Windows\System\gFSOEgi.exe

C:\Windows\System\gFSOEgi.exe

C:\Windows\System\QjENbfh.exe

C:\Windows\System\QjENbfh.exe

C:\Windows\System\eNOpxUY.exe

C:\Windows\System\eNOpxUY.exe

C:\Windows\System\aCetwQo.exe

C:\Windows\System\aCetwQo.exe

C:\Windows\System\UctVrHF.exe

C:\Windows\System\UctVrHF.exe

C:\Windows\System\hakLCdh.exe

C:\Windows\System\hakLCdh.exe

C:\Windows\System\HGXhJyA.exe

C:\Windows\System\HGXhJyA.exe

C:\Windows\System\BLctokd.exe

C:\Windows\System\BLctokd.exe

C:\Windows\System\iVDGnEi.exe

C:\Windows\System\iVDGnEi.exe

C:\Windows\System\zhonGun.exe

C:\Windows\System\zhonGun.exe

C:\Windows\System\bLuUzFP.exe

C:\Windows\System\bLuUzFP.exe

C:\Windows\System\prelyPQ.exe

C:\Windows\System\prelyPQ.exe

C:\Windows\System\mljZlIC.exe

C:\Windows\System\mljZlIC.exe

C:\Windows\System\KtsrRcg.exe

C:\Windows\System\KtsrRcg.exe

C:\Windows\System\OjYbPrZ.exe

C:\Windows\System\OjYbPrZ.exe

C:\Windows\System\EMpTxkJ.exe

C:\Windows\System\EMpTxkJ.exe

C:\Windows\System\qXMAyBg.exe

C:\Windows\System\qXMAyBg.exe

C:\Windows\System\OAmeZxn.exe

C:\Windows\System\OAmeZxn.exe

C:\Windows\System\WIJtuiQ.exe

C:\Windows\System\WIJtuiQ.exe

C:\Windows\System\WWQOGPo.exe

C:\Windows\System\WWQOGPo.exe

C:\Windows\System\qVOEoEa.exe

C:\Windows\System\qVOEoEa.exe

C:\Windows\System\IvPNzYo.exe

C:\Windows\System\IvPNzYo.exe

C:\Windows\System\mqtiNZV.exe

C:\Windows\System\mqtiNZV.exe

C:\Windows\System\riRqZdj.exe

C:\Windows\System\riRqZdj.exe

C:\Windows\System\wpYHZLo.exe

C:\Windows\System\wpYHZLo.exe

C:\Windows\System\wgxutoI.exe

C:\Windows\System\wgxutoI.exe

C:\Windows\System\jNNpJUK.exe

C:\Windows\System\jNNpJUK.exe

C:\Windows\System\SPDJbOc.exe

C:\Windows\System\SPDJbOc.exe

C:\Windows\System\IbusLWM.exe

C:\Windows\System\IbusLWM.exe

C:\Windows\System\GnsJecZ.exe

C:\Windows\System\GnsJecZ.exe

C:\Windows\System\VmlnTdz.exe

C:\Windows\System\VmlnTdz.exe

C:\Windows\System\kXZDwWF.exe

C:\Windows\System\kXZDwWF.exe

C:\Windows\System\pHoiOmf.exe

C:\Windows\System\pHoiOmf.exe

C:\Windows\System\nvlFpAV.exe

C:\Windows\System\nvlFpAV.exe

C:\Windows\System\KELnbCY.exe

C:\Windows\System\KELnbCY.exe

C:\Windows\System\pPiXNMg.exe

C:\Windows\System\pPiXNMg.exe

C:\Windows\System\XrylWlg.exe

C:\Windows\System\XrylWlg.exe

C:\Windows\System\NzBzzoq.exe

C:\Windows\System\NzBzzoq.exe

C:\Windows\System\JupjDGe.exe

C:\Windows\System\JupjDGe.exe

C:\Windows\System\cNhTkno.exe

C:\Windows\System\cNhTkno.exe

C:\Windows\System\SpOMXUs.exe

C:\Windows\System\SpOMXUs.exe

C:\Windows\System\bDnkQpe.exe

C:\Windows\System\bDnkQpe.exe

C:\Windows\System\vaQMqiK.exe

C:\Windows\System\vaQMqiK.exe

C:\Windows\System\anNkwzw.exe

C:\Windows\System\anNkwzw.exe

C:\Windows\System\EpCTbvk.exe

C:\Windows\System\EpCTbvk.exe

C:\Windows\System\fcotcvD.exe

C:\Windows\System\fcotcvD.exe

C:\Windows\System\hkHPGxM.exe

C:\Windows\System\hkHPGxM.exe

C:\Windows\System\bEatWzv.exe

C:\Windows\System\bEatWzv.exe

C:\Windows\System\MJGXtWL.exe

C:\Windows\System\MJGXtWL.exe

C:\Windows\System\BQMCivd.exe

C:\Windows\System\BQMCivd.exe

C:\Windows\System\OuuJMug.exe

C:\Windows\System\OuuJMug.exe

C:\Windows\System\hYMOFzD.exe

C:\Windows\System\hYMOFzD.exe

C:\Windows\System\ensvgic.exe

C:\Windows\System\ensvgic.exe

C:\Windows\System\BQdXZhH.exe

C:\Windows\System\BQdXZhH.exe

C:\Windows\System\HdbDamg.exe

C:\Windows\System\HdbDamg.exe

C:\Windows\System\WbCJgBX.exe

C:\Windows\System\WbCJgBX.exe

C:\Windows\System\qWXpdiH.exe

C:\Windows\System\qWXpdiH.exe

C:\Windows\System\XrxcCPN.exe

C:\Windows\System\XrxcCPN.exe

C:\Windows\System\uLlvLOw.exe

C:\Windows\System\uLlvLOw.exe

C:\Windows\System\xVVfuKE.exe

C:\Windows\System\xVVfuKE.exe

C:\Windows\System\wttBqte.exe

C:\Windows\System\wttBqte.exe

C:\Windows\System\BZvFzZs.exe

C:\Windows\System\BZvFzZs.exe

C:\Windows\System\MkUZVjA.exe

C:\Windows\System\MkUZVjA.exe

C:\Windows\System\fYiBhlN.exe

C:\Windows\System\fYiBhlN.exe

C:\Windows\System\QQRmJTv.exe

C:\Windows\System\QQRmJTv.exe

C:\Windows\System\VWokUzh.exe

C:\Windows\System\VWokUzh.exe

C:\Windows\System\sCEBxzi.exe

C:\Windows\System\sCEBxzi.exe

C:\Windows\System\pgwJgrB.exe

C:\Windows\System\pgwJgrB.exe

C:\Windows\System\TaNTxWw.exe

C:\Windows\System\TaNTxWw.exe

C:\Windows\System\PPCCMuK.exe

C:\Windows\System\PPCCMuK.exe

C:\Windows\System\HkNYDhE.exe

C:\Windows\System\HkNYDhE.exe

C:\Windows\System\wCWJsxe.exe

C:\Windows\System\wCWJsxe.exe

C:\Windows\System\bncFZer.exe

C:\Windows\System\bncFZer.exe

C:\Windows\System\UXzTqnA.exe

C:\Windows\System\UXzTqnA.exe

C:\Windows\System\aUDNvvl.exe

C:\Windows\System\aUDNvvl.exe

C:\Windows\System\QcEWmge.exe

C:\Windows\System\QcEWmge.exe

C:\Windows\System\loWObet.exe

C:\Windows\System\loWObet.exe

C:\Windows\System\MdoBXlX.exe

C:\Windows\System\MdoBXlX.exe

C:\Windows\System\xssMwvM.exe

C:\Windows\System\xssMwvM.exe

C:\Windows\System\AjEXInl.exe

C:\Windows\System\AjEXInl.exe

C:\Windows\System\OABTuXu.exe

C:\Windows\System\OABTuXu.exe

C:\Windows\System\xguffaC.exe

C:\Windows\System\xguffaC.exe

C:\Windows\System\iZMCTSh.exe

C:\Windows\System\iZMCTSh.exe

C:\Windows\System\acxPWXE.exe

C:\Windows\System\acxPWXE.exe

C:\Windows\System\sycNJms.exe

C:\Windows\System\sycNJms.exe

C:\Windows\System\yKlTczW.exe

C:\Windows\System\yKlTczW.exe

C:\Windows\System\eQRiCjl.exe

C:\Windows\System\eQRiCjl.exe

C:\Windows\System\lZwaqew.exe

C:\Windows\System\lZwaqew.exe

C:\Windows\System\yMjsRxx.exe

C:\Windows\System\yMjsRxx.exe

C:\Windows\System\nOwzZxf.exe

C:\Windows\System\nOwzZxf.exe

C:\Windows\System\yDrQzrg.exe

C:\Windows\System\yDrQzrg.exe

C:\Windows\System\HxpAwQR.exe

C:\Windows\System\HxpAwQR.exe

C:\Windows\System\tzOHJSm.exe

C:\Windows\System\tzOHJSm.exe

C:\Windows\System\LHGpuml.exe

C:\Windows\System\LHGpuml.exe

C:\Windows\System\WTYREyg.exe

C:\Windows\System\WTYREyg.exe

C:\Windows\System\juKJCap.exe

C:\Windows\System\juKJCap.exe

C:\Windows\System\cgmKUoV.exe

C:\Windows\System\cgmKUoV.exe

C:\Windows\System\aSQChRF.exe

C:\Windows\System\aSQChRF.exe

C:\Windows\System\vOBDbgb.exe

C:\Windows\System\vOBDbgb.exe

C:\Windows\System\EzlDvWI.exe

C:\Windows\System\EzlDvWI.exe

C:\Windows\System\OpvcGwJ.exe

C:\Windows\System\OpvcGwJ.exe

C:\Windows\System\aajKxnP.exe

C:\Windows\System\aajKxnP.exe

C:\Windows\System\gErVxKG.exe

C:\Windows\System\gErVxKG.exe

C:\Windows\System\TivuRab.exe

C:\Windows\System\TivuRab.exe

C:\Windows\System\hvNtDJE.exe

C:\Windows\System\hvNtDJE.exe

C:\Windows\System\cTsENKZ.exe

C:\Windows\System\cTsENKZ.exe

C:\Windows\System\zajLRlP.exe

C:\Windows\System\zajLRlP.exe

C:\Windows\System\nMqoMxS.exe

C:\Windows\System\nMqoMxS.exe

C:\Windows\System\JlgrILT.exe

C:\Windows\System\JlgrILT.exe

C:\Windows\System\uTaVEBx.exe

C:\Windows\System\uTaVEBx.exe

C:\Windows\System\VXkRwZR.exe

C:\Windows\System\VXkRwZR.exe

C:\Windows\System\EuDPUyK.exe

C:\Windows\System\EuDPUyK.exe

C:\Windows\System\crXxaKK.exe

C:\Windows\System\crXxaKK.exe

C:\Windows\System\iAblLCZ.exe

C:\Windows\System\iAblLCZ.exe

C:\Windows\System\uAZeNIP.exe

C:\Windows\System\uAZeNIP.exe

C:\Windows\System\xFvQAWY.exe

C:\Windows\System\xFvQAWY.exe

C:\Windows\System\xeLVicU.exe

C:\Windows\System\xeLVicU.exe

C:\Windows\System\TpKBKfW.exe

C:\Windows\System\TpKBKfW.exe

C:\Windows\System\SyvmXWV.exe

C:\Windows\System\SyvmXWV.exe

C:\Windows\System\cYRtOMd.exe

C:\Windows\System\cYRtOMd.exe

C:\Windows\System\cBggbtP.exe

C:\Windows\System\cBggbtP.exe

C:\Windows\System\rTJWwzG.exe

C:\Windows\System\rTJWwzG.exe

C:\Windows\System\bZdEsSl.exe

C:\Windows\System\bZdEsSl.exe

C:\Windows\System\hjDVDpa.exe

C:\Windows\System\hjDVDpa.exe

C:\Windows\System\LeffAac.exe

C:\Windows\System\LeffAac.exe

C:\Windows\System\INXWCgK.exe

C:\Windows\System\INXWCgK.exe

C:\Windows\System\BcNQfvT.exe

C:\Windows\System\BcNQfvT.exe

C:\Windows\System\wWqMqpM.exe

C:\Windows\System\wWqMqpM.exe

C:\Windows\System\PuzmXsG.exe

C:\Windows\System\PuzmXsG.exe

C:\Windows\System\HxuYzpW.exe

C:\Windows\System\HxuYzpW.exe

C:\Windows\System\dxvpuQG.exe

C:\Windows\System\dxvpuQG.exe

C:\Windows\System\UaYKcNP.exe

C:\Windows\System\UaYKcNP.exe

C:\Windows\System\meMmSUD.exe

C:\Windows\System\meMmSUD.exe

C:\Windows\System\XMcpysA.exe

C:\Windows\System\XMcpysA.exe

C:\Windows\System\ozqlZSU.exe

C:\Windows\System\ozqlZSU.exe

C:\Windows\System\jIEgViy.exe

C:\Windows\System\jIEgViy.exe

C:\Windows\System\EVVwwDu.exe

C:\Windows\System\EVVwwDu.exe

C:\Windows\System\fFRQyat.exe

C:\Windows\System\fFRQyat.exe

C:\Windows\System\wEXaouw.exe

C:\Windows\System\wEXaouw.exe

C:\Windows\System\ERgYSjA.exe

C:\Windows\System\ERgYSjA.exe

C:\Windows\System\YETELiM.exe

C:\Windows\System\YETELiM.exe

C:\Windows\System\VPfrxfJ.exe

C:\Windows\System\VPfrxfJ.exe

C:\Windows\System\NaTPrus.exe

C:\Windows\System\NaTPrus.exe

C:\Windows\System\yMgbJyK.exe

C:\Windows\System\yMgbJyK.exe

C:\Windows\System\aQjiAez.exe

C:\Windows\System\aQjiAez.exe

C:\Windows\System\NMclLWx.exe

C:\Windows\System\NMclLWx.exe

C:\Windows\System\eIfjROF.exe

C:\Windows\System\eIfjROF.exe

C:\Windows\System\bjVeWiY.exe

C:\Windows\System\bjVeWiY.exe

C:\Windows\System\zQLosXr.exe

C:\Windows\System\zQLosXr.exe

C:\Windows\System\nIWBOPa.exe

C:\Windows\System\nIWBOPa.exe

C:\Windows\System\MNRXzsC.exe

C:\Windows\System\MNRXzsC.exe

C:\Windows\System\uTLztgn.exe

C:\Windows\System\uTLztgn.exe

C:\Windows\System\OeeZbAt.exe

C:\Windows\System\OeeZbAt.exe

C:\Windows\System\PwJOhhq.exe

C:\Windows\System\PwJOhhq.exe

C:\Windows\System\sAOfzHQ.exe

C:\Windows\System\sAOfzHQ.exe

C:\Windows\System\OEpNYBP.exe

C:\Windows\System\OEpNYBP.exe

C:\Windows\System\nkAYuEE.exe

C:\Windows\System\nkAYuEE.exe

C:\Windows\System\AegdfRj.exe

C:\Windows\System\AegdfRj.exe

C:\Windows\System\nirpPel.exe

C:\Windows\System\nirpPel.exe

C:\Windows\System\mgQftKI.exe

C:\Windows\System\mgQftKI.exe

C:\Windows\System\TvMJqjS.exe

C:\Windows\System\TvMJqjS.exe

C:\Windows\System\TWBlUUm.exe

C:\Windows\System\TWBlUUm.exe

C:\Windows\System\crofReY.exe

C:\Windows\System\crofReY.exe

C:\Windows\System\koeJMvL.exe

C:\Windows\System\koeJMvL.exe

C:\Windows\System\DySdtll.exe

C:\Windows\System\DySdtll.exe

C:\Windows\System\KoeJUDX.exe

C:\Windows\System\KoeJUDX.exe

C:\Windows\System\IveZjZy.exe

C:\Windows\System\IveZjZy.exe

C:\Windows\System\NRZmrGz.exe

C:\Windows\System\NRZmrGz.exe

C:\Windows\System\bwweRPq.exe

C:\Windows\System\bwweRPq.exe

C:\Windows\System\cYSqKUE.exe

C:\Windows\System\cYSqKUE.exe

C:\Windows\System\zmhapIt.exe

C:\Windows\System\zmhapIt.exe

C:\Windows\System\WONyzlJ.exe

C:\Windows\System\WONyzlJ.exe

C:\Windows\System\bxMVcYe.exe

C:\Windows\System\bxMVcYe.exe

C:\Windows\System\FBYcNXe.exe

C:\Windows\System\FBYcNXe.exe

C:\Windows\System\yAgRdHL.exe

C:\Windows\System\yAgRdHL.exe

C:\Windows\System\cmBkLyz.exe

C:\Windows\System\cmBkLyz.exe

C:\Windows\System\fYRIUbM.exe

C:\Windows\System\fYRIUbM.exe

C:\Windows\System\JxBqHLg.exe

C:\Windows\System\JxBqHLg.exe

C:\Windows\System\ysIWMCj.exe

C:\Windows\System\ysIWMCj.exe

C:\Windows\System\GWQfpQu.exe

C:\Windows\System\GWQfpQu.exe

C:\Windows\System\QukljsR.exe

C:\Windows\System\QukljsR.exe

C:\Windows\System\zEXjYdb.exe

C:\Windows\System\zEXjYdb.exe

C:\Windows\System\bppaHgC.exe

C:\Windows\System\bppaHgC.exe

C:\Windows\System\ZeweRoN.exe

C:\Windows\System\ZeweRoN.exe

C:\Windows\System\CuFPXEi.exe

C:\Windows\System\CuFPXEi.exe

C:\Windows\System\LMLWgzc.exe

C:\Windows\System\LMLWgzc.exe

C:\Windows\System\ysOFCvI.exe

C:\Windows\System\ysOFCvI.exe

C:\Windows\System\WWixrnb.exe

C:\Windows\System\WWixrnb.exe

C:\Windows\System\YPMTRWm.exe

C:\Windows\System\YPMTRWm.exe

C:\Windows\System\TsPwNvr.exe

C:\Windows\System\TsPwNvr.exe

C:\Windows\System\XIQdYyq.exe

C:\Windows\System\XIQdYyq.exe

C:\Windows\System\YMxIHlN.exe

C:\Windows\System\YMxIHlN.exe

C:\Windows\System\pbZRONP.exe

C:\Windows\System\pbZRONP.exe

C:\Windows\System\mRphqey.exe

C:\Windows\System\mRphqey.exe

C:\Windows\System\JPxFcoE.exe

C:\Windows\System\JPxFcoE.exe

C:\Windows\System\hBiFvxh.exe

C:\Windows\System\hBiFvxh.exe

C:\Windows\System\vqcbPhp.exe

C:\Windows\System\vqcbPhp.exe

C:\Windows\System\TLXgKKg.exe

C:\Windows\System\TLXgKKg.exe

C:\Windows\System\fuwUeuo.exe

C:\Windows\System\fuwUeuo.exe

C:\Windows\System\EIKzAEH.exe

C:\Windows\System\EIKzAEH.exe

C:\Windows\System\DgWrcSH.exe

C:\Windows\System\DgWrcSH.exe

C:\Windows\System\izsDgkq.exe

C:\Windows\System\izsDgkq.exe

C:\Windows\System\ZvYrmyq.exe

C:\Windows\System\ZvYrmyq.exe

C:\Windows\System\Jjdxgsz.exe

C:\Windows\System\Jjdxgsz.exe

C:\Windows\System\FUzcnBz.exe

C:\Windows\System\FUzcnBz.exe

C:\Windows\System\xgsAtOI.exe

C:\Windows\System\xgsAtOI.exe

C:\Windows\System\CQzXmcD.exe

C:\Windows\System\CQzXmcD.exe

C:\Windows\System\sYXyrOK.exe

C:\Windows\System\sYXyrOK.exe

C:\Windows\System\wqYUeNW.exe

C:\Windows\System\wqYUeNW.exe

C:\Windows\System\nZJZjhZ.exe

C:\Windows\System\nZJZjhZ.exe

C:\Windows\System\tWHIlLD.exe

C:\Windows\System\tWHIlLD.exe

C:\Windows\System\lajqZTg.exe

C:\Windows\System\lajqZTg.exe

C:\Windows\System\XqVxyiC.exe

C:\Windows\System\XqVxyiC.exe

C:\Windows\System\XlLGpsY.exe

C:\Windows\System\XlLGpsY.exe

C:\Windows\System\usuumMk.exe

C:\Windows\System\usuumMk.exe

C:\Windows\System\DnjiAqE.exe

C:\Windows\System\DnjiAqE.exe

C:\Windows\System\FWZepkn.exe

C:\Windows\System\FWZepkn.exe

C:\Windows\System\cPsWHkO.exe

C:\Windows\System\cPsWHkO.exe

C:\Windows\System\hnMmgEG.exe

C:\Windows\System\hnMmgEG.exe

C:\Windows\System\pzEcggo.exe

C:\Windows\System\pzEcggo.exe

C:\Windows\System\GWkjXZq.exe

C:\Windows\System\GWkjXZq.exe

C:\Windows\System\QUGYtJf.exe

C:\Windows\System\QUGYtJf.exe

C:\Windows\System\isHrKQj.exe

C:\Windows\System\isHrKQj.exe

C:\Windows\System\DhtUVXg.exe

C:\Windows\System\DhtUVXg.exe

C:\Windows\System\sBbcWSw.exe

C:\Windows\System\sBbcWSw.exe

C:\Windows\System\tqcpCPa.exe

C:\Windows\System\tqcpCPa.exe

C:\Windows\System\gWWGjVX.exe

C:\Windows\System\gWWGjVX.exe

C:\Windows\System\uyBhJrT.exe

C:\Windows\System\uyBhJrT.exe

C:\Windows\System\MRwXYhy.exe

C:\Windows\System\MRwXYhy.exe

C:\Windows\System\REMzUoQ.exe

C:\Windows\System\REMzUoQ.exe

C:\Windows\System\FDwuvGu.exe

C:\Windows\System\FDwuvGu.exe

C:\Windows\System\GCHIuKB.exe

C:\Windows\System\GCHIuKB.exe

C:\Windows\System\YrDbnya.exe

C:\Windows\System\YrDbnya.exe

C:\Windows\System\oVfeCKz.exe

C:\Windows\System\oVfeCKz.exe

C:\Windows\System\WMAhNsO.exe

C:\Windows\System\WMAhNsO.exe

C:\Windows\System\WEhhZsL.exe

C:\Windows\System\WEhhZsL.exe

C:\Windows\System\CCnYoZR.exe

C:\Windows\System\CCnYoZR.exe

C:\Windows\System\OZiXIGM.exe

C:\Windows\System\OZiXIGM.exe

C:\Windows\System\jBVGmwg.exe

C:\Windows\System\jBVGmwg.exe

C:\Windows\System\TeeNsCu.exe

C:\Windows\System\TeeNsCu.exe

C:\Windows\System\pIKWroM.exe

C:\Windows\System\pIKWroM.exe

C:\Windows\System\lSsBGfM.exe

C:\Windows\System\lSsBGfM.exe

C:\Windows\System\oocLMhu.exe

C:\Windows\System\oocLMhu.exe

C:\Windows\System\JXuEdsk.exe

C:\Windows\System\JXuEdsk.exe

C:\Windows\System\tLbbrOK.exe

C:\Windows\System\tLbbrOK.exe

C:\Windows\System\vaVkgse.exe

C:\Windows\System\vaVkgse.exe

C:\Windows\System\InuESdD.exe

C:\Windows\System\InuESdD.exe

C:\Windows\System\JAvVKZr.exe

C:\Windows\System\JAvVKZr.exe

C:\Windows\System\rKCyIwf.exe

C:\Windows\System\rKCyIwf.exe

C:\Windows\System\sNzPIdF.exe

C:\Windows\System\sNzPIdF.exe

C:\Windows\System\VnuuJwO.exe

C:\Windows\System\VnuuJwO.exe

C:\Windows\System\QmPGOst.exe

C:\Windows\System\QmPGOst.exe

C:\Windows\System\pVXEhos.exe

C:\Windows\System\pVXEhos.exe

C:\Windows\System\QdfNlHX.exe

C:\Windows\System\QdfNlHX.exe

C:\Windows\System\GVmQhce.exe

C:\Windows\System\GVmQhce.exe

C:\Windows\System\zMlDCfB.exe

C:\Windows\System\zMlDCfB.exe

C:\Windows\System\qOsrqvj.exe

C:\Windows\System\qOsrqvj.exe

C:\Windows\System\KdUEgyP.exe

C:\Windows\System\KdUEgyP.exe

C:\Windows\System\IkbALCk.exe

C:\Windows\System\IkbALCk.exe

C:\Windows\System\jhfWltz.exe

C:\Windows\System\jhfWltz.exe

C:\Windows\System\xOqOTgo.exe

C:\Windows\System\xOqOTgo.exe

C:\Windows\System\xZtKzBT.exe

C:\Windows\System\xZtKzBT.exe

C:\Windows\System\CSpYmdh.exe

C:\Windows\System\CSpYmdh.exe

C:\Windows\System\ZvtCgTq.exe

C:\Windows\System\ZvtCgTq.exe

C:\Windows\System\GbwmNxr.exe

C:\Windows\System\GbwmNxr.exe

C:\Windows\System\zTqculs.exe

C:\Windows\System\zTqculs.exe

C:\Windows\System\CEVnOKq.exe

C:\Windows\System\CEVnOKq.exe

C:\Windows\System\cONDKVq.exe

C:\Windows\System\cONDKVq.exe

C:\Windows\System\vlAKaPm.exe

C:\Windows\System\vlAKaPm.exe

C:\Windows\System\cIAVSlm.exe

C:\Windows\System\cIAVSlm.exe

C:\Windows\System\dcSpEoS.exe

C:\Windows\System\dcSpEoS.exe

C:\Windows\System\dbzBGCM.exe

C:\Windows\System\dbzBGCM.exe

C:\Windows\System\KDyhypS.exe

C:\Windows\System\KDyhypS.exe

C:\Windows\System\RbPLKyZ.exe

C:\Windows\System\RbPLKyZ.exe

C:\Windows\System\DyusdVi.exe

C:\Windows\System\DyusdVi.exe

C:\Windows\System\sCbYSHA.exe

C:\Windows\System\sCbYSHA.exe

C:\Windows\System\JBxPksF.exe

C:\Windows\System\JBxPksF.exe

C:\Windows\System\HMxYdFA.exe

C:\Windows\System\HMxYdFA.exe

C:\Windows\System\uftbpXN.exe

C:\Windows\System\uftbpXN.exe

C:\Windows\System\aJOepln.exe

C:\Windows\System\aJOepln.exe

C:\Windows\System\ABxmEMf.exe

C:\Windows\System\ABxmEMf.exe

C:\Windows\System\WuNIIJB.exe

C:\Windows\System\WuNIIJB.exe

C:\Windows\System\ZJLYtCb.exe

C:\Windows\System\ZJLYtCb.exe

C:\Windows\System\WbgMmeK.exe

C:\Windows\System\WbgMmeK.exe

C:\Windows\System\yYOHfsw.exe

C:\Windows\System\yYOHfsw.exe

C:\Windows\System\jhIncOp.exe

C:\Windows\System\jhIncOp.exe

C:\Windows\System\VUpDIJU.exe

C:\Windows\System\VUpDIJU.exe

C:\Windows\System\gUvxqJb.exe

C:\Windows\System\gUvxqJb.exe

C:\Windows\System\FStvDaw.exe

C:\Windows\System\FStvDaw.exe

C:\Windows\System\fGFrEXL.exe

C:\Windows\System\fGFrEXL.exe

C:\Windows\System\SghRfJI.exe

C:\Windows\System\SghRfJI.exe

C:\Windows\System\MsXCluD.exe

C:\Windows\System\MsXCluD.exe

C:\Windows\System\LEjqJTf.exe

C:\Windows\System\LEjqJTf.exe

C:\Windows\System\ffWFmVg.exe

C:\Windows\System\ffWFmVg.exe

C:\Windows\System\DDAxOOL.exe

C:\Windows\System\DDAxOOL.exe

C:\Windows\System\KHOHaHS.exe

C:\Windows\System\KHOHaHS.exe

C:\Windows\System\tEbzjmh.exe

C:\Windows\System\tEbzjmh.exe

C:\Windows\System\JyNUqWL.exe

C:\Windows\System\JyNUqWL.exe

C:\Windows\System\AcebHNl.exe

C:\Windows\System\AcebHNl.exe

C:\Windows\System\TPEyXWi.exe

C:\Windows\System\TPEyXWi.exe

C:\Windows\System\CLsUOUU.exe

C:\Windows\System\CLsUOUU.exe

C:\Windows\System\zMsqryV.exe

C:\Windows\System\zMsqryV.exe

C:\Windows\System\uWJJagu.exe

C:\Windows\System\uWJJagu.exe

C:\Windows\System\SEMWpbv.exe

C:\Windows\System\SEMWpbv.exe

C:\Windows\System\PWsjfrS.exe

C:\Windows\System\PWsjfrS.exe

C:\Windows\System\bAeOFCo.exe

C:\Windows\System\bAeOFCo.exe

C:\Windows\System\ihzXsBP.exe

C:\Windows\System\ihzXsBP.exe

C:\Windows\System\hJXvhry.exe

C:\Windows\System\hJXvhry.exe

C:\Windows\System\zwUmiDj.exe

C:\Windows\System\zwUmiDj.exe

C:\Windows\System\ibiBNrb.exe

C:\Windows\System\ibiBNrb.exe

C:\Windows\System\uLMfMNt.exe

C:\Windows\System\uLMfMNt.exe

C:\Windows\System\IMLlbyH.exe

C:\Windows\System\IMLlbyH.exe

C:\Windows\System\Xkkoiwa.exe

C:\Windows\System\Xkkoiwa.exe

C:\Windows\System\DTdGHlm.exe

C:\Windows\System\DTdGHlm.exe

C:\Windows\System\iQXmRup.exe

C:\Windows\System\iQXmRup.exe

C:\Windows\System\PKDpsjT.exe

C:\Windows\System\PKDpsjT.exe

C:\Windows\System\oHcXYVC.exe

C:\Windows\System\oHcXYVC.exe

C:\Windows\System\tgXZbUg.exe

C:\Windows\System\tgXZbUg.exe

C:\Windows\System\njhEgct.exe

C:\Windows\System\njhEgct.exe

C:\Windows\System\BOoxuFG.exe

C:\Windows\System\BOoxuFG.exe

C:\Windows\System\SUzKEBc.exe

C:\Windows\System\SUzKEBc.exe

C:\Windows\System\IKchlEE.exe

C:\Windows\System\IKchlEE.exe

C:\Windows\System\yDuGTAn.exe

C:\Windows\System\yDuGTAn.exe

C:\Windows\System\eZRAzWt.exe

C:\Windows\System\eZRAzWt.exe

C:\Windows\System\QEnrWaD.exe

C:\Windows\System\QEnrWaD.exe

C:\Windows\System\rtooxBg.exe

C:\Windows\System\rtooxBg.exe

C:\Windows\System\TaEeFmJ.exe

C:\Windows\System\TaEeFmJ.exe

C:\Windows\System\BlbUkWw.exe

C:\Windows\System\BlbUkWw.exe

C:\Windows\System\oUdkIAs.exe

C:\Windows\System\oUdkIAs.exe

C:\Windows\System\RbGyaQN.exe

C:\Windows\System\RbGyaQN.exe

C:\Windows\System\pgRXizo.exe

C:\Windows\System\pgRXizo.exe

C:\Windows\System\zFHubjp.exe

C:\Windows\System\zFHubjp.exe

C:\Windows\System\CjkCAwG.exe

C:\Windows\System\CjkCAwG.exe

C:\Windows\System\rKEODVN.exe

C:\Windows\System\rKEODVN.exe

C:\Windows\System\QofBWHa.exe

C:\Windows\System\QofBWHa.exe

C:\Windows\System\loKvqvo.exe

C:\Windows\System\loKvqvo.exe

C:\Windows\System\jbUbClx.exe

C:\Windows\System\jbUbClx.exe

C:\Windows\System\ddwiEqg.exe

C:\Windows\System\ddwiEqg.exe

C:\Windows\System\MpuniTs.exe

C:\Windows\System\MpuniTs.exe

C:\Windows\System\wydovFE.exe

C:\Windows\System\wydovFE.exe

C:\Windows\System\PYcHFIU.exe

C:\Windows\System\PYcHFIU.exe

C:\Windows\System\NmKkmfm.exe

C:\Windows\System\NmKkmfm.exe

C:\Windows\System\zPKhbIC.exe

C:\Windows\System\zPKhbIC.exe

C:\Windows\System\lrVlDgQ.exe

C:\Windows\System\lrVlDgQ.exe

C:\Windows\System\hzIChpN.exe

C:\Windows\System\hzIChpN.exe

C:\Windows\System\hSwopVN.exe

C:\Windows\System\hSwopVN.exe

C:\Windows\System\FNmiEcd.exe

C:\Windows\System\FNmiEcd.exe

C:\Windows\System\kTDqUis.exe

C:\Windows\System\kTDqUis.exe

C:\Windows\System\jrGlZCC.exe

C:\Windows\System\jrGlZCC.exe

C:\Windows\System\xETJovC.exe

C:\Windows\System\xETJovC.exe

C:\Windows\System\iIugJJy.exe

C:\Windows\System\iIugJJy.exe

C:\Windows\System\oONZljL.exe

C:\Windows\System\oONZljL.exe

C:\Windows\System\RtQdZvb.exe

C:\Windows\System\RtQdZvb.exe

C:\Windows\System\kkEHlfQ.exe

C:\Windows\System\kkEHlfQ.exe

C:\Windows\System\Qlngjqo.exe

C:\Windows\System\Qlngjqo.exe

C:\Windows\System\geupLDv.exe

C:\Windows\System\geupLDv.exe

C:\Windows\System\KjJwlsE.exe

C:\Windows\System\KjJwlsE.exe

C:\Windows\System\AVNDQjG.exe

C:\Windows\System\AVNDQjG.exe

C:\Windows\System\CsKmhBL.exe

C:\Windows\System\CsKmhBL.exe

C:\Windows\System\SSMFXUV.exe

C:\Windows\System\SSMFXUV.exe

C:\Windows\System\wVybMiV.exe

C:\Windows\System\wVybMiV.exe

C:\Windows\System\vIabUgf.exe

C:\Windows\System\vIabUgf.exe

C:\Windows\System\FLlZbqC.exe

C:\Windows\System\FLlZbqC.exe

C:\Windows\System\hrVknqF.exe

C:\Windows\System\hrVknqF.exe

C:\Windows\System\wlOPEyj.exe

C:\Windows\System\wlOPEyj.exe

C:\Windows\System\HCnlvSE.exe

C:\Windows\System\HCnlvSE.exe

C:\Windows\System\GUzOcGf.exe

C:\Windows\System\GUzOcGf.exe

C:\Windows\System\TsGCgsW.exe

C:\Windows\System\TsGCgsW.exe

C:\Windows\System\TbqAgNO.exe

C:\Windows\System\TbqAgNO.exe

C:\Windows\System\VuKsWXH.exe

C:\Windows\System\VuKsWXH.exe

C:\Windows\System\LlzSKaa.exe

C:\Windows\System\LlzSKaa.exe

C:\Windows\System\OAmbrtk.exe

C:\Windows\System\OAmbrtk.exe

C:\Windows\System\tefDEPM.exe

C:\Windows\System\tefDEPM.exe

C:\Windows\System\MKIOSXS.exe

C:\Windows\System\MKIOSXS.exe

C:\Windows\System\GjMMmDy.exe

C:\Windows\System\GjMMmDy.exe

C:\Windows\System\GLiIiEV.exe

C:\Windows\System\GLiIiEV.exe

C:\Windows\System\CFhOVub.exe

C:\Windows\System\CFhOVub.exe

C:\Windows\System\LtdWNVg.exe

C:\Windows\System\LtdWNVg.exe

C:\Windows\System\vAcJuUe.exe

C:\Windows\System\vAcJuUe.exe

C:\Windows\System\PeEmNBB.exe

C:\Windows\System\PeEmNBB.exe

C:\Windows\System\geAoWIo.exe

C:\Windows\System\geAoWIo.exe

C:\Windows\System\cPTqORn.exe

C:\Windows\System\cPTqORn.exe

C:\Windows\System\gWLmKXJ.exe

C:\Windows\System\gWLmKXJ.exe

C:\Windows\System\HYsHbjm.exe

C:\Windows\System\HYsHbjm.exe

C:\Windows\System\thikygE.exe

C:\Windows\System\thikygE.exe

C:\Windows\System\WQqouRA.exe

C:\Windows\System\WQqouRA.exe

C:\Windows\System\ghtZASv.exe

C:\Windows\System\ghtZASv.exe

C:\Windows\System\yuuvfnX.exe

C:\Windows\System\yuuvfnX.exe

C:\Windows\System\simxseK.exe

C:\Windows\System\simxseK.exe

C:\Windows\System\oMyqAJT.exe

C:\Windows\System\oMyqAJT.exe

C:\Windows\System\lgZxnSx.exe

C:\Windows\System\lgZxnSx.exe

C:\Windows\System\wNKKCGM.exe

C:\Windows\System\wNKKCGM.exe

C:\Windows\System\dzfZvxU.exe

C:\Windows\System\dzfZvxU.exe

C:\Windows\System\wzTeuaD.exe

C:\Windows\System\wzTeuaD.exe

C:\Windows\System\ICOTgRA.exe

C:\Windows\System\ICOTgRA.exe

C:\Windows\System\MtHbHZs.exe

C:\Windows\System\MtHbHZs.exe

C:\Windows\System\mNmXlDR.exe

C:\Windows\System\mNmXlDR.exe

C:\Windows\System\IrIiCqv.exe

C:\Windows\System\IrIiCqv.exe

C:\Windows\System\xAezuti.exe

C:\Windows\System\xAezuti.exe

C:\Windows\System\sUqmbFz.exe

C:\Windows\System\sUqmbFz.exe

C:\Windows\System\DNmoEDP.exe

C:\Windows\System\DNmoEDP.exe

C:\Windows\System\mUnfUMY.exe

C:\Windows\System\mUnfUMY.exe

C:\Windows\System\pTeDhWo.exe

C:\Windows\System\pTeDhWo.exe

C:\Windows\System\irRBsjw.exe

C:\Windows\System\irRBsjw.exe

C:\Windows\System\iMgVowP.exe

C:\Windows\System\iMgVowP.exe

C:\Windows\System\nLcNhln.exe

C:\Windows\System\nLcNhln.exe

C:\Windows\System\RbOtMnM.exe

C:\Windows\System\RbOtMnM.exe

C:\Windows\System\nnlMPQb.exe

C:\Windows\System\nnlMPQb.exe

C:\Windows\System\iTQWHOh.exe

C:\Windows\System\iTQWHOh.exe

C:\Windows\System\xbttIUs.exe

C:\Windows\System\xbttIUs.exe

C:\Windows\System\PxhcMOe.exe

C:\Windows\System\PxhcMOe.exe

C:\Windows\System\SUPKsaC.exe

C:\Windows\System\SUPKsaC.exe

C:\Windows\System\uqFQTfh.exe

C:\Windows\System\uqFQTfh.exe

C:\Windows\System\ilhnFkQ.exe

C:\Windows\System\ilhnFkQ.exe

C:\Windows\System\koQvRLQ.exe

C:\Windows\System\koQvRLQ.exe

C:\Windows\System\jnqxIKa.exe

C:\Windows\System\jnqxIKa.exe

C:\Windows\System\LbnHQoT.exe

C:\Windows\System\LbnHQoT.exe

C:\Windows\System\FKeYUxV.exe

C:\Windows\System\FKeYUxV.exe

C:\Windows\System\dAeWpzR.exe

C:\Windows\System\dAeWpzR.exe

C:\Windows\System\NKkaRnQ.exe

C:\Windows\System\NKkaRnQ.exe

C:\Windows\System\bLVTlIK.exe

C:\Windows\System\bLVTlIK.exe

C:\Windows\System\xtQEgeK.exe

C:\Windows\System\xtQEgeK.exe

C:\Windows\System\SNSQHyM.exe

C:\Windows\System\SNSQHyM.exe

C:\Windows\System\UrbLaTS.exe

C:\Windows\System\UrbLaTS.exe

C:\Windows\System\jEurKWw.exe

C:\Windows\System\jEurKWw.exe

C:\Windows\System\vbtfhOO.exe

C:\Windows\System\vbtfhOO.exe

C:\Windows\System\ptwKXgR.exe

C:\Windows\System\ptwKXgR.exe

C:\Windows\System\gPZAnpo.exe

C:\Windows\System\gPZAnpo.exe

C:\Windows\System\vfjaUCf.exe

C:\Windows\System\vfjaUCf.exe

C:\Windows\System\iGxnZHd.exe

C:\Windows\System\iGxnZHd.exe

C:\Windows\System\EfvYyHF.exe

C:\Windows\System\EfvYyHF.exe

C:\Windows\System\IgYWQKv.exe

C:\Windows\System\IgYWQKv.exe

C:\Windows\System\zjsRXFw.exe

C:\Windows\System\zjsRXFw.exe

C:\Windows\System\YeMHvfj.exe

C:\Windows\System\YeMHvfj.exe

C:\Windows\System\PkOVmvD.exe

C:\Windows\System\PkOVmvD.exe

C:\Windows\System\EYYpNeL.exe

C:\Windows\System\EYYpNeL.exe

C:\Windows\System\ewRFVSp.exe

C:\Windows\System\ewRFVSp.exe

C:\Windows\System\BouWFsA.exe

C:\Windows\System\BouWFsA.exe

C:\Windows\System\WDrvKMI.exe

C:\Windows\System\WDrvKMI.exe

C:\Windows\System\LQimuGq.exe

C:\Windows\System\LQimuGq.exe

C:\Windows\System\MBLPRHS.exe

C:\Windows\System\MBLPRHS.exe

C:\Windows\System\YYEwqTa.exe

C:\Windows\System\YYEwqTa.exe

C:\Windows\System\bXBRZrW.exe

C:\Windows\System\bXBRZrW.exe

C:\Windows\System\xsMZuJf.exe

C:\Windows\System\xsMZuJf.exe

C:\Windows\System\RqdWcuH.exe

C:\Windows\System\RqdWcuH.exe

C:\Windows\System\fUYKujB.exe

C:\Windows\System\fUYKujB.exe

C:\Windows\System\GwWOoxl.exe

C:\Windows\System\GwWOoxl.exe

C:\Windows\System\XPMRpCc.exe

C:\Windows\System\XPMRpCc.exe

C:\Windows\System\YUVhWgR.exe

C:\Windows\System\YUVhWgR.exe

C:\Windows\System\iKHMhgR.exe

C:\Windows\System\iKHMhgR.exe

C:\Windows\System\VObHXqy.exe

C:\Windows\System\VObHXqy.exe

C:\Windows\System\rkEBCGl.exe

C:\Windows\System\rkEBCGl.exe

C:\Windows\System\SwvhxtC.exe

C:\Windows\System\SwvhxtC.exe

C:\Windows\System\MJNrYqk.exe

C:\Windows\System\MJNrYqk.exe

C:\Windows\System\PdcqUtC.exe

C:\Windows\System\PdcqUtC.exe

C:\Windows\System\GcwDVDO.exe

C:\Windows\System\GcwDVDO.exe

C:\Windows\System\hSInMuN.exe

C:\Windows\System\hSInMuN.exe

C:\Windows\System\MAbjBbp.exe

C:\Windows\System\MAbjBbp.exe

C:\Windows\System\KAPWXLu.exe

C:\Windows\System\KAPWXLu.exe

C:\Windows\System\lxJWGBD.exe

C:\Windows\System\lxJWGBD.exe

C:\Windows\System\fYGOZAF.exe

C:\Windows\System\fYGOZAF.exe

C:\Windows\System\ZPVWzrX.exe

C:\Windows\System\ZPVWzrX.exe

C:\Windows\System\PpPyddO.exe

C:\Windows\System\PpPyddO.exe

C:\Windows\System\TPuTiDD.exe

C:\Windows\System\TPuTiDD.exe

C:\Windows\System\COAYvIG.exe

C:\Windows\System\COAYvIG.exe

C:\Windows\System\MPIVBOc.exe

C:\Windows\System\MPIVBOc.exe

C:\Windows\System\oXxiFlL.exe

C:\Windows\System\oXxiFlL.exe

C:\Windows\System\oBLIfao.exe

C:\Windows\System\oBLIfao.exe

C:\Windows\System\vViEvFy.exe

C:\Windows\System\vViEvFy.exe

C:\Windows\System\wymlEYZ.exe

C:\Windows\System\wymlEYZ.exe

C:\Windows\System\ckAGAuF.exe

C:\Windows\System\ckAGAuF.exe

C:\Windows\System\sxRiDxd.exe

C:\Windows\System\sxRiDxd.exe

C:\Windows\System\SKTRddb.exe

C:\Windows\System\SKTRddb.exe

C:\Windows\System\mMhcLZk.exe

C:\Windows\System\mMhcLZk.exe

C:\Windows\System\xqYtRmg.exe

C:\Windows\System\xqYtRmg.exe

C:\Windows\System\eFmjsTU.exe

C:\Windows\System\eFmjsTU.exe

C:\Windows\System\NWBqASn.exe

C:\Windows\System\NWBqASn.exe

C:\Windows\System\vGgtTvN.exe

C:\Windows\System\vGgtTvN.exe

C:\Windows\System\zitHYgt.exe

C:\Windows\System\zitHYgt.exe

C:\Windows\System\RuwNVNj.exe

C:\Windows\System\RuwNVNj.exe

C:\Windows\System\pzGowWe.exe

C:\Windows\System\pzGowWe.exe

C:\Windows\System\DVhfLyG.exe

C:\Windows\System\DVhfLyG.exe

C:\Windows\System\CeRwEsJ.exe

C:\Windows\System\CeRwEsJ.exe

C:\Windows\System\DpkUapQ.exe

C:\Windows\System\DpkUapQ.exe

C:\Windows\System\JAbLoaj.exe

C:\Windows\System\JAbLoaj.exe

C:\Windows\System\oMbhNtY.exe

C:\Windows\System\oMbhNtY.exe

C:\Windows\System\szsEYyU.exe

C:\Windows\System\szsEYyU.exe

C:\Windows\System\ywGwBKB.exe

C:\Windows\System\ywGwBKB.exe

C:\Windows\System\UZWuxjZ.exe

C:\Windows\System\UZWuxjZ.exe

C:\Windows\System\kjCCKZq.exe

C:\Windows\System\kjCCKZq.exe

C:\Windows\System\RikfsCO.exe

C:\Windows\System\RikfsCO.exe

C:\Windows\System\gPmiFOn.exe

C:\Windows\System\gPmiFOn.exe

C:\Windows\System\GrWckxi.exe

C:\Windows\System\GrWckxi.exe

C:\Windows\System\YtkYsZU.exe

C:\Windows\System\YtkYsZU.exe

C:\Windows\System\yGmQrvb.exe

C:\Windows\System\yGmQrvb.exe

C:\Windows\System\UpCNZJb.exe

C:\Windows\System\UpCNZJb.exe

C:\Windows\System\ShuNuhg.exe

C:\Windows\System\ShuNuhg.exe

C:\Windows\System\FpMkmJA.exe

C:\Windows\System\FpMkmJA.exe

C:\Windows\System\CWSYuBG.exe

C:\Windows\System\CWSYuBG.exe

C:\Windows\System\nEXBadh.exe

C:\Windows\System\nEXBadh.exe

C:\Windows\System\nToFSrP.exe

C:\Windows\System\nToFSrP.exe

C:\Windows\System\WxwCZtz.exe

C:\Windows\System\WxwCZtz.exe

C:\Windows\System\otErWEp.exe

C:\Windows\System\otErWEp.exe

C:\Windows\System\wAyIGpY.exe

C:\Windows\System\wAyIGpY.exe

C:\Windows\System\aHpUjuL.exe

C:\Windows\System\aHpUjuL.exe

C:\Windows\System\VcVwbPM.exe

C:\Windows\System\VcVwbPM.exe

C:\Windows\System\KsSgJWc.exe

C:\Windows\System\KsSgJWc.exe

C:\Windows\System\vFGZBgt.exe

C:\Windows\System\vFGZBgt.exe

C:\Windows\System\fuhWhra.exe

C:\Windows\System\fuhWhra.exe

C:\Windows\System\dDFlrmg.exe

C:\Windows\System\dDFlrmg.exe

C:\Windows\System\WYsPZFp.exe

C:\Windows\System\WYsPZFp.exe

Network

Country	Destination	Domain	Proto
GB	96.16.110.114:80		tcp
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	raw.githubusercontent.com	udp
US	185.199.109.133:443	raw.githubusercontent.com	tcp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	133.109.199.185.in-addr.arpa	udp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	164.189.21.2.in-addr.arpa	udp
US	8.8.8.8:53	228.249.119.40.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	github.githubassets.com	udp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	8.8.8.8:53	154.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	13.107.253.64:443		tcp
US	8.8.8.8:53		udp
US	8.8.8.8:53		udp
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
GB	142.250.179.234:443	chromewebstore.googleapis.com	tcp
US	8.8.8.8:53	pki.goog	udp
US	8.8.8.8:53	pki.goog	udp
US	216.239.32.29:80	pki.goog	tcp
US	8.8.8.8:53	234.179.250.142.in-addr.arpa	udp
US	8.8.8.8:53	29.32.239.216.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53		udp
US	8.8.8.8:53		udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	88.251.17.2.in-addr.arpa	udp
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	41.173.79.40.in-addr.arpa	udp
DE	3.120.98.217:8080		tcp

Files

memory/4292-0-0x00007FF7D96E0000-0x00007FF7D9AD6000-memory.dmp

memory/4292-1-0x000002C95B640000-0x000002C95B650000-memory.dmp

memory/4104-3-0x00007FFCE8BB3000-0x00007FFCE8BB5000-memory.dmp

memory/4104-4-0x00000231CEBB0000-0x00000231CEBD2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g2wmt41p.1ba.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Windows\System\LhypVWS.exe

MD5	f0cf8899e7c8e222244330d6d4f10d69
SHA1	99caf607373280b7dbfc6a6c662adea14c0b3006
SHA256	a4a42e3c1d2ba1dcf30de52103f59961e5bef402a4e37f27fe657760bfb4e8a4
SHA512	0635c7739c7c941443d345dc437e9d13b7f779b95284600e7ffbc298ae9701dd53af9b73fe5ca59d7268a8ae6fc7112d5ae29977bcdca0a832ac46c03a6dac04

C:\Windows\System\WmXPKQn.exe

MD5	2a69844fd86c5229d13dc383ee9900ea
SHA1	50475c78b868d9604e7ad3c2e19f3b4f81435c4a
SHA256	582af373fda34472388dca123904e706ebe0d396acd42f2952a93980b4b9caae
SHA512	7f541b53cc678b63dfe9cf7aa89f5dc5a45af394a9ef660a9042bf371f6169406109369f62bdf9c812b4c1a8decd868e8a75e6a84a1963052258206f95bfd7c3

C:\Windows\System\MEcvQLW.exe

MD5	5d7362757090dfb1d7e9c4c04c504015
SHA1	6e79dda9d41d7136df65d48d7b3153bbf7bf4dc5
SHA256	55e581c25ffcfc884cafa351fcc05c67ca7d7e4abd0c1c424d0ac9bd200ec154
SHA512	9c9f5c1b0b2ab09cb839296af60ace78ba4e25c4cbb594d17823094fd9b09a6c44659f9ef49dfc91afa0ab3f470fbf8913b8ed5a7606a52adf83da8a8d708870

C:\Windows\System\ImUfHfE.exe

MD5	4f76e0c230a6405672bed1c62a3046df
SHA1	317a35eb0174dc970a9c053f397e1ac3bad1d676
SHA256	a99c6786a3e792994f9b39e1ea8cd76acd2e2acb13dd68af2eeb8402ce1fae13
SHA512	1ed757eb909babd30107711c85c73e57bca295b3a1ddf2148ec2fb35ce9cffb35dd0f80d03f1e111143b58f5e80ad8b05cd19ff6343b701f0649b053c8542969

C:\Windows\System\OMAxBBK.exe

MD5	a16f76a956d7c806e5acd02c88ed8f29
SHA1	30689182e41eb89ad1c452e5c86dd4e623780041
SHA256	e77b90a8edcb433a0f11f97e155896b5e46d3aa09ab61e2e88b35813d33b5a45
SHA512	8d242b11654c69ab98e55b8e5fb3ea0a98536266f69a2e8e32498e2127b7de4c401c8871a62093605a04eed42276a1890eff90f89bbcb4f8e09928586f948c11

C:\Windows\System\GIFhqcs.exe

MD5	b852de14fe69e7b15fdb4afcf27db596
SHA1	b8d52291137c249ef7e85a2dfd04e18280812249
SHA256	ab2cc12274776c098cc50d1982901863e14688e1dabdcd82dd829fc8791072c3
SHA512	54c3fdd7e7f142017727974d3117ef8e326ff512d2010502de06413377436f78bf5e087ac31afd66b3198a3f435b79531e5cf4fc59d27217605ea981bd5e89e0

C:\Windows\System\srczSVb.exe

MD5	5b92e48fa27c6f523d2959a92e411fe0
SHA1	b5d89af5846715501feaa631284b093d7208c6ea
SHA256	fc118188521cf8a1a90a87d7fb172d8379f3efe14652d6bff5541846b3ce89ab
SHA512	8e8594e615bca2015341a6a48607fdf627ca1ffa4b887306b31d95b31c73eff49d5006c18c22f993cf18c11c779cf3dd6700ffae85925a47a47e2a68f53c528c

memory/4104-47-0x00007FFCE8BB0000-0x00007FFCE9671000-memory.dmp

memory/4104-50-0x00007FFCE8BB0000-0x00007FFCE9671000-memory.dmp

C:\Windows\System\tRLTlKz.exe

MD5	dc5062ac3d64db9c468268bf81420132
SHA1	577761c1166015d7b427d10d6d97147de766fb88
SHA256	07aede42c2098d251df6553a78dbe21ac04a865e786596feabdaaac07261a2fc
SHA512	2dc77988fbe3c5a1035bee93750f19da8c868aac6de68a3b9342b6746978edd99d115e1ce7c19f679c8cecca22e5d3fae5c0cfd6f7d96e91c08918a33ba7135a

memory/2720-52-0x00007FF783410000-0x00007FF783806000-memory.dmp

memory/3604-57-0x00007FF6945D0000-0x00007FF6949C6000-memory.dmp

C:\Windows\System\XaQqDBs.exe

MD5	0e3a1de0cc4656d9a4441cbc3c50246f
SHA1	479c1c167f3d802ba0e1a7808fb37395b39ff49e
SHA256	2ebc86a9f24e6e76c9077d909aff4d28b15a7d301676025afdcb960f617c88d2
SHA512	219103633f52f5e3a5b291a339ca565553c0305582d944a902eac90fb2b8881c755efa1a870e97950a15d8347ceddb5b889f47355ddd5735d1d842b1a4207975

memory/208-60-0x00007FF6472C0000-0x00007FF6476B6000-memory.dmp

memory/2320-62-0x00007FF613160000-0x00007FF613556000-memory.dmp

memory/4252-64-0x00007FF798950000-0x00007FF798D46000-memory.dmp

memory/4860-63-0x00007FF7E4EB0000-0x00007FF7E52A6000-memory.dmp

memory/5036-69-0x00007FF6B2780000-0x00007FF6B2B76000-memory.dmp

C:\Windows\System\CIjrHjl.exe

MD5	36b4c6ff461c7f09eaf2d56959447262
SHA1	d5954ad1b35f7acd3d7dd9a61a1ed9c60e1ae7c8
SHA256	29b8e20cd264cb0bc8a33099f90a8456d4deead1c5b951f450fed444381dfea6
SHA512	1eef1ea2dfd97abc70047a6b8ff7d2964321be3608162a60634c00b4107aafe81ab80f0f28de013780dde41f6267c50c33b4304e7d00e981f72c639573df27d0

memory/4104-73-0x00007FFCE8BB0000-0x00007FFCE9671000-memory.dmp

memory/560-74-0x00007FF6FE4F0000-0x00007FF6FE8E6000-memory.dmp

C:\Windows\System\jLyPxbI.exe

MD5	2373555b97cffc30fb12ae9bbd94316c
SHA1	46119d44b24a4a31a7cdc49e353fadbcb33a67da
SHA256	175432aaf879ba173abcbd4d521bf922de36ad2bd85b522df41fc3b27491ad76
SHA512	47c96767d6fbdf123b7d828621fcfb5d1b3ffd8fa00009a63d2fb43464cb64b3ac964f936edfc1e3837bf54f7ea78f71ef0e505e06fa4cb95fe4cb723cdd6b8b

memory/1816-81-0x00007FF6ACBB0000-0x00007FF6ACFA6000-memory.dmp

C:\Windows\System\UYCaLPn.exe

MD5	2c42d28943b787e11067aed551e1624a
SHA1	da07a16c64ec1a3dc923ad130d94851ddaae00df
SHA256	6732ae527a21b3cb5a1d084a163d6b1eca7b6e293863ce8deb25728adc9b3ea4
SHA512	3e3c82f29598826f1c6e238dc3b69a460c6582250b8935e6d358e10b203f973eef5e9ba41a2b5c3ba66d73f1ffed4d70bb73c5a720b002148268d564db363af8

memory/1192-78-0x00007FF654C10000-0x00007FF655006000-memory.dmp

memory/2004-75-0x00007FF63F700000-0x00007FF63FAF6000-memory.dmp

memory/4104-88-0x00000231CF880000-0x00000231D0026000-memory.dmp

C:\Windows\System\OyBbGZx.exe

MD5	75b0c5bb0edab9cce93840b4574fbc34
SHA1	730f3333553ea25f6375caab144fa918242867a0
SHA256	29c4b1fe0bac2bbf57eb7ecc1584045fb9d2a23e23229fcc72d333e576e275c6
SHA512	afc5d3a553b3a6c5e2623ae1e5409eea6484ba55eb68ef56ae5302f55810bde81faeab4e7db286c5a7a001c3cce14933f261294614ae5e0e9d3f8034fa5eab18

memory/1964-94-0x00007FF616E50000-0x00007FF617246000-memory.dmp

memory/3624-91-0x00007FF744800000-0x00007FF744BF6000-memory.dmp

C:\Windows\System\cYQyQuI.exe

MD5	e8ac32f0a50d200be222302c0ee5c4a3
SHA1	411559d8d58b966469d135526b51b831a972c17e
SHA256	e333e1c01279d03a6da176b8b371c86fc376ce2b26ea48150ebebd07e196474a
SHA512	34d723ac1c6e16571136386b980c7dffdffb1d8aac4741815006c9880d6dd8b1cfdf6db058696b96b9d778ef2249b8068c7f15abbc070adb9079bfd30aa745ec

C:\Windows\System\WFvBpgU.exe

MD5	eb10c3003727995751789819a4c2c3cf
SHA1	170522b601d017506266be133bfed6e890620517
SHA256	a97070dd35ef2ce51a1e3240c854664e5ec685aff19dd32b219d5e4221a49647
SHA512	3c71d14ad85a17cdc77dc71075734fe5bdf27b40fa17dab148754a325d665bf2c3a4c1b1a020d2130943d26604baf5fbbe43e9ec50d2483373bbb9c2b7e0dc37

memory/4068-106-0x00007FF617910000-0x00007FF617D06000-memory.dmp

memory/4332-107-0x00007FF7AFE30000-0x00007FF7B0226000-memory.dmp

C:\Windows\System\QhUfLId.exe

MD5	874bd0f113ce7d34977972db35a3a2f1
SHA1	a9bb67d0ef650cfa5aa7a23b899bb36c67467a96
SHA256	cf987cf6460877ecbc6c1022ad290b343eda2e5ebaf35be0f947ac2a65ed3f19
SHA512	3d255acfc53ea67555a504e2544301e595417102cf686d8d70938819f02dd5aa1d452b5a72953b42e95d5898d00e4323d47a5c480b0e5bed33880cee427ce15b

C:\Windows\System\lLVWHfp.exe

MD5	5afc3c545d86b8b55c265587a8ca48e2
SHA1	b1d4a428ec336af23900b1a48f3127c0d5ba958b
SHA256	e0e9e12a574dd1a0a9b008f893f50eafb5191f159e888eed9719e6d09c2e9c00
SHA512	7bd470f24e3cb4ef89923c97dfd8d956639a5cb35b152311c0ae21a0b371c80e37d5768491624d3332a03eacb90f016e0d783acae21980f1e0987488d56dd7dc

memory/1560-123-0x00007FF615E20000-0x00007FF616216000-memory.dmp

memory/4292-127-0x00007FF7D96E0000-0x00007FF7D9AD6000-memory.dmp

C:\Windows\System\UgURamg.exe

MD5	f80e4e9c4f7ecf21a551ab6351695d3f
SHA1	7e5c508277890000676451b5dc3af84b098faae9
SHA256	6f29c6720e1d0a3c952528f35772e285bd22dc1059b3fd94427d030f18c433dd
SHA512	ed507c2f0b5cada5f49858389eeb37a9aac8d483a18118f2043efbd9469c5a092318a3ea54f48fe1b148517c4a369e0bb53dac99c4c93e6993eaad6445b57baf

C:\Windows\System\sENfjPK.exe

MD5	e4ef47542083dbc4a1b59bff92f1a37b
SHA1	eb65def42d5236f5ca087a34ff8a81610614a738
SHA256	28aa9a40f1876952f70ae8d3d2c3b399491f4821fe38a453c871091e1936d4ce
SHA512	73bc11de8c671941bef7ecf5008ae5bd6f9cca548581f375c5b7dfc87a89364cdf52dffcb0aa158c6bb3a3cf4010b78d252e25b0d2b1bd19eb372738da3f6088

C:\Windows\System\kGLNWtr.exe

MD5	3115092dd349a46a25cfb14829c65bc3
SHA1	f339716941b3c803766a056d87e1a75db8d75de3
SHA256	2a1d3f1d92935b0488d82029a44b868a46b28962a5d680c8abc9dfa389328951
SHA512	e7fcfe22c8bdcf2595ed69efceca6b3deffd6b480f4cc67c4410fedc5c2e0858dd2a98e2ae99b385a4b42ce59affb6cd7fc26604a0268a6deb7324af22217b59

memory/1120-136-0x00007FF7F49B0000-0x00007FF7F4DA6000-memory.dmp

C:\Windows\System\rTenzjm.exe

MD5	a9c1d469cba8b8cd3700dec3b6df05cd
SHA1	17ba2568982c857f8047a25b253e887f1cc1b48d
SHA256	c3bb9839d5398d5aa59f77d203a929dee33ace6056ec86218f8bc69b0c0bd25d
SHA512	5bf6e8224307ccfe5168a85f37a232c2f5951d2ba07be28506164dae7220211d2e3c512916c9e967ce57ed4f2c4b293d522b3034b4b19882d550f83e48e32ec5

memory/1772-145-0x00007FF6EBFB0000-0x00007FF6EC3A6000-memory.dmp

memory/4104-146-0x00007FFCE8BB0000-0x00007FFCE9671000-memory.dmp

memory/4300-147-0x00007FF791640000-0x00007FF791A36000-memory.dmp

memory/1860-140-0x00007FF6D7920000-0x00007FF6D7D16000-memory.dmp

memory/4104-135-0x00007FFCE8BB0000-0x00007FFCE9671000-memory.dmp

memory/3608-120-0x00007FF6CE840000-0x00007FF6CEC36000-memory.dmp

C:\Windows\System\tWybpcS.exe

MD5	91d966cff4a63880dc59f7164e262d40
SHA1	276e413d75cdf50d7855706842dfcf5ee11a44f4
SHA256	e97c19c7834739364ad11ffabadc20a3ab3a1ae0563f4f2af2adcb37c78e9f60
SHA512	e93816be66b815d8ae4feadcf05bed9e5b493b0055f0d694f6c32bea15fdabb8972262c51dfd3052948b52e99b37efc6d7c43478f54911f5ca1e401472c84410

C:\Windows\System\cuElRPw.exe

MD5	f1a53480e4bb8000a37923ad18d8e20b
SHA1	d1f9e9a92c507b5f662d48b2d6ec0dee17f94db0
SHA256	f74136eae60a41656bcb0eb4dcd8fbf3cf326cf8a1bd7b6195068793d6583557
SHA512	d31032edd0f3efb05d1e4455a93e98c921983df1cb0dc33a1f7e9548e952313ea688ad792a445a05d6243ea3efdd53632d1be15cacf0c81d8ce0f2fea8a27ebf

C:\Windows\System\ImbLuCI.exe

MD5	c7cfd6c3ad9b4ae51288f79448a668ed
SHA1	eeea42dd09a11757abba180867d12cbcfd5cf44a
SHA256	d37c503455a9bf37ae28537130b99cbbdc5d5d957c2b0d8425ce10b2062beaef
SHA512	029af62623470ef0fb80872d7a75316268fb362c0b82b136f47b8c66c4e74a1e5e860ef114f0ee86db8a77ca6ead1ddc4d2f8e8b3417472548e351734fd96bc1

memory/2800-163-0x00007FF67F7A0000-0x00007FF67FB96000-memory.dmp

memory/1816-165-0x00007FF6ACBB0000-0x00007FF6ACFA6000-memory.dmp

C:\Windows\System\hLqEvWX.exe

MD5	762d8eb83c0f32b7f7fa19210b277acb
SHA1	d6e145f8bb1e1168cda77301472530df18c8e77c
SHA256	f7396a5451b36c49be7e8ca14925b5c7b70f1564dc98a3fbec8b433208eeef93
SHA512	9456a5c47930f1dbf834540c11465812be97f0247e2249e565860a44042a047e07e0106a163c8125499a11e1da978d7a6c3198de77dabcb670b3a8ca25b56009

memory/2248-170-0x00007FF7321B0000-0x00007FF7325A6000-memory.dmp

memory/4356-164-0x00007FF6AEC30000-0x00007FF6AF026000-memory.dmp

C:\Windows\System\xjMcygh.exe

MD5	54e64c3dde760bf3f0a9a4a526b17e9d
SHA1	1b1289b0d3928eef7ae992db4cf34dc636085fcd
SHA256	faa446fae160df83ed7c53dd5a3de480938416112a9e0f6ee311176f6838ca18
SHA512	845ef768cedd8da5de9bc379ff113d8160dff3dc05a93f8904148c6e059fc388cc8de4d0f5eb7f73fb1bff578c5670784e10339314f423108b35919ec6b814b0

C:\Windows\System\XUtvdMS.exe

MD5	d051810abccf4fe6e75f1f1316b783db
SHA1	81fba67ca2892ae02d7c363ff85f25d15864d0e3
SHA256	d9281575a96893e89a770d674db3a4df46d68633984cf3c17c52d87aa50ebcd4
SHA512	f188ceb98277241057f5e82f2ee100e6218fc2f6d95121c1eb7c6ef42b1ec78d17981de068ed177ae774a8807c7491d1cdc55b004437de712fe4d553de7480c2

C:\Windows\System\JBmESVo.exe

MD5	1cafc0278bb29ab4342b33ffcadf0edf
SHA1	6b9c73b57d76707a741f5406b4d021334856a528
SHA256	59d85358c353c38ba705fcd9c6d8601e3722b6fde1ec72d5b0e376c6dbf0f9eb
SHA512	e121ee52610203419f568bafbe17bb3c04e0a9664ef378d88c5a610d73ab31d5d5453b58a50521d358f49bb9170f70e891f0cff4e39ac4ce139473bc652d3999

C:\Windows\System\LEesgnW.exe

MD5	ca36bebd9666aea1557af9e76c2b2779
SHA1	2946811f1afb27d8c6b726720a59263db8567a64
SHA256	c496caf48bd04e880c814bd21ab8cb3a307aeb9e3f3cf772c382ef7b4002e072
SHA512	691e7921d37e25393db0a23ea2652f39d088ace5efbd4f1e0f3427a18a12fa25cae1f08b8f04c67af62cef82f1d8088b2ede76e75be4fb95e006998e12cf6b8c

C:\Windows\System\VyYLlyM.exe

MD5	d539b4b938599783b36042a3cbbf4092
SHA1	480ce0ee827c11c4e87602a83429907956f9e1f8
SHA256	6772df3a135f10e65632d4a7bb6f0c5381158f9275e03853a1d3c33799c85fe8
SHA512	2533bfbefb94c915818bdaf8ddd8b2ea6224622f8b46b391ac6e3ac538a50039bc005b0bde942c2f950a542355c4e98c1209839c7e4438077b43008b96203ae7

C:\Windows\System\bMarfHM.exe

MD5	66ad5771b5d15ccbfa7978fde49f755c
SHA1	e0cc1dd84091b75ab383aa6e6bcf2b6e42aea8df
SHA256	3910ed6821804519c29a831943c41fe67461df0e842b22dada0f571e18e6ce9b
SHA512	76a2b676d8c579713d450f5931105ba5b81968d33d580978d076d2b840a8a47c7b90d85d33d9a08810803b67734f56a5187047639fddfc95536712da02e1e1a4

C:\Windows\System\PCjSYyb.exe

MD5	f84147dbbce7fd6ade062785e3c9cf58
SHA1	43fb7fc81bb82b626e300b0519ba9b0347d2b021
SHA256	47222aff8523de60f3cdb89d4df5bc77e8fad944be93514826a0c5542c92c516
SHA512	ea53f2f446a47c20731f1b8902df3bb408fcaa08bb08eedb90104779560a3d086b18205ae251743b15b094ca61bc8dd8339fa5cd5694c427b80d447268aab346

memory/1964-614-0x00007FF616E50000-0x00007FF617246000-memory.dmp

memory/2720-1286-0x00007FF783410000-0x00007FF783806000-memory.dmp

memory/3604-1321-0x00007FF6945D0000-0x00007FF6949C6000-memory.dmp

memory/208-1334-0x00007FF6472C0000-0x00007FF6476B6000-memory.dmp

memory/2320-1342-0x00007FF613160000-0x00007FF613556000-memory.dmp

memory/4252-1356-0x00007FF798950000-0x00007FF798D46000-memory.dmp

memory/4860-1359-0x00007FF7E4EB0000-0x00007FF7E52A6000-memory.dmp

memory/5036-1369-0x00007FF6B2780000-0x00007FF6B2B76000-memory.dmp

memory/560-1378-0x00007FF6FE4F0000-0x00007FF6FE8E6000-memory.dmp

memory/2004-1427-0x00007FF63F700000-0x00007FF63FAF6000-memory.dmp

memory/1192-1464-0x00007FF654C10000-0x00007FF655006000-memory.dmp

memory/1816-1483-0x00007FF6ACBB0000-0x00007FF6ACFA6000-memory.dmp

memory/3624-1485-0x00007FF744800000-0x00007FF744BF6000-memory.dmp

memory/1964-1526-0x00007FF616E50000-0x00007FF617246000-memory.dmp

memory/4068-1537-0x00007FF617910000-0x00007FF617D06000-memory.dmp

memory/4332-1547-0x00007FF7AFE30000-0x00007FF7B0226000-memory.dmp

memory/3608-1552-0x00007FF6CE840000-0x00007FF6CEC36000-memory.dmp

memory/1560-1559-0x00007FF615E20000-0x00007FF616216000-memory.dmp

memory/1120-1585-0x00007FF7F49B0000-0x00007FF7F4DA6000-memory.dmp

memory/1860-1596-0x00007FF6D7920000-0x00007FF6D7D16000-memory.dmp

memory/1772-1611-0x00007FF6EBFB0000-0x00007FF6EC3A6000-memory.dmp

memory/4300-1616-0x00007FF791640000-0x00007FF791A36000-memory.dmp

memory/2800-1800-0x00007FF67F7A0000-0x00007FF67FB96000-memory.dmp

memory/4356-1812-0x00007FF6AEC30000-0x00007FF6AF026000-memory.dmp

memory/2248-1821-0x00007FF7321B0000-0x00007FF7325A6000-memory.dmp

Sample ID	240613-1n72ksvfqp
Target	89b09e2b78db28d9fee1e5bac90502a0_NeikiAnalytics.exe
SHA256	ebf40496224879a29c3e47c935ee59ec4a5289b8bce3f55fe805caecc7702d62
Tags	miner upx xmrig execution

Malware Analysis Report

2024-07-28 23:14

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files