Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\PdADvTq.exe	N/A
N/A	N/A	C:\Windows\System\QyNtRMv.exe	N/A
N/A	N/A	C:\Windows\System\tBjIAQp.exe	N/A
N/A	N/A	C:\Windows\System\XrxSKsN.exe	N/A
N/A	N/A	C:\Windows\System\moTRBrd.exe	N/A
N/A	N/A	C:\Windows\System\HSZgXgn.exe	N/A
N/A	N/A	C:\Windows\System\SBbbkcg.exe	N/A
N/A	N/A	C:\Windows\System\QcEZuho.exe	N/A
N/A	N/A	C:\Windows\System\UprvtgW.exe	N/A
N/A	N/A	C:\Windows\System\MONYLqb.exe	N/A
N/A	N/A	C:\Windows\System\KJzdVPz.exe	N/A
N/A	N/A	C:\Windows\System\DuvLiZJ.exe	N/A
N/A	N/A	C:\Windows\System\HBepVax.exe	N/A
N/A	N/A	C:\Windows\System\PqedBgv.exe	N/A
N/A	N/A	C:\Windows\System\PtlRDrg.exe	N/A
N/A	N/A	C:\Windows\System\dcTxima.exe	N/A
N/A	N/A	C:\Windows\System\ugCYDOP.exe	N/A
N/A	N/A	C:\Windows\System\txgJMQi.exe	N/A
N/A	N/A	C:\Windows\System\IgykWye.exe	N/A
N/A	N/A	C:\Windows\System\phSAoJM.exe	N/A
N/A	N/A	C:\Windows\System\bHngmrz.exe	N/A
N/A	N/A	C:\Windows\System\yfSPcoj.exe	N/A
N/A	N/A	C:\Windows\System\jfJZnEX.exe	N/A
N/A	N/A	C:\Windows\System\aRpXEEM.exe	N/A
N/A	N/A	C:\Windows\System\ODdPRta.exe	N/A
N/A	N/A	C:\Windows\System\mNlCeQc.exe	N/A
N/A	N/A	C:\Windows\System\nYGBFAb.exe	N/A
N/A	N/A	C:\Windows\System\OfAwiEP.exe	N/A
N/A	N/A	C:\Windows\System\xAsyqic.exe	N/A
N/A	N/A	C:\Windows\System\RgRFevl.exe	N/A
N/A	N/A	C:\Windows\System\ixMJZFw.exe	N/A
N/A	N/A	C:\Windows\System\wvsBeWH.exe	N/A
N/A	N/A	C:\Windows\System\idEtYSh.exe	N/A
N/A	N/A	C:\Windows\System\vUerVcF.exe	N/A
N/A	N/A	C:\Windows\System\JNlgmHs.exe	N/A
N/A	N/A	C:\Windows\System\tUioNFw.exe	N/A
N/A	N/A	C:\Windows\System\aZEkMrM.exe	N/A
N/A	N/A	C:\Windows\System\BiDlchP.exe	N/A
N/A	N/A	C:\Windows\System\CeICImH.exe	N/A
N/A	N/A	C:\Windows\System\Qotbyyf.exe	N/A
N/A	N/A	C:\Windows\System\GcszSWN.exe	N/A
N/A	N/A	C:\Windows\System\NFrdHmJ.exe	N/A
N/A	N/A	C:\Windows\System\FbRgARy.exe	N/A
N/A	N/A	C:\Windows\System\lnJCNBk.exe	N/A
N/A	N/A	C:\Windows\System\jSkITYW.exe	N/A
N/A	N/A	C:\Windows\System\SYNUWGM.exe	N/A
N/A	N/A	C:\Windows\System\csNKScO.exe	N/A
N/A	N/A	C:\Windows\System\OSMjmfs.exe	N/A
N/A	N/A	C:\Windows\System\RvHdqgU.exe	N/A
N/A	N/A	C:\Windows\System\EAGrOoQ.exe	N/A
N/A	N/A	C:\Windows\System\UQsIIKk.exe	N/A
N/A	N/A	C:\Windows\System\MJVTQTL.exe	N/A
N/A	N/A	C:\Windows\System\uxWuLgh.exe	N/A
N/A	N/A	C:\Windows\System\YhmoEXz.exe	N/A
N/A	N/A	C:\Windows\System\WagoxvS.exe	N/A
N/A	N/A	C:\Windows\System\dBDmSrS.exe	N/A
N/A	N/A	C:\Windows\System\kYICZwj.exe	N/A
N/A	N/A	C:\Windows\System\xnJGgbK.exe	N/A
N/A	N/A	C:\Windows\System\XHhMoSc.exe	N/A
N/A	N/A	C:\Windows\System\IjwsDUr.exe	N/A
N/A	N/A	C:\Windows\System\ooxDEEv.exe	N/A
N/A	N/A	C:\Windows\System\YTkxWVf.exe	N/A
N/A	N/A	C:\Windows\System\ryRMyzD.exe	N/A
N/A	N/A	C:\Windows\System\oCDOjjG.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\qthosIF.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JvFcFfR.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zsJtPCo.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LBGTmqC.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kqtMgMM.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QQCDuaV.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Xcrfdmp.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KjxssjO.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eMSSxeg.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uiJDfwI.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YztqZNm.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ajJLjrR.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\goSgXcE.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EcnHukH.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ubvMntT.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EVMYRkh.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lBKvBgn.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MdByNBu.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tSHASSo.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hdntytS.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HuhxLjO.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WQtxEPm.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JIHHfFQ.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rSSncOs.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\adiMMxj.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Sbetbox.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DkvPdTU.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zhIiupW.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yboAaTw.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DuLIacK.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LkvXUDa.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uqeeDKc.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XYuLcLq.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vqNrvhF.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nTOBzVF.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LfAcpea.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ptbLUWl.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TRpVqyT.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xswQsqJ.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EiUvuAw.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oZfcSrc.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hdfTHcg.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NScowkb.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BVeRdiY.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\brdJIHr.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IEXZVME.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KPSwUgo.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\enobhCV.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dRapQtD.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iupOzAL.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GsXCjwh.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dwpxIKV.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NcKLROK.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZXzLhBq.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ihdInWF.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\McigvYY.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ELceCvQ.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UYZlbIh.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cXvOjrk.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mkucqWo.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EUzIryK.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mbiKWaZ.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hkpiwHD.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KEBfBsn.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1576 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1576 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1576 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1576 wrote to memory of 2984	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\QyNtRMv.exe
PID 1576 wrote to memory of 2984	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\QyNtRMv.exe
PID 1576 wrote to memory of 2984	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\QyNtRMv.exe
PID 1576 wrote to memory of 2612	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\PdADvTq.exe
PID 1576 wrote to memory of 2612	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\PdADvTq.exe
PID 1576 wrote to memory of 2612	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\PdADvTq.exe
PID 1576 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\tBjIAQp.exe
PID 1576 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\tBjIAQp.exe
PID 1576 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\tBjIAQp.exe
PID 1576 wrote to memory of 2692	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\moTRBrd.exe
PID 1576 wrote to memory of 2692	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\moTRBrd.exe
PID 1576 wrote to memory of 2692	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\moTRBrd.exe
PID 1576 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\XrxSKsN.exe
PID 1576 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\XrxSKsN.exe
PID 1576 wrote to memory of 2596	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\XrxSKsN.exe
PID 1576 wrote to memory of 2828	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\HSZgXgn.exe
PID 1576 wrote to memory of 2828	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\HSZgXgn.exe
PID 1576 wrote to memory of 2828	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\HSZgXgn.exe
PID 1576 wrote to memory of 2728	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\SBbbkcg.exe
PID 1576 wrote to memory of 2728	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\SBbbkcg.exe
PID 1576 wrote to memory of 2728	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\SBbbkcg.exe
PID 1576 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\UprvtgW.exe
PID 1576 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\UprvtgW.exe
PID 1576 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\UprvtgW.exe
PID 1576 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\QcEZuho.exe
PID 1576 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\QcEZuho.exe
PID 1576 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\QcEZuho.exe
PID 1576 wrote to memory of 2484	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\MONYLqb.exe
PID 1576 wrote to memory of 2484	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\MONYLqb.exe
PID 1576 wrote to memory of 2484	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\MONYLqb.exe
PID 1576 wrote to memory of 2928	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\KJzdVPz.exe
PID 1576 wrote to memory of 2928	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\KJzdVPz.exe
PID 1576 wrote to memory of 2928	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\KJzdVPz.exe
PID 1576 wrote to memory of 376	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\DuvLiZJ.exe
PID 1576 wrote to memory of 376	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\DuvLiZJ.exe
PID 1576 wrote to memory of 376	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\DuvLiZJ.exe
PID 1576 wrote to memory of 1572	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\HBepVax.exe
PID 1576 wrote to memory of 1572	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\HBepVax.exe
PID 1576 wrote to memory of 1572	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\HBepVax.exe
PID 1576 wrote to memory of 1464	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\PqedBgv.exe
PID 1576 wrote to memory of 1464	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\PqedBgv.exe
PID 1576 wrote to memory of 1464	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\PqedBgv.exe
PID 1576 wrote to memory of 632	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\PtlRDrg.exe
PID 1576 wrote to memory of 632	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\PtlRDrg.exe
PID 1576 wrote to memory of 632	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\PtlRDrg.exe
PID 1576 wrote to memory of 2760	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\dcTxima.exe
PID 1576 wrote to memory of 2760	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\dcTxima.exe
PID 1576 wrote to memory of 2760	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\dcTxima.exe
PID 1576 wrote to memory of 1912	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\ugCYDOP.exe
PID 1576 wrote to memory of 1912	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\ugCYDOP.exe
PID 1576 wrote to memory of 1912	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\ugCYDOP.exe
PID 1576 wrote to memory of 2380	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\txgJMQi.exe
PID 1576 wrote to memory of 2380	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\txgJMQi.exe
PID 1576 wrote to memory of 2380	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\txgJMQi.exe
PID 1576 wrote to memory of 2384	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\IgykWye.exe
PID 1576 wrote to memory of 2384	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\IgykWye.exe
PID 1576 wrote to memory of 2384	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\IgykWye.exe
PID 1576 wrote to memory of 1900	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\phSAoJM.exe
PID 1576 wrote to memory of 1900	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\phSAoJM.exe
PID 1576 wrote to memory of 1900	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\phSAoJM.exe
PID 1576 wrote to memory of 108	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\bHngmrz.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\QyNtRMv.exe

C:\Windows\System\QyNtRMv.exe

C:\Windows\System\PdADvTq.exe

C:\Windows\System\PdADvTq.exe

C:\Windows\System\tBjIAQp.exe

C:\Windows\System\tBjIAQp.exe

C:\Windows\System\moTRBrd.exe

C:\Windows\System\moTRBrd.exe

C:\Windows\System\XrxSKsN.exe

C:\Windows\System\XrxSKsN.exe

C:\Windows\System\HSZgXgn.exe

C:\Windows\System\HSZgXgn.exe

C:\Windows\System\SBbbkcg.exe

C:\Windows\System\SBbbkcg.exe

C:\Windows\System\UprvtgW.exe

C:\Windows\System\UprvtgW.exe

C:\Windows\System\QcEZuho.exe

C:\Windows\System\QcEZuho.exe

C:\Windows\System\MONYLqb.exe

C:\Windows\System\MONYLqb.exe

C:\Windows\System\KJzdVPz.exe

C:\Windows\System\KJzdVPz.exe

C:\Windows\System\DuvLiZJ.exe

C:\Windows\System\DuvLiZJ.exe

C:\Windows\System\HBepVax.exe

C:\Windows\System\HBepVax.exe

C:\Windows\System\PqedBgv.exe

C:\Windows\System\PqedBgv.exe

C:\Windows\System\PtlRDrg.exe

C:\Windows\System\PtlRDrg.exe

C:\Windows\System\dcTxima.exe

C:\Windows\System\dcTxima.exe

C:\Windows\System\ugCYDOP.exe

C:\Windows\System\ugCYDOP.exe

C:\Windows\System\txgJMQi.exe

C:\Windows\System\txgJMQi.exe

C:\Windows\System\IgykWye.exe

C:\Windows\System\IgykWye.exe

C:\Windows\System\phSAoJM.exe

C:\Windows\System\phSAoJM.exe

C:\Windows\System\bHngmrz.exe

C:\Windows\System\bHngmrz.exe

C:\Windows\System\yfSPcoj.exe

C:\Windows\System\yfSPcoj.exe

C:\Windows\System\jfJZnEX.exe

C:\Windows\System\jfJZnEX.exe

C:\Windows\System\ODdPRta.exe

C:\Windows\System\ODdPRta.exe

C:\Windows\System\aRpXEEM.exe

C:\Windows\System\aRpXEEM.exe

C:\Windows\System\nYGBFAb.exe

C:\Windows\System\nYGBFAb.exe

C:\Windows\System\mNlCeQc.exe

C:\Windows\System\mNlCeQc.exe

C:\Windows\System\OfAwiEP.exe

C:\Windows\System\OfAwiEP.exe

C:\Windows\System\xAsyqic.exe

C:\Windows\System\xAsyqic.exe

C:\Windows\System\RgRFevl.exe

C:\Windows\System\RgRFevl.exe

C:\Windows\System\ixMJZFw.exe

C:\Windows\System\ixMJZFw.exe

C:\Windows\System\wvsBeWH.exe

C:\Windows\System\wvsBeWH.exe

C:\Windows\System\idEtYSh.exe

C:\Windows\System\idEtYSh.exe

C:\Windows\System\vUerVcF.exe

C:\Windows\System\vUerVcF.exe

C:\Windows\System\JNlgmHs.exe

C:\Windows\System\JNlgmHs.exe

C:\Windows\System\tUioNFw.exe

C:\Windows\System\tUioNFw.exe

C:\Windows\System\aZEkMrM.exe

C:\Windows\System\aZEkMrM.exe

C:\Windows\System\BiDlchP.exe

C:\Windows\System\BiDlchP.exe

C:\Windows\System\CeICImH.exe

C:\Windows\System\CeICImH.exe

C:\Windows\System\Qotbyyf.exe

C:\Windows\System\Qotbyyf.exe

C:\Windows\System\GcszSWN.exe

C:\Windows\System\GcszSWN.exe

C:\Windows\System\NFrdHmJ.exe

C:\Windows\System\NFrdHmJ.exe

C:\Windows\System\FbRgARy.exe

C:\Windows\System\FbRgARy.exe

C:\Windows\System\lnJCNBk.exe

C:\Windows\System\lnJCNBk.exe

C:\Windows\System\jSkITYW.exe

C:\Windows\System\jSkITYW.exe

C:\Windows\System\csNKScO.exe

C:\Windows\System\csNKScO.exe

C:\Windows\System\SYNUWGM.exe

C:\Windows\System\SYNUWGM.exe

C:\Windows\System\RvHdqgU.exe

C:\Windows\System\RvHdqgU.exe

C:\Windows\System\OSMjmfs.exe

C:\Windows\System\OSMjmfs.exe

C:\Windows\System\EAGrOoQ.exe

C:\Windows\System\EAGrOoQ.exe

C:\Windows\System\UQsIIKk.exe

C:\Windows\System\UQsIIKk.exe

C:\Windows\System\YhmoEXz.exe

C:\Windows\System\YhmoEXz.exe

C:\Windows\System\MJVTQTL.exe

C:\Windows\System\MJVTQTL.exe

C:\Windows\System\WagoxvS.exe

C:\Windows\System\WagoxvS.exe

C:\Windows\System\uxWuLgh.exe

C:\Windows\System\uxWuLgh.exe

C:\Windows\System\dBDmSrS.exe

C:\Windows\System\dBDmSrS.exe

C:\Windows\System\kYICZwj.exe

C:\Windows\System\kYICZwj.exe

C:\Windows\System\xnJGgbK.exe

C:\Windows\System\xnJGgbK.exe

C:\Windows\System\XHhMoSc.exe

C:\Windows\System\XHhMoSc.exe

C:\Windows\System\IjwsDUr.exe

C:\Windows\System\IjwsDUr.exe

C:\Windows\System\ooxDEEv.exe

C:\Windows\System\ooxDEEv.exe

C:\Windows\System\YTkxWVf.exe

C:\Windows\System\YTkxWVf.exe

C:\Windows\System\ryRMyzD.exe

C:\Windows\System\ryRMyzD.exe

C:\Windows\System\uSXlexn.exe

C:\Windows\System\uSXlexn.exe

C:\Windows\System\oCDOjjG.exe

C:\Windows\System\oCDOjjG.exe

C:\Windows\System\afkEXgi.exe

C:\Windows\System\afkEXgi.exe

C:\Windows\System\IkKOMmx.exe

C:\Windows\System\IkKOMmx.exe

C:\Windows\System\trWlhKp.exe

C:\Windows\System\trWlhKp.exe

C:\Windows\System\mNpMvNA.exe

C:\Windows\System\mNpMvNA.exe

C:\Windows\System\rAGnwwr.exe

C:\Windows\System\rAGnwwr.exe

C:\Windows\System\PjRZKrM.exe

C:\Windows\System\PjRZKrM.exe

C:\Windows\System\xvifPaE.exe

C:\Windows\System\xvifPaE.exe

C:\Windows\System\ZsyjODX.exe

C:\Windows\System\ZsyjODX.exe

C:\Windows\System\isJlyCP.exe

C:\Windows\System\isJlyCP.exe

C:\Windows\System\CYydLeu.exe

C:\Windows\System\CYydLeu.exe

C:\Windows\System\uhSDzUg.exe

C:\Windows\System\uhSDzUg.exe

C:\Windows\System\aqNsXeV.exe

C:\Windows\System\aqNsXeV.exe

C:\Windows\System\XGimENq.exe

C:\Windows\System\XGimENq.exe

C:\Windows\System\bQtrtfW.exe

C:\Windows\System\bQtrtfW.exe

C:\Windows\System\dRERlvR.exe

C:\Windows\System\dRERlvR.exe

C:\Windows\System\AkFnBBf.exe

C:\Windows\System\AkFnBBf.exe

C:\Windows\System\hgFdPtB.exe

C:\Windows\System\hgFdPtB.exe

C:\Windows\System\QZPTWzD.exe

C:\Windows\System\QZPTWzD.exe

C:\Windows\System\JCdECiO.exe

C:\Windows\System\JCdECiO.exe

C:\Windows\System\lkKhAEr.exe

C:\Windows\System\lkKhAEr.exe

C:\Windows\System\YBxNCgL.exe

C:\Windows\System\YBxNCgL.exe

C:\Windows\System\zydCfsE.exe

C:\Windows\System\zydCfsE.exe

C:\Windows\System\zywSyrX.exe

C:\Windows\System\zywSyrX.exe

C:\Windows\System\uNjGNLV.exe

C:\Windows\System\uNjGNLV.exe

C:\Windows\System\pTPfjRr.exe

C:\Windows\System\pTPfjRr.exe

C:\Windows\System\rdxJkkX.exe

C:\Windows\System\rdxJkkX.exe

C:\Windows\System\MGOjQPr.exe

C:\Windows\System\MGOjQPr.exe

C:\Windows\System\shHUKDK.exe

C:\Windows\System\shHUKDK.exe

C:\Windows\System\bgANxVF.exe

C:\Windows\System\bgANxVF.exe

C:\Windows\System\gPGRnou.exe

C:\Windows\System\gPGRnou.exe

C:\Windows\System\TXgLjij.exe

C:\Windows\System\TXgLjij.exe

C:\Windows\System\jbvJFLz.exe

C:\Windows\System\jbvJFLz.exe

C:\Windows\System\dJhQsIp.exe

C:\Windows\System\dJhQsIp.exe

C:\Windows\System\BebORNg.exe

C:\Windows\System\BebORNg.exe

C:\Windows\System\qIDkzli.exe

C:\Windows\System\qIDkzli.exe

C:\Windows\System\JawVatI.exe

C:\Windows\System\JawVatI.exe

C:\Windows\System\CdSboeO.exe

C:\Windows\System\CdSboeO.exe

C:\Windows\System\fHhZfxL.exe

C:\Windows\System\fHhZfxL.exe

C:\Windows\System\PMDDYLx.exe

C:\Windows\System\PMDDYLx.exe

C:\Windows\System\OTKzyfN.exe

C:\Windows\System\OTKzyfN.exe

C:\Windows\System\vWDNUTv.exe

C:\Windows\System\vWDNUTv.exe

C:\Windows\System\VLMmvNP.exe

C:\Windows\System\VLMmvNP.exe

C:\Windows\System\rEcvWgj.exe

C:\Windows\System\rEcvWgj.exe

C:\Windows\System\Mhhfwfq.exe

C:\Windows\System\Mhhfwfq.exe

C:\Windows\System\jvxcRGu.exe

C:\Windows\System\jvxcRGu.exe

C:\Windows\System\LEvmOQU.exe

C:\Windows\System\LEvmOQU.exe

C:\Windows\System\RokEWxc.exe

C:\Windows\System\RokEWxc.exe

C:\Windows\System\NrtmWPT.exe

C:\Windows\System\NrtmWPT.exe

C:\Windows\System\WcZYDES.exe

C:\Windows\System\WcZYDES.exe

C:\Windows\System\uXQLQyt.exe

C:\Windows\System\uXQLQyt.exe

C:\Windows\System\QuqAgNn.exe

C:\Windows\System\QuqAgNn.exe

C:\Windows\System\KmoevYF.exe

C:\Windows\System\KmoevYF.exe

C:\Windows\System\cNEONtR.exe

C:\Windows\System\cNEONtR.exe

C:\Windows\System\RWWJbEX.exe

C:\Windows\System\RWWJbEX.exe

C:\Windows\System\ISNNHsm.exe

C:\Windows\System\ISNNHsm.exe

C:\Windows\System\DDlGvnl.exe

C:\Windows\System\DDlGvnl.exe

C:\Windows\System\joDBYlw.exe

C:\Windows\System\joDBYlw.exe

C:\Windows\System\zDhSLTR.exe

C:\Windows\System\zDhSLTR.exe

C:\Windows\System\pRqRZnQ.exe

C:\Windows\System\pRqRZnQ.exe

C:\Windows\System\lTCOovF.exe

C:\Windows\System\lTCOovF.exe

C:\Windows\System\hGTquzI.exe

C:\Windows\System\hGTquzI.exe

C:\Windows\System\RBQcrwL.exe

C:\Windows\System\RBQcrwL.exe

C:\Windows\System\OWfOYhx.exe

C:\Windows\System\OWfOYhx.exe

C:\Windows\System\vJkNaJn.exe

C:\Windows\System\vJkNaJn.exe

C:\Windows\System\mlZKKrC.exe

C:\Windows\System\mlZKKrC.exe

C:\Windows\System\unaASTV.exe

C:\Windows\System\unaASTV.exe

C:\Windows\System\jLkAsQW.exe

C:\Windows\System\jLkAsQW.exe

C:\Windows\System\BOSsZrh.exe

C:\Windows\System\BOSsZrh.exe

C:\Windows\System\RsCxCgA.exe

C:\Windows\System\RsCxCgA.exe

C:\Windows\System\SjdqVps.exe

C:\Windows\System\SjdqVps.exe

C:\Windows\System\CWCUQxx.exe

C:\Windows\System\CWCUQxx.exe

C:\Windows\System\UpINncI.exe

C:\Windows\System\UpINncI.exe

C:\Windows\System\zEGjkYy.exe

C:\Windows\System\zEGjkYy.exe

C:\Windows\System\uLdxEHh.exe

C:\Windows\System\uLdxEHh.exe

C:\Windows\System\EBlBIKt.exe

C:\Windows\System\EBlBIKt.exe

C:\Windows\System\BGcIrwI.exe

C:\Windows\System\BGcIrwI.exe

C:\Windows\System\sjZZrqe.exe

C:\Windows\System\sjZZrqe.exe

C:\Windows\System\pkgAEuQ.exe

C:\Windows\System\pkgAEuQ.exe

C:\Windows\System\uCZmOAT.exe

C:\Windows\System\uCZmOAT.exe

C:\Windows\System\pSoBoXU.exe

C:\Windows\System\pSoBoXU.exe

C:\Windows\System\xqqyHow.exe

C:\Windows\System\xqqyHow.exe

C:\Windows\System\hOGelab.exe

C:\Windows\System\hOGelab.exe

C:\Windows\System\uHrAjKl.exe

C:\Windows\System\uHrAjKl.exe

C:\Windows\System\HsLKcte.exe

C:\Windows\System\HsLKcte.exe

C:\Windows\System\rEaGAPI.exe

C:\Windows\System\rEaGAPI.exe

C:\Windows\System\ZahfTsC.exe

C:\Windows\System\ZahfTsC.exe

C:\Windows\System\Qgsilzb.exe

C:\Windows\System\Qgsilzb.exe

C:\Windows\System\nuPrPhf.exe

C:\Windows\System\nuPrPhf.exe

C:\Windows\System\YENVcYd.exe

C:\Windows\System\YENVcYd.exe

C:\Windows\System\MtBZgeV.exe

C:\Windows\System\MtBZgeV.exe

C:\Windows\System\EfQtSTh.exe

C:\Windows\System\EfQtSTh.exe

C:\Windows\System\zpmAddI.exe

C:\Windows\System\zpmAddI.exe

C:\Windows\System\Pyukxvy.exe

C:\Windows\System\Pyukxvy.exe

C:\Windows\System\XbnpWvx.exe

C:\Windows\System\XbnpWvx.exe

C:\Windows\System\CbxCCzP.exe

C:\Windows\System\CbxCCzP.exe

C:\Windows\System\bKyjeLy.exe

C:\Windows\System\bKyjeLy.exe

C:\Windows\System\LBVWplU.exe

C:\Windows\System\LBVWplU.exe

C:\Windows\System\uqJomMU.exe

C:\Windows\System\uqJomMU.exe

C:\Windows\System\UVamNth.exe

C:\Windows\System\UVamNth.exe

C:\Windows\System\sDqHRof.exe

C:\Windows\System\sDqHRof.exe

C:\Windows\System\JGXcMgZ.exe

C:\Windows\System\JGXcMgZ.exe

C:\Windows\System\Wxxvxrk.exe

C:\Windows\System\Wxxvxrk.exe

C:\Windows\System\esmJnpB.exe

C:\Windows\System\esmJnpB.exe

C:\Windows\System\UWUpbcy.exe

C:\Windows\System\UWUpbcy.exe

C:\Windows\System\QbZtaRP.exe

C:\Windows\System\QbZtaRP.exe

C:\Windows\System\NNAsNnX.exe

C:\Windows\System\NNAsNnX.exe

C:\Windows\System\wnybvig.exe

C:\Windows\System\wnybvig.exe

C:\Windows\System\KbLcUQs.exe

C:\Windows\System\KbLcUQs.exe

C:\Windows\System\bjEsgfu.exe

C:\Windows\System\bjEsgfu.exe

C:\Windows\System\WxIymVG.exe

C:\Windows\System\WxIymVG.exe

C:\Windows\System\KwGvkkU.exe

C:\Windows\System\KwGvkkU.exe

C:\Windows\System\uiOrfsi.exe

C:\Windows\System\uiOrfsi.exe

C:\Windows\System\kcxJvyk.exe

C:\Windows\System\kcxJvyk.exe

C:\Windows\System\puRKtvd.exe

C:\Windows\System\puRKtvd.exe

C:\Windows\System\eFifQLF.exe

C:\Windows\System\eFifQLF.exe

C:\Windows\System\VplGMTh.exe

C:\Windows\System\VplGMTh.exe

C:\Windows\System\UJHdBCh.exe

C:\Windows\System\UJHdBCh.exe

C:\Windows\System\CVxHGXh.exe

C:\Windows\System\CVxHGXh.exe

C:\Windows\System\vukyRCS.exe

C:\Windows\System\vukyRCS.exe

C:\Windows\System\nnxswJP.exe

C:\Windows\System\nnxswJP.exe

C:\Windows\System\KyKeZlA.exe

C:\Windows\System\KyKeZlA.exe

C:\Windows\System\kPSwkCR.exe

C:\Windows\System\kPSwkCR.exe

C:\Windows\System\EUzIryK.exe

C:\Windows\System\EUzIryK.exe

C:\Windows\System\vNoBakS.exe

C:\Windows\System\vNoBakS.exe

C:\Windows\System\gfNeCVe.exe

C:\Windows\System\gfNeCVe.exe

C:\Windows\System\mSzfjVl.exe

C:\Windows\System\mSzfjVl.exe

C:\Windows\System\BlgLknO.exe

C:\Windows\System\BlgLknO.exe

C:\Windows\System\MlcrcQU.exe

C:\Windows\System\MlcrcQU.exe

C:\Windows\System\ubjQujZ.exe

C:\Windows\System\ubjQujZ.exe

C:\Windows\System\xtAjbFo.exe

C:\Windows\System\xtAjbFo.exe

C:\Windows\System\DNZNcqk.exe

C:\Windows\System\DNZNcqk.exe

C:\Windows\System\AXIDWvl.exe

C:\Windows\System\AXIDWvl.exe

C:\Windows\System\pWppNvm.exe

C:\Windows\System\pWppNvm.exe

C:\Windows\System\wRJlEra.exe

C:\Windows\System\wRJlEra.exe

C:\Windows\System\LsLNXeC.exe

C:\Windows\System\LsLNXeC.exe

C:\Windows\System\yzdNbNZ.exe

C:\Windows\System\yzdNbNZ.exe

C:\Windows\System\JpoWzbH.exe

C:\Windows\System\JpoWzbH.exe

C:\Windows\System\aWKRmFa.exe

C:\Windows\System\aWKRmFa.exe

C:\Windows\System\onCmBAi.exe

C:\Windows\System\onCmBAi.exe

C:\Windows\System\FCFBODO.exe

C:\Windows\System\FCFBODO.exe

C:\Windows\System\YSUatff.exe

C:\Windows\System\YSUatff.exe

C:\Windows\System\ZCibetI.exe

C:\Windows\System\ZCibetI.exe

C:\Windows\System\SKEPhkE.exe

C:\Windows\System\SKEPhkE.exe

C:\Windows\System\naepfRa.exe

C:\Windows\System\naepfRa.exe

C:\Windows\System\FvFoaVd.exe

C:\Windows\System\FvFoaVd.exe

C:\Windows\System\OSBSFin.exe

C:\Windows\System\OSBSFin.exe

C:\Windows\System\xDEaJyO.exe

C:\Windows\System\xDEaJyO.exe

C:\Windows\System\WDEUWBY.exe

C:\Windows\System\WDEUWBY.exe

C:\Windows\System\cVrFWaf.exe

C:\Windows\System\cVrFWaf.exe

C:\Windows\System\BgzOyTV.exe

C:\Windows\System\BgzOyTV.exe

C:\Windows\System\FaCvixC.exe

C:\Windows\System\FaCvixC.exe

C:\Windows\System\vRXKgrZ.exe

C:\Windows\System\vRXKgrZ.exe

C:\Windows\System\SqtoThL.exe

C:\Windows\System\SqtoThL.exe

C:\Windows\System\VcraneP.exe

C:\Windows\System\VcraneP.exe

C:\Windows\System\iZsxUSb.exe

C:\Windows\System\iZsxUSb.exe

C:\Windows\System\TJHPWlJ.exe

C:\Windows\System\TJHPWlJ.exe

C:\Windows\System\JtIJhZg.exe

C:\Windows\System\JtIJhZg.exe

C:\Windows\System\tcfPwiB.exe

C:\Windows\System\tcfPwiB.exe

C:\Windows\System\SKLaXqW.exe

C:\Windows\System\SKLaXqW.exe

C:\Windows\System\VHshyHu.exe

C:\Windows\System\VHshyHu.exe

C:\Windows\System\ZIqFRJH.exe

C:\Windows\System\ZIqFRJH.exe

C:\Windows\System\HvRXVlO.exe

C:\Windows\System\HvRXVlO.exe

C:\Windows\System\NgNaLJq.exe

C:\Windows\System\NgNaLJq.exe

C:\Windows\System\HwdlTtI.exe

C:\Windows\System\HwdlTtI.exe

C:\Windows\System\OoIkshu.exe

C:\Windows\System\OoIkshu.exe

C:\Windows\System\KaZwUlb.exe

C:\Windows\System\KaZwUlb.exe

C:\Windows\System\lYSGdNJ.exe

C:\Windows\System\lYSGdNJ.exe

C:\Windows\System\RsIjYVE.exe

C:\Windows\System\RsIjYVE.exe

C:\Windows\System\CTAmKdf.exe

C:\Windows\System\CTAmKdf.exe

C:\Windows\System\NcKLROK.exe

C:\Windows\System\NcKLROK.exe

C:\Windows\System\PELxEwK.exe

C:\Windows\System\PELxEwK.exe

C:\Windows\System\vNWpRaO.exe

C:\Windows\System\vNWpRaO.exe

C:\Windows\System\KsejTEg.exe

C:\Windows\System\KsejTEg.exe

C:\Windows\System\vIoMTlU.exe

C:\Windows\System\vIoMTlU.exe

C:\Windows\System\yQiixQW.exe

C:\Windows\System\yQiixQW.exe

C:\Windows\System\Omdnsov.exe

C:\Windows\System\Omdnsov.exe

C:\Windows\System\GsejZhy.exe

C:\Windows\System\GsejZhy.exe

C:\Windows\System\QYPWJuE.exe

C:\Windows\System\QYPWJuE.exe

C:\Windows\System\zddMwxA.exe

C:\Windows\System\zddMwxA.exe

C:\Windows\System\TFzibHF.exe

C:\Windows\System\TFzibHF.exe

C:\Windows\System\Hiyktjy.exe

C:\Windows\System\Hiyktjy.exe

C:\Windows\System\RWffGWl.exe

C:\Windows\System\RWffGWl.exe

C:\Windows\System\aOsTFGh.exe

C:\Windows\System\aOsTFGh.exe

C:\Windows\System\CVQJmbK.exe

C:\Windows\System\CVQJmbK.exe

C:\Windows\System\djOzpLz.exe

C:\Windows\System\djOzpLz.exe

C:\Windows\System\lmpfQXI.exe

C:\Windows\System\lmpfQXI.exe

C:\Windows\System\SNnOVFF.exe

C:\Windows\System\SNnOVFF.exe

C:\Windows\System\QWgeWTD.exe

C:\Windows\System\QWgeWTD.exe

C:\Windows\System\VRydSrc.exe

C:\Windows\System\VRydSrc.exe

C:\Windows\System\NgtIgug.exe

C:\Windows\System\NgtIgug.exe

C:\Windows\System\lMLBuTe.exe

C:\Windows\System\lMLBuTe.exe

C:\Windows\System\nnIIbeD.exe

C:\Windows\System\nnIIbeD.exe

C:\Windows\System\aMzTpJD.exe

C:\Windows\System\aMzTpJD.exe

C:\Windows\System\wPKmZMW.exe

C:\Windows\System\wPKmZMW.exe

C:\Windows\System\BFiZQDj.exe

C:\Windows\System\BFiZQDj.exe

C:\Windows\System\wXjURxd.exe

C:\Windows\System\wXjURxd.exe

C:\Windows\System\nxjdLeN.exe

C:\Windows\System\nxjdLeN.exe

C:\Windows\System\ggUvjRZ.exe

C:\Windows\System\ggUvjRZ.exe

C:\Windows\System\kKSEQhd.exe

C:\Windows\System\kKSEQhd.exe

C:\Windows\System\ZzNDoRU.exe

C:\Windows\System\ZzNDoRU.exe

C:\Windows\System\vZMBhYB.exe

C:\Windows\System\vZMBhYB.exe

C:\Windows\System\GAUnXxD.exe

C:\Windows\System\GAUnXxD.exe

C:\Windows\System\CvHdKGo.exe

C:\Windows\System\CvHdKGo.exe

C:\Windows\System\NOWrysf.exe

C:\Windows\System\NOWrysf.exe

C:\Windows\System\NqmmUwd.exe

C:\Windows\System\NqmmUwd.exe

C:\Windows\System\DikJFDV.exe

C:\Windows\System\DikJFDV.exe

C:\Windows\System\zGkFHtc.exe

C:\Windows\System\zGkFHtc.exe

C:\Windows\System\bPfdCjp.exe

C:\Windows\System\bPfdCjp.exe

C:\Windows\System\dpRaLLO.exe

C:\Windows\System\dpRaLLO.exe

C:\Windows\System\TqCbgAm.exe

C:\Windows\System\TqCbgAm.exe

C:\Windows\System\nEkCLRf.exe

C:\Windows\System\nEkCLRf.exe

C:\Windows\System\kHvbXed.exe

C:\Windows\System\kHvbXed.exe

C:\Windows\System\YIXjtZK.exe

C:\Windows\System\YIXjtZK.exe

C:\Windows\System\XQdPCmd.exe

C:\Windows\System\XQdPCmd.exe

C:\Windows\System\SwZJuoZ.exe

C:\Windows\System\SwZJuoZ.exe

C:\Windows\System\JSOAiMp.exe

C:\Windows\System\JSOAiMp.exe

C:\Windows\System\lOajIjw.exe

C:\Windows\System\lOajIjw.exe

C:\Windows\System\inCHTUX.exe

C:\Windows\System\inCHTUX.exe

C:\Windows\System\nZLcOAv.exe

C:\Windows\System\nZLcOAv.exe

C:\Windows\System\HwRUBbN.exe

C:\Windows\System\HwRUBbN.exe

C:\Windows\System\FOklBbz.exe

C:\Windows\System\FOklBbz.exe

C:\Windows\System\xfPDPhu.exe

C:\Windows\System\xfPDPhu.exe

C:\Windows\System\BduSqaw.exe

C:\Windows\System\BduSqaw.exe

C:\Windows\System\tZdEXbM.exe

C:\Windows\System\tZdEXbM.exe

C:\Windows\System\rXAEqBw.exe

C:\Windows\System\rXAEqBw.exe

C:\Windows\System\IvavWDj.exe

C:\Windows\System\IvavWDj.exe

C:\Windows\System\wQLxNML.exe

C:\Windows\System\wQLxNML.exe

C:\Windows\System\KsEMvvt.exe

C:\Windows\System\KsEMvvt.exe

C:\Windows\System\VkzzEdj.exe

C:\Windows\System\VkzzEdj.exe

C:\Windows\System\ZwPvLvC.exe

C:\Windows\System\ZwPvLvC.exe

C:\Windows\System\pwXBBuN.exe

C:\Windows\System\pwXBBuN.exe

C:\Windows\System\bDXzQeA.exe

C:\Windows\System\bDXzQeA.exe

C:\Windows\System\YTkcxXt.exe

C:\Windows\System\YTkcxXt.exe

C:\Windows\System\xCkDGLs.exe

C:\Windows\System\xCkDGLs.exe

C:\Windows\System\gDLeieN.exe

C:\Windows\System\gDLeieN.exe

C:\Windows\System\FSKepOS.exe

C:\Windows\System\FSKepOS.exe

C:\Windows\System\mITAGoG.exe

C:\Windows\System\mITAGoG.exe

C:\Windows\System\GobioiH.exe

C:\Windows\System\GobioiH.exe

C:\Windows\System\nYOLfCg.exe

C:\Windows\System\nYOLfCg.exe

C:\Windows\System\LwwKJrQ.exe

C:\Windows\System\LwwKJrQ.exe

C:\Windows\System\kvUBpqW.exe

C:\Windows\System\kvUBpqW.exe

C:\Windows\System\HOyXbrH.exe

C:\Windows\System\HOyXbrH.exe

C:\Windows\System\VfLEgmk.exe

C:\Windows\System\VfLEgmk.exe

C:\Windows\System\RgPXVJQ.exe

C:\Windows\System\RgPXVJQ.exe

C:\Windows\System\YyzFxXk.exe

C:\Windows\System\YyzFxXk.exe

C:\Windows\System\jQoCipG.exe

C:\Windows\System\jQoCipG.exe

C:\Windows\System\pNlwIkS.exe

C:\Windows\System\pNlwIkS.exe

C:\Windows\System\LUzBgwv.exe

C:\Windows\System\LUzBgwv.exe

C:\Windows\System\sETBQSh.exe

C:\Windows\System\sETBQSh.exe

C:\Windows\System\ypQTVlF.exe

C:\Windows\System\ypQTVlF.exe

C:\Windows\System\hMWWInp.exe

C:\Windows\System\hMWWInp.exe

C:\Windows\System\yEgSIHS.exe

C:\Windows\System\yEgSIHS.exe

C:\Windows\System\sFWOGUo.exe

C:\Windows\System\sFWOGUo.exe

C:\Windows\System\hQGwViH.exe

C:\Windows\System\hQGwViH.exe

C:\Windows\System\gfzMqQq.exe

C:\Windows\System\gfzMqQq.exe

C:\Windows\System\IWObuPD.exe

C:\Windows\System\IWObuPD.exe

C:\Windows\System\eRYPdtc.exe

C:\Windows\System\eRYPdtc.exe

C:\Windows\System\PleqBtf.exe

C:\Windows\System\PleqBtf.exe

C:\Windows\System\hGSbIAf.exe

C:\Windows\System\hGSbIAf.exe

C:\Windows\System\zXYpaAb.exe

C:\Windows\System\zXYpaAb.exe

C:\Windows\System\XaJqtkx.exe

C:\Windows\System\XaJqtkx.exe

C:\Windows\System\OtKXeTW.exe

C:\Windows\System\OtKXeTW.exe

C:\Windows\System\uvZCzRM.exe

C:\Windows\System\uvZCzRM.exe

C:\Windows\System\vBkNNmA.exe

C:\Windows\System\vBkNNmA.exe

C:\Windows\System\towNIOV.exe

C:\Windows\System\towNIOV.exe

C:\Windows\System\qifgOjC.exe

C:\Windows\System\qifgOjC.exe

C:\Windows\System\mwDnoTs.exe

C:\Windows\System\mwDnoTs.exe

C:\Windows\System\ARtZBnb.exe

C:\Windows\System\ARtZBnb.exe

C:\Windows\System\xZvdYYY.exe

C:\Windows\System\xZvdYYY.exe

C:\Windows\System\sLtKYZH.exe

C:\Windows\System\sLtKYZH.exe

C:\Windows\System\nGhgKoD.exe

C:\Windows\System\nGhgKoD.exe

C:\Windows\System\iWMuFJp.exe

C:\Windows\System\iWMuFJp.exe

C:\Windows\System\ViWMHvK.exe

C:\Windows\System\ViWMHvK.exe

C:\Windows\System\ACcwJjA.exe

C:\Windows\System\ACcwJjA.exe

C:\Windows\System\WnQRGUp.exe

C:\Windows\System\WnQRGUp.exe

C:\Windows\System\PdzGiNy.exe

C:\Windows\System\PdzGiNy.exe

C:\Windows\System\GYufTfH.exe

C:\Windows\System\GYufTfH.exe

C:\Windows\System\MxtjeoL.exe

C:\Windows\System\MxtjeoL.exe

C:\Windows\System\YxluHsa.exe

C:\Windows\System\YxluHsa.exe

C:\Windows\System\RgDZMFv.exe

C:\Windows\System\RgDZMFv.exe

C:\Windows\System\gTnsDbM.exe

C:\Windows\System\gTnsDbM.exe

C:\Windows\System\TeepFHj.exe

C:\Windows\System\TeepFHj.exe

C:\Windows\System\lHmupjo.exe

C:\Windows\System\lHmupjo.exe

C:\Windows\System\qcoNeWA.exe

C:\Windows\System\qcoNeWA.exe

C:\Windows\System\bVgDxoA.exe

C:\Windows\System\bVgDxoA.exe

C:\Windows\System\zYRXurE.exe

C:\Windows\System\zYRXurE.exe

C:\Windows\System\lPKDnwh.exe

C:\Windows\System\lPKDnwh.exe

C:\Windows\System\rlVvgCi.exe

C:\Windows\System\rlVvgCi.exe

C:\Windows\System\ZaHQGvN.exe

C:\Windows\System\ZaHQGvN.exe

C:\Windows\System\xOMPmDc.exe

C:\Windows\System\xOMPmDc.exe

C:\Windows\System\deRHLnq.exe

C:\Windows\System\deRHLnq.exe

C:\Windows\System\SUNHVzS.exe

C:\Windows\System\SUNHVzS.exe

C:\Windows\System\SuqIZJW.exe

C:\Windows\System\SuqIZJW.exe

C:\Windows\System\mTtBSMX.exe

C:\Windows\System\mTtBSMX.exe

C:\Windows\System\AHhgsJD.exe

C:\Windows\System\AHhgsJD.exe

C:\Windows\System\MfCllGM.exe

C:\Windows\System\MfCllGM.exe

C:\Windows\System\mKVOumP.exe

C:\Windows\System\mKVOumP.exe

C:\Windows\System\dQrfOlp.exe

C:\Windows\System\dQrfOlp.exe

C:\Windows\System\DPuFbHJ.exe

C:\Windows\System\DPuFbHJ.exe

C:\Windows\System\zPUdCIi.exe

C:\Windows\System\zPUdCIi.exe

C:\Windows\System\RxgoxYa.exe

C:\Windows\System\RxgoxYa.exe

C:\Windows\System\YepSxKQ.exe

C:\Windows\System\YepSxKQ.exe

C:\Windows\System\QvoEsWZ.exe

C:\Windows\System\QvoEsWZ.exe

C:\Windows\System\rYizCLn.exe

C:\Windows\System\rYizCLn.exe

C:\Windows\System\XNEgQdh.exe

C:\Windows\System\XNEgQdh.exe

C:\Windows\System\GfLxjNw.exe

C:\Windows\System\GfLxjNw.exe

C:\Windows\System\OeoOQrl.exe

C:\Windows\System\OeoOQrl.exe

C:\Windows\System\cHDhpJK.exe

C:\Windows\System\cHDhpJK.exe

C:\Windows\System\HzARGgP.exe

C:\Windows\System\HzARGgP.exe

C:\Windows\System\ORtrWvo.exe

C:\Windows\System\ORtrWvo.exe

C:\Windows\System\ZovrZMz.exe

C:\Windows\System\ZovrZMz.exe

C:\Windows\System\bJEveRt.exe

C:\Windows\System\bJEveRt.exe

C:\Windows\System\nkqfsaz.exe

C:\Windows\System\nkqfsaz.exe

C:\Windows\System\cvVTlhW.exe

C:\Windows\System\cvVTlhW.exe

C:\Windows\System\HRYBSZn.exe

C:\Windows\System\HRYBSZn.exe

C:\Windows\System\cFicclh.exe

C:\Windows\System\cFicclh.exe

C:\Windows\System\CyldOpl.exe

C:\Windows\System\CyldOpl.exe

C:\Windows\System\wqKrCms.exe

C:\Windows\System\wqKrCms.exe

C:\Windows\System\IVvLMfp.exe

C:\Windows\System\IVvLMfp.exe

C:\Windows\System\HXYBloU.exe

C:\Windows\System\HXYBloU.exe

C:\Windows\System\XCdjEOg.exe

C:\Windows\System\XCdjEOg.exe

C:\Windows\System\WuGvccn.exe

C:\Windows\System\WuGvccn.exe

C:\Windows\System\XFVIVNw.exe

C:\Windows\System\XFVIVNw.exe

C:\Windows\System\fLhbFRZ.exe

C:\Windows\System\fLhbFRZ.exe

C:\Windows\System\CIRbkuj.exe

C:\Windows\System\CIRbkuj.exe

C:\Windows\System\WDfvBAT.exe

C:\Windows\System\WDfvBAT.exe

C:\Windows\System\jYSKMLy.exe

C:\Windows\System\jYSKMLy.exe

C:\Windows\System\uNixxCx.exe

C:\Windows\System\uNixxCx.exe

C:\Windows\System\LMOCyKE.exe

C:\Windows\System\LMOCyKE.exe

C:\Windows\System\eHrzTmh.exe

C:\Windows\System\eHrzTmh.exe

C:\Windows\System\YbWQJAR.exe

C:\Windows\System\YbWQJAR.exe

C:\Windows\System\YspPpbf.exe

C:\Windows\System\YspPpbf.exe

C:\Windows\System\zsvXrEw.exe

C:\Windows\System\zsvXrEw.exe

C:\Windows\System\CmgROjO.exe

C:\Windows\System\CmgROjO.exe

C:\Windows\System\UNXzsMe.exe

C:\Windows\System\UNXzsMe.exe

C:\Windows\System\XqLnAem.exe

C:\Windows\System\XqLnAem.exe

C:\Windows\System\BKkEIQN.exe

C:\Windows\System\BKkEIQN.exe

C:\Windows\System\NRPWchJ.exe

C:\Windows\System\NRPWchJ.exe

C:\Windows\System\oPyfEHl.exe

C:\Windows\System\oPyfEHl.exe

C:\Windows\System\ZEDealx.exe

C:\Windows\System\ZEDealx.exe

C:\Windows\System\qKAuFFU.exe

C:\Windows\System\qKAuFFU.exe

C:\Windows\System\qwZSGiR.exe

C:\Windows\System\qwZSGiR.exe

C:\Windows\System\FiehDLf.exe

C:\Windows\System\FiehDLf.exe

C:\Windows\System\vksZlaB.exe

C:\Windows\System\vksZlaB.exe

C:\Windows\System\LjyMJsv.exe

C:\Windows\System\LjyMJsv.exe

C:\Windows\System\glwUmTF.exe

C:\Windows\System\glwUmTF.exe

C:\Windows\System\KmcSHsK.exe

C:\Windows\System\KmcSHsK.exe

C:\Windows\System\WmBvBSy.exe

C:\Windows\System\WmBvBSy.exe

C:\Windows\System\IBHEZAZ.exe

C:\Windows\System\IBHEZAZ.exe

C:\Windows\System\jCPYBUY.exe

C:\Windows\System\jCPYBUY.exe

C:\Windows\System\RNzgCcN.exe

C:\Windows\System\RNzgCcN.exe

C:\Windows\System\bnEEiJa.exe

C:\Windows\System\bnEEiJa.exe

C:\Windows\System\rAzFUbR.exe

C:\Windows\System\rAzFUbR.exe

C:\Windows\System\qxzosgs.exe

C:\Windows\System\qxzosgs.exe

C:\Windows\System\VmZvRaa.exe

C:\Windows\System\VmZvRaa.exe

C:\Windows\System\mTAguhx.exe

C:\Windows\System\mTAguhx.exe

C:\Windows\System\GRYnVVO.exe

C:\Windows\System\GRYnVVO.exe

C:\Windows\System\xVBZttd.exe

C:\Windows\System\xVBZttd.exe

C:\Windows\System\YmIEsKQ.exe

C:\Windows\System\YmIEsKQ.exe

C:\Windows\System\CmUCeBK.exe

C:\Windows\System\CmUCeBK.exe

C:\Windows\System\AxbZprc.exe

C:\Windows\System\AxbZprc.exe

C:\Windows\System\GJIwBdO.exe

C:\Windows\System\GJIwBdO.exe

C:\Windows\System\tkljdUa.exe

C:\Windows\System\tkljdUa.exe

C:\Windows\System\hMmcGHZ.exe

C:\Windows\System\hMmcGHZ.exe

C:\Windows\System\SXArRvX.exe

C:\Windows\System\SXArRvX.exe

C:\Windows\System\PaewdlG.exe

C:\Windows\System\PaewdlG.exe

C:\Windows\System\wqGdjPZ.exe

C:\Windows\System\wqGdjPZ.exe

C:\Windows\System\pFXzHOf.exe

C:\Windows\System\pFXzHOf.exe

C:\Windows\System\FMlcwVk.exe

C:\Windows\System\FMlcwVk.exe

C:\Windows\System\lEkvthp.exe

C:\Windows\System\lEkvthp.exe

C:\Windows\System\BAwnUPP.exe

C:\Windows\System\BAwnUPP.exe

C:\Windows\System\vNkDGyf.exe

C:\Windows\System\vNkDGyf.exe

C:\Windows\System\ohLjGDT.exe

C:\Windows\System\ohLjGDT.exe

C:\Windows\System\MykXbVv.exe

C:\Windows\System\MykXbVv.exe

C:\Windows\System\wbzeXhI.exe

C:\Windows\System\wbzeXhI.exe

C:\Windows\System\owxknZT.exe

C:\Windows\System\owxknZT.exe

C:\Windows\System\OUNaGsk.exe

C:\Windows\System\OUNaGsk.exe

C:\Windows\System\FivgKuv.exe

C:\Windows\System\FivgKuv.exe

C:\Windows\System\fntnprN.exe

C:\Windows\System\fntnprN.exe

C:\Windows\System\mFxSeFf.exe

C:\Windows\System\mFxSeFf.exe

C:\Windows\System\FlksDtQ.exe

C:\Windows\System\FlksDtQ.exe

C:\Windows\System\iNlMfGe.exe

C:\Windows\System\iNlMfGe.exe

C:\Windows\System\QvJOgsG.exe

C:\Windows\System\QvJOgsG.exe

C:\Windows\System\ECIlhVv.exe

C:\Windows\System\ECIlhVv.exe

C:\Windows\System\bSAAxgj.exe

C:\Windows\System\bSAAxgj.exe

C:\Windows\System\dTwABQu.exe

C:\Windows\System\dTwABQu.exe

C:\Windows\System\LtaAdZv.exe

C:\Windows\System\LtaAdZv.exe

C:\Windows\System\bqQJPYi.exe

C:\Windows\System\bqQJPYi.exe

C:\Windows\System\CkUySoV.exe

C:\Windows\System\CkUySoV.exe

C:\Windows\System\cnDcQsl.exe

C:\Windows\System\cnDcQsl.exe

C:\Windows\System\JMkijnX.exe

C:\Windows\System\JMkijnX.exe

C:\Windows\System\UivXbFT.exe

C:\Windows\System\UivXbFT.exe

C:\Windows\System\dzhzKwb.exe

C:\Windows\System\dzhzKwb.exe

C:\Windows\System\XAQaejj.exe

C:\Windows\System\XAQaejj.exe

C:\Windows\System\Enkjbha.exe

C:\Windows\System\Enkjbha.exe

C:\Windows\System\kHCGwFd.exe

C:\Windows\System\kHCGwFd.exe

C:\Windows\System\HCmnqne.exe

C:\Windows\System\HCmnqne.exe

C:\Windows\System\PuDjeIT.exe

C:\Windows\System\PuDjeIT.exe

C:\Windows\System\NoGXEGD.exe

C:\Windows\System\NoGXEGD.exe

C:\Windows\System\FoZaXuR.exe

C:\Windows\System\FoZaXuR.exe

C:\Windows\System\GirMLAb.exe

C:\Windows\System\GirMLAb.exe

C:\Windows\System\iMXMGzV.exe

C:\Windows\System\iMXMGzV.exe

C:\Windows\System\wBIrONG.exe

C:\Windows\System\wBIrONG.exe

C:\Windows\System\AaJLpPw.exe

C:\Windows\System\AaJLpPw.exe

C:\Windows\System\sReYgDD.exe

C:\Windows\System\sReYgDD.exe

C:\Windows\System\XoUzHLl.exe

C:\Windows\System\XoUzHLl.exe

C:\Windows\System\zCAoVzG.exe

C:\Windows\System\zCAoVzG.exe

C:\Windows\System\MBpzAfc.exe

C:\Windows\System\MBpzAfc.exe

C:\Windows\System\bnKOcPx.exe

C:\Windows\System\bnKOcPx.exe

C:\Windows\System\OLWzhFH.exe

C:\Windows\System\OLWzhFH.exe

C:\Windows\System\VfpxqKd.exe

C:\Windows\System\VfpxqKd.exe

C:\Windows\System\SpSxXdX.exe

C:\Windows\System\SpSxXdX.exe

C:\Windows\System\CnNwGAA.exe

C:\Windows\System\CnNwGAA.exe

C:\Windows\System\NqPJASA.exe

C:\Windows\System\NqPJASA.exe

C:\Windows\System\RvSyrqZ.exe

C:\Windows\System\RvSyrqZ.exe

C:\Windows\System\lTmErEX.exe

C:\Windows\System\lTmErEX.exe

C:\Windows\System\eeJSEtT.exe

C:\Windows\System\eeJSEtT.exe

C:\Windows\System\bwoSvEH.exe

C:\Windows\System\bwoSvEH.exe

C:\Windows\System\mnJWQEv.exe

C:\Windows\System\mnJWQEv.exe

C:\Windows\System\KybkYkH.exe

C:\Windows\System\KybkYkH.exe

C:\Windows\System\DClWCVL.exe

C:\Windows\System\DClWCVL.exe

C:\Windows\System\qAlIhaI.exe

C:\Windows\System\qAlIhaI.exe

C:\Windows\System\DEIweAt.exe

C:\Windows\System\DEIweAt.exe

C:\Windows\System\vBFmTtw.exe

C:\Windows\System\vBFmTtw.exe

C:\Windows\System\SQzAKJs.exe

C:\Windows\System\SQzAKJs.exe

C:\Windows\System\KuuhVvV.exe

C:\Windows\System\KuuhVvV.exe

C:\Windows\System\AsPgDYZ.exe

C:\Windows\System\AsPgDYZ.exe

C:\Windows\System\HEaDscn.exe

C:\Windows\System\HEaDscn.exe

C:\Windows\System\BwGFEmx.exe

C:\Windows\System\BwGFEmx.exe

C:\Windows\System\FHfNPhV.exe

C:\Windows\System\FHfNPhV.exe

C:\Windows\System\dZqrwik.exe

C:\Windows\System\dZqrwik.exe

C:\Windows\System\lkPFgEE.exe

C:\Windows\System\lkPFgEE.exe

C:\Windows\System\YCWcWzl.exe

C:\Windows\System\YCWcWzl.exe

C:\Windows\System\kVLWaTk.exe

C:\Windows\System\kVLWaTk.exe

C:\Windows\System\uOLfpfi.exe

C:\Windows\System\uOLfpfi.exe

C:\Windows\System\STjyCRz.exe

C:\Windows\System\STjyCRz.exe

C:\Windows\System\vtScPDl.exe

C:\Windows\System\vtScPDl.exe

C:\Windows\System\kZfyLKM.exe

C:\Windows\System\kZfyLKM.exe

C:\Windows\System\cJExwYr.exe

C:\Windows\System\cJExwYr.exe

C:\Windows\System\vkEjuOX.exe

C:\Windows\System\vkEjuOX.exe

C:\Windows\System\lMyCfgT.exe

C:\Windows\System\lMyCfgT.exe

C:\Windows\System\jziyaNy.exe

C:\Windows\System\jziyaNy.exe

C:\Windows\System\tXifQMh.exe

C:\Windows\System\tXifQMh.exe

C:\Windows\System\ExtdXeH.exe

C:\Windows\System\ExtdXeH.exe

C:\Windows\System\DyJxHJX.exe

C:\Windows\System\DyJxHJX.exe

C:\Windows\System\VCLoApy.exe

C:\Windows\System\VCLoApy.exe

C:\Windows\System\IZIXPiT.exe

C:\Windows\System\IZIXPiT.exe

C:\Windows\System\bKQYMhO.exe

C:\Windows\System\bKQYMhO.exe

C:\Windows\System\wKImgpa.exe

C:\Windows\System\wKImgpa.exe

C:\Windows\System\kYnGYex.exe

C:\Windows\System\kYnGYex.exe

C:\Windows\System\SIMWppi.exe

C:\Windows\System\SIMWppi.exe

C:\Windows\System\iJgwCke.exe

C:\Windows\System\iJgwCke.exe

C:\Windows\System\tCLnNxh.exe

C:\Windows\System\tCLnNxh.exe

C:\Windows\System\oxbNHtB.exe

C:\Windows\System\oxbNHtB.exe

C:\Windows\System\PZTThMz.exe

C:\Windows\System\PZTThMz.exe

C:\Windows\System\wYYkQYO.exe

C:\Windows\System\wYYkQYO.exe

C:\Windows\System\sNZlQTU.exe

C:\Windows\System\sNZlQTU.exe

C:\Windows\System\zlGaspE.exe

C:\Windows\System\zlGaspE.exe

C:\Windows\System\nVRRwFl.exe

C:\Windows\System\nVRRwFl.exe

C:\Windows\System\EVtmZBH.exe

C:\Windows\System\EVtmZBH.exe

C:\Windows\System\hVAZquw.exe

C:\Windows\System\hVAZquw.exe

C:\Windows\System\CNFTJJc.exe

C:\Windows\System\CNFTJJc.exe

C:\Windows\System\uKuneCA.exe

C:\Windows\System\uKuneCA.exe

C:\Windows\System\iQzsbHg.exe

C:\Windows\System\iQzsbHg.exe

C:\Windows\System\qOnhdYc.exe

C:\Windows\System\qOnhdYc.exe

C:\Windows\System\LekDdUc.exe

C:\Windows\System\LekDdUc.exe

C:\Windows\System\awhSpjU.exe

C:\Windows\System\awhSpjU.exe

C:\Windows\System\rQxsqnt.exe

C:\Windows\System\rQxsqnt.exe

C:\Windows\System\gWCkHcL.exe

C:\Windows\System\gWCkHcL.exe

C:\Windows\System\SWLLvJq.exe

C:\Windows\System\SWLLvJq.exe

C:\Windows\System\ByHgZgV.exe

C:\Windows\System\ByHgZgV.exe

C:\Windows\System\yokQiDV.exe

C:\Windows\System\yokQiDV.exe

C:\Windows\System\yukgeUC.exe

C:\Windows\System\yukgeUC.exe

C:\Windows\System\YYaLSdc.exe

C:\Windows\System\YYaLSdc.exe

C:\Windows\System\apJrBPN.exe

C:\Windows\System\apJrBPN.exe

C:\Windows\System\PbsAeVr.exe

C:\Windows\System\PbsAeVr.exe

C:\Windows\System\jSGOaUQ.exe

C:\Windows\System\jSGOaUQ.exe

C:\Windows\System\BcTYDba.exe

C:\Windows\System\BcTYDba.exe

C:\Windows\System\Jsxtnpj.exe

C:\Windows\System\Jsxtnpj.exe

C:\Windows\System\aAvisGA.exe

C:\Windows\System\aAvisGA.exe

C:\Windows\System\QYbwOYd.exe

C:\Windows\System\QYbwOYd.exe

C:\Windows\System\tOFsFZR.exe

C:\Windows\System\tOFsFZR.exe

C:\Windows\System\KmzAuah.exe

C:\Windows\System\KmzAuah.exe

C:\Windows\System\dZPSJZR.exe

C:\Windows\System\dZPSJZR.exe

C:\Windows\System\rcKSbwS.exe

C:\Windows\System\rcKSbwS.exe

C:\Windows\System\qsAyAyI.exe

C:\Windows\System\qsAyAyI.exe

C:\Windows\System\XumxPYY.exe

C:\Windows\System\XumxPYY.exe

C:\Windows\System\yLZlsAU.exe

C:\Windows\System\yLZlsAU.exe

C:\Windows\System\lmvNhtL.exe

C:\Windows\System\lmvNhtL.exe

C:\Windows\System\PGYrPSw.exe

C:\Windows\System\PGYrPSw.exe

C:\Windows\System\VwDzkMQ.exe

C:\Windows\System\VwDzkMQ.exe

C:\Windows\System\dwXnEqo.exe

C:\Windows\System\dwXnEqo.exe

C:\Windows\System\SeoxIlY.exe

C:\Windows\System\SeoxIlY.exe

C:\Windows\System\VqepcPR.exe

C:\Windows\System\VqepcPR.exe

C:\Windows\System\SzTWfWe.exe

C:\Windows\System\SzTWfWe.exe

C:\Windows\System\PEmymyO.exe

C:\Windows\System\PEmymyO.exe

C:\Windows\System\urFdjjW.exe

C:\Windows\System\urFdjjW.exe

C:\Windows\System\PRCBkmv.exe

C:\Windows\System\PRCBkmv.exe

C:\Windows\System\JrKZeHm.exe

C:\Windows\System\JrKZeHm.exe

C:\Windows\System\otvxItu.exe

C:\Windows\System\otvxItu.exe

C:\Windows\System\gPUfQaj.exe

C:\Windows\System\gPUfQaj.exe

C:\Windows\System\RyIbbvt.exe

C:\Windows\System\RyIbbvt.exe

C:\Windows\System\kLtxHch.exe

C:\Windows\System\kLtxHch.exe

C:\Windows\System\pejJwtM.exe

C:\Windows\System\pejJwtM.exe

C:\Windows\System\lvUqlaS.exe

C:\Windows\System\lvUqlaS.exe

C:\Windows\System\MBywUyk.exe

C:\Windows\System\MBywUyk.exe

C:\Windows\System\dEhCadC.exe

C:\Windows\System\dEhCadC.exe

C:\Windows\System\yJKQZFH.exe

C:\Windows\System\yJKQZFH.exe

C:\Windows\System\yIqoUVb.exe

C:\Windows\System\yIqoUVb.exe

C:\Windows\System\ScEaNXW.exe

C:\Windows\System\ScEaNXW.exe

C:\Windows\System\MWZwjWz.exe

C:\Windows\System\MWZwjWz.exe

C:\Windows\System\VEjGApS.exe

C:\Windows\System\VEjGApS.exe

C:\Windows\System\IVZIZDv.exe

C:\Windows\System\IVZIZDv.exe

C:\Windows\System\AknMZqi.exe

C:\Windows\System\AknMZqi.exe

C:\Windows\System\Wbwzahz.exe

C:\Windows\System\Wbwzahz.exe

C:\Windows\System\yPJsMSJ.exe

C:\Windows\System\yPJsMSJ.exe

C:\Windows\System\ipZDseW.exe

C:\Windows\System\ipZDseW.exe

C:\Windows\System\rBJAfhm.exe

C:\Windows\System\rBJAfhm.exe

C:\Windows\System\ZAbwkfG.exe

C:\Windows\System\ZAbwkfG.exe

C:\Windows\System\yRnwFXq.exe

C:\Windows\System\yRnwFXq.exe

C:\Windows\System\ODabEEh.exe

C:\Windows\System\ODabEEh.exe

C:\Windows\System\IZxKnSQ.exe

C:\Windows\System\IZxKnSQ.exe

C:\Windows\System\IBxZKhF.exe

C:\Windows\System\IBxZKhF.exe

C:\Windows\System\xCovEOX.exe

C:\Windows\System\xCovEOX.exe

C:\Windows\System\dmquVsM.exe

C:\Windows\System\dmquVsM.exe

C:\Windows\System\jIuSkyH.exe

C:\Windows\System\jIuSkyH.exe

C:\Windows\System\bkowafU.exe

C:\Windows\System\bkowafU.exe

C:\Windows\System\BRIwenl.exe

C:\Windows\System\BRIwenl.exe

C:\Windows\System\fhEmtHA.exe

C:\Windows\System\fhEmtHA.exe

C:\Windows\System\VgiHKiS.exe

C:\Windows\System\VgiHKiS.exe

C:\Windows\System\uylEXsO.exe

C:\Windows\System\uylEXsO.exe

C:\Windows\System\qVtmBAm.exe

C:\Windows\System\qVtmBAm.exe

C:\Windows\System\uZpTyRM.exe

C:\Windows\System\uZpTyRM.exe

C:\Windows\System\rOcekCQ.exe

C:\Windows\System\rOcekCQ.exe

C:\Windows\System\fuPJvLT.exe

C:\Windows\System\fuPJvLT.exe

C:\Windows\System\zZGLUqi.exe

C:\Windows\System\zZGLUqi.exe

C:\Windows\System\haeiGWH.exe

C:\Windows\System\haeiGWH.exe

C:\Windows\System\ZGWkBfo.exe

C:\Windows\System\ZGWkBfo.exe

C:\Windows\System\tGsnEcL.exe

C:\Windows\System\tGsnEcL.exe

C:\Windows\System\PYkoMvP.exe

C:\Windows\System\PYkoMvP.exe

C:\Windows\System\mHKPvgl.exe

C:\Windows\System\mHKPvgl.exe

C:\Windows\System\AbeCGXd.exe

C:\Windows\System\AbeCGXd.exe

C:\Windows\System\JRmIwlN.exe

C:\Windows\System\JRmIwlN.exe

C:\Windows\System\JeQLCEv.exe

C:\Windows\System\JeQLCEv.exe

C:\Windows\System\LpXWSJv.exe

C:\Windows\System\LpXWSJv.exe

C:\Windows\System\akYPJbm.exe

C:\Windows\System\akYPJbm.exe

C:\Windows\System\nHNUpbA.exe

C:\Windows\System\nHNUpbA.exe

C:\Windows\System\mztkjYh.exe

C:\Windows\System\mztkjYh.exe

C:\Windows\System\tUNuwHd.exe

C:\Windows\System\tUNuwHd.exe

C:\Windows\System\LSGmwZp.exe

C:\Windows\System\LSGmwZp.exe

C:\Windows\System\TIlXZmP.exe

C:\Windows\System\TIlXZmP.exe

C:\Windows\System\zqcKuOp.exe

C:\Windows\System\zqcKuOp.exe

C:\Windows\System\fwlVqDh.exe

C:\Windows\System\fwlVqDh.exe

C:\Windows\System\gjYqsfC.exe

C:\Windows\System\gjYqsfC.exe

C:\Windows\System\FfDtqYx.exe

C:\Windows\System\FfDtqYx.exe

C:\Windows\System\bYZwaKI.exe

C:\Windows\System\bYZwaKI.exe

C:\Windows\System\SBBzHAo.exe

C:\Windows\System\SBBzHAo.exe

C:\Windows\System\fzJDtqS.exe

C:\Windows\System\fzJDtqS.exe

C:\Windows\System\gNVyMUE.exe

C:\Windows\System\gNVyMUE.exe

C:\Windows\System\rmYGnYN.exe

C:\Windows\System\rmYGnYN.exe

C:\Windows\System\xUhLSoC.exe

C:\Windows\System\xUhLSoC.exe

C:\Windows\System\vNfxZrJ.exe

C:\Windows\System\vNfxZrJ.exe

C:\Windows\System\qVDySyY.exe

C:\Windows\System\qVDySyY.exe

C:\Windows\System\sCblQzp.exe

C:\Windows\System\sCblQzp.exe

C:\Windows\System\jTZOVAz.exe

C:\Windows\System\jTZOVAz.exe

C:\Windows\System\NZZDUAH.exe

C:\Windows\System\NZZDUAH.exe

C:\Windows\System\QwMWYuP.exe

C:\Windows\System\QwMWYuP.exe

C:\Windows\System\AWNeyNX.exe

C:\Windows\System\AWNeyNX.exe

C:\Windows\System\YKizCNQ.exe

C:\Windows\System\YKizCNQ.exe

C:\Windows\System\uuHbEgS.exe

C:\Windows\System\uuHbEgS.exe

C:\Windows\System\TbUrNKY.exe

C:\Windows\System\TbUrNKY.exe

C:\Windows\System\gxgsWeK.exe

C:\Windows\System\gxgsWeK.exe

C:\Windows\System\YwCDcol.exe

C:\Windows\System\YwCDcol.exe

C:\Windows\System\KQJvuqL.exe

C:\Windows\System\KQJvuqL.exe

C:\Windows\System\oeuJqbL.exe

C:\Windows\System\oeuJqbL.exe

C:\Windows\System\NflGLVU.exe

C:\Windows\System\NflGLVU.exe

C:\Windows\System\pgsepOY.exe

C:\Windows\System\pgsepOY.exe

C:\Windows\System\DMQDkTv.exe

C:\Windows\System\DMQDkTv.exe

C:\Windows\System\VhHjbAJ.exe

C:\Windows\System\VhHjbAJ.exe

C:\Windows\System\vJzsjJH.exe

C:\Windows\System\vJzsjJH.exe

C:\Windows\System\UeGazGI.exe

C:\Windows\System\UeGazGI.exe

C:\Windows\System\PhftPoQ.exe

C:\Windows\System\PhftPoQ.exe

C:\Windows\System\jIkSKvA.exe

C:\Windows\System\jIkSKvA.exe

C:\Windows\System\uDGayZs.exe

C:\Windows\System\uDGayZs.exe

C:\Windows\System\tRMenbt.exe

C:\Windows\System\tRMenbt.exe

C:\Windows\System\JZiXtHE.exe

C:\Windows\System\JZiXtHE.exe

C:\Windows\System\WyNNIAb.exe

C:\Windows\System\WyNNIAb.exe

C:\Windows\System\ZosIRtL.exe

C:\Windows\System\ZosIRtL.exe

C:\Windows\System\UwiqFTZ.exe

C:\Windows\System\UwiqFTZ.exe

C:\Windows\System\yCHonee.exe

C:\Windows\System\yCHonee.exe

C:\Windows\System\kWaiECT.exe

C:\Windows\System\kWaiECT.exe

C:\Windows\System\LYYLWaj.exe

C:\Windows\System\LYYLWaj.exe

C:\Windows\System\UQbYPTc.exe

C:\Windows\System\UQbYPTc.exe

C:\Windows\System\iCqbKVI.exe

C:\Windows\System\iCqbKVI.exe

C:\Windows\System\sskwuRn.exe

C:\Windows\System\sskwuRn.exe

C:\Windows\System\RCeYefK.exe

C:\Windows\System\RCeYefK.exe

C:\Windows\System\jdMkhBz.exe

C:\Windows\System\jdMkhBz.exe

C:\Windows\System\WvwbcSX.exe

C:\Windows\System\WvwbcSX.exe

C:\Windows\System\peRijII.exe

C:\Windows\System\peRijII.exe

C:\Windows\System\SgwxyZN.exe

C:\Windows\System\SgwxyZN.exe

C:\Windows\System\hcFZXiT.exe

C:\Windows\System\hcFZXiT.exe

C:\Windows\System\faMJqqL.exe

C:\Windows\System\faMJqqL.exe

C:\Windows\System\KrCanAR.exe

C:\Windows\System\KrCanAR.exe

C:\Windows\System\nWxYrau.exe

C:\Windows\System\nWxYrau.exe

C:\Windows\System\medDwjP.exe

C:\Windows\System\medDwjP.exe

C:\Windows\System\MEsaKrd.exe

C:\Windows\System\MEsaKrd.exe

C:\Windows\System\RuEMMfN.exe

C:\Windows\System\RuEMMfN.exe

C:\Windows\System\hTXPgNk.exe

C:\Windows\System\hTXPgNk.exe

C:\Windows\System\ayctlLH.exe

C:\Windows\System\ayctlLH.exe

C:\Windows\System\IiHCTPC.exe

C:\Windows\System\IiHCTPC.exe

C:\Windows\System\DpWrYER.exe

C:\Windows\System\DpWrYER.exe

C:\Windows\System\ulLqckB.exe

C:\Windows\System\ulLqckB.exe

C:\Windows\System\dOfMtRO.exe

C:\Windows\System\dOfMtRO.exe

C:\Windows\System\fCvpjpE.exe

C:\Windows\System\fCvpjpE.exe

C:\Windows\System\fJsxWxx.exe

C:\Windows\System\fJsxWxx.exe

C:\Windows\System\zPeJTsf.exe

C:\Windows\System\zPeJTsf.exe

C:\Windows\System\CKfnSaT.exe

C:\Windows\System\CKfnSaT.exe

C:\Windows\System\cKGRaGv.exe

C:\Windows\System\cKGRaGv.exe

C:\Windows\System\brexgnP.exe

C:\Windows\System\brexgnP.exe

C:\Windows\System\ybMqiEw.exe

C:\Windows\System\ybMqiEw.exe

C:\Windows\System\nSVgLCy.exe

C:\Windows\System\nSVgLCy.exe

C:\Windows\System\XFncLMM.exe

C:\Windows\System\XFncLMM.exe

C:\Windows\System\ZGAeTwI.exe

C:\Windows\System\ZGAeTwI.exe

C:\Windows\System\dyuwZhy.exe

C:\Windows\System\dyuwZhy.exe

C:\Windows\System\wtqVnbt.exe

C:\Windows\System\wtqVnbt.exe

C:\Windows\System\TQxWnhK.exe

C:\Windows\System\TQxWnhK.exe

C:\Windows\System\hQUiTdn.exe

C:\Windows\System\hQUiTdn.exe

C:\Windows\System\zDRizDu.exe

C:\Windows\System\zDRizDu.exe

C:\Windows\System\hkWKuLg.exe

C:\Windows\System\hkWKuLg.exe

C:\Windows\System\fpxWVwz.exe

C:\Windows\System\fpxWVwz.exe

C:\Windows\System\gmMPsyn.exe

C:\Windows\System\gmMPsyn.exe

C:\Windows\System\ynapBMC.exe

C:\Windows\System\ynapBMC.exe

C:\Windows\System\cgmtZmK.exe

C:\Windows\System\cgmtZmK.exe

C:\Windows\System\ULtqGQL.exe

C:\Windows\System\ULtqGQL.exe

C:\Windows\System\PDmLkuv.exe

C:\Windows\System\PDmLkuv.exe

C:\Windows\System\XsPExcd.exe

C:\Windows\System\XsPExcd.exe

C:\Windows\System\MVNMhbA.exe

C:\Windows\System\MVNMhbA.exe

C:\Windows\System\rWofcMm.exe

C:\Windows\System\rWofcMm.exe

C:\Windows\System\BDUUjyJ.exe

C:\Windows\System\BDUUjyJ.exe

C:\Windows\System\jUuVDMv.exe

C:\Windows\System\jUuVDMv.exe

C:\Windows\System\GTnmagw.exe

C:\Windows\System\GTnmagw.exe

C:\Windows\System\rrKrhWD.exe

C:\Windows\System\rrKrhWD.exe

C:\Windows\System\mkxxozc.exe

C:\Windows\System\mkxxozc.exe

C:\Windows\System\DXaFpOg.exe

C:\Windows\System\DXaFpOg.exe

C:\Windows\System\RcWYCeL.exe

C:\Windows\System\RcWYCeL.exe

C:\Windows\System\iEoSCPS.exe

C:\Windows\System\iEoSCPS.exe

C:\Windows\System\BbCsyBu.exe

C:\Windows\System\BbCsyBu.exe

C:\Windows\System\tuMfMjC.exe

C:\Windows\System\tuMfMjC.exe

C:\Windows\System\PDzKbTo.exe

C:\Windows\System\PDzKbTo.exe

C:\Windows\System\mpjZdfW.exe

C:\Windows\System\mpjZdfW.exe

C:\Windows\System\jBrmXLp.exe

C:\Windows\System\jBrmXLp.exe

C:\Windows\System\JdilteW.exe

C:\Windows\System\JdilteW.exe

C:\Windows\System\ooyBVJH.exe

C:\Windows\System\ooyBVJH.exe

C:\Windows\System\TFOMvOH.exe

C:\Windows\System\TFOMvOH.exe

C:\Windows\System\KXqVtmZ.exe

C:\Windows\System\KXqVtmZ.exe

C:\Windows\System\qUaZWxO.exe

C:\Windows\System\qUaZWxO.exe

C:\Windows\System\VXHOHoW.exe

C:\Windows\System\VXHOHoW.exe

C:\Windows\System\MviQonY.exe

C:\Windows\System\MviQonY.exe

C:\Windows\System\hZmPxSc.exe

C:\Windows\System\hZmPxSc.exe

C:\Windows\System\wXRDaDJ.exe

C:\Windows\System\wXRDaDJ.exe

C:\Windows\System\pTKAcNu.exe

C:\Windows\System\pTKAcNu.exe

C:\Windows\System\LOgHZST.exe

C:\Windows\System\LOgHZST.exe

C:\Windows\System\bUbjqzk.exe

C:\Windows\System\bUbjqzk.exe

C:\Windows\System\KfYuhgh.exe

C:\Windows\System\KfYuhgh.exe

C:\Windows\System\pPiRTMl.exe

C:\Windows\System\pPiRTMl.exe

C:\Windows\System\dzjypLx.exe

C:\Windows\System\dzjypLx.exe

C:\Windows\System\eTfnCId.exe

C:\Windows\System\eTfnCId.exe

C:\Windows\System\oqHltjX.exe

C:\Windows\System\oqHltjX.exe

C:\Windows\System\CygldKe.exe

C:\Windows\System\CygldKe.exe

C:\Windows\System\bStVxDS.exe

C:\Windows\System\bStVxDS.exe

C:\Windows\System\yKXkyfN.exe

C:\Windows\System\yKXkyfN.exe

C:\Windows\System\wZWdBCd.exe

C:\Windows\System\wZWdBCd.exe

C:\Windows\System\NriNZHC.exe

C:\Windows\System\NriNZHC.exe

C:\Windows\System\prcioRK.exe

C:\Windows\System\prcioRK.exe

C:\Windows\System\pNalHBu.exe

C:\Windows\System\pNalHBu.exe

C:\Windows\System\mLXpfWQ.exe

C:\Windows\System\mLXpfWQ.exe

C:\Windows\System\jNFNSTP.exe

C:\Windows\System\jNFNSTP.exe

C:\Windows\System\sHkrbEj.exe

C:\Windows\System\sHkrbEj.exe

C:\Windows\System\HuBUtKy.exe

C:\Windows\System\HuBUtKy.exe

C:\Windows\System\Uhgktim.exe

C:\Windows\System\Uhgktim.exe

C:\Windows\System\BffZrLj.exe

C:\Windows\System\BffZrLj.exe

C:\Windows\System\xCAdLWj.exe

C:\Windows\System\xCAdLWj.exe

C:\Windows\System\LBoEHaN.exe

C:\Windows\System\LBoEHaN.exe

C:\Windows\System\IeQYpHa.exe

C:\Windows\System\IeQYpHa.exe

C:\Windows\System\LRwIPzc.exe

C:\Windows\System\LRwIPzc.exe

C:\Windows\System\ZJAIAac.exe

C:\Windows\System\ZJAIAac.exe

C:\Windows\System\zPQzVlo.exe

C:\Windows\System\zPQzVlo.exe

C:\Windows\System\hPKlDqP.exe

C:\Windows\System\hPKlDqP.exe

C:\Windows\System\zlQIivn.exe

C:\Windows\System\zlQIivn.exe

C:\Windows\System\GDULYGa.exe

C:\Windows\System\GDULYGa.exe

C:\Windows\System\eOEAYoC.exe

C:\Windows\System\eOEAYoC.exe

C:\Windows\System\irQcrML.exe

C:\Windows\System\irQcrML.exe

C:\Windows\System\sXVKnsB.exe

C:\Windows\System\sXVKnsB.exe

C:\Windows\System\MjMLeAY.exe

C:\Windows\System\MjMLeAY.exe

C:\Windows\System\Mitthrn.exe

C:\Windows\System\Mitthrn.exe

C:\Windows\System\Gaarzbm.exe

C:\Windows\System\Gaarzbm.exe

C:\Windows\System\gjcfKUO.exe

C:\Windows\System\gjcfKUO.exe

C:\Windows\System\GrpSbKi.exe

C:\Windows\System\GrpSbKi.exe

C:\Windows\System\CSDmMiv.exe

C:\Windows\System\CSDmMiv.exe

C:\Windows\System\KqgSVzq.exe

C:\Windows\System\KqgSVzq.exe

C:\Windows\System\qprriuz.exe

C:\Windows\System\qprriuz.exe

C:\Windows\System\fFrBiNq.exe

C:\Windows\System\fFrBiNq.exe

C:\Windows\System\lXMmODy.exe

C:\Windows\System\lXMmODy.exe

C:\Windows\System\mXTnrfy.exe

C:\Windows\System\mXTnrfy.exe

C:\Windows\System\nNruqfW.exe

C:\Windows\System\nNruqfW.exe

C:\Windows\System\rqmUsLu.exe

C:\Windows\System\rqmUsLu.exe

C:\Windows\System\RoXWNZE.exe

C:\Windows\System\RoXWNZE.exe

C:\Windows\System\nlOHNZR.exe

C:\Windows\System\nlOHNZR.exe

C:\Windows\System\xIxchyn.exe

C:\Windows\System\xIxchyn.exe

C:\Windows\System\GUzsOqX.exe

C:\Windows\System\GUzsOqX.exe

C:\Windows\System\HCqMIxm.exe

C:\Windows\System\HCqMIxm.exe

C:\Windows\System\xnNLxxG.exe

C:\Windows\System\xnNLxxG.exe

C:\Windows\System\ScwamZm.exe

C:\Windows\System\ScwamZm.exe

C:\Windows\System\rUijOEA.exe

C:\Windows\System\rUijOEA.exe

C:\Windows\System\uKNzdio.exe

C:\Windows\System\uKNzdio.exe

C:\Windows\System\SJZMiQI.exe

C:\Windows\System\SJZMiQI.exe

C:\Windows\System\zBBKNqy.exe

C:\Windows\System\zBBKNqy.exe

C:\Windows\System\ONFXDiJ.exe

C:\Windows\System\ONFXDiJ.exe

C:\Windows\System\vkPoTAC.exe

C:\Windows\System\vkPoTAC.exe

C:\Windows\System\TbZFtIG.exe

C:\Windows\System\TbZFtIG.exe

C:\Windows\System\CNbZZEw.exe

C:\Windows\System\CNbZZEw.exe

C:\Windows\System\SoYesWk.exe

C:\Windows\System\SoYesWk.exe

C:\Windows\System\TLAIETO.exe

C:\Windows\System\TLAIETO.exe

C:\Windows\System\IvUvnlE.exe

C:\Windows\System\IvUvnlE.exe

C:\Windows\System\CzHjPhO.exe

C:\Windows\System\CzHjPhO.exe

C:\Windows\System\qzuuSOd.exe

C:\Windows\System\qzuuSOd.exe

C:\Windows\System\lfPOWzc.exe

C:\Windows\System\lfPOWzc.exe

C:\Windows\System\RtQJkPe.exe

C:\Windows\System\RtQJkPe.exe

C:\Windows\System\FUUGiDr.exe

C:\Windows\System\FUUGiDr.exe

C:\Windows\System\TXrNuFW.exe

C:\Windows\System\TXrNuFW.exe

C:\Windows\System\TYovdkh.exe

C:\Windows\System\TYovdkh.exe

C:\Windows\System\MvSDhpw.exe

C:\Windows\System\MvSDhpw.exe

C:\Windows\System\fIBCuAX.exe

C:\Windows\System\fIBCuAX.exe

C:\Windows\System\sSaDBag.exe

C:\Windows\System\sSaDBag.exe

C:\Windows\System\uWLeitc.exe

C:\Windows\System\uWLeitc.exe

C:\Windows\System\pYgivbf.exe

C:\Windows\System\pYgivbf.exe

C:\Windows\System\YPRVQtR.exe

C:\Windows\System\YPRVQtR.exe

C:\Windows\System\LcmjaMY.exe

C:\Windows\System\LcmjaMY.exe

C:\Windows\System\VqZJGll.exe

C:\Windows\System\VqZJGll.exe

C:\Windows\System\iokpwiW.exe

C:\Windows\System\iokpwiW.exe

C:\Windows\System\beSAnMG.exe

C:\Windows\System\beSAnMG.exe

C:\Windows\System\IuvHrWU.exe

C:\Windows\System\IuvHrWU.exe

C:\Windows\System\YKjLCdi.exe

C:\Windows\System\YKjLCdi.exe

C:\Windows\System\wNQJyHq.exe

C:\Windows\System\wNQJyHq.exe

C:\Windows\System\YQcbbyf.exe

C:\Windows\System\YQcbbyf.exe

C:\Windows\System\zlHyCkO.exe

C:\Windows\System\zlHyCkO.exe

C:\Windows\System\pgKeNER.exe

C:\Windows\System\pgKeNER.exe

C:\Windows\System\nMBCNcg.exe

C:\Windows\System\nMBCNcg.exe

C:\Windows\System\UFvbPlU.exe

C:\Windows\System\UFvbPlU.exe

C:\Windows\System\VCgSyTg.exe

C:\Windows\System\VCgSyTg.exe

C:\Windows\System\EEeosEP.exe

C:\Windows\System\EEeosEP.exe

C:\Windows\System\Iiqwxrm.exe

C:\Windows\System\Iiqwxrm.exe

C:\Windows\System\KqUDHtx.exe

C:\Windows\System\KqUDHtx.exe

C:\Windows\System\aaoNHvu.exe

C:\Windows\System\aaoNHvu.exe

C:\Windows\System\KICFdqr.exe

C:\Windows\System\KICFdqr.exe

C:\Windows\System\SPwKKjz.exe

C:\Windows\System\SPwKKjz.exe

C:\Windows\System\ynkowOJ.exe

C:\Windows\System\ynkowOJ.exe

C:\Windows\System\SeiHzUG.exe

C:\Windows\System\SeiHzUG.exe

C:\Windows\System\FfgcZuW.exe

C:\Windows\System\FfgcZuW.exe

C:\Windows\System\sqycelo.exe

C:\Windows\System\sqycelo.exe

C:\Windows\System\AsmCRgd.exe

C:\Windows\System\AsmCRgd.exe

C:\Windows\System\MLKLdRF.exe

C:\Windows\System\MLKLdRF.exe

C:\Windows\System\WlnTzBQ.exe

C:\Windows\System\WlnTzBQ.exe

C:\Windows\System\oFdzpNC.exe

C:\Windows\System\oFdzpNC.exe

C:\Windows\System\jJgJTww.exe

C:\Windows\System\jJgJTww.exe

C:\Windows\System\BONifHm.exe

C:\Windows\System\BONifHm.exe

C:\Windows\System\qepKPdX.exe

C:\Windows\System\qepKPdX.exe

C:\Windows\System\ErWzLKz.exe

C:\Windows\System\ErWzLKz.exe

C:\Windows\System\QTFeXLd.exe

C:\Windows\System\QTFeXLd.exe

C:\Windows\System\fxOxSlc.exe

C:\Windows\System\fxOxSlc.exe

C:\Windows\System\uLkJOEp.exe

C:\Windows\System\uLkJOEp.exe

C:\Windows\System\QKglPZE.exe

C:\Windows\System\QKglPZE.exe

C:\Windows\System\KWLGpOE.exe

C:\Windows\System\KWLGpOE.exe

C:\Windows\System\xqKWORE.exe

C:\Windows\System\xqKWORE.exe

C:\Windows\System\CwyHgqi.exe

C:\Windows\System\CwyHgqi.exe

C:\Windows\System\IilVzWX.exe

C:\Windows\System\IilVzWX.exe

C:\Windows\System\hgVLaML.exe

C:\Windows\System\hgVLaML.exe

C:\Windows\System\oDyWCaZ.exe

C:\Windows\System\oDyWCaZ.exe

C:\Windows\System\zkaWzMB.exe

C:\Windows\System\zkaWzMB.exe

C:\Windows\System\nVtbSYO.exe

C:\Windows\System\nVtbSYO.exe

C:\Windows\System\QBPyFDm.exe

C:\Windows\System\QBPyFDm.exe

C:\Windows\System\DoqtqZc.exe

C:\Windows\System\DoqtqZc.exe

C:\Windows\System\xkZzkky.exe

C:\Windows\System\xkZzkky.exe

C:\Windows\System\beSgteH.exe

C:\Windows\System\beSgteH.exe

C:\Windows\System\fnlVdcF.exe

C:\Windows\System\fnlVdcF.exe

C:\Windows\System\IFSwGSz.exe

C:\Windows\System\IFSwGSz.exe

C:\Windows\System\QiQdjDO.exe

C:\Windows\System\QiQdjDO.exe

C:\Windows\System\vftfLtJ.exe

C:\Windows\System\vftfLtJ.exe

C:\Windows\System\lYjcXQc.exe

C:\Windows\System\lYjcXQc.exe

C:\Windows\System\ohoTvJX.exe

C:\Windows\System\ohoTvJX.exe

C:\Windows\System\kZwpdYO.exe

C:\Windows\System\kZwpdYO.exe

C:\Windows\System\PYTrKNU.exe

C:\Windows\System\PYTrKNU.exe

C:\Windows\System\BiynyIg.exe

C:\Windows\System\BiynyIg.exe

C:\Windows\System\CTMQqJD.exe

C:\Windows\System\CTMQqJD.exe

C:\Windows\System\bWDWBjv.exe

C:\Windows\System\bWDWBjv.exe

C:\Windows\System\xLqJPxs.exe

C:\Windows\System\xLqJPxs.exe

C:\Windows\System\yQiBrGs.exe

C:\Windows\System\yQiBrGs.exe

C:\Windows\System\XMtrtOI.exe

C:\Windows\System\XMtrtOI.exe

C:\Windows\System\jZULAgi.exe

C:\Windows\System\jZULAgi.exe

C:\Windows\System\ENNJVzD.exe

C:\Windows\System\ENNJVzD.exe

C:\Windows\System\HDJuowK.exe

C:\Windows\System\HDJuowK.exe

C:\Windows\System\JAlIfNu.exe

C:\Windows\System\JAlIfNu.exe

C:\Windows\System\zxTcZhg.exe

C:\Windows\System\zxTcZhg.exe

C:\Windows\System\nVWSDTD.exe

C:\Windows\System\nVWSDTD.exe

C:\Windows\System\phpCtqK.exe

C:\Windows\System\phpCtqK.exe

C:\Windows\System\SDiyXFq.exe

C:\Windows\System\SDiyXFq.exe

C:\Windows\System\kyKIddl.exe

C:\Windows\System\kyKIddl.exe

C:\Windows\System\tvUUwQA.exe

C:\Windows\System\tvUUwQA.exe

C:\Windows\System\HUabgGa.exe

C:\Windows\System\HUabgGa.exe

C:\Windows\System\UcfTrzQ.exe

C:\Windows\System\UcfTrzQ.exe

C:\Windows\System\ZxqSzyP.exe

C:\Windows\System\ZxqSzyP.exe

C:\Windows\System\CWrGIvV.exe

C:\Windows\System\CWrGIvV.exe

C:\Windows\System\cfwkDRx.exe

C:\Windows\System\cfwkDRx.exe

C:\Windows\System\ktDnQYi.exe

C:\Windows\System\ktDnQYi.exe

C:\Windows\System\aUYWiJZ.exe

C:\Windows\System\aUYWiJZ.exe

C:\Windows\System\xTpCrvu.exe

C:\Windows\System\xTpCrvu.exe

C:\Windows\System\ZNgHOVt.exe

C:\Windows\System\ZNgHOVt.exe

C:\Windows\System\uVCPQjQ.exe

C:\Windows\System\uVCPQjQ.exe

C:\Windows\System\MZUQqAt.exe

C:\Windows\System\MZUQqAt.exe

C:\Windows\System\tzuIePm.exe

C:\Windows\System\tzuIePm.exe

C:\Windows\System\qxVVKfx.exe

C:\Windows\System\qxVVKfx.exe

C:\Windows\System\XXcicDx.exe

C:\Windows\System\XXcicDx.exe

C:\Windows\System\pbXrOSc.exe

C:\Windows\System\pbXrOSc.exe

C:\Windows\System\AUojVHj.exe

C:\Windows\System\AUojVHj.exe

C:\Windows\System\ICJtTms.exe

C:\Windows\System\ICJtTms.exe

C:\Windows\System\fnvgCWr.exe

C:\Windows\System\fnvgCWr.exe

C:\Windows\System\lzCXDob.exe

C:\Windows\System\lzCXDob.exe

C:\Windows\System\HTUOWoe.exe

C:\Windows\System\HTUOWoe.exe

C:\Windows\System\xQEaNOu.exe

C:\Windows\System\xQEaNOu.exe

C:\Windows\System\RsWJZvI.exe

C:\Windows\System\RsWJZvI.exe

C:\Windows\System\LuimOdT.exe

C:\Windows\System\LuimOdT.exe

C:\Windows\System\hRFqTot.exe

C:\Windows\System\hRFqTot.exe

C:\Windows\System\SJwkTdC.exe

C:\Windows\System\SJwkTdC.exe

C:\Windows\System\XfweddN.exe

C:\Windows\System\XfweddN.exe

C:\Windows\System\RrXvjdj.exe

C:\Windows\System\RrXvjdj.exe

C:\Windows\System\sevQHnP.exe

C:\Windows\System\sevQHnP.exe

C:\Windows\System\ZZxEAtH.exe

C:\Windows\System\ZZxEAtH.exe

C:\Windows\System\WORqSjW.exe

C:\Windows\System\WORqSjW.exe

C:\Windows\System\AKIYKdB.exe

C:\Windows\System\AKIYKdB.exe

C:\Windows\System\UzgyNjV.exe

C:\Windows\System\UzgyNjV.exe

C:\Windows\System\UYMJRhT.exe

C:\Windows\System\UYMJRhT.exe

C:\Windows\System\aSjZFeU.exe

C:\Windows\System\aSjZFeU.exe

C:\Windows\System\aYGzyGD.exe

C:\Windows\System\aYGzyGD.exe

C:\Windows\System\MRpyndq.exe

C:\Windows\System\MRpyndq.exe

C:\Windows\System\nKkkZkI.exe

C:\Windows\System\nKkkZkI.exe

C:\Windows\System\nEzBuUd.exe

C:\Windows\System\nEzBuUd.exe

C:\Windows\System\vQcQCte.exe

C:\Windows\System\vQcQCte.exe

C:\Windows\System\RQGBeFa.exe

C:\Windows\System\RQGBeFa.exe

C:\Windows\System\UkoBfXF.exe

C:\Windows\System\UkoBfXF.exe

C:\Windows\System\iVKHekJ.exe

C:\Windows\System\iVKHekJ.exe

C:\Windows\System\WAULvyq.exe

C:\Windows\System\WAULvyq.exe

C:\Windows\System\fHfQdmJ.exe

C:\Windows\System\fHfQdmJ.exe

C:\Windows\System\aumcaXn.exe

C:\Windows\System\aumcaXn.exe

C:\Windows\System\XtJnYIX.exe

C:\Windows\System\XtJnYIX.exe

C:\Windows\System\aDSAeUg.exe

C:\Windows\System\aDSAeUg.exe

C:\Windows\System\qdBoRTb.exe

C:\Windows\System\qdBoRTb.exe

C:\Windows\System\JvaAkyY.exe

C:\Windows\System\JvaAkyY.exe

C:\Windows\System\cKfHUPT.exe

C:\Windows\System\cKfHUPT.exe

C:\Windows\System\NzWXAuG.exe

C:\Windows\System\NzWXAuG.exe

C:\Windows\System\qPHTAHr.exe

C:\Windows\System\qPHTAHr.exe

C:\Windows\System\nNOHMMf.exe

C:\Windows\System\nNOHMMf.exe

C:\Windows\System\MTgmBcc.exe

C:\Windows\System\MTgmBcc.exe

C:\Windows\System\YATmsFg.exe

C:\Windows\System\YATmsFg.exe

C:\Windows\System\GQNLIHr.exe

C:\Windows\System\GQNLIHr.exe

C:\Windows\System\fmabHpP.exe

C:\Windows\System\fmabHpP.exe

C:\Windows\System\DdRahka.exe

C:\Windows\System\DdRahka.exe

C:\Windows\System\zetNUxZ.exe

C:\Windows\System\zetNUxZ.exe

C:\Windows\System\EJZTMCk.exe

C:\Windows\System\EJZTMCk.exe

C:\Windows\System\WBkHiuP.exe

C:\Windows\System\WBkHiuP.exe

C:\Windows\System\SlrXTzR.exe

C:\Windows\System\SlrXTzR.exe

C:\Windows\System\BmvMKCA.exe

C:\Windows\System\BmvMKCA.exe

C:\Windows\System\hubuKNm.exe

C:\Windows\System\hubuKNm.exe

C:\Windows\System\esxaQQs.exe

C:\Windows\System\esxaQQs.exe

C:\Windows\System\xORFeYx.exe

C:\Windows\System\xORFeYx.exe

C:\Windows\System\XUSZyAV.exe

C:\Windows\System\XUSZyAV.exe

C:\Windows\System\JsftlHV.exe

C:\Windows\System\JsftlHV.exe

C:\Windows\System\OrFoAeb.exe

C:\Windows\System\OrFoAeb.exe

C:\Windows\System\hSFTKcp.exe

C:\Windows\System\hSFTKcp.exe

C:\Windows\System\wIwgCLu.exe

C:\Windows\System\wIwgCLu.exe

C:\Windows\System\nNvXJbT.exe

C:\Windows\System\nNvXJbT.exe

C:\Windows\System\dhCkEyl.exe

C:\Windows\System\dhCkEyl.exe

C:\Windows\System\bvgyXwR.exe

C:\Windows\System\bvgyXwR.exe

C:\Windows\System\vveScJA.exe

C:\Windows\System\vveScJA.exe

C:\Windows\System\dvYTdBc.exe

C:\Windows\System\dvYTdBc.exe

C:\Windows\System\wkWYTAK.exe

C:\Windows\System\wkWYTAK.exe

C:\Windows\System\JOwrFtF.exe

C:\Windows\System\JOwrFtF.exe

C:\Windows\System\yKsvikV.exe

C:\Windows\System\yKsvikV.exe

C:\Windows\System\rIKtsQq.exe

C:\Windows\System\rIKtsQq.exe

C:\Windows\System\QXKxKFt.exe

C:\Windows\System\QXKxKFt.exe

C:\Windows\System\pCeiAUV.exe

C:\Windows\System\pCeiAUV.exe

C:\Windows\System\meAmODu.exe

C:\Windows\System\meAmODu.exe

C:\Windows\System\uowRNYJ.exe

C:\Windows\System\uowRNYJ.exe

C:\Windows\System\tIjxyzm.exe

C:\Windows\System\tIjxyzm.exe

C:\Windows\System\jYSUfkz.exe

C:\Windows\System\jYSUfkz.exe

C:\Windows\System\TplvDfd.exe

C:\Windows\System\TplvDfd.exe

C:\Windows\System\LxKjbyd.exe

C:\Windows\System\LxKjbyd.exe

C:\Windows\System\TWUdpZa.exe

C:\Windows\System\TWUdpZa.exe

C:\Windows\System\jlycHmF.exe

C:\Windows\System\jlycHmF.exe

C:\Windows\System\SkaIxXP.exe

C:\Windows\System\SkaIxXP.exe

C:\Windows\System\VnOHunp.exe

C:\Windows\System\VnOHunp.exe

C:\Windows\System\XKlwwnG.exe

C:\Windows\System\XKlwwnG.exe

C:\Windows\System\OjuNnsi.exe

C:\Windows\System\OjuNnsi.exe

C:\Windows\System\nbTpWNm.exe

C:\Windows\System\nbTpWNm.exe

C:\Windows\System\bhDePfM.exe

C:\Windows\System\bhDePfM.exe

C:\Windows\System\HgTvWgH.exe

C:\Windows\System\HgTvWgH.exe

C:\Windows\System\DAFFJgL.exe

C:\Windows\System\DAFFJgL.exe

C:\Windows\System\UaxEgkF.exe

C:\Windows\System\UaxEgkF.exe

C:\Windows\System\FxkLvwR.exe

C:\Windows\System\FxkLvwR.exe

C:\Windows\System\csQligC.exe

C:\Windows\System\csQligC.exe

C:\Windows\System\ZFXEaqa.exe

C:\Windows\System\ZFXEaqa.exe

C:\Windows\System\NsAsLIY.exe

C:\Windows\System\NsAsLIY.exe

C:\Windows\System\NLyhmCh.exe

C:\Windows\System\NLyhmCh.exe

C:\Windows\System\COZiwvg.exe

C:\Windows\System\COZiwvg.exe

C:\Windows\System\YtLikMi.exe

C:\Windows\System\YtLikMi.exe

C:\Windows\System\bfKFqOU.exe

C:\Windows\System\bfKFqOU.exe

C:\Windows\System\zeaeYVx.exe

C:\Windows\System\zeaeYVx.exe

C:\Windows\System\ZDsbyRn.exe

C:\Windows\System\ZDsbyRn.exe

C:\Windows\System\ZjBhCHo.exe

C:\Windows\System\ZjBhCHo.exe

C:\Windows\System\JFdFIxl.exe

C:\Windows\System\JFdFIxl.exe

C:\Windows\System\HsCvAkQ.exe

C:\Windows\System\HsCvAkQ.exe

C:\Windows\System\pQXbRSn.exe

C:\Windows\System\pQXbRSn.exe

C:\Windows\System\yxKgnGZ.exe

C:\Windows\System\yxKgnGZ.exe

C:\Windows\System\stwLgAO.exe

C:\Windows\System\stwLgAO.exe

C:\Windows\System\PmlzWjO.exe

C:\Windows\System\PmlzWjO.exe

C:\Windows\System\zcZoqJP.exe

C:\Windows\System\zcZoqJP.exe

C:\Windows\System\DopjlGu.exe

C:\Windows\System\DopjlGu.exe

C:\Windows\System\RbqFfjo.exe

C:\Windows\System\RbqFfjo.exe

C:\Windows\System\VINIyDl.exe

C:\Windows\System\VINIyDl.exe

C:\Windows\System\utluwsf.exe

C:\Windows\System\utluwsf.exe

C:\Windows\System\eoTZmoq.exe

C:\Windows\System\eoTZmoq.exe

C:\Windows\System\SwhdYIH.exe

C:\Windows\System\SwhdYIH.exe

C:\Windows\System\cKZQMWb.exe

C:\Windows\System\cKZQMWb.exe

C:\Windows\System\sieqcnF.exe

C:\Windows\System\sieqcnF.exe

C:\Windows\System\gpgTksR.exe

C:\Windows\System\gpgTksR.exe

C:\Windows\System\GGsyeal.exe

C:\Windows\System\GGsyeal.exe

C:\Windows\System\TXELcdK.exe

C:\Windows\System\TXELcdK.exe

C:\Windows\System\RAWregh.exe

C:\Windows\System\RAWregh.exe

C:\Windows\System\DMIzYDO.exe

C:\Windows\System\DMIzYDO.exe

C:\Windows\System\osALlNA.exe

C:\Windows\System\osALlNA.exe

C:\Windows\System\AJoajhY.exe

C:\Windows\System\AJoajhY.exe

C:\Windows\System\eEoOAyS.exe

C:\Windows\System\eEoOAyS.exe

C:\Windows\System\ftrxopF.exe

C:\Windows\System\ftrxopF.exe

C:\Windows\System\mwhQfGa.exe

C:\Windows\System\mwhQfGa.exe

C:\Windows\System\IFwjcaB.exe

C:\Windows\System\IFwjcaB.exe

C:\Windows\System\MDtdjNb.exe

C:\Windows\System\MDtdjNb.exe

C:\Windows\System\vYUmsGu.exe

C:\Windows\System\vYUmsGu.exe

C:\Windows\System\dbabdDd.exe

C:\Windows\System\dbabdDd.exe

C:\Windows\System\NCwjqNx.exe

C:\Windows\System\NCwjqNx.exe

C:\Windows\System\wuiGBgo.exe

C:\Windows\System\wuiGBgo.exe

C:\Windows\System\GSwGCkS.exe

C:\Windows\System\GSwGCkS.exe

C:\Windows\System\fGtoEEa.exe

C:\Windows\System\fGtoEEa.exe

C:\Windows\System\HdyZTKP.exe

C:\Windows\System\HdyZTKP.exe

C:\Windows\System\kDLqUWS.exe

C:\Windows\System\kDLqUWS.exe

C:\Windows\System\wJyptgR.exe

C:\Windows\System\wJyptgR.exe

C:\Windows\System\NLlzmdj.exe

C:\Windows\System\NLlzmdj.exe

C:\Windows\System\ZZpBKDq.exe

C:\Windows\System\ZZpBKDq.exe

C:\Windows\System\cNaPfUW.exe

C:\Windows\System\cNaPfUW.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp

Files

memory/1576-1-0x000000013FE00000-0x00000001401F6000-memory.dmp

\Windows\system\QyNtRMv.exe

MD5	46d82c3a27f9017e39f9ed53bdf8e8f5
SHA1	40abd19b08fd8ae2b04385899309b2b08606ca84
SHA256	ba588d40d8c87536925ca65bef00bc5de8173dc403c86b7d6c561031c58f2f43
SHA512	2f56e346861a050e8f986db3f05c90d2bf3aa50422745412ab265d81e26e57c653c3f5758867365f70161bd5b13ab86b9296a86b3b26aa4cdc6c5be18305ccbd

\Windows\system\tBjIAQp.exe

MD5	9286c21c82bdaad911721d37e008c4d5
SHA1	d07ec79c2817223c0cc1e863d096f143a7189e8e
SHA256	60dc9a7cdce0f28200dbf6d443be83926c5f46d440089cddde7df600e132c220
SHA512	eb95beb1c527f86e75ddd5d4f9be475555f512316cb42070f628a3a4e6826401968b92983dee75c91b15c647a17813d3794b0f7eb2c5c3c1bbf59ace6bd03b94

\Windows\system\HSZgXgn.exe

MD5	7bfe8f71af028587f3eb870f5f2142fd
SHA1	a67991077bf5576dfc54c2a840d59aeea839a5e7
SHA256	2332de76a0db342fad2dbb36a62e4cb5f4227255ab786f1fe597c400e6409884
SHA512	3cb1b21f4b37c19d9b788c9e1d9e0f27d6bea247a4714f15816288dc1a79ac8c0f73f919074f5fd2415f9c9edda32b363b4e80211ae4c7dd1b21421f1265bf05

memory/2612-42-0x000000013FF20000-0x0000000140316000-memory.dmp

C:\Windows\system\moTRBrd.exe

MD5	597876075d3fd7c17e771d266afb0028
SHA1	2ac276eefd577dbee87fafcce987eca129a8f0e2
SHA256	7c89739cd9c3a93cf2bf093f3265c631e9efee7b1dc5c8aac929c4420675269c
SHA512	71446435ddd8da69e96223082bd3c8d328ac1d38a0cff3872a55c6f40ffbfe2bb17bde8dbb80ee4a1eba527875e3a993ad64f0c1b1aafb577d13ae2534c717b3

C:\Windows\system\MONYLqb.exe

MD5	f8c7397bc6a24552e1356caa6cef8f82
SHA1	796d9934ddb4d18f0c0ec0bae59c2fce275ae44a
SHA256	b3daa3e23a6fb79f6a2c686f9bb7f933bdaf615f9729e05b0f37b18a2d3e82ff
SHA512	ee865f934a7b79255159fdc681d7819e17638d93b43bec6a487ebd0a6cf91834bbb93e9e573f63687b36cd6bb65f321841fdba8b3a97eaed27f3ebd6d79bac62

C:\Windows\system\DuvLiZJ.exe

MD5	90de253416ad346637dba2819bc4d6cf
SHA1	c5d7c15d925facf05b8077f30197dc96c42b202e
SHA256	0d6a31d53077a0c04dd557e55aef361db16a5932308b1f799f0a5bb40163fc50
SHA512	8efffed40155b8944d56e2b2b363b687a25ee0768bdf08e0806bbe81c91fa5d5b65814442190701513d281b7931bfe69f3011f0002cab5035faaa3b8abee6421

C:\Windows\system\PqedBgv.exe

MD5	a72c59f8a35323e90e626962099a0fed
SHA1	8ff97c6a6be661c996ee96e5a45e84c530d4f9f8
SHA256	b022b76517fe7bbfe848a53ab8fb32a50fcba4dc93535e37164f15f2f5b9362b
SHA512	111d43ec69ae3b1a87d242bc88b0d95c75ec7e7474072cf487a95adda45ee3d18d2d6fe1c69106134ac7bed27416c21699418f28724f545680ec58df560db31c

C:\Windows\system\ugCYDOP.exe

MD5	145724c0563e3633fedba1a4699999e3
SHA1	ceabafaa2acdd5364b61c172f8115a05bc3e3f77
SHA256	d309f53dae9fd3a720e0a5bc410d652f4fbc2231345dec986f05ec0c27e4ea74
SHA512	eaae64cfe30addede99bb79b65b95ff30da2f3033772ab1aa70a5e94703d76b0875a84338d5d324085a8542fb8bfbace92b044543e8a45e2f3f876a104164b44

C:\Windows\system\bHngmrz.exe

MD5	a672299c5d8d4e7964f8211cd62bf960
SHA1	8f6c2b530e25a947559cc87aa9d163920e06a07d
SHA256	43f17304a733d7cd3759549d70bb0f486bd7ad25a3ab6635032109295b97f14f
SHA512	aabe9b9667fae652264aeb533b4405de44cfcc8b985dc69c69983e1e5f85b5de0ec2e7b6c33b12d5d14fdfb9fae4ff402f0c09cc1d6eb34e17e5c9295d8ce936

C:\Windows\system\jfJZnEX.exe

MD5	ac5912e92d517cf5f44bdb968d402f27
SHA1	056b82957678a326e32ca22c8f302d4a37b7174a
SHA256	926fbf8edaa0a66880bf054cbaed3ee71cd51f24387be6a8cb8e1d2d4d84696a
SHA512	1b17a21262046eb39169b9d0979b55fa670d5c0de68913bea61947ca7952e2ec5eea92ae75b45235b2d5c65b4c9c3b5c455414d86552a259731c558a17f7d355

memory/1576-118-0x0000000002970000-0x0000000002D66000-memory.dmp

C:\Windows\system\mNlCeQc.exe

MD5	9601c9d010523d52eb4efae9c557b0aa
SHA1	cc777c354ecc30257f564b556754ffb5be484c30
SHA256	26c48ecfc1af4d580789adc2f342cc594f11e9d07583edd03eb669481b7a294e
SHA512	174db50bc7fba2c2624fe81eda60f304dafeff418b6481909e21e5043b00432a1bc2b78e158b6e67c70314a21066424d5c774c56504e8c040deea75531304f84

C:\Windows\system\xAsyqic.exe

MD5	b6caad55f07c7e68b504911f1b81418f
SHA1	547524d043863d0939b007c5a416c3b16dd309d4
SHA256	1b87182c9e92dec9b58ba73c97326343d59e5be7fbaa0ef06bc9e730f5752c68
SHA512	123ab1670ae95ae619117d0ac7f78c1feda619958109a49b1c6d434e561db61830f94f810b8e660beb9b5493657230b9f63086c4e3b93b77388fd557f462447d

memory/2564-1385-0x000000001B730000-0x000000001BA12000-memory.dmp

memory/2564-1565-0x0000000001F70000-0x0000000001F78000-memory.dmp

C:\Windows\system\wvsBeWH.exe

MD5	843f1d43c4175b3b6dd360b770dcb61d
SHA1	25b67d0ed592d288dfd3d9fd1ba1bc1832ffc196
SHA256	8df05f1dbb089d7db126b9266cb9c9abb7a7eff8236920899f2474b7a859f8cd
SHA512	87b939efa98be201e17a1d827ec2331552df6b08d2e0e2c61aa0942b04ecb9aa03cfce256a595e8f4b455749f029049c5038a49af07c1839aed48e21f821a90b

C:\Windows\system\ixMJZFw.exe

MD5	246a82bcd96c656f8c5ad3e1d96bbded
SHA1	71392ba337bd59504e764bc08444df4a12c63b51
SHA256	3fb11d8ebaf55c4ab019d17ae0131a5aef93006a97465acfb891dfba18c3baa4
SHA512	3f3e1c545a57a8e352ac5681281c52910bbf44a1c835f1634457e7aa41081aaf0177738a2157937051029f426dd242086fdc3e1a0f16185cebb7faef1571a422

C:\Windows\system\RgRFevl.exe

MD5	95d4f259677f26d0c1a80a4618c323f4
SHA1	6ce04a7d9949f09035431435829da84be05b5a52
SHA256	2af258580a2273e6369338297d0129a2fa789e85dced1442bf6cfbd5731309d1
SHA512	be11d369d3f4db00818e89990e12901d4a852029de3c7b00aa01b184332bb89b8e0fb8664f8b27b24139a3d3c1d76c874c12a024c64bc17467222e4f304c7ccd

C:\Windows\system\OfAwiEP.exe

MD5	3d48a6cd3d5690c284d5ca34b38b9d30
SHA1	d4d7934aaf230f8723acac3e3fc1ad38edd90759
SHA256	4584958d33f5c0728f22bc90aceb7fdce5f3dd674075a9dc166784a934bfc278
SHA512	12538f5768091090b6def983b65a83917008d7585894da83c8f38f03712c1a661bbb64d29c0f53f2c30f9b03465d8af604dd4b45f705a3166f8f9b15eba3e2df

memory/2928-130-0x000000013F490000-0x000000013F886000-memory.dmp

memory/1576-129-0x000000013F490000-0x000000013F886000-memory.dmp

memory/2484-128-0x000000013F7D0000-0x000000013FBC6000-memory.dmp

C:\Windows\system\ODdPRta.exe

MD5	26c3ad0dea861c6ddfc322564b1c6445
SHA1	51fd91bb0b71de64f5b35302aa5031a808c0d738
SHA256	cb11060dcb64cf86ca6a795629af205aa9a4a26901871237d131c94b2fd648b7
SHA512	e8c2919b1a0144cc0bfa76d5366684128e4a9f9c36293596450984424d6c8924fff8337cacdd83c68e912a4fc2225f9f6e71a548545bc965383584ebb10784e4

memory/2684-126-0x000000013F9D0000-0x000000013FDC6000-memory.dmp

memory/2720-125-0x000000013FB00000-0x000000013FEF6000-memory.dmp

memory/2828-124-0x000000013F350000-0x000000013F746000-memory.dmp

memory/1576-123-0x0000000003040000-0x0000000003436000-memory.dmp

memory/1576-122-0x000000013F9D0000-0x000000013FDC6000-memory.dmp

\Windows\system\nYGBFAb.exe

MD5	14e192fd4210db06d0f8c41ce099028a
SHA1	24d40981f9a4e21043d2a04ae4c68626f566bfb6
SHA256	95df619c2e94d8b7ab9349b22fcd6e8e803dafc18b11e7217e2e61af71147b69
SHA512	9cc61d7115d722ce45bc7f5a77eb55c02cd8b2bb9ebf982042e291a17695ec078cce03311f9bc5123e932310155fa213ab7342bda1ba29bc2a909debf1a0480f

memory/2596-112-0x000000013F300000-0x000000013F6F6000-memory.dmp

memory/2672-105-0x000000013F980000-0x000000013FD76000-memory.dmp

memory/2728-141-0x000000013FE10000-0x0000000140206000-memory.dmp

memory/1576-140-0x000000013F7D0000-0x000000013FBC6000-memory.dmp

memory/2692-139-0x000000013FF70000-0x0000000140366000-memory.dmp

memory/1576-104-0x000000013F350000-0x000000013F746000-memory.dmp

memory/2984-103-0x000000013F520000-0x000000013F916000-memory.dmp

memory/1576-137-0x00000000026A0000-0x0000000002A96000-memory.dmp

memory/376-136-0x000000013FF40000-0x0000000140336000-memory.dmp

memory/1576-134-0x0000000003040000-0x0000000003436000-memory.dmp

memory/1576-102-0x000000013F300000-0x000000013F6F6000-memory.dmp

memory/1576-101-0x00000000026A0000-0x0000000002A96000-memory.dmp

C:\Windows\system\aRpXEEM.exe

MD5	2b5d078cb3376e405238e28c314f4148
SHA1	faf9e6690319bc3f4b738599cb902c991db5d495
SHA256	aa11c2d7d96a25f76139388e331a69d58c45aa903b182080fce602e34ce44029
SHA512	be6129c840f119d765f0eff8bc2145fcbd0fd0447295ab1348d349bd56381a5bf6f645d06cff9247991efa154a8a39404989c76a54478b3e214e28404be3b190

C:\Windows\system\yfSPcoj.exe

MD5	44ee38a933aa46e2fcf47d27033d408b
SHA1	9a142f9812a1cabeef40a0b121faf5cd9500edcd
SHA256	b76294f2393ca0e637990bdf8ed4271de8d4f9e2a5e9d097f7f2d2fac190a8e4
SHA512	b2dc5d5f445af1a0df60691d7cef3f42d67c9db53a763ceb03ec3a31a29aff6c6e2071b7358ca64b976224ef24daaecb8fecadff8577bc3ce98431c0428dfc12

C:\Windows\system\phSAoJM.exe

MD5	f8f9ae9d8fc55b9d20c212bfd0044f8a
SHA1	bd8c6de1443be4ffb49bc0eda7b7b924e2702a36
SHA256	6a1fbe13e3b8f65fe660cef8818055414b1d123bffd6caf6b10489ac2fed2009
SHA512	17d4da62aa7c065bf13fc461bdf38f1a1a2b07703f24d776d26c645f805f293dcc14a111c1f0b96400035a099bd7de481839a0cf595aadb6822da7ec62036b3b

C:\Windows\system\IgykWye.exe

MD5	5e1839f589738bec5d2c4214d53b329e
SHA1	205a0c9f9a0a17960ca24a69364d0708821ef08e
SHA256	95ce832ae0a53f562694596c5b87941f4b5b4088c34645e3528138848d190584
SHA512	bfb016e59f55f89021f86243a4e22f91f6676de9bb9eb256ce2790f3e99f9f45790e162fe1d3a4e3f85a63e4552a8c3c44a6fef2b801c0b858370e21a450c26c

C:\Windows\system\txgJMQi.exe

MD5	eaca50bd8d4ab4602623b793545af083
SHA1	a7cb8e62b4c2f7e8884ff6a0d8524dd227d47253
SHA256	66e452b2c2a643bb174e21942992ca2326ed96ad0006d10ebcf1b2ce9363d2b2
SHA512	8f7276a005b08cfcbe72e9addf1608f86408a54b14afcf88852d35c1cceb91c9b25447ea3dee99bce4416248aef141a3fd8e7fbef700f140520430221ade43fd

C:\Windows\system\dcTxima.exe

MD5	869b3995d619c8483ebcbeea54ecb4c2
SHA1	ea5daa9e7c3a039f6be31a83946ea67498ac6955
SHA256	95f5660192c2a8c059a69e3ad541175ba79b00f1aeec87224d6b4f4a96490b94
SHA512	364b93863d3e56effb433d4c114bfbeed88c6be0b8438c9e1bdeded3a038cc74998059591b8c28320ecdfef6d926abf2fe07c5b5a1e4ce23f00f1cb286287083

C:\Windows\system\PtlRDrg.exe

MD5	fc61cf13f63e52be51650b5b56578f7a
SHA1	42c1a53101cd712d56946f717176b6e60c8cf49f
SHA256	2117143b7d7b82cd7b3e7d9572af3c825167a4fc326bd759c502e6df15ee9a00
SHA512	fdec3580bf94ff72599f8d165db7d63e030963085eb7e9355e10bb9e9ed8d88c5ffca449364bf183e31343b542224a8ff00fc750aa335767d70afacb7816a2dc

C:\Windows\system\HBepVax.exe

MD5	f169b3b24d3c41fc5916a9233c2f781c
SHA1	e038a95ac0c08bfabc223db93bf15c93f15578ba
SHA256	5e6a1c02bf69cc3c18639b8b140424422c2c4f150022c047bfc3bf6dc0f6984c
SHA512	03d82652b81a41ef4aadc4165ce6f4eba6223965b607243925cd3fac820e9622a3169ad6ffba2b6650a6258cc8f36fea8892b1e1e2264a1ff4ca1baed13e6edd

C:\Windows\system\KJzdVPz.exe

MD5	baeab61271080c803ac3537b2939ae03
SHA1	fef77003080c99ec0b24b96fe79ffb53d3aabd00
SHA256	f261c45a70134ce72de58db6ec522ff4d6dcae2f5dce5a1afea903ff5cf58b10
SHA512	8172ec364523c53b6b3aa7effebf704ce9c724624b619b176c090a5236894846c719d6db1d39b59a8edbd90e8b99dae50a75123a3a0fa9fbd76a825bd9c2cf4f

C:\Windows\system\UprvtgW.exe

MD5	d6b6339f7cc5a36be4a1a526b2e0a1b8
SHA1	8f447a28252fe0622fd2d906d1b4cef1a7794ad5
SHA256	93619e3ee1d9cbef303d3d81f750bdbe2bdf00aea9fd6b1e50fb2a8cf35497b1
SHA512	85d7d68c5ed84a3416b6aa88a2cc485f5345142b1e00b0a9a1bee0cc2188e14700476cf29ebdf819dcd96809ca65e98b5b5bff57144e6b5ad826bccc899b1ea0

C:\Windows\system\QcEZuho.exe

MD5	e5ad5ce7f3f6e3a5223a5c8a625de6c4
SHA1	eecfd1c95099b03667eb48c74e4d387c58cc809f
SHA256	b1417ed77613132941c8891a5fc8b6cd71004893b580ed392e5488ae50581f5c
SHA512	2d1a6ce625b5b6d2274f0618a0acb4c326bee3769cd1a9e21b0d94675327bfc5a68b4e8b83e2db0e7e0183f1d40ca3ba8b3e3dca42e4211e169c1d9fe5163cf0

C:\Windows\system\SBbbkcg.exe

MD5	b980ec7abb9af3f6ccda5cec31505f8f
SHA1	09fb3b0cfc505e54f811532055b82038d2f5e708
SHA256	134425db939798352930b49381d8aff03820f399cb007e4a7b83fd815cfeb670
SHA512	fc01ac975f5e05d869d262cfa729c57e3c9c2b8bec67e651b70ea20dc05f2125bd49b810fbe6a058ad10127693b8e62f43b095e0c2161708704fd4e57da763d1

memory/1576-47-0x000000013F980000-0x000000013FD76000-memory.dmp

C:\Windows\system\XrxSKsN.exe

MD5	95c18370bdf39c4659145639232a63a2
SHA1	0272237cd3a3279f8ab2e5db918d56a282a41cc1
SHA256	c9efb3f62f078c36cbf3050175811cf71bbfd774cb7a83f53812efba06e7767f
SHA512	61cda2418a8e21ec7491867d105930509c4883d44a3944d5d7ef6f7bd4f8ab6c0592f6ba7e380837199db7ff738a79c78153b534fe2195200673416d8fb51c10

memory/1576-17-0x000000013F520000-0x000000013F916000-memory.dmp

C:\Windows\system\PdADvTq.exe

MD5	d5de364329d1e2e1041e396b7cb0dc5d
SHA1	d8affffdbba991156419fe1d4cc476cd15de19be
SHA256	249ef915c69ad6731dfeb7cd3cc68a5cdf0750e4e49f0482fec6c0e3bf34a76b
SHA512	3545f37b10c8de012513e526d0b306b707dce0a45fc863c570a366299e2f9de41e1f945ef08d9e54dcee0f563c57d127c27fbd92d7ad0ee57f8f7509c44dc527

memory/1576-0-0x00000000002F0000-0x0000000000300000-memory.dmp

memory/1576-2499-0x000000013FE00000-0x00000001401F6000-memory.dmp

memory/1576-3244-0x0000000003040000-0x0000000003436000-memory.dmp

memory/2684-3251-0x000000013F9D0000-0x000000013FDC6000-memory.dmp

memory/2720-3249-0x000000013FB00000-0x000000013FEF6000-memory.dmp

memory/2928-3299-0x000000013F490000-0x000000013F886000-memory.dmp

memory/376-3300-0x000000013FF40000-0x0000000140336000-memory.dmp

memory/2484-3298-0x000000013F7D0000-0x000000013FBC6000-memory.dmp

memory/2692-6849-0x000000013FF70000-0x0000000140366000-memory.dmp

memory/2728-6899-0x000000013FE10000-0x0000000140206000-memory.dmp

memory/2684-8517-0x000000013F9D0000-0x000000013FDC6000-memory.dmp

memory/2928-8516-0x000000013F490000-0x000000013F886000-memory.dmp

memory/376-8520-0x000000013FF40000-0x0000000140336000-memory.dmp

memory/2484-8519-0x000000013F7D0000-0x000000013FBC6000-memory.dmp

memory/2720-8515-0x000000013FB00000-0x000000013FEF6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 22:23

Reported

2024-06-13 22:26

Platform

win10v2004-20240611-en

Max time kernel

138s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Blocklisted process makes network request

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\QyNtRMv.exe	N/A
N/A	N/A	C:\Windows\System\PdADvTq.exe	N/A
N/A	N/A	C:\Windows\System\tBjIAQp.exe	N/A
N/A	N/A	C:\Windows\System\moTRBrd.exe	N/A
N/A	N/A	C:\Windows\System\XrxSKsN.exe	N/A
N/A	N/A	C:\Windows\System\HSZgXgn.exe	N/A
N/A	N/A	C:\Windows\System\SBbbkcg.exe	N/A
N/A	N/A	C:\Windows\System\UprvtgW.exe	N/A
N/A	N/A	C:\Windows\System\QcEZuho.exe	N/A
N/A	N/A	C:\Windows\System\MONYLqb.exe	N/A
N/A	N/A	C:\Windows\System\KJzdVPz.exe	N/A
N/A	N/A	C:\Windows\System\DuvLiZJ.exe	N/A
N/A	N/A	C:\Windows\System\HBepVax.exe	N/A
N/A	N/A	C:\Windows\System\PtlRDrg.exe	N/A
N/A	N/A	C:\Windows\System\dcTxima.exe	N/A
N/A	N/A	C:\Windows\System\PqedBgv.exe	N/A
N/A	N/A	C:\Windows\System\ugCYDOP.exe	N/A
N/A	N/A	C:\Windows\System\txgJMQi.exe	N/A
N/A	N/A	C:\Windows\System\IgykWye.exe	N/A
N/A	N/A	C:\Windows\System\bHngmrz.exe	N/A
N/A	N/A	C:\Windows\System\yfSPcoj.exe	N/A
N/A	N/A	C:\Windows\System\phSAoJM.exe	N/A
N/A	N/A	C:\Windows\System\ODdPRta.exe	N/A
N/A	N/A	C:\Windows\System\aRpXEEM.exe	N/A
N/A	N/A	C:\Windows\System\nYGBFAb.exe	N/A
N/A	N/A	C:\Windows\System\jfJZnEX.exe	N/A
N/A	N/A	C:\Windows\System\mNlCeQc.exe	N/A
N/A	N/A	C:\Windows\System\OfAwiEP.exe	N/A
N/A	N/A	C:\Windows\System\xAsyqic.exe	N/A
N/A	N/A	C:\Windows\System\RgRFevl.exe	N/A
N/A	N/A	C:\Windows\System\ixMJZFw.exe	N/A
N/A	N/A	C:\Windows\System\wvsBeWH.exe	N/A
N/A	N/A	C:\Windows\System\idEtYSh.exe	N/A
N/A	N/A	C:\Windows\System\vUerVcF.exe	N/A
N/A	N/A	C:\Windows\System\JNlgmHs.exe	N/A
N/A	N/A	C:\Windows\System\tUioNFw.exe	N/A
N/A	N/A	C:\Windows\System\aZEkMrM.exe	N/A
N/A	N/A	C:\Windows\System\BiDlchP.exe	N/A
N/A	N/A	C:\Windows\System\CeICImH.exe	N/A
N/A	N/A	C:\Windows\System\Qotbyyf.exe	N/A
N/A	N/A	C:\Windows\System\GcszSWN.exe	N/A
N/A	N/A	C:\Windows\System\NFrdHmJ.exe	N/A
N/A	N/A	C:\Windows\System\FbRgARy.exe	N/A
N/A	N/A	C:\Windows\System\lnJCNBk.exe	N/A
N/A	N/A	C:\Windows\System\jSkITYW.exe	N/A
N/A	N/A	C:\Windows\System\csNKScO.exe	N/A
N/A	N/A	C:\Windows\System\SYNUWGM.exe	N/A
N/A	N/A	C:\Windows\System\RvHdqgU.exe	N/A
N/A	N/A	C:\Windows\System\OSMjmfs.exe	N/A
N/A	N/A	C:\Windows\System\EAGrOoQ.exe	N/A
N/A	N/A	C:\Windows\System\UQsIIKk.exe	N/A
N/A	N/A	C:\Windows\System\YhmoEXz.exe	N/A
N/A	N/A	C:\Windows\System\MJVTQTL.exe	N/A
N/A	N/A	C:\Windows\System\WagoxvS.exe	N/A
N/A	N/A	C:\Windows\System\uxWuLgh.exe	N/A
N/A	N/A	C:\Windows\System\dBDmSrS.exe	N/A
N/A	N/A	C:\Windows\System\kYICZwj.exe	N/A
N/A	N/A	C:\Windows\System\xnJGgbK.exe	N/A
N/A	N/A	C:\Windows\System\XHhMoSc.exe	N/A
N/A	N/A	C:\Windows\System\IjwsDUr.exe	N/A
N/A	N/A	C:\Windows\System\ooxDEEv.exe	N/A
N/A	N/A	C:\Windows\System\YTkxWVf.exe	N/A
N/A	N/A	C:\Windows\System\ryRMyzD.exe	N/A
N/A	N/A	C:\Windows\System\uSXlexn.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	raw.githubusercontent.com	N/A	N/A
N/A	raw.githubusercontent.com	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\Hiyktjy.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lmpfQXI.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HwRUBbN.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gDLeieN.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xZvdYYY.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AaJLpPw.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qOnhdYc.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tBjIAQp.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JCdECiO.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\inCHTUX.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XNEgQdh.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IgykWye.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vRXKgrZ.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bVgDxoA.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zCAoVzG.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bKQYMhO.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qIDkzli.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bJEveRt.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xVBZttd.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NqPJASA.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tXifQMh.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ipZDseW.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DPuFbHJ.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OLWzhFH.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XFVIVNw.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vJkNaJn.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JSOAiMp.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pwXBBuN.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TFnVTyK.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZsyjODX.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aqNsXeV.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zywSyrX.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\onCmBAi.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OtKXeTW.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lPKDnwh.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yukgeUC.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MWZwjWz.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QyNtRMv.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZAbwkfG.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AknMZqi.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ggUvjRZ.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WnQRGUp.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WagoxvS.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UVamNth.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QcEZuho.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MlcrcQU.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yokQiDV.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pejJwtM.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EBlBIKt.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ooxDEEv.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vNWpRaO.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zsvXrEw.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IZIXPiT.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RyIbbvt.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\euMcIqH.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kYICZwj.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cVrFWaf.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xfPDPhu.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HCmnqne.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PMDDYLx.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AkFnBBf.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pkgAEuQ.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vZMBhYB.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KsEMvvt.exe	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2184 wrote to memory of 1660	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2184 wrote to memory of 1660	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2184 wrote to memory of 1044	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\QyNtRMv.exe
PID 2184 wrote to memory of 1044	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\QyNtRMv.exe
PID 2184 wrote to memory of 548	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\PdADvTq.exe
PID 2184 wrote to memory of 548	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\PdADvTq.exe
PID 2184 wrote to memory of 4236	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\tBjIAQp.exe
PID 2184 wrote to memory of 4236	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\tBjIAQp.exe
PID 2184 wrote to memory of 4768	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\moTRBrd.exe
PID 2184 wrote to memory of 4768	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\moTRBrd.exe
PID 2184 wrote to memory of 2932	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\XrxSKsN.exe
PID 2184 wrote to memory of 2932	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\XrxSKsN.exe
PID 2184 wrote to memory of 1408	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\HSZgXgn.exe
PID 2184 wrote to memory of 1408	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\HSZgXgn.exe
PID 2184 wrote to memory of 4448	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\SBbbkcg.exe
PID 2184 wrote to memory of 4448	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\SBbbkcg.exe
PID 2184 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\UprvtgW.exe
PID 2184 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\UprvtgW.exe
PID 2184 wrote to memory of 4896	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\QcEZuho.exe
PID 2184 wrote to memory of 4896	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\QcEZuho.exe
PID 2184 wrote to memory of 4940	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\MONYLqb.exe
PID 2184 wrote to memory of 4940	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\MONYLqb.exe
PID 2184 wrote to memory of 4960	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\KJzdVPz.exe
PID 2184 wrote to memory of 4960	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\KJzdVPz.exe
PID 2184 wrote to memory of 2424	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\DuvLiZJ.exe
PID 2184 wrote to memory of 2424	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\DuvLiZJ.exe
PID 2184 wrote to memory of 2504	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\HBepVax.exe
PID 2184 wrote to memory of 2504	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\HBepVax.exe
PID 2184 wrote to memory of 3112	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\PqedBgv.exe
PID 2184 wrote to memory of 3112	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\PqedBgv.exe
PID 2184 wrote to memory of 844	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\PtlRDrg.exe
PID 2184 wrote to memory of 844	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\PtlRDrg.exe
PID 2184 wrote to memory of 3528	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\dcTxima.exe
PID 2184 wrote to memory of 3528	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\dcTxima.exe
PID 2184 wrote to memory of 4700	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\ugCYDOP.exe
PID 2184 wrote to memory of 4700	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\ugCYDOP.exe
PID 2184 wrote to memory of 4528	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\txgJMQi.exe
PID 2184 wrote to memory of 4528	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\txgJMQi.exe
PID 2184 wrote to memory of 1376	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\IgykWye.exe
PID 2184 wrote to memory of 1376	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\IgykWye.exe
PID 2184 wrote to memory of 1416	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\phSAoJM.exe
PID 2184 wrote to memory of 1416	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\phSAoJM.exe
PID 2184 wrote to memory of 1636	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\bHngmrz.exe
PID 2184 wrote to memory of 1636	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\bHngmrz.exe
PID 2184 wrote to memory of 3864	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\yfSPcoj.exe
PID 2184 wrote to memory of 3864	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\yfSPcoj.exe
PID 2184 wrote to memory of 4476	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\jfJZnEX.exe
PID 2184 wrote to memory of 4476	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\jfJZnEX.exe
PID 2184 wrote to memory of 1424	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\ODdPRta.exe
PID 2184 wrote to memory of 1424	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\ODdPRta.exe
PID 2184 wrote to memory of 2396	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\aRpXEEM.exe
PID 2184 wrote to memory of 2396	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\aRpXEEM.exe
PID 2184 wrote to memory of 3380	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\nYGBFAb.exe
PID 2184 wrote to memory of 3380	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\nYGBFAb.exe
PID 2184 wrote to memory of 3404	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\mNlCeQc.exe
PID 2184 wrote to memory of 3404	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\mNlCeQc.exe
PID 2184 wrote to memory of 4928	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\OfAwiEP.exe
PID 2184 wrote to memory of 4928	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\OfAwiEP.exe
PID 2184 wrote to memory of 4328	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\xAsyqic.exe
PID 2184 wrote to memory of 4328	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\xAsyqic.exe
PID 2184 wrote to memory of 1184	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\RgRFevl.exe
PID 2184 wrote to memory of 1184	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\RgRFevl.exe
PID 2184 wrote to memory of 5048	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\ixMJZFw.exe
PID 2184 wrote to memory of 5048	N/A	C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe	C:\Windows\System\ixMJZFw.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\QyNtRMv.exe

C:\Windows\System\QyNtRMv.exe

C:\Windows\System\PdADvTq.exe

C:\Windows\System\PdADvTq.exe

C:\Windows\System\tBjIAQp.exe

C:\Windows\System\tBjIAQp.exe

C:\Windows\System\moTRBrd.exe

C:\Windows\System\moTRBrd.exe

C:\Windows\System\XrxSKsN.exe

C:\Windows\System\XrxSKsN.exe

C:\Windows\System\HSZgXgn.exe

C:\Windows\System\HSZgXgn.exe

C:\Windows\System\SBbbkcg.exe

C:\Windows\System\SBbbkcg.exe

C:\Windows\System\UprvtgW.exe

C:\Windows\System\UprvtgW.exe

C:\Windows\System\QcEZuho.exe

C:\Windows\System\QcEZuho.exe

C:\Windows\System\MONYLqb.exe

C:\Windows\System\MONYLqb.exe

C:\Windows\System\KJzdVPz.exe

C:\Windows\System\KJzdVPz.exe

C:\Windows\System\DuvLiZJ.exe

C:\Windows\System\DuvLiZJ.exe

C:\Windows\System\HBepVax.exe

C:\Windows\System\HBepVax.exe

C:\Windows\System\PqedBgv.exe

C:\Windows\System\PqedBgv.exe

C:\Windows\System\PtlRDrg.exe

C:\Windows\System\PtlRDrg.exe

C:\Windows\System\dcTxima.exe

C:\Windows\System\dcTxima.exe

C:\Windows\System\ugCYDOP.exe

C:\Windows\System\ugCYDOP.exe

C:\Windows\System\txgJMQi.exe

C:\Windows\System\txgJMQi.exe

C:\Windows\System\IgykWye.exe

C:\Windows\System\IgykWye.exe

C:\Windows\System\phSAoJM.exe

C:\Windows\System\phSAoJM.exe

C:\Windows\System\bHngmrz.exe

C:\Windows\System\bHngmrz.exe

C:\Windows\System\yfSPcoj.exe

C:\Windows\System\yfSPcoj.exe

C:\Windows\System\jfJZnEX.exe

C:\Windows\System\jfJZnEX.exe

C:\Windows\System\ODdPRta.exe

C:\Windows\System\ODdPRta.exe

C:\Windows\System\aRpXEEM.exe

C:\Windows\System\aRpXEEM.exe

C:\Windows\System\nYGBFAb.exe

C:\Windows\System\nYGBFAb.exe

C:\Windows\System\mNlCeQc.exe

C:\Windows\System\mNlCeQc.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4416,i,8660989700097327804,17931739887231169645,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8

C:\Windows\System\OfAwiEP.exe

C:\Windows\System\OfAwiEP.exe

C:\Windows\System\xAsyqic.exe

C:\Windows\System\xAsyqic.exe

C:\Windows\System\RgRFevl.exe

C:\Windows\System\RgRFevl.exe

C:\Windows\System\ixMJZFw.exe

C:\Windows\System\ixMJZFw.exe

C:\Windows\System\wvsBeWH.exe

C:\Windows\System\wvsBeWH.exe

C:\Windows\System\idEtYSh.exe

C:\Windows\System\idEtYSh.exe

C:\Windows\System\vUerVcF.exe

C:\Windows\System\vUerVcF.exe

C:\Windows\System\JNlgmHs.exe

C:\Windows\System\JNlgmHs.exe

C:\Windows\System\tUioNFw.exe

C:\Windows\System\tUioNFw.exe

C:\Windows\System\aZEkMrM.exe

C:\Windows\System\aZEkMrM.exe

C:\Windows\System\BiDlchP.exe

C:\Windows\System\BiDlchP.exe

C:\Windows\System\CeICImH.exe

C:\Windows\System\CeICImH.exe

C:\Windows\System\Qotbyyf.exe

C:\Windows\System\Qotbyyf.exe

C:\Windows\System\GcszSWN.exe

C:\Windows\System\GcszSWN.exe

C:\Windows\System\NFrdHmJ.exe

C:\Windows\System\NFrdHmJ.exe

C:\Windows\System\FbRgARy.exe

C:\Windows\System\FbRgARy.exe

C:\Windows\System\lnJCNBk.exe

C:\Windows\System\lnJCNBk.exe

C:\Windows\System\jSkITYW.exe

C:\Windows\System\jSkITYW.exe

C:\Windows\System\csNKScO.exe

C:\Windows\System\csNKScO.exe

C:\Windows\System\SYNUWGM.exe

C:\Windows\System\SYNUWGM.exe

C:\Windows\System\RvHdqgU.exe

C:\Windows\System\RvHdqgU.exe

C:\Windows\System\OSMjmfs.exe

C:\Windows\System\OSMjmfs.exe

C:\Windows\System\EAGrOoQ.exe

C:\Windows\System\EAGrOoQ.exe

C:\Windows\System\UQsIIKk.exe

C:\Windows\System\UQsIIKk.exe

C:\Windows\System\YhmoEXz.exe

C:\Windows\System\YhmoEXz.exe

C:\Windows\System\MJVTQTL.exe

C:\Windows\System\MJVTQTL.exe

C:\Windows\System\WagoxvS.exe

C:\Windows\System\WagoxvS.exe

C:\Windows\System\uxWuLgh.exe

C:\Windows\System\uxWuLgh.exe

C:\Windows\System\dBDmSrS.exe

C:\Windows\System\dBDmSrS.exe

C:\Windows\System\kYICZwj.exe

C:\Windows\System\kYICZwj.exe

C:\Windows\System\xnJGgbK.exe

C:\Windows\System\xnJGgbK.exe

C:\Windows\System\XHhMoSc.exe

C:\Windows\System\XHhMoSc.exe

C:\Windows\System\IjwsDUr.exe

C:\Windows\System\IjwsDUr.exe

C:\Windows\System\ooxDEEv.exe

C:\Windows\System\ooxDEEv.exe

C:\Windows\System\YTkxWVf.exe

C:\Windows\System\YTkxWVf.exe

C:\Windows\System\ryRMyzD.exe

C:\Windows\System\ryRMyzD.exe

C:\Windows\System\uSXlexn.exe

C:\Windows\System\uSXlexn.exe

C:\Windows\System\oCDOjjG.exe

C:\Windows\System\oCDOjjG.exe

C:\Windows\System\afkEXgi.exe

C:\Windows\System\afkEXgi.exe

C:\Windows\System\IkKOMmx.exe

C:\Windows\System\IkKOMmx.exe

C:\Windows\System\trWlhKp.exe

C:\Windows\System\trWlhKp.exe

C:\Windows\System\mNpMvNA.exe

C:\Windows\System\mNpMvNA.exe

C:\Windows\System\rAGnwwr.exe

C:\Windows\System\rAGnwwr.exe

C:\Windows\System\PjRZKrM.exe

C:\Windows\System\PjRZKrM.exe

C:\Windows\System\xvifPaE.exe

C:\Windows\System\xvifPaE.exe

C:\Windows\System\ZsyjODX.exe

C:\Windows\System\ZsyjODX.exe

C:\Windows\System\isJlyCP.exe

C:\Windows\System\isJlyCP.exe

C:\Windows\System\CYydLeu.exe

C:\Windows\System\CYydLeu.exe

C:\Windows\System\uhSDzUg.exe

C:\Windows\System\uhSDzUg.exe

C:\Windows\System\aqNsXeV.exe

C:\Windows\System\aqNsXeV.exe

C:\Windows\System\XGimENq.exe

C:\Windows\System\XGimENq.exe

C:\Windows\System\bQtrtfW.exe

C:\Windows\System\bQtrtfW.exe

C:\Windows\System\dRERlvR.exe

C:\Windows\System\dRERlvR.exe

C:\Windows\System\AkFnBBf.exe

C:\Windows\System\AkFnBBf.exe

C:\Windows\System\hgFdPtB.exe

C:\Windows\System\hgFdPtB.exe

C:\Windows\System\QZPTWzD.exe

C:\Windows\System\QZPTWzD.exe

C:\Windows\System\JCdECiO.exe

C:\Windows\System\JCdECiO.exe

C:\Windows\System\lkKhAEr.exe

C:\Windows\System\lkKhAEr.exe

C:\Windows\System\YBxNCgL.exe

C:\Windows\System\YBxNCgL.exe

C:\Windows\System\zydCfsE.exe

C:\Windows\System\zydCfsE.exe

C:\Windows\System\zywSyrX.exe

C:\Windows\System\zywSyrX.exe

C:\Windows\System\uNjGNLV.exe

C:\Windows\System\uNjGNLV.exe

C:\Windows\System\pTPfjRr.exe

C:\Windows\System\pTPfjRr.exe

C:\Windows\System\rdxJkkX.exe

C:\Windows\System\rdxJkkX.exe

C:\Windows\System\MGOjQPr.exe

C:\Windows\System\MGOjQPr.exe

C:\Windows\System\shHUKDK.exe

C:\Windows\System\shHUKDK.exe

C:\Windows\System\bgANxVF.exe

C:\Windows\System\bgANxVF.exe

C:\Windows\System\gPGRnou.exe

C:\Windows\System\gPGRnou.exe

C:\Windows\System\TXgLjij.exe

C:\Windows\System\TXgLjij.exe

C:\Windows\System\jbvJFLz.exe

C:\Windows\System\jbvJFLz.exe

C:\Windows\System\dJhQsIp.exe

C:\Windows\System\dJhQsIp.exe

C:\Windows\System\BebORNg.exe

C:\Windows\System\BebORNg.exe

C:\Windows\System\qIDkzli.exe

C:\Windows\System\qIDkzli.exe

C:\Windows\System\JawVatI.exe

C:\Windows\System\JawVatI.exe

C:\Windows\System\CdSboeO.exe

C:\Windows\System\CdSboeO.exe

C:\Windows\System\fHhZfxL.exe

C:\Windows\System\fHhZfxL.exe

C:\Windows\System\PMDDYLx.exe

C:\Windows\System\PMDDYLx.exe

C:\Windows\System\OTKzyfN.exe

C:\Windows\System\OTKzyfN.exe

C:\Windows\System\vWDNUTv.exe

C:\Windows\System\vWDNUTv.exe

C:\Windows\System\VLMmvNP.exe

C:\Windows\System\VLMmvNP.exe

C:\Windows\System\rEcvWgj.exe

C:\Windows\System\rEcvWgj.exe

C:\Windows\System\Mhhfwfq.exe

C:\Windows\System\Mhhfwfq.exe

C:\Windows\System\jvxcRGu.exe

C:\Windows\System\jvxcRGu.exe

C:\Windows\System\LEvmOQU.exe

C:\Windows\System\LEvmOQU.exe

C:\Windows\System\RokEWxc.exe

C:\Windows\System\RokEWxc.exe

C:\Windows\System\NrtmWPT.exe

C:\Windows\System\NrtmWPT.exe

C:\Windows\System\WcZYDES.exe

C:\Windows\System\WcZYDES.exe

C:\Windows\System\uXQLQyt.exe

C:\Windows\System\uXQLQyt.exe

C:\Windows\System\QuqAgNn.exe

C:\Windows\System\QuqAgNn.exe

C:\Windows\System\KmoevYF.exe

C:\Windows\System\KmoevYF.exe

C:\Windows\System\cNEONtR.exe

C:\Windows\System\cNEONtR.exe

C:\Windows\System\RWWJbEX.exe

C:\Windows\System\RWWJbEX.exe

C:\Windows\System\ISNNHsm.exe

C:\Windows\System\ISNNHsm.exe

C:\Windows\System\DDlGvnl.exe

C:\Windows\System\DDlGvnl.exe

C:\Windows\System\joDBYlw.exe

C:\Windows\System\joDBYlw.exe

C:\Windows\System\zDhSLTR.exe

C:\Windows\System\zDhSLTR.exe

C:\Windows\System\pRqRZnQ.exe

C:\Windows\System\pRqRZnQ.exe

C:\Windows\System\lTCOovF.exe

C:\Windows\System\lTCOovF.exe

C:\Windows\System\hGTquzI.exe

C:\Windows\System\hGTquzI.exe

C:\Windows\System\RBQcrwL.exe

C:\Windows\System\RBQcrwL.exe

C:\Windows\System\OWfOYhx.exe

C:\Windows\System\OWfOYhx.exe

C:\Windows\System\vJkNaJn.exe

C:\Windows\System\vJkNaJn.exe

C:\Windows\System\mlZKKrC.exe

C:\Windows\System\mlZKKrC.exe

C:\Windows\System\unaASTV.exe

C:\Windows\System\unaASTV.exe

C:\Windows\System\jLkAsQW.exe

C:\Windows\System\jLkAsQW.exe

C:\Windows\System\BOSsZrh.exe

C:\Windows\System\BOSsZrh.exe

C:\Windows\System\RsCxCgA.exe

C:\Windows\System\RsCxCgA.exe

C:\Windows\System\SjdqVps.exe

C:\Windows\System\SjdqVps.exe

C:\Windows\System\CWCUQxx.exe

C:\Windows\System\CWCUQxx.exe

C:\Windows\System\UpINncI.exe

C:\Windows\System\UpINncI.exe

C:\Windows\System\zEGjkYy.exe

C:\Windows\System\zEGjkYy.exe

C:\Windows\System\uLdxEHh.exe

C:\Windows\System\uLdxEHh.exe

C:\Windows\System\EBlBIKt.exe

C:\Windows\System\EBlBIKt.exe

C:\Windows\System\BGcIrwI.exe

C:\Windows\System\BGcIrwI.exe

C:\Windows\System\sjZZrqe.exe

C:\Windows\System\sjZZrqe.exe

C:\Windows\System\pkgAEuQ.exe

C:\Windows\System\pkgAEuQ.exe

C:\Windows\System\uCZmOAT.exe

C:\Windows\System\uCZmOAT.exe

C:\Windows\System\pSoBoXU.exe

C:\Windows\System\pSoBoXU.exe

C:\Windows\System\xqqyHow.exe

C:\Windows\System\xqqyHow.exe

C:\Windows\System\hOGelab.exe

C:\Windows\System\hOGelab.exe

C:\Windows\System\uHrAjKl.exe

C:\Windows\System\uHrAjKl.exe

C:\Windows\System\HsLKcte.exe

C:\Windows\System\HsLKcte.exe

C:\Windows\System\rEaGAPI.exe

C:\Windows\System\rEaGAPI.exe

C:\Windows\System\ZahfTsC.exe

C:\Windows\System\ZahfTsC.exe

C:\Windows\System\Qgsilzb.exe

C:\Windows\System\Qgsilzb.exe

C:\Windows\System\nuPrPhf.exe

C:\Windows\System\nuPrPhf.exe

C:\Windows\System\YENVcYd.exe

C:\Windows\System\YENVcYd.exe

C:\Windows\System\MtBZgeV.exe

C:\Windows\System\MtBZgeV.exe

C:\Windows\System\EfQtSTh.exe

C:\Windows\System\EfQtSTh.exe

C:\Windows\System\zpmAddI.exe

C:\Windows\System\zpmAddI.exe

C:\Windows\System\Pyukxvy.exe

C:\Windows\System\Pyukxvy.exe

C:\Windows\System\XbnpWvx.exe

C:\Windows\System\XbnpWvx.exe

C:\Windows\System\CbxCCzP.exe

C:\Windows\System\CbxCCzP.exe

C:\Windows\System\bKyjeLy.exe

C:\Windows\System\bKyjeLy.exe

C:\Windows\System\LBVWplU.exe

C:\Windows\System\LBVWplU.exe

C:\Windows\System\uqJomMU.exe

C:\Windows\System\uqJomMU.exe

C:\Windows\System\UVamNth.exe

C:\Windows\System\UVamNth.exe

C:\Windows\System\sDqHRof.exe

C:\Windows\System\sDqHRof.exe

C:\Windows\System\JGXcMgZ.exe

C:\Windows\System\JGXcMgZ.exe

C:\Windows\System\Wxxvxrk.exe

C:\Windows\System\Wxxvxrk.exe

C:\Windows\System\esmJnpB.exe

C:\Windows\System\esmJnpB.exe

C:\Windows\System\UWUpbcy.exe

C:\Windows\System\UWUpbcy.exe

C:\Windows\System\QbZtaRP.exe

C:\Windows\System\QbZtaRP.exe

C:\Windows\System\NNAsNnX.exe

C:\Windows\System\NNAsNnX.exe

C:\Windows\System\wnybvig.exe

C:\Windows\System\wnybvig.exe

C:\Windows\System\KbLcUQs.exe

C:\Windows\System\KbLcUQs.exe

C:\Windows\System\bjEsgfu.exe

C:\Windows\System\bjEsgfu.exe

C:\Windows\System\WxIymVG.exe

C:\Windows\System\WxIymVG.exe

C:\Windows\System\KwGvkkU.exe

C:\Windows\System\KwGvkkU.exe

C:\Windows\System\uiOrfsi.exe

C:\Windows\System\uiOrfsi.exe

C:\Windows\System\kcxJvyk.exe

C:\Windows\System\kcxJvyk.exe

C:\Windows\System\puRKtvd.exe

C:\Windows\System\puRKtvd.exe

C:\Windows\System\eFifQLF.exe

C:\Windows\System\eFifQLF.exe

C:\Windows\System\VplGMTh.exe

C:\Windows\System\VplGMTh.exe

C:\Windows\System\UJHdBCh.exe

C:\Windows\System\UJHdBCh.exe

C:\Windows\System\CVxHGXh.exe

C:\Windows\System\CVxHGXh.exe

C:\Windows\System\vukyRCS.exe

C:\Windows\System\vukyRCS.exe

C:\Windows\System\nnxswJP.exe

C:\Windows\System\nnxswJP.exe

C:\Windows\System\KyKeZlA.exe

C:\Windows\System\KyKeZlA.exe

C:\Windows\System\kPSwkCR.exe

C:\Windows\System\kPSwkCR.exe

C:\Windows\System\EUzIryK.exe

C:\Windows\System\EUzIryK.exe

C:\Windows\System\vNoBakS.exe

C:\Windows\System\vNoBakS.exe

C:\Windows\System\gfNeCVe.exe

C:\Windows\System\gfNeCVe.exe

C:\Windows\System\mSzfjVl.exe

C:\Windows\System\mSzfjVl.exe

C:\Windows\System\BlgLknO.exe

C:\Windows\System\BlgLknO.exe

C:\Windows\System\MlcrcQU.exe

C:\Windows\System\MlcrcQU.exe

C:\Windows\System\ubjQujZ.exe

C:\Windows\System\ubjQujZ.exe

C:\Windows\System\xtAjbFo.exe

C:\Windows\System\xtAjbFo.exe

C:\Windows\System\DNZNcqk.exe

C:\Windows\System\DNZNcqk.exe

C:\Windows\System\AXIDWvl.exe

C:\Windows\System\AXIDWvl.exe

C:\Windows\System\pWppNvm.exe

C:\Windows\System\pWppNvm.exe

C:\Windows\System\wRJlEra.exe

C:\Windows\System\wRJlEra.exe

C:\Windows\System\LsLNXeC.exe

C:\Windows\System\LsLNXeC.exe

C:\Windows\System\yzdNbNZ.exe

C:\Windows\System\yzdNbNZ.exe

C:\Windows\System\JpoWzbH.exe

C:\Windows\System\JpoWzbH.exe

C:\Windows\System\aWKRmFa.exe

C:\Windows\System\aWKRmFa.exe

C:\Windows\System\onCmBAi.exe

C:\Windows\System\onCmBAi.exe

C:\Windows\System\FCFBODO.exe

C:\Windows\System\FCFBODO.exe

C:\Windows\System\YSUatff.exe

C:\Windows\System\YSUatff.exe

C:\Windows\System\ZCibetI.exe

C:\Windows\System\ZCibetI.exe

C:\Windows\System\SKEPhkE.exe

C:\Windows\System\SKEPhkE.exe

C:\Windows\System\naepfRa.exe

C:\Windows\System\naepfRa.exe

C:\Windows\System\FvFoaVd.exe

C:\Windows\System\FvFoaVd.exe

C:\Windows\System\OSBSFin.exe

C:\Windows\System\OSBSFin.exe

C:\Windows\System\xDEaJyO.exe

C:\Windows\System\xDEaJyO.exe

C:\Windows\System\WDEUWBY.exe

C:\Windows\System\WDEUWBY.exe

C:\Windows\System\cVrFWaf.exe

C:\Windows\System\cVrFWaf.exe

C:\Windows\System\BgzOyTV.exe

C:\Windows\System\BgzOyTV.exe

C:\Windows\System\FaCvixC.exe

C:\Windows\System\FaCvixC.exe

C:\Windows\System\vRXKgrZ.exe

C:\Windows\System\vRXKgrZ.exe

C:\Windows\System\SqtoThL.exe

C:\Windows\System\SqtoThL.exe

C:\Windows\System\VcraneP.exe

C:\Windows\System\VcraneP.exe

C:\Windows\System\iZsxUSb.exe

C:\Windows\System\iZsxUSb.exe

C:\Windows\System\TJHPWlJ.exe

C:\Windows\System\TJHPWlJ.exe

C:\Windows\System\JtIJhZg.exe

C:\Windows\System\JtIJhZg.exe

C:\Windows\System\tcfPwiB.exe

C:\Windows\System\tcfPwiB.exe

C:\Windows\System\SKLaXqW.exe

C:\Windows\System\SKLaXqW.exe

C:\Windows\System\VHshyHu.exe

C:\Windows\System\VHshyHu.exe

C:\Windows\System\ZIqFRJH.exe

C:\Windows\System\ZIqFRJH.exe

C:\Windows\System\HvRXVlO.exe

C:\Windows\System\HvRXVlO.exe

C:\Windows\System\NgNaLJq.exe

C:\Windows\System\NgNaLJq.exe

C:\Windows\System\HwdlTtI.exe

C:\Windows\System\HwdlTtI.exe

C:\Windows\System\OoIkshu.exe

C:\Windows\System\OoIkshu.exe

C:\Windows\System\KaZwUlb.exe

C:\Windows\System\KaZwUlb.exe

C:\Windows\System\lYSGdNJ.exe

C:\Windows\System\lYSGdNJ.exe

C:\Windows\System\RsIjYVE.exe

C:\Windows\System\RsIjYVE.exe

C:\Windows\System\CTAmKdf.exe

C:\Windows\System\CTAmKdf.exe

C:\Windows\System\NcKLROK.exe

C:\Windows\System\NcKLROK.exe

C:\Windows\System\PELxEwK.exe

C:\Windows\System\PELxEwK.exe

C:\Windows\System\vNWpRaO.exe

C:\Windows\System\vNWpRaO.exe

C:\Windows\System\KsejTEg.exe

C:\Windows\System\KsejTEg.exe

C:\Windows\System\vIoMTlU.exe

C:\Windows\System\vIoMTlU.exe

C:\Windows\System\yQiixQW.exe

C:\Windows\System\yQiixQW.exe

C:\Windows\System\Omdnsov.exe

C:\Windows\System\Omdnsov.exe

C:\Windows\System\GsejZhy.exe

C:\Windows\System\GsejZhy.exe

C:\Windows\System\QYPWJuE.exe

C:\Windows\System\QYPWJuE.exe

C:\Windows\System\zddMwxA.exe

C:\Windows\System\zddMwxA.exe

C:\Windows\System\TFzibHF.exe

C:\Windows\System\TFzibHF.exe

C:\Windows\System\Hiyktjy.exe

C:\Windows\System\Hiyktjy.exe

C:\Windows\System\RWffGWl.exe

C:\Windows\System\RWffGWl.exe

C:\Windows\System\aOsTFGh.exe

C:\Windows\System\aOsTFGh.exe

C:\Windows\System\CVQJmbK.exe

C:\Windows\System\CVQJmbK.exe

C:\Windows\System\djOzpLz.exe

C:\Windows\System\djOzpLz.exe

C:\Windows\System\lmpfQXI.exe

C:\Windows\System\lmpfQXI.exe

C:\Windows\System\SNnOVFF.exe

C:\Windows\System\SNnOVFF.exe

C:\Windows\System\QWgeWTD.exe

C:\Windows\System\QWgeWTD.exe

C:\Windows\System\VRydSrc.exe

C:\Windows\System\VRydSrc.exe

C:\Windows\System\NgtIgug.exe

C:\Windows\System\NgtIgug.exe

C:\Windows\System\lMLBuTe.exe

C:\Windows\System\lMLBuTe.exe

C:\Windows\System\nnIIbeD.exe

C:\Windows\System\nnIIbeD.exe

C:\Windows\System\aMzTpJD.exe

C:\Windows\System\aMzTpJD.exe

C:\Windows\System\wPKmZMW.exe

C:\Windows\System\wPKmZMW.exe

C:\Windows\System\BFiZQDj.exe

C:\Windows\System\BFiZQDj.exe

C:\Windows\System\wXjURxd.exe

C:\Windows\System\wXjURxd.exe

C:\Windows\System\nxjdLeN.exe

C:\Windows\System\nxjdLeN.exe

C:\Windows\System\ggUvjRZ.exe

C:\Windows\System\ggUvjRZ.exe

C:\Windows\System\kKSEQhd.exe

C:\Windows\System\kKSEQhd.exe

C:\Windows\System\ZzNDoRU.exe

C:\Windows\System\ZzNDoRU.exe

C:\Windows\System\vZMBhYB.exe

C:\Windows\System\vZMBhYB.exe

C:\Windows\System\GAUnXxD.exe

C:\Windows\System\GAUnXxD.exe

C:\Windows\System\CvHdKGo.exe

C:\Windows\System\CvHdKGo.exe

C:\Windows\System\NOWrysf.exe

C:\Windows\System\NOWrysf.exe

C:\Windows\System\NqmmUwd.exe

C:\Windows\System\NqmmUwd.exe

C:\Windows\System\DikJFDV.exe

C:\Windows\System\DikJFDV.exe

C:\Windows\System\zGkFHtc.exe

C:\Windows\System\zGkFHtc.exe

C:\Windows\System\bPfdCjp.exe

C:\Windows\System\bPfdCjp.exe

C:\Windows\System\dpRaLLO.exe

C:\Windows\System\dpRaLLO.exe

C:\Windows\System\TqCbgAm.exe

C:\Windows\System\TqCbgAm.exe

C:\Windows\System\nEkCLRf.exe

C:\Windows\System\nEkCLRf.exe

C:\Windows\System\kHvbXed.exe

C:\Windows\System\kHvbXed.exe

C:\Windows\System\YIXjtZK.exe

C:\Windows\System\YIXjtZK.exe

C:\Windows\System\XQdPCmd.exe

C:\Windows\System\XQdPCmd.exe

C:\Windows\System\SwZJuoZ.exe

C:\Windows\System\SwZJuoZ.exe

C:\Windows\System\JSOAiMp.exe

C:\Windows\System\JSOAiMp.exe

C:\Windows\System\lOajIjw.exe

C:\Windows\System\lOajIjw.exe

C:\Windows\System\inCHTUX.exe

C:\Windows\System\inCHTUX.exe

C:\Windows\System\nZLcOAv.exe

C:\Windows\System\nZLcOAv.exe

C:\Windows\System\HwRUBbN.exe

C:\Windows\System\HwRUBbN.exe

C:\Windows\System\FOklBbz.exe

C:\Windows\System\FOklBbz.exe

C:\Windows\System\xfPDPhu.exe

C:\Windows\System\xfPDPhu.exe

C:\Windows\System\BduSqaw.exe

C:\Windows\System\BduSqaw.exe

C:\Windows\System\tZdEXbM.exe

C:\Windows\System\tZdEXbM.exe

C:\Windows\System\rXAEqBw.exe

C:\Windows\System\rXAEqBw.exe

C:\Windows\System\IvavWDj.exe

C:\Windows\System\IvavWDj.exe

C:\Windows\System\wQLxNML.exe

C:\Windows\System\wQLxNML.exe

C:\Windows\System\KsEMvvt.exe

C:\Windows\System\KsEMvvt.exe

C:\Windows\System\VkzzEdj.exe

C:\Windows\System\VkzzEdj.exe

C:\Windows\System\ZwPvLvC.exe

C:\Windows\System\ZwPvLvC.exe

C:\Windows\System\pwXBBuN.exe

C:\Windows\System\pwXBBuN.exe

C:\Windows\System\bDXzQeA.exe

C:\Windows\System\bDXzQeA.exe

C:\Windows\System\YTkcxXt.exe

C:\Windows\System\YTkcxXt.exe

C:\Windows\System\xCkDGLs.exe

C:\Windows\System\xCkDGLs.exe

C:\Windows\System\gDLeieN.exe

C:\Windows\System\gDLeieN.exe

C:\Windows\System\FSKepOS.exe

C:\Windows\System\FSKepOS.exe

C:\Windows\System\mITAGoG.exe

C:\Windows\System\mITAGoG.exe

C:\Windows\System\GobioiH.exe

C:\Windows\System\GobioiH.exe

C:\Windows\System\nYOLfCg.exe

C:\Windows\System\nYOLfCg.exe

C:\Windows\System\LwwKJrQ.exe

C:\Windows\System\LwwKJrQ.exe

C:\Windows\System\kvUBpqW.exe

C:\Windows\System\kvUBpqW.exe

C:\Windows\System\HOyXbrH.exe

C:\Windows\System\HOyXbrH.exe

C:\Windows\System\VfLEgmk.exe

C:\Windows\System\VfLEgmk.exe

C:\Windows\System\RgPXVJQ.exe

C:\Windows\System\RgPXVJQ.exe

C:\Windows\System\YyzFxXk.exe

C:\Windows\System\YyzFxXk.exe

C:\Windows\System\jQoCipG.exe

C:\Windows\System\jQoCipG.exe

C:\Windows\System\pNlwIkS.exe

C:\Windows\System\pNlwIkS.exe

C:\Windows\System\LUzBgwv.exe

C:\Windows\System\LUzBgwv.exe

C:\Windows\System\sETBQSh.exe

C:\Windows\System\sETBQSh.exe

C:\Windows\System\ypQTVlF.exe

C:\Windows\System\ypQTVlF.exe

C:\Windows\System\hMWWInp.exe

C:\Windows\System\hMWWInp.exe

C:\Windows\System\yEgSIHS.exe

C:\Windows\System\yEgSIHS.exe

C:\Windows\System\sFWOGUo.exe

C:\Windows\System\sFWOGUo.exe

C:\Windows\System\hQGwViH.exe

C:\Windows\System\hQGwViH.exe

C:\Windows\System\gfzMqQq.exe

C:\Windows\System\gfzMqQq.exe

C:\Windows\System\IWObuPD.exe

C:\Windows\System\IWObuPD.exe

C:\Windows\System\eRYPdtc.exe

C:\Windows\System\eRYPdtc.exe

C:\Windows\System\PleqBtf.exe

C:\Windows\System\PleqBtf.exe

C:\Windows\System\hGSbIAf.exe

C:\Windows\System\hGSbIAf.exe

C:\Windows\System\zXYpaAb.exe

C:\Windows\System\zXYpaAb.exe

C:\Windows\System\XaJqtkx.exe

C:\Windows\System\XaJqtkx.exe

C:\Windows\System\OtKXeTW.exe

C:\Windows\System\OtKXeTW.exe

C:\Windows\System\uvZCzRM.exe

C:\Windows\System\uvZCzRM.exe

C:\Windows\System\vBkNNmA.exe

C:\Windows\System\vBkNNmA.exe

C:\Windows\System\towNIOV.exe

C:\Windows\System\towNIOV.exe

C:\Windows\System\qifgOjC.exe

C:\Windows\System\qifgOjC.exe

C:\Windows\System\mwDnoTs.exe

C:\Windows\System\mwDnoTs.exe

C:\Windows\System\ARtZBnb.exe

C:\Windows\System\ARtZBnb.exe

C:\Windows\System\xZvdYYY.exe

C:\Windows\System\xZvdYYY.exe

C:\Windows\System\sLtKYZH.exe

C:\Windows\System\sLtKYZH.exe

C:\Windows\System\nGhgKoD.exe

C:\Windows\System\nGhgKoD.exe

C:\Windows\System\iWMuFJp.exe

C:\Windows\System\iWMuFJp.exe

C:\Windows\System\ViWMHvK.exe

C:\Windows\System\ViWMHvK.exe

C:\Windows\System\ACcwJjA.exe

C:\Windows\System\ACcwJjA.exe

C:\Windows\System\WnQRGUp.exe

C:\Windows\System\WnQRGUp.exe

C:\Windows\System\PdzGiNy.exe

C:\Windows\System\PdzGiNy.exe

C:\Windows\System\GYufTfH.exe

C:\Windows\System\GYufTfH.exe

C:\Windows\System\MxtjeoL.exe

C:\Windows\System\MxtjeoL.exe

C:\Windows\System\YxluHsa.exe

C:\Windows\System\YxluHsa.exe

C:\Windows\System\RgDZMFv.exe

C:\Windows\System\RgDZMFv.exe

C:\Windows\System\gTnsDbM.exe

C:\Windows\System\gTnsDbM.exe

C:\Windows\System\TeepFHj.exe

C:\Windows\System\TeepFHj.exe

C:\Windows\System\lHmupjo.exe

C:\Windows\System\lHmupjo.exe

C:\Windows\System\qcoNeWA.exe

C:\Windows\System\qcoNeWA.exe

C:\Windows\System\bVgDxoA.exe

C:\Windows\System\bVgDxoA.exe

C:\Windows\System\zYRXurE.exe

C:\Windows\System\zYRXurE.exe

C:\Windows\System\lPKDnwh.exe

C:\Windows\System\lPKDnwh.exe

C:\Windows\System\rlVvgCi.exe

C:\Windows\System\rlVvgCi.exe

C:\Windows\System\ZaHQGvN.exe

C:\Windows\System\ZaHQGvN.exe

C:\Windows\System\xOMPmDc.exe

C:\Windows\System\xOMPmDc.exe

C:\Windows\System\deRHLnq.exe

C:\Windows\System\deRHLnq.exe

C:\Windows\System\SUNHVzS.exe

C:\Windows\System\SUNHVzS.exe

C:\Windows\System\SuqIZJW.exe

C:\Windows\System\SuqIZJW.exe

C:\Windows\System\mTtBSMX.exe

C:\Windows\System\mTtBSMX.exe

C:\Windows\System\AHhgsJD.exe

C:\Windows\System\AHhgsJD.exe

C:\Windows\System\MfCllGM.exe

C:\Windows\System\MfCllGM.exe

C:\Windows\System\mKVOumP.exe

C:\Windows\System\mKVOumP.exe

C:\Windows\System\dQrfOlp.exe

C:\Windows\System\dQrfOlp.exe

C:\Windows\System\DPuFbHJ.exe

C:\Windows\System\DPuFbHJ.exe

C:\Windows\System\zPUdCIi.exe

C:\Windows\System\zPUdCIi.exe

C:\Windows\System\RxgoxYa.exe

C:\Windows\System\RxgoxYa.exe

C:\Windows\System\YepSxKQ.exe

C:\Windows\System\YepSxKQ.exe

C:\Windows\System\QvoEsWZ.exe

C:\Windows\System\QvoEsWZ.exe

C:\Windows\System\rYizCLn.exe

C:\Windows\System\rYizCLn.exe

C:\Windows\System\XNEgQdh.exe

C:\Windows\System\XNEgQdh.exe

C:\Windows\System\GfLxjNw.exe

C:\Windows\System\GfLxjNw.exe

C:\Windows\System\OeoOQrl.exe

C:\Windows\System\OeoOQrl.exe

C:\Windows\System\cHDhpJK.exe

C:\Windows\System\cHDhpJK.exe

C:\Windows\System\HzARGgP.exe

C:\Windows\System\HzARGgP.exe

C:\Windows\System\ORtrWvo.exe

C:\Windows\System\ORtrWvo.exe

C:\Windows\System\ZovrZMz.exe

C:\Windows\System\ZovrZMz.exe

C:\Windows\System\bJEveRt.exe

C:\Windows\System\bJEveRt.exe

C:\Windows\System\nkqfsaz.exe

C:\Windows\System\nkqfsaz.exe

C:\Windows\System\cvVTlhW.exe

C:\Windows\System\cvVTlhW.exe

C:\Windows\System\HRYBSZn.exe

C:\Windows\System\HRYBSZn.exe

C:\Windows\System\cFicclh.exe

C:\Windows\System\cFicclh.exe

C:\Windows\System\CyldOpl.exe

C:\Windows\System\CyldOpl.exe

C:\Windows\System\wqKrCms.exe

C:\Windows\System\wqKrCms.exe

C:\Windows\System\IVvLMfp.exe

C:\Windows\System\IVvLMfp.exe

C:\Windows\System\HXYBloU.exe

C:\Windows\System\HXYBloU.exe

C:\Windows\System\XCdjEOg.exe

C:\Windows\System\XCdjEOg.exe

C:\Windows\System\WuGvccn.exe

C:\Windows\System\WuGvccn.exe

C:\Windows\System\XFVIVNw.exe

C:\Windows\System\XFVIVNw.exe

C:\Windows\System\fLhbFRZ.exe

C:\Windows\System\fLhbFRZ.exe

C:\Windows\System\CIRbkuj.exe

C:\Windows\System\CIRbkuj.exe

C:\Windows\System\WDfvBAT.exe

C:\Windows\System\WDfvBAT.exe

C:\Windows\System\jYSKMLy.exe

C:\Windows\System\jYSKMLy.exe

C:\Windows\System\uNixxCx.exe

C:\Windows\System\uNixxCx.exe

C:\Windows\System\LMOCyKE.exe

C:\Windows\System\LMOCyKE.exe

C:\Windows\System\eHrzTmh.exe

C:\Windows\System\eHrzTmh.exe

C:\Windows\System\YbWQJAR.exe

C:\Windows\System\YbWQJAR.exe

C:\Windows\System\YspPpbf.exe

C:\Windows\System\YspPpbf.exe

C:\Windows\System\zsvXrEw.exe

C:\Windows\System\zsvXrEw.exe

C:\Windows\System\CmgROjO.exe

C:\Windows\System\CmgROjO.exe

C:\Windows\System\UNXzsMe.exe

C:\Windows\System\UNXzsMe.exe

C:\Windows\System\XqLnAem.exe

C:\Windows\System\XqLnAem.exe

C:\Windows\System\BKkEIQN.exe

C:\Windows\System\BKkEIQN.exe

C:\Windows\System\NRPWchJ.exe

C:\Windows\System\NRPWchJ.exe

C:\Windows\System\oPyfEHl.exe

C:\Windows\System\oPyfEHl.exe

C:\Windows\System\ZEDealx.exe

C:\Windows\System\ZEDealx.exe

C:\Windows\System\qKAuFFU.exe

C:\Windows\System\qKAuFFU.exe

C:\Windows\System\qwZSGiR.exe

C:\Windows\System\qwZSGiR.exe

C:\Windows\System\FiehDLf.exe

C:\Windows\System\FiehDLf.exe

C:\Windows\System\vksZlaB.exe

C:\Windows\System\vksZlaB.exe

C:\Windows\System\LjyMJsv.exe

C:\Windows\System\LjyMJsv.exe

C:\Windows\System\glwUmTF.exe

C:\Windows\System\glwUmTF.exe

C:\Windows\System\KmcSHsK.exe

C:\Windows\System\KmcSHsK.exe

C:\Windows\System\WmBvBSy.exe

C:\Windows\System\WmBvBSy.exe

C:\Windows\System\IBHEZAZ.exe

C:\Windows\System\IBHEZAZ.exe

C:\Windows\System\jCPYBUY.exe

C:\Windows\System\jCPYBUY.exe

C:\Windows\System\RNzgCcN.exe

C:\Windows\System\RNzgCcN.exe

C:\Windows\System\bnEEiJa.exe

C:\Windows\System\bnEEiJa.exe

C:\Windows\System\rAzFUbR.exe

C:\Windows\System\rAzFUbR.exe

C:\Windows\System\qxzosgs.exe

C:\Windows\System\qxzosgs.exe

C:\Windows\System\VmZvRaa.exe

C:\Windows\System\VmZvRaa.exe

C:\Windows\System\mTAguhx.exe

C:\Windows\System\mTAguhx.exe

C:\Windows\System\GRYnVVO.exe

C:\Windows\System\GRYnVVO.exe

C:\Windows\System\xVBZttd.exe

C:\Windows\System\xVBZttd.exe

C:\Windows\System\YmIEsKQ.exe

C:\Windows\System\YmIEsKQ.exe

C:\Windows\System\CmUCeBK.exe

C:\Windows\System\CmUCeBK.exe

C:\Windows\System\AxbZprc.exe

C:\Windows\System\AxbZprc.exe

C:\Windows\System\GJIwBdO.exe

C:\Windows\System\GJIwBdO.exe

C:\Windows\System\tkljdUa.exe

C:\Windows\System\tkljdUa.exe

C:\Windows\System\hMmcGHZ.exe

C:\Windows\System\hMmcGHZ.exe

C:\Windows\System\SXArRvX.exe

C:\Windows\System\SXArRvX.exe

C:\Windows\System\PaewdlG.exe

C:\Windows\System\PaewdlG.exe

C:\Windows\System\wqGdjPZ.exe

C:\Windows\System\wqGdjPZ.exe

C:\Windows\System\pFXzHOf.exe

C:\Windows\System\pFXzHOf.exe

C:\Windows\System\FMlcwVk.exe

C:\Windows\System\FMlcwVk.exe

C:\Windows\System\lEkvthp.exe

C:\Windows\System\lEkvthp.exe

C:\Windows\System\BAwnUPP.exe

C:\Windows\System\BAwnUPP.exe

C:\Windows\System\vNkDGyf.exe

C:\Windows\System\vNkDGyf.exe

C:\Windows\System\ohLjGDT.exe

C:\Windows\System\ohLjGDT.exe

C:\Windows\System\MykXbVv.exe

C:\Windows\System\MykXbVv.exe

C:\Windows\System\wbzeXhI.exe

C:\Windows\System\wbzeXhI.exe

C:\Windows\System\owxknZT.exe

C:\Windows\System\owxknZT.exe

C:\Windows\System\OUNaGsk.exe

C:\Windows\System\OUNaGsk.exe

C:\Windows\System\FivgKuv.exe

C:\Windows\System\FivgKuv.exe

C:\Windows\System\fntnprN.exe

C:\Windows\System\fntnprN.exe

C:\Windows\System\mFxSeFf.exe

C:\Windows\System\mFxSeFf.exe

C:\Windows\System\FlksDtQ.exe

C:\Windows\System\FlksDtQ.exe

C:\Windows\System\iNlMfGe.exe

C:\Windows\System\iNlMfGe.exe

C:\Windows\System\QvJOgsG.exe

C:\Windows\System\QvJOgsG.exe

C:\Windows\System\ECIlhVv.exe

C:\Windows\System\ECIlhVv.exe

C:\Windows\System\bSAAxgj.exe

C:\Windows\System\bSAAxgj.exe

C:\Windows\System\dTwABQu.exe

C:\Windows\System\dTwABQu.exe

C:\Windows\System\LtaAdZv.exe

C:\Windows\System\LtaAdZv.exe

C:\Windows\System\bqQJPYi.exe

C:\Windows\System\bqQJPYi.exe

C:\Windows\System\CkUySoV.exe

C:\Windows\System\CkUySoV.exe

C:\Windows\System\cnDcQsl.exe

C:\Windows\System\cnDcQsl.exe

C:\Windows\System\JMkijnX.exe

C:\Windows\System\JMkijnX.exe

C:\Windows\System\UivXbFT.exe

C:\Windows\System\UivXbFT.exe

C:\Windows\System\dzhzKwb.exe

C:\Windows\System\dzhzKwb.exe

C:\Windows\System\XAQaejj.exe

C:\Windows\System\XAQaejj.exe

C:\Windows\System\Enkjbha.exe

C:\Windows\System\Enkjbha.exe

C:\Windows\System\kHCGwFd.exe

C:\Windows\System\kHCGwFd.exe

C:\Windows\System\HCmnqne.exe

C:\Windows\System\HCmnqne.exe

C:\Windows\System\PuDjeIT.exe

C:\Windows\System\PuDjeIT.exe

C:\Windows\System\NoGXEGD.exe

C:\Windows\System\NoGXEGD.exe

C:\Windows\System\FoZaXuR.exe

C:\Windows\System\FoZaXuR.exe

C:\Windows\System\GirMLAb.exe

C:\Windows\System\GirMLAb.exe

C:\Windows\System\iMXMGzV.exe

C:\Windows\System\iMXMGzV.exe

C:\Windows\System\wBIrONG.exe

C:\Windows\System\wBIrONG.exe

C:\Windows\System\AaJLpPw.exe

C:\Windows\System\AaJLpPw.exe

C:\Windows\System\sReYgDD.exe

C:\Windows\System\sReYgDD.exe

C:\Windows\System\XoUzHLl.exe

C:\Windows\System\XoUzHLl.exe

C:\Windows\System\zCAoVzG.exe

C:\Windows\System\zCAoVzG.exe

C:\Windows\System\MBpzAfc.exe

C:\Windows\System\MBpzAfc.exe

C:\Windows\System\bnKOcPx.exe

C:\Windows\System\bnKOcPx.exe

C:\Windows\System\OLWzhFH.exe

C:\Windows\System\OLWzhFH.exe

C:\Windows\System\VfpxqKd.exe

C:\Windows\System\VfpxqKd.exe

C:\Windows\System\SpSxXdX.exe

C:\Windows\System\SpSxXdX.exe

C:\Windows\System\CnNwGAA.exe

C:\Windows\System\CnNwGAA.exe

C:\Windows\System\NqPJASA.exe

C:\Windows\System\NqPJASA.exe

C:\Windows\System\RvSyrqZ.exe

C:\Windows\System\RvSyrqZ.exe

C:\Windows\System\lTmErEX.exe

C:\Windows\System\lTmErEX.exe

C:\Windows\System\eeJSEtT.exe

C:\Windows\System\eeJSEtT.exe

C:\Windows\System\bwoSvEH.exe

C:\Windows\System\bwoSvEH.exe

C:\Windows\System\mnJWQEv.exe

C:\Windows\System\mnJWQEv.exe

C:\Windows\System\KybkYkH.exe

C:\Windows\System\KybkYkH.exe

C:\Windows\System\DClWCVL.exe

C:\Windows\System\DClWCVL.exe

C:\Windows\System\qAlIhaI.exe

C:\Windows\System\qAlIhaI.exe

C:\Windows\System\DEIweAt.exe

C:\Windows\System\DEIweAt.exe

C:\Windows\System\vBFmTtw.exe

C:\Windows\System\vBFmTtw.exe

C:\Windows\System\SQzAKJs.exe

C:\Windows\System\SQzAKJs.exe

C:\Windows\System\KuuhVvV.exe

C:\Windows\System\KuuhVvV.exe

C:\Windows\System\AsPgDYZ.exe

C:\Windows\System\AsPgDYZ.exe

C:\Windows\System\HEaDscn.exe

C:\Windows\System\HEaDscn.exe

C:\Windows\System\BwGFEmx.exe

C:\Windows\System\BwGFEmx.exe

C:\Windows\System\FHfNPhV.exe

C:\Windows\System\FHfNPhV.exe

C:\Windows\System\dZqrwik.exe

C:\Windows\System\dZqrwik.exe

C:\Windows\System\lkPFgEE.exe

C:\Windows\System\lkPFgEE.exe

C:\Windows\System\YCWcWzl.exe

C:\Windows\System\YCWcWzl.exe

C:\Windows\System\kVLWaTk.exe

C:\Windows\System\kVLWaTk.exe

C:\Windows\System\uOLfpfi.exe

C:\Windows\System\uOLfpfi.exe

C:\Windows\System\STjyCRz.exe

C:\Windows\System\STjyCRz.exe

C:\Windows\System\vtScPDl.exe

C:\Windows\System\vtScPDl.exe

C:\Windows\System\kZfyLKM.exe

C:\Windows\System\kZfyLKM.exe

C:\Windows\System\cJExwYr.exe

C:\Windows\System\cJExwYr.exe

C:\Windows\System\vkEjuOX.exe

C:\Windows\System\vkEjuOX.exe

C:\Windows\System\lMyCfgT.exe

C:\Windows\System\lMyCfgT.exe

C:\Windows\System\jziyaNy.exe

C:\Windows\System\jziyaNy.exe

C:\Windows\System\tXifQMh.exe

C:\Windows\System\tXifQMh.exe

C:\Windows\System\ExtdXeH.exe

C:\Windows\System\ExtdXeH.exe

C:\Windows\System\DyJxHJX.exe

C:\Windows\System\DyJxHJX.exe

C:\Windows\System\VCLoApy.exe

C:\Windows\System\VCLoApy.exe

C:\Windows\System\IZIXPiT.exe

C:\Windows\System\IZIXPiT.exe

C:\Windows\System\bKQYMhO.exe

C:\Windows\System\bKQYMhO.exe

C:\Windows\System\wKImgpa.exe

C:\Windows\System\wKImgpa.exe

C:\Windows\System\kYnGYex.exe

C:\Windows\System\kYnGYex.exe

C:\Windows\System\SIMWppi.exe

C:\Windows\System\SIMWppi.exe

C:\Windows\System\iJgwCke.exe

C:\Windows\System\iJgwCke.exe

C:\Windows\System\tCLnNxh.exe

C:\Windows\System\tCLnNxh.exe

C:\Windows\System\oxbNHtB.exe

C:\Windows\System\oxbNHtB.exe

C:\Windows\System\PZTThMz.exe

C:\Windows\System\PZTThMz.exe

C:\Windows\System\wYYkQYO.exe

C:\Windows\System\wYYkQYO.exe

C:\Windows\System\sNZlQTU.exe

C:\Windows\System\sNZlQTU.exe

C:\Windows\System\zlGaspE.exe

C:\Windows\System\zlGaspE.exe

C:\Windows\System\nVRRwFl.exe

C:\Windows\System\nVRRwFl.exe

C:\Windows\System\EVtmZBH.exe

C:\Windows\System\EVtmZBH.exe

C:\Windows\System\hVAZquw.exe

C:\Windows\System\hVAZquw.exe

C:\Windows\System\CNFTJJc.exe

C:\Windows\System\CNFTJJc.exe

C:\Windows\System\uKuneCA.exe

C:\Windows\System\uKuneCA.exe

C:\Windows\System\iQzsbHg.exe

C:\Windows\System\iQzsbHg.exe

C:\Windows\System\qOnhdYc.exe

C:\Windows\System\qOnhdYc.exe

C:\Windows\System\LekDdUc.exe

C:\Windows\System\LekDdUc.exe

C:\Windows\System\awhSpjU.exe

C:\Windows\System\awhSpjU.exe

C:\Windows\System\rQxsqnt.exe

C:\Windows\System\rQxsqnt.exe

C:\Windows\System\gWCkHcL.exe

C:\Windows\System\gWCkHcL.exe

C:\Windows\System\SWLLvJq.exe

C:\Windows\System\SWLLvJq.exe

C:\Windows\System\ByHgZgV.exe

C:\Windows\System\ByHgZgV.exe

C:\Windows\System\yokQiDV.exe

C:\Windows\System\yokQiDV.exe

C:\Windows\System\yukgeUC.exe

C:\Windows\System\yukgeUC.exe

C:\Windows\System\YYaLSdc.exe

C:\Windows\System\YYaLSdc.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	raw.githubusercontent.com	udp
US	185.199.108.133:443	raw.githubusercontent.com	tcp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	github.githubassets.com	udp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	8.8.8.8:53	133.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	154.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	98.251.17.2.in-addr.arpa	udp
US	185.199.108.154:443	github.githubassets.com	tcp
US	8.8.8.8:53	134.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	31.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp

Files

memory/2184-0-0x00007FF6C0530000-0x00007FF6C0926000-memory.dmp

memory/2184-1-0x0000022CF4BD0000-0x0000022CF4BE0000-memory.dmp

C:\Windows\System\tBjIAQp.exe

MD5	9286c21c82bdaad911721d37e008c4d5
SHA1	d07ec79c2817223c0cc1e863d096f143a7189e8e
SHA256	60dc9a7cdce0f28200dbf6d443be83926c5f46d440089cddde7df600e132c220
SHA512	eb95beb1c527f86e75ddd5d4f9be475555f512316cb42070f628a3a4e6826401968b92983dee75c91b15c647a17813d3794b0f7eb2c5c3c1bbf59ace6bd03b94

memory/1660-8-0x00007FF8D8113000-0x00007FF8D8115000-memory.dmp

C:\Windows\System\QyNtRMv.exe

MD5	46d82c3a27f9017e39f9ed53bdf8e8f5
SHA1	40abd19b08fd8ae2b04385899309b2b08606ca84
SHA256	ba588d40d8c87536925ca65bef00bc5de8173dc403c86b7d6c561031c58f2f43
SHA512	2f56e346861a050e8f986db3f05c90d2bf3aa50422745412ab265d81e26e57c653c3f5758867365f70161bd5b13ab86b9296a86b3b26aa4cdc6c5be18305ccbd

C:\Windows\System\PdADvTq.exe

MD5	d5de364329d1e2e1041e396b7cb0dc5d
SHA1	d8affffdbba991156419fe1d4cc476cd15de19be
SHA256	249ef915c69ad6731dfeb7cd3cc68a5cdf0750e4e49f0482fec6c0e3bf34a76b
SHA512	3545f37b10c8de012513e526d0b306b707dce0a45fc863c570a366299e2f9de41e1f945ef08d9e54dcee0f563c57d127c27fbd92d7ad0ee57f8f7509c44dc527

C:\Windows\System\XrxSKsN.exe

MD5	95c18370bdf39c4659145639232a63a2
SHA1	0272237cd3a3279f8ab2e5db918d56a282a41cc1
SHA256	c9efb3f62f078c36cbf3050175811cf71bbfd774cb7a83f53812efba06e7767f
SHA512	61cda2418a8e21ec7491867d105930509c4883d44a3944d5d7ef6f7bd4f8ab6c0592f6ba7e380837199db7ff738a79c78153b534fe2195200673416d8fb51c10

C:\Windows\System\SBbbkcg.exe

MD5	b980ec7abb9af3f6ccda5cec31505f8f
SHA1	09fb3b0cfc505e54f811532055b82038d2f5e708
SHA256	134425db939798352930b49381d8aff03820f399cb007e4a7b83fd815cfeb670
SHA512	fc01ac975f5e05d869d262cfa729c57e3c9c2b8bec67e651b70ea20dc05f2125bd49b810fbe6a058ad10127693b8e62f43b095e0c2161708704fd4e57da763d1

C:\Windows\System\QcEZuho.exe

MD5	e5ad5ce7f3f6e3a5223a5c8a625de6c4
SHA1	eecfd1c95099b03667eb48c74e4d387c58cc809f
SHA256	b1417ed77613132941c8891a5fc8b6cd71004893b580ed392e5488ae50581f5c
SHA512	2d1a6ce625b5b6d2274f0618a0acb4c326bee3769cd1a9e21b0d94675327bfc5a68b4e8b83e2db0e7e0183f1d40ca3ba8b3e3dca42e4211e169c1d9fe5163cf0

C:\Windows\System\KJzdVPz.exe

MD5	baeab61271080c803ac3537b2939ae03
SHA1	fef77003080c99ec0b24b96fe79ffb53d3aabd00
SHA256	f261c45a70134ce72de58db6ec522ff4d6dcae2f5dce5a1afea903ff5cf58b10
SHA512	8172ec364523c53b6b3aa7effebf704ce9c724624b619b176c090a5236894846c719d6db1d39b59a8edbd90e8b99dae50a75123a3a0fa9fbd76a825bd9c2cf4f

C:\Windows\System\bHngmrz.exe

MD5	a672299c5d8d4e7964f8211cd62bf960
SHA1	8f6c2b530e25a947559cc87aa9d163920e06a07d
SHA256	43f17304a733d7cd3759549d70bb0f486bd7ad25a3ab6635032109295b97f14f
SHA512	aabe9b9667fae652264aeb533b4405de44cfcc8b985dc69c69983e1e5f85b5de0ec2e7b6c33b12d5d14fdfb9fae4ff402f0c09cc1d6eb34e17e5c9295d8ce936

C:\Windows\System\aRpXEEM.exe

MD5	2b5d078cb3376e405238e28c314f4148
SHA1	faf9e6690319bc3f4b738599cb902c991db5d495
SHA256	aa11c2d7d96a25f76139388e331a69d58c45aa903b182080fce602e34ce44029
SHA512	be6129c840f119d765f0eff8bc2145fcbd0fd0447295ab1348d349bd56381a5bf6f645d06cff9247991efa154a8a39404989c76a54478b3e214e28404be3b190

memory/2504-154-0x00007FF62D690000-0x00007FF62DA86000-memory.dmp

memory/4528-159-0x00007FF77D490000-0x00007FF77D886000-memory.dmp

memory/2396-163-0x00007FF7B81B0000-0x00007FF7B85A6000-memory.dmp

memory/3864-169-0x00007FF648BC0000-0x00007FF648FB6000-memory.dmp

memory/1376-168-0x00007FF74A000000-0x00007FF74A3F6000-memory.dmp

memory/4960-167-0x00007FF72DA70000-0x00007FF72DE66000-memory.dmp

memory/2672-166-0x00007FF66FF80000-0x00007FF670376000-memory.dmp

memory/548-165-0x00007FF633470000-0x00007FF633866000-memory.dmp

memory/1044-164-0x00007FF794160000-0x00007FF794556000-memory.dmp

memory/1424-162-0x00007FF78D910000-0x00007FF78DD06000-memory.dmp

memory/1416-161-0x00007FF6F7880000-0x00007FF6F7C76000-memory.dmp

memory/1636-160-0x00007FF65BD50000-0x00007FF65C146000-memory.dmp

memory/4700-158-0x00007FF64CB40000-0x00007FF64CF36000-memory.dmp

memory/3112-157-0x00007FF7D3130000-0x00007FF7D3526000-memory.dmp

memory/3528-156-0x00007FF71E0A0000-0x00007FF71E496000-memory.dmp

memory/844-155-0x00007FF6FC510000-0x00007FF6FC906000-memory.dmp

C:\Windows\System\jfJZnEX.exe

MD5	ac5912e92d517cf5f44bdb968d402f27
SHA1	056b82957678a326e32ca22c8f302d4a37b7174a
SHA256	926fbf8edaa0a66880bf054cbaed3ee71cd51f24387be6a8cb8e1d2d4d84696a
SHA512	1b17a21262046eb39169b9d0979b55fa670d5c0de68913bea61947ca7952e2ec5eea92ae75b45235b2d5c65b4c9c3b5c455414d86552a259731c558a17f7d355

C:\Windows\System\nYGBFAb.exe

MD5	14e192fd4210db06d0f8c41ce099028a
SHA1	24d40981f9a4e21043d2a04ae4c68626f566bfb6
SHA256	95df619c2e94d8b7ab9349b22fcd6e8e803dafc18b11e7217e2e61af71147b69
SHA512	9cc61d7115d722ce45bc7f5a77eb55c02cd8b2bb9ebf982042e291a17695ec078cce03311f9bc5123e932310155fa213ab7342bda1ba29bc2a909debf1a0480f

memory/1660-170-0x000001B580710000-0x000001B580EB6000-memory.dmp

memory/2424-149-0x00007FF649F70000-0x00007FF64A366000-memory.dmp

memory/4940-148-0x00007FF6EAD60000-0x00007FF6EB156000-memory.dmp

C:\Windows\System\yfSPcoj.exe

MD5	44ee38a933aa46e2fcf47d27033d408b
SHA1	9a142f9812a1cabeef40a0b121faf5cd9500edcd
SHA256	b76294f2393ca0e637990bdf8ed4271de8d4f9e2a5e9d097f7f2d2fac190a8e4
SHA512	b2dc5d5f445af1a0df60691d7cef3f42d67c9db53a763ceb03ec3a31a29aff6c6e2071b7358ca64b976224ef24daaecb8fecadff8577bc3ce98431c0428dfc12

memory/4896-143-0x00007FF69DF60000-0x00007FF69E356000-memory.dmp

memory/4448-142-0x00007FF697820000-0x00007FF697C16000-memory.dmp

C:\Windows\System\ODdPRta.exe

MD5	26c3ad0dea861c6ddfc322564b1c6445
SHA1	51fd91bb0b71de64f5b35302aa5031a808c0d738
SHA256	cb11060dcb64cf86ca6a795629af205aa9a4a26901871237d131c94b2fd648b7
SHA512	e8c2919b1a0144cc0bfa76d5366684128e4a9f9c36293596450984424d6c8924fff8337cacdd83c68e912a4fc2225f9f6e71a548545bc965383584ebb10784e4

C:\Windows\System\phSAoJM.exe

MD5	f8f9ae9d8fc55b9d20c212bfd0044f8a
SHA1	bd8c6de1443be4ffb49bc0eda7b7b924e2702a36
SHA256	6a1fbe13e3b8f65fe660cef8818055414b1d123bffd6caf6b10489ac2fed2009
SHA512	17d4da62aa7c065bf13fc461bdf38f1a1a2b07703f24d776d26c645f805f293dcc14a111c1f0b96400035a099bd7de481839a0cf595aadb6822da7ec62036b3b

memory/1408-133-0x00007FF657DB0000-0x00007FF6581A6000-memory.dmp

C:\Windows\System\txgJMQi.exe

MD5	eaca50bd8d4ab4602623b793545af083
SHA1	a7cb8e62b4c2f7e8884ff6a0d8524dd227d47253
SHA256	66e452b2c2a643bb174e21942992ca2326ed96ad0006d10ebcf1b2ce9363d2b2
SHA512	8f7276a005b08cfcbe72e9addf1608f86408a54b14afcf88852d35c1cceb91c9b25447ea3dee99bce4416248aef141a3fd8e7fbef700f140520430221ade43fd

C:\Windows\System\PtlRDrg.exe

MD5	fc61cf13f63e52be51650b5b56578f7a
SHA1	42c1a53101cd712d56946f717176b6e60c8cf49f
SHA256	2117143b7d7b82cd7b3e7d9572af3c825167a4fc326bd759c502e6df15ee9a00
SHA512	fdec3580bf94ff72599f8d165db7d63e030963085eb7e9355e10bb9e9ed8d88c5ffca449364bf183e31343b542224a8ff00fc750aa335767d70afacb7816a2dc

memory/2932-121-0x00007FF7F2310000-0x00007FF7F2706000-memory.dmp

C:\Windows\System\ugCYDOP.exe

MD5	145724c0563e3633fedba1a4699999e3
SHA1	ceabafaa2acdd5364b61c172f8115a05bc3e3f77
SHA256	d309f53dae9fd3a720e0a5bc410d652f4fbc2231345dec986f05ec0c27e4ea74
SHA512	eaae64cfe30addede99bb79b65b95ff30da2f3033772ab1aa70a5e94703d76b0875a84338d5d324085a8542fb8bfbace92b044543e8a45e2f3f876a104164b44

C:\Windows\System\PqedBgv.exe

MD5	a72c59f8a35323e90e626962099a0fed
SHA1	8ff97c6a6be661c996ee96e5a45e84c530d4f9f8
SHA256	b022b76517fe7bbfe848a53ab8fb32a50fcba4dc93535e37164f15f2f5b9362b
SHA512	111d43ec69ae3b1a87d242bc88b0d95c75ec7e7474072cf487a95adda45ee3d18d2d6fe1c69106134ac7bed27416c21699418f28724f545680ec58df560db31c

C:\Windows\System\MONYLqb.exe

MD5	f8c7397bc6a24552e1356caa6cef8f82
SHA1	796d9934ddb4d18f0c0ec0bae59c2fce275ae44a
SHA256	b3daa3e23a6fb79f6a2c686f9bb7f933bdaf615f9729e05b0f37b18a2d3e82ff
SHA512	ee865f934a7b79255159fdc681d7819e17638d93b43bec6a487ebd0a6cf91834bbb93e9e573f63687b36cd6bb65f321841fdba8b3a97eaed27f3ebd6d79bac62

C:\Windows\System\dcTxima.exe

MD5	869b3995d619c8483ebcbeea54ecb4c2
SHA1	ea5daa9e7c3a039f6be31a83946ea67498ac6955
SHA256	95f5660192c2a8c059a69e3ad541175ba79b00f1aeec87224d6b4f4a96490b94
SHA512	364b93863d3e56effb433d4c114bfbeed88c6be0b8438c9e1bdeded3a038cc74998059591b8c28320ecdfef6d926abf2fe07c5b5a1e4ce23f00f1cb286287083

memory/1660-104-0x000001B57FCB0000-0x000001B57FCD2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cunsrikb.vwu.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Windows\System\IgykWye.exe

MD5	5e1839f589738bec5d2c4214d53b329e
SHA1	205a0c9f9a0a17960ca24a69364d0708821ef08e
SHA256	95ce832ae0a53f562694596c5b87941f4b5b4088c34645e3528138848d190584
SHA512	bfb016e59f55f89021f86243a4e22f91f6676de9bb9eb256ce2790f3e99f9f45790e162fe1d3a4e3f85a63e4552a8c3c44a6fef2b801c0b858370e21a450c26c

memory/4768-90-0x00007FF705290000-0x00007FF705686000-memory.dmp

C:\Windows\System\DuvLiZJ.exe

MD5	90de253416ad346637dba2819bc4d6cf
SHA1	c5d7c15d925facf05b8077f30197dc96c42b202e
SHA256	0d6a31d53077a0c04dd557e55aef361db16a5932308b1f799f0a5bb40163fc50
SHA512	8efffed40155b8944d56e2b2b363b687a25ee0768bdf08e0806bbe81c91fa5d5b65814442190701513d281b7931bfe69f3011f0002cab5035faaa3b8abee6421

memory/1660-84-0x00007FF8D8110000-0x00007FF8D8BD1000-memory.dmp

C:\Windows\System\HBepVax.exe

MD5	f169b3b24d3c41fc5916a9233c2f781c
SHA1	e038a95ac0c08bfabc223db93bf15c93f15578ba
SHA256	5e6a1c02bf69cc3c18639b8b140424422c2c4f150022c047bfc3bf6dc0f6984c
SHA512	03d82652b81a41ef4aadc4165ce6f4eba6223965b607243925cd3fac820e9622a3169ad6ffba2b6650a6258cc8f36fea8892b1e1e2264a1ff4ca1baed13e6edd

C:\Windows\System\UprvtgW.exe

MD5	d6b6339f7cc5a36be4a1a526b2e0a1b8
SHA1	8f447a28252fe0622fd2d906d1b4cef1a7794ad5
SHA256	93619e3ee1d9cbef303d3d81f750bdbe2bdf00aea9fd6b1e50fb2a8cf35497b1
SHA512	85d7d68c5ed84a3416b6aa88a2cc485f5345142b1e00b0a9a1bee0cc2188e14700476cf29ebdf819dcd96809ca65e98b5b5bff57144e6b5ad826bccc899b1ea0

memory/4236-55-0x00007FF762E70000-0x00007FF763266000-memory.dmp

C:\Windows\System\HSZgXgn.exe

MD5	7bfe8f71af028587f3eb870f5f2142fd
SHA1	a67991077bf5576dfc54c2a840d59aeea839a5e7
SHA256	2332de76a0db342fad2dbb36a62e4cb5f4227255ab786f1fe597c400e6409884
SHA512	3cb1b21f4b37c19d9b788c9e1d9e0f27d6bea247a4714f15816288dc1a79ac8c0f73f919074f5fd2415f9c9edda32b363b4e80211ae4c7dd1b21421f1265bf05

memory/1660-37-0x00007FF8D8110000-0x00007FF8D8BD1000-memory.dmp

C:\Windows\System\moTRBrd.exe

MD5	597876075d3fd7c17e771d266afb0028
SHA1	2ac276eefd577dbee87fafcce987eca129a8f0e2
SHA256	7c89739cd9c3a93cf2bf093f3265c631e9efee7b1dc5c8aac929c4420675269c
SHA512	71446435ddd8da69e96223082bd3c8d328ac1d38a0cff3872a55c6f40ffbfe2bb17bde8dbb80ee4a1eba527875e3a993ad64f0c1b1aafb577d13ae2534c717b3

C:\Windows\System\mNlCeQc.exe

MD5	9601c9d010523d52eb4efae9c557b0aa
SHA1	cc777c354ecc30257f564b556754ffb5be484c30
SHA256	26c48ecfc1af4d580789adc2f342cc594f11e9d07583edd03eb669481b7a294e
SHA512	174db50bc7fba2c2624fe81eda60f304dafeff418b6481909e21e5043b00432a1bc2b78e158b6e67c70314a21066424d5c774c56504e8c040deea75531304f84

C:\Windows\System\xAsyqic.exe

MD5	b6caad55f07c7e68b504911f1b81418f
SHA1	547524d043863d0939b007c5a416c3b16dd309d4
SHA256	1b87182c9e92dec9b58ba73c97326343d59e5be7fbaa0ef06bc9e730f5752c68
SHA512	123ab1670ae95ae619117d0ac7f78c1feda619958109a49b1c6d434e561db61830f94f810b8e660beb9b5493657230b9f63086c4e3b93b77388fd557f462447d

C:\Windows\System\OfAwiEP.exe

MD5	3d48a6cd3d5690c284d5ca34b38b9d30
SHA1	d4d7934aaf230f8723acac3e3fc1ad38edd90759
SHA256	4584958d33f5c0728f22bc90aceb7fdce5f3dd674075a9dc166784a934bfc278
SHA512	12538f5768091090b6def983b65a83917008d7585894da83c8f38f03712c1a661bbb64d29c0f53f2c30f9b03465d8af604dd4b45f705a3166f8f9b15eba3e2df

C:\Windows\System\RgRFevl.exe

MD5	95d4f259677f26d0c1a80a4618c323f4
SHA1	6ce04a7d9949f09035431435829da84be05b5a52
SHA256	2af258580a2273e6369338297d0129a2fa789e85dced1442bf6cfbd5731309d1
SHA512	be11d369d3f4db00818e89990e12901d4a852029de3c7b00aa01b184332bb89b8e0fb8664f8b27b24139a3d3c1d76c874c12a024c64bc17467222e4f304c7ccd

C:\Windows\System\ixMJZFw.exe

MD5	246a82bcd96c656f8c5ad3e1d96bbded
SHA1	71392ba337bd59504e764bc08444df4a12c63b51
SHA256	3fb11d8ebaf55c4ab019d17ae0131a5aef93006a97465acfb891dfba18c3baa4
SHA512	3f3e1c545a57a8e352ac5681281c52910bbf44a1c835f1634457e7aa41081aaf0177738a2157937051029f426dd242086fdc3e1a0f16185cebb7faef1571a422

C:\Windows\System\wvsBeWH.exe

MD5	843f1d43c4175b3b6dd360b770dcb61d
SHA1	25b67d0ed592d288dfd3d9fd1ba1bc1832ffc196
SHA256	8df05f1dbb089d7db126b9266cb9c9abb7a7eff8236920899f2474b7a859f8cd
SHA512	87b939efa98be201e17a1d827ec2331552df6b08d2e0e2c61aa0942b04ecb9aa03cfce256a595e8f4b455749f029049c5038a49af07c1839aed48e21f821a90b

memory/1660-2038-0x00007FF8D8110000-0x00007FF8D8BD1000-memory.dmp

memory/1660-2039-0x00007FF8D8113000-0x00007FF8D8115000-memory.dmp

memory/1044-2040-0x00007FF794160000-0x00007FF794556000-memory.dmp

memory/548-2041-0x00007FF633470000-0x00007FF633866000-memory.dmp

memory/4768-2042-0x00007FF705290000-0x00007FF705686000-memory.dmp

memory/4236-2043-0x00007FF762E70000-0x00007FF763266000-memory.dmp

memory/2932-2044-0x00007FF7F2310000-0x00007FF7F2706000-memory.dmp

memory/1408-2049-0x00007FF657DB0000-0x00007FF6581A6000-memory.dmp

memory/2672-2048-0x00007FF66FF80000-0x00007FF670376000-memory.dmp

memory/4960-2050-0x00007FF72DA70000-0x00007FF72DE66000-memory.dmp

memory/2504-2047-0x00007FF62D690000-0x00007FF62DA86000-memory.dmp

memory/4448-2046-0x00007FF697820000-0x00007FF697C16000-memory.dmp

memory/4896-2045-0x00007FF69DF60000-0x00007FF69E356000-memory.dmp

memory/4700-2051-0x00007FF64CB40000-0x00007FF64CF36000-memory.dmp

memory/4940-2053-0x00007FF6EAD60000-0x00007FF6EB156000-memory.dmp

memory/2424-2057-0x00007FF649F70000-0x00007FF64A366000-memory.dmp

memory/4528-2058-0x00007FF77D490000-0x00007FF77D886000-memory.dmp

memory/844-2056-0x00007FF6FC510000-0x00007FF6FC906000-memory.dmp

memory/3528-2055-0x00007FF71E0A0000-0x00007FF71E496000-memory.dmp

memory/1376-2054-0x00007FF74A000000-0x00007FF74A3F6000-memory.dmp

memory/3112-2052-0x00007FF7D3130000-0x00007FF7D3526000-memory.dmp

memory/2396-2062-0x00007FF7B81B0000-0x00007FF7B85A6000-memory.dmp

memory/3864-2061-0x00007FF648BC0000-0x00007FF648FB6000-memory.dmp

memory/1416-2060-0x00007FF6F7880000-0x00007FF6F7C76000-memory.dmp

memory/1636-2059-0x00007FF65BD50000-0x00007FF65C146000-memory.dmp

memory/1424-2063-0x00007FF78D910000-0x00007FF78DD06000-memory.dmp

Sample ID	240613-2a2hbawfpm
Target	8bdbd2f1a49b0c101a8e8230ff4ab930_NeikiAnalytics.exe
SHA256	dc901bd4989483f6d9efefe8e0145f3cf5fb7cbc3532c92ca0ca3a1f3401e289
Tags	miner upx xmrig execution

Malware Analysis Report

2024-07-28 21:35

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files