Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\neZYftI.exe	N/A
N/A	N/A	C:\Windows\System\nMuSwXG.exe	N/A
N/A	N/A	C:\Windows\System\vyrqcMd.exe	N/A
N/A	N/A	C:\Windows\System\QwBmwPp.exe	N/A
N/A	N/A	C:\Windows\System\mKrduaj.exe	N/A
N/A	N/A	C:\Windows\System\cQnthqd.exe	N/A
N/A	N/A	C:\Windows\System\tzRKtJk.exe	N/A
N/A	N/A	C:\Windows\System\mXosAkS.exe	N/A
N/A	N/A	C:\Windows\System\uiQFKMh.exe	N/A
N/A	N/A	C:\Windows\System\lWAUphK.exe	N/A
N/A	N/A	C:\Windows\System\UBZkGMz.exe	N/A
N/A	N/A	C:\Windows\System\tgADpeH.exe	N/A
N/A	N/A	C:\Windows\System\RVQeEjg.exe	N/A
N/A	N/A	C:\Windows\System\ALSWyzR.exe	N/A
N/A	N/A	C:\Windows\System\rXcRCYN.exe	N/A
N/A	N/A	C:\Windows\System\bbkXHHU.exe	N/A
N/A	N/A	C:\Windows\System\IjiDgKe.exe	N/A
N/A	N/A	C:\Windows\System\wYaRgtk.exe	N/A
N/A	N/A	C:\Windows\System\zsGtoLo.exe	N/A
N/A	N/A	C:\Windows\System\vnoigXl.exe	N/A
N/A	N/A	C:\Windows\System\CvXTrxE.exe	N/A
N/A	N/A	C:\Windows\System\hzfnoPh.exe	N/A
N/A	N/A	C:\Windows\System\xHDxpnO.exe	N/A
N/A	N/A	C:\Windows\System\LtwstEt.exe	N/A
N/A	N/A	C:\Windows\System\QriWwny.exe	N/A
N/A	N/A	C:\Windows\System\XWoEEhk.exe	N/A
N/A	N/A	C:\Windows\System\GRRjSyN.exe	N/A
N/A	N/A	C:\Windows\System\iMSNyPl.exe	N/A
N/A	N/A	C:\Windows\System\pzoXpwK.exe	N/A
N/A	N/A	C:\Windows\System\FzSHTxe.exe	N/A
N/A	N/A	C:\Windows\System\zuBoPLa.exe	N/A
N/A	N/A	C:\Windows\System\PBbZZbB.exe	N/A
N/A	N/A	C:\Windows\System\kvTYdwP.exe	N/A
N/A	N/A	C:\Windows\System\UdbHtuc.exe	N/A
N/A	N/A	C:\Windows\System\kZmVQyV.exe	N/A
N/A	N/A	C:\Windows\System\EHDlyjE.exe	N/A
N/A	N/A	C:\Windows\System\ADFSUDX.exe	N/A
N/A	N/A	C:\Windows\System\KcbXkft.exe	N/A
N/A	N/A	C:\Windows\System\UgejOIY.exe	N/A
N/A	N/A	C:\Windows\System\NqypxZv.exe	N/A
N/A	N/A	C:\Windows\System\sqjMACN.exe	N/A
N/A	N/A	C:\Windows\System\XzEBBRh.exe	N/A
N/A	N/A	C:\Windows\System\DqAYIAd.exe	N/A
N/A	N/A	C:\Windows\System\hChThkp.exe	N/A
N/A	N/A	C:\Windows\System\CjYPDhJ.exe	N/A
N/A	N/A	C:\Windows\System\YlVWSHH.exe	N/A
N/A	N/A	C:\Windows\System\DHeTvuW.exe	N/A
N/A	N/A	C:\Windows\System\YmmHVkk.exe	N/A
N/A	N/A	C:\Windows\System\uIOFrop.exe	N/A
N/A	N/A	C:\Windows\System\mRKeVPX.exe	N/A
N/A	N/A	C:\Windows\System\UwvkKWY.exe	N/A
N/A	N/A	C:\Windows\System\kSQYxAB.exe	N/A
N/A	N/A	C:\Windows\System\WrpBsqN.exe	N/A
N/A	N/A	C:\Windows\System\ZPhVZnv.exe	N/A
N/A	N/A	C:\Windows\System\SYcnySa.exe	N/A
N/A	N/A	C:\Windows\System\oiwQGGC.exe	N/A
N/A	N/A	C:\Windows\System\QCNjSIS.exe	N/A
N/A	N/A	C:\Windows\System\fTHuFYy.exe	N/A
N/A	N/A	C:\Windows\System\ArXxRkR.exe	N/A
N/A	N/A	C:\Windows\System\vQAcZFT.exe	N/A
N/A	N/A	C:\Windows\System\IKSGtjQ.exe	N/A
N/A	N/A	C:\Windows\System\ItpVONH.exe	N/A
N/A	N/A	C:\Windows\System\QWeZSfM.exe	N/A
N/A	N/A	C:\Windows\System\YoCyMJO.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\jkiJJBi.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hRNVPXd.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hpfxiEL.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hssUEco.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\adkwPqk.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KtYORCE.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dEUIrxP.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oRVqAJd.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uyQrGwV.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mAQEXJI.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sHCAWEK.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nBcQTTL.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BHFLNaX.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hChThkp.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gVEMrMH.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eWorWps.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\StWTHXk.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mJdnnsP.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mxhXMaP.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xrLyFGu.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UTuKyvM.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CZOAnnw.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rcrqwed.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jmSVtMO.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sdPInFx.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ARwWltM.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YQLTHgI.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BxRkXbd.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Hljtopa.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ddDMnkz.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hfgVDZL.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IgwYNSp.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SJOOscA.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gOUKvPx.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pPkWGRO.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xkvomQX.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pXfIVOZ.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jdPmhYW.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iRsbojy.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cMnskCp.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rXKXviv.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xSWnnZd.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AaMsUXC.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FQyKXDQ.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MoYEOSZ.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AjYTAMB.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JbXnwnn.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GpjDjbA.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bXvSgca.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oWkLYev.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\grlsaFN.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IukpxiW.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PbxEhcl.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hrKJFtw.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uCtWxzh.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LUgALlJ.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xDvPdcW.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XwJBrit.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UKlCAWy.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TdkPiQo.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VdNgXxb.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cFQxeAb.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TxcEpdY.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qCsSHMg.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1876 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1876 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1876 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1876 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\neZYftI.exe
PID 1876 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\neZYftI.exe
PID 1876 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\neZYftI.exe
PID 1876 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\nMuSwXG.exe
PID 1876 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\nMuSwXG.exe
PID 1876 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\nMuSwXG.exe
PID 1876 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\vyrqcMd.exe
PID 1876 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\vyrqcMd.exe
PID 1876 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\vyrqcMd.exe
PID 1876 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\tzRKtJk.exe
PID 1876 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\tzRKtJk.exe
PID 1876 wrote to memory of 2540	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\tzRKtJk.exe
PID 1876 wrote to memory of 2568	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\QwBmwPp.exe
PID 1876 wrote to memory of 2568	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\QwBmwPp.exe
PID 1876 wrote to memory of 2568	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\QwBmwPp.exe
PID 1876 wrote to memory of 2448	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\UBZkGMz.exe
PID 1876 wrote to memory of 2448	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\UBZkGMz.exe
PID 1876 wrote to memory of 2448	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\UBZkGMz.exe
PID 1876 wrote to memory of 2716	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\mKrduaj.exe
PID 1876 wrote to memory of 2716	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\mKrduaj.exe
PID 1876 wrote to memory of 2716	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\mKrduaj.exe
PID 1876 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\RVQeEjg.exe
PID 1876 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\RVQeEjg.exe
PID 1876 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\RVQeEjg.exe
PID 1876 wrote to memory of 1460	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\cQnthqd.exe
PID 1876 wrote to memory of 1460	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\cQnthqd.exe
PID 1876 wrote to memory of 1460	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\cQnthqd.exe
PID 1876 wrote to memory of 2408	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\ALSWyzR.exe
PID 1876 wrote to memory of 2408	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\ALSWyzR.exe
PID 1876 wrote to memory of 2408	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\ALSWyzR.exe
PID 1876 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\mXosAkS.exe
PID 1876 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\mXosAkS.exe
PID 1876 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\mXosAkS.exe
PID 1876 wrote to memory of 2948	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\bbkXHHU.exe
PID 1876 wrote to memory of 2948	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\bbkXHHU.exe
PID 1876 wrote to memory of 2948	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\bbkXHHU.exe
PID 1876 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\uiQFKMh.exe
PID 1876 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\uiQFKMh.exe
PID 1876 wrote to memory of 2056	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\uiQFKMh.exe
PID 1876 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\wYaRgtk.exe
PID 1876 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\wYaRgtk.exe
PID 1876 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\wYaRgtk.exe
PID 1876 wrote to memory of 2776	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\lWAUphK.exe
PID 1876 wrote to memory of 2776	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\lWAUphK.exe
PID 1876 wrote to memory of 2776	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\lWAUphK.exe
PID 1876 wrote to memory of 1316	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\zsGtoLo.exe
PID 1876 wrote to memory of 1316	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\zsGtoLo.exe
PID 1876 wrote to memory of 1316	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\zsGtoLo.exe
PID 1876 wrote to memory of 2460	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\tgADpeH.exe
PID 1876 wrote to memory of 2460	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\tgADpeH.exe
PID 1876 wrote to memory of 2460	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\tgADpeH.exe
PID 1876 wrote to memory of 1588	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\vnoigXl.exe
PID 1876 wrote to memory of 1588	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\vnoigXl.exe
PID 1876 wrote to memory of 1588	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\vnoigXl.exe
PID 1876 wrote to memory of 564	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\rXcRCYN.exe
PID 1876 wrote to memory of 564	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\rXcRCYN.exe
PID 1876 wrote to memory of 564	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\rXcRCYN.exe
PID 1876 wrote to memory of 1404	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\CvXTrxE.exe
PID 1876 wrote to memory of 1404	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\CvXTrxE.exe
PID 1876 wrote to memory of 1404	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\CvXTrxE.exe
PID 1876 wrote to memory of 2664	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\IjiDgKe.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\neZYftI.exe

C:\Windows\System\neZYftI.exe

C:\Windows\System\nMuSwXG.exe

C:\Windows\System\nMuSwXG.exe

C:\Windows\System\vyrqcMd.exe

C:\Windows\System\vyrqcMd.exe

C:\Windows\System\tzRKtJk.exe

C:\Windows\System\tzRKtJk.exe

C:\Windows\System\QwBmwPp.exe

C:\Windows\System\QwBmwPp.exe

C:\Windows\System\UBZkGMz.exe

C:\Windows\System\UBZkGMz.exe

C:\Windows\System\mKrduaj.exe

C:\Windows\System\mKrduaj.exe

C:\Windows\System\RVQeEjg.exe

C:\Windows\System\RVQeEjg.exe

C:\Windows\System\cQnthqd.exe

C:\Windows\System\cQnthqd.exe

C:\Windows\System\ALSWyzR.exe

C:\Windows\System\ALSWyzR.exe

C:\Windows\System\mXosAkS.exe

C:\Windows\System\mXosAkS.exe

C:\Windows\System\bbkXHHU.exe

C:\Windows\System\bbkXHHU.exe

C:\Windows\System\uiQFKMh.exe

C:\Windows\System\uiQFKMh.exe

C:\Windows\System\wYaRgtk.exe

C:\Windows\System\wYaRgtk.exe

C:\Windows\System\lWAUphK.exe

C:\Windows\System\lWAUphK.exe

C:\Windows\System\zsGtoLo.exe

C:\Windows\System\zsGtoLo.exe

C:\Windows\System\tgADpeH.exe

C:\Windows\System\tgADpeH.exe

C:\Windows\System\vnoigXl.exe

C:\Windows\System\vnoigXl.exe

C:\Windows\System\rXcRCYN.exe

C:\Windows\System\rXcRCYN.exe

C:\Windows\System\CvXTrxE.exe

C:\Windows\System\CvXTrxE.exe

C:\Windows\System\IjiDgKe.exe

C:\Windows\System\IjiDgKe.exe

C:\Windows\System\xHDxpnO.exe

C:\Windows\System\xHDxpnO.exe

C:\Windows\System\hzfnoPh.exe

C:\Windows\System\hzfnoPh.exe

C:\Windows\System\XWoEEhk.exe

C:\Windows\System\XWoEEhk.exe

C:\Windows\System\LtwstEt.exe

C:\Windows\System\LtwstEt.exe

C:\Windows\System\GRRjSyN.exe

C:\Windows\System\GRRjSyN.exe

C:\Windows\System\QriWwny.exe

C:\Windows\System\QriWwny.exe

C:\Windows\System\iMSNyPl.exe

C:\Windows\System\iMSNyPl.exe

C:\Windows\System\pzoXpwK.exe

C:\Windows\System\pzoXpwK.exe

C:\Windows\System\FzSHTxe.exe

C:\Windows\System\FzSHTxe.exe

C:\Windows\System\zuBoPLa.exe

C:\Windows\System\zuBoPLa.exe

C:\Windows\System\PBbZZbB.exe

C:\Windows\System\PBbZZbB.exe

C:\Windows\System\kvTYdwP.exe

C:\Windows\System\kvTYdwP.exe

C:\Windows\System\UdbHtuc.exe

C:\Windows\System\UdbHtuc.exe

C:\Windows\System\kZmVQyV.exe

C:\Windows\System\kZmVQyV.exe

C:\Windows\System\EHDlyjE.exe

C:\Windows\System\EHDlyjE.exe

C:\Windows\System\ADFSUDX.exe

C:\Windows\System\ADFSUDX.exe

C:\Windows\System\KcbXkft.exe

C:\Windows\System\KcbXkft.exe

C:\Windows\System\UgejOIY.exe

C:\Windows\System\UgejOIY.exe

C:\Windows\System\NqypxZv.exe

C:\Windows\System\NqypxZv.exe

C:\Windows\System\sqjMACN.exe

C:\Windows\System\sqjMACN.exe

C:\Windows\System\DqAYIAd.exe

C:\Windows\System\DqAYIAd.exe

C:\Windows\System\XzEBBRh.exe

C:\Windows\System\XzEBBRh.exe

C:\Windows\System\CjYPDhJ.exe

C:\Windows\System\CjYPDhJ.exe

C:\Windows\System\hChThkp.exe

C:\Windows\System\hChThkp.exe

C:\Windows\System\YlVWSHH.exe

C:\Windows\System\YlVWSHH.exe

C:\Windows\System\DHeTvuW.exe

C:\Windows\System\DHeTvuW.exe

C:\Windows\System\YmmHVkk.exe

C:\Windows\System\YmmHVkk.exe

C:\Windows\System\uIOFrop.exe

C:\Windows\System\uIOFrop.exe

C:\Windows\System\UwvkKWY.exe

C:\Windows\System\UwvkKWY.exe

C:\Windows\System\mRKeVPX.exe

C:\Windows\System\mRKeVPX.exe

C:\Windows\System\ZPhVZnv.exe

C:\Windows\System\ZPhVZnv.exe

C:\Windows\System\kSQYxAB.exe

C:\Windows\System\kSQYxAB.exe

C:\Windows\System\SYcnySa.exe

C:\Windows\System\SYcnySa.exe

C:\Windows\System\WrpBsqN.exe

C:\Windows\System\WrpBsqN.exe

C:\Windows\System\oiwQGGC.exe

C:\Windows\System\oiwQGGC.exe

C:\Windows\System\QCNjSIS.exe

C:\Windows\System\QCNjSIS.exe

C:\Windows\System\fTHuFYy.exe

C:\Windows\System\fTHuFYy.exe

C:\Windows\System\ArXxRkR.exe

C:\Windows\System\ArXxRkR.exe

C:\Windows\System\vQAcZFT.exe

C:\Windows\System\vQAcZFT.exe

C:\Windows\System\IKSGtjQ.exe

C:\Windows\System\IKSGtjQ.exe

C:\Windows\System\ItpVONH.exe

C:\Windows\System\ItpVONH.exe

C:\Windows\System\QWeZSfM.exe

C:\Windows\System\QWeZSfM.exe

C:\Windows\System\YoCyMJO.exe

C:\Windows\System\YoCyMJO.exe

C:\Windows\System\liZqsXc.exe

C:\Windows\System\liZqsXc.exe

C:\Windows\System\TXhPmZm.exe

C:\Windows\System\TXhPmZm.exe

C:\Windows\System\DnaupQF.exe

C:\Windows\System\DnaupQF.exe

C:\Windows\System\VVkyIwZ.exe

C:\Windows\System\VVkyIwZ.exe

C:\Windows\System\iMqrzfR.exe

C:\Windows\System\iMqrzfR.exe

C:\Windows\System\PBVpTDU.exe

C:\Windows\System\PBVpTDU.exe

C:\Windows\System\jdPmhYW.exe

C:\Windows\System\jdPmhYW.exe

C:\Windows\System\mQMNXge.exe

C:\Windows\System\mQMNXge.exe

C:\Windows\System\YLfLROU.exe

C:\Windows\System\YLfLROU.exe

C:\Windows\System\HpUZoTX.exe

C:\Windows\System\HpUZoTX.exe

C:\Windows\System\ZVgcFVj.exe

C:\Windows\System\ZVgcFVj.exe

C:\Windows\System\QRvVsmP.exe

C:\Windows\System\QRvVsmP.exe

C:\Windows\System\yerEwAJ.exe

C:\Windows\System\yerEwAJ.exe

C:\Windows\System\sCJqnOc.exe

C:\Windows\System\sCJqnOc.exe

C:\Windows\System\iyNLxES.exe

C:\Windows\System\iyNLxES.exe

C:\Windows\System\YdGOcKi.exe

C:\Windows\System\YdGOcKi.exe

C:\Windows\System\TQxgBEa.exe

C:\Windows\System\TQxgBEa.exe

C:\Windows\System\traCjGa.exe

C:\Windows\System\traCjGa.exe

C:\Windows\System\oSXLKfw.exe

C:\Windows\System\oSXLKfw.exe

C:\Windows\System\obUAGme.exe

C:\Windows\System\obUAGme.exe

C:\Windows\System\vGxqkyR.exe

C:\Windows\System\vGxqkyR.exe

C:\Windows\System\sbHFYXm.exe

C:\Windows\System\sbHFYXm.exe

C:\Windows\System\AvsnHCU.exe

C:\Windows\System\AvsnHCU.exe

C:\Windows\System\HBGWkao.exe

C:\Windows\System\HBGWkao.exe

C:\Windows\System\gopvpuw.exe

C:\Windows\System\gopvpuw.exe

C:\Windows\System\YcrLaVZ.exe

C:\Windows\System\YcrLaVZ.exe

C:\Windows\System\TKXvrWe.exe

C:\Windows\System\TKXvrWe.exe

C:\Windows\System\ILGjLfY.exe

C:\Windows\System\ILGjLfY.exe

C:\Windows\System\vCtOItQ.exe

C:\Windows\System\vCtOItQ.exe

C:\Windows\System\CBbICft.exe

C:\Windows\System\CBbICft.exe

C:\Windows\System\wOTOKuN.exe

C:\Windows\System\wOTOKuN.exe

C:\Windows\System\StddFeH.exe

C:\Windows\System\StddFeH.exe

C:\Windows\System\ZlSaZdD.exe

C:\Windows\System\ZlSaZdD.exe

C:\Windows\System\nDNhODA.exe

C:\Windows\System\nDNhODA.exe

C:\Windows\System\IMzmhqx.exe

C:\Windows\System\IMzmhqx.exe

C:\Windows\System\KqxVTks.exe

C:\Windows\System\KqxVTks.exe

C:\Windows\System\UcPCpeR.exe

C:\Windows\System\UcPCpeR.exe

C:\Windows\System\jBOIwOu.exe

C:\Windows\System\jBOIwOu.exe

C:\Windows\System\pbmKWjk.exe

C:\Windows\System\pbmKWjk.exe

C:\Windows\System\lfJaINO.exe

C:\Windows\System\lfJaINO.exe

C:\Windows\System\wYDlRTe.exe

C:\Windows\System\wYDlRTe.exe

C:\Windows\System\KUbeUTq.exe

C:\Windows\System\KUbeUTq.exe

C:\Windows\System\cxyobgF.exe

C:\Windows\System\cxyobgF.exe

C:\Windows\System\UAfQhpq.exe

C:\Windows\System\UAfQhpq.exe

C:\Windows\System\ccfETfK.exe

C:\Windows\System\ccfETfK.exe

C:\Windows\System\YOFgqhE.exe

C:\Windows\System\YOFgqhE.exe

C:\Windows\System\mNpiOrO.exe

C:\Windows\System\mNpiOrO.exe

C:\Windows\System\rQkcAJF.exe

C:\Windows\System\rQkcAJF.exe

C:\Windows\System\WGdXiFT.exe

C:\Windows\System\WGdXiFT.exe

C:\Windows\System\hmsClgG.exe

C:\Windows\System\hmsClgG.exe

C:\Windows\System\yHxlxSj.exe

C:\Windows\System\yHxlxSj.exe

C:\Windows\System\FIpHvmY.exe

C:\Windows\System\FIpHvmY.exe

C:\Windows\System\heYzbSb.exe

C:\Windows\System\heYzbSb.exe

C:\Windows\System\PaDrZtK.exe

C:\Windows\System\PaDrZtK.exe

C:\Windows\System\VjiYYWh.exe

C:\Windows\System\VjiYYWh.exe

C:\Windows\System\bYKXSPu.exe

C:\Windows\System\bYKXSPu.exe

C:\Windows\System\JlvMILu.exe

C:\Windows\System\JlvMILu.exe

C:\Windows\System\qbLRGMJ.exe

C:\Windows\System\qbLRGMJ.exe

C:\Windows\System\MmxxWlU.exe

C:\Windows\System\MmxxWlU.exe

C:\Windows\System\meUJjJQ.exe

C:\Windows\System\meUJjJQ.exe

C:\Windows\System\xYPXsYy.exe

C:\Windows\System\xYPXsYy.exe

C:\Windows\System\FHukukE.exe

C:\Windows\System\FHukukE.exe

C:\Windows\System\zciInZr.exe

C:\Windows\System\zciInZr.exe

C:\Windows\System\UFdtKWL.exe

C:\Windows\System\UFdtKWL.exe

C:\Windows\System\jCGBUyQ.exe

C:\Windows\System\jCGBUyQ.exe

C:\Windows\System\ZLnaHZH.exe

C:\Windows\System\ZLnaHZH.exe

C:\Windows\System\iFTxeUt.exe

C:\Windows\System\iFTxeUt.exe

C:\Windows\System\tSpzsnF.exe

C:\Windows\System\tSpzsnF.exe

C:\Windows\System\qyeKDTR.exe

C:\Windows\System\qyeKDTR.exe

C:\Windows\System\ScKqmQh.exe

C:\Windows\System\ScKqmQh.exe

C:\Windows\System\QXTzagU.exe

C:\Windows\System\QXTzagU.exe

C:\Windows\System\hYmDvIJ.exe

C:\Windows\System\hYmDvIJ.exe

C:\Windows\System\sBMfcYC.exe

C:\Windows\System\sBMfcYC.exe

C:\Windows\System\cYdnujC.exe

C:\Windows\System\cYdnujC.exe

C:\Windows\System\ajUmhuu.exe

C:\Windows\System\ajUmhuu.exe

C:\Windows\System\NuKoLSK.exe

C:\Windows\System\NuKoLSK.exe

C:\Windows\System\EbkySDz.exe

C:\Windows\System\EbkySDz.exe

C:\Windows\System\UDBqztr.exe

C:\Windows\System\UDBqztr.exe

C:\Windows\System\TBnajsu.exe

C:\Windows\System\TBnajsu.exe

C:\Windows\System\UAhVVFx.exe

C:\Windows\System\UAhVVFx.exe

C:\Windows\System\dMCevbM.exe

C:\Windows\System\dMCevbM.exe

C:\Windows\System\hjKVFPI.exe

C:\Windows\System\hjKVFPI.exe

C:\Windows\System\HPGrKqg.exe

C:\Windows\System\HPGrKqg.exe

C:\Windows\System\qyfmLcX.exe

C:\Windows\System\qyfmLcX.exe

C:\Windows\System\hXmXHmG.exe

C:\Windows\System\hXmXHmG.exe

C:\Windows\System\LWVWNgS.exe

C:\Windows\System\LWVWNgS.exe

C:\Windows\System\GXxJrXe.exe

C:\Windows\System\GXxJrXe.exe

C:\Windows\System\suUPUXE.exe

C:\Windows\System\suUPUXE.exe

C:\Windows\System\lQrDnZG.exe

C:\Windows\System\lQrDnZG.exe

C:\Windows\System\sNctijf.exe

C:\Windows\System\sNctijf.exe

C:\Windows\System\bKzWCoL.exe

C:\Windows\System\bKzWCoL.exe

C:\Windows\System\fpKmWQT.exe

C:\Windows\System\fpKmWQT.exe

C:\Windows\System\jYdovNP.exe

C:\Windows\System\jYdovNP.exe

C:\Windows\System\bnENmQo.exe

C:\Windows\System\bnENmQo.exe

C:\Windows\System\ldFgynH.exe

C:\Windows\System\ldFgynH.exe

C:\Windows\System\rMGrehb.exe

C:\Windows\System\rMGrehb.exe

C:\Windows\System\NuFikei.exe

C:\Windows\System\NuFikei.exe

C:\Windows\System\AqjmgYG.exe

C:\Windows\System\AqjmgYG.exe

C:\Windows\System\KlkKeii.exe

C:\Windows\System\KlkKeii.exe

C:\Windows\System\UhQjLeY.exe

C:\Windows\System\UhQjLeY.exe

C:\Windows\System\FWhYXTB.exe

C:\Windows\System\FWhYXTB.exe

C:\Windows\System\RaKmVRK.exe

C:\Windows\System\RaKmVRK.exe

C:\Windows\System\OKvdQfc.exe

C:\Windows\System\OKvdQfc.exe

C:\Windows\System\vajAzNu.exe

C:\Windows\System\vajAzNu.exe

C:\Windows\System\wflndCO.exe

C:\Windows\System\wflndCO.exe

C:\Windows\System\QombYVo.exe

C:\Windows\System\QombYVo.exe

C:\Windows\System\asAeyqC.exe

C:\Windows\System\asAeyqC.exe

C:\Windows\System\dxMJiqK.exe

C:\Windows\System\dxMJiqK.exe

C:\Windows\System\tQQDuLY.exe

C:\Windows\System\tQQDuLY.exe

C:\Windows\System\UnKMUFx.exe

C:\Windows\System\UnKMUFx.exe

C:\Windows\System\dquSrKB.exe

C:\Windows\System\dquSrKB.exe

C:\Windows\System\TIhvDFq.exe

C:\Windows\System\TIhvDFq.exe

C:\Windows\System\qPFmwPp.exe

C:\Windows\System\qPFmwPp.exe

C:\Windows\System\tOQGMtN.exe

C:\Windows\System\tOQGMtN.exe

C:\Windows\System\AXuiZdD.exe

C:\Windows\System\AXuiZdD.exe

C:\Windows\System\Jxmynzh.exe

C:\Windows\System\Jxmynzh.exe

C:\Windows\System\AkDIEnP.exe

C:\Windows\System\AkDIEnP.exe

C:\Windows\System\NLckZRF.exe

C:\Windows\System\NLckZRF.exe

C:\Windows\System\PbxEhcl.exe

C:\Windows\System\PbxEhcl.exe

C:\Windows\System\vwPyCsn.exe

C:\Windows\System\vwPyCsn.exe

C:\Windows\System\OYCuLze.exe

C:\Windows\System\OYCuLze.exe

C:\Windows\System\vtRHUER.exe

C:\Windows\System\vtRHUER.exe

C:\Windows\System\SnnQOtT.exe

C:\Windows\System\SnnQOtT.exe

C:\Windows\System\MERKnIo.exe

C:\Windows\System\MERKnIo.exe

C:\Windows\System\BtzagZx.exe

C:\Windows\System\BtzagZx.exe

C:\Windows\System\StYXzBg.exe

C:\Windows\System\StYXzBg.exe

C:\Windows\System\XBkznNd.exe

C:\Windows\System\XBkznNd.exe

C:\Windows\System\yIkbxed.exe

C:\Windows\System\yIkbxed.exe

C:\Windows\System\qVcVOjm.exe

C:\Windows\System\qVcVOjm.exe

C:\Windows\System\cpQABmZ.exe

C:\Windows\System\cpQABmZ.exe

C:\Windows\System\HJjaOkv.exe

C:\Windows\System\HJjaOkv.exe

C:\Windows\System\mfOBrRw.exe

C:\Windows\System\mfOBrRw.exe

C:\Windows\System\pZUnufX.exe

C:\Windows\System\pZUnufX.exe

C:\Windows\System\ybZZfiJ.exe

C:\Windows\System\ybZZfiJ.exe

C:\Windows\System\CuNFKRd.exe

C:\Windows\System\CuNFKRd.exe

C:\Windows\System\uyQrGwV.exe

C:\Windows\System\uyQrGwV.exe

C:\Windows\System\YYquNwE.exe

C:\Windows\System\YYquNwE.exe

C:\Windows\System\bxSQTHC.exe

C:\Windows\System\bxSQTHC.exe

C:\Windows\System\uorQiuR.exe

C:\Windows\System\uorQiuR.exe

C:\Windows\System\LnzLUMo.exe

C:\Windows\System\LnzLUMo.exe

C:\Windows\System\QddnpTx.exe

C:\Windows\System\QddnpTx.exe

C:\Windows\System\kEqEeZR.exe

C:\Windows\System\kEqEeZR.exe

C:\Windows\System\MMzeDeI.exe

C:\Windows\System\MMzeDeI.exe

C:\Windows\System\qEYbibd.exe

C:\Windows\System\qEYbibd.exe

C:\Windows\System\IjdxgQe.exe

C:\Windows\System\IjdxgQe.exe

C:\Windows\System\IWangFf.exe

C:\Windows\System\IWangFf.exe

C:\Windows\System\xZfiqVJ.exe

C:\Windows\System\xZfiqVJ.exe

C:\Windows\System\VsLpqUn.exe

C:\Windows\System\VsLpqUn.exe

C:\Windows\System\xqXYfSw.exe

C:\Windows\System\xqXYfSw.exe

C:\Windows\System\nxgnxrk.exe

C:\Windows\System\nxgnxrk.exe

C:\Windows\System\siQbeJz.exe

C:\Windows\System\siQbeJz.exe

C:\Windows\System\IEsfUoC.exe

C:\Windows\System\IEsfUoC.exe

C:\Windows\System\avPncXP.exe

C:\Windows\System\avPncXP.exe

C:\Windows\System\TLYvSAu.exe

C:\Windows\System\TLYvSAu.exe

C:\Windows\System\OwdQInY.exe

C:\Windows\System\OwdQInY.exe

C:\Windows\System\RrgaSsM.exe

C:\Windows\System\RrgaSsM.exe

C:\Windows\System\uHAUvCG.exe

C:\Windows\System\uHAUvCG.exe

C:\Windows\System\kxLfBRq.exe

C:\Windows\System\kxLfBRq.exe

C:\Windows\System\XshPxWk.exe

C:\Windows\System\XshPxWk.exe

C:\Windows\System\GfGMvzD.exe

C:\Windows\System\GfGMvzD.exe

C:\Windows\System\poSSJiQ.exe

C:\Windows\System\poSSJiQ.exe

C:\Windows\System\PPTZKgw.exe

C:\Windows\System\PPTZKgw.exe

C:\Windows\System\mAQEXJI.exe

C:\Windows\System\mAQEXJI.exe

C:\Windows\System\ezzVlHD.exe

C:\Windows\System\ezzVlHD.exe

C:\Windows\System\JudltVF.exe

C:\Windows\System\JudltVF.exe

C:\Windows\System\mnXVWfR.exe

C:\Windows\System\mnXVWfR.exe

C:\Windows\System\okhBMJH.exe

C:\Windows\System\okhBMJH.exe

C:\Windows\System\IjdOykX.exe

C:\Windows\System\IjdOykX.exe

C:\Windows\System\QUcFXSV.exe

C:\Windows\System\QUcFXSV.exe

C:\Windows\System\oWkLYev.exe

C:\Windows\System\oWkLYev.exe

C:\Windows\System\iicPRFs.exe

C:\Windows\System\iicPRFs.exe

C:\Windows\System\zuhHsJC.exe

C:\Windows\System\zuhHsJC.exe

C:\Windows\System\YqkpYmn.exe

C:\Windows\System\YqkpYmn.exe

C:\Windows\System\ooTvwaw.exe

C:\Windows\System\ooTvwaw.exe

C:\Windows\System\crgiSjP.exe

C:\Windows\System\crgiSjP.exe

C:\Windows\System\uJBQaCV.exe

C:\Windows\System\uJBQaCV.exe

C:\Windows\System\jYOxHXK.exe

C:\Windows\System\jYOxHXK.exe

C:\Windows\System\iPItiWs.exe

C:\Windows\System\iPItiWs.exe

C:\Windows\System\hMHilTE.exe

C:\Windows\System\hMHilTE.exe

C:\Windows\System\FBoVFSc.exe

C:\Windows\System\FBoVFSc.exe

C:\Windows\System\NXdPSZD.exe

C:\Windows\System\NXdPSZD.exe

C:\Windows\System\qcBOgav.exe

C:\Windows\System\qcBOgav.exe

C:\Windows\System\aCMkVHU.exe

C:\Windows\System\aCMkVHU.exe

C:\Windows\System\WJHTmEd.exe

C:\Windows\System\WJHTmEd.exe

C:\Windows\System\HHiIpxF.exe

C:\Windows\System\HHiIpxF.exe

C:\Windows\System\DYPcmfu.exe

C:\Windows\System\DYPcmfu.exe

C:\Windows\System\JWvRDxf.exe

C:\Windows\System\JWvRDxf.exe

C:\Windows\System\TSEwwIv.exe

C:\Windows\System\TSEwwIv.exe

C:\Windows\System\Siijzpy.exe

C:\Windows\System\Siijzpy.exe

C:\Windows\System\wOnXnEg.exe

C:\Windows\System\wOnXnEg.exe

C:\Windows\System\KyKyRWa.exe

C:\Windows\System\KyKyRWa.exe

C:\Windows\System\fpmTwKs.exe

C:\Windows\System\fpmTwKs.exe

C:\Windows\System\QMYtaZQ.exe

C:\Windows\System\QMYtaZQ.exe

C:\Windows\System\KtFFLaY.exe

C:\Windows\System\KtFFLaY.exe

C:\Windows\System\mHPyEbW.exe

C:\Windows\System\mHPyEbW.exe

C:\Windows\System\aPsHcwD.exe

C:\Windows\System\aPsHcwD.exe

C:\Windows\System\lyzQyWm.exe

C:\Windows\System\lyzQyWm.exe

C:\Windows\System\iOULeqo.exe

C:\Windows\System\iOULeqo.exe

C:\Windows\System\nkrnXzq.exe

C:\Windows\System\nkrnXzq.exe

C:\Windows\System\lJhNxra.exe

C:\Windows\System\lJhNxra.exe

C:\Windows\System\stizklB.exe

C:\Windows\System\stizklB.exe

C:\Windows\System\LQVLaeE.exe

C:\Windows\System\LQVLaeE.exe

C:\Windows\System\zuqUzWq.exe

C:\Windows\System\zuqUzWq.exe

C:\Windows\System\VzRLYYd.exe

C:\Windows\System\VzRLYYd.exe

C:\Windows\System\WNNiTNp.exe

C:\Windows\System\WNNiTNp.exe

C:\Windows\System\RgpuQje.exe

C:\Windows\System\RgpuQje.exe

C:\Windows\System\dfjTdCi.exe

C:\Windows\System\dfjTdCi.exe

C:\Windows\System\pKNUrFq.exe

C:\Windows\System\pKNUrFq.exe

C:\Windows\System\KCskKju.exe

C:\Windows\System\KCskKju.exe

C:\Windows\System\gCVvTKY.exe

C:\Windows\System\gCVvTKY.exe

C:\Windows\System\MZTAyzb.exe

C:\Windows\System\MZTAyzb.exe

C:\Windows\System\jDTAsOm.exe

C:\Windows\System\jDTAsOm.exe

C:\Windows\System\fGDrjFj.exe

C:\Windows\System\fGDrjFj.exe

C:\Windows\System\Tzrdqvm.exe

C:\Windows\System\Tzrdqvm.exe

C:\Windows\System\PBwVzFL.exe

C:\Windows\System\PBwVzFL.exe

C:\Windows\System\mYohpUp.exe

C:\Windows\System\mYohpUp.exe

C:\Windows\System\fNDnqRQ.exe

C:\Windows\System\fNDnqRQ.exe

C:\Windows\System\jrPiWNB.exe

C:\Windows\System\jrPiWNB.exe

C:\Windows\System\LUDRjRT.exe

C:\Windows\System\LUDRjRT.exe

C:\Windows\System\ckkSBpV.exe

C:\Windows\System\ckkSBpV.exe

C:\Windows\System\WvXfixg.exe

C:\Windows\System\WvXfixg.exe

C:\Windows\System\eCCVZlj.exe

C:\Windows\System\eCCVZlj.exe

C:\Windows\System\UeKjqqV.exe

C:\Windows\System\UeKjqqV.exe

C:\Windows\System\gRefhdR.exe

C:\Windows\System\gRefhdR.exe

C:\Windows\System\acwaYLV.exe

C:\Windows\System\acwaYLV.exe

C:\Windows\System\AuzzjAg.exe

C:\Windows\System\AuzzjAg.exe

C:\Windows\System\AVjmoIH.exe

C:\Windows\System\AVjmoIH.exe

C:\Windows\System\ZxcHkJg.exe

C:\Windows\System\ZxcHkJg.exe

C:\Windows\System\ewRoeCG.exe

C:\Windows\System\ewRoeCG.exe

C:\Windows\System\YwxkMqY.exe

C:\Windows\System\YwxkMqY.exe

C:\Windows\System\tZgumoh.exe

C:\Windows\System\tZgumoh.exe

C:\Windows\System\KlpGiUN.exe

C:\Windows\System\KlpGiUN.exe

C:\Windows\System\kOwULkb.exe

C:\Windows\System\kOwULkb.exe

C:\Windows\System\OelewHb.exe

C:\Windows\System\OelewHb.exe

C:\Windows\System\FBMugir.exe

C:\Windows\System\FBMugir.exe

C:\Windows\System\FPzdoFk.exe

C:\Windows\System\FPzdoFk.exe

C:\Windows\System\BZvOXBX.exe

C:\Windows\System\BZvOXBX.exe

C:\Windows\System\BEGwOFH.exe

C:\Windows\System\BEGwOFH.exe

C:\Windows\System\DDDjAxg.exe

C:\Windows\System\DDDjAxg.exe

C:\Windows\System\zMoEGhB.exe

C:\Windows\System\zMoEGhB.exe

C:\Windows\System\DFIUpIm.exe

C:\Windows\System\DFIUpIm.exe

C:\Windows\System\uSbSxfJ.exe

C:\Windows\System\uSbSxfJ.exe

C:\Windows\System\fvrFpJf.exe

C:\Windows\System\fvrFpJf.exe

C:\Windows\System\atngWCb.exe

C:\Windows\System\atngWCb.exe

C:\Windows\System\sQjpkuF.exe

C:\Windows\System\sQjpkuF.exe

C:\Windows\System\cMnskCp.exe

C:\Windows\System\cMnskCp.exe

C:\Windows\System\goZNHgO.exe

C:\Windows\System\goZNHgO.exe

C:\Windows\System\jPWeTok.exe

C:\Windows\System\jPWeTok.exe

C:\Windows\System\hGDvIIP.exe

C:\Windows\System\hGDvIIP.exe

C:\Windows\System\ARcnJSw.exe

C:\Windows\System\ARcnJSw.exe

C:\Windows\System\IKvZsJF.exe

C:\Windows\System\IKvZsJF.exe

C:\Windows\System\pPjjMOe.exe

C:\Windows\System\pPjjMOe.exe

C:\Windows\System\aqswTYH.exe

C:\Windows\System\aqswTYH.exe

C:\Windows\System\JLYUcAC.exe

C:\Windows\System\JLYUcAC.exe

C:\Windows\System\ZqlDBlu.exe

C:\Windows\System\ZqlDBlu.exe

C:\Windows\System\ZPSGwOE.exe

C:\Windows\System\ZPSGwOE.exe

C:\Windows\System\DzURcxs.exe

C:\Windows\System\DzURcxs.exe

C:\Windows\System\iCMQAuA.exe

C:\Windows\System\iCMQAuA.exe

C:\Windows\System\zqucFyB.exe

C:\Windows\System\zqucFyB.exe

C:\Windows\System\CrwubVc.exe

C:\Windows\System\CrwubVc.exe

C:\Windows\System\QAMbuhC.exe

C:\Windows\System\QAMbuhC.exe

C:\Windows\System\lEtHrYq.exe

C:\Windows\System\lEtHrYq.exe

C:\Windows\System\RVLmekC.exe

C:\Windows\System\RVLmekC.exe

C:\Windows\System\jGJrpWB.exe

C:\Windows\System\jGJrpWB.exe

C:\Windows\System\ZvWAlsp.exe

C:\Windows\System\ZvWAlsp.exe

C:\Windows\System\fwkwMhz.exe

C:\Windows\System\fwkwMhz.exe

C:\Windows\System\zSzqMyg.exe

C:\Windows\System\zSzqMyg.exe

C:\Windows\System\ioYcFJp.exe

C:\Windows\System\ioYcFJp.exe

C:\Windows\System\KXDQWwy.exe

C:\Windows\System\KXDQWwy.exe

C:\Windows\System\BUYZXzP.exe

C:\Windows\System\BUYZXzP.exe

C:\Windows\System\TlVIujb.exe

C:\Windows\System\TlVIujb.exe

C:\Windows\System\jSiIpvB.exe

C:\Windows\System\jSiIpvB.exe

C:\Windows\System\NNBwbnx.exe

C:\Windows\System\NNBwbnx.exe

C:\Windows\System\nQICaad.exe

C:\Windows\System\nQICaad.exe

C:\Windows\System\yLXACtO.exe

C:\Windows\System\yLXACtO.exe

C:\Windows\System\OxxUzpQ.exe

C:\Windows\System\OxxUzpQ.exe

C:\Windows\System\gQSYrDM.exe

C:\Windows\System\gQSYrDM.exe

C:\Windows\System\iSoUGOz.exe

C:\Windows\System\iSoUGOz.exe

C:\Windows\System\tPxwKnb.exe

C:\Windows\System\tPxwKnb.exe

C:\Windows\System\qmPyhwM.exe

C:\Windows\System\qmPyhwM.exe

C:\Windows\System\lQNILRz.exe

C:\Windows\System\lQNILRz.exe

C:\Windows\System\SVxdaqW.exe

C:\Windows\System\SVxdaqW.exe

C:\Windows\System\OZtYqWn.exe

C:\Windows\System\OZtYqWn.exe

C:\Windows\System\PCUHmHV.exe

C:\Windows\System\PCUHmHV.exe

C:\Windows\System\xqIhudW.exe

C:\Windows\System\xqIhudW.exe

C:\Windows\System\TTDkAOj.exe

C:\Windows\System\TTDkAOj.exe

C:\Windows\System\VswwpDs.exe

C:\Windows\System\VswwpDs.exe

C:\Windows\System\bcMhWen.exe

C:\Windows\System\bcMhWen.exe

C:\Windows\System\rJTbWql.exe

C:\Windows\System\rJTbWql.exe

C:\Windows\System\DOKrJQt.exe

C:\Windows\System\DOKrJQt.exe

C:\Windows\System\AbCNpPA.exe

C:\Windows\System\AbCNpPA.exe

C:\Windows\System\jbTOWwR.exe

C:\Windows\System\jbTOWwR.exe

C:\Windows\System\KPMCAWt.exe

C:\Windows\System\KPMCAWt.exe

C:\Windows\System\CYockWC.exe

C:\Windows\System\CYockWC.exe

C:\Windows\System\HLRDnZr.exe

C:\Windows\System\HLRDnZr.exe

C:\Windows\System\LtJUmGU.exe

C:\Windows\System\LtJUmGU.exe

C:\Windows\System\FLRjaQd.exe

C:\Windows\System\FLRjaQd.exe

C:\Windows\System\iLhDAUA.exe

C:\Windows\System\iLhDAUA.exe

C:\Windows\System\ddDMnkz.exe

C:\Windows\System\ddDMnkz.exe

C:\Windows\System\WHPgvbe.exe

C:\Windows\System\WHPgvbe.exe

C:\Windows\System\VduthnN.exe

C:\Windows\System\VduthnN.exe

C:\Windows\System\esbhuet.exe

C:\Windows\System\esbhuet.exe

C:\Windows\System\XUohPWd.exe

C:\Windows\System\XUohPWd.exe

C:\Windows\System\mICDRdC.exe

C:\Windows\System\mICDRdC.exe

C:\Windows\System\IeAQNnV.exe

C:\Windows\System\IeAQNnV.exe

C:\Windows\System\TfIKEgb.exe

C:\Windows\System\TfIKEgb.exe

C:\Windows\System\IgavaOr.exe

C:\Windows\System\IgavaOr.exe

C:\Windows\System\fpshgsN.exe

C:\Windows\System\fpshgsN.exe

C:\Windows\System\FrbmSGc.exe

C:\Windows\System\FrbmSGc.exe

C:\Windows\System\iMXTrbR.exe

C:\Windows\System\iMXTrbR.exe

C:\Windows\System\rXKXviv.exe

C:\Windows\System\rXKXviv.exe

C:\Windows\System\iMpFrQh.exe

C:\Windows\System\iMpFrQh.exe

C:\Windows\System\OIFfWds.exe

C:\Windows\System\OIFfWds.exe

C:\Windows\System\sMYJHhU.exe

C:\Windows\System\sMYJHhU.exe

C:\Windows\System\sYtvtsn.exe

C:\Windows\System\sYtvtsn.exe

C:\Windows\System\sMUqKdn.exe

C:\Windows\System\sMUqKdn.exe

C:\Windows\System\QDJLXLe.exe

C:\Windows\System\QDJLXLe.exe

C:\Windows\System\LEFVAac.exe

C:\Windows\System\LEFVAac.exe

C:\Windows\System\xSWnnZd.exe

C:\Windows\System\xSWnnZd.exe

C:\Windows\System\uHmrjGC.exe

C:\Windows\System\uHmrjGC.exe

C:\Windows\System\xtubFmU.exe

C:\Windows\System\xtubFmU.exe

C:\Windows\System\ZtHqCVm.exe

C:\Windows\System\ZtHqCVm.exe

C:\Windows\System\mLbRyAm.exe

C:\Windows\System\mLbRyAm.exe

C:\Windows\System\XHtNEjJ.exe

C:\Windows\System\XHtNEjJ.exe

C:\Windows\System\dMkgqPf.exe

C:\Windows\System\dMkgqPf.exe

C:\Windows\System\JeXbCsj.exe

C:\Windows\System\JeXbCsj.exe

C:\Windows\System\XWoOQSs.exe

C:\Windows\System\XWoOQSs.exe

C:\Windows\System\yxAHIdl.exe

C:\Windows\System\yxAHIdl.exe

C:\Windows\System\lcAGFIo.exe

C:\Windows\System\lcAGFIo.exe

C:\Windows\System\kWhNWAi.exe

C:\Windows\System\kWhNWAi.exe

C:\Windows\System\JLrHJBy.exe

C:\Windows\System\JLrHJBy.exe

C:\Windows\System\onQFVns.exe

C:\Windows\System\onQFVns.exe

C:\Windows\System\NXNtZKs.exe

C:\Windows\System\NXNtZKs.exe

C:\Windows\System\GYtIkZG.exe

C:\Windows\System\GYtIkZG.exe

C:\Windows\System\AfsmUyq.exe

C:\Windows\System\AfsmUyq.exe

C:\Windows\System\TbSSmQI.exe

C:\Windows\System\TbSSmQI.exe

C:\Windows\System\wvzdSNs.exe

C:\Windows\System\wvzdSNs.exe

C:\Windows\System\rDhkNXA.exe

C:\Windows\System\rDhkNXA.exe

C:\Windows\System\iCJqvSG.exe

C:\Windows\System\iCJqvSG.exe

C:\Windows\System\IWEVdlV.exe

C:\Windows\System\IWEVdlV.exe

C:\Windows\System\OnYQLCJ.exe

C:\Windows\System\OnYQLCJ.exe

C:\Windows\System\Svyjodr.exe

C:\Windows\System\Svyjodr.exe

C:\Windows\System\YqAMnqN.exe

C:\Windows\System\YqAMnqN.exe

C:\Windows\System\YZZqmwN.exe

C:\Windows\System\YZZqmwN.exe

C:\Windows\System\WZgSWze.exe

C:\Windows\System\WZgSWze.exe

C:\Windows\System\yRnSCDU.exe

C:\Windows\System\yRnSCDU.exe

C:\Windows\System\sMVCxnM.exe

C:\Windows\System\sMVCxnM.exe

C:\Windows\System\uqtARXM.exe

C:\Windows\System\uqtARXM.exe

C:\Windows\System\CqNVykR.exe

C:\Windows\System\CqNVykR.exe

C:\Windows\System\VbhLFBW.exe

C:\Windows\System\VbhLFBW.exe

C:\Windows\System\nGzdaij.exe

C:\Windows\System\nGzdaij.exe

C:\Windows\System\pAqGjQv.exe

C:\Windows\System\pAqGjQv.exe

C:\Windows\System\zpExNiR.exe

C:\Windows\System\zpExNiR.exe

C:\Windows\System\IkErsjv.exe

C:\Windows\System\IkErsjv.exe

C:\Windows\System\WSHkbth.exe

C:\Windows\System\WSHkbth.exe

C:\Windows\System\mViGPZu.exe

C:\Windows\System\mViGPZu.exe

C:\Windows\System\cwBnSXc.exe

C:\Windows\System\cwBnSXc.exe

C:\Windows\System\EUJYCoj.exe

C:\Windows\System\EUJYCoj.exe

C:\Windows\System\FIiVdMv.exe

C:\Windows\System\FIiVdMv.exe

C:\Windows\System\ZTMmVxQ.exe

C:\Windows\System\ZTMmVxQ.exe

C:\Windows\System\VMzzKRl.exe

C:\Windows\System\VMzzKRl.exe

C:\Windows\System\MOcftEW.exe

C:\Windows\System\MOcftEW.exe

C:\Windows\System\grlsaFN.exe

C:\Windows\System\grlsaFN.exe

C:\Windows\System\AqjQHuv.exe

C:\Windows\System\AqjQHuv.exe

C:\Windows\System\yQPLodD.exe

C:\Windows\System\yQPLodD.exe

C:\Windows\System\GTQjVsy.exe

C:\Windows\System\GTQjVsy.exe

C:\Windows\System\jvdHBPM.exe

C:\Windows\System\jvdHBPM.exe

C:\Windows\System\PWwQoMg.exe

C:\Windows\System\PWwQoMg.exe

C:\Windows\System\BxchjIL.exe

C:\Windows\System\BxchjIL.exe

C:\Windows\System\XNlJvQD.exe

C:\Windows\System\XNlJvQD.exe

C:\Windows\System\HWMXeoE.exe

C:\Windows\System\HWMXeoE.exe

C:\Windows\System\jAdKtwd.exe

C:\Windows\System\jAdKtwd.exe

C:\Windows\System\BTbGsag.exe

C:\Windows\System\BTbGsag.exe

C:\Windows\System\QIDbYFR.exe

C:\Windows\System\QIDbYFR.exe

C:\Windows\System\qMFBljz.exe

C:\Windows\System\qMFBljz.exe

C:\Windows\System\jaWeEDu.exe

C:\Windows\System\jaWeEDu.exe

C:\Windows\System\oFRjWQJ.exe

C:\Windows\System\oFRjWQJ.exe

C:\Windows\System\GsHdtrc.exe

C:\Windows\System\GsHdtrc.exe

C:\Windows\System\ecvwiDT.exe

C:\Windows\System\ecvwiDT.exe

C:\Windows\System\LtqOTmr.exe

C:\Windows\System\LtqOTmr.exe

C:\Windows\System\IOBMfCe.exe

C:\Windows\System\IOBMfCe.exe

C:\Windows\System\JoIDGOt.exe

C:\Windows\System\JoIDGOt.exe

C:\Windows\System\wBotjrr.exe

C:\Windows\System\wBotjrr.exe

C:\Windows\System\kMGPThc.exe

C:\Windows\System\kMGPThc.exe

C:\Windows\System\krRFPSD.exe

C:\Windows\System\krRFPSD.exe

C:\Windows\System\ZiUqdIA.exe

C:\Windows\System\ZiUqdIA.exe

C:\Windows\System\PlcNoex.exe

C:\Windows\System\PlcNoex.exe

C:\Windows\System\saCVXDk.exe

C:\Windows\System\saCVXDk.exe

C:\Windows\System\sukMChF.exe

C:\Windows\System\sukMChF.exe

C:\Windows\System\VYaXAhk.exe

C:\Windows\System\VYaXAhk.exe

C:\Windows\System\tPiijBi.exe

C:\Windows\System\tPiijBi.exe

C:\Windows\System\sOPVILO.exe

C:\Windows\System\sOPVILO.exe

C:\Windows\System\eYaEiee.exe

C:\Windows\System\eYaEiee.exe

C:\Windows\System\LKWgsGv.exe

C:\Windows\System\LKWgsGv.exe

C:\Windows\System\AKbLCwG.exe

C:\Windows\System\AKbLCwG.exe

C:\Windows\System\WLpPCYq.exe

C:\Windows\System\WLpPCYq.exe

C:\Windows\System\BkGccsn.exe

C:\Windows\System\BkGccsn.exe

C:\Windows\System\zLPskcs.exe

C:\Windows\System\zLPskcs.exe

C:\Windows\System\OEAxlCi.exe

C:\Windows\System\OEAxlCi.exe

C:\Windows\System\KShmMJd.exe

C:\Windows\System\KShmMJd.exe

C:\Windows\System\flayLFa.exe

C:\Windows\System\flayLFa.exe

C:\Windows\System\KwtcUfc.exe

C:\Windows\System\KwtcUfc.exe

C:\Windows\System\zXLQbHY.exe

C:\Windows\System\zXLQbHY.exe

C:\Windows\System\rTIGMYq.exe

C:\Windows\System\rTIGMYq.exe

C:\Windows\System\eIlvHkw.exe

C:\Windows\System\eIlvHkw.exe

C:\Windows\System\SBCjMne.exe

C:\Windows\System\SBCjMne.exe

C:\Windows\System\PHHdWTX.exe

C:\Windows\System\PHHdWTX.exe

C:\Windows\System\EKCYzLv.exe

C:\Windows\System\EKCYzLv.exe

C:\Windows\System\IbwZnDg.exe

C:\Windows\System\IbwZnDg.exe

C:\Windows\System\BdTOPvw.exe

C:\Windows\System\BdTOPvw.exe

C:\Windows\System\vEsKpwH.exe

C:\Windows\System\vEsKpwH.exe

C:\Windows\System\pPkWGRO.exe

C:\Windows\System\pPkWGRO.exe

C:\Windows\System\JrVEGTt.exe

C:\Windows\System\JrVEGTt.exe

C:\Windows\System\rbArcJI.exe

C:\Windows\System\rbArcJI.exe

C:\Windows\System\lsHPxvV.exe

C:\Windows\System\lsHPxvV.exe

C:\Windows\System\hrKJFtw.exe

C:\Windows\System\hrKJFtw.exe

C:\Windows\System\IxNvjwz.exe

C:\Windows\System\IxNvjwz.exe

C:\Windows\System\fzGkqSK.exe

C:\Windows\System\fzGkqSK.exe

C:\Windows\System\CUHJEHo.exe

C:\Windows\System\CUHJEHo.exe

C:\Windows\System\pSizJcF.exe

C:\Windows\System\pSizJcF.exe

C:\Windows\System\QKmDlrR.exe

C:\Windows\System\QKmDlrR.exe

C:\Windows\System\OzOFvQm.exe

C:\Windows\System\OzOFvQm.exe

C:\Windows\System\vwVcKoO.exe

C:\Windows\System\vwVcKoO.exe

C:\Windows\System\uCtWxzh.exe

C:\Windows\System\uCtWxzh.exe

C:\Windows\System\CUSAhYx.exe

C:\Windows\System\CUSAhYx.exe

C:\Windows\System\peDJNci.exe

C:\Windows\System\peDJNci.exe

C:\Windows\System\VHqXddb.exe

C:\Windows\System\VHqXddb.exe

C:\Windows\System\CFlUqoe.exe

C:\Windows\System\CFlUqoe.exe

C:\Windows\System\Ncggzvf.exe

C:\Windows\System\Ncggzvf.exe

C:\Windows\System\TqCdRIS.exe

C:\Windows\System\TqCdRIS.exe

C:\Windows\System\WboGZqz.exe

C:\Windows\System\WboGZqz.exe

C:\Windows\System\PiEgYfb.exe

C:\Windows\System\PiEgYfb.exe

C:\Windows\System\StWTHXk.exe

C:\Windows\System\StWTHXk.exe

C:\Windows\System\dZtvfwr.exe

C:\Windows\System\dZtvfwr.exe

C:\Windows\System\UBRJfxK.exe

C:\Windows\System\UBRJfxK.exe

C:\Windows\System\cXgToZR.exe

C:\Windows\System\cXgToZR.exe

C:\Windows\System\exqgyiB.exe

C:\Windows\System\exqgyiB.exe

C:\Windows\System\ifNDfGH.exe

C:\Windows\System\ifNDfGH.exe

C:\Windows\System\ZeZTFAi.exe

C:\Windows\System\ZeZTFAi.exe

C:\Windows\System\fNrFduZ.exe

C:\Windows\System\fNrFduZ.exe

C:\Windows\System\CjdcEEY.exe

C:\Windows\System\CjdcEEY.exe

C:\Windows\System\ZqBAQxy.exe

C:\Windows\System\ZqBAQxy.exe

C:\Windows\System\eZocUGo.exe

C:\Windows\System\eZocUGo.exe

C:\Windows\System\CVtCphb.exe

C:\Windows\System\CVtCphb.exe

C:\Windows\System\WGBwnFD.exe

C:\Windows\System\WGBwnFD.exe

C:\Windows\System\fsDZmHE.exe

C:\Windows\System\fsDZmHE.exe

C:\Windows\System\IZifZHs.exe

C:\Windows\System\IZifZHs.exe

C:\Windows\System\tzYCOfc.exe

C:\Windows\System\tzYCOfc.exe

C:\Windows\System\nJxMsuN.exe

C:\Windows\System\nJxMsuN.exe

C:\Windows\System\joRJvbM.exe

C:\Windows\System\joRJvbM.exe

C:\Windows\System\PaYTtUM.exe

C:\Windows\System\PaYTtUM.exe

C:\Windows\System\tZVyYcD.exe

C:\Windows\System\tZVyYcD.exe

C:\Windows\System\lReLejR.exe

C:\Windows\System\lReLejR.exe

C:\Windows\System\ttShAfz.exe

C:\Windows\System\ttShAfz.exe

C:\Windows\System\vMBPtSP.exe

C:\Windows\System\vMBPtSP.exe

C:\Windows\System\EIMnIBj.exe

C:\Windows\System\EIMnIBj.exe

C:\Windows\System\XIKPeWX.exe

C:\Windows\System\XIKPeWX.exe

C:\Windows\System\tbyRHMd.exe

C:\Windows\System\tbyRHMd.exe

C:\Windows\System\mbmVTuU.exe

C:\Windows\System\mbmVTuU.exe

C:\Windows\System\EOjGSWo.exe

C:\Windows\System\EOjGSWo.exe

C:\Windows\System\kPnGXhD.exe

C:\Windows\System\kPnGXhD.exe

C:\Windows\System\jmSVtMO.exe

C:\Windows\System\jmSVtMO.exe

C:\Windows\System\sCJccEc.exe

C:\Windows\System\sCJccEc.exe

C:\Windows\System\mefqZin.exe

C:\Windows\System\mefqZin.exe

C:\Windows\System\eWTAuCb.exe

C:\Windows\System\eWTAuCb.exe

C:\Windows\System\fXdynKJ.exe

C:\Windows\System\fXdynKJ.exe

C:\Windows\System\XpkYUAm.exe

C:\Windows\System\XpkYUAm.exe

C:\Windows\System\yQtYCUx.exe

C:\Windows\System\yQtYCUx.exe

C:\Windows\System\ljyoflD.exe

C:\Windows\System\ljyoflD.exe

C:\Windows\System\XWWbmSk.exe

C:\Windows\System\XWWbmSk.exe

C:\Windows\System\yJfmjyM.exe

C:\Windows\System\yJfmjyM.exe

C:\Windows\System\PEmhjiX.exe

C:\Windows\System\PEmhjiX.exe

C:\Windows\System\KYhkWsZ.exe

C:\Windows\System\KYhkWsZ.exe

C:\Windows\System\eEnEovM.exe

C:\Windows\System\eEnEovM.exe

C:\Windows\System\RmXpgIG.exe

C:\Windows\System\RmXpgIG.exe

C:\Windows\System\AbrRSNL.exe

C:\Windows\System\AbrRSNL.exe

C:\Windows\System\aqkZWRT.exe

C:\Windows\System\aqkZWRT.exe

C:\Windows\System\sbBAZnF.exe

C:\Windows\System\sbBAZnF.exe

C:\Windows\System\WJRBKym.exe

C:\Windows\System\WJRBKym.exe

C:\Windows\System\iiaTfdu.exe

C:\Windows\System\iiaTfdu.exe

C:\Windows\System\VcQuWYZ.exe

C:\Windows\System\VcQuWYZ.exe

C:\Windows\System\lwGhsQO.exe

C:\Windows\System\lwGhsQO.exe

C:\Windows\System\ZPHMGVM.exe

C:\Windows\System\ZPHMGVM.exe

C:\Windows\System\UyYoZoT.exe

C:\Windows\System\UyYoZoT.exe

C:\Windows\System\urPZHaX.exe

C:\Windows\System\urPZHaX.exe

C:\Windows\System\QyFbOCq.exe

C:\Windows\System\QyFbOCq.exe

C:\Windows\System\tVEXVup.exe

C:\Windows\System\tVEXVup.exe

C:\Windows\System\VLKQVAU.exe

C:\Windows\System\VLKQVAU.exe

C:\Windows\System\fADBtpk.exe

C:\Windows\System\fADBtpk.exe

C:\Windows\System\ToAWGUi.exe

C:\Windows\System\ToAWGUi.exe

C:\Windows\System\otiNZmj.exe

C:\Windows\System\otiNZmj.exe

C:\Windows\System\dIMpzDl.exe

C:\Windows\System\dIMpzDl.exe

C:\Windows\System\TdkPiQo.exe

C:\Windows\System\TdkPiQo.exe

C:\Windows\System\YZuogdp.exe

C:\Windows\System\YZuogdp.exe

C:\Windows\System\CCzCSLc.exe

C:\Windows\System\CCzCSLc.exe

C:\Windows\System\ADIrsJo.exe

C:\Windows\System\ADIrsJo.exe

C:\Windows\System\DAlJZfd.exe

C:\Windows\System\DAlJZfd.exe

C:\Windows\System\pCBjKrg.exe

C:\Windows\System\pCBjKrg.exe

C:\Windows\System\TTaTvVt.exe

C:\Windows\System\TTaTvVt.exe

C:\Windows\System\ZGklIgp.exe

C:\Windows\System\ZGklIgp.exe

C:\Windows\System\qtYRxaz.exe

C:\Windows\System\qtYRxaz.exe

C:\Windows\System\omokhkZ.exe

C:\Windows\System\omokhkZ.exe

C:\Windows\System\sjqrIoE.exe

C:\Windows\System\sjqrIoE.exe

C:\Windows\System\kbDHCVZ.exe

C:\Windows\System\kbDHCVZ.exe

C:\Windows\System\nYLVwiP.exe

C:\Windows\System\nYLVwiP.exe

C:\Windows\System\PRqGOLd.exe

C:\Windows\System\PRqGOLd.exe

C:\Windows\System\xIYWJgS.exe

C:\Windows\System\xIYWJgS.exe

C:\Windows\System\eAJHBBK.exe

C:\Windows\System\eAJHBBK.exe

C:\Windows\System\KwLXHPl.exe

C:\Windows\System\KwLXHPl.exe

C:\Windows\System\cwwgQSn.exe

C:\Windows\System\cwwgQSn.exe

C:\Windows\System\ocSeNYl.exe

C:\Windows\System\ocSeNYl.exe

C:\Windows\System\QEdnmuM.exe

C:\Windows\System\QEdnmuM.exe

C:\Windows\System\qWqrexj.exe

C:\Windows\System\qWqrexj.exe

C:\Windows\System\AUZHFFs.exe

C:\Windows\System\AUZHFFs.exe

C:\Windows\System\oXcIHKw.exe

C:\Windows\System\oXcIHKw.exe

C:\Windows\System\CHJHUEd.exe

C:\Windows\System\CHJHUEd.exe

C:\Windows\System\UusMXMh.exe

C:\Windows\System\UusMXMh.exe

C:\Windows\System\mqHHdQa.exe

C:\Windows\System\mqHHdQa.exe

C:\Windows\System\NISIBFf.exe

C:\Windows\System\NISIBFf.exe

C:\Windows\System\mzdWEuq.exe

C:\Windows\System\mzdWEuq.exe

C:\Windows\System\rwfHbkj.exe

C:\Windows\System\rwfHbkj.exe

C:\Windows\System\Eatuqps.exe

C:\Windows\System\Eatuqps.exe

C:\Windows\System\ndUyJEG.exe

C:\Windows\System\ndUyJEG.exe

C:\Windows\System\PpPlsaY.exe

C:\Windows\System\PpPlsaY.exe

C:\Windows\System\sXGmWGZ.exe

C:\Windows\System\sXGmWGZ.exe

C:\Windows\System\kEGeFSX.exe

C:\Windows\System\kEGeFSX.exe

C:\Windows\System\WOXEVMp.exe

C:\Windows\System\WOXEVMp.exe

C:\Windows\System\BocnvSC.exe

C:\Windows\System\BocnvSC.exe

C:\Windows\System\FrQyfhb.exe

C:\Windows\System\FrQyfhb.exe

C:\Windows\System\WnYULVz.exe

C:\Windows\System\WnYULVz.exe

C:\Windows\System\aOsqdsy.exe

C:\Windows\System\aOsqdsy.exe

C:\Windows\System\lQoPapY.exe

C:\Windows\System\lQoPapY.exe

C:\Windows\System\KvZkXXs.exe

C:\Windows\System\KvZkXXs.exe

C:\Windows\System\XODIaHy.exe

C:\Windows\System\XODIaHy.exe

C:\Windows\System\RKNbvaU.exe

C:\Windows\System\RKNbvaU.exe

C:\Windows\System\PcNkpAn.exe

C:\Windows\System\PcNkpAn.exe

C:\Windows\System\fxbYXvN.exe

C:\Windows\System\fxbYXvN.exe

C:\Windows\System\tsSdIax.exe

C:\Windows\System\tsSdIax.exe

C:\Windows\System\siojvEH.exe

C:\Windows\System\siojvEH.exe

C:\Windows\System\HakEHWP.exe

C:\Windows\System\HakEHWP.exe

C:\Windows\System\ZPiVyTJ.exe

C:\Windows\System\ZPiVyTJ.exe

C:\Windows\System\PSqOYry.exe

C:\Windows\System\PSqOYry.exe

C:\Windows\System\sVvgCaq.exe

C:\Windows\System\sVvgCaq.exe

C:\Windows\System\iUJoMBy.exe

C:\Windows\System\iUJoMBy.exe

C:\Windows\System\XDHaMZy.exe

C:\Windows\System\XDHaMZy.exe

C:\Windows\System\MnSEvab.exe

C:\Windows\System\MnSEvab.exe

C:\Windows\System\yTKncmR.exe

C:\Windows\System\yTKncmR.exe

C:\Windows\System\TbylkGV.exe

C:\Windows\System\TbylkGV.exe

C:\Windows\System\awKNdtu.exe

C:\Windows\System\awKNdtu.exe

C:\Windows\System\iQMBKxk.exe

C:\Windows\System\iQMBKxk.exe

C:\Windows\System\DslPqKn.exe

C:\Windows\System\DslPqKn.exe

C:\Windows\System\CRrBlGX.exe

C:\Windows\System\CRrBlGX.exe

C:\Windows\System\YEUrYvu.exe

C:\Windows\System\YEUrYvu.exe

C:\Windows\System\kkhZHHU.exe

C:\Windows\System\kkhZHHU.exe

C:\Windows\System\hIihUWE.exe

C:\Windows\System\hIihUWE.exe

C:\Windows\System\HTguSLw.exe

C:\Windows\System\HTguSLw.exe

C:\Windows\System\jkiJJBi.exe

C:\Windows\System\jkiJJBi.exe

C:\Windows\System\tvyLlAj.exe

C:\Windows\System\tvyLlAj.exe

C:\Windows\System\yIQaeOB.exe

C:\Windows\System\yIQaeOB.exe

C:\Windows\System\gCzQDbF.exe

C:\Windows\System\gCzQDbF.exe

C:\Windows\System\kXkcpQQ.exe

C:\Windows\System\kXkcpQQ.exe

C:\Windows\System\jxXxhyf.exe

C:\Windows\System\jxXxhyf.exe

C:\Windows\System\AyFGABN.exe

C:\Windows\System\AyFGABN.exe

C:\Windows\System\OcBwjIn.exe

C:\Windows\System\OcBwjIn.exe

C:\Windows\System\UuBcbdu.exe

C:\Windows\System\UuBcbdu.exe

C:\Windows\System\GAkdIjK.exe

C:\Windows\System\GAkdIjK.exe

C:\Windows\System\vYIfAJa.exe

C:\Windows\System\vYIfAJa.exe

C:\Windows\System\UtOczDC.exe

C:\Windows\System\UtOczDC.exe

C:\Windows\System\lwqHnSl.exe

C:\Windows\System\lwqHnSl.exe

C:\Windows\System\AmfixQp.exe

C:\Windows\System\AmfixQp.exe

C:\Windows\System\agTPzWl.exe

C:\Windows\System\agTPzWl.exe

C:\Windows\System\psLJsDM.exe

C:\Windows\System\psLJsDM.exe

C:\Windows\System\AQphrlQ.exe

C:\Windows\System\AQphrlQ.exe

C:\Windows\System\bLGYJWJ.exe

C:\Windows\System\bLGYJWJ.exe

C:\Windows\System\EqLtAfh.exe

C:\Windows\System\EqLtAfh.exe

C:\Windows\System\RiWnuzW.exe

C:\Windows\System\RiWnuzW.exe

C:\Windows\System\CjIbvVj.exe

C:\Windows\System\CjIbvVj.exe

C:\Windows\System\LdgvAPm.exe

C:\Windows\System\LdgvAPm.exe

C:\Windows\System\APKUtLe.exe

C:\Windows\System\APKUtLe.exe

C:\Windows\System\PpyBtUa.exe

C:\Windows\System\PpyBtUa.exe

C:\Windows\System\VdNgXxb.exe

C:\Windows\System\VdNgXxb.exe

C:\Windows\System\aqhRpSH.exe

C:\Windows\System\aqhRpSH.exe

C:\Windows\System\rPrLDlD.exe

C:\Windows\System\rPrLDlD.exe

C:\Windows\System\WRARsDT.exe

C:\Windows\System\WRARsDT.exe

C:\Windows\System\AQNfrPD.exe

C:\Windows\System\AQNfrPD.exe

C:\Windows\System\aGHNMmd.exe

C:\Windows\System\aGHNMmd.exe

C:\Windows\System\BFZOnWd.exe

C:\Windows\System\BFZOnWd.exe

C:\Windows\System\BzbdAXk.exe

C:\Windows\System\BzbdAXk.exe

C:\Windows\System\LBtGJrL.exe

C:\Windows\System\LBtGJrL.exe

C:\Windows\System\euPMHyn.exe

C:\Windows\System\euPMHyn.exe

C:\Windows\System\oTmAEJV.exe

C:\Windows\System\oTmAEJV.exe

C:\Windows\System\JQUAFSa.exe

C:\Windows\System\JQUAFSa.exe

C:\Windows\System\IgiRqFq.exe

C:\Windows\System\IgiRqFq.exe

C:\Windows\System\DVmIugu.exe

C:\Windows\System\DVmIugu.exe

C:\Windows\System\KnfDFIT.exe

C:\Windows\System\KnfDFIT.exe

C:\Windows\System\YMLeQki.exe

C:\Windows\System\YMLeQki.exe

C:\Windows\System\BpkjkgO.exe

C:\Windows\System\BpkjkgO.exe

C:\Windows\System\XnSWtRe.exe

C:\Windows\System\XnSWtRe.exe

C:\Windows\System\xKMiIEz.exe

C:\Windows\System\xKMiIEz.exe

C:\Windows\System\eeEHWCw.exe

C:\Windows\System\eeEHWCw.exe

C:\Windows\System\VxXsDPJ.exe

C:\Windows\System\VxXsDPJ.exe

C:\Windows\System\viIIpFE.exe

C:\Windows\System\viIIpFE.exe

C:\Windows\System\GvJbfgg.exe

C:\Windows\System\GvJbfgg.exe

C:\Windows\System\fhiMfwn.exe

C:\Windows\System\fhiMfwn.exe

C:\Windows\System\zGwYikR.exe

C:\Windows\System\zGwYikR.exe

C:\Windows\System\xtAMWoC.exe

C:\Windows\System\xtAMWoC.exe

C:\Windows\System\vmvsfcp.exe

C:\Windows\System\vmvsfcp.exe

C:\Windows\System\NzfrOJm.exe

C:\Windows\System\NzfrOJm.exe

C:\Windows\System\QtsycYS.exe

C:\Windows\System\QtsycYS.exe

C:\Windows\System\OTURRwe.exe

C:\Windows\System\OTURRwe.exe

C:\Windows\System\ICILmzj.exe

C:\Windows\System\ICILmzj.exe

C:\Windows\System\qbGUseN.exe

C:\Windows\System\qbGUseN.exe

C:\Windows\System\VIwlogW.exe

C:\Windows\System\VIwlogW.exe

C:\Windows\System\hnpshCl.exe

C:\Windows\System\hnpshCl.exe

C:\Windows\System\NIPfNzn.exe

C:\Windows\System\NIPfNzn.exe

C:\Windows\System\RRyRxrM.exe

C:\Windows\System\RRyRxrM.exe

C:\Windows\System\xrriRTz.exe

C:\Windows\System\xrriRTz.exe

C:\Windows\System\OZdUrez.exe

C:\Windows\System\OZdUrez.exe

C:\Windows\System\pEAsEpa.exe

C:\Windows\System\pEAsEpa.exe

C:\Windows\System\phNUjxN.exe

C:\Windows\System\phNUjxN.exe

C:\Windows\System\FBwVNBt.exe

C:\Windows\System\FBwVNBt.exe

C:\Windows\System\qFoMIFt.exe

C:\Windows\System\qFoMIFt.exe

C:\Windows\System\eWyjpuF.exe

C:\Windows\System\eWyjpuF.exe

C:\Windows\System\xflcrFw.exe

C:\Windows\System\xflcrFw.exe

C:\Windows\System\dimTnEb.exe

C:\Windows\System\dimTnEb.exe

C:\Windows\System\DiQfhsr.exe

C:\Windows\System\DiQfhsr.exe

C:\Windows\System\TWYVtdi.exe

C:\Windows\System\TWYVtdi.exe

C:\Windows\System\XizAtyI.exe

C:\Windows\System\XizAtyI.exe

C:\Windows\System\AFdGajb.exe

C:\Windows\System\AFdGajb.exe

C:\Windows\System\ledLBMu.exe

C:\Windows\System\ledLBMu.exe

C:\Windows\System\WsYrbri.exe

C:\Windows\System\WsYrbri.exe

C:\Windows\System\heMkcxo.exe

C:\Windows\System\heMkcxo.exe

C:\Windows\System\IYeunjZ.exe

C:\Windows\System\IYeunjZ.exe

C:\Windows\System\aVqFYBK.exe

C:\Windows\System\aVqFYBK.exe

C:\Windows\System\NWOHkHB.exe

C:\Windows\System\NWOHkHB.exe

C:\Windows\System\pzNnoWl.exe

C:\Windows\System\pzNnoWl.exe

C:\Windows\System\YRqdXmd.exe

C:\Windows\System\YRqdXmd.exe

C:\Windows\System\JSJozZL.exe

C:\Windows\System\JSJozZL.exe

C:\Windows\System\IsVhtQH.exe

C:\Windows\System\IsVhtQH.exe

C:\Windows\System\kuiROVJ.exe

C:\Windows\System\kuiROVJ.exe

C:\Windows\System\hLfzSOy.exe

C:\Windows\System\hLfzSOy.exe

C:\Windows\System\rIKmbNF.exe

C:\Windows\System\rIKmbNF.exe

C:\Windows\System\qwPiTDg.exe

C:\Windows\System\qwPiTDg.exe

C:\Windows\System\kPlgdLa.exe

C:\Windows\System\kPlgdLa.exe

C:\Windows\System\lFxrQuZ.exe

C:\Windows\System\lFxrQuZ.exe

C:\Windows\System\qeNAHhY.exe

C:\Windows\System\qeNAHhY.exe

C:\Windows\System\yXuNXjd.exe

C:\Windows\System\yXuNXjd.exe

C:\Windows\System\wfPKMEk.exe

C:\Windows\System\wfPKMEk.exe

C:\Windows\System\SLUkdjJ.exe

C:\Windows\System\SLUkdjJ.exe

C:\Windows\System\KQBOfLq.exe

C:\Windows\System\KQBOfLq.exe

C:\Windows\System\ValMsnK.exe

C:\Windows\System\ValMsnK.exe

C:\Windows\System\kZVluKT.exe

C:\Windows\System\kZVluKT.exe

C:\Windows\System\EByzwvz.exe

C:\Windows\System\EByzwvz.exe

C:\Windows\System\TEWifca.exe

C:\Windows\System\TEWifca.exe

C:\Windows\System\urvVVoJ.exe

C:\Windows\System\urvVVoJ.exe

C:\Windows\System\MaAjHlH.exe

C:\Windows\System\MaAjHlH.exe

C:\Windows\System\kImJQLk.exe

C:\Windows\System\kImJQLk.exe

C:\Windows\System\jVLKebC.exe

C:\Windows\System\jVLKebC.exe

C:\Windows\System\ofNfuAs.exe

C:\Windows\System\ofNfuAs.exe

C:\Windows\System\UwIilRr.exe

C:\Windows\System\UwIilRr.exe

C:\Windows\System\dVdwlAd.exe

C:\Windows\System\dVdwlAd.exe

C:\Windows\System\UzGMhVG.exe

C:\Windows\System\UzGMhVG.exe

C:\Windows\System\UusdwXF.exe

C:\Windows\System\UusdwXF.exe

C:\Windows\System\mJdnnsP.exe

C:\Windows\System\mJdnnsP.exe

C:\Windows\System\sVzNwRr.exe

C:\Windows\System\sVzNwRr.exe

C:\Windows\System\auFTOkP.exe

C:\Windows\System\auFTOkP.exe

C:\Windows\System\qqJmDDX.exe

C:\Windows\System\qqJmDDX.exe

C:\Windows\System\qANplFh.exe

C:\Windows\System\qANplFh.exe

C:\Windows\System\qWkCPCu.exe

C:\Windows\System\qWkCPCu.exe

C:\Windows\System\TwUqhzg.exe

C:\Windows\System\TwUqhzg.exe

C:\Windows\System\dyHEPvf.exe

C:\Windows\System\dyHEPvf.exe

C:\Windows\System\tchxYkL.exe

C:\Windows\System\tchxYkL.exe

C:\Windows\System\dUCzmUZ.exe

C:\Windows\System\dUCzmUZ.exe

C:\Windows\System\itGOsBN.exe

C:\Windows\System\itGOsBN.exe

C:\Windows\System\xVtvcDi.exe

C:\Windows\System\xVtvcDi.exe

C:\Windows\System\VGTePrR.exe

C:\Windows\System\VGTePrR.exe

C:\Windows\System\ZFCjTnw.exe

C:\Windows\System\ZFCjTnw.exe

C:\Windows\System\fYzzeIh.exe

C:\Windows\System\fYzzeIh.exe

C:\Windows\System\YzWkyun.exe

C:\Windows\System\YzWkyun.exe

C:\Windows\System\yfYnezK.exe

C:\Windows\System\yfYnezK.exe

C:\Windows\System\GmalAkP.exe

C:\Windows\System\GmalAkP.exe

C:\Windows\System\XkEwkxP.exe

C:\Windows\System\XkEwkxP.exe

C:\Windows\System\uTuiIEx.exe

C:\Windows\System\uTuiIEx.exe

C:\Windows\System\sHjfiht.exe

C:\Windows\System\sHjfiht.exe

C:\Windows\System\VgicoZZ.exe

C:\Windows\System\VgicoZZ.exe

C:\Windows\System\wfbkRfR.exe

C:\Windows\System\wfbkRfR.exe

C:\Windows\System\iMhQZco.exe

C:\Windows\System\iMhQZco.exe

C:\Windows\System\RlmqHKr.exe

C:\Windows\System\RlmqHKr.exe

C:\Windows\System\ToMnkYF.exe

C:\Windows\System\ToMnkYF.exe

C:\Windows\System\qstDljU.exe

C:\Windows\System\qstDljU.exe

C:\Windows\System\ttWSeUZ.exe

C:\Windows\System\ttWSeUZ.exe

C:\Windows\System\hnisAyV.exe

C:\Windows\System\hnisAyV.exe

C:\Windows\System\KtYORCE.exe

C:\Windows\System\KtYORCE.exe

C:\Windows\System\EQcqxvJ.exe

C:\Windows\System\EQcqxvJ.exe

C:\Windows\System\CgsZoAe.exe

C:\Windows\System\CgsZoAe.exe

C:\Windows\System\lAxCCeT.exe

C:\Windows\System\lAxCCeT.exe

C:\Windows\System\aAnFWCl.exe

C:\Windows\System\aAnFWCl.exe

C:\Windows\System\KJZCnJs.exe

C:\Windows\System\KJZCnJs.exe

C:\Windows\System\pSfJKQr.exe

C:\Windows\System\pSfJKQr.exe

C:\Windows\System\MupGrDd.exe

C:\Windows\System\MupGrDd.exe

C:\Windows\System\bUqbwLe.exe

C:\Windows\System\bUqbwLe.exe

C:\Windows\System\XoVVckv.exe

C:\Windows\System\XoVVckv.exe

C:\Windows\System\oyNhnSV.exe

C:\Windows\System\oyNhnSV.exe

C:\Windows\System\uAgmCep.exe

C:\Windows\System\uAgmCep.exe

C:\Windows\System\pvEozOZ.exe

C:\Windows\System\pvEozOZ.exe

C:\Windows\System\exwkdKl.exe

C:\Windows\System\exwkdKl.exe

C:\Windows\System\SCEzdzs.exe

C:\Windows\System\SCEzdzs.exe

C:\Windows\System\dksvHvN.exe

C:\Windows\System\dksvHvN.exe

C:\Windows\System\KfsEdGd.exe

C:\Windows\System\KfsEdGd.exe

C:\Windows\System\raRUPyY.exe

C:\Windows\System\raRUPyY.exe

C:\Windows\System\YKJxSHL.exe

C:\Windows\System\YKJxSHL.exe

C:\Windows\System\kABqBEa.exe

C:\Windows\System\kABqBEa.exe

C:\Windows\System\XxxZdBD.exe

C:\Windows\System\XxxZdBD.exe

C:\Windows\System\UoVGKzt.exe

C:\Windows\System\UoVGKzt.exe

C:\Windows\System\cFQxeAb.exe

C:\Windows\System\cFQxeAb.exe

C:\Windows\System\OOMObGg.exe

C:\Windows\System\OOMObGg.exe

C:\Windows\System\zCncwjM.exe

C:\Windows\System\zCncwjM.exe

C:\Windows\System\kFpORrk.exe

C:\Windows\System\kFpORrk.exe

C:\Windows\System\gCgnwdQ.exe

C:\Windows\System\gCgnwdQ.exe

C:\Windows\System\BZOZxYt.exe

C:\Windows\System\BZOZxYt.exe

C:\Windows\System\bwrlUbh.exe

C:\Windows\System\bwrlUbh.exe

C:\Windows\System\cqjgSBr.exe

C:\Windows\System\cqjgSBr.exe

C:\Windows\System\FMCqoLX.exe

C:\Windows\System\FMCqoLX.exe

C:\Windows\System\bPxGLYH.exe

C:\Windows\System\bPxGLYH.exe

C:\Windows\System\VeacRId.exe

C:\Windows\System\VeacRId.exe

C:\Windows\System\wGbzgOl.exe

C:\Windows\System\wGbzgOl.exe

C:\Windows\System\sGBgmcu.exe

C:\Windows\System\sGBgmcu.exe

C:\Windows\System\NymzENL.exe

C:\Windows\System\NymzENL.exe

C:\Windows\System\ONJbAtY.exe

C:\Windows\System\ONJbAtY.exe

C:\Windows\System\XHxfbiw.exe

C:\Windows\System\XHxfbiw.exe

C:\Windows\System\IOMIzSb.exe

C:\Windows\System\IOMIzSb.exe

C:\Windows\System\undKwfD.exe

C:\Windows\System\undKwfD.exe

C:\Windows\System\IrXaXbk.exe

C:\Windows\System\IrXaXbk.exe

C:\Windows\System\huRKjMq.exe

C:\Windows\System\huRKjMq.exe

C:\Windows\System\DxVhlIh.exe

C:\Windows\System\DxVhlIh.exe

C:\Windows\System\jiZZXHu.exe

C:\Windows\System\jiZZXHu.exe

C:\Windows\System\bthMGbr.exe

C:\Windows\System\bthMGbr.exe

C:\Windows\System\EdDBvay.exe

C:\Windows\System\EdDBvay.exe

C:\Windows\System\gXFRqbC.exe

C:\Windows\System\gXFRqbC.exe

C:\Windows\System\NJRqwys.exe

C:\Windows\System\NJRqwys.exe

C:\Windows\System\sHiLylG.exe

C:\Windows\System\sHiLylG.exe

C:\Windows\System\aSiDWkd.exe

C:\Windows\System\aSiDWkd.exe

C:\Windows\System\KKLievG.exe

C:\Windows\System\KKLievG.exe

C:\Windows\System\KiWcKnt.exe

C:\Windows\System\KiWcKnt.exe

C:\Windows\System\sxXBFLG.exe

C:\Windows\System\sxXBFLG.exe

C:\Windows\System\yQGICjc.exe

C:\Windows\System\yQGICjc.exe

C:\Windows\System\SuzOInx.exe

C:\Windows\System\SuzOInx.exe

C:\Windows\System\rcrqwed.exe

C:\Windows\System\rcrqwed.exe

C:\Windows\System\jYmqIBi.exe

C:\Windows\System\jYmqIBi.exe

C:\Windows\System\hEXSczd.exe

C:\Windows\System\hEXSczd.exe

C:\Windows\System\TqhqvHD.exe

C:\Windows\System\TqhqvHD.exe

C:\Windows\System\PBSTkfM.exe

C:\Windows\System\PBSTkfM.exe

C:\Windows\System\MuLEXDW.exe

C:\Windows\System\MuLEXDW.exe

C:\Windows\System\aAktRwV.exe

C:\Windows\System\aAktRwV.exe

C:\Windows\System\gtLWTzY.exe

C:\Windows\System\gtLWTzY.exe

C:\Windows\System\KkGERPU.exe

C:\Windows\System\KkGERPU.exe

C:\Windows\System\KLbKfMT.exe

C:\Windows\System\KLbKfMT.exe

C:\Windows\System\iJnNjTQ.exe

C:\Windows\System\iJnNjTQ.exe

C:\Windows\System\WUBTuxx.exe

C:\Windows\System\WUBTuxx.exe

C:\Windows\System\HstWXbf.exe

C:\Windows\System\HstWXbf.exe

C:\Windows\System\AsFByeA.exe

C:\Windows\System\AsFByeA.exe

C:\Windows\System\hzjaCFU.exe

C:\Windows\System\hzjaCFU.exe

C:\Windows\System\xvYqsNl.exe

C:\Windows\System\xvYqsNl.exe

C:\Windows\System\wkpFUWs.exe

C:\Windows\System\wkpFUWs.exe

C:\Windows\System\EItVsgF.exe

C:\Windows\System\EItVsgF.exe

C:\Windows\System\OOPjXuL.exe

C:\Windows\System\OOPjXuL.exe

C:\Windows\System\NbRvISm.exe

C:\Windows\System\NbRvISm.exe

C:\Windows\System\tvymmXK.exe

C:\Windows\System\tvymmXK.exe

C:\Windows\System\MrJuSXP.exe

C:\Windows\System\MrJuSXP.exe

C:\Windows\System\XgcUUyX.exe

C:\Windows\System\XgcUUyX.exe

C:\Windows\System\MrAyzHZ.exe

C:\Windows\System\MrAyzHZ.exe

C:\Windows\System\PZJbDNM.exe

C:\Windows\System\PZJbDNM.exe

C:\Windows\System\qWSQdaq.exe

C:\Windows\System\qWSQdaq.exe

C:\Windows\System\MFnxZxP.exe

C:\Windows\System\MFnxZxP.exe

C:\Windows\System\XYupyUb.exe

C:\Windows\System\XYupyUb.exe

C:\Windows\System\DeWkZcm.exe

C:\Windows\System\DeWkZcm.exe

C:\Windows\System\AMynMdI.exe

C:\Windows\System\AMynMdI.exe

C:\Windows\System\EFRRyfg.exe

C:\Windows\System\EFRRyfg.exe

C:\Windows\System\gGWRYdG.exe

C:\Windows\System\gGWRYdG.exe

C:\Windows\System\lYQMpoy.exe

C:\Windows\System\lYQMpoy.exe

C:\Windows\System\otnfEDp.exe

C:\Windows\System\otnfEDp.exe

C:\Windows\System\WeCZVAx.exe

C:\Windows\System\WeCZVAx.exe

C:\Windows\System\mGLqeLJ.exe

C:\Windows\System\mGLqeLJ.exe

C:\Windows\System\MJohzPd.exe

C:\Windows\System\MJohzPd.exe

C:\Windows\System\PoFixka.exe

C:\Windows\System\PoFixka.exe

C:\Windows\System\IQmHmqC.exe

C:\Windows\System\IQmHmqC.exe

C:\Windows\System\HbLvJtc.exe

C:\Windows\System\HbLvJtc.exe

C:\Windows\System\eacLfoW.exe

C:\Windows\System\eacLfoW.exe

C:\Windows\System\mRKjioC.exe

C:\Windows\System\mRKjioC.exe

C:\Windows\System\pdtXlWb.exe

C:\Windows\System\pdtXlWb.exe

C:\Windows\System\jOHQyrL.exe

C:\Windows\System\jOHQyrL.exe

C:\Windows\System\eBGNOOT.exe

C:\Windows\System\eBGNOOT.exe

C:\Windows\System\gYshpiV.exe

C:\Windows\System\gYshpiV.exe

C:\Windows\System\bpVDokW.exe

C:\Windows\System\bpVDokW.exe

C:\Windows\System\YYykTIg.exe

C:\Windows\System\YYykTIg.exe

C:\Windows\System\GliUGao.exe

C:\Windows\System\GliUGao.exe

C:\Windows\System\THWQofb.exe

C:\Windows\System\THWQofb.exe

C:\Windows\System\YQbVXWr.exe

C:\Windows\System\YQbVXWr.exe

C:\Windows\System\RUgDJjN.exe

C:\Windows\System\RUgDJjN.exe

C:\Windows\System\IukpxiW.exe

C:\Windows\System\IukpxiW.exe

C:\Windows\System\sDFKYWM.exe

C:\Windows\System\sDFKYWM.exe

C:\Windows\System\sazOirQ.exe

C:\Windows\System\sazOirQ.exe

C:\Windows\System\xGAeQHY.exe

C:\Windows\System\xGAeQHY.exe

C:\Windows\System\cwgqnHW.exe

C:\Windows\System\cwgqnHW.exe

C:\Windows\System\EzCykeG.exe

C:\Windows\System\EzCykeG.exe

C:\Windows\System\ZPjwLSk.exe

C:\Windows\System\ZPjwLSk.exe

C:\Windows\System\VQkZDBd.exe

C:\Windows\System\VQkZDBd.exe

C:\Windows\System\TjiIXnV.exe

C:\Windows\System\TjiIXnV.exe

C:\Windows\System\Rjhlswo.exe

C:\Windows\System\Rjhlswo.exe

C:\Windows\System\fmveDtK.exe

C:\Windows\System\fmveDtK.exe

C:\Windows\System\XMSRYlP.exe

C:\Windows\System\XMSRYlP.exe

C:\Windows\System\SpvGbhX.exe

C:\Windows\System\SpvGbhX.exe

C:\Windows\System\LNBKHtZ.exe

C:\Windows\System\LNBKHtZ.exe

C:\Windows\System\TxcEpdY.exe

C:\Windows\System\TxcEpdY.exe

C:\Windows\System\bTWpcAk.exe

C:\Windows\System\bTWpcAk.exe

C:\Windows\System\jmZHIrO.exe

C:\Windows\System\jmZHIrO.exe

C:\Windows\System\GnzRzfe.exe

C:\Windows\System\GnzRzfe.exe

C:\Windows\System\NSzCxqR.exe

C:\Windows\System\NSzCxqR.exe

C:\Windows\System\ySfgomp.exe

C:\Windows\System\ySfgomp.exe

C:\Windows\System\oFIGtiL.exe

C:\Windows\System\oFIGtiL.exe

C:\Windows\System\cHoIqBH.exe

C:\Windows\System\cHoIqBH.exe

C:\Windows\System\hCslKBp.exe

C:\Windows\System\hCslKBp.exe

C:\Windows\System\hfgVDZL.exe

C:\Windows\System\hfgVDZL.exe

C:\Windows\System\HNlWpMs.exe

C:\Windows\System\HNlWpMs.exe

C:\Windows\System\jzkmVJz.exe

C:\Windows\System\jzkmVJz.exe

C:\Windows\System\OqApmJY.exe

C:\Windows\System\OqApmJY.exe

C:\Windows\System\mODNOZB.exe

C:\Windows\System\mODNOZB.exe

C:\Windows\System\MiXVfLT.exe

C:\Windows\System\MiXVfLT.exe

C:\Windows\System\niTMdEE.exe

C:\Windows\System\niTMdEE.exe

C:\Windows\System\AIdNLFZ.exe

C:\Windows\System\AIdNLFZ.exe

C:\Windows\System\hUDJvfu.exe

C:\Windows\System\hUDJvfu.exe

C:\Windows\System\zInZvbc.exe

C:\Windows\System\zInZvbc.exe

C:\Windows\System\IWUFMxX.exe

C:\Windows\System\IWUFMxX.exe

C:\Windows\System\DYjvjjh.exe

C:\Windows\System\DYjvjjh.exe

C:\Windows\System\EpCYBPn.exe

C:\Windows\System\EpCYBPn.exe

C:\Windows\System\laiTlwF.exe

C:\Windows\System\laiTlwF.exe

C:\Windows\System\QXTrulE.exe

C:\Windows\System\QXTrulE.exe

C:\Windows\System\xgymCCm.exe

C:\Windows\System\xgymCCm.exe

C:\Windows\System\ZWgVpXT.exe

C:\Windows\System\ZWgVpXT.exe

C:\Windows\System\HeyNOED.exe

C:\Windows\System\HeyNOED.exe

C:\Windows\System\CyVuwfY.exe

C:\Windows\System\CyVuwfY.exe

C:\Windows\System\OIHfhzN.exe

C:\Windows\System\OIHfhzN.exe

C:\Windows\System\nkwzCBG.exe

C:\Windows\System\nkwzCBG.exe

C:\Windows\System\kgRWeYi.exe

C:\Windows\System\kgRWeYi.exe

C:\Windows\System\IdWEXOA.exe

C:\Windows\System\IdWEXOA.exe

C:\Windows\System\frDOQii.exe

C:\Windows\System\frDOQii.exe

C:\Windows\System\dNftZHi.exe

C:\Windows\System\dNftZHi.exe

C:\Windows\System\lrpomxx.exe

C:\Windows\System\lrpomxx.exe

C:\Windows\System\aLcAdLO.exe

C:\Windows\System\aLcAdLO.exe

C:\Windows\System\ulweOcG.exe

C:\Windows\System\ulweOcG.exe

C:\Windows\System\cvCzmcJ.exe

C:\Windows\System\cvCzmcJ.exe

C:\Windows\System\SdcROqs.exe

C:\Windows\System\SdcROqs.exe

C:\Windows\System\xxVsTrd.exe

C:\Windows\System\xxVsTrd.exe

C:\Windows\System\eYMzYPY.exe

C:\Windows\System\eYMzYPY.exe

C:\Windows\System\rBelEvq.exe

C:\Windows\System\rBelEvq.exe

C:\Windows\System\BlNtQKt.exe

C:\Windows\System\BlNtQKt.exe

C:\Windows\System\PXrEpZN.exe

C:\Windows\System\PXrEpZN.exe

C:\Windows\System\pCztCdR.exe

C:\Windows\System\pCztCdR.exe

C:\Windows\System\CIvfrXW.exe

C:\Windows\System\CIvfrXW.exe

C:\Windows\System\WjQOvzU.exe

C:\Windows\System\WjQOvzU.exe

C:\Windows\System\JrYJlnE.exe

C:\Windows\System\JrYJlnE.exe

C:\Windows\System\rWyalaM.exe

C:\Windows\System\rWyalaM.exe

C:\Windows\System\UrsRTrZ.exe

C:\Windows\System\UrsRTrZ.exe

C:\Windows\System\OETiXAy.exe

C:\Windows\System\OETiXAy.exe

C:\Windows\System\mQuZNIl.exe

C:\Windows\System\mQuZNIl.exe

C:\Windows\System\mdmuJDX.exe

C:\Windows\System\mdmuJDX.exe

C:\Windows\System\tDOdrOW.exe

C:\Windows\System\tDOdrOW.exe

C:\Windows\System\EzUbUJH.exe

C:\Windows\System\EzUbUJH.exe

C:\Windows\System\HZRwEQi.exe

C:\Windows\System\HZRwEQi.exe

C:\Windows\System\MsoRqZK.exe

C:\Windows\System\MsoRqZK.exe

C:\Windows\System\wevwbcK.exe

C:\Windows\System\wevwbcK.exe

C:\Windows\System\nOqeXvu.exe

C:\Windows\System\nOqeXvu.exe

C:\Windows\System\HtpeWKy.exe

C:\Windows\System\HtpeWKy.exe

C:\Windows\System\naPnsax.exe

C:\Windows\System\naPnsax.exe

C:\Windows\System\jzZWMjV.exe

C:\Windows\System\jzZWMjV.exe

C:\Windows\System\ISlfxSt.exe

C:\Windows\System\ISlfxSt.exe

C:\Windows\System\qhYlrEg.exe

C:\Windows\System\qhYlrEg.exe

C:\Windows\System\AVjPRgW.exe

C:\Windows\System\AVjPRgW.exe

C:\Windows\System\EzpgSPw.exe

C:\Windows\System\EzpgSPw.exe

C:\Windows\System\lFHFgQt.exe

C:\Windows\System\lFHFgQt.exe

C:\Windows\System\IMNrmtJ.exe

C:\Windows\System\IMNrmtJ.exe

C:\Windows\System\yJNOpDB.exe

C:\Windows\System\yJNOpDB.exe

C:\Windows\System\SZWpqor.exe

C:\Windows\System\SZWpqor.exe

C:\Windows\System\GligrPh.exe

C:\Windows\System\GligrPh.exe

C:\Windows\System\BUlwxis.exe

C:\Windows\System\BUlwxis.exe

C:\Windows\System\UftxEVi.exe

C:\Windows\System\UftxEVi.exe

C:\Windows\System\ZuMATuA.exe

C:\Windows\System\ZuMATuA.exe

C:\Windows\System\xkvomQX.exe

C:\Windows\System\xkvomQX.exe

C:\Windows\System\lJRDiAE.exe

C:\Windows\System\lJRDiAE.exe

C:\Windows\System\EIgupka.exe

C:\Windows\System\EIgupka.exe

C:\Windows\System\trmoEtN.exe

C:\Windows\System\trmoEtN.exe

C:\Windows\System\oTWiURk.exe

C:\Windows\System\oTWiURk.exe

C:\Windows\System\riwrSAh.exe

C:\Windows\System\riwrSAh.exe

C:\Windows\System\TlZIyxn.exe

C:\Windows\System\TlZIyxn.exe

C:\Windows\System\CFhrUOy.exe

C:\Windows\System\CFhrUOy.exe

C:\Windows\System\KuPavbg.exe

C:\Windows\System\KuPavbg.exe

C:\Windows\System\AlIIjZv.exe

C:\Windows\System\AlIIjZv.exe

C:\Windows\System\QRKkezN.exe

C:\Windows\System\QRKkezN.exe

C:\Windows\System\PEghsey.exe

C:\Windows\System\PEghsey.exe

C:\Windows\System\uOxdFpe.exe

C:\Windows\System\uOxdFpe.exe

C:\Windows\System\IqIAYdX.exe

C:\Windows\System\IqIAYdX.exe

C:\Windows\System\GGWnwUb.exe

C:\Windows\System\GGWnwUb.exe

C:\Windows\System\QkHLxIK.exe

C:\Windows\System\QkHLxIK.exe

C:\Windows\System\WTewbvE.exe

C:\Windows\System\WTewbvE.exe

C:\Windows\System\vnBlWWz.exe

C:\Windows\System\vnBlWWz.exe

C:\Windows\System\mxhXMaP.exe

C:\Windows\System\mxhXMaP.exe

C:\Windows\System\YgAcwpr.exe

C:\Windows\System\YgAcwpr.exe

C:\Windows\System\rFPRhSB.exe

C:\Windows\System\rFPRhSB.exe

C:\Windows\System\RAkYrtM.exe

C:\Windows\System\RAkYrtM.exe

C:\Windows\System\tzOnIyt.exe

C:\Windows\System\tzOnIyt.exe

C:\Windows\System\gTkULNC.exe

C:\Windows\System\gTkULNC.exe

C:\Windows\System\kzBeoDP.exe

C:\Windows\System\kzBeoDP.exe

C:\Windows\System\qCsSHMg.exe

C:\Windows\System\qCsSHMg.exe

C:\Windows\System\FribWkW.exe

C:\Windows\System\FribWkW.exe

C:\Windows\System\vFxpsqL.exe

C:\Windows\System\vFxpsqL.exe

C:\Windows\System\ibtXzRq.exe

C:\Windows\System\ibtXzRq.exe

C:\Windows\System\rLAAVys.exe

C:\Windows\System\rLAAVys.exe

C:\Windows\System\PLkgFJQ.exe

C:\Windows\System\PLkgFJQ.exe

C:\Windows\System\PnarwFR.exe

C:\Windows\System\PnarwFR.exe

C:\Windows\System\PfTNBid.exe

C:\Windows\System\PfTNBid.exe

C:\Windows\System\mpAvTKg.exe

C:\Windows\System\mpAvTKg.exe

C:\Windows\System\MEJCPON.exe

C:\Windows\System\MEJCPON.exe

C:\Windows\System\imsMrcK.exe

C:\Windows\System\imsMrcK.exe

C:\Windows\System\qEodZKr.exe

C:\Windows\System\qEodZKr.exe

C:\Windows\System\xiZhWTx.exe

C:\Windows\System\xiZhWTx.exe

C:\Windows\System\ZXGvBDH.exe

C:\Windows\System\ZXGvBDH.exe

C:\Windows\System\vqyTDBY.exe

C:\Windows\System\vqyTDBY.exe

C:\Windows\System\nLtTGqE.exe

C:\Windows\System\nLtTGqE.exe

C:\Windows\System\MFRIvLw.exe

C:\Windows\System\MFRIvLw.exe

C:\Windows\System\jpsNsjn.exe

C:\Windows\System\jpsNsjn.exe

C:\Windows\System\CNIbVFu.exe

C:\Windows\System\CNIbVFu.exe

C:\Windows\System\EJqYbIn.exe

C:\Windows\System\EJqYbIn.exe

C:\Windows\System\QxHBDcA.exe

C:\Windows\System\QxHBDcA.exe

C:\Windows\System\bonbESu.exe

C:\Windows\System\bonbESu.exe

C:\Windows\System\fkqzACi.exe

C:\Windows\System\fkqzACi.exe

C:\Windows\System\dudvkeR.exe

C:\Windows\System\dudvkeR.exe

C:\Windows\System\sadMBiz.exe

C:\Windows\System\sadMBiz.exe

C:\Windows\System\MrqSGjK.exe

C:\Windows\System\MrqSGjK.exe

C:\Windows\System\xUMSwtd.exe

C:\Windows\System\xUMSwtd.exe

C:\Windows\System\ouIwNAq.exe

C:\Windows\System\ouIwNAq.exe

C:\Windows\System\uSeGriB.exe

C:\Windows\System\uSeGriB.exe

C:\Windows\System\mdWeeJj.exe

C:\Windows\System\mdWeeJj.exe

C:\Windows\System\RgEgXXs.exe

C:\Windows\System\RgEgXXs.exe

C:\Windows\System\NiFGxPS.exe

C:\Windows\System\NiFGxPS.exe

C:\Windows\System\GAkJjMH.exe

C:\Windows\System\GAkJjMH.exe

C:\Windows\System\pWGxFsy.exe

C:\Windows\System\pWGxFsy.exe

C:\Windows\System\suENXui.exe

C:\Windows\System\suENXui.exe

C:\Windows\System\jNOmmhW.exe

C:\Windows\System\jNOmmhW.exe

C:\Windows\System\znNfJHO.exe

C:\Windows\System\znNfJHO.exe

C:\Windows\System\rDUiceu.exe

C:\Windows\System\rDUiceu.exe

C:\Windows\System\ZVNgMhU.exe

C:\Windows\System\ZVNgMhU.exe

C:\Windows\System\iNdYIUW.exe

C:\Windows\System\iNdYIUW.exe

C:\Windows\System\swetdew.exe

C:\Windows\System\swetdew.exe

C:\Windows\System\Janicvo.exe

C:\Windows\System\Janicvo.exe

C:\Windows\System\adAUDYb.exe

C:\Windows\System\adAUDYb.exe

C:\Windows\System\oIeQgcZ.exe

C:\Windows\System\oIeQgcZ.exe

C:\Windows\System\qnpAjff.exe

C:\Windows\System\qnpAjff.exe

C:\Windows\System\iqtnPDI.exe

C:\Windows\System\iqtnPDI.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp

Files

memory/1876-1-0x000000013FF50000-0x0000000140342000-memory.dmp

memory/1876-0-0x00000000002F0000-0x0000000000300000-memory.dmp

C:\Windows\system\neZYftI.exe

MD5	d3b103f4dce6ba33148bd3d2bef81011
SHA1	029d77c6b5db3f9bce291d32b84ce5f554c7bb4a
SHA256	7d0295eb6d221bb34555a5ff199aec2516dc8caeb44c1157b02f7090e54bccbc
SHA512	edd016e0fb9cd34e2cc3e01e661c6eccc7f45c35417b756fb2f4d40ae8d2ffa91f41ae8100fe62a44ac989fa9a48018220b1ddac8bd0aea2f3c9581e0411e13a

\Windows\system\tzRKtJk.exe

MD5	9b1c8fc54b5b8b5e7da120bb215d02c3
SHA1	61572773576b3d860e54f2fc9752ce0c445c6342
SHA256	43cf1c11fe507530acdd854e7c9a94c6eeb32b89f201a27809bca495d0dab69f
SHA512	b4069d3aee6d81d32d617d8786a466f9294c9005c7e937c76ad9ad0145b7cb3c58d7435bcbbf0900c71c3e513be68fa9c7462ed06061baaee6aed8d5beb74f02

memory/2620-59-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

memory/1876-60-0x000000013F420000-0x000000013F812000-memory.dmp

memory/1876-61-0x000000013F950000-0x000000013FD42000-memory.dmp

memory/1876-62-0x0000000002920000-0x0000000002D12000-memory.dmp

memory/2564-63-0x000000013F420000-0x000000013F812000-memory.dmp

memory/1876-65-0x000000013F210000-0x000000013F602000-memory.dmp

memory/2456-71-0x000000013F970000-0x000000013FD62000-memory.dmp

\Windows\system\lWAUphK.exe

MD5	88921031a65bd90d9d80ec5e374ac4e1
SHA1	0295386e83595f605c9f6436fa5a342d5e5d225c
SHA256	a1225ce291ef41daacca9e04a5ae1d03e332d646cef7a95088d4008a00278834
SHA512	b0a1601e07b87018410a134615ab1561779db2317922397b8386d77915ae3a720eb14b6f6360799530dd7b3e5d56210ba8dd4316c5bdb95718b403cfd9ee8acd

C:\Windows\system\tgADpeH.exe

MD5	387917fc10543404b63b35b96eb56e63
SHA1	be42e6faa46a8f8c8a070f37a988f2b2541c38db
SHA256	61ca811bc4f513a017a06c1e8717c02c6606e4f050654e68fd5eea3515735c85
SHA512	8898c6c099e039e25e4046feb27ebe4d49ddc301220d0ecd0f73ca6c124a73df760d1a517166c047222b2c73912edf765b944f254be769321310717c8b0e0b2b

C:\Windows\system\rXcRCYN.exe

MD5	de3c6c11191ad6dc297253f7157f1347
SHA1	eba6300af599233b2b1eec76edd17f24f2a52f13
SHA256	0e85d274fd52f68fee97ad4e2db7d6c46c9ca3f4279c37c8c046ad932b52525c
SHA512	206b9b7e8e346315e85164c0d195472028a4ebd6ab4f65ce4ed49bc7c70e0f5ad43bd6fc033c7059e4dd6b49f8fc237a2328c153497e0e5f33fe8c6709376986

C:\Windows\system\wYaRgtk.exe

MD5	be36817a42369366ff48998cc0f00e0b
SHA1	013d8d1939efe960698af985e51a9a7de4bcf1bf
SHA256	73808218d72fd609281f06d348bdd9595fe189f5b3f71cb03b42c0fc00070684
SHA512	457804c64cdeebfbb94c952c49856157f4dd16d6fb6c92b87d9af512afb6481fb768375b1f96a5aa3dfa2cab7c780fa404929f58168226982996ed96fda20599

C:\Windows\system\CvXTrxE.exe

MD5	8c97135c90f971e2cfd4db9f6d8ada24
SHA1	5d1a55c5a1eaf8091da3589d1725190f814e2611
SHA256	0ec377f3c0ad0cff0a017102a5de37294ca35951784fe5d0063c768d3a1015ed
SHA512	f69ef7b1ea7d0384abcdf8807dc4b2624550c72e87b64b808b9947072b27094acd3cc1c9d3381c0ec40a7c2cc874e94fe378e80bf50ce4eec76d76413f98b7b8

\Windows\system\LtwstEt.exe

MD5	870cbfe0781d20eb2a25c42b769d9303
SHA1	770b2de955a108941bbff6d9d9566799685e407d
SHA256	a6bc3bda9edad8255e58a48ec5193edc2f2b9ae8cfb05039261ce334b5054fc8
SHA512	016ce9d6fc17d34784cab7707ab51f6f1b732c6a5bc8d30044ade853b97abc4e1f329e16c5a0a6c21a155f975e6970697060e3a958164c67b727fc5410f0b07b

C:\Windows\system\pzoXpwK.exe

MD5	0d14e91e17cc41d1c9fd7ca825290255
SHA1	2ce69f8672ee93181f999c3fbc8b5d44c17e975f
SHA256	3a1ee6c3e87099da8d95fde59a6aa0d8b9396b3b33c2b01883243d204f140776
SHA512	16e1f297a07f19df9515f6dcdbc2d831a53ba20d9cd37e69bab620dbc7d14cd73892a9ff55b2291e6a8909d0179057b580170586cb81d2f23ca05991d5e90ea8

C:\Windows\system\PBbZZbB.exe

MD5	d131e35f8b91df5626efba93dabad9c0
SHA1	214bdd981074002aee834dce872cc96300db9503
SHA256	8f714a588a40fd855c760fa742fe942f21a64e61dc0c6336bab3d589afac4636
SHA512	591e8809d09e5906fe00b7c08c800a7a17a3d687f0b223a84b143394266367cce0e18842774c4fa8519d7502de9b45b839a291e528d2c2f877b214abcd43b047

memory/3012-345-0x0000000002660000-0x0000000002668000-memory.dmp

memory/3012-343-0x000000001B280000-0x000000001B562000-memory.dmp

C:\Windows\system\FzSHTxe.exe

MD5	df6dc87a68e1f53228a979ac42eb9cfd
SHA1	e0eb97cf9d68c0b2094cc523b746e1d34eb0980b
SHA256	b9e027785071c2528425c1a1922b42f42cfdbae363bbdd86a39d8f2143699e22
SHA512	3cabfefd5d31e0b9aa9f565be8cda5b7f75f83a7c592a366359211a57fd7ad2a7d7bdf85e9496344b6ccb47cd9c61d257ac9d37829dc211f0bd408de75cad19a

C:\Windows\system\zuBoPLa.exe

MD5	56fecedd618212cd66b20b6c3028be13
SHA1	62e1e4b620d30f2919ab930da86e402c078b3dae
SHA256	59bcf7689a1bae75a12547f5297a4b938ddeda76ad5a68aaeeca2d216136e789
SHA512	0ab580897d249d7d3d0e22d6b0053c3820be1c57bfaefa8582b5cb26e686cd77edf56140190c8d5b6126156264483f77c945d331f0a07f65f4c4a837da57f069

C:\Windows\system\iMSNyPl.exe

MD5	15736bc9f6ecb0a9885f488214fd80ad
SHA1	602e4a072d7651b7eebc66d07032338397fa6b33
SHA256	15e68d27f16bff379a08abb735fa23d67909eea2e15726f0a7af41754dab443b
SHA512	bc7bb9e25d17e2fb3b26baed305890bdb7f58b1bdcb5dc5d0282bc917375825b3e9a7edf903eb5d49952902093523aaa16d3226e195ee55ffba26d83039590eb

C:\Windows\system\GRRjSyN.exe

MD5	8fafa316769189b91131dbfb90d22dda
SHA1	3accebca77adfce876a1260ba93b5937b493a991
SHA256	4e869c822e8b7cc4d5585893fc863ec5651c5c11632e38f24049f8644e5f76aa
SHA512	5c4b1ed5253f6cdbfecb993d4d2d7a3013fcd988747a8325e0c262d871081107f87c96536d1d3bd54c428f36386911c3f9a226bb39e579b8c5aecf0007cc71f6

C:\Windows\system\XWoEEhk.exe

MD5	f34cdb9cf499a65753f6f4990ea66d13
SHA1	b951f37842b6b9684aa2450766ceaa6bfeabcce8
SHA256	0ee1f768cdb1649ec796efa1457d182ae0ef8cd6eb61340dcff83a504b2541c4
SHA512	523ea5f4c27536c6751b114c8070f1a7aef4c324fbca5a01a7519af47a56b7ad7faf630fc7adfddb3b5d58c609bd3c35a9e90591926158e028ee436902551dd5

C:\Windows\system\xHDxpnO.exe

MD5	8ac3ed64900156b173c404206124a76b
SHA1	0eeced14971b8767707d442f2b5da152a1136b52
SHA256	7cb408e3fb9841d8548faf763da61c1208cb172af271e006c98a22761570b9c8
SHA512	83ddb4f7191040a54df6770e2ea798a86282784441ced91edde5d6a2977a26d537081aa1d089d0a16b834faeeabc40ce54f5daab096602fa9aefdd89a540f53e

C:\Windows\system\QriWwny.exe

MD5	0b3d08e572539bb7bcad09952271e362
SHA1	7b4298cd5ee43d1a00b81aad69f571a264653750
SHA256	7390d7adf7fffaee3e642226f0881520d1830678cf9e326246c353becda0ad0c
SHA512	32a9ebaf43aca0a4b4c5112001bc51d7477404705e6767a6ceefb58afe6b4c77149e19f040a58b99e560391c40b038620fda87106537457fd8f00efcf0806f50

C:\Windows\system\bbkXHHU.exe

MD5	f786b3738eb872d580d61883f2de525a
SHA1	b22d49daddfc0ae60b1d8601725e13552bf96479
SHA256	556c2a78e1d287083504fdc6f4971c1982cdc6fb87e2065b20e0a6abee0e9b15
SHA512	8e7772708f097c17b1b749f38322df955f95c3e8dcabd68fadfed2efaa7d8019e0c2c40231515b2cd03a09f2bb5345bbcbede9b8aa5ff0bac774174083212e07

C:\Windows\system\ALSWyzR.exe

MD5	5fd08762be2e225d03215345ae99d4e4
SHA1	73676ecc1f95953b64b0e347de2e3053e8cadea9
SHA256	cd5c740869b0ecbe1c92689eeb9bdfa3b7abefe41e22c5e13c5a96eab563e38a
SHA512	50fc9292da2b58f3193dc637fbb7ecad16bf7aa19ad4ca131385b88ff3593391675cb75a3fb4b1fdb945d6b6147dc594515974d2ca1ca54a4f16b6ea9d656a7f

C:\Windows\system\RVQeEjg.exe

MD5	640965cac2171ac44cc7eed1e7f9216e
SHA1	6484ed8cd7271e333f87b6ddcb57726bd3dc5dd8
SHA256	2d94e5af308b37ada86a75721ac603b62dbf228a5a05ecf485e80c148f812c2d
SHA512	02c50a0d3b06cde22e4fb13c22b5964ac68239fb3201875b2638bd1d84e482b8e4c33357f653638729850711a8763a34bddeed5a161132a817a49c33f54bfccc

\Windows\system\vnoigXl.exe

MD5	ffede45da9d61455f74af1296ac0b340
SHA1	a51c1447fb55ccdadc166489022cbcb6c374a46f
SHA256	0ab36c6290daa238264d6eda7ba140b96eeec6dc3927561ba5861055996ec04f
SHA512	6fa300119f6c873a93e7840cca07f3dab1d98f6cdc3c308138f07e51d1ff98a18d8eeccfbc4ea740c015f6ce039ffec469a1b0fe254baf84b5d00545955d19e9

C:\Windows\system\UBZkGMz.exe

MD5	5d434bc096e2dccd4739f80654073fd9
SHA1	51fa22ae9f4597d15a5443f131afe21ac070a5a9
SHA256	29069db694922d05263a195d84ac46d0eaf1d9aa68092c78867f642c1cc1241e
SHA512	23b2d73230a8499c97a65917112d68f1f8b849659deaa98a09f93073ab3def87e2f31c3eec0422407184996dc8599192fce14bbcb4fbf62db9fbda70406eba0d

memory/1876-87-0x000000013F420000-0x000000013F812000-memory.dmp

memory/1876-86-0x000000013F490000-0x000000013F882000-memory.dmp

\Windows\system\zsGtoLo.exe

MD5	e2e63cad598e14a73c0cf0a49086421a
SHA1	1b6f71f8fedffe1071788c6a6bb8f4c6f5147236
SHA256	a46c6436878344af78e8444fee4b045a89ad5212efc494674e0b7ec733e61eb6
SHA512	019dff8556a7158eeb79bab859eb0a7ce39eefdc8fb01149c0801641350c036e09793b59a855f646c38cd82bd048a877d9c309dbfb890784799cf450e5d0084b

memory/1876-77-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

memory/1876-74-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

memory/2056-73-0x000000013FF60000-0x0000000140352000-memory.dmp

C:\Windows\system\hzfnoPh.exe

MD5	12f0a478a34f015079bf568db5b945a0
SHA1	355225282e7dfa433ed05de1148fdae57a82e702
SHA256	747a04707f1012404b06ae8617aad8b8f38930c7f5d41d3e6132b911356e0c56
SHA512	e925a054d3592cf4b2f44fb42b59926daee732c3d4a2d57916f2d946c5227a58fc75730b820f10d7424b01a3cca2fd225c5d1612c9a0d0b020bfb56c6f405d95

C:\Windows\system\QwBmwPp.exe

MD5	6a44e0422c82c0e4d2e585d0c264362b
SHA1	a8ce1897d6c0df0d961b1c2f52fa1822314aed49
SHA256	9a2aa96f8e05ae741ac2d75272f8924f408cd0eb9caf6ecc51e9729c500544fa
SHA512	dbd587813419ece8e3d6cf2739e7ca833c2a90370ab58c3e17b4010d85181db683646bab64e7c6abc2727adb42b1051ddb9a2eeeaf048e45a5f6e9597fb1cccc

C:\Windows\system\vyrqcMd.exe

MD5	13b805c7d9f7ad19a2b648552080314a
SHA1	6c16762afc06de66771f8e223cf11851b67d7b4a
SHA256	5f92401ef089c7da077e05252abef1e206186d4a74c765d21da9e5d62b3835fe
SHA512	7e2d5ebb65f3f3bf826a0930c5db98a253b62f408586ecfd25ca14096bf0f8c7cd39089326d95d05d29f1c7ff31887433ab70a0bba7c8c07c110f083d9524f9d

memory/1876-25-0x000000013F5A0000-0x000000013F992000-memory.dmp

C:\Windows\system\IjiDgKe.exe

MD5	265fa7ed3d986201698955c39fdd6737
SHA1	f8d02f3a9ce8cac951d621d9062e7e5595ca7688
SHA256	ed059edc70042c23675337ff0719a631aa72a9c918e98b005c22e3bff5c4fecc
SHA512	21a27a6712532ae94eee718c918f9602d303584e7170c0485ed347c43004857e256a29367c6a3166ba72e974ec9b18395883fdd93b71fdc32fbecf155926d966

memory/2540-81-0x000000013F950000-0x000000013FD42000-memory.dmp

memory/1876-70-0x0000000002920000-0x0000000002D12000-memory.dmp

memory/1876-69-0x0000000002920000-0x0000000002D12000-memory.dmp

memory/1460-68-0x000000013FA20000-0x000000013FE12000-memory.dmp

memory/2716-67-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

memory/1876-66-0x000000013F970000-0x000000013FD62000-memory.dmp

memory/2568-64-0x000000013FE20000-0x0000000140212000-memory.dmp

C:\Windows\system\uiQFKMh.exe

MD5	aef680b966a8ac481bd6613eb1c8bcb4
SHA1	d715376cd1a12648c63ca9ff2e42bb8570b8cad0
SHA256	1b9890b048b929e1b12cb23c9a3fa63af0b6657f7ccc31001b070edaa80a2917
SHA512	88d1b56ef0d0dba090e9c1113dd253f3f6b0289bfe49cc3e6e49377b5ac9ce2eca9490ff27cc67c02357b8862552dcdb0abade3037a77487b2db2ca0a1fabd18

C:\Windows\system\mXosAkS.exe

MD5	21c31084c6cd3f5bfaa75d918b70ba91
SHA1	4d09a1865d8241e1951969e74400d58b779f30d1
SHA256	d14f2a8fb715b20010ba9cfe7f1fa736e96b719021fdbcbaebf59889fcf794be
SHA512	d43ffbb51ce3263634c6257dfdd0aef11d08d2f6f86ab41c25680dd783dfce62ebc0327d9b473b604bc02b863d1858a9a57fb5c61a04c57e85348bae0d46cdc4

memory/2548-53-0x000000013F5A0000-0x000000013F992000-memory.dmp

C:\Windows\system\cQnthqd.exe

MD5	d4c364210107b56abce948c0748f60af
SHA1	e03e7d7a4b3310d3ac9caa905959c5e13c99249f
SHA256	b37af23c2b10b6243686be3864aca084e10c3e5a4e2b7f806aae0138b1e29151
SHA512	8757aa728df9d6161ee7a203711ef0a1a08adc4994f241786232cef9f5bbce78ceb5226505c98523fc274d7d42723f6856e9ea87b5fed091aefc42324c7f003b

C:\Windows\system\mKrduaj.exe

MD5	2bf77207c3aa888c5b88d477a4b08c78
SHA1	40bbf2d77cf163947860781ca5b6242ae02fec4b
SHA256	796993999b19e6103167f949e48cdf80966661d7d8b64725f1c89688e0fa485d
SHA512	93cb699f5aa10586152e50c1539bc91436bbe49969ce8b6fab69cce116f8cbd4d00d48a71bb63be93479342c5e9c71b31c231aba39cdbf634c6db073c8b2b74b

C:\Windows\system\nMuSwXG.exe

MD5	4c35d280dba5a20160b0d0f89ada2532
SHA1	b2a277731aff5591a2880026616eca5b84abbefe
SHA256	3d8e2206d3847f59db1d7b22bdebfd19c36864930baa145829fedc8a2d8625f9
SHA512	10be85a7ed0043aad66993456e4cbca32590958138614234baf6a847a5c222b58c07404a67f7df766d235b77b51b557ff1038f050dbae63a62fc7966b90e7cc3

memory/2568-1954-0x000000013FE20000-0x0000000140212000-memory.dmp

memory/1460-1956-0x000000013FA20000-0x000000013FE12000-memory.dmp

memory/2716-1957-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

memory/2548-1955-0x000000013F5A0000-0x000000013F992000-memory.dmp

memory/2564-1958-0x000000013F420000-0x000000013F812000-memory.dmp

memory/2056-3305-0x000000013FF60000-0x0000000140352000-memory.dmp

memory/2456-3690-0x000000013F970000-0x000000013FD62000-memory.dmp

memory/2540-3754-0x000000013F950000-0x000000013FD42000-memory.dmp

memory/2620-4024-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 22:00

Reported

2024-06-13 22:03

Platform

win10v2004-20240226-en

Max time kernel

41s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Blocklisted process makes network request

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\XwlsPJj.exe	N/A
N/A	N/A	C:\Windows\System\oceEUZM.exe	N/A
N/A	N/A	C:\Windows\System\LKsCxKB.exe	N/A
N/A	N/A	C:\Windows\System\WkWCFry.exe	N/A
N/A	N/A	C:\Windows\System\iwjWtKI.exe	N/A
N/A	N/A	C:\Windows\System\RiCEjuT.exe	N/A
N/A	N/A	C:\Windows\System\axplnQQ.exe	N/A
N/A	N/A	C:\Windows\System\xbOOQOu.exe	N/A
N/A	N/A	C:\Windows\System\jklLMtJ.exe	N/A
N/A	N/A	C:\Windows\System\jJkCYLe.exe	N/A
N/A	N/A	C:\Windows\System\fAUEzqO.exe	N/A
N/A	N/A	C:\Windows\System\fLxHewc.exe	N/A
N/A	N/A	C:\Windows\System\uGlUOeH.exe	N/A
N/A	N/A	C:\Windows\System\FKhcOns.exe	N/A
N/A	N/A	C:\Windows\System\eVxAYGB.exe	N/A
N/A	N/A	C:\Windows\System\MgsPKqZ.exe	N/A
N/A	N/A	C:\Windows\System\JfrugdA.exe	N/A
N/A	N/A	C:\Windows\System\oACUWHn.exe	N/A
N/A	N/A	C:\Windows\System\grBgEOy.exe	N/A
N/A	N/A	C:\Windows\System\DfCmBMJ.exe	N/A
N/A	N/A	C:\Windows\System\lBzJfic.exe	N/A
N/A	N/A	C:\Windows\System\xhzCVex.exe	N/A
N/A	N/A	C:\Windows\System\gCJUPVS.exe	N/A
N/A	N/A	C:\Windows\System\EnnVUsD.exe	N/A
N/A	N/A	C:\Windows\System\kpItnno.exe	N/A
N/A	N/A	C:\Windows\System\NrEymVK.exe	N/A
N/A	N/A	C:\Windows\System\grhkOpu.exe	N/A
N/A	N/A	C:\Windows\System\fKayPjc.exe	N/A
N/A	N/A	C:\Windows\System\ftSLUel.exe	N/A
N/A	N/A	C:\Windows\System\vlDoxcR.exe	N/A
N/A	N/A	C:\Windows\System\xXgBxNI.exe	N/A
N/A	N/A	C:\Windows\System\vXfAiND.exe	N/A
N/A	N/A	C:\Windows\System\hOEFEwU.exe	N/A
N/A	N/A	C:\Windows\System\sfFxeey.exe	N/A
N/A	N/A	C:\Windows\System\CajWgWi.exe	N/A
N/A	N/A	C:\Windows\System\EwCuiQS.exe	N/A
N/A	N/A	C:\Windows\System\sAfUAIG.exe	N/A
N/A	N/A	C:\Windows\System\izMiURa.exe	N/A
N/A	N/A	C:\Windows\System\IMSfTGz.exe	N/A
N/A	N/A	C:\Windows\System\Dmlchhs.exe	N/A
N/A	N/A	C:\Windows\System\oAHXJzi.exe	N/A
N/A	N/A	C:\Windows\System\uHfNLiK.exe	N/A
N/A	N/A	C:\Windows\System\ilphoSx.exe	N/A
N/A	N/A	C:\Windows\System\ybnBgBO.exe	N/A
N/A	N/A	C:\Windows\System\Hwmzlwc.exe	N/A
N/A	N/A	C:\Windows\System\VBSWGaF.exe	N/A
N/A	N/A	C:\Windows\System\tjiDohK.exe	N/A
N/A	N/A	C:\Windows\System\fNXHFlN.exe	N/A
N/A	N/A	C:\Windows\System\ScOzgpv.exe	N/A
N/A	N/A	C:\Windows\System\nkSthfE.exe	N/A
N/A	N/A	C:\Windows\System\apeEOug.exe	N/A
N/A	N/A	C:\Windows\System\CnbuRvz.exe	N/A
N/A	N/A	C:\Windows\System\hRgcksQ.exe	N/A
N/A	N/A	C:\Windows\System\VkCiMSS.exe	N/A
N/A	N/A	C:\Windows\System\KmeQiKX.exe	N/A
N/A	N/A	C:\Windows\System\AwwPOuj.exe	N/A
N/A	N/A	C:\Windows\System\wGYuTkG.exe	N/A
N/A	N/A	C:\Windows\System\wgiwytu.exe	N/A
N/A	N/A	C:\Windows\System\UKOxOXK.exe	N/A
N/A	N/A	C:\Windows\System\zlHEtSL.exe	N/A
N/A	N/A	C:\Windows\System\RoEVRLm.exe	N/A
N/A	N/A	C:\Windows\System\eBxUAnE.exe	N/A
N/A	N/A	C:\Windows\System\gkePAdX.exe	N/A
N/A	N/A	C:\Windows\System\cLKZitt.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	raw.githubusercontent.com	N/A	N/A
N/A	raw.githubusercontent.com	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\wgiwytu.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HxjFFQH.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QwOdmqZ.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\okJloZd.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sfFxeey.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QvkmRyW.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uwRDBZG.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dededUS.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zRNripV.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eaJaphq.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gipTKZj.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bjRqSsB.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TrKAFQc.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ntXicOF.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DQqbwEs.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cunjkHJ.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hPOuntQ.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lHWQrhH.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MGZeJEP.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OUJkmvb.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nmxjCyd.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OPElIwI.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FKhcOns.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ViNakAo.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vbLzynz.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XZLxeCe.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\StlVLLT.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Hwmzlwc.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rqCuaOI.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rRFAJQP.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dggDLFg.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Dmlchhs.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IwwEqxv.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hjtXkgf.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\apfIhTz.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mbNzery.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gRRuSvi.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pcfDAcI.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kxSFhbS.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fVyIeLR.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\glxhXlj.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FHwQkwj.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gnPMpYO.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tZKLxWZ.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TfEotxM.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KmNCCId.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JKomGeP.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EtgZCFB.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IKDbNgp.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uVHgaSe.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fWXuhHG.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ErItOIZ.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QVYuYwm.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dUnlbuv.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ylwfomC.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ovJMNTD.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HyeYeZi.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YpRSurE.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xxuNDTE.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fLxHewc.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wbBSklq.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ljodsqh.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mUmPJNu.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oGVxDky.exe	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3256 wrote to memory of 4104	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3256 wrote to memory of 4104	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3256 wrote to memory of 2856	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\XwlsPJj.exe
PID 3256 wrote to memory of 2856	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\XwlsPJj.exe
PID 3256 wrote to memory of 2372	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\oceEUZM.exe
PID 3256 wrote to memory of 2372	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\oceEUZM.exe
PID 3256 wrote to memory of 4912	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\LKsCxKB.exe
PID 3256 wrote to memory of 4912	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\LKsCxKB.exe
PID 3256 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\WkWCFry.exe
PID 3256 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\WkWCFry.exe
PID 3256 wrote to memory of 656	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\iwjWtKI.exe
PID 3256 wrote to memory of 656	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\iwjWtKI.exe
PID 3256 wrote to memory of 208	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\RiCEjuT.exe
PID 3256 wrote to memory of 208	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\RiCEjuT.exe
PID 3256 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\axplnQQ.exe
PID 3256 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\axplnQQ.exe
PID 3256 wrote to memory of 3992	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\xbOOQOu.exe
PID 3256 wrote to memory of 3992	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\xbOOQOu.exe
PID 3256 wrote to memory of 1180	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\jklLMtJ.exe
PID 3256 wrote to memory of 1180	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\jklLMtJ.exe
PID 3256 wrote to memory of 1600	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\jJkCYLe.exe
PID 3256 wrote to memory of 1600	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\jJkCYLe.exe
PID 3256 wrote to memory of 4428	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\fAUEzqO.exe
PID 3256 wrote to memory of 4428	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\fAUEzqO.exe
PID 3256 wrote to memory of 3380	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\fLxHewc.exe
PID 3256 wrote to memory of 3380	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\fLxHewc.exe
PID 3256 wrote to memory of 3556	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\uGlUOeH.exe
PID 3256 wrote to memory of 3556	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\uGlUOeH.exe
PID 3256 wrote to memory of 1384	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\FKhcOns.exe
PID 3256 wrote to memory of 1384	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\FKhcOns.exe
PID 3256 wrote to memory of 1228	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\eVxAYGB.exe
PID 3256 wrote to memory of 1228	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\eVxAYGB.exe
PID 3256 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\MgsPKqZ.exe
PID 3256 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\MgsPKqZ.exe
PID 3256 wrote to memory of 4540	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\JfrugdA.exe
PID 3256 wrote to memory of 4540	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\JfrugdA.exe
PID 3256 wrote to memory of 4332	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\oACUWHn.exe
PID 3256 wrote to memory of 4332	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\oACUWHn.exe
PID 3256 wrote to memory of 3608	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\grBgEOy.exe
PID 3256 wrote to memory of 3608	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\grBgEOy.exe
PID 3256 wrote to memory of 3076	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\DfCmBMJ.exe
PID 3256 wrote to memory of 3076	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\DfCmBMJ.exe
PID 3256 wrote to memory of 2480	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\lBzJfic.exe
PID 3256 wrote to memory of 2480	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\lBzJfic.exe
PID 3256 wrote to memory of 4008	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\xhzCVex.exe
PID 3256 wrote to memory of 4008	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\xhzCVex.exe
PID 3256 wrote to memory of 5064	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\gCJUPVS.exe
PID 3256 wrote to memory of 5064	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\gCJUPVS.exe
PID 3256 wrote to memory of 4908	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\EnnVUsD.exe
PID 3256 wrote to memory of 4908	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\EnnVUsD.exe
PID 3256 wrote to memory of 4820	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\NrEymVK.exe
PID 3256 wrote to memory of 4820	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\NrEymVK.exe
PID 3256 wrote to memory of 1728	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\kpItnno.exe
PID 3256 wrote to memory of 1728	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\kpItnno.exe
PID 3256 wrote to memory of 4164	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\grhkOpu.exe
PID 3256 wrote to memory of 4164	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\grhkOpu.exe
PID 3256 wrote to memory of 3036	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\fKayPjc.exe
PID 3256 wrote to memory of 3036	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\fKayPjc.exe
PID 3256 wrote to memory of 4284	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\ftSLUel.exe
PID 3256 wrote to memory of 4284	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\ftSLUel.exe
PID 3256 wrote to memory of 4872	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\vlDoxcR.exe
PID 3256 wrote to memory of 4872	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\vlDoxcR.exe
PID 3256 wrote to memory of 2952	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\xXgBxNI.exe
PID 3256 wrote to memory of 2952	N/A	C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe	C:\Windows\System\xXgBxNI.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\XwlsPJj.exe

C:\Windows\System\XwlsPJj.exe

C:\Windows\System\oceEUZM.exe

C:\Windows\System\oceEUZM.exe

C:\Windows\System\LKsCxKB.exe

C:\Windows\System\LKsCxKB.exe

C:\Windows\System\WkWCFry.exe

C:\Windows\System\WkWCFry.exe

C:\Windows\System\iwjWtKI.exe

C:\Windows\System\iwjWtKI.exe

C:\Windows\System\RiCEjuT.exe

C:\Windows\System\RiCEjuT.exe

C:\Windows\System\axplnQQ.exe

C:\Windows\System\axplnQQ.exe

C:\Windows\System\xbOOQOu.exe

C:\Windows\System\xbOOQOu.exe

C:\Windows\System\jklLMtJ.exe

C:\Windows\System\jklLMtJ.exe

C:\Windows\System\jJkCYLe.exe

C:\Windows\System\jJkCYLe.exe

C:\Windows\System\fAUEzqO.exe

C:\Windows\System\fAUEzqO.exe

C:\Windows\System\fLxHewc.exe

C:\Windows\System\fLxHewc.exe

C:\Windows\System\uGlUOeH.exe

C:\Windows\System\uGlUOeH.exe

C:\Windows\System\FKhcOns.exe

C:\Windows\System\FKhcOns.exe

C:\Windows\System\eVxAYGB.exe

C:\Windows\System\eVxAYGB.exe

C:\Windows\System\MgsPKqZ.exe

C:\Windows\System\MgsPKqZ.exe

C:\Windows\System\JfrugdA.exe

C:\Windows\System\JfrugdA.exe

C:\Windows\System\oACUWHn.exe

C:\Windows\System\oACUWHn.exe

C:\Windows\System\grBgEOy.exe

C:\Windows\System\grBgEOy.exe

C:\Windows\System\DfCmBMJ.exe

C:\Windows\System\DfCmBMJ.exe

C:\Windows\System\lBzJfic.exe

C:\Windows\System\lBzJfic.exe

C:\Windows\System\xhzCVex.exe

C:\Windows\System\xhzCVex.exe

C:\Windows\System\gCJUPVS.exe

C:\Windows\System\gCJUPVS.exe

C:\Windows\System\EnnVUsD.exe

C:\Windows\System\EnnVUsD.exe

C:\Windows\System\NrEymVK.exe

C:\Windows\System\NrEymVK.exe

C:\Windows\System\kpItnno.exe

C:\Windows\System\kpItnno.exe

C:\Windows\System\grhkOpu.exe

C:\Windows\System\grhkOpu.exe

C:\Windows\System\fKayPjc.exe

C:\Windows\System\fKayPjc.exe

C:\Windows\System\ftSLUel.exe

C:\Windows\System\ftSLUel.exe

C:\Windows\System\vlDoxcR.exe

C:\Windows\System\vlDoxcR.exe

C:\Windows\System\xXgBxNI.exe

C:\Windows\System\xXgBxNI.exe

C:\Windows\System\vXfAiND.exe

C:\Windows\System\vXfAiND.exe

C:\Windows\System\hOEFEwU.exe

C:\Windows\System\hOEFEwU.exe

C:\Windows\System\sfFxeey.exe

C:\Windows\System\sfFxeey.exe

C:\Windows\System\CajWgWi.exe

C:\Windows\System\CajWgWi.exe

C:\Windows\System\EwCuiQS.exe

C:\Windows\System\EwCuiQS.exe

C:\Windows\System\sAfUAIG.exe

C:\Windows\System\sAfUAIG.exe

C:\Windows\System\izMiURa.exe

C:\Windows\System\izMiURa.exe

C:\Windows\System\IMSfTGz.exe

C:\Windows\System\IMSfTGz.exe

C:\Windows\System\Dmlchhs.exe

C:\Windows\System\Dmlchhs.exe

C:\Windows\System\oAHXJzi.exe

C:\Windows\System\oAHXJzi.exe

C:\Windows\System\uHfNLiK.exe

C:\Windows\System\uHfNLiK.exe

C:\Windows\System\ilphoSx.exe

C:\Windows\System\ilphoSx.exe

C:\Windows\System\ybnBgBO.exe

C:\Windows\System\ybnBgBO.exe

C:\Windows\System\Hwmzlwc.exe

C:\Windows\System\Hwmzlwc.exe

C:\Windows\System\VBSWGaF.exe

C:\Windows\System\VBSWGaF.exe

C:\Windows\System\tjiDohK.exe

C:\Windows\System\tjiDohK.exe

C:\Windows\System\fNXHFlN.exe

C:\Windows\System\fNXHFlN.exe

C:\Windows\System\ScOzgpv.exe

C:\Windows\System\ScOzgpv.exe

C:\Windows\System\nkSthfE.exe

C:\Windows\System\nkSthfE.exe

C:\Windows\System\apeEOug.exe

C:\Windows\System\apeEOug.exe

C:\Windows\System\CnbuRvz.exe

C:\Windows\System\CnbuRvz.exe

C:\Windows\System\hRgcksQ.exe

C:\Windows\System\hRgcksQ.exe

C:\Windows\System\VkCiMSS.exe

C:\Windows\System\VkCiMSS.exe

C:\Windows\System\KmeQiKX.exe

C:\Windows\System\KmeQiKX.exe

C:\Windows\System\AwwPOuj.exe

C:\Windows\System\AwwPOuj.exe

C:\Windows\System\wGYuTkG.exe

C:\Windows\System\wGYuTkG.exe

C:\Windows\System\wgiwytu.exe

C:\Windows\System\wgiwytu.exe

C:\Windows\System\UKOxOXK.exe

C:\Windows\System\UKOxOXK.exe

C:\Windows\System\zlHEtSL.exe

C:\Windows\System\zlHEtSL.exe

C:\Windows\System\RoEVRLm.exe

C:\Windows\System\RoEVRLm.exe

C:\Windows\System\eBxUAnE.exe

C:\Windows\System\eBxUAnE.exe

C:\Windows\System\gkePAdX.exe

C:\Windows\System\gkePAdX.exe

C:\Windows\System\cLKZitt.exe

C:\Windows\System\cLKZitt.exe

C:\Windows\System\prstLyl.exe

C:\Windows\System\prstLyl.exe

C:\Windows\System\hVjicRi.exe

C:\Windows\System\hVjicRi.exe

C:\Windows\System\HClpwAq.exe

C:\Windows\System\HClpwAq.exe

C:\Windows\System\ubLcpTd.exe

C:\Windows\System\ubLcpTd.exe

C:\Windows\System\rniFDDN.exe

C:\Windows\System\rniFDDN.exe

C:\Windows\System\qlgzXSw.exe

C:\Windows\System\qlgzXSw.exe

C:\Windows\System\MkLDzNe.exe

C:\Windows\System\MkLDzNe.exe

C:\Windows\System\QruQDlS.exe

C:\Windows\System\QruQDlS.exe

C:\Windows\System\pcfDAcI.exe

C:\Windows\System\pcfDAcI.exe

C:\Windows\System\cIyUnAS.exe

C:\Windows\System\cIyUnAS.exe

C:\Windows\System\WghgYHJ.exe

C:\Windows\System\WghgYHJ.exe

C:\Windows\System\XcBqiEA.exe

C:\Windows\System\XcBqiEA.exe

C:\Windows\System\dErKtQA.exe

C:\Windows\System\dErKtQA.exe

C:\Windows\System\BEmoVtQ.exe

C:\Windows\System\BEmoVtQ.exe

C:\Windows\System\mZPIBAV.exe

C:\Windows\System\mZPIBAV.exe

C:\Windows\System\kKWcOdk.exe

C:\Windows\System\kKWcOdk.exe

C:\Windows\System\UtsIDun.exe

C:\Windows\System\UtsIDun.exe

C:\Windows\System\VgEPnod.exe

C:\Windows\System\VgEPnod.exe

C:\Windows\System\AUhKKrK.exe

C:\Windows\System\AUhKKrK.exe

C:\Windows\System\mXYbayU.exe

C:\Windows\System\mXYbayU.exe

C:\Windows\System\kbWjFiE.exe

C:\Windows\System\kbWjFiE.exe

C:\Windows\System\eTggkHg.exe

C:\Windows\System\eTggkHg.exe

C:\Windows\System\opmgAXZ.exe

C:\Windows\System\opmgAXZ.exe

C:\Windows\System\hLkQJbW.exe

C:\Windows\System\hLkQJbW.exe

C:\Windows\System\FXxQlZS.exe

C:\Windows\System\FXxQlZS.exe

C:\Windows\System\EZrJAhR.exe

C:\Windows\System\EZrJAhR.exe

C:\Windows\System\KosCNqZ.exe

C:\Windows\System\KosCNqZ.exe

C:\Windows\System\cXmaaAq.exe

C:\Windows\System\cXmaaAq.exe

C:\Windows\System\wbBSklq.exe

C:\Windows\System\wbBSklq.exe

C:\Windows\System\MrDebPD.exe

C:\Windows\System\MrDebPD.exe

C:\Windows\System\WbZBtPh.exe

C:\Windows\System\WbZBtPh.exe

C:\Windows\System\xcYJZHx.exe

C:\Windows\System\xcYJZHx.exe

C:\Windows\System\aKiVoSi.exe

C:\Windows\System\aKiVoSi.exe

C:\Windows\System\pRqDPMF.exe

C:\Windows\System\pRqDPMF.exe

C:\Windows\System\ljodsqh.exe

C:\Windows\System\ljodsqh.exe

C:\Windows\System\kYeXqhp.exe

C:\Windows\System\kYeXqhp.exe

C:\Windows\System\anoMxVW.exe

C:\Windows\System\anoMxVW.exe

C:\Windows\System\ZOJjAbf.exe

C:\Windows\System\ZOJjAbf.exe

C:\Windows\System\vYAehWD.exe

C:\Windows\System\vYAehWD.exe

C:\Windows\System\tsxSxmh.exe

C:\Windows\System\tsxSxmh.exe

C:\Windows\System\HyeYeZi.exe

C:\Windows\System\HyeYeZi.exe

C:\Windows\System\JZWkMHt.exe

C:\Windows\System\JZWkMHt.exe

C:\Windows\System\qkfTHaz.exe

C:\Windows\System\qkfTHaz.exe

C:\Windows\System\mrEFgsM.exe

C:\Windows\System\mrEFgsM.exe

C:\Windows\System\tAgJcwX.exe

C:\Windows\System\tAgJcwX.exe

C:\Windows\System\FmfzWso.exe

C:\Windows\System\FmfzWso.exe

C:\Windows\System\gYQdOcy.exe

C:\Windows\System\gYQdOcy.exe

C:\Windows\System\sDKGLNP.exe

C:\Windows\System\sDKGLNP.exe

C:\Windows\System\frWrvzm.exe

C:\Windows\System\frWrvzm.exe

C:\Windows\System\udcAsCP.exe

C:\Windows\System\udcAsCP.exe

C:\Windows\System\WYyigNE.exe

C:\Windows\System\WYyigNE.exe

C:\Windows\System\XQAJuiS.exe

C:\Windows\System\XQAJuiS.exe

C:\Windows\System\pOVIwcX.exe

C:\Windows\System\pOVIwcX.exe

C:\Windows\System\dLuUnYY.exe

C:\Windows\System\dLuUnYY.exe

C:\Windows\System\XboZgbd.exe

C:\Windows\System\XboZgbd.exe

C:\Windows\System\RNYWwPE.exe

C:\Windows\System\RNYWwPE.exe

C:\Windows\System\swTwUot.exe

C:\Windows\System\swTwUot.exe

C:\Windows\System\iHzpNch.exe

C:\Windows\System\iHzpNch.exe

C:\Windows\System\zSjIkxU.exe

C:\Windows\System\zSjIkxU.exe

C:\Windows\System\htnNhuO.exe

C:\Windows\System\htnNhuO.exe

C:\Windows\System\rPfwhQM.exe

C:\Windows\System\rPfwhQM.exe

C:\Windows\System\QKKrEhJ.exe

C:\Windows\System\QKKrEhJ.exe

C:\Windows\System\nwlakzM.exe

C:\Windows\System\nwlakzM.exe

C:\Windows\System\TPhMEgO.exe

C:\Windows\System\TPhMEgO.exe

C:\Windows\System\lHWQrhH.exe

C:\Windows\System\lHWQrhH.exe

C:\Windows\System\OUJkmvb.exe

C:\Windows\System\OUJkmvb.exe

C:\Windows\System\tgiggPi.exe

C:\Windows\System\tgiggPi.exe

C:\Windows\System\wDSctJp.exe

C:\Windows\System\wDSctJp.exe

C:\Windows\System\zRNripV.exe

C:\Windows\System\zRNripV.exe

C:\Windows\System\cZIrjyG.exe

C:\Windows\System\cZIrjyG.exe

C:\Windows\System\sTWMXNj.exe

C:\Windows\System\sTWMXNj.exe

C:\Windows\System\KJpGkQh.exe

C:\Windows\System\KJpGkQh.exe

C:\Windows\System\dUUZTie.exe

C:\Windows\System\dUUZTie.exe

C:\Windows\System\IybJDiM.exe

C:\Windows\System\IybJDiM.exe

C:\Windows\System\zKFMegu.exe

C:\Windows\System\zKFMegu.exe

C:\Windows\System\oOPGkyo.exe

C:\Windows\System\oOPGkyo.exe

C:\Windows\System\nZJQsjg.exe

C:\Windows\System\nZJQsjg.exe

C:\Windows\System\ePgiCiB.exe

C:\Windows\System\ePgiCiB.exe

C:\Windows\System\ErItOIZ.exe

C:\Windows\System\ErItOIZ.exe

C:\Windows\System\LPnliYt.exe

C:\Windows\System\LPnliYt.exe

C:\Windows\System\IwwEqxv.exe

C:\Windows\System\IwwEqxv.exe

C:\Windows\System\ADjGqVp.exe

C:\Windows\System\ADjGqVp.exe

C:\Windows\System\rRFAJQP.exe

C:\Windows\System\rRFAJQP.exe

C:\Windows\System\CcgZyGD.exe

C:\Windows\System\CcgZyGD.exe

C:\Windows\System\GAstpTC.exe

C:\Windows\System\GAstpTC.exe

C:\Windows\System\kijFGWi.exe

C:\Windows\System\kijFGWi.exe

C:\Windows\System\BUUiPHp.exe

C:\Windows\System\BUUiPHp.exe

C:\Windows\System\vVtPPWI.exe

C:\Windows\System\vVtPPWI.exe

C:\Windows\System\hjtXkgf.exe

C:\Windows\System\hjtXkgf.exe

C:\Windows\System\sAWACIT.exe

C:\Windows\System\sAWACIT.exe

C:\Windows\System\bzbDZFr.exe

C:\Windows\System\bzbDZFr.exe

C:\Windows\System\SVzEsfI.exe

C:\Windows\System\SVzEsfI.exe

C:\Windows\System\tEjcBIi.exe

C:\Windows\System\tEjcBIi.exe

C:\Windows\System\eaJaphq.exe

C:\Windows\System\eaJaphq.exe

C:\Windows\System\QvkmRyW.exe

C:\Windows\System\QvkmRyW.exe

C:\Windows\System\qPWSOKF.exe

C:\Windows\System\qPWSOKF.exe

C:\Windows\System\QmevsTc.exe

C:\Windows\System\QmevsTc.exe

C:\Windows\System\lqHddsP.exe

C:\Windows\System\lqHddsP.exe

C:\Windows\System\nPhYQXK.exe

C:\Windows\System\nPhYQXK.exe

C:\Windows\System\ktMNyJm.exe

C:\Windows\System\ktMNyJm.exe

C:\Windows\System\QMpwmbV.exe

C:\Windows\System\QMpwmbV.exe

C:\Windows\System\tOlSjow.exe

C:\Windows\System\tOlSjow.exe

C:\Windows\System\gipTKZj.exe

C:\Windows\System\gipTKZj.exe

C:\Windows\System\nYkgWjE.exe

C:\Windows\System\nYkgWjE.exe

C:\Windows\System\jwbyDHf.exe

C:\Windows\System\jwbyDHf.exe

C:\Windows\System\yXZbXZm.exe

C:\Windows\System\yXZbXZm.exe

C:\Windows\System\lCnIkIj.exe

C:\Windows\System\lCnIkIj.exe

C:\Windows\System\AzWiAmi.exe

C:\Windows\System\AzWiAmi.exe

C:\Windows\System\bOpOltI.exe

C:\Windows\System\bOpOltI.exe

C:\Windows\System\brzatwr.exe

C:\Windows\System\brzatwr.exe

C:\Windows\System\tKnayxW.exe

C:\Windows\System\tKnayxW.exe

C:\Windows\System\hTiJHsz.exe

C:\Windows\System\hTiJHsz.exe

C:\Windows\System\CeZVRfB.exe

C:\Windows\System\CeZVRfB.exe

C:\Windows\System\aSXfDxs.exe

C:\Windows\System\aSXfDxs.exe

C:\Windows\System\JWyMwkn.exe

C:\Windows\System\JWyMwkn.exe

C:\Windows\System\qxfnmXN.exe

C:\Windows\System\qxfnmXN.exe

C:\Windows\System\haGDmFE.exe

C:\Windows\System\haGDmFE.exe

C:\Windows\System\NyAjYsK.exe

C:\Windows\System\NyAjYsK.exe

C:\Windows\System\kcsvprr.exe

C:\Windows\System\kcsvprr.exe

C:\Windows\System\OohNbYf.exe

C:\Windows\System\OohNbYf.exe

C:\Windows\System\JToAwGw.exe

C:\Windows\System\JToAwGw.exe

C:\Windows\System\rlVeGLr.exe

C:\Windows\System\rlVeGLr.exe

C:\Windows\System\qwQcvkd.exe

C:\Windows\System\qwQcvkd.exe

C:\Windows\System\QBxftUK.exe

C:\Windows\System\QBxftUK.exe

C:\Windows\System\jtaavtI.exe

C:\Windows\System\jtaavtI.exe

C:\Windows\System\ekRHGqW.exe

C:\Windows\System\ekRHGqW.exe

C:\Windows\System\klvufoF.exe

C:\Windows\System\klvufoF.exe

C:\Windows\System\xBpignp.exe

C:\Windows\System\xBpignp.exe

C:\Windows\System\qXhJKPi.exe

C:\Windows\System\qXhJKPi.exe

C:\Windows\System\SyCmBkN.exe

C:\Windows\System\SyCmBkN.exe

C:\Windows\System\fJoPdLs.exe

C:\Windows\System\fJoPdLs.exe

C:\Windows\System\ngwSoHW.exe

C:\Windows\System\ngwSoHW.exe

C:\Windows\System\SJkoenr.exe

C:\Windows\System\SJkoenr.exe

C:\Windows\System\HxjFFQH.exe

C:\Windows\System\HxjFFQH.exe

C:\Windows\System\JmkGKXB.exe

C:\Windows\System\JmkGKXB.exe

C:\Windows\System\wrNIegd.exe

C:\Windows\System\wrNIegd.exe

C:\Windows\System\dEaYBjB.exe

C:\Windows\System\dEaYBjB.exe

C:\Windows\System\HPFGwVE.exe

C:\Windows\System\HPFGwVE.exe

C:\Windows\System\fHvTVSl.exe

C:\Windows\System\fHvTVSl.exe

C:\Windows\System\apfIhTz.exe

C:\Windows\System\apfIhTz.exe

C:\Windows\System\kxSFhbS.exe

C:\Windows\System\kxSFhbS.exe

C:\Windows\System\AzRSXyl.exe

C:\Windows\System\AzRSXyl.exe

C:\Windows\System\fVyIeLR.exe

C:\Windows\System\fVyIeLR.exe

C:\Windows\System\ViNakAo.exe

C:\Windows\System\ViNakAo.exe

C:\Windows\System\RUygjCm.exe

C:\Windows\System\RUygjCm.exe

C:\Windows\System\rxNNWPn.exe

C:\Windows\System\rxNNWPn.exe

C:\Windows\System\undWNtD.exe

C:\Windows\System\undWNtD.exe

C:\Windows\System\bqCpKdy.exe

C:\Windows\System\bqCpKdy.exe

C:\Windows\System\rbcipMK.exe

C:\Windows\System\rbcipMK.exe

C:\Windows\System\caMXXTx.exe

C:\Windows\System\caMXXTx.exe

C:\Windows\System\QwOdmqZ.exe

C:\Windows\System\QwOdmqZ.exe

C:\Windows\System\rqCuaOI.exe

C:\Windows\System\rqCuaOI.exe

C:\Windows\System\fIDcVFE.exe

C:\Windows\System\fIDcVFE.exe

C:\Windows\System\fJivxUM.exe

C:\Windows\System\fJivxUM.exe

C:\Windows\System\ghadyAv.exe

C:\Windows\System\ghadyAv.exe

C:\Windows\System\mUmPJNu.exe

C:\Windows\System\mUmPJNu.exe

C:\Windows\System\RfSCzLj.exe

C:\Windows\System\RfSCzLj.exe

C:\Windows\System\VSNHddl.exe

C:\Windows\System\VSNHddl.exe

C:\Windows\System\DZdSbZM.exe

C:\Windows\System\DZdSbZM.exe

C:\Windows\System\WtziRFb.exe

C:\Windows\System\WtziRFb.exe

C:\Windows\System\TzZiOeD.exe

C:\Windows\System\TzZiOeD.exe

C:\Windows\System\QVYuYwm.exe

C:\Windows\System\QVYuYwm.exe

C:\Windows\System\ZaXiCtx.exe

C:\Windows\System\ZaXiCtx.exe

C:\Windows\System\tOgSoHa.exe

C:\Windows\System\tOgSoHa.exe

C:\Windows\System\JcyzZpW.exe

C:\Windows\System\JcyzZpW.exe

C:\Windows\System\fjTflHu.exe

C:\Windows\System\fjTflHu.exe

C:\Windows\System\RMjuWjL.exe

C:\Windows\System\RMjuWjL.exe

C:\Windows\System\QmEiJdy.exe

C:\Windows\System\QmEiJdy.exe

C:\Windows\System\MALfGLU.exe

C:\Windows\System\MALfGLU.exe

C:\Windows\System\bjRqSsB.exe

C:\Windows\System\bjRqSsB.exe

C:\Windows\System\HyWlBeV.exe

C:\Windows\System\HyWlBeV.exe

C:\Windows\System\nYHVzeE.exe

C:\Windows\System\nYHVzeE.exe

C:\Windows\System\vbLzynz.exe

C:\Windows\System\vbLzynz.exe

C:\Windows\System\dhNqzrl.exe

C:\Windows\System\dhNqzrl.exe

C:\Windows\System\uwRDBZG.exe

C:\Windows\System\uwRDBZG.exe

C:\Windows\System\gpFDvxV.exe

C:\Windows\System\gpFDvxV.exe

C:\Windows\System\ReuVaiV.exe

C:\Windows\System\ReuVaiV.exe

C:\Windows\System\glxhXlj.exe

C:\Windows\System\glxhXlj.exe

C:\Windows\System\LWrhlUr.exe

C:\Windows\System\LWrhlUr.exe

C:\Windows\System\ivMFNTN.exe

C:\Windows\System\ivMFNTN.exe

C:\Windows\System\MQnyRXs.exe

C:\Windows\System\MQnyRXs.exe

C:\Windows\System\vaIwdfB.exe

C:\Windows\System\vaIwdfB.exe

C:\Windows\System\fSiARxR.exe

C:\Windows\System\fSiARxR.exe

C:\Windows\System\GmCnuaw.exe

C:\Windows\System\GmCnuaw.exe

C:\Windows\System\UWauIaj.exe

C:\Windows\System\UWauIaj.exe

C:\Windows\System\jaSaADa.exe

C:\Windows\System\jaSaADa.exe

C:\Windows\System\YpRSurE.exe

C:\Windows\System\YpRSurE.exe

C:\Windows\System\gCikUdq.exe

C:\Windows\System\gCikUdq.exe

C:\Windows\System\WhMcGLb.exe

C:\Windows\System\WhMcGLb.exe

C:\Windows\System\yWqxYai.exe

C:\Windows\System\yWqxYai.exe

C:\Windows\System\BGscRES.exe

C:\Windows\System\BGscRES.exe

C:\Windows\System\XWpBlGu.exe

C:\Windows\System\XWpBlGu.exe

C:\Windows\System\DQqbwEs.exe

C:\Windows\System\DQqbwEs.exe

C:\Windows\System\xnnTMWO.exe

C:\Windows\System\xnnTMWO.exe

C:\Windows\System\QJVpTXB.exe

C:\Windows\System\QJVpTXB.exe

C:\Windows\System\XZLxeCe.exe

C:\Windows\System\XZLxeCe.exe

C:\Windows\System\dUnlbuv.exe

C:\Windows\System\dUnlbuv.exe

C:\Windows\System\bCcEfcJ.exe

C:\Windows\System\bCcEfcJ.exe

C:\Windows\System\bnHpEgr.exe

C:\Windows\System\bnHpEgr.exe

C:\Windows\System\MGZeJEP.exe

C:\Windows\System\MGZeJEP.exe

C:\Windows\System\niqdqmE.exe

C:\Windows\System\niqdqmE.exe

C:\Windows\System\xaibGga.exe

C:\Windows\System\xaibGga.exe

C:\Windows\System\jHkONcG.exe

C:\Windows\System\jHkONcG.exe

C:\Windows\System\ywdEeLf.exe

C:\Windows\System\ywdEeLf.exe

C:\Windows\System\czAeUbm.exe

C:\Windows\System\czAeUbm.exe

C:\Windows\System\zvLHXMm.exe

C:\Windows\System\zvLHXMm.exe

C:\Windows\System\nrvQREV.exe

C:\Windows\System\nrvQREV.exe

C:\Windows\System\KoHKnBK.exe

C:\Windows\System\KoHKnBK.exe

C:\Windows\System\nsCLcPS.exe

C:\Windows\System\nsCLcPS.exe

C:\Windows\System\AlHHTZT.exe

C:\Windows\System\AlHHTZT.exe

C:\Windows\System\ANiTDIB.exe

C:\Windows\System\ANiTDIB.exe

C:\Windows\System\tZKLxWZ.exe

C:\Windows\System\tZKLxWZ.exe

C:\Windows\System\XdbbyGR.exe

C:\Windows\System\XdbbyGR.exe

C:\Windows\System\gGMzLUj.exe

C:\Windows\System\gGMzLUj.exe

C:\Windows\System\zURunjB.exe

C:\Windows\System\zURunjB.exe

C:\Windows\System\KObNTGC.exe

C:\Windows\System\KObNTGC.exe

C:\Windows\System\aNrbuZN.exe

C:\Windows\System\aNrbuZN.exe

C:\Windows\System\IlOZucC.exe

C:\Windows\System\IlOZucC.exe

C:\Windows\System\HdpBcfg.exe

C:\Windows\System\HdpBcfg.exe

C:\Windows\System\TfEotxM.exe

C:\Windows\System\TfEotxM.exe

C:\Windows\System\HdRcywT.exe

C:\Windows\System\HdRcywT.exe

C:\Windows\System\aubFRAP.exe

C:\Windows\System\aubFRAP.exe

C:\Windows\System\vOIyRuF.exe

C:\Windows\System\vOIyRuF.exe

C:\Windows\System\tiNGkBb.exe

C:\Windows\System\tiNGkBb.exe

C:\Windows\System\jYBnnEW.exe

C:\Windows\System\jYBnnEW.exe

C:\Windows\System\TrKAFQc.exe

C:\Windows\System\TrKAFQc.exe

C:\Windows\System\FHwQkwj.exe

C:\Windows\System\FHwQkwj.exe

C:\Windows\System\gnPMpYO.exe

C:\Windows\System\gnPMpYO.exe

C:\Windows\System\FWHWZpV.exe

C:\Windows\System\FWHWZpV.exe

C:\Windows\System\moSpeNj.exe

C:\Windows\System\moSpeNj.exe

C:\Windows\System\YuouKff.exe

C:\Windows\System\YuouKff.exe

C:\Windows\System\ojILssB.exe

C:\Windows\System\ojILssB.exe

C:\Windows\System\SbYhxRR.exe

C:\Windows\System\SbYhxRR.exe

C:\Windows\System\CNNMPbP.exe

C:\Windows\System\CNNMPbP.exe

C:\Windows\System\MBZqQhJ.exe

C:\Windows\System\MBZqQhJ.exe

C:\Windows\System\bZyGZaG.exe

C:\Windows\System\bZyGZaG.exe

C:\Windows\System\bSZYtik.exe

C:\Windows\System\bSZYtik.exe

C:\Windows\System\lUFEpdA.exe

C:\Windows\System\lUFEpdA.exe

C:\Windows\System\ZHkLUAG.exe

C:\Windows\System\ZHkLUAG.exe

C:\Windows\System\fKtZMyC.exe

C:\Windows\System\fKtZMyC.exe

C:\Windows\System\KmNCCId.exe

C:\Windows\System\KmNCCId.exe

C:\Windows\System\VnEvtOc.exe

C:\Windows\System\VnEvtOc.exe

C:\Windows\System\EEbyjgm.exe

C:\Windows\System\EEbyjgm.exe

C:\Windows\System\bWnuYis.exe

C:\Windows\System\bWnuYis.exe

C:\Windows\System\dtYBNJJ.exe

C:\Windows\System\dtYBNJJ.exe

C:\Windows\System\SebLpdE.exe

C:\Windows\System\SebLpdE.exe

C:\Windows\System\PVqxsav.exe

C:\Windows\System\PVqxsav.exe

C:\Windows\System\EnPOfRn.exe

C:\Windows\System\EnPOfRn.exe

C:\Windows\System\DmMWSRG.exe

C:\Windows\System\DmMWSRG.exe

C:\Windows\System\HJgXnMc.exe

C:\Windows\System\HJgXnMc.exe

C:\Windows\System\xxuNDTE.exe

C:\Windows\System\xxuNDTE.exe

C:\Windows\System\RwkVOxu.exe

C:\Windows\System\RwkVOxu.exe

C:\Windows\System\NlruKmT.exe

C:\Windows\System\NlruKmT.exe

C:\Windows\System\XchklIz.exe

C:\Windows\System\XchklIz.exe

C:\Windows\System\Aoecjes.exe

C:\Windows\System\Aoecjes.exe

C:\Windows\System\nmxjCyd.exe

C:\Windows\System\nmxjCyd.exe

C:\Windows\System\iGKbhzz.exe

C:\Windows\System\iGKbhzz.exe

C:\Windows\System\rKNIxZF.exe

C:\Windows\System\rKNIxZF.exe

C:\Windows\System\orPfKcT.exe

C:\Windows\System\orPfKcT.exe

C:\Windows\System\EvBOXVm.exe

C:\Windows\System\EvBOXVm.exe

C:\Windows\System\iOruyhV.exe

C:\Windows\System\iOruyhV.exe

C:\Windows\System\MgThTYu.exe

C:\Windows\System\MgThTYu.exe

C:\Windows\System\STxeFvW.exe

C:\Windows\System\STxeFvW.exe

C:\Windows\System\QFdfttM.exe

C:\Windows\System\QFdfttM.exe

C:\Windows\System\WshUeEH.exe

C:\Windows\System\WshUeEH.exe

C:\Windows\System\ykUXFbr.exe

C:\Windows\System\ykUXFbr.exe

C:\Windows\System\GdREaPS.exe

C:\Windows\System\GdREaPS.exe

C:\Windows\System\CkddWmo.exe

C:\Windows\System\CkddWmo.exe

C:\Windows\System\DsmuPYY.exe

C:\Windows\System\DsmuPYY.exe

C:\Windows\System\bwoeKBf.exe

C:\Windows\System\bwoeKBf.exe

C:\Windows\System\QjKSjEO.exe

C:\Windows\System\QjKSjEO.exe

C:\Windows\System\vJZWPeV.exe

C:\Windows\System\vJZWPeV.exe

C:\Windows\System\ylwfomC.exe

C:\Windows\System\ylwfomC.exe

C:\Windows\System\tkOBFoe.exe

C:\Windows\System\tkOBFoe.exe

C:\Windows\System\lZHnVrc.exe

C:\Windows\System\lZHnVrc.exe

C:\Windows\System\ZEASaSV.exe

C:\Windows\System\ZEASaSV.exe

C:\Windows\System\SZmAJxl.exe

C:\Windows\System\SZmAJxl.exe

C:\Windows\System\GiRsPKa.exe

C:\Windows\System\GiRsPKa.exe

C:\Windows\System\ndOdAvx.exe

C:\Windows\System\ndOdAvx.exe

C:\Windows\System\VAMrYPe.exe

C:\Windows\System\VAMrYPe.exe

C:\Windows\System\mbNzery.exe

C:\Windows\System\mbNzery.exe

C:\Windows\System\FfuPjBv.exe

C:\Windows\System\FfuPjBv.exe

C:\Windows\System\VYBqHzE.exe

C:\Windows\System\VYBqHzE.exe

C:\Windows\System\xHXfJVi.exe

C:\Windows\System\xHXfJVi.exe

C:\Windows\System\xNodHRA.exe

C:\Windows\System\xNodHRA.exe

C:\Windows\System\DfYerRa.exe

C:\Windows\System\DfYerRa.exe

C:\Windows\System\NtVhemy.exe

C:\Windows\System\NtVhemy.exe

C:\Windows\System\ntXicOF.exe

C:\Windows\System\ntXicOF.exe

C:\Windows\System\dmAKcNR.exe

C:\Windows\System\dmAKcNR.exe

C:\Windows\System\RIYseOc.exe

C:\Windows\System\RIYseOc.exe

C:\Windows\System\VeKRwHm.exe

C:\Windows\System\VeKRwHm.exe

C:\Windows\System\kWUsesW.exe

C:\Windows\System\kWUsesW.exe

C:\Windows\System\kDZdiUW.exe

C:\Windows\System\kDZdiUW.exe

C:\Windows\System\GikAKBZ.exe

C:\Windows\System\GikAKBZ.exe

C:\Windows\System\zGLsoij.exe

C:\Windows\System\zGLsoij.exe

C:\Windows\System\ovJMNTD.exe

C:\Windows\System\ovJMNTD.exe

C:\Windows\System\WLMIvmu.exe

C:\Windows\System\WLMIvmu.exe

C:\Windows\System\dededUS.exe

C:\Windows\System\dededUS.exe

C:\Windows\System\sfEynYA.exe

C:\Windows\System\sfEynYA.exe

C:\Windows\System\sHvcHzQ.exe

C:\Windows\System\sHvcHzQ.exe

C:\Windows\System\mgLQtRX.exe

C:\Windows\System\mgLQtRX.exe

C:\Windows\System\ibKIdJL.exe

C:\Windows\System\ibKIdJL.exe

C:\Windows\System\ceyrGxv.exe

C:\Windows\System\ceyrGxv.exe

C:\Windows\System\FyFrDXQ.exe

C:\Windows\System\FyFrDXQ.exe

C:\Windows\System\AYmheUN.exe

C:\Windows\System\AYmheUN.exe

C:\Windows\System\NzyFEcs.exe

C:\Windows\System\NzyFEcs.exe

C:\Windows\System\JKomGeP.exe

C:\Windows\System\JKomGeP.exe

C:\Windows\System\pSgcNHP.exe

C:\Windows\System\pSgcNHP.exe

C:\Windows\System\WlFcWId.exe

C:\Windows\System\WlFcWId.exe

C:\Windows\System\mXDXEhW.exe

C:\Windows\System\mXDXEhW.exe

C:\Windows\System\sohtzlN.exe

C:\Windows\System\sohtzlN.exe

C:\Windows\System\LTdbJNw.exe

C:\Windows\System\LTdbJNw.exe

C:\Windows\System\cunjkHJ.exe

C:\Windows\System\cunjkHJ.exe

C:\Windows\System\JPyWvlo.exe

C:\Windows\System\JPyWvlo.exe

C:\Windows\System\pDoLBQf.exe

C:\Windows\System\pDoLBQf.exe

C:\Windows\System\oGVxDky.exe

C:\Windows\System\oGVxDky.exe

C:\Windows\System\SyPjjZO.exe

C:\Windows\System\SyPjjZO.exe

C:\Windows\System\JIvBilR.exe

C:\Windows\System\JIvBilR.exe

C:\Windows\System\QnWhHXF.exe

C:\Windows\System\QnWhHXF.exe

C:\Windows\System\ndNYFDq.exe

C:\Windows\System\ndNYFDq.exe

C:\Windows\System\vswYpha.exe

C:\Windows\System\vswYpha.exe

C:\Windows\System\kYmULVe.exe

C:\Windows\System\kYmULVe.exe

C:\Windows\System\nQlEeJQ.exe

C:\Windows\System\nQlEeJQ.exe

C:\Windows\System\fWIozGn.exe

C:\Windows\System\fWIozGn.exe

C:\Windows\System\jaSyddN.exe

C:\Windows\System\jaSyddN.exe

C:\Windows\System\zOIvvec.exe

C:\Windows\System\zOIvvec.exe

C:\Windows\System\ntBFdpo.exe

C:\Windows\System\ntBFdpo.exe

C:\Windows\System\nWWYrjK.exe

C:\Windows\System\nWWYrjK.exe

C:\Windows\System\COKVCga.exe

C:\Windows\System\COKVCga.exe

C:\Windows\System\GEmKeod.exe

C:\Windows\System\GEmKeod.exe

C:\Windows\System\DSHncTn.exe

C:\Windows\System\DSHncTn.exe

C:\Windows\System\MAnsovM.exe

C:\Windows\System\MAnsovM.exe

C:\Windows\System\OzIGDRY.exe

C:\Windows\System\OzIGDRY.exe

C:\Windows\System\UhPqQhE.exe

C:\Windows\System\UhPqQhE.exe

C:\Windows\System\aSfGwHO.exe

C:\Windows\System\aSfGwHO.exe

C:\Windows\System\WobxUID.exe

C:\Windows\System\WobxUID.exe

C:\Windows\System\iasNvTm.exe

C:\Windows\System\iasNvTm.exe

C:\Windows\System\RCBmRUC.exe

C:\Windows\System\RCBmRUC.exe

C:\Windows\System\xPLvtCq.exe

C:\Windows\System\xPLvtCq.exe

C:\Windows\System\dggDLFg.exe

C:\Windows\System\dggDLFg.exe

C:\Windows\System\tcxgxYA.exe

C:\Windows\System\tcxgxYA.exe

C:\Windows\System\RwFvyEV.exe

C:\Windows\System\RwFvyEV.exe

C:\Windows\System\pzRhcOa.exe

C:\Windows\System\pzRhcOa.exe

C:\Windows\System\KQJcLpM.exe

C:\Windows\System\KQJcLpM.exe

C:\Windows\System\sGRFRQT.exe

C:\Windows\System\sGRFRQT.exe

C:\Windows\System\SNChGPu.exe

C:\Windows\System\SNChGPu.exe

C:\Windows\System\nSEqMoq.exe

C:\Windows\System\nSEqMoq.exe

C:\Windows\System\rkhzXuw.exe

C:\Windows\System\rkhzXuw.exe

C:\Windows\System\XobmlKE.exe

C:\Windows\System\XobmlKE.exe

C:\Windows\System\aBuQRZa.exe

C:\Windows\System\aBuQRZa.exe

C:\Windows\System\nABRmwU.exe

C:\Windows\System\nABRmwU.exe

C:\Windows\System\QjZJaDN.exe

C:\Windows\System\QjZJaDN.exe

C:\Windows\System\jNxaQwU.exe

C:\Windows\System\jNxaQwU.exe

C:\Windows\System\VflNRHm.exe

C:\Windows\System\VflNRHm.exe

C:\Windows\System\kcPntKk.exe

C:\Windows\System\kcPntKk.exe

C:\Windows\System\tpWJKOz.exe

C:\Windows\System\tpWJKOz.exe

C:\Windows\System\TbSHsNN.exe

C:\Windows\System\TbSHsNN.exe

C:\Windows\System\fgUCypP.exe

C:\Windows\System\fgUCypP.exe

C:\Windows\System\wVIUqjQ.exe

C:\Windows\System\wVIUqjQ.exe

C:\Windows\System\StlVLLT.exe

C:\Windows\System\StlVLLT.exe

C:\Windows\System\qMSVkiv.exe

C:\Windows\System\qMSVkiv.exe

C:\Windows\System\neJUMck.exe

C:\Windows\System\neJUMck.exe

C:\Windows\System\fnkSIwY.exe

C:\Windows\System\fnkSIwY.exe

C:\Windows\System\OefLjwj.exe

C:\Windows\System\OefLjwj.exe

C:\Windows\System\rVdQaZU.exe

C:\Windows\System\rVdQaZU.exe

C:\Windows\System\nzLlFUr.exe

C:\Windows\System\nzLlFUr.exe

C:\Windows\System\hPOuntQ.exe

C:\Windows\System\hPOuntQ.exe

C:\Windows\System\elRcnyl.exe

C:\Windows\System\elRcnyl.exe

C:\Windows\System\OdqSUXd.exe

C:\Windows\System\OdqSUXd.exe

C:\Windows\System\NapasGN.exe

C:\Windows\System\NapasGN.exe

C:\Windows\System\gRRuSvi.exe

C:\Windows\System\gRRuSvi.exe

C:\Windows\System\sqTfSjP.exe

C:\Windows\System\sqTfSjP.exe

C:\Windows\System\aXTWVYX.exe

C:\Windows\System\aXTWVYX.exe

C:\Windows\System\clWczst.exe

C:\Windows\System\clWczst.exe

C:\Windows\System\igFawTz.exe

C:\Windows\System\igFawTz.exe

C:\Windows\System\MFeRkRj.exe

C:\Windows\System\MFeRkRj.exe

C:\Windows\System\OPElIwI.exe

C:\Windows\System\OPElIwI.exe

C:\Windows\System\LcwKwba.exe

C:\Windows\System\LcwKwba.exe

C:\Windows\System\okJloZd.exe

C:\Windows\System\okJloZd.exe

C:\Windows\System\jdQyrVj.exe

C:\Windows\System\jdQyrVj.exe

C:\Windows\System\fPWEJhP.exe

C:\Windows\System\fPWEJhP.exe

C:\Windows\System\EoKopQK.exe

C:\Windows\System\EoKopQK.exe

C:\Windows\System\xLxwzfX.exe

C:\Windows\System\xLxwzfX.exe

C:\Windows\System\CCVlNcZ.exe

C:\Windows\System\CCVlNcZ.exe

C:\Windows\System\QrnPkGR.exe

C:\Windows\System\QrnPkGR.exe

C:\Windows\System\EtgZCFB.exe

C:\Windows\System\EtgZCFB.exe

C:\Windows\System\yUOtQXi.exe

C:\Windows\System\yUOtQXi.exe

C:\Windows\System\WdWgaNv.exe

C:\Windows\System\WdWgaNv.exe

C:\Windows\System\rRNaSub.exe

C:\Windows\System\rRNaSub.exe

C:\Windows\System\uVHgaSe.exe

C:\Windows\System\uVHgaSe.exe

C:\Windows\System\MvrpcGy.exe

C:\Windows\System\MvrpcGy.exe

C:\Windows\System\NSicFFP.exe

C:\Windows\System\NSicFFP.exe

C:\Windows\System\fagjMLF.exe

C:\Windows\System\fagjMLF.exe

C:\Windows\System\ugEmfNy.exe

C:\Windows\System\ugEmfNy.exe

C:\Windows\System\UmAMcjn.exe

C:\Windows\System\UmAMcjn.exe

C:\Windows\System\rhbVeec.exe

C:\Windows\System\rhbVeec.exe

C:\Windows\System\fWXuhHG.exe

C:\Windows\System\fWXuhHG.exe

C:\Windows\System\DgAVlXS.exe

C:\Windows\System\DgAVlXS.exe

C:\Windows\System\tPGXtwf.exe

C:\Windows\System\tPGXtwf.exe

C:\Windows\System\xCBIDvX.exe

C:\Windows\System\xCBIDvX.exe

C:\Windows\System\oErVJvO.exe

C:\Windows\System\oErVJvO.exe

C:\Windows\System\IKDbNgp.exe

C:\Windows\System\IKDbNgp.exe

C:\Windows\System\cEgLCqP.exe

C:\Windows\System\cEgLCqP.exe

C:\Windows\System\jcqlbug.exe

C:\Windows\System\jcqlbug.exe

C:\Windows\System\LCpMycR.exe

C:\Windows\System\LCpMycR.exe

C:\Windows\System\seGzrAY.exe

C:\Windows\System\seGzrAY.exe

C:\Windows\System\cNbvfgO.exe

C:\Windows\System\cNbvfgO.exe

C:\Windows\System\rMrhejh.exe

C:\Windows\System\rMrhejh.exe

C:\Windows\System\uSHMIoI.exe

C:\Windows\System\uSHMIoI.exe

C:\Windows\System\tIGeidT.exe

C:\Windows\System\tIGeidT.exe

C:\Windows\System\cecZSmS.exe

C:\Windows\System\cecZSmS.exe

C:\Windows\System\YFpNpTK.exe

C:\Windows\System\YFpNpTK.exe

C:\Windows\System\vuOjrVe.exe

C:\Windows\System\vuOjrVe.exe

C:\Windows\System\xPLzSkp.exe

C:\Windows\System\xPLzSkp.exe

C:\Windows\System\nLaXdBC.exe

C:\Windows\System\nLaXdBC.exe

C:\Windows\System\UnPEUAb.exe

C:\Windows\System\UnPEUAb.exe

C:\Windows\System\DYsgPGP.exe

C:\Windows\System\DYsgPGP.exe

C:\Windows\System\tdfsUum.exe

C:\Windows\System\tdfsUum.exe

C:\Windows\System\SdFXLDj.exe

C:\Windows\System\SdFXLDj.exe

C:\Windows\System\DsfEJLs.exe

C:\Windows\System\DsfEJLs.exe

C:\Windows\System\UBgEruj.exe

C:\Windows\System\UBgEruj.exe

C:\Windows\System\ZXLhcOR.exe

C:\Windows\System\ZXLhcOR.exe

C:\Windows\System\CyjpLDE.exe

C:\Windows\System\CyjpLDE.exe

C:\Windows\System\bfdNuAd.exe

C:\Windows\System\bfdNuAd.exe

C:\Windows\System\gmGUkMB.exe

C:\Windows\System\gmGUkMB.exe

C:\Windows\System\sJJpMdn.exe

C:\Windows\System\sJJpMdn.exe

C:\Windows\System\yWMhaVb.exe

C:\Windows\System\yWMhaVb.exe

C:\Windows\System\uakNund.exe

C:\Windows\System\uakNund.exe

C:\Windows\System\oZAkoRr.exe

C:\Windows\System\oZAkoRr.exe

C:\Windows\System\CfFQXxi.exe

C:\Windows\System\CfFQXxi.exe

C:\Windows\System\HjgGPoc.exe

C:\Windows\System\HjgGPoc.exe

C:\Windows\System\OeuFwwM.exe

C:\Windows\System\OeuFwwM.exe

C:\Windows\System\WEHEicF.exe

C:\Windows\System\WEHEicF.exe

C:\Windows\System\cLordwx.exe

C:\Windows\System\cLordwx.exe

C:\Windows\System\nsyygif.exe

C:\Windows\System\nsyygif.exe

C:\Windows\System\wfZlpuX.exe

C:\Windows\System\wfZlpuX.exe

C:\Windows\System\mEgngsz.exe

C:\Windows\System\mEgngsz.exe

C:\Windows\System\yPSIQpM.exe

C:\Windows\System\yPSIQpM.exe

C:\Windows\System\OBAoVcW.exe

C:\Windows\System\OBAoVcW.exe

C:\Windows\System\IVLSlxV.exe

C:\Windows\System\IVLSlxV.exe

C:\Windows\System\NRvNgHb.exe

C:\Windows\System\NRvNgHb.exe

C:\Windows\System\YPKJOJi.exe

C:\Windows\System\YPKJOJi.exe

C:\Windows\System\CcbWAPk.exe

C:\Windows\System\CcbWAPk.exe

C:\Windows\System\EgtViAT.exe

C:\Windows\System\EgtViAT.exe

C:\Windows\System\nCxQEta.exe

C:\Windows\System\nCxQEta.exe

C:\Windows\System\NIcMsCz.exe

C:\Windows\System\NIcMsCz.exe

C:\Windows\System\DCZlaRJ.exe

C:\Windows\System\DCZlaRJ.exe

C:\Windows\System\AWdCaaH.exe

C:\Windows\System\AWdCaaH.exe

C:\Windows\System\uzdgjZg.exe

C:\Windows\System\uzdgjZg.exe

C:\Windows\System\YECcOGC.exe

C:\Windows\System\YECcOGC.exe

C:\Windows\System\XSoKrCf.exe

C:\Windows\System\XSoKrCf.exe

C:\Windows\System\bZKCtUY.exe

C:\Windows\System\bZKCtUY.exe

C:\Windows\System\iDJGjwc.exe

C:\Windows\System\iDJGjwc.exe

C:\Windows\System\foMdMRs.exe

C:\Windows\System\foMdMRs.exe

C:\Windows\System\TybzyJh.exe

C:\Windows\System\TybzyJh.exe

C:\Windows\System\OQvIVYK.exe

C:\Windows\System\OQvIVYK.exe

C:\Windows\System\dBBOutN.exe

C:\Windows\System\dBBOutN.exe

C:\Windows\System\FJStSus.exe

C:\Windows\System\FJStSus.exe

C:\Windows\System\AouCYkw.exe

C:\Windows\System\AouCYkw.exe

C:\Windows\System\HruvzNh.exe

C:\Windows\System\HruvzNh.exe

C:\Windows\System\ESlBjqb.exe

C:\Windows\System\ESlBjqb.exe

C:\Windows\System\uGsspXT.exe

C:\Windows\System\uGsspXT.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3592 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8

C:\Windows\System\WgPuUUU.exe

C:\Windows\System\WgPuUUU.exe

C:\Windows\System\mafvSmd.exe

C:\Windows\System\mafvSmd.exe

C:\Windows\System\qvvOqGO.exe

C:\Windows\System\qvvOqGO.exe

C:\Windows\System\LleECFp.exe

C:\Windows\System\LleECFp.exe

C:\Windows\System\aERLwjl.exe

C:\Windows\System\aERLwjl.exe

C:\Windows\System\WZfpfWY.exe

C:\Windows\System\WZfpfWY.exe

C:\Windows\System\LGlYQUs.exe

C:\Windows\System\LGlYQUs.exe

C:\Windows\System\FMeikbn.exe

C:\Windows\System\FMeikbn.exe

C:\Windows\System\owzGJsH.exe

C:\Windows\System\owzGJsH.exe

C:\Windows\System\XGQqHmn.exe

C:\Windows\System\XGQqHmn.exe

C:\Windows\System\GyMBBPK.exe

C:\Windows\System\GyMBBPK.exe

C:\Windows\System\TnGXHQi.exe

C:\Windows\System\TnGXHQi.exe

C:\Windows\System\sdggBgR.exe

C:\Windows\System\sdggBgR.exe

C:\Windows\System\tHTpGeF.exe

C:\Windows\System\tHTpGeF.exe

C:\Windows\System\eumPzHa.exe

C:\Windows\System\eumPzHa.exe

C:\Windows\System\WaKweOg.exe

C:\Windows\System\WaKweOg.exe

C:\Windows\System\jAyygQT.exe

C:\Windows\System\jAyygQT.exe

C:\Windows\System\MSaLAfg.exe

C:\Windows\System\MSaLAfg.exe

C:\Windows\System\UIVslWa.exe

C:\Windows\System\UIVslWa.exe

C:\Windows\System\sZZINtY.exe

C:\Windows\System\sZZINtY.exe

C:\Windows\System\PlnAuMt.exe

C:\Windows\System\PlnAuMt.exe

C:\Windows\System\WEiYXXk.exe

C:\Windows\System\WEiYXXk.exe

C:\Windows\System\YOpGPTW.exe

C:\Windows\System\YOpGPTW.exe

C:\Windows\System\cHvdqTv.exe

C:\Windows\System\cHvdqTv.exe

C:\Windows\System\NzcETaJ.exe

C:\Windows\System\NzcETaJ.exe

C:\Windows\System\cySVydh.exe

C:\Windows\System\cySVydh.exe

C:\Windows\System\vwUhzJW.exe

C:\Windows\System\vwUhzJW.exe

C:\Windows\System\AGFZlHp.exe

C:\Windows\System\AGFZlHp.exe

C:\Windows\System\gkvtRmU.exe

C:\Windows\System\gkvtRmU.exe

C:\Windows\System\uikUFwA.exe

C:\Windows\System\uikUFwA.exe

C:\Windows\System\trSHnqZ.exe

C:\Windows\System\trSHnqZ.exe

C:\Windows\System\zYdpJVN.exe

C:\Windows\System\zYdpJVN.exe

C:\Windows\System\apFAutx.exe

C:\Windows\System\apFAutx.exe

C:\Windows\System\ZyGOqMR.exe

C:\Windows\System\ZyGOqMR.exe

C:\Windows\System\cfLorEp.exe

C:\Windows\System\cfLorEp.exe

C:\Windows\System\FTzDnHL.exe

C:\Windows\System\FTzDnHL.exe

C:\Windows\System\RtfGqRD.exe

C:\Windows\System\RtfGqRD.exe

C:\Windows\System\hQsgcjG.exe

C:\Windows\System\hQsgcjG.exe

C:\Windows\System\QQmNRJJ.exe

C:\Windows\System\QQmNRJJ.exe

C:\Windows\System\yKdBwtE.exe

C:\Windows\System\yKdBwtE.exe

C:\Windows\System\qioZNTM.exe

C:\Windows\System\qioZNTM.exe

C:\Windows\System\fRhXyzQ.exe

C:\Windows\System\fRhXyzQ.exe

C:\Windows\System\ZzNznkz.exe

C:\Windows\System\ZzNznkz.exe

C:\Windows\System\opELCMY.exe

C:\Windows\System\opELCMY.exe

C:\Windows\System\AqpjKdd.exe

C:\Windows\System\AqpjKdd.exe

C:\Windows\System\GdQlYXM.exe

C:\Windows\System\GdQlYXM.exe

C:\Windows\System\qPVYtOr.exe

C:\Windows\System\qPVYtOr.exe

C:\Windows\System\CtIOhPZ.exe

C:\Windows\System\CtIOhPZ.exe

C:\Windows\System\nHUvAOS.exe

C:\Windows\System\nHUvAOS.exe

C:\Windows\System\NgNKFJW.exe

C:\Windows\System\NgNKFJW.exe

C:\Windows\System\BTxOsfP.exe

C:\Windows\System\BTxOsfP.exe

C:\Windows\System\yWQUkDB.exe

C:\Windows\System\yWQUkDB.exe

C:\Windows\System\ITWCSte.exe

C:\Windows\System\ITWCSte.exe

C:\Windows\System\QqMiaYB.exe

C:\Windows\System\QqMiaYB.exe

C:\Windows\System\EjNFeZK.exe

C:\Windows\System\EjNFeZK.exe

C:\Windows\System\BQfRKbf.exe

C:\Windows\System\BQfRKbf.exe

C:\Windows\System\eBJrcTf.exe

C:\Windows\System\eBJrcTf.exe

C:\Windows\System\KBDgxPr.exe

C:\Windows\System\KBDgxPr.exe

C:\Windows\System\guMjClU.exe

C:\Windows\System\guMjClU.exe

C:\Windows\System\aelTyJV.exe

C:\Windows\System\aelTyJV.exe

C:\Windows\System\MNQzOuQ.exe

C:\Windows\System\MNQzOuQ.exe

C:\Windows\System\AVmnnyt.exe

C:\Windows\System\AVmnnyt.exe

C:\Windows\System\jeAEbZW.exe

C:\Windows\System\jeAEbZW.exe

C:\Windows\System\PWxmwfF.exe

C:\Windows\System\PWxmwfF.exe

C:\Windows\System\XOuzDDl.exe

C:\Windows\System\XOuzDDl.exe

C:\Windows\System\jdKBrmd.exe

C:\Windows\System\jdKBrmd.exe

C:\Windows\System\ueysDXe.exe

C:\Windows\System\ueysDXe.exe

C:\Windows\System\IulItXs.exe

C:\Windows\System\IulItXs.exe

C:\Windows\System\PbqGDQR.exe

C:\Windows\System\PbqGDQR.exe

C:\Windows\System\KjdXFtz.exe

C:\Windows\System\KjdXFtz.exe

C:\Windows\System\HdYvrqd.exe

C:\Windows\System\HdYvrqd.exe

C:\Windows\System\PfAlEIy.exe

C:\Windows\System\PfAlEIy.exe

C:\Windows\System\tAZDHSX.exe

C:\Windows\System\tAZDHSX.exe

C:\Windows\System\WeavlaE.exe

C:\Windows\System\WeavlaE.exe

C:\Windows\System\GCTYKQz.exe

C:\Windows\System\GCTYKQz.exe

C:\Windows\System\pESzpHw.exe

C:\Windows\System\pESzpHw.exe

C:\Windows\System\jjnDUmt.exe

C:\Windows\System\jjnDUmt.exe

C:\Windows\System\PVLyKDY.exe

C:\Windows\System\PVLyKDY.exe

C:\Windows\System\pJNzQTk.exe

C:\Windows\System\pJNzQTk.exe

C:\Windows\System\sibzRmI.exe

C:\Windows\System\sibzRmI.exe

C:\Windows\System\exMjDHY.exe

C:\Windows\System\exMjDHY.exe

C:\Windows\System\imPBKkD.exe

C:\Windows\System\imPBKkD.exe

C:\Windows\System\NFnFpJw.exe

C:\Windows\System\NFnFpJw.exe

C:\Windows\System\NshJdZi.exe

C:\Windows\System\NshJdZi.exe

C:\Windows\System\bAudLnG.exe

C:\Windows\System\bAudLnG.exe

C:\Windows\System\LUJwviB.exe

C:\Windows\System\LUJwviB.exe

C:\Windows\System\cCRmhUr.exe

C:\Windows\System\cCRmhUr.exe

C:\Windows\System\sRXwdLy.exe

C:\Windows\System\sRXwdLy.exe

C:\Windows\System\zVBsBjD.exe

C:\Windows\System\zVBsBjD.exe

C:\Windows\System\HgbUvjc.exe

C:\Windows\System\HgbUvjc.exe

C:\Windows\System\dZirbUS.exe

C:\Windows\System\dZirbUS.exe

C:\Windows\System\nAcuWmY.exe

C:\Windows\System\nAcuWmY.exe

C:\Windows\System\AOFzsEg.exe

C:\Windows\System\AOFzsEg.exe

C:\Windows\System\XKAQgMH.exe

C:\Windows\System\XKAQgMH.exe

C:\Windows\System\onvDgKa.exe

C:\Windows\System\onvDgKa.exe

C:\Windows\System\MpNovez.exe

C:\Windows\System\MpNovez.exe

C:\Windows\System\cMoeueJ.exe

C:\Windows\System\cMoeueJ.exe

C:\Windows\System\SFRGwdP.exe

C:\Windows\System\SFRGwdP.exe

C:\Windows\System\KkvJaQV.exe

C:\Windows\System\KkvJaQV.exe

C:\Windows\System\uEgTpNf.exe

C:\Windows\System\uEgTpNf.exe

C:\Windows\System\vLPTjgR.exe

C:\Windows\System\vLPTjgR.exe

C:\Windows\System\wXrsYct.exe

C:\Windows\System\wXrsYct.exe

C:\Windows\System\nVMAWFH.exe

C:\Windows\System\nVMAWFH.exe

C:\Windows\System\cAHCDMH.exe

C:\Windows\System\cAHCDMH.exe

C:\Windows\System\XfrbdQe.exe

C:\Windows\System\XfrbdQe.exe

C:\Windows\System\XPvYjon.exe

C:\Windows\System\XPvYjon.exe

C:\Windows\System\qopjjaS.exe

C:\Windows\System\qopjjaS.exe

C:\Windows\System\zSTBpBk.exe

C:\Windows\System\zSTBpBk.exe

C:\Windows\System\gTYjRKF.exe

C:\Windows\System\gTYjRKF.exe

C:\Windows\System\CuMbVCl.exe

C:\Windows\System\CuMbVCl.exe

C:\Windows\System\leoJBGY.exe

C:\Windows\System\leoJBGY.exe

C:\Windows\System\gXsAAOk.exe

C:\Windows\System\gXsAAOk.exe

C:\Windows\System\EnNLHfe.exe

C:\Windows\System\EnNLHfe.exe

C:\Windows\System\xcvemYQ.exe

C:\Windows\System\xcvemYQ.exe

C:\Windows\System\OczvycL.exe

C:\Windows\System\OczvycL.exe

C:\Windows\System\QJhlTOC.exe

C:\Windows\System\QJhlTOC.exe

C:\Windows\System\zNRGCsw.exe

C:\Windows\System\zNRGCsw.exe

C:\Windows\System\iazMeHe.exe

C:\Windows\System\iazMeHe.exe

C:\Windows\System\AWuUVjm.exe

C:\Windows\System\AWuUVjm.exe

C:\Windows\System\oNvyfUB.exe

C:\Windows\System\oNvyfUB.exe

C:\Windows\System\sbleSxK.exe

C:\Windows\System\sbleSxK.exe

C:\Windows\System\VUXUmZm.exe

C:\Windows\System\VUXUmZm.exe

C:\Windows\System\ClkQiDB.exe

C:\Windows\System\ClkQiDB.exe

C:\Windows\System\OkgBdmK.exe

C:\Windows\System\OkgBdmK.exe

C:\Windows\System\PrwTrsA.exe

C:\Windows\System\PrwTrsA.exe

C:\Windows\System\JhZkpsC.exe

C:\Windows\System\JhZkpsC.exe

C:\Windows\System\dCKVmov.exe

C:\Windows\System\dCKVmov.exe

C:\Windows\System\wCKhyCC.exe

C:\Windows\System\wCKhyCC.exe

C:\Windows\System\okOlfJm.exe

C:\Windows\System\okOlfJm.exe

C:\Windows\System\iMvcSLH.exe

C:\Windows\System\iMvcSLH.exe

C:\Windows\System\KsqzzWn.exe

C:\Windows\System\KsqzzWn.exe

C:\Windows\System\syWCjDC.exe

C:\Windows\System\syWCjDC.exe

C:\Windows\System\jDUcUYl.exe

C:\Windows\System\jDUcUYl.exe

C:\Windows\System\dNZOPDD.exe

C:\Windows\System\dNZOPDD.exe

C:\Windows\System\GgdMaBa.exe

C:\Windows\System\GgdMaBa.exe

C:\Windows\System\SfxLumr.exe

C:\Windows\System\SfxLumr.exe

C:\Windows\System\toYhBRZ.exe

C:\Windows\System\toYhBRZ.exe

C:\Windows\System\OqUatqP.exe

C:\Windows\System\OqUatqP.exe

C:\Windows\System\IKVqtAW.exe

C:\Windows\System\IKVqtAW.exe

C:\Windows\System\eAFPztt.exe

C:\Windows\System\eAFPztt.exe

C:\Windows\System\XVYKNEp.exe

C:\Windows\System\XVYKNEp.exe

C:\Windows\System\sZAMwOM.exe

C:\Windows\System\sZAMwOM.exe

C:\Windows\System\SNCVtTj.exe

C:\Windows\System\SNCVtTj.exe

C:\Windows\System\MxnqFdK.exe

C:\Windows\System\MxnqFdK.exe

C:\Windows\System\StrYqlh.exe

C:\Windows\System\StrYqlh.exe

C:\Windows\System\aOktofS.exe

C:\Windows\System\aOktofS.exe

C:\Windows\System\yOpcWpA.exe

C:\Windows\System\yOpcWpA.exe

C:\Windows\System\IFOncOn.exe

C:\Windows\System\IFOncOn.exe

C:\Windows\System\ZhXRxAT.exe

C:\Windows\System\ZhXRxAT.exe

C:\Windows\System\ujzFEdc.exe

C:\Windows\System\ujzFEdc.exe

C:\Windows\System\KkDoSYv.exe

C:\Windows\System\KkDoSYv.exe

C:\Windows\System\czBVFvC.exe

C:\Windows\System\czBVFvC.exe

C:\Windows\System\pgEaKKS.exe

C:\Windows\System\pgEaKKS.exe

C:\Windows\System\MmxipkW.exe

C:\Windows\System\MmxipkW.exe

C:\Windows\System\hFCqiim.exe

C:\Windows\System\hFCqiim.exe

C:\Windows\System\UCdhXDl.exe

C:\Windows\System\UCdhXDl.exe

C:\Windows\System\BWYjFdI.exe

C:\Windows\System\BWYjFdI.exe

C:\Windows\System\BMrwkrW.exe

C:\Windows\System\BMrwkrW.exe

C:\Windows\System\SjEUriA.exe

C:\Windows\System\SjEUriA.exe

C:\Windows\System\CMshCkH.exe

C:\Windows\System\CMshCkH.exe

C:\Windows\System\iyCjvgm.exe

C:\Windows\System\iyCjvgm.exe

C:\Windows\System\zYrgJXN.exe

C:\Windows\System\zYrgJXN.exe

C:\Windows\System\JaANQnB.exe

C:\Windows\System\JaANQnB.exe

C:\Windows\System\mxyCKXZ.exe

C:\Windows\System\mxyCKXZ.exe

C:\Windows\System\vCHBXEB.exe

C:\Windows\System\vCHBXEB.exe

C:\Windows\System\vigsxol.exe

C:\Windows\System\vigsxol.exe

C:\Windows\System\KbhXrtl.exe

C:\Windows\System\KbhXrtl.exe

C:\Windows\System\HXmpydz.exe

C:\Windows\System\HXmpydz.exe

C:\Windows\System\TqgNQic.exe

C:\Windows\System\TqgNQic.exe

C:\Windows\System\SEUPDSR.exe

C:\Windows\System\SEUPDSR.exe

C:\Windows\System\NwJrhNR.exe

C:\Windows\System\NwJrhNR.exe

C:\Windows\System\qTpNOsH.exe

C:\Windows\System\qTpNOsH.exe

C:\Windows\System\EEtbPQu.exe

C:\Windows\System\EEtbPQu.exe

C:\Windows\System\PlLEsfZ.exe

C:\Windows\System\PlLEsfZ.exe

C:\Windows\System\tFIfbVN.exe

C:\Windows\System\tFIfbVN.exe

C:\Windows\System\TUdAjOu.exe

C:\Windows\System\TUdAjOu.exe

C:\Windows\System\SKBMcSI.exe

C:\Windows\System\SKBMcSI.exe

C:\Windows\System\Slzjmyq.exe

C:\Windows\System\Slzjmyq.exe

C:\Windows\System\cKfZZUP.exe

C:\Windows\System\cKfZZUP.exe

C:\Windows\System\BZqAZDj.exe

C:\Windows\System\BZqAZDj.exe

C:\Windows\System\tDpedRO.exe

C:\Windows\System\tDpedRO.exe

C:\Windows\System\HoaFAcf.exe

C:\Windows\System\HoaFAcf.exe

C:\Windows\System\cgkgreb.exe

C:\Windows\System\cgkgreb.exe

C:\Windows\System\oOAyQiQ.exe

C:\Windows\System\oOAyQiQ.exe

C:\Windows\System\KIeiNqg.exe

C:\Windows\System\KIeiNqg.exe

C:\Windows\System\matpLkJ.exe

C:\Windows\System\matpLkJ.exe

C:\Windows\System\opxrmhd.exe

C:\Windows\System\opxrmhd.exe

C:\Windows\System\jYjQKDF.exe

C:\Windows\System\jYjQKDF.exe

C:\Windows\System\kldcTZu.exe

C:\Windows\System\kldcTZu.exe

C:\Windows\System\MEPQfsU.exe

C:\Windows\System\MEPQfsU.exe

C:\Windows\System\rmRlCtM.exe

C:\Windows\System\rmRlCtM.exe

C:\Windows\System\VPXYeLa.exe

C:\Windows\System\VPXYeLa.exe

C:\Windows\System\sqHolyN.exe

C:\Windows\System\sqHolyN.exe

C:\Windows\System\vCoRBOA.exe

C:\Windows\System\vCoRBOA.exe

C:\Windows\System\UIurOGF.exe

C:\Windows\System\UIurOGF.exe

C:\Windows\System\mkSQsZN.exe

C:\Windows\System\mkSQsZN.exe

C:\Windows\System\dQDOUyC.exe

C:\Windows\System\dQDOUyC.exe

C:\Windows\System\qowukBF.exe

C:\Windows\System\qowukBF.exe

C:\Windows\System\YJgYlNw.exe

C:\Windows\System\YJgYlNw.exe

C:\Windows\System\OwbUvXP.exe

C:\Windows\System\OwbUvXP.exe

C:\Windows\System\tvcVnlb.exe

C:\Windows\System\tvcVnlb.exe

C:\Windows\System\HratiKZ.exe

C:\Windows\System\HratiKZ.exe

C:\Windows\System\jefZStj.exe

C:\Windows\System\jefZStj.exe

C:\Windows\System\hekhXjR.exe

C:\Windows\System\hekhXjR.exe

C:\Windows\System\falvMEb.exe

C:\Windows\System\falvMEb.exe

C:\Windows\System\IMGxTpB.exe

C:\Windows\System\IMGxTpB.exe

C:\Windows\System\jEvVsmk.exe

C:\Windows\System\jEvVsmk.exe

C:\Windows\System\JUCWduX.exe

C:\Windows\System\JUCWduX.exe

C:\Windows\System\wVvhAvo.exe

C:\Windows\System\wVvhAvo.exe

C:\Windows\System\wiswBOy.exe

C:\Windows\System\wiswBOy.exe

C:\Windows\System\BjUIWnB.exe

C:\Windows\System\BjUIWnB.exe

C:\Windows\System\MxNTkjC.exe

C:\Windows\System\MxNTkjC.exe

C:\Windows\System\VYFamvD.exe

C:\Windows\System\VYFamvD.exe

C:\Windows\System\MDhoIXC.exe

C:\Windows\System\MDhoIXC.exe

C:\Windows\System\HFSgIDx.exe

C:\Windows\System\HFSgIDx.exe

C:\Windows\System\qUyqxru.exe

C:\Windows\System\qUyqxru.exe

C:\Windows\System\zFzkGls.exe

C:\Windows\System\zFzkGls.exe

C:\Windows\System\juuUESM.exe

C:\Windows\System\juuUESM.exe

C:\Windows\System\eSYPiif.exe

C:\Windows\System\eSYPiif.exe

C:\Windows\System\hJXrRJD.exe

C:\Windows\System\hJXrRJD.exe

C:\Windows\System\llbmZdl.exe

C:\Windows\System\llbmZdl.exe

C:\Windows\System\IGBUqDj.exe

C:\Windows\System\IGBUqDj.exe

C:\Windows\System\ajrxqhe.exe

C:\Windows\System\ajrxqhe.exe

C:\Windows\System\UJFxIyD.exe

C:\Windows\System\UJFxIyD.exe

C:\Windows\System\RWVBfKB.exe

C:\Windows\System\RWVBfKB.exe

C:\Windows\System\vMGUtFR.exe

C:\Windows\System\vMGUtFR.exe

C:\Windows\System\QeDQYnz.exe

C:\Windows\System\QeDQYnz.exe

C:\Windows\System\yZORGTe.exe

C:\Windows\System\yZORGTe.exe

C:\Windows\System\PaqwsPW.exe

C:\Windows\System\PaqwsPW.exe

C:\Windows\System\iGrORYg.exe

C:\Windows\System\iGrORYg.exe

C:\Windows\System\bGRZFUO.exe

C:\Windows\System\bGRZFUO.exe

C:\Windows\System\qWNEYFJ.exe

C:\Windows\System\qWNEYFJ.exe

C:\Windows\System\CihPNQI.exe

C:\Windows\System\CihPNQI.exe

C:\Windows\System\JxmynDk.exe

C:\Windows\System\JxmynDk.exe

C:\Windows\System\GhpEtno.exe

C:\Windows\System\GhpEtno.exe

C:\Windows\System\iYPKEuy.exe

C:\Windows\System\iYPKEuy.exe

C:\Windows\System\fcfeuuv.exe

C:\Windows\System\fcfeuuv.exe

C:\Windows\System\fgTgwHB.exe

C:\Windows\System\fgTgwHB.exe

C:\Windows\System\LDSfQdL.exe

C:\Windows\System\LDSfQdL.exe

C:\Windows\System\RrXBWsM.exe

C:\Windows\System\RrXBWsM.exe

C:\Windows\System\FpNJXAc.exe

C:\Windows\System\FpNJXAc.exe

C:\Windows\System\DqnJOpd.exe

C:\Windows\System\DqnJOpd.exe

C:\Windows\System\oegtyXP.exe

C:\Windows\System\oegtyXP.exe

C:\Windows\System\YuKRYOw.exe

C:\Windows\System\YuKRYOw.exe

C:\Windows\System\GrjIdmD.exe

C:\Windows\System\GrjIdmD.exe

C:\Windows\System\MFttfLa.exe

C:\Windows\System\MFttfLa.exe

C:\Windows\System\tnpaZHk.exe

C:\Windows\System\tnpaZHk.exe

C:\Windows\System\ulvFBVT.exe

C:\Windows\System\ulvFBVT.exe

C:\Windows\System\GiOKUYL.exe

C:\Windows\System\GiOKUYL.exe

C:\Windows\System\WjezpHH.exe

C:\Windows\System\WjezpHH.exe

C:\Windows\System\LjQlZvX.exe

C:\Windows\System\LjQlZvX.exe

C:\Windows\System\HVkipRS.exe

C:\Windows\System\HVkipRS.exe

C:\Windows\System\znONDNl.exe

C:\Windows\System\znONDNl.exe

C:\Windows\System\QUEXvIN.exe

C:\Windows\System\QUEXvIN.exe

C:\Windows\System\VmvzAtX.exe

C:\Windows\System\VmvzAtX.exe

C:\Windows\System\IFphvGn.exe

C:\Windows\System\IFphvGn.exe

C:\Windows\System\TWZRSHv.exe

C:\Windows\System\TWZRSHv.exe

C:\Windows\System\rsxfdnb.exe

C:\Windows\System\rsxfdnb.exe

C:\Windows\System\zvcxrKL.exe

C:\Windows\System\zvcxrKL.exe

C:\Windows\System\xoThsOc.exe

C:\Windows\System\xoThsOc.exe

C:\Windows\System\WpuRYis.exe

C:\Windows\System\WpuRYis.exe

C:\Windows\System\bRcaAKq.exe

C:\Windows\System\bRcaAKq.exe

C:\Windows\System\pmmBkLH.exe

C:\Windows\System\pmmBkLH.exe

C:\Windows\System\FcMdtex.exe

C:\Windows\System\FcMdtex.exe

C:\Windows\System\OMZorZZ.exe

C:\Windows\System\OMZorZZ.exe

C:\Windows\System\ntrOoQp.exe

C:\Windows\System\ntrOoQp.exe

C:\Windows\System\aYUziBL.exe

C:\Windows\System\aYUziBL.exe

C:\Windows\System\FHZirWH.exe

C:\Windows\System\FHZirWH.exe

C:\Windows\System\hkFBzqb.exe

C:\Windows\System\hkFBzqb.exe

C:\Windows\System\lRYlYkd.exe

C:\Windows\System\lRYlYkd.exe

C:\Windows\System\CfEtLbu.exe

C:\Windows\System\CfEtLbu.exe

C:\Windows\System\YnUQVIG.exe

C:\Windows\System\YnUQVIG.exe

C:\Windows\System\XbSWUBT.exe

C:\Windows\System\XbSWUBT.exe

C:\Windows\System\kmOlOQH.exe

C:\Windows\System\kmOlOQH.exe

C:\Windows\System\FCwAdjt.exe

C:\Windows\System\FCwAdjt.exe

C:\Windows\System\NXCBegF.exe

C:\Windows\System\NXCBegF.exe

C:\Windows\System\TYvpghJ.exe

C:\Windows\System\TYvpghJ.exe

C:\Windows\System\IyVRahr.exe

C:\Windows\System\IyVRahr.exe

C:\Windows\System\mOktOAF.exe

C:\Windows\System\mOktOAF.exe

C:\Windows\System\MgnEacI.exe

C:\Windows\System\MgnEacI.exe

C:\Windows\System\iIEZtFu.exe

C:\Windows\System\iIEZtFu.exe

C:\Windows\System\svKDpeb.exe

C:\Windows\System\svKDpeb.exe

C:\Windows\System\gucnUuk.exe

C:\Windows\System\gucnUuk.exe

C:\Windows\System\SymhqCQ.exe

C:\Windows\System\SymhqCQ.exe

C:\Windows\System\kBVqlIn.exe

C:\Windows\System\kBVqlIn.exe

C:\Windows\System\MyAfMAg.exe

C:\Windows\System\MyAfMAg.exe

C:\Windows\System\UzsXqxG.exe

C:\Windows\System\UzsXqxG.exe

C:\Windows\System\pHGnjiq.exe

C:\Windows\System\pHGnjiq.exe

C:\Windows\System\udmmZrm.exe

C:\Windows\System\udmmZrm.exe

C:\Windows\System\eMEUtxi.exe

C:\Windows\System\eMEUtxi.exe

C:\Windows\System\jXXGinU.exe

C:\Windows\System\jXXGinU.exe

C:\Windows\System\LKcMBOq.exe

C:\Windows\System\LKcMBOq.exe

C:\Windows\System\lTlHuYF.exe

C:\Windows\System\lTlHuYF.exe

C:\Windows\System\VosTocz.exe

C:\Windows\System\VosTocz.exe

C:\Windows\System\AuRUBhY.exe

C:\Windows\System\AuRUBhY.exe

C:\Windows\System\AowwuzG.exe

C:\Windows\System\AowwuzG.exe

C:\Windows\System\xVvIQyf.exe

C:\Windows\System\xVvIQyf.exe

C:\Windows\System\uPjPPyk.exe

C:\Windows\System\uPjPPyk.exe

C:\Windows\System\orKbcSy.exe

C:\Windows\System\orKbcSy.exe

C:\Windows\System\ufzvYdB.exe

C:\Windows\System\ufzvYdB.exe

C:\Windows\System\AjeHmvC.exe

C:\Windows\System\AjeHmvC.exe

C:\Windows\System\dQBUfCN.exe

C:\Windows\System\dQBUfCN.exe

C:\Windows\System\veakifK.exe

C:\Windows\System\veakifK.exe

C:\Windows\System\qCJYUPY.exe

C:\Windows\System\qCJYUPY.exe

C:\Windows\System\cHyRRDC.exe

C:\Windows\System\cHyRRDC.exe

C:\Windows\System\yscAnRR.exe

C:\Windows\System\yscAnRR.exe

C:\Windows\System\xoTMTKo.exe

C:\Windows\System\xoTMTKo.exe

C:\Windows\System\HlPeONA.exe

C:\Windows\System\HlPeONA.exe

C:\Windows\System\KfkTVQR.exe

C:\Windows\System\KfkTVQR.exe

C:\Windows\System\CMBYFPx.exe

C:\Windows\System\CMBYFPx.exe

C:\Windows\System\PuJKLrn.exe

C:\Windows\System\PuJKLrn.exe

C:\Windows\System\jLWOWRc.exe

C:\Windows\System\jLWOWRc.exe

C:\Windows\System\DGMsiuH.exe

C:\Windows\System\DGMsiuH.exe

C:\Windows\System\QfuLQPr.exe

C:\Windows\System\QfuLQPr.exe

C:\Windows\System\nTBTnuG.exe

C:\Windows\System\nTBTnuG.exe

C:\Windows\System\xiKwoWM.exe

C:\Windows\System\xiKwoWM.exe

C:\Windows\System\VIOkQqq.exe

C:\Windows\System\VIOkQqq.exe

C:\Windows\System\JjKKdBu.exe

C:\Windows\System\JjKKdBu.exe

C:\Windows\System\YSgNaib.exe

C:\Windows\System\YSgNaib.exe

C:\Windows\System\TbWPIHa.exe

C:\Windows\System\TbWPIHa.exe

C:\Windows\System\kgwmpUc.exe

C:\Windows\System\kgwmpUc.exe

C:\Windows\System\RaBXpPH.exe

C:\Windows\System\RaBXpPH.exe

C:\Windows\System\PsnDbyY.exe

C:\Windows\System\PsnDbyY.exe

C:\Windows\System\AHCFqXC.exe

C:\Windows\System\AHCFqXC.exe

C:\Windows\System\iiQGYgD.exe

C:\Windows\System\iiQGYgD.exe

C:\Windows\System\VkihioL.exe

C:\Windows\System\VkihioL.exe

C:\Windows\System\gkkzQMI.exe

C:\Windows\System\gkkzQMI.exe

C:\Windows\System\SZgwrjU.exe

C:\Windows\System\SZgwrjU.exe

C:\Windows\System\XkFOthC.exe

C:\Windows\System\XkFOthC.exe

C:\Windows\System\lfMbHFK.exe

C:\Windows\System\lfMbHFK.exe

C:\Windows\System\arGQwJQ.exe

C:\Windows\System\arGQwJQ.exe

C:\Windows\System\imACswW.exe

C:\Windows\System\imACswW.exe

C:\Windows\System\lqdcrqQ.exe

C:\Windows\System\lqdcrqQ.exe

C:\Windows\System\nkRNpcB.exe

C:\Windows\System\nkRNpcB.exe

C:\Windows\System\fmJvEWm.exe

C:\Windows\System\fmJvEWm.exe

C:\Windows\System\GVebfJm.exe

C:\Windows\System\GVebfJm.exe

C:\Windows\System\nMClLUG.exe

C:\Windows\System\nMClLUG.exe

C:\Windows\System\bOsnDYG.exe

C:\Windows\System\bOsnDYG.exe

C:\Windows\System\uIpOnSV.exe

C:\Windows\System\uIpOnSV.exe

C:\Windows\System\mPUTXWj.exe

C:\Windows\System\mPUTXWj.exe

C:\Windows\System\xMYsjMY.exe

C:\Windows\System\xMYsjMY.exe

C:\Windows\System\YSaOXLM.exe

C:\Windows\System\YSaOXLM.exe

C:\Windows\System\ErGMxSG.exe

C:\Windows\System\ErGMxSG.exe

C:\Windows\System\ElsrMQT.exe

C:\Windows\System\ElsrMQT.exe

C:\Windows\System\CVmxmuf.exe

C:\Windows\System\CVmxmuf.exe

C:\Windows\System\EwaUCgP.exe

C:\Windows\System\EwaUCgP.exe

C:\Windows\System\mfKtFLQ.exe

C:\Windows\System\mfKtFLQ.exe

C:\Windows\System\IpwyOEm.exe

C:\Windows\System\IpwyOEm.exe

C:\Windows\System\NxfkaAf.exe

C:\Windows\System\NxfkaAf.exe

C:\Windows\System\lMtJMgF.exe

C:\Windows\System\lMtJMgF.exe

C:\Windows\System\JrKWeAH.exe

C:\Windows\System\JrKWeAH.exe

C:\Windows\System\ZVPNyIm.exe

C:\Windows\System\ZVPNyIm.exe

C:\Windows\System\CyIuGUU.exe

C:\Windows\System\CyIuGUU.exe

C:\Windows\System\EEfCGQJ.exe

C:\Windows\System\EEfCGQJ.exe

C:\Windows\System\PXNETTZ.exe

C:\Windows\System\PXNETTZ.exe

C:\Windows\System\ZSQFfme.exe

C:\Windows\System\ZSQFfme.exe

C:\Windows\System\SYPQxnC.exe

C:\Windows\System\SYPQxnC.exe

C:\Windows\System\NsXLSTK.exe

C:\Windows\System\NsXLSTK.exe

C:\Windows\System\OBhVRkn.exe

C:\Windows\System\OBhVRkn.exe

C:\Windows\System\MzKRNHH.exe

C:\Windows\System\MzKRNHH.exe

C:\Windows\System\NtrkOIW.exe

C:\Windows\System\NtrkOIW.exe

C:\Windows\System\txcRIwn.exe

C:\Windows\System\txcRIwn.exe

C:\Windows\System\SIxaScE.exe

C:\Windows\System\SIxaScE.exe

C:\Windows\System\nVYfjQL.exe

C:\Windows\System\nVYfjQL.exe

C:\Windows\System\IHUJeuy.exe

C:\Windows\System\IHUJeuy.exe

C:\Windows\System\beojpSF.exe

C:\Windows\System\beojpSF.exe

C:\Windows\System\CpfygUu.exe

C:\Windows\System\CpfygUu.exe

C:\Windows\System\tFHHkdJ.exe

C:\Windows\System\tFHHkdJ.exe

C:\Windows\System\AuhkpxB.exe

C:\Windows\System\AuhkpxB.exe

C:\Windows\System\obEAxcS.exe

C:\Windows\System\obEAxcS.exe

C:\Windows\System\WdzCldD.exe

C:\Windows\System\WdzCldD.exe

C:\Windows\System\fGuhqRE.exe

C:\Windows\System\fGuhqRE.exe

C:\Windows\System\gbZHepF.exe

C:\Windows\System\gbZHepF.exe

C:\Windows\System\oybKxrw.exe

C:\Windows\System\oybKxrw.exe

C:\Windows\System\xpULDxn.exe

C:\Windows\System\xpULDxn.exe

C:\Windows\System\KGkDoYa.exe

C:\Windows\System\KGkDoYa.exe

C:\Windows\System\JYnmLsm.exe

C:\Windows\System\JYnmLsm.exe

C:\Windows\System\qwmlDCg.exe

C:\Windows\System\qwmlDCg.exe

C:\Windows\System\MtjfPMg.exe

C:\Windows\System\MtjfPMg.exe

C:\Windows\System\bcWEZcp.exe

C:\Windows\System\bcWEZcp.exe

C:\Windows\System\pqOwBKR.exe

C:\Windows\System\pqOwBKR.exe

C:\Windows\System\OYlMHCS.exe

C:\Windows\System\OYlMHCS.exe

C:\Windows\System\HuGBIGO.exe

C:\Windows\System\HuGBIGO.exe

C:\Windows\System\zlayCqr.exe

C:\Windows\System\zlayCqr.exe

C:\Windows\System\NUiaTuW.exe

C:\Windows\System\NUiaTuW.exe

C:\Windows\System\icZLiAF.exe

C:\Windows\System\icZLiAF.exe

C:\Windows\System\zrcwNqo.exe

C:\Windows\System\zrcwNqo.exe

C:\Windows\System\coukrFY.exe

C:\Windows\System\coukrFY.exe

C:\Windows\System\IfanRwo.exe

C:\Windows\System\IfanRwo.exe

C:\Windows\System\nNGvvak.exe

C:\Windows\System\nNGvvak.exe

C:\Windows\System\aNROkWm.exe

C:\Windows\System\aNROkWm.exe

C:\Windows\System\qqdAauJ.exe

C:\Windows\System\qqdAauJ.exe

C:\Windows\System\ZVZwqNX.exe

C:\Windows\System\ZVZwqNX.exe

C:\Windows\System\CJZFuDB.exe

C:\Windows\System\CJZFuDB.exe

C:\Windows\System\nVKwFWI.exe

C:\Windows\System\nVKwFWI.exe

C:\Windows\System\vSYNFPY.exe

C:\Windows\System\vSYNFPY.exe

C:\Windows\System\MENVHQD.exe

C:\Windows\System\MENVHQD.exe

C:\Windows\System\JajfQIw.exe

C:\Windows\System\JajfQIw.exe

C:\Windows\System\bZVigwP.exe

C:\Windows\System\bZVigwP.exe

C:\Windows\System\GkfMBQJ.exe

C:\Windows\System\GkfMBQJ.exe

C:\Windows\System\HvfQJeE.exe

C:\Windows\System\HvfQJeE.exe

C:\Windows\System\gKORhiO.exe

C:\Windows\System\gKORhiO.exe

C:\Windows\System\IXQULRJ.exe

C:\Windows\System\IXQULRJ.exe

C:\Windows\System\ldUoPDs.exe

C:\Windows\System\ldUoPDs.exe

C:\Windows\System\cpJJSaA.exe

C:\Windows\System\cpJJSaA.exe

C:\Windows\System\YYVBnZp.exe

C:\Windows\System\YYVBnZp.exe

C:\Windows\System\xdznobV.exe

C:\Windows\System\xdznobV.exe

C:\Windows\System\OqYnOKk.exe

C:\Windows\System\OqYnOKk.exe

C:\Windows\System\ikKQZKM.exe

C:\Windows\System\ikKQZKM.exe

C:\Windows\System\aNCOjsK.exe

C:\Windows\System\aNCOjsK.exe

C:\Windows\System\EyJbFzo.exe

C:\Windows\System\EyJbFzo.exe

C:\Windows\System\uOGKASS.exe

C:\Windows\System\uOGKASS.exe

C:\Windows\System\FpJmkHl.exe

C:\Windows\System\FpJmkHl.exe

C:\Windows\System\bALOCth.exe

C:\Windows\System\bALOCth.exe

C:\Windows\System\tnnGDpq.exe

C:\Windows\System\tnnGDpq.exe

C:\Windows\System\TbTZeZz.exe

C:\Windows\System\TbTZeZz.exe

C:\Windows\System\gBkxRip.exe

C:\Windows\System\gBkxRip.exe

C:\Windows\System\scQRPgG.exe

C:\Windows\System\scQRPgG.exe

C:\Windows\System\fdNdjEC.exe

C:\Windows\System\fdNdjEC.exe

C:\Windows\System\zIpGHpa.exe

C:\Windows\System\zIpGHpa.exe

C:\Windows\System\VaRGhAM.exe

C:\Windows\System\VaRGhAM.exe

C:\Windows\System\eKDvyfJ.exe

C:\Windows\System\eKDvyfJ.exe

C:\Windows\System\oEgiyxV.exe

C:\Windows\System\oEgiyxV.exe

C:\Windows\System\IqokAxz.exe

C:\Windows\System\IqokAxz.exe

C:\Windows\System\lEAfSaF.exe

C:\Windows\System\lEAfSaF.exe

C:\Windows\System\nfEwaTS.exe

C:\Windows\System\nfEwaTS.exe

C:\Windows\System\NvpXmzG.exe

C:\Windows\System\NvpXmzG.exe

C:\Windows\System\FlgJtHt.exe

C:\Windows\System\FlgJtHt.exe

C:\Windows\System\XLxUnvs.exe

C:\Windows\System\XLxUnvs.exe

C:\Windows\System\urZpdak.exe

C:\Windows\System\urZpdak.exe

C:\Windows\System\zhHqXap.exe

C:\Windows\System\zhHqXap.exe

C:\Windows\System\XwgIMRo.exe

C:\Windows\System\XwgIMRo.exe

C:\Windows\System\xklygTP.exe

C:\Windows\System\xklygTP.exe

C:\Windows\System\FRQGMRq.exe

C:\Windows\System\FRQGMRq.exe

C:\Windows\System\vDJwLVv.exe

C:\Windows\System\vDJwLVv.exe

C:\Windows\System\nxLMZds.exe

C:\Windows\System\nxLMZds.exe

C:\Windows\System\FEmhUXi.exe

C:\Windows\System\FEmhUXi.exe

C:\Windows\System\bxfbwvj.exe

C:\Windows\System\bxfbwvj.exe

C:\Windows\System\ddnIqxk.exe

C:\Windows\System\ddnIqxk.exe

C:\Windows\System\gtKmONC.exe

C:\Windows\System\gtKmONC.exe

C:\Windows\System\wIUDGCN.exe

C:\Windows\System\wIUDGCN.exe

C:\Windows\System\KpZnGcM.exe

C:\Windows\System\KpZnGcM.exe

C:\Windows\System\lOnXqvJ.exe

C:\Windows\System\lOnXqvJ.exe

C:\Windows\System\ywgYIKq.exe

C:\Windows\System\ywgYIKq.exe

C:\Windows\System\koNGvLC.exe

C:\Windows\System\koNGvLC.exe

C:\Windows\System\sTqpvOS.exe

C:\Windows\System\sTqpvOS.exe

C:\Windows\System\gWeynUZ.exe

C:\Windows\System\gWeynUZ.exe

C:\Windows\System\vHOWwYO.exe

C:\Windows\System\vHOWwYO.exe

C:\Windows\System\HaARIbz.exe

C:\Windows\System\HaARIbz.exe

C:\Windows\System\hitdEEp.exe

C:\Windows\System\hitdEEp.exe

C:\Windows\System\wUeBWzF.exe

C:\Windows\System\wUeBWzF.exe

C:\Windows\System\FSJPPPp.exe

C:\Windows\System\FSJPPPp.exe

C:\Windows\System\pQkqbKb.exe

C:\Windows\System\pQkqbKb.exe

C:\Windows\System\CIjUHMk.exe

C:\Windows\System\CIjUHMk.exe

C:\Windows\System\rGWmVen.exe

C:\Windows\System\rGWmVen.exe

C:\Windows\System\tHMtiAf.exe

C:\Windows\System\tHMtiAf.exe

C:\Windows\System\MtLEKRk.exe

C:\Windows\System\MtLEKRk.exe

C:\Windows\System\NHJVmIK.exe

C:\Windows\System\NHJVmIK.exe

C:\Windows\System\oxbHJmr.exe

C:\Windows\System\oxbHJmr.exe

C:\Windows\System\NtGYIyl.exe

C:\Windows\System\NtGYIyl.exe

C:\Windows\System\OmsGAUM.exe

C:\Windows\System\OmsGAUM.exe

C:\Windows\System\IRKRRwT.exe

C:\Windows\System\IRKRRwT.exe

C:\Windows\System\qcpqOfO.exe

C:\Windows\System\qcpqOfO.exe

C:\Windows\System\RoMVfUQ.exe

C:\Windows\System\RoMVfUQ.exe

C:\Windows\System\UbnqVpm.exe

C:\Windows\System\UbnqVpm.exe

C:\Windows\System\QrAdQio.exe

C:\Windows\System\QrAdQio.exe

C:\Windows\System\FhdZVkk.exe

C:\Windows\System\FhdZVkk.exe

C:\Windows\System\jdhEJRW.exe

C:\Windows\System\jdhEJRW.exe

C:\Windows\System\LdVPSRa.exe

C:\Windows\System\LdVPSRa.exe

C:\Windows\System\yhyEJbd.exe

C:\Windows\System\yhyEJbd.exe

C:\Windows\System\UGkvdSd.exe

C:\Windows\System\UGkvdSd.exe

C:\Windows\System\PbEMxlL.exe

C:\Windows\System\PbEMxlL.exe

C:\Windows\System\LhgiwOc.exe

C:\Windows\System\LhgiwOc.exe

C:\Windows\System\DSJchCG.exe

C:\Windows\System\DSJchCG.exe

C:\Windows\System\UkyAfAw.exe

C:\Windows\System\UkyAfAw.exe

C:\Windows\System\ZVjuFIz.exe

C:\Windows\System\ZVjuFIz.exe

C:\Windows\System\otuOeMQ.exe

C:\Windows\System\otuOeMQ.exe

C:\Windows\System\JODLMet.exe

C:\Windows\System\JODLMet.exe

C:\Windows\System\YvcslYT.exe

C:\Windows\System\YvcslYT.exe

C:\Windows\System\EdvFfnq.exe

C:\Windows\System\EdvFfnq.exe

C:\Windows\System\iDWkzHS.exe

C:\Windows\System\iDWkzHS.exe

C:\Windows\System\mxuKhvJ.exe

C:\Windows\System\mxuKhvJ.exe

C:\Windows\System\hdCslcG.exe

C:\Windows\System\hdCslcG.exe

C:\Windows\System\WgUOepZ.exe

C:\Windows\System\WgUOepZ.exe

C:\Windows\System\rHmZxvX.exe

C:\Windows\System\rHmZxvX.exe

C:\Windows\System\wWVBRQb.exe

C:\Windows\System\wWVBRQb.exe

C:\Windows\System\AEPBblk.exe

C:\Windows\System\AEPBblk.exe

C:\Windows\System\GROPIOk.exe

C:\Windows\System\GROPIOk.exe

C:\Windows\System\ylfFFFo.exe

C:\Windows\System\ylfFFFo.exe

C:\Windows\System\sxEQcJk.exe

C:\Windows\System\sxEQcJk.exe

C:\Windows\System\ooIIxZT.exe

C:\Windows\System\ooIIxZT.exe

C:\Windows\System\rvlbqye.exe

C:\Windows\System\rvlbqye.exe

C:\Windows\System\YLiYELg.exe

C:\Windows\System\YLiYELg.exe

C:\Windows\System\hCLCQBn.exe

C:\Windows\System\hCLCQBn.exe

C:\Windows\System\TQmTLnV.exe

C:\Windows\System\TQmTLnV.exe

Network

Country	Destination	Domain	Proto
GB	96.16.110.114:80		tcp
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	raw.githubusercontent.com	udp
US	185.199.111.133:443	raw.githubusercontent.com	tcp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	133.111.199.185.in-addr.arpa	udp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	133.211.185.52.in-addr.arpa	udp
US	8.8.8.8:53	88.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	76.234.34.23.in-addr.arpa	udp
US	13.107.253.64:443		tcp
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	4.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
GB	142.250.179.234:443	chromewebstore.googleapis.com	tcp
US	8.8.8.8:53	pki.goog	udp
US	8.8.8.8:53	pki.goog	udp
US	216.239.32.29:80	pki.goog	tcp
US	8.8.8.8:53	234.179.250.142.in-addr.arpa	udp
US	8.8.8.8:53	29.32.239.216.in-addr.arpa	udp
US	216.239.32.29:80	pki.goog	tcp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	241.150.49.20.in-addr.arpa	udp
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	57.15.31.184.in-addr.arpa	udp
US	8.8.8.8:53	23.236.111.52.in-addr.arpa	udp
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	83.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	91.16.208.104.in-addr.arpa	udp
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	github.githubassets.com	udp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	8.8.8.8:53	154.108.199.185.in-addr.arpa	udp

Files

memory/3256-0-0x00007FF689FF0000-0x00007FF68A3E2000-memory.dmp

memory/3256-1-0x000001FD47440000-0x000001FD47450000-memory.dmp

C:\Windows\System\LKsCxKB.exe

MD5	7fc48b025e3a11935859827cebfc9518
SHA1	cf960e4fe1a1b464aefef826d32850fa471cb0d0
SHA256	8edf2c37121a4b4762943182495a726bc47a3e45ad67a33c6314a81a6fafa648
SHA512	ef69870d31ea793c5fa64d28b43a3f912e63a6f62ed0eeb07ccbf48eb6c253a4498b27edaefb6be03e7f5f4893cd387354d77be49980d01f3b7275917e9b298f

C:\Windows\System\XwlsPJj.exe

MD5	83d245cf7f66191d678a4e0b8858ae7b
SHA1	f7d199d6d6dd422af3fe875a7dc76cd4992c0024
SHA256	a01b86c37f803d007c531e567007289326326ff25dfc016ce9554bbf1496c49f
SHA512	ad7dc28846f0ab429d85a6ea40bb433ad8a779b33521dd49b64d9c20c5432b66ac5d49be6effa7eb2c39dcaa9c9398ea665ad0c419de1a0f3b63b3072eb4af20

C:\Windows\System\oceEUZM.exe

MD5	d9bd8e854fb5b7a3ca6b545156c908c8
SHA1	7bde334bc0fe711505cd0b03561029dc78b45c11
SHA256	904b42110841bab06b4a8cf6020d4bdc17590ca0d50d75e0414fe31e320c083a
SHA512	fba5447b702e427cdc77cb1d24e05be6bbaa4beb296fea48575424bd2db661ebb46409ecd61bef5721b7d5d9370348e78c600aa5833f6fde43da2fa1a6d144df

C:\Windows\System\WkWCFry.exe

MD5	19da515ce6d35a60552b799505136c53
SHA1	147bb6bcb45fabd77c49ce0cb9d727ef31413256
SHA256	c853bf3033f9bcfa07cc66f5c64c87407696f22a51673c383c30a5ab1d0098f1
SHA512	54ad45be37ea7e917412a5cbd29e5deed6c2d745d305de0cd173de54c732c2e618828509b67d521ab46fb98089694eef7ec7e49db41432300e558b3b878a7e20

memory/2372-20-0x00007FF6A4B40000-0x00007FF6A4F32000-memory.dmp

memory/2720-23-0x00007FF6629D0000-0x00007FF662DC2000-memory.dmp

C:\Windows\System\iwjWtKI.exe

MD5	c2781f90995cf1b6884231cddb431ef2
SHA1	3b58f58749e8506fb8f1a817d7e429d0d4e36970
SHA256	5a83a1dea01109e5da7c9c6eca543a88f93be7ee09bbebdc7e408c796320cec0
SHA512	4ad90aa0b9fbb7728a123a464c4570d14c5f60c919d4de42f332ee363a91701ebce3146964c24d8d46b3f7cb9b6eb991fc920c70953625805162fdf1b73ea4a1

C:\Windows\System\RiCEjuT.exe

MD5	900da63714a66d5804f2129a99246ac0
SHA1	efa90420cf990f8f03a14d50754a742c587ac105
SHA256	f8c8b8297513b41db6de10eab88643f42efdfbccc85d0a52997826729fe0e5ee
SHA512	e04727687c545a2f235f3f5a07050297ebbb5d9145fec0ea25cefc840515635d2365223c8a9cf4b99ff3c04840880521162af528ffe6b0c1e4ccbc9bd24d2feb

C:\Windows\System\axplnQQ.exe

MD5	5e3d0a33a7f610457c447d5b995cf5a0
SHA1	2eaad11378610388d9f91df9a4c08a130de72267
SHA256	0fc6ab4797f7b9150dc9712dd213f3263d2f047e078d2a4847c281456ae32046
SHA512	17239aecad2ad187570b8fdc547c37b76eb5adb611f0bdc78626d52a45fe930b254e86d34b14e2fcc9bc0b376aed7f6514bcca425b633e1aea1bdd16daef9358

memory/208-40-0x00007FF6766C0000-0x00007FF676AB2000-memory.dmp

C:\Windows\System\xbOOQOu.exe

MD5	a70ede5523dd61a627fdb707a0bb9183
SHA1	72cc23096322d3ba602b9f1ba31e46fa2496d771
SHA256	1af2b7b5135917ff8da5fb3401fb363a095432197031ca2a23c4d5676f58c6f7
SHA512	fb462cca39dda0e74e88e679f35bcf752b4c378bfcb20c323bbc679ddfc6ef48704bc127d5116019f41ee4e70720dbc5b5ade6835a5ef8f8884d1f436ab8d255

memory/2672-45-0x00007FF7B54F0000-0x00007FF7B58E2000-memory.dmp

C:\Windows\System\jklLMtJ.exe

MD5	6076fa3bcb7f3b19be5ad4f87923b8ae
SHA1	4175d2d7788c7fd575b3f64c72353ad1a67f5603
SHA256	1e5e1d5f81c92923bd4a068e1e67efc00005d0964bd3a8763daa1dcb724999c8
SHA512	9a68e655ac1253956411d9a7b5d9f89e693618dd9ed74aa1cbb9a5ce85f958e6acf141191530fd78fba794afdcb891bf6b62cd3bc0a2b1497f35767a7a42b937

C:\Windows\System\jJkCYLe.exe

MD5	d07527f5ecf797ff59c832af70e84a00
SHA1	5a16a19cc2e401c921d13fc9b12a3539f1c80976
SHA256	ac6258a15692a4fb4935fd4072d4ed8207c71d43f383c2f3548ebd0358f832f3
SHA512	b9579cf56d39fab4000997cd32059facbfada460a7350ce4801aee92becb39610dc970da3c9c09941460c6536e8003706fdfab9b3abc33233e27568f26ed82ea

C:\Windows\System\fLxHewc.exe

MD5	2128fef7dfae473b31f6ce2551879b99
SHA1	932a3899b053e0b7ed6d097ebdd066e72a18dd9c
SHA256	bc7a6927085d671839897609ed994bdbeb49403c9b910f51a806c5f787b302cc
SHA512	8a357b5e7faab403dcf645b0bd88061418bdfca9e07a4f411cd0cc61d73f924eae6cee4ee08602917d3de27d95d4170c1b0aaa795467b372c53b139b4627244b

C:\Windows\System\fAUEzqO.exe

MD5	b06dbeb95fda0755cd6a5f80cec7fc0d
SHA1	65342d2047d81b354bb7858e634c9ffbb06280e1
SHA256	b9bf3f8bd809331f543cc7980cd3b3e7b7409eb1007c98bbadee560155efc758
SHA512	970d49b5609f2c4c79c382c6f4406e86ab76ef1ff5554db2b3929c802e2587841d78bca4a96c01e6ab7ea5405e190e2ceca2600d7115b01d8745843fe0f66be7

C:\Windows\System\uGlUOeH.exe

MD5	d83ab0d033eed43edcd5282e80b64375
SHA1	d876019e3ef98803220a8e7c93fdf00831b74a71
SHA256	ad19499b57af83fa147106f335d83259053ed2fa36ae90cc8a441dc3941004d3
SHA512	984bce366b11ec5a5cb906590b60a927f7957f3ea280ef54e7c96e79b83287ac0ce1926ce270ece7d532e4bb0507a251cb203541fab4bb542d049b363853ca78

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hhgwpiws.fcu.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Windows\System\FKhcOns.exe

MD5	567eb112876bf361b3c56dc878b56767
SHA1	7a0a0a5b6dde682f20f28ce2ac7071a3dd1aeb64
SHA256	c0790aa096158669a3d5c566a20c31ca40cf016ab8585ee4f9dbc4906e820d89
SHA512	b26f97b4146bfeee5588bdbf18aa631007785d3d63789eebc76ab048a68f9d5734144b9deef27b4d870e62a78e60ba4888f13782830d82b586cc7e398d5c56e8

C:\Windows\System\MgsPKqZ.exe

MD5	b429d464589c6f3bfa440411c8e07f59
SHA1	b4e11c53af7e3edcd593d99590a7dd7de8d8a933
SHA256	b88b8bb1812b8c3f22a757b8f36cd9b0e06f0a19070f0bfa748826d59dfa9991
SHA512	a41ea5aecfb93f57e6d95350d4c873391cba748c2941efe048b726505cc04b977cea897ff3d1a6fd2d9db36b185b9f0d5b57d9b7be9688340fb1bdb129440ac9

C:\Windows\System\JfrugdA.exe

MD5	a2effdc6b7f1bcfa6ced7e985589ed93
SHA1	5cc6df3cf43d9dbc5fe9694bfd9525e2ce7d5d1c
SHA256	2c2e4f5857aa1f6f92e7fa5564e1bcd11b05f860c074df00e3f085ec54c4b45a
SHA512	5975ef54fdbf4822a8749d6551385da57758cea9f76edb42f51c81b7954462e538094d8434c85d8727d8920f073db3e7f41bfc96e52898e29b9809e283ed7acd

C:\Windows\System\eVxAYGB.exe

MD5	e79fc9f1deb9f4c47d3779ac093dcc0f
SHA1	3c29cb8a858beb3065a14c3eb380c3b2efcc6870
SHA256	67ab84377ded5b848dbfd29bad0606776f60bb09a18297f61f94ab02b4fe8a47
SHA512	df19d14fba1b4b9bff49c2d5ed9efa2c112b37d8748a4818dcf3bce8c1469075f3be908833e56ead5e97c8443f2501d16ffea17eaa4b4a126c6dc419fb7f5e16

memory/1600-108-0x00007FF6B1610000-0x00007FF6B1A02000-memory.dmp

memory/3556-111-0x00007FF666A60000-0x00007FF666E52000-memory.dmp

memory/1228-113-0x00007FF7F85B0000-0x00007FF7F89A2000-memory.dmp

memory/4540-115-0x00007FF7F4390000-0x00007FF7F4782000-memory.dmp

memory/2836-114-0x00007FF7E0AC0000-0x00007FF7E0EB2000-memory.dmp

memory/1384-112-0x00007FF6C2D90000-0x00007FF6C3182000-memory.dmp

memory/3380-110-0x00007FF6C7840000-0x00007FF6C7C32000-memory.dmp

memory/4428-109-0x00007FF6CE0F0000-0x00007FF6CE4E2000-memory.dmp

memory/1180-107-0x00007FF7BCF20000-0x00007FF7BD312000-memory.dmp

memory/4104-85-0x000001C937D90000-0x000001C937DB2000-memory.dmp

C:\Windows\System\oACUWHn.exe

MD5	c94697ff2df486a8b1991f89ab01fa06
SHA1	81da169b8f21e55f14554e68de08ee46a1820f54
SHA256	63e94be3f3fd1b21281979db78b7ca4eb1f98d4d49f876b4ae7b53471bc0af48
SHA512	78658f78b37babdfc804b3a0eaaffeb28a15d1d7e82a301225bd8e288cb86c9cb12d009a0fc79eff333927c8702d364f350581ddb6ed81a2fc47186d303e2f1e

C:\Windows\System\grBgEOy.exe

MD5	d30aa20b069621f033d28090a7ddbd89
SHA1	46dd19c2fd563659b360252420ae967a389f87bc
SHA256	5360964f717efb0f499918f3d83e59715a5f4932507eb900bc5546e9cadef768
SHA512	564b135b9c8934121f97e13a5185c442b5d5f75841e229ba5ac24ecc4abcc9a03b6be7dbc98e1060bf8bdc897db65deac595b5ec11e29dbe6d2c2ca36b99357b

C:\Windows\System\DfCmBMJ.exe

MD5	2b90c4b5cf5e86fabf30932f2c93d3fa
SHA1	cfb2f9cbb7e3b91facafac3bc5894eec7a835f43
SHA256	226da85f588f85cf5bd79b1daa21c843b9875cbdd31d057f9cff1022f8745892
SHA512	71181412e59533dc14b1fb6308a4da1def39a04531e3bd92e11ef571749feccba32359088b78a15ada446e8320be99b311db9c0a73c9ab15976bdd4da3edbadd

memory/4332-132-0x00007FF774880000-0x00007FF774C72000-memory.dmp

memory/2856-134-0x00007FF69CD90000-0x00007FF69D182000-memory.dmp

memory/3608-137-0x00007FF734CD0000-0x00007FF7350C2000-memory.dmp

C:\Windows\System\gCJUPVS.exe

MD5	06ba36e2a21e3d9a410bf948cd90228f
SHA1	f3d9d5a4a0bf63f45a2e0f3d07fc362de5fd692b
SHA256	c1f1b4fb3f47885997cb9701a39c8c04e216251cc6bc01322e21fdc91cc70ddf
SHA512	54b0bd62461afbffd5c74ba8945ffc5af00a3f5ef2479672f6ef59ca91709d9ef6dab1c5e9f642333730b699bdeed8a8944d1d47d6b470cf7799b0da90e9e307

memory/2720-152-0x00007FF6629D0000-0x00007FF662DC2000-memory.dmp

memory/5064-156-0x00007FF6B40E0000-0x00007FF6B44D2000-memory.dmp

memory/4008-150-0x00007FF6B6240000-0x00007FF6B6632000-memory.dmp

C:\Windows\System\EnnVUsD.exe

MD5	902810e74c319f4ba078069100121c20
SHA1	f43c57492c4a97801cdc2825eb9081a9dd99b4fd
SHA256	0f7ba237ab165dc21317feb50dee5883ee2d1a2ffcc98c2af6efab54b1954388
SHA512	2c5c8ad5e9737e588441a81576022481479e4faa6551d3eee69e3e9302894535967e9af091364bd8801b44d2c0e6e1a93478c23f3b5f6461396131b25aa17919

memory/2480-148-0x00007FF6028A0000-0x00007FF602C92000-memory.dmp

C:\Windows\System\xhzCVex.exe

MD5	1d346a6b94d207d67f1b122f0bf278f7
SHA1	a14f568ee2276786875a0c686a106995665dc145
SHA256	02eed5d6561456da4ad805270b15e2576d98fd13474480728e7e4d99eb700246
SHA512	ca012595fcd1757a17ad1f20410df417837a98bc1541408bf02fe0a49b6cea5ebe30918920a693e6226043f78b69eaae5b43265fd4e557dfa4587b336432fb4d

memory/3076-145-0x00007FF63F3E0000-0x00007FF63F7D2000-memory.dmp

memory/2372-144-0x00007FF6A4B40000-0x00007FF6A4F32000-memory.dmp

C:\Windows\System\lBzJfic.exe

MD5	de29e8fa07a286a351bb608256d29c77
SHA1	5b7a9f45aed36d3732d6d4a75b05a57f97036c50
SHA256	d2384036c36a13ac54aa7d74e6ca100374157d3c4dd8a966d257a805d8205a52
SHA512	3c49c2f72dadacc07f0ecd5e76b5c6ae6a77ead902597d01265597b0ce939a51934e747a9e40f6044441e5de2c434ddfec64da455014b75369ad7d38d9e02472

memory/3256-133-0x00007FF689FF0000-0x00007FF68A3E2000-memory.dmp

memory/3992-48-0x00007FF6EB2C0000-0x00007FF6EB6B2000-memory.dmp

memory/656-32-0x00007FF629720000-0x00007FF629B12000-memory.dmp

memory/4912-26-0x00007FF6EDA30000-0x00007FF6EDE22000-memory.dmp

memory/2856-14-0x00007FF69CD90000-0x00007FF69D182000-memory.dmp

memory/4104-164-0x000001C9389A0000-0x000001C939146000-memory.dmp

C:\Windows\System\kpItnno.exe

MD5	62ef807e30b7fe03f6b6e7b130cf2d23
SHA1	4953db0af0b7e1075fe06e310d886d9ea4025421
SHA256	24de2afdfcb0a5671bb84b4a60a74774fc40900a379a34c85de585ce4748ad00
SHA512	570cbcfc35ff19a9b9b23080c2475fb3dae08f0b177b5d1beb23e6398ec61e27702e92b8c5514fc2c86dccd9a5a25342a869294e45a7d854fb74b30018073780

memory/2672-174-0x00007FF7B54F0000-0x00007FF7B58E2000-memory.dmp

C:\Windows\System\grhkOpu.exe

MD5	91e712baffd3324e0bfb0828fb5603e8
SHA1	ac76181f120eeae3b3be04d274a57be353484a29
SHA256	d8fe95682a36baeed9df427d72aa9428131ec56bd779394eacd1da32f33cf7dc
SHA512	7af65ead29de10902791956b5dd82384ad00a53c317d6d7e4f44c41bca1dfe7da3bc0ab42643ab50928fc284d8923ed39a66d352992a52bfb890a08ec76ed882

C:\Windows\System\fKayPjc.exe

MD5	73160a5dc23a27bff1438a2b2911df7c
SHA1	7d3325c917d306367c52d8608d9f2cc0069069e3
SHA256	bc66d6e2c9cb3a3c30a62e1970abd43c8d0d8f8b34125eacc1b4e656f3f2c679
SHA512	f68a5c5e3a4b302926e508615d0ff2acf72b921dd90475b1f5dffe2dc2cd6e4c70d559a2e19ce39dbba21491799cef4cd39046828ea64e0d94933e7129c54e73

memory/4908-189-0x00007FF706D10000-0x00007FF707102000-memory.dmp

C:\Windows\System\NrEymVK.exe

MD5	b7cf4d170a1d895725484f61a17c7719
SHA1	2be0f14d54c0cb17f694ec907bd8c336c008f2d5
SHA256	1bfb046bd28366f3a027ae37489cef0840bd389de1e3930a89b2abadb5a40d38
SHA512	d6ee4bcb43a43a1e7a8ed8df22ee571ca4c585d4fb05ce8772250372f8a94ecb535e643a784f94f3160eaf0276c526f8cbaba0e265d205ecc723f8ce1aec2bd3

memory/3992-175-0x00007FF6EB2C0000-0x00007FF6EB6B2000-memory.dmp

memory/208-171-0x00007FF6766C0000-0x00007FF676AB2000-memory.dmp

memory/656-170-0x00007FF629720000-0x00007FF629B12000-memory.dmp

memory/4912-168-0x00007FF6EDA30000-0x00007FF6EDE22000-memory.dmp

memory/3256-160-0x00007FF689FF0000-0x00007FF68A3E2000-memory.dmp

C:\Windows\System\ftSLUel.exe

MD5	a26c1817d166362df91462e0f98b6409
SHA1	ac6cd3c1bc54ba59f0f88830d7b01a750462e30c
SHA256	afaad9a33d8bc8a949415ce2854901acef96bb32df00f125d7d2473354790662
SHA512	0094465953ebd85e628fe28115413d2c0719f4f38df57b701987d0848d16e8824ad0c888478c98371189461ea681930dee477374ffd71925430f9db96688b926

C:\Windows\System\vlDoxcR.exe

MD5	338615ad0d9a547ca5c5e0e88263800a
SHA1	3f244c146cf4a8b5cdbf9635810955197c9ed332
SHA256	1be2511ca8e726fd35f197d069dae1138275bbf35bc20c361be5f4cd584ad346
SHA512	6e66134d992323ace1dbe3d467d4e465b3adc6faf9f11e7f13db657e40377cc3a0e4684933fbc416df24b9a95e868a05659ef7a832adef51c4a0e3d40d6638ba

C:\Windows\System\xXgBxNI.exe

MD5	14fa6d111d3abcb804c84f8d1f032142
SHA1	9340a35f2912e6c4d894f8b203e2fe5e9152d879
SHA256	71f5e2bf8e6fbac3297e5276b5339edd12ebeef31e52607711286823a841bc64
SHA512	39de31ab2845ffdb11bc5195731b5ce0038aa659c5f188c0e37ee22d06c2d93c3f9117856b972a0d6eacce2b5079a6b06ff7895947bd1a878570f946afbe0280

C:\Windows\System\vXfAiND.exe

MD5	5d0691dc548708a70acfd6f943cf3ebb
SHA1	0b4c8743c4d0d736789cc1e9aba176f1209ab9fa
SHA256	b9d88cf044ff83751ea1a32887bcb324719c78c341bcf173475ec6282576fb73
SHA512	b076fb581e44b509d441b5f7f29bb55784170daeb4aee7cf477d596ea02935fc0ba4406f6f36924fd1e931c18a7d5888992f34ebdd1ad3d2b7637349ddee1554

memory/1180-1705-0x00007FF7BCF20000-0x00007FF7BD312000-memory.dmp

memory/1600-1704-0x00007FF6B1610000-0x00007FF6B1A02000-memory.dmp

memory/2372-1707-0x00007FF6A4B40000-0x00007FF6A4F32000-memory.dmp

memory/2856-1696-0x00007FF69CD90000-0x00007FF69D182000-memory.dmp

memory/3992-1673-0x00007FF6EB2C0000-0x00007FF6EB6B2000-memory.dmp

memory/2720-1706-0x00007FF6629D0000-0x00007FF662DC2000-memory.dmp

memory/4540-1758-0x00007FF7F4390000-0x00007FF7F4782000-memory.dmp

memory/3380-1737-0x00007FF6C7840000-0x00007FF6C7C32000-memory.dmp

memory/4428-1717-0x00007FF6CE0F0000-0x00007FF6CE4E2000-memory.dmp

memory/2672-1712-0x00007FF7B54F0000-0x00007FF7B58E2000-memory.dmp

memory/208-1710-0x00007FF6766C0000-0x00007FF676AB2000-memory.dmp

memory/656-1709-0x00007FF629720000-0x00007FF629B12000-memory.dmp

memory/4912-1708-0x00007FF6EDA30000-0x00007FF6EDE22000-memory.dmp

memory/2836-1764-0x00007FF7E0AC0000-0x00007FF7E0EB2000-memory.dmp

memory/1228-1763-0x00007FF7F85B0000-0x00007FF7F89A2000-memory.dmp

memory/1384-1762-0x00007FF6C2D90000-0x00007FF6C3182000-memory.dmp

memory/3556-1760-0x00007FF666A60000-0x00007FF666E52000-memory.dmp

memory/4332-1875-0x00007FF774880000-0x00007FF774C72000-memory.dmp

memory/2480-1881-0x00007FF6028A0000-0x00007FF602C92000-memory.dmp

memory/4908-1935-0x00007FF706D10000-0x00007FF707102000-memory.dmp

memory/5064-1906-0x00007FF6B40E0000-0x00007FF6B44D2000-memory.dmp

memory/4008-1884-0x00007FF6B6240000-0x00007FF6B6632000-memory.dmp

memory/3076-1888-0x00007FF63F3E0000-0x00007FF63F7D2000-memory.dmp

memory/3608-1866-0x00007FF734CD0000-0x00007FF7350C2000-memory.dmp

Sample ID	240613-1wq32asakc
Target	8a4850b8f5418f54a08f8193d8a3dad0_NeikiAnalytics.exe
SHA256	603f1a99996e8d9cda9f8065b21e90e96c0ae4a7148da14daf585e305af2ca79
Tags	xmrig execution miner upx

Malware Analysis Report

2024-07-28 23:56

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files