Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\LbPEzHD.exe	N/A
N/A	N/A	C:\Windows\System\CowsqlJ.exe	N/A
N/A	N/A	C:\Windows\System\nNXlfcM.exe	N/A
N/A	N/A	C:\Windows\System\DSaqwKz.exe	N/A
N/A	N/A	C:\Windows\System\KdYZdTh.exe	N/A
N/A	N/A	C:\Windows\System\qAqwbLB.exe	N/A
N/A	N/A	C:\Windows\System\ZruFqUX.exe	N/A
N/A	N/A	C:\Windows\System\iDPPkMn.exe	N/A
N/A	N/A	C:\Windows\System\JmvYOeD.exe	N/A
N/A	N/A	C:\Windows\System\xQVuKEc.exe	N/A
N/A	N/A	C:\Windows\System\DTOEncV.exe	N/A
N/A	N/A	C:\Windows\System\YVPXILi.exe	N/A
N/A	N/A	C:\Windows\System\hfUHvQp.exe	N/A
N/A	N/A	C:\Windows\System\odXcUpX.exe	N/A
N/A	N/A	C:\Windows\System\hcujssD.exe	N/A
N/A	N/A	C:\Windows\System\LytIgOn.exe	N/A
N/A	N/A	C:\Windows\System\HAhfRkW.exe	N/A
N/A	N/A	C:\Windows\System\nbZAueb.exe	N/A
N/A	N/A	C:\Windows\System\LJpdZiv.exe	N/A
N/A	N/A	C:\Windows\System\FMeazxQ.exe	N/A
N/A	N/A	C:\Windows\System\jQoDnMS.exe	N/A
N/A	N/A	C:\Windows\System\xcJoHwC.exe	N/A
N/A	N/A	C:\Windows\System\gPcVOsC.exe	N/A
N/A	N/A	C:\Windows\System\ItbeNxn.exe	N/A
N/A	N/A	C:\Windows\System\mBKdwTk.exe	N/A
N/A	N/A	C:\Windows\System\uoSDMuk.exe	N/A
N/A	N/A	C:\Windows\System\yWEsdxT.exe	N/A
N/A	N/A	C:\Windows\System\aZZJMDU.exe	N/A
N/A	N/A	C:\Windows\System\AIjfbDY.exe	N/A
N/A	N/A	C:\Windows\System\suzIeRh.exe	N/A
N/A	N/A	C:\Windows\System\LFoCBhU.exe	N/A
N/A	N/A	C:\Windows\System\Khodcis.exe	N/A
N/A	N/A	C:\Windows\System\ArrlLEM.exe	N/A
N/A	N/A	C:\Windows\System\VWRJdAR.exe	N/A
N/A	N/A	C:\Windows\System\kOBkUhM.exe	N/A
N/A	N/A	C:\Windows\System\TEpxyoz.exe	N/A
N/A	N/A	C:\Windows\System\zUsXaia.exe	N/A
N/A	N/A	C:\Windows\System\KAaRbQr.exe	N/A
N/A	N/A	C:\Windows\System\jpWiktU.exe	N/A
N/A	N/A	C:\Windows\System\cFZQaIj.exe	N/A
N/A	N/A	C:\Windows\System\FVtHQtW.exe	N/A
N/A	N/A	C:\Windows\System\WAfnUWZ.exe	N/A
N/A	N/A	C:\Windows\System\VgzNHqZ.exe	N/A
N/A	N/A	C:\Windows\System\fGeStqM.exe	N/A
N/A	N/A	C:\Windows\System\aTVYosE.exe	N/A
N/A	N/A	C:\Windows\System\KqQzgHO.exe	N/A
N/A	N/A	C:\Windows\System\JLPsIVR.exe	N/A
N/A	N/A	C:\Windows\System\KkxaMTf.exe	N/A
N/A	N/A	C:\Windows\System\LSfslBV.exe	N/A
N/A	N/A	C:\Windows\System\SUWjjqu.exe	N/A
N/A	N/A	C:\Windows\System\MHXzjUn.exe	N/A
N/A	N/A	C:\Windows\System\jeJtvKz.exe	N/A
N/A	N/A	C:\Windows\System\bAYJgWD.exe	N/A
N/A	N/A	C:\Windows\System\DXIHrEm.exe	N/A
N/A	N/A	C:\Windows\System\mfAjDrg.exe	N/A
N/A	N/A	C:\Windows\System\iFHpSoZ.exe	N/A
N/A	N/A	C:\Windows\System\JzVJQud.exe	N/A
N/A	N/A	C:\Windows\System\fiIvyla.exe	N/A
N/A	N/A	C:\Windows\System\SbXVJkP.exe	N/A
N/A	N/A	C:\Windows\System\AhRUyYt.exe	N/A
N/A	N/A	C:\Windows\System\AoLtDVA.exe	N/A
N/A	N/A	C:\Windows\System\NQAVyre.exe	N/A
N/A	N/A	C:\Windows\System\siXCNdf.exe	N/A
N/A	N/A	C:\Windows\System\VuBBUOI.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\WRFDjjp.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QljUzPo.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dKSdtUN.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yKekzMY.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\utARyGT.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YklErpZ.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\babWNtm.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rIvUvSW.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZzXKnQb.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NfSjJEB.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xUIHafm.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZHpeSGd.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xbhoxKR.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\brXXDeF.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FuZHEaA.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vYglAfT.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\msrKSmp.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XkDBMAY.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vqHLBmE.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DuToYbQ.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZBUhCUI.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tKbYaEH.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZJwyCyb.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kgHtLDk.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WbjlHmn.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ELMglbl.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XMKuozX.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fXZFhYR.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LmGaQMc.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pShFXFD.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gbWXlbO.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FmxZxYO.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CvPAFPL.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PilZXlJ.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kVKOpDi.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ypUyOAf.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wzLtXmU.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SqeMpbH.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WxOdyVi.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GCmRJSU.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cqwoXeU.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jvHMASP.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OkqVFDa.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XRFOGqq.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PgfLbxv.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CdqgCpO.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hgQXBbX.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YbkXpED.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HJCnURn.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MvantxQ.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wpmQxaa.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BydhHGM.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rHaOhyi.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xrCoSzW.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CVEEVOk.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ELdScYx.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GABeRPx.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IxeHuPB.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lIRvILG.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zGGItDh.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rTWXFZw.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vnhaKbm.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FXaPsiF.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QBsvndf.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2384 wrote to memory of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2384 wrote to memory of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2384 wrote to memory of 1920	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2384 wrote to memory of 2300	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\LbPEzHD.exe
PID 2384 wrote to memory of 2300	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\LbPEzHD.exe
PID 2384 wrote to memory of 2300	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\LbPEzHD.exe
PID 2384 wrote to memory of 2956	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\CowsqlJ.exe
PID 2384 wrote to memory of 2956	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\CowsqlJ.exe
PID 2384 wrote to memory of 2956	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\CowsqlJ.exe
PID 2384 wrote to memory of 2592	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\nNXlfcM.exe
PID 2384 wrote to memory of 2592	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\nNXlfcM.exe
PID 2384 wrote to memory of 2592	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\nNXlfcM.exe
PID 2384 wrote to memory of 2484	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\DSaqwKz.exe
PID 2384 wrote to memory of 2484	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\DSaqwKz.exe
PID 2384 wrote to memory of 2484	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\DSaqwKz.exe
PID 2384 wrote to memory of 2632	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\KdYZdTh.exe
PID 2384 wrote to memory of 2632	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\KdYZdTh.exe
PID 2384 wrote to memory of 2632	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\KdYZdTh.exe
PID 2384 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\qAqwbLB.exe
PID 2384 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\qAqwbLB.exe
PID 2384 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\qAqwbLB.exe
PID 2384 wrote to memory of 2508	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\ZruFqUX.exe
PID 2384 wrote to memory of 2508	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\ZruFqUX.exe
PID 2384 wrote to memory of 2508	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\ZruFqUX.exe
PID 2384 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\iDPPkMn.exe
PID 2384 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\iDPPkMn.exe
PID 2384 wrote to memory of 3012	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\iDPPkMn.exe
PID 2384 wrote to memory of 3016	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\JmvYOeD.exe
PID 2384 wrote to memory of 3016	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\JmvYOeD.exe
PID 2384 wrote to memory of 3016	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\JmvYOeD.exe
PID 2384 wrote to memory of 2436	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\xQVuKEc.exe
PID 2384 wrote to memory of 2436	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\xQVuKEc.exe
PID 2384 wrote to memory of 2436	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\xQVuKEc.exe
PID 2384 wrote to memory of 588	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\DTOEncV.exe
PID 2384 wrote to memory of 588	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\DTOEncV.exe
PID 2384 wrote to memory of 588	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\DTOEncV.exe
PID 2384 wrote to memory of 1012	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\YVPXILi.exe
PID 2384 wrote to memory of 1012	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\YVPXILi.exe
PID 2384 wrote to memory of 1012	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\YVPXILi.exe
PID 2384 wrote to memory of 572	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\hfUHvQp.exe
PID 2384 wrote to memory of 572	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\hfUHvQp.exe
PID 2384 wrote to memory of 572	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\hfUHvQp.exe
PID 2384 wrote to memory of 2896	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\LytIgOn.exe
PID 2384 wrote to memory of 2896	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\LytIgOn.exe
PID 2384 wrote to memory of 2896	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\LytIgOn.exe
PID 2384 wrote to memory of 2876	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\odXcUpX.exe
PID 2384 wrote to memory of 2876	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\odXcUpX.exe
PID 2384 wrote to memory of 2876	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\odXcUpX.exe
PID 2384 wrote to memory of 3044	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\HAhfRkW.exe
PID 2384 wrote to memory of 3044	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\HAhfRkW.exe
PID 2384 wrote to memory of 3044	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\HAhfRkW.exe
PID 2384 wrote to memory of 2824	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\hcujssD.exe
PID 2384 wrote to memory of 2824	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\hcujssD.exe
PID 2384 wrote to memory of 2824	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\hcujssD.exe
PID 2384 wrote to memory of 2544	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\LJpdZiv.exe
PID 2384 wrote to memory of 2544	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\LJpdZiv.exe
PID 2384 wrote to memory of 2544	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\LJpdZiv.exe
PID 2384 wrote to memory of 2812	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\nbZAueb.exe
PID 2384 wrote to memory of 2812	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\nbZAueb.exe
PID 2384 wrote to memory of 2812	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\nbZAueb.exe
PID 2384 wrote to memory of 2700	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\xcJoHwC.exe
PID 2384 wrote to memory of 2700	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\xcJoHwC.exe
PID 2384 wrote to memory of 2700	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\xcJoHwC.exe
PID 2384 wrote to memory of 2844	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\FMeazxQ.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\LbPEzHD.exe

C:\Windows\System\LbPEzHD.exe

C:\Windows\System\CowsqlJ.exe

C:\Windows\System\CowsqlJ.exe

C:\Windows\System\nNXlfcM.exe

C:\Windows\System\nNXlfcM.exe

C:\Windows\System\DSaqwKz.exe

C:\Windows\System\DSaqwKz.exe

C:\Windows\System\KdYZdTh.exe

C:\Windows\System\KdYZdTh.exe

C:\Windows\System\qAqwbLB.exe

C:\Windows\System\qAqwbLB.exe

C:\Windows\System\ZruFqUX.exe

C:\Windows\System\ZruFqUX.exe

C:\Windows\System\iDPPkMn.exe

C:\Windows\System\iDPPkMn.exe

C:\Windows\System\JmvYOeD.exe

C:\Windows\System\JmvYOeD.exe

C:\Windows\System\xQVuKEc.exe

C:\Windows\System\xQVuKEc.exe

C:\Windows\System\DTOEncV.exe

C:\Windows\System\DTOEncV.exe

C:\Windows\System\YVPXILi.exe

C:\Windows\System\YVPXILi.exe

C:\Windows\System\hfUHvQp.exe

C:\Windows\System\hfUHvQp.exe

C:\Windows\System\LytIgOn.exe

C:\Windows\System\LytIgOn.exe

C:\Windows\System\odXcUpX.exe

C:\Windows\System\odXcUpX.exe

C:\Windows\System\HAhfRkW.exe

C:\Windows\System\HAhfRkW.exe

C:\Windows\System\hcujssD.exe

C:\Windows\System\hcujssD.exe

C:\Windows\System\LJpdZiv.exe

C:\Windows\System\LJpdZiv.exe

C:\Windows\System\nbZAueb.exe

C:\Windows\System\nbZAueb.exe

C:\Windows\System\xcJoHwC.exe

C:\Windows\System\xcJoHwC.exe

C:\Windows\System\FMeazxQ.exe

C:\Windows\System\FMeazxQ.exe

C:\Windows\System\yWEsdxT.exe

C:\Windows\System\yWEsdxT.exe

C:\Windows\System\jQoDnMS.exe

C:\Windows\System\jQoDnMS.exe

C:\Windows\System\Khodcis.exe

C:\Windows\System\Khodcis.exe

C:\Windows\System\gPcVOsC.exe

C:\Windows\System\gPcVOsC.exe

C:\Windows\System\kOBkUhM.exe

C:\Windows\System\kOBkUhM.exe

C:\Windows\System\ItbeNxn.exe

C:\Windows\System\ItbeNxn.exe

C:\Windows\System\jpWiktU.exe

C:\Windows\System\jpWiktU.exe

C:\Windows\System\mBKdwTk.exe

C:\Windows\System\mBKdwTk.exe

C:\Windows\System\cFZQaIj.exe

C:\Windows\System\cFZQaIj.exe

C:\Windows\System\uoSDMuk.exe

C:\Windows\System\uoSDMuk.exe

C:\Windows\System\FVtHQtW.exe

C:\Windows\System\FVtHQtW.exe

C:\Windows\System\aZZJMDU.exe

C:\Windows\System\aZZJMDU.exe

C:\Windows\System\WAfnUWZ.exe

C:\Windows\System\WAfnUWZ.exe

C:\Windows\System\AIjfbDY.exe

C:\Windows\System\AIjfbDY.exe

C:\Windows\System\VgzNHqZ.exe

C:\Windows\System\VgzNHqZ.exe

C:\Windows\System\suzIeRh.exe

C:\Windows\System\suzIeRh.exe

C:\Windows\System\fGeStqM.exe

C:\Windows\System\fGeStqM.exe

C:\Windows\System\LFoCBhU.exe

C:\Windows\System\LFoCBhU.exe

C:\Windows\System\KqQzgHO.exe

C:\Windows\System\KqQzgHO.exe

C:\Windows\System\ArrlLEM.exe

C:\Windows\System\ArrlLEM.exe

C:\Windows\System\JLPsIVR.exe

C:\Windows\System\JLPsIVR.exe

C:\Windows\System\VWRJdAR.exe

C:\Windows\System\VWRJdAR.exe

C:\Windows\System\KkxaMTf.exe

C:\Windows\System\KkxaMTf.exe

C:\Windows\System\TEpxyoz.exe

C:\Windows\System\TEpxyoz.exe

C:\Windows\System\LSfslBV.exe

C:\Windows\System\LSfslBV.exe

C:\Windows\System\zUsXaia.exe

C:\Windows\System\zUsXaia.exe

C:\Windows\System\SUWjjqu.exe

C:\Windows\System\SUWjjqu.exe

C:\Windows\System\KAaRbQr.exe

C:\Windows\System\KAaRbQr.exe

C:\Windows\System\jeJtvKz.exe

C:\Windows\System\jeJtvKz.exe

C:\Windows\System\aTVYosE.exe

C:\Windows\System\aTVYosE.exe

C:\Windows\System\bAYJgWD.exe

C:\Windows\System\bAYJgWD.exe

C:\Windows\System\MHXzjUn.exe

C:\Windows\System\MHXzjUn.exe

C:\Windows\System\NWmwUgg.exe

C:\Windows\System\NWmwUgg.exe

C:\Windows\System\DXIHrEm.exe

C:\Windows\System\DXIHrEm.exe

C:\Windows\System\QYASUEn.exe

C:\Windows\System\QYASUEn.exe

C:\Windows\System\mfAjDrg.exe

C:\Windows\System\mfAjDrg.exe

C:\Windows\System\EibRVGb.exe

C:\Windows\System\EibRVGb.exe

C:\Windows\System\iFHpSoZ.exe

C:\Windows\System\iFHpSoZ.exe

C:\Windows\System\CfzqTPJ.exe

C:\Windows\System\CfzqTPJ.exe

C:\Windows\System\JzVJQud.exe

C:\Windows\System\JzVJQud.exe

C:\Windows\System\qlkQdWI.exe

C:\Windows\System\qlkQdWI.exe

C:\Windows\System\fiIvyla.exe

C:\Windows\System\fiIvyla.exe

C:\Windows\System\MYAiWzV.exe

C:\Windows\System\MYAiWzV.exe

C:\Windows\System\SbXVJkP.exe

C:\Windows\System\SbXVJkP.exe

C:\Windows\System\EDOlUiF.exe

C:\Windows\System\EDOlUiF.exe

C:\Windows\System\AhRUyYt.exe

C:\Windows\System\AhRUyYt.exe

C:\Windows\System\VLcDpow.exe

C:\Windows\System\VLcDpow.exe

C:\Windows\System\AoLtDVA.exe

C:\Windows\System\AoLtDVA.exe

C:\Windows\System\RqyUlUI.exe

C:\Windows\System\RqyUlUI.exe

C:\Windows\System\NQAVyre.exe

C:\Windows\System\NQAVyre.exe

C:\Windows\System\YlwsNkc.exe

C:\Windows\System\YlwsNkc.exe

C:\Windows\System\siXCNdf.exe

C:\Windows\System\siXCNdf.exe

C:\Windows\System\puvbtCL.exe

C:\Windows\System\puvbtCL.exe

C:\Windows\System\VuBBUOI.exe

C:\Windows\System\VuBBUOI.exe

C:\Windows\System\kAgqOtM.exe

C:\Windows\System\kAgqOtM.exe

C:\Windows\System\QoHwQqh.exe

C:\Windows\System\QoHwQqh.exe

C:\Windows\System\kcoULYy.exe

C:\Windows\System\kcoULYy.exe

C:\Windows\System\hAPLAoB.exe

C:\Windows\System\hAPLAoB.exe

C:\Windows\System\lYZAEsy.exe

C:\Windows\System\lYZAEsy.exe

C:\Windows\System\SbrkOkl.exe

C:\Windows\System\SbrkOkl.exe

C:\Windows\System\RUFCVaF.exe

C:\Windows\System\RUFCVaF.exe

C:\Windows\System\inAlejH.exe

C:\Windows\System\inAlejH.exe

C:\Windows\System\jxhzTDQ.exe

C:\Windows\System\jxhzTDQ.exe

C:\Windows\System\rZXZaKI.exe

C:\Windows\System\rZXZaKI.exe

C:\Windows\System\TrdoLkk.exe

C:\Windows\System\TrdoLkk.exe

C:\Windows\System\GsDwwbJ.exe

C:\Windows\System\GsDwwbJ.exe

C:\Windows\System\dKYOjhW.exe

C:\Windows\System\dKYOjhW.exe

C:\Windows\System\pnuMLne.exe

C:\Windows\System\pnuMLne.exe

C:\Windows\System\dkTnGIR.exe

C:\Windows\System\dkTnGIR.exe

C:\Windows\System\UkCMpDd.exe

C:\Windows\System\UkCMpDd.exe

C:\Windows\System\aLUeHrR.exe

C:\Windows\System\aLUeHrR.exe

C:\Windows\System\KKfmgOx.exe

C:\Windows\System\KKfmgOx.exe

C:\Windows\System\wOFueap.exe

C:\Windows\System\wOFueap.exe

C:\Windows\System\dhiSUJF.exe

C:\Windows\System\dhiSUJF.exe

C:\Windows\System\CvPAFPL.exe

C:\Windows\System\CvPAFPL.exe

C:\Windows\System\HkAkhTq.exe

C:\Windows\System\HkAkhTq.exe

C:\Windows\System\SQvmhpF.exe

C:\Windows\System\SQvmhpF.exe

C:\Windows\System\gcxJzgS.exe

C:\Windows\System\gcxJzgS.exe

C:\Windows\System\JATEfBF.exe

C:\Windows\System\JATEfBF.exe

C:\Windows\System\vXoIVaD.exe

C:\Windows\System\vXoIVaD.exe

C:\Windows\System\IQpNtjm.exe

C:\Windows\System\IQpNtjm.exe

C:\Windows\System\DguKtfw.exe

C:\Windows\System\DguKtfw.exe

C:\Windows\System\bVRfFcX.exe

C:\Windows\System\bVRfFcX.exe

C:\Windows\System\VksfYVt.exe

C:\Windows\System\VksfYVt.exe

C:\Windows\System\tfiPZee.exe

C:\Windows\System\tfiPZee.exe

C:\Windows\System\wgNwjBG.exe

C:\Windows\System\wgNwjBG.exe

C:\Windows\System\SseMnAN.exe

C:\Windows\System\SseMnAN.exe

C:\Windows\System\BrHNbkU.exe

C:\Windows\System\BrHNbkU.exe

C:\Windows\System\HYSEYpt.exe

C:\Windows\System\HYSEYpt.exe

C:\Windows\System\OnaLYOf.exe

C:\Windows\System\OnaLYOf.exe

C:\Windows\System\kmnJAlA.exe

C:\Windows\System\kmnJAlA.exe

C:\Windows\System\dZMXMof.exe

C:\Windows\System\dZMXMof.exe

C:\Windows\System\wVtYvwA.exe

C:\Windows\System\wVtYvwA.exe

C:\Windows\System\MwrUsDR.exe

C:\Windows\System\MwrUsDR.exe

C:\Windows\System\CleOiFc.exe

C:\Windows\System\CleOiFc.exe

C:\Windows\System\WDRPEPF.exe

C:\Windows\System\WDRPEPF.exe

C:\Windows\System\MzcaMoQ.exe

C:\Windows\System\MzcaMoQ.exe

C:\Windows\System\SdnwlRa.exe

C:\Windows\System\SdnwlRa.exe

C:\Windows\System\lyzCnVx.exe

C:\Windows\System\lyzCnVx.exe

C:\Windows\System\PotiVkl.exe

C:\Windows\System\PotiVkl.exe

C:\Windows\System\lvvQJrO.exe

C:\Windows\System\lvvQJrO.exe

C:\Windows\System\CabcYSh.exe

C:\Windows\System\CabcYSh.exe

C:\Windows\System\UyNaAXE.exe

C:\Windows\System\UyNaAXE.exe

C:\Windows\System\LAttUST.exe

C:\Windows\System\LAttUST.exe

C:\Windows\System\KswNhSX.exe

C:\Windows\System\KswNhSX.exe

C:\Windows\System\srejZEd.exe

C:\Windows\System\srejZEd.exe

C:\Windows\System\CIDQMhz.exe

C:\Windows\System\CIDQMhz.exe

C:\Windows\System\dawRQFA.exe

C:\Windows\System\dawRQFA.exe

C:\Windows\System\UDmzYSK.exe

C:\Windows\System\UDmzYSK.exe

C:\Windows\System\alSBdSz.exe

C:\Windows\System\alSBdSz.exe

C:\Windows\System\haZbEzv.exe

C:\Windows\System\haZbEzv.exe

C:\Windows\System\IIhCsBc.exe

C:\Windows\System\IIhCsBc.exe

C:\Windows\System\onKswsF.exe

C:\Windows\System\onKswsF.exe

C:\Windows\System\RUilDDj.exe

C:\Windows\System\RUilDDj.exe

C:\Windows\System\UgQjgaQ.exe

C:\Windows\System\UgQjgaQ.exe

C:\Windows\System\lVEXCRh.exe

C:\Windows\System\lVEXCRh.exe

C:\Windows\System\aIofbua.exe

C:\Windows\System\aIofbua.exe

C:\Windows\System\BeukLic.exe

C:\Windows\System\BeukLic.exe

C:\Windows\System\nsVBucL.exe

C:\Windows\System\nsVBucL.exe

C:\Windows\System\kXZiEIa.exe

C:\Windows\System\kXZiEIa.exe

C:\Windows\System\RsHIKWT.exe

C:\Windows\System\RsHIKWT.exe

C:\Windows\System\thHFVVp.exe

C:\Windows\System\thHFVVp.exe

C:\Windows\System\gYvvTyP.exe

C:\Windows\System\gYvvTyP.exe

C:\Windows\System\DcfwyMR.exe

C:\Windows\System\DcfwyMR.exe

C:\Windows\System\hPnpBCC.exe

C:\Windows\System\hPnpBCC.exe

C:\Windows\System\jgZsFTY.exe

C:\Windows\System\jgZsFTY.exe

C:\Windows\System\DpIpHXj.exe

C:\Windows\System\DpIpHXj.exe

C:\Windows\System\WzmGhQw.exe

C:\Windows\System\WzmGhQw.exe

C:\Windows\System\MytgqcD.exe

C:\Windows\System\MytgqcD.exe

C:\Windows\System\AAuJCvZ.exe

C:\Windows\System\AAuJCvZ.exe

C:\Windows\System\xzSVlbA.exe

C:\Windows\System\xzSVlbA.exe

C:\Windows\System\JFHCNuk.exe

C:\Windows\System\JFHCNuk.exe

C:\Windows\System\MODIgtC.exe

C:\Windows\System\MODIgtC.exe

C:\Windows\System\ZsGlNcq.exe

C:\Windows\System\ZsGlNcq.exe

C:\Windows\System\nUGCMOQ.exe

C:\Windows\System\nUGCMOQ.exe

C:\Windows\System\WbjlHmn.exe

C:\Windows\System\WbjlHmn.exe

C:\Windows\System\XClnbIu.exe

C:\Windows\System\XClnbIu.exe

C:\Windows\System\nemQtwv.exe

C:\Windows\System\nemQtwv.exe

C:\Windows\System\QSrSRgr.exe

C:\Windows\System\QSrSRgr.exe

C:\Windows\System\PmvaGZT.exe

C:\Windows\System\PmvaGZT.exe

C:\Windows\System\oMSHluy.exe

C:\Windows\System\oMSHluy.exe

C:\Windows\System\wgdoVnk.exe

C:\Windows\System\wgdoVnk.exe

C:\Windows\System\vyfOEgb.exe

C:\Windows\System\vyfOEgb.exe

C:\Windows\System\DdPTXCV.exe

C:\Windows\System\DdPTXCV.exe

C:\Windows\System\Rcnjaou.exe

C:\Windows\System\Rcnjaou.exe

C:\Windows\System\KYAGbBW.exe

C:\Windows\System\KYAGbBW.exe

C:\Windows\System\aITAcwc.exe

C:\Windows\System\aITAcwc.exe

C:\Windows\System\WAkUBHc.exe

C:\Windows\System\WAkUBHc.exe

C:\Windows\System\HUMbUmz.exe

C:\Windows\System\HUMbUmz.exe

C:\Windows\System\MyvPIhs.exe

C:\Windows\System\MyvPIhs.exe

C:\Windows\System\QmTXDhO.exe

C:\Windows\System\QmTXDhO.exe

C:\Windows\System\vFnDTuY.exe

C:\Windows\System\vFnDTuY.exe

C:\Windows\System\fuhgVOz.exe

C:\Windows\System\fuhgVOz.exe

C:\Windows\System\PXkETHy.exe

C:\Windows\System\PXkETHy.exe

C:\Windows\System\MBehkTW.exe

C:\Windows\System\MBehkTW.exe

C:\Windows\System\babWNtm.exe

C:\Windows\System\babWNtm.exe

C:\Windows\System\GlyKywi.exe

C:\Windows\System\GlyKywi.exe

C:\Windows\System\DFrWLEC.exe

C:\Windows\System\DFrWLEC.exe

C:\Windows\System\gskepaa.exe

C:\Windows\System\gskepaa.exe

C:\Windows\System\yvaZgtb.exe

C:\Windows\System\yvaZgtb.exe

C:\Windows\System\WWPMWQG.exe

C:\Windows\System\WWPMWQG.exe

C:\Windows\System\cFWBTUL.exe

C:\Windows\System\cFWBTUL.exe

C:\Windows\System\AoIUVES.exe

C:\Windows\System\AoIUVES.exe

C:\Windows\System\iDTfUGg.exe

C:\Windows\System\iDTfUGg.exe

C:\Windows\System\ojYuwwR.exe

C:\Windows\System\ojYuwwR.exe

C:\Windows\System\nNFKwqx.exe

C:\Windows\System\nNFKwqx.exe

C:\Windows\System\dsLhVUE.exe

C:\Windows\System\dsLhVUE.exe

C:\Windows\System\CGUPXsl.exe

C:\Windows\System\CGUPXsl.exe

C:\Windows\System\EJlebTx.exe

C:\Windows\System\EJlebTx.exe

C:\Windows\System\LWsUFvv.exe

C:\Windows\System\LWsUFvv.exe

C:\Windows\System\JpnXGdi.exe

C:\Windows\System\JpnXGdi.exe

C:\Windows\System\TnJhsDP.exe

C:\Windows\System\TnJhsDP.exe

C:\Windows\System\wforgIO.exe

C:\Windows\System\wforgIO.exe

C:\Windows\System\WRFDjjp.exe

C:\Windows\System\WRFDjjp.exe

C:\Windows\System\VkTnfjR.exe

C:\Windows\System\VkTnfjR.exe

C:\Windows\System\FgxJDQM.exe

C:\Windows\System\FgxJDQM.exe

C:\Windows\System\erHMcKI.exe

C:\Windows\System\erHMcKI.exe

C:\Windows\System\AWdVBkC.exe

C:\Windows\System\AWdVBkC.exe

C:\Windows\System\tbeTLbd.exe

C:\Windows\System\tbeTLbd.exe

C:\Windows\System\NiAgxhS.exe

C:\Windows\System\NiAgxhS.exe

C:\Windows\System\QrHQoph.exe

C:\Windows\System\QrHQoph.exe

C:\Windows\System\mHZhlZT.exe

C:\Windows\System\mHZhlZT.exe

C:\Windows\System\tsqjKzZ.exe

C:\Windows\System\tsqjKzZ.exe

C:\Windows\System\ZecnUgD.exe

C:\Windows\System\ZecnUgD.exe

C:\Windows\System\gPjYfJW.exe

C:\Windows\System\gPjYfJW.exe

C:\Windows\System\xZjbrZn.exe

C:\Windows\System\xZjbrZn.exe

C:\Windows\System\cBgMcrz.exe

C:\Windows\System\cBgMcrz.exe

C:\Windows\System\iUkoGdv.exe

C:\Windows\System\iUkoGdv.exe

C:\Windows\System\FTsxDgw.exe

C:\Windows\System\FTsxDgw.exe

C:\Windows\System\kKVFMep.exe

C:\Windows\System\kKVFMep.exe

C:\Windows\System\rnknZEt.exe

C:\Windows\System\rnknZEt.exe

C:\Windows\System\GSAkHqg.exe

C:\Windows\System\GSAkHqg.exe

C:\Windows\System\DFqgTBZ.exe

C:\Windows\System\DFqgTBZ.exe

C:\Windows\System\SRCNNoY.exe

C:\Windows\System\SRCNNoY.exe

C:\Windows\System\GCvKfot.exe

C:\Windows\System\GCvKfot.exe

C:\Windows\System\wuZbFaI.exe

C:\Windows\System\wuZbFaI.exe

C:\Windows\System\bhZmocb.exe

C:\Windows\System\bhZmocb.exe

C:\Windows\System\DppHfgE.exe

C:\Windows\System\DppHfgE.exe

C:\Windows\System\MPAhyKG.exe

C:\Windows\System\MPAhyKG.exe

C:\Windows\System\jxlCCmB.exe

C:\Windows\System\jxlCCmB.exe

C:\Windows\System\tQCHlvk.exe

C:\Windows\System\tQCHlvk.exe

C:\Windows\System\IQGebIw.exe

C:\Windows\System\IQGebIw.exe

C:\Windows\System\kBgfAYM.exe

C:\Windows\System\kBgfAYM.exe

C:\Windows\System\zGGItDh.exe

C:\Windows\System\zGGItDh.exe

C:\Windows\System\fhzqlBH.exe

C:\Windows\System\fhzqlBH.exe

C:\Windows\System\WxOdyVi.exe

C:\Windows\System\WxOdyVi.exe

C:\Windows\System\IwHAWPr.exe

C:\Windows\System\IwHAWPr.exe

C:\Windows\System\EowCFsn.exe

C:\Windows\System\EowCFsn.exe

C:\Windows\System\EnKURSk.exe

C:\Windows\System\EnKURSk.exe

C:\Windows\System\VQzlNAq.exe

C:\Windows\System\VQzlNAq.exe

C:\Windows\System\pLkDauB.exe

C:\Windows\System\pLkDauB.exe

C:\Windows\System\inlAIpu.exe

C:\Windows\System\inlAIpu.exe

C:\Windows\System\CRUVGIE.exe

C:\Windows\System\CRUVGIE.exe

C:\Windows\System\BUIRwfS.exe

C:\Windows\System\BUIRwfS.exe

C:\Windows\System\iLkhIOp.exe

C:\Windows\System\iLkhIOp.exe

C:\Windows\System\rpuqyIx.exe

C:\Windows\System\rpuqyIx.exe

C:\Windows\System\zKMTmnH.exe

C:\Windows\System\zKMTmnH.exe

C:\Windows\System\wPSAgYH.exe

C:\Windows\System\wPSAgYH.exe

C:\Windows\System\FAPzjzt.exe

C:\Windows\System\FAPzjzt.exe

C:\Windows\System\UBqLJGL.exe

C:\Windows\System\UBqLJGL.exe

C:\Windows\System\CptdsLA.exe

C:\Windows\System\CptdsLA.exe

C:\Windows\System\zHuRZED.exe

C:\Windows\System\zHuRZED.exe

C:\Windows\System\NSuOtuL.exe

C:\Windows\System\NSuOtuL.exe

C:\Windows\System\aLYAAWF.exe

C:\Windows\System\aLYAAWF.exe

C:\Windows\System\DziJNpn.exe

C:\Windows\System\DziJNpn.exe

C:\Windows\System\hMKFLnb.exe

C:\Windows\System\hMKFLnb.exe

C:\Windows\System\Xevjnas.exe

C:\Windows\System\Xevjnas.exe

C:\Windows\System\JuBhYst.exe

C:\Windows\System\JuBhYst.exe

C:\Windows\System\QBHZCqc.exe

C:\Windows\System\QBHZCqc.exe

C:\Windows\System\qkElcdk.exe

C:\Windows\System\qkElcdk.exe

C:\Windows\System\RNRUcCq.exe

C:\Windows\System\RNRUcCq.exe

C:\Windows\System\OVBDYhb.exe

C:\Windows\System\OVBDYhb.exe

C:\Windows\System\mANyhMl.exe

C:\Windows\System\mANyhMl.exe

C:\Windows\System\ScWgFEf.exe

C:\Windows\System\ScWgFEf.exe

C:\Windows\System\lyWoPox.exe

C:\Windows\System\lyWoPox.exe

C:\Windows\System\TLeRhdR.exe

C:\Windows\System\TLeRhdR.exe

C:\Windows\System\NVgJfZj.exe

C:\Windows\System\NVgJfZj.exe

C:\Windows\System\yLSnQOz.exe

C:\Windows\System\yLSnQOz.exe

C:\Windows\System\AlFbQTY.exe

C:\Windows\System\AlFbQTY.exe

C:\Windows\System\LZTOzRF.exe

C:\Windows\System\LZTOzRF.exe

C:\Windows\System\jdUQVIh.exe

C:\Windows\System\jdUQVIh.exe

C:\Windows\System\uWbAkNL.exe

C:\Windows\System\uWbAkNL.exe

C:\Windows\System\XPKRJqu.exe

C:\Windows\System\XPKRJqu.exe

C:\Windows\System\VWpQUFE.exe

C:\Windows\System\VWpQUFE.exe

C:\Windows\System\IuoiYCY.exe

C:\Windows\System\IuoiYCY.exe

C:\Windows\System\LELjfbL.exe

C:\Windows\System\LELjfbL.exe

C:\Windows\System\WWXJAHp.exe

C:\Windows\System\WWXJAHp.exe

C:\Windows\System\keRBrWc.exe

C:\Windows\System\keRBrWc.exe

C:\Windows\System\XQiHtQP.exe

C:\Windows\System\XQiHtQP.exe

C:\Windows\System\vQXhGzH.exe

C:\Windows\System\vQXhGzH.exe

C:\Windows\System\VbGSFTk.exe

C:\Windows\System\VbGSFTk.exe

C:\Windows\System\VqtQYTr.exe

C:\Windows\System\VqtQYTr.exe

C:\Windows\System\PfCvBgu.exe

C:\Windows\System\PfCvBgu.exe

C:\Windows\System\DsCDObK.exe

C:\Windows\System\DsCDObK.exe

C:\Windows\System\KtEhDdR.exe

C:\Windows\System\KtEhDdR.exe

C:\Windows\System\ntvQwqw.exe

C:\Windows\System\ntvQwqw.exe

C:\Windows\System\mBaIQSR.exe

C:\Windows\System\mBaIQSR.exe

C:\Windows\System\HGBpZNh.exe

C:\Windows\System\HGBpZNh.exe

C:\Windows\System\YVNAQTv.exe

C:\Windows\System\YVNAQTv.exe

C:\Windows\System\KizhpvG.exe

C:\Windows\System\KizhpvG.exe

C:\Windows\System\cdiOIyw.exe

C:\Windows\System\cdiOIyw.exe

C:\Windows\System\qyKzkiG.exe

C:\Windows\System\qyKzkiG.exe

C:\Windows\System\kZCUBWN.exe

C:\Windows\System\kZCUBWN.exe

C:\Windows\System\eUdVvcr.exe

C:\Windows\System\eUdVvcr.exe

C:\Windows\System\vZOjcrF.exe

C:\Windows\System\vZOjcrF.exe

C:\Windows\System\peCojFD.exe

C:\Windows\System\peCojFD.exe

C:\Windows\System\sBsMfSl.exe

C:\Windows\System\sBsMfSl.exe

C:\Windows\System\RKRxtNK.exe

C:\Windows\System\RKRxtNK.exe

C:\Windows\System\ruuCTbA.exe

C:\Windows\System\ruuCTbA.exe

C:\Windows\System\NSKQTiI.exe

C:\Windows\System\NSKQTiI.exe

C:\Windows\System\BPTplUW.exe

C:\Windows\System\BPTplUW.exe

C:\Windows\System\bHvcxNl.exe

C:\Windows\System\bHvcxNl.exe

C:\Windows\System\fJAKZUQ.exe

C:\Windows\System\fJAKZUQ.exe

C:\Windows\System\GytAdTV.exe

C:\Windows\System\GytAdTV.exe

C:\Windows\System\RXrcwXC.exe

C:\Windows\System\RXrcwXC.exe

C:\Windows\System\lUFYUkt.exe

C:\Windows\System\lUFYUkt.exe

C:\Windows\System\uvqEYtl.exe

C:\Windows\System\uvqEYtl.exe

C:\Windows\System\cEmQXkg.exe

C:\Windows\System\cEmQXkg.exe

C:\Windows\System\WStbDEK.exe

C:\Windows\System\WStbDEK.exe

C:\Windows\System\QZWXdfC.exe

C:\Windows\System\QZWXdfC.exe

C:\Windows\System\ddgGBJV.exe

C:\Windows\System\ddgGBJV.exe

C:\Windows\System\ZRJzJmD.exe

C:\Windows\System\ZRJzJmD.exe

C:\Windows\System\qknuFek.exe

C:\Windows\System\qknuFek.exe

C:\Windows\System\ADhlZMq.exe

C:\Windows\System\ADhlZMq.exe

C:\Windows\System\iZHaWNe.exe

C:\Windows\System\iZHaWNe.exe

C:\Windows\System\wOWWiCM.exe

C:\Windows\System\wOWWiCM.exe

C:\Windows\System\NXgdnwa.exe

C:\Windows\System\NXgdnwa.exe

C:\Windows\System\MZFFyxY.exe

C:\Windows\System\MZFFyxY.exe

C:\Windows\System\wPUvJjO.exe

C:\Windows\System\wPUvJjO.exe

C:\Windows\System\GeddEKB.exe

C:\Windows\System\GeddEKB.exe

C:\Windows\System\IKRUTeW.exe

C:\Windows\System\IKRUTeW.exe

C:\Windows\System\jLWSxHE.exe

C:\Windows\System\jLWSxHE.exe

C:\Windows\System\WflCjIT.exe

C:\Windows\System\WflCjIT.exe

C:\Windows\System\ubuZfqc.exe

C:\Windows\System\ubuZfqc.exe

C:\Windows\System\JQznPYf.exe

C:\Windows\System\JQznPYf.exe

C:\Windows\System\vIAMlEt.exe

C:\Windows\System\vIAMlEt.exe

C:\Windows\System\rHaOhyi.exe

C:\Windows\System\rHaOhyi.exe

C:\Windows\System\wJBHrIo.exe

C:\Windows\System\wJBHrIo.exe

C:\Windows\System\SlvPDGT.exe

C:\Windows\System\SlvPDGT.exe

C:\Windows\System\rOHgcos.exe

C:\Windows\System\rOHgcos.exe

C:\Windows\System\AqKAlUs.exe

C:\Windows\System\AqKAlUs.exe

C:\Windows\System\wkZMAJd.exe

C:\Windows\System\wkZMAJd.exe

C:\Windows\System\mMrOlbV.exe

C:\Windows\System\mMrOlbV.exe

C:\Windows\System\SWPEdFp.exe

C:\Windows\System\SWPEdFp.exe

C:\Windows\System\PiojjPo.exe

C:\Windows\System\PiojjPo.exe

C:\Windows\System\DaSDouX.exe

C:\Windows\System\DaSDouX.exe

C:\Windows\System\OAIFmAf.exe

C:\Windows\System\OAIFmAf.exe

C:\Windows\System\nIKUkPB.exe

C:\Windows\System\nIKUkPB.exe

C:\Windows\System\AnXWHaj.exe

C:\Windows\System\AnXWHaj.exe

C:\Windows\System\GxCnwTb.exe

C:\Windows\System\GxCnwTb.exe

C:\Windows\System\STJuLbz.exe

C:\Windows\System\STJuLbz.exe

C:\Windows\System\bulgMrR.exe

C:\Windows\System\bulgMrR.exe

C:\Windows\System\FQeuwMa.exe

C:\Windows\System\FQeuwMa.exe

C:\Windows\System\RxDXOlW.exe

C:\Windows\System\RxDXOlW.exe

C:\Windows\System\EByadFl.exe

C:\Windows\System\EByadFl.exe

C:\Windows\System\DTGbLhN.exe

C:\Windows\System\DTGbLhN.exe

C:\Windows\System\aALqOzk.exe

C:\Windows\System\aALqOzk.exe

C:\Windows\System\PTKHDGX.exe

C:\Windows\System\PTKHDGX.exe

C:\Windows\System\MkoOfrX.exe

C:\Windows\System\MkoOfrX.exe

C:\Windows\System\OoJKPlk.exe

C:\Windows\System\OoJKPlk.exe

C:\Windows\System\AdjPPMa.exe

C:\Windows\System\AdjPPMa.exe

C:\Windows\System\zpVFTHo.exe

C:\Windows\System\zpVFTHo.exe

C:\Windows\System\fBmMoBi.exe

C:\Windows\System\fBmMoBi.exe

C:\Windows\System\HUYSfNa.exe

C:\Windows\System\HUYSfNa.exe

C:\Windows\System\eplIrXm.exe

C:\Windows\System\eplIrXm.exe

C:\Windows\System\yAVEZfk.exe

C:\Windows\System\yAVEZfk.exe

C:\Windows\System\XltqeuD.exe

C:\Windows\System\XltqeuD.exe

C:\Windows\System\SkbxABx.exe

C:\Windows\System\SkbxABx.exe

C:\Windows\System\MRvPJLQ.exe

C:\Windows\System\MRvPJLQ.exe

C:\Windows\System\UiyRDuA.exe

C:\Windows\System\UiyRDuA.exe

C:\Windows\System\OxSowrd.exe

C:\Windows\System\OxSowrd.exe

C:\Windows\System\LTQKqlY.exe

C:\Windows\System\LTQKqlY.exe

C:\Windows\System\scfUlUV.exe

C:\Windows\System\scfUlUV.exe

C:\Windows\System\NNskjee.exe

C:\Windows\System\NNskjee.exe

C:\Windows\System\lWvmRBK.exe

C:\Windows\System\lWvmRBK.exe

C:\Windows\System\zrImdME.exe

C:\Windows\System\zrImdME.exe

C:\Windows\System\JdzbNza.exe

C:\Windows\System\JdzbNza.exe

C:\Windows\System\fmQninB.exe

C:\Windows\System\fmQninB.exe

C:\Windows\System\roUuZjD.exe

C:\Windows\System\roUuZjD.exe

C:\Windows\System\DMKohIr.exe

C:\Windows\System\DMKohIr.exe

C:\Windows\System\jByFVsu.exe

C:\Windows\System\jByFVsu.exe

C:\Windows\System\TgPpdLy.exe

C:\Windows\System\TgPpdLy.exe

C:\Windows\System\eoqkejZ.exe

C:\Windows\System\eoqkejZ.exe

C:\Windows\System\GxhJGGz.exe

C:\Windows\System\GxhJGGz.exe

C:\Windows\System\aeYhUba.exe

C:\Windows\System\aeYhUba.exe

C:\Windows\System\UCrDMQs.exe

C:\Windows\System\UCrDMQs.exe

C:\Windows\System\NhJnfbP.exe

C:\Windows\System\NhJnfbP.exe

C:\Windows\System\MUQSOSL.exe

C:\Windows\System\MUQSOSL.exe

C:\Windows\System\TrDUCCE.exe

C:\Windows\System\TrDUCCE.exe

C:\Windows\System\vNtZHrt.exe

C:\Windows\System\vNtZHrt.exe

C:\Windows\System\pqyMpiH.exe

C:\Windows\System\pqyMpiH.exe

C:\Windows\System\jHnPUcK.exe

C:\Windows\System\jHnPUcK.exe

C:\Windows\System\zOHzOtH.exe

C:\Windows\System\zOHzOtH.exe

C:\Windows\System\dyhYGGp.exe

C:\Windows\System\dyhYGGp.exe

C:\Windows\System\quQfSKh.exe

C:\Windows\System\quQfSKh.exe

C:\Windows\System\IKsvrbR.exe

C:\Windows\System\IKsvrbR.exe

C:\Windows\System\EpVksMf.exe

C:\Windows\System\EpVksMf.exe

C:\Windows\System\eHrrxbU.exe

C:\Windows\System\eHrrxbU.exe

C:\Windows\System\jZiZgrJ.exe

C:\Windows\System\jZiZgrJ.exe

C:\Windows\System\lDyDmaD.exe

C:\Windows\System\lDyDmaD.exe

C:\Windows\System\MketeJi.exe

C:\Windows\System\MketeJi.exe

C:\Windows\System\ZMHGSeA.exe

C:\Windows\System\ZMHGSeA.exe

C:\Windows\System\YLCHSCC.exe

C:\Windows\System\YLCHSCC.exe

C:\Windows\System\LPMXMnm.exe

C:\Windows\System\LPMXMnm.exe

C:\Windows\System\YViEirl.exe

C:\Windows\System\YViEirl.exe

C:\Windows\System\ebKnLZr.exe

C:\Windows\System\ebKnLZr.exe

C:\Windows\System\YiRdwhh.exe

C:\Windows\System\YiRdwhh.exe

C:\Windows\System\mcRkWsd.exe

C:\Windows\System\mcRkWsd.exe

C:\Windows\System\PadprCS.exe

C:\Windows\System\PadprCS.exe

C:\Windows\System\ngIhetA.exe

C:\Windows\System\ngIhetA.exe

C:\Windows\System\WdYivFc.exe

C:\Windows\System\WdYivFc.exe

C:\Windows\System\ZinMCcM.exe

C:\Windows\System\ZinMCcM.exe

C:\Windows\System\OvAYVBv.exe

C:\Windows\System\OvAYVBv.exe

C:\Windows\System\vzctYav.exe

C:\Windows\System\vzctYav.exe

C:\Windows\System\muGrfsj.exe

C:\Windows\System\muGrfsj.exe

C:\Windows\System\szrtFra.exe

C:\Windows\System\szrtFra.exe

C:\Windows\System\uWhUtdk.exe

C:\Windows\System\uWhUtdk.exe

C:\Windows\System\uJcgfPe.exe

C:\Windows\System\uJcgfPe.exe

C:\Windows\System\HcdsMWS.exe

C:\Windows\System\HcdsMWS.exe

C:\Windows\System\cnTGfbN.exe

C:\Windows\System\cnTGfbN.exe

C:\Windows\System\CdqgCpO.exe

C:\Windows\System\CdqgCpO.exe

C:\Windows\System\QzLpbRV.exe

C:\Windows\System\QzLpbRV.exe

C:\Windows\System\JvRTwpb.exe

C:\Windows\System\JvRTwpb.exe

C:\Windows\System\JIRtaeR.exe

C:\Windows\System\JIRtaeR.exe

C:\Windows\System\ZTcxaHu.exe

C:\Windows\System\ZTcxaHu.exe

C:\Windows\System\GOZQWlR.exe

C:\Windows\System\GOZQWlR.exe

C:\Windows\System\olARrRw.exe

C:\Windows\System\olARrRw.exe

C:\Windows\System\YVeimXs.exe

C:\Windows\System\YVeimXs.exe

C:\Windows\System\ZipzdWz.exe

C:\Windows\System\ZipzdWz.exe

C:\Windows\System\HCKvNau.exe

C:\Windows\System\HCKvNau.exe

C:\Windows\System\FYXUzUC.exe

C:\Windows\System\FYXUzUC.exe

C:\Windows\System\WUzOnEr.exe

C:\Windows\System\WUzOnEr.exe

C:\Windows\System\HLgOmQx.exe

C:\Windows\System\HLgOmQx.exe

C:\Windows\System\fwDmhQz.exe

C:\Windows\System\fwDmhQz.exe

C:\Windows\System\BzzYRKG.exe

C:\Windows\System\BzzYRKG.exe

C:\Windows\System\HQfPcJV.exe

C:\Windows\System\HQfPcJV.exe

C:\Windows\System\uHGAxYS.exe

C:\Windows\System\uHGAxYS.exe

C:\Windows\System\vzpKJwY.exe

C:\Windows\System\vzpKJwY.exe

C:\Windows\System\PbzrCOd.exe

C:\Windows\System\PbzrCOd.exe

C:\Windows\System\rbfDwuO.exe

C:\Windows\System\rbfDwuO.exe

C:\Windows\System\mQqrPzn.exe

C:\Windows\System\mQqrPzn.exe

C:\Windows\System\jBPpEIo.exe

C:\Windows\System\jBPpEIo.exe

C:\Windows\System\uRfiQJw.exe

C:\Windows\System\uRfiQJw.exe

C:\Windows\System\tSncHMX.exe

C:\Windows\System\tSncHMX.exe

C:\Windows\System\hIZfQic.exe

C:\Windows\System\hIZfQic.exe

C:\Windows\System\UIKvbqI.exe

C:\Windows\System\UIKvbqI.exe

C:\Windows\System\BtcRPHu.exe

C:\Windows\System\BtcRPHu.exe

C:\Windows\System\heqtmPB.exe

C:\Windows\System\heqtmPB.exe

C:\Windows\System\vqHLBmE.exe

C:\Windows\System\vqHLBmE.exe

C:\Windows\System\uRqKULc.exe

C:\Windows\System\uRqKULc.exe

C:\Windows\System\pmwlrDm.exe

C:\Windows\System\pmwlrDm.exe

C:\Windows\System\mfMmxxf.exe

C:\Windows\System\mfMmxxf.exe

C:\Windows\System\qoEkRNy.exe

C:\Windows\System\qoEkRNy.exe

C:\Windows\System\CRNJbPm.exe

C:\Windows\System\CRNJbPm.exe

C:\Windows\System\zXoflhH.exe

C:\Windows\System\zXoflhH.exe

C:\Windows\System\jdsXcYo.exe

C:\Windows\System\jdsXcYo.exe

C:\Windows\System\yMWcokK.exe

C:\Windows\System\yMWcokK.exe

C:\Windows\System\MtVMxrD.exe

C:\Windows\System\MtVMxrD.exe

C:\Windows\System\RayTJzH.exe

C:\Windows\System\RayTJzH.exe

C:\Windows\System\YYeTHzw.exe

C:\Windows\System\YYeTHzw.exe

C:\Windows\System\rIvUvSW.exe

C:\Windows\System\rIvUvSW.exe

C:\Windows\System\UYtbTdY.exe

C:\Windows\System\UYtbTdY.exe

C:\Windows\System\RucTyzO.exe

C:\Windows\System\RucTyzO.exe

C:\Windows\System\VUpTNnB.exe

C:\Windows\System\VUpTNnB.exe

C:\Windows\System\bfvhIUo.exe

C:\Windows\System\bfvhIUo.exe

C:\Windows\System\BmGteoS.exe

C:\Windows\System\BmGteoS.exe

C:\Windows\System\PXsNAJR.exe

C:\Windows\System\PXsNAJR.exe

C:\Windows\System\VedqcYm.exe

C:\Windows\System\VedqcYm.exe

C:\Windows\System\IUAHarj.exe

C:\Windows\System\IUAHarj.exe

C:\Windows\System\auRQOpu.exe

C:\Windows\System\auRQOpu.exe

C:\Windows\System\QOAQsuf.exe

C:\Windows\System\QOAQsuf.exe

C:\Windows\System\LzmhWhW.exe

C:\Windows\System\LzmhWhW.exe

C:\Windows\System\hYCAniZ.exe

C:\Windows\System\hYCAniZ.exe

C:\Windows\System\iUjrkQo.exe

C:\Windows\System\iUjrkQo.exe

C:\Windows\System\nqyYeZK.exe

C:\Windows\System\nqyYeZK.exe

C:\Windows\System\uFEPFLd.exe

C:\Windows\System\uFEPFLd.exe

C:\Windows\System\AFsTPWm.exe

C:\Windows\System\AFsTPWm.exe

C:\Windows\System\EOggnTz.exe

C:\Windows\System\EOggnTz.exe

C:\Windows\System\QUIIpWy.exe

C:\Windows\System\QUIIpWy.exe

C:\Windows\System\lwLkpFX.exe

C:\Windows\System\lwLkpFX.exe

C:\Windows\System\KghuSSH.exe

C:\Windows\System\KghuSSH.exe

C:\Windows\System\mMUAKXB.exe

C:\Windows\System\mMUAKXB.exe

C:\Windows\System\sgGbCxn.exe

C:\Windows\System\sgGbCxn.exe

C:\Windows\System\QGBAsrk.exe

C:\Windows\System\QGBAsrk.exe

C:\Windows\System\HAXOhpQ.exe

C:\Windows\System\HAXOhpQ.exe

C:\Windows\System\uPjEOmm.exe

C:\Windows\System\uPjEOmm.exe

C:\Windows\System\psRkHZp.exe

C:\Windows\System\psRkHZp.exe

C:\Windows\System\VJWZVWJ.exe

C:\Windows\System\VJWZVWJ.exe

C:\Windows\System\OENvbmB.exe

C:\Windows\System\OENvbmB.exe

C:\Windows\System\YmMfZgs.exe

C:\Windows\System\YmMfZgs.exe

C:\Windows\System\FmxZxYO.exe

C:\Windows\System\FmxZxYO.exe

C:\Windows\System\AoQKGVN.exe

C:\Windows\System\AoQKGVN.exe

C:\Windows\System\hoIQKEE.exe

C:\Windows\System\hoIQKEE.exe

C:\Windows\System\KNeHrAM.exe

C:\Windows\System\KNeHrAM.exe

C:\Windows\System\zyOeGxE.exe

C:\Windows\System\zyOeGxE.exe

C:\Windows\System\gEyRWaO.exe

C:\Windows\System\gEyRWaO.exe

C:\Windows\System\GQhNtFI.exe

C:\Windows\System\GQhNtFI.exe

C:\Windows\System\puLrnKw.exe

C:\Windows\System\puLrnKw.exe

C:\Windows\System\dgdXJob.exe

C:\Windows\System\dgdXJob.exe

C:\Windows\System\zLaIYBY.exe

C:\Windows\System\zLaIYBY.exe

C:\Windows\System\qngptmX.exe

C:\Windows\System\qngptmX.exe

C:\Windows\System\ZzXKnQb.exe

C:\Windows\System\ZzXKnQb.exe

C:\Windows\System\dbXDFFy.exe

C:\Windows\System\dbXDFFy.exe

C:\Windows\System\lQJtWjh.exe

C:\Windows\System\lQJtWjh.exe

C:\Windows\System\idlXizu.exe

C:\Windows\System\idlXizu.exe

C:\Windows\System\tHCPblE.exe

C:\Windows\System\tHCPblE.exe

C:\Windows\System\lANErFp.exe

C:\Windows\System\lANErFp.exe

C:\Windows\System\lPpLilB.exe

C:\Windows\System\lPpLilB.exe

C:\Windows\System\EQFkrPN.exe

C:\Windows\System\EQFkrPN.exe

C:\Windows\System\iuGvveO.exe

C:\Windows\System\iuGvveO.exe

C:\Windows\System\bgyptrF.exe

C:\Windows\System\bgyptrF.exe

C:\Windows\System\BoBTenC.exe

C:\Windows\System\BoBTenC.exe

C:\Windows\System\iszZraF.exe

C:\Windows\System\iszZraF.exe

C:\Windows\System\ELMglbl.exe

C:\Windows\System\ELMglbl.exe

C:\Windows\System\PYOVXSF.exe

C:\Windows\System\PYOVXSF.exe

C:\Windows\System\EMTXMxY.exe

C:\Windows\System\EMTXMxY.exe

C:\Windows\System\FvQyQvk.exe

C:\Windows\System\FvQyQvk.exe

C:\Windows\System\HqYPFxo.exe

C:\Windows\System\HqYPFxo.exe

C:\Windows\System\dsrJCcw.exe

C:\Windows\System\dsrJCcw.exe

C:\Windows\System\YkfUAnj.exe

C:\Windows\System\YkfUAnj.exe

C:\Windows\System\QEJQTwb.exe

C:\Windows\System\QEJQTwb.exe

C:\Windows\System\ZqsmadH.exe

C:\Windows\System\ZqsmadH.exe

C:\Windows\System\FzCdngR.exe

C:\Windows\System\FzCdngR.exe

C:\Windows\System\Pxlbzky.exe

C:\Windows\System\Pxlbzky.exe

C:\Windows\System\oEbqSkW.exe

C:\Windows\System\oEbqSkW.exe

C:\Windows\System\rtxUXfp.exe

C:\Windows\System\rtxUXfp.exe

C:\Windows\System\GlbwpTR.exe

C:\Windows\System\GlbwpTR.exe

C:\Windows\System\VVGZHuM.exe

C:\Windows\System\VVGZHuM.exe

C:\Windows\System\RVcnEEE.exe

C:\Windows\System\RVcnEEE.exe

C:\Windows\System\BzwjTrH.exe

C:\Windows\System\BzwjTrH.exe

C:\Windows\System\wTrcqCJ.exe

C:\Windows\System\wTrcqCJ.exe

C:\Windows\System\uZDMuNU.exe

C:\Windows\System\uZDMuNU.exe

C:\Windows\System\KHdfmDU.exe

C:\Windows\System\KHdfmDU.exe

C:\Windows\System\fCSaTfg.exe

C:\Windows\System\fCSaTfg.exe

C:\Windows\System\zdmyNlX.exe

C:\Windows\System\zdmyNlX.exe

C:\Windows\System\NewgKpH.exe

C:\Windows\System\NewgKpH.exe

C:\Windows\System\jYMmtPn.exe

C:\Windows\System\jYMmtPn.exe

C:\Windows\System\xjytMzp.exe

C:\Windows\System\xjytMzp.exe

C:\Windows\System\RZjRYfD.exe

C:\Windows\System\RZjRYfD.exe

C:\Windows\System\GEVuIWo.exe

C:\Windows\System\GEVuIWo.exe

C:\Windows\System\ULNkXWW.exe

C:\Windows\System\ULNkXWW.exe

C:\Windows\System\mKmdRzX.exe

C:\Windows\System\mKmdRzX.exe

C:\Windows\System\mBNpLsW.exe

C:\Windows\System\mBNpLsW.exe

C:\Windows\System\kadRwuh.exe

C:\Windows\System\kadRwuh.exe

C:\Windows\System\FABEFwd.exe

C:\Windows\System\FABEFwd.exe

C:\Windows\System\ZtFRxfR.exe

C:\Windows\System\ZtFRxfR.exe

C:\Windows\System\qYlQHbo.exe

C:\Windows\System\qYlQHbo.exe

C:\Windows\System\rnyaufQ.exe

C:\Windows\System\rnyaufQ.exe

C:\Windows\System\lyKPfoL.exe

C:\Windows\System\lyKPfoL.exe

C:\Windows\System\VEdAsqg.exe

C:\Windows\System\VEdAsqg.exe

C:\Windows\System\AElUucO.exe

C:\Windows\System\AElUucO.exe

C:\Windows\System\DTuUepi.exe

C:\Windows\System\DTuUepi.exe

C:\Windows\System\BvjpBRp.exe

C:\Windows\System\BvjpBRp.exe

C:\Windows\System\BFMpWcF.exe

C:\Windows\System\BFMpWcF.exe

C:\Windows\System\sHclaGp.exe

C:\Windows\System\sHclaGp.exe

C:\Windows\System\HWHmbtn.exe

C:\Windows\System\HWHmbtn.exe

C:\Windows\System\SGlyHVm.exe

C:\Windows\System\SGlyHVm.exe

C:\Windows\System\hpDiJBm.exe

C:\Windows\System\hpDiJBm.exe

C:\Windows\System\DmsfJgU.exe

C:\Windows\System\DmsfJgU.exe

C:\Windows\System\DGyiszU.exe

C:\Windows\System\DGyiszU.exe

C:\Windows\System\MrVcpLR.exe

C:\Windows\System\MrVcpLR.exe

C:\Windows\System\ZWMvPKr.exe

C:\Windows\System\ZWMvPKr.exe

C:\Windows\System\qbZnnZp.exe

C:\Windows\System\qbZnnZp.exe

C:\Windows\System\ywOoMyd.exe

C:\Windows\System\ywOoMyd.exe

C:\Windows\System\eXrwYuh.exe

C:\Windows\System\eXrwYuh.exe

C:\Windows\System\sPXzYMa.exe

C:\Windows\System\sPXzYMa.exe

C:\Windows\System\WVULwPp.exe

C:\Windows\System\WVULwPp.exe

C:\Windows\System\UqQJDmY.exe

C:\Windows\System\UqQJDmY.exe

C:\Windows\System\ZdRbDkO.exe

C:\Windows\System\ZdRbDkO.exe

C:\Windows\System\kAJMPzj.exe

C:\Windows\System\kAJMPzj.exe

C:\Windows\System\iywPZtb.exe

C:\Windows\System\iywPZtb.exe

C:\Windows\System\RfKhHeh.exe

C:\Windows\System\RfKhHeh.exe

C:\Windows\System\BEMJNOX.exe

C:\Windows\System\BEMJNOX.exe

C:\Windows\System\NnFpfuI.exe

C:\Windows\System\NnFpfuI.exe

C:\Windows\System\smnCcPv.exe

C:\Windows\System\smnCcPv.exe

C:\Windows\System\areOxBI.exe

C:\Windows\System\areOxBI.exe

C:\Windows\System\RxzfCWs.exe

C:\Windows\System\RxzfCWs.exe

C:\Windows\System\gXjSfvt.exe

C:\Windows\System\gXjSfvt.exe

C:\Windows\System\JLGnxEg.exe

C:\Windows\System\JLGnxEg.exe

C:\Windows\System\htibVdA.exe

C:\Windows\System\htibVdA.exe

C:\Windows\System\imrJajL.exe

C:\Windows\System\imrJajL.exe

C:\Windows\System\pfpLPSh.exe

C:\Windows\System\pfpLPSh.exe

C:\Windows\System\SfxnrkD.exe

C:\Windows\System\SfxnrkD.exe

C:\Windows\System\CAUMnhu.exe

C:\Windows\System\CAUMnhu.exe

C:\Windows\System\hjJwMce.exe

C:\Windows\System\hjJwMce.exe

C:\Windows\System\aHpxrXl.exe

C:\Windows\System\aHpxrXl.exe

C:\Windows\System\CxItwbQ.exe

C:\Windows\System\CxItwbQ.exe

C:\Windows\System\CADTxWN.exe

C:\Windows\System\CADTxWN.exe

C:\Windows\System\mpVtAUV.exe

C:\Windows\System\mpVtAUV.exe

C:\Windows\System\AHILuLZ.exe

C:\Windows\System\AHILuLZ.exe

C:\Windows\System\KiaemoC.exe

C:\Windows\System\KiaemoC.exe

C:\Windows\System\HyOdlkq.exe

C:\Windows\System\HyOdlkq.exe

C:\Windows\System\vuRaYgf.exe

C:\Windows\System\vuRaYgf.exe

C:\Windows\System\LyzWWuJ.exe

C:\Windows\System\LyzWWuJ.exe

C:\Windows\System\ekUVemY.exe

C:\Windows\System\ekUVemY.exe

C:\Windows\System\HeUihGA.exe

C:\Windows\System\HeUihGA.exe

C:\Windows\System\lYTtAFB.exe

C:\Windows\System\lYTtAFB.exe

C:\Windows\System\JCKSgXf.exe

C:\Windows\System\JCKSgXf.exe

C:\Windows\System\aPpEDgp.exe

C:\Windows\System\aPpEDgp.exe

C:\Windows\System\tWdwFkM.exe

C:\Windows\System\tWdwFkM.exe

C:\Windows\System\XMZrcAD.exe

C:\Windows\System\XMZrcAD.exe

C:\Windows\System\KxRadEd.exe

C:\Windows\System\KxRadEd.exe

C:\Windows\System\tApHKnJ.exe

C:\Windows\System\tApHKnJ.exe

C:\Windows\System\RduNhGl.exe

C:\Windows\System\RduNhGl.exe

C:\Windows\System\FptvTNa.exe

C:\Windows\System\FptvTNa.exe

C:\Windows\System\tSGHias.exe

C:\Windows\System\tSGHias.exe

C:\Windows\System\fobZLvI.exe

C:\Windows\System\fobZLvI.exe

C:\Windows\System\UJNPXSO.exe

C:\Windows\System\UJNPXSO.exe

C:\Windows\System\XSRBsLl.exe

C:\Windows\System\XSRBsLl.exe

C:\Windows\System\vBOxerk.exe

C:\Windows\System\vBOxerk.exe

C:\Windows\System\FNWGPsd.exe

C:\Windows\System\FNWGPsd.exe

C:\Windows\System\deYYZTr.exe

C:\Windows\System\deYYZTr.exe

C:\Windows\System\pufhYSd.exe

C:\Windows\System\pufhYSd.exe

C:\Windows\System\ViJjaIx.exe

C:\Windows\System\ViJjaIx.exe

C:\Windows\System\WWqHORk.exe

C:\Windows\System\WWqHORk.exe

C:\Windows\System\uppYumz.exe

C:\Windows\System\uppYumz.exe

C:\Windows\System\fJsbYKb.exe

C:\Windows\System\fJsbYKb.exe

C:\Windows\System\hvxwsFs.exe

C:\Windows\System\hvxwsFs.exe

C:\Windows\System\ApJQHCz.exe

C:\Windows\System\ApJQHCz.exe

C:\Windows\System\kDNqlZs.exe

C:\Windows\System\kDNqlZs.exe

C:\Windows\System\wtZSycw.exe

C:\Windows\System\wtZSycw.exe

C:\Windows\System\yRzxmst.exe

C:\Windows\System\yRzxmst.exe

C:\Windows\System\ThjkeDi.exe

C:\Windows\System\ThjkeDi.exe

C:\Windows\System\UsNhFmj.exe

C:\Windows\System\UsNhFmj.exe

C:\Windows\System\lizOmqN.exe

C:\Windows\System\lizOmqN.exe

C:\Windows\System\tcNrUpw.exe

C:\Windows\System\tcNrUpw.exe

C:\Windows\System\gyQxCVe.exe

C:\Windows\System\gyQxCVe.exe

C:\Windows\System\gBKjGAU.exe

C:\Windows\System\gBKjGAU.exe

C:\Windows\System\APlRWSG.exe

C:\Windows\System\APlRWSG.exe

C:\Windows\System\pzWqxGs.exe

C:\Windows\System\pzWqxGs.exe

C:\Windows\System\bCgDhnu.exe

C:\Windows\System\bCgDhnu.exe

C:\Windows\System\IcqenAu.exe

C:\Windows\System\IcqenAu.exe

C:\Windows\System\LQgCAeN.exe

C:\Windows\System\LQgCAeN.exe

C:\Windows\System\lnsRsFw.exe

C:\Windows\System\lnsRsFw.exe

C:\Windows\System\EeOYDDh.exe

C:\Windows\System\EeOYDDh.exe

C:\Windows\System\sVLwQlf.exe

C:\Windows\System\sVLwQlf.exe

C:\Windows\System\qRsBHsx.exe

C:\Windows\System\qRsBHsx.exe

C:\Windows\System\tiOQqcT.exe

C:\Windows\System\tiOQqcT.exe

C:\Windows\System\JydRkBq.exe

C:\Windows\System\JydRkBq.exe

C:\Windows\System\NexDrSp.exe

C:\Windows\System\NexDrSp.exe

C:\Windows\System\DVTkDnl.exe

C:\Windows\System\DVTkDnl.exe

C:\Windows\System\svCQmQz.exe

C:\Windows\System\svCQmQz.exe

C:\Windows\System\YKcibQw.exe

C:\Windows\System\YKcibQw.exe

C:\Windows\System\wgGWviW.exe

C:\Windows\System\wgGWviW.exe

C:\Windows\System\UyPOiyJ.exe

C:\Windows\System\UyPOiyJ.exe

C:\Windows\System\jJkMsCv.exe

C:\Windows\System\jJkMsCv.exe

C:\Windows\System\moghSVl.exe

C:\Windows\System\moghSVl.exe

C:\Windows\System\CtrdBul.exe

C:\Windows\System\CtrdBul.exe

C:\Windows\System\JoEziAc.exe

C:\Windows\System\JoEziAc.exe

C:\Windows\System\OBhfqdm.exe

C:\Windows\System\OBhfqdm.exe

C:\Windows\System\NEwCXMe.exe

C:\Windows\System\NEwCXMe.exe

C:\Windows\System\TStejUn.exe

C:\Windows\System\TStejUn.exe

C:\Windows\System\sChydGt.exe

C:\Windows\System\sChydGt.exe

C:\Windows\System\RKskxKl.exe

C:\Windows\System\RKskxKl.exe

C:\Windows\System\luZmnld.exe

C:\Windows\System\luZmnld.exe

C:\Windows\System\uRsqRtF.exe

C:\Windows\System\uRsqRtF.exe

C:\Windows\System\fOOEGBj.exe

C:\Windows\System\fOOEGBj.exe

C:\Windows\System\BsCvRuV.exe

C:\Windows\System\BsCvRuV.exe

C:\Windows\System\ctEsqdH.exe

C:\Windows\System\ctEsqdH.exe

C:\Windows\System\ONSLBMy.exe

C:\Windows\System\ONSLBMy.exe

C:\Windows\System\WNkUelv.exe

C:\Windows\System\WNkUelv.exe

C:\Windows\System\wrgQzuy.exe

C:\Windows\System\wrgQzuy.exe

C:\Windows\System\EjPJuwJ.exe

C:\Windows\System\EjPJuwJ.exe

C:\Windows\System\SPMveVo.exe

C:\Windows\System\SPMveVo.exe

C:\Windows\System\vuWgEid.exe

C:\Windows\System\vuWgEid.exe

C:\Windows\System\LlZTSAL.exe

C:\Windows\System\LlZTSAL.exe

C:\Windows\System\xrKeXTC.exe

C:\Windows\System\xrKeXTC.exe

C:\Windows\System\UlYHLak.exe

C:\Windows\System\UlYHLak.exe

C:\Windows\System\vZfDheh.exe

C:\Windows\System\vZfDheh.exe

C:\Windows\System\ijYvvDQ.exe

C:\Windows\System\ijYvvDQ.exe

C:\Windows\System\TWNELzR.exe

C:\Windows\System\TWNELzR.exe

C:\Windows\System\ZRbeYQs.exe

C:\Windows\System\ZRbeYQs.exe

C:\Windows\System\NDSixCn.exe

C:\Windows\System\NDSixCn.exe

C:\Windows\System\MIHEwgZ.exe

C:\Windows\System\MIHEwgZ.exe

C:\Windows\System\tiBSSTj.exe

C:\Windows\System\tiBSSTj.exe

C:\Windows\System\qBxxWtk.exe

C:\Windows\System\qBxxWtk.exe

C:\Windows\System\BOSZVyk.exe

C:\Windows\System\BOSZVyk.exe

C:\Windows\System\DoXnyNj.exe

C:\Windows\System\DoXnyNj.exe

C:\Windows\System\cLjDUtN.exe

C:\Windows\System\cLjDUtN.exe

C:\Windows\System\igBqyWM.exe

C:\Windows\System\igBqyWM.exe

C:\Windows\System\JGVMQfg.exe

C:\Windows\System\JGVMQfg.exe

C:\Windows\System\FvhZkai.exe

C:\Windows\System\FvhZkai.exe

C:\Windows\System\JUMYuVq.exe

C:\Windows\System\JUMYuVq.exe

C:\Windows\System\pSIZIlv.exe

C:\Windows\System\pSIZIlv.exe

C:\Windows\System\XQOYdKO.exe

C:\Windows\System\XQOYdKO.exe

C:\Windows\System\QuEDiGv.exe

C:\Windows\System\QuEDiGv.exe

C:\Windows\System\Byqtcvy.exe

C:\Windows\System\Byqtcvy.exe

C:\Windows\System\dKSdtUN.exe

C:\Windows\System\dKSdtUN.exe

C:\Windows\System\WykgcBC.exe

C:\Windows\System\WykgcBC.exe

C:\Windows\System\NJieiaI.exe

C:\Windows\System\NJieiaI.exe

C:\Windows\System\DZVRHTw.exe

C:\Windows\System\DZVRHTw.exe

C:\Windows\System\JMJHImu.exe

C:\Windows\System\JMJHImu.exe

C:\Windows\System\jMxTToY.exe

C:\Windows\System\jMxTToY.exe

C:\Windows\System\vtvaAWz.exe

C:\Windows\System\vtvaAWz.exe

C:\Windows\System\OCFGTvR.exe

C:\Windows\System\OCFGTvR.exe

C:\Windows\System\xvylCUx.exe

C:\Windows\System\xvylCUx.exe

C:\Windows\System\IdAByAy.exe

C:\Windows\System\IdAByAy.exe

C:\Windows\System\JRfWPRX.exe

C:\Windows\System\JRfWPRX.exe

C:\Windows\System\AhlSjzy.exe

C:\Windows\System\AhlSjzy.exe

C:\Windows\System\xapabTs.exe

C:\Windows\System\xapabTs.exe

C:\Windows\System\FDjuTUn.exe

C:\Windows\System\FDjuTUn.exe

C:\Windows\System\KNeRgcZ.exe

C:\Windows\System\KNeRgcZ.exe

C:\Windows\System\MGfNdPg.exe

C:\Windows\System\MGfNdPg.exe

C:\Windows\System\sePNcBf.exe

C:\Windows\System\sePNcBf.exe

C:\Windows\System\AYwwsEo.exe

C:\Windows\System\AYwwsEo.exe

C:\Windows\System\LIhROVz.exe

C:\Windows\System\LIhROVz.exe

C:\Windows\System\heIzcSf.exe

C:\Windows\System\heIzcSf.exe

C:\Windows\System\vpaliwV.exe

C:\Windows\System\vpaliwV.exe

C:\Windows\System\fildGYA.exe

C:\Windows\System\fildGYA.exe

C:\Windows\System\UjGvUEB.exe

C:\Windows\System\UjGvUEB.exe

C:\Windows\System\dNTiamV.exe

C:\Windows\System\dNTiamV.exe

C:\Windows\System\GaJvyRI.exe

C:\Windows\System\GaJvyRI.exe

C:\Windows\System\IwAqUCP.exe

C:\Windows\System\IwAqUCP.exe

C:\Windows\System\lTNQeho.exe

C:\Windows\System\lTNQeho.exe

C:\Windows\System\IfilLkF.exe

C:\Windows\System\IfilLkF.exe

C:\Windows\System\UzUpnjH.exe

C:\Windows\System\UzUpnjH.exe

C:\Windows\System\oEPUhvF.exe

C:\Windows\System\oEPUhvF.exe

C:\Windows\System\TxDOLjm.exe

C:\Windows\System\TxDOLjm.exe

C:\Windows\System\LlMXJXG.exe

C:\Windows\System\LlMXJXG.exe

C:\Windows\System\mEsJJoE.exe

C:\Windows\System\mEsJJoE.exe

C:\Windows\System\PAPVwTO.exe

C:\Windows\System\PAPVwTO.exe

C:\Windows\System\pAFtujY.exe

C:\Windows\System\pAFtujY.exe

C:\Windows\System\UjGAsKj.exe

C:\Windows\System\UjGAsKj.exe

C:\Windows\System\hoIhPLf.exe

C:\Windows\System\hoIhPLf.exe

C:\Windows\System\TeDFnFF.exe

C:\Windows\System\TeDFnFF.exe

C:\Windows\System\pQPvKsl.exe

C:\Windows\System\pQPvKsl.exe

C:\Windows\System\VeiWKED.exe

C:\Windows\System\VeiWKED.exe

C:\Windows\System\LkNfnNm.exe

C:\Windows\System\LkNfnNm.exe

C:\Windows\System\mzEhpAx.exe

C:\Windows\System\mzEhpAx.exe

C:\Windows\System\LBgLxSr.exe

C:\Windows\System\LBgLxSr.exe

C:\Windows\System\zUwbTIU.exe

C:\Windows\System\zUwbTIU.exe

C:\Windows\System\xXVBWrO.exe

C:\Windows\System\xXVBWrO.exe

C:\Windows\System\WYiZbaR.exe

C:\Windows\System\WYiZbaR.exe

C:\Windows\System\soolWLR.exe

C:\Windows\System\soolWLR.exe

C:\Windows\System\aCLjxnk.exe

C:\Windows\System\aCLjxnk.exe

C:\Windows\System\HtokxBy.exe

C:\Windows\System\HtokxBy.exe

C:\Windows\System\FDiLXSj.exe

C:\Windows\System\FDiLXSj.exe

C:\Windows\System\RBwHWmg.exe

C:\Windows\System\RBwHWmg.exe

C:\Windows\System\uoGAxVw.exe

C:\Windows\System\uoGAxVw.exe

C:\Windows\System\ndTOPTP.exe

C:\Windows\System\ndTOPTP.exe

C:\Windows\System\TToSUFa.exe

C:\Windows\System\TToSUFa.exe

C:\Windows\System\ReHIywB.exe

C:\Windows\System\ReHIywB.exe

C:\Windows\System\xSIGOHM.exe

C:\Windows\System\xSIGOHM.exe

C:\Windows\System\rrTpJcB.exe

C:\Windows\System\rrTpJcB.exe

C:\Windows\System\atDVaJG.exe

C:\Windows\System\atDVaJG.exe

C:\Windows\System\rhlTIDd.exe

C:\Windows\System\rhlTIDd.exe

C:\Windows\System\LkWZFLZ.exe

C:\Windows\System\LkWZFLZ.exe

C:\Windows\System\qoubZuE.exe

C:\Windows\System\qoubZuE.exe

C:\Windows\System\ksNDmLc.exe

C:\Windows\System\ksNDmLc.exe

C:\Windows\System\LAYmuHO.exe

C:\Windows\System\LAYmuHO.exe

C:\Windows\System\nSVpPvl.exe

C:\Windows\System\nSVpPvl.exe

C:\Windows\System\vZJmxxI.exe

C:\Windows\System\vZJmxxI.exe

C:\Windows\System\JKRVblG.exe

C:\Windows\System\JKRVblG.exe

C:\Windows\System\TBvmlSi.exe

C:\Windows\System\TBvmlSi.exe

C:\Windows\System\bBrCrvJ.exe

C:\Windows\System\bBrCrvJ.exe

C:\Windows\System\etFFYhd.exe

C:\Windows\System\etFFYhd.exe

C:\Windows\System\zuLyoUy.exe

C:\Windows\System\zuLyoUy.exe

C:\Windows\System\ejlIuJy.exe

C:\Windows\System\ejlIuJy.exe

C:\Windows\System\IAKpuMG.exe

C:\Windows\System\IAKpuMG.exe

C:\Windows\System\YbMatvZ.exe

C:\Windows\System\YbMatvZ.exe

C:\Windows\System\FJDQWHh.exe

C:\Windows\System\FJDQWHh.exe

C:\Windows\System\QFDuqgE.exe

C:\Windows\System\QFDuqgE.exe

C:\Windows\System\IeXCGuo.exe

C:\Windows\System\IeXCGuo.exe

C:\Windows\System\aSyDSTC.exe

C:\Windows\System\aSyDSTC.exe

C:\Windows\System\BNYVGHJ.exe

C:\Windows\System\BNYVGHJ.exe

C:\Windows\System\sVDfdgs.exe

C:\Windows\System\sVDfdgs.exe

C:\Windows\System\DTZkDtU.exe

C:\Windows\System\DTZkDtU.exe

C:\Windows\System\ZGuGgER.exe

C:\Windows\System\ZGuGgER.exe

C:\Windows\System\oxgJWaZ.exe

C:\Windows\System\oxgJWaZ.exe

C:\Windows\System\RZkCkTh.exe

C:\Windows\System\RZkCkTh.exe

C:\Windows\System\DSndsUX.exe

C:\Windows\System\DSndsUX.exe

C:\Windows\System\xRKoyyv.exe

C:\Windows\System\xRKoyyv.exe

C:\Windows\System\rDeZOEz.exe

C:\Windows\System\rDeZOEz.exe

C:\Windows\System\BWVDHtP.exe

C:\Windows\System\BWVDHtP.exe

C:\Windows\System\vkReUwq.exe

C:\Windows\System\vkReUwq.exe

C:\Windows\System\oLArSTv.exe

C:\Windows\System\oLArSTv.exe

C:\Windows\System\mfbckEx.exe

C:\Windows\System\mfbckEx.exe

C:\Windows\System\XTtlWVd.exe

C:\Windows\System\XTtlWVd.exe

C:\Windows\System\lHbxhTo.exe

C:\Windows\System\lHbxhTo.exe

C:\Windows\System\PaaPcXB.exe

C:\Windows\System\PaaPcXB.exe

C:\Windows\System\FaokMHZ.exe

C:\Windows\System\FaokMHZ.exe

C:\Windows\System\bloSUzf.exe

C:\Windows\System\bloSUzf.exe

C:\Windows\System\lvzDBOu.exe

C:\Windows\System\lvzDBOu.exe

C:\Windows\System\rDmZgKv.exe

C:\Windows\System\rDmZgKv.exe

C:\Windows\System\eQdPQhS.exe

C:\Windows\System\eQdPQhS.exe

C:\Windows\System\lgcNsAB.exe

C:\Windows\System\lgcNsAB.exe

C:\Windows\System\FReSuCr.exe

C:\Windows\System\FReSuCr.exe

C:\Windows\System\DEGxRGh.exe

C:\Windows\System\DEGxRGh.exe

C:\Windows\System\JwYzqSj.exe

C:\Windows\System\JwYzqSj.exe

C:\Windows\System\azNYQlo.exe

C:\Windows\System\azNYQlo.exe

C:\Windows\System\ljtrQJr.exe

C:\Windows\System\ljtrQJr.exe

C:\Windows\System\aCoMvvj.exe

C:\Windows\System\aCoMvvj.exe

C:\Windows\System\wiymXvP.exe

C:\Windows\System\wiymXvP.exe

C:\Windows\System\mSLTicC.exe

C:\Windows\System\mSLTicC.exe

C:\Windows\System\eVdyaRW.exe

C:\Windows\System\eVdyaRW.exe

C:\Windows\System\lcLyjVl.exe

C:\Windows\System\lcLyjVl.exe

C:\Windows\System\TVgFMMK.exe

C:\Windows\System\TVgFMMK.exe

C:\Windows\System\LWCwlyi.exe

C:\Windows\System\LWCwlyi.exe

C:\Windows\System\sBGSkUN.exe

C:\Windows\System\sBGSkUN.exe

C:\Windows\System\eFCDspE.exe

C:\Windows\System\eFCDspE.exe

C:\Windows\System\pdqXKiV.exe

C:\Windows\System\pdqXKiV.exe

C:\Windows\System\IpZSmRO.exe

C:\Windows\System\IpZSmRO.exe

C:\Windows\System\QLiDeKm.exe

C:\Windows\System\QLiDeKm.exe

C:\Windows\System\LFtXeRw.exe

C:\Windows\System\LFtXeRw.exe

C:\Windows\System\xMXdrvV.exe

C:\Windows\System\xMXdrvV.exe

C:\Windows\System\hOyIBar.exe

C:\Windows\System\hOyIBar.exe

C:\Windows\System\wwsQeZR.exe

C:\Windows\System\wwsQeZR.exe

C:\Windows\System\JTYWqZW.exe

C:\Windows\System\JTYWqZW.exe

C:\Windows\System\iDRJkLb.exe

C:\Windows\System\iDRJkLb.exe

C:\Windows\System\VfGgpJD.exe

C:\Windows\System\VfGgpJD.exe

C:\Windows\System\mIZlTTg.exe

C:\Windows\System\mIZlTTg.exe

C:\Windows\System\hxZiqUP.exe

C:\Windows\System\hxZiqUP.exe

C:\Windows\System\hhjszGG.exe

C:\Windows\System\hhjszGG.exe

C:\Windows\System\PKSzIuJ.exe

C:\Windows\System\PKSzIuJ.exe

C:\Windows\System\MllUXIZ.exe

C:\Windows\System\MllUXIZ.exe

C:\Windows\System\HVGyrwD.exe

C:\Windows\System\HVGyrwD.exe

C:\Windows\System\fMfazKb.exe

C:\Windows\System\fMfazKb.exe

C:\Windows\System\IsYoOsx.exe

C:\Windows\System\IsYoOsx.exe

C:\Windows\System\xusAyqD.exe

C:\Windows\System\xusAyqD.exe

C:\Windows\System\tRtQFFv.exe

C:\Windows\System\tRtQFFv.exe

C:\Windows\System\QljUzPo.exe

C:\Windows\System\QljUzPo.exe

C:\Windows\System\KJegUbx.exe

C:\Windows\System\KJegUbx.exe

C:\Windows\System\aJbcaxC.exe

C:\Windows\System\aJbcaxC.exe

C:\Windows\System\fLYomxQ.exe

C:\Windows\System\fLYomxQ.exe

C:\Windows\System\NoHWPCu.exe

C:\Windows\System\NoHWPCu.exe

C:\Windows\System\zAaOHxL.exe

C:\Windows\System\zAaOHxL.exe

C:\Windows\System\VjvoFAe.exe

C:\Windows\System\VjvoFAe.exe

C:\Windows\System\KYMJHfH.exe

C:\Windows\System\KYMJHfH.exe

C:\Windows\System\xQzpFJP.exe

C:\Windows\System\xQzpFJP.exe

C:\Windows\System\zRGThej.exe

C:\Windows\System\zRGThej.exe

C:\Windows\System\xQQHHQW.exe

C:\Windows\System\xQQHHQW.exe

C:\Windows\System\nLwnLcH.exe

C:\Windows\System\nLwnLcH.exe

C:\Windows\System\YwlNmBk.exe

C:\Windows\System\YwlNmBk.exe

C:\Windows\System\mYfruuZ.exe

C:\Windows\System\mYfruuZ.exe

C:\Windows\System\ufvBbIn.exe

C:\Windows\System\ufvBbIn.exe

C:\Windows\System\jQyDfdn.exe

C:\Windows\System\jQyDfdn.exe

C:\Windows\System\BVYuQLW.exe

C:\Windows\System\BVYuQLW.exe

C:\Windows\System\vmypKAx.exe

C:\Windows\System\vmypKAx.exe

C:\Windows\System\INxDejS.exe

C:\Windows\System\INxDejS.exe

C:\Windows\System\buyZmnq.exe

C:\Windows\System\buyZmnq.exe

C:\Windows\System\EIriNSQ.exe

C:\Windows\System\EIriNSQ.exe

C:\Windows\System\QlqGIdI.exe

C:\Windows\System\QlqGIdI.exe

C:\Windows\System\KbxXGpb.exe

C:\Windows\System\KbxXGpb.exe

C:\Windows\System\KkhiOjp.exe

C:\Windows\System\KkhiOjp.exe

C:\Windows\System\cNSuviO.exe

C:\Windows\System\cNSuviO.exe

C:\Windows\System\DyfEsFs.exe

C:\Windows\System\DyfEsFs.exe

C:\Windows\System\lzKSGKn.exe

C:\Windows\System\lzKSGKn.exe

C:\Windows\System\xrCoSzW.exe

C:\Windows\System\xrCoSzW.exe

C:\Windows\System\oMCfxox.exe

C:\Windows\System\oMCfxox.exe

C:\Windows\System\odQKvWf.exe

C:\Windows\System\odQKvWf.exe

C:\Windows\System\fwcxPdu.exe

C:\Windows\System\fwcxPdu.exe

C:\Windows\System\kkgSxKO.exe

C:\Windows\System\kkgSxKO.exe

C:\Windows\System\dnLQlzB.exe

C:\Windows\System\dnLQlzB.exe

C:\Windows\System\ZmhDRMv.exe

C:\Windows\System\ZmhDRMv.exe

C:\Windows\System\MfsfTPa.exe

C:\Windows\System\MfsfTPa.exe

C:\Windows\System\WExjigc.exe

C:\Windows\System\WExjigc.exe

C:\Windows\System\isjeOjv.exe

C:\Windows\System\isjeOjv.exe

C:\Windows\System\wXPXbHG.exe

C:\Windows\System\wXPXbHG.exe

C:\Windows\System\iaArkcc.exe

C:\Windows\System\iaArkcc.exe

C:\Windows\System\NjtTIDz.exe

C:\Windows\System\NjtTIDz.exe

C:\Windows\System\gChuwey.exe

C:\Windows\System\gChuwey.exe

C:\Windows\System\XxLNLrj.exe

C:\Windows\System\XxLNLrj.exe

C:\Windows\System\tLcpIKY.exe

C:\Windows\System\tLcpIKY.exe

C:\Windows\System\HnPDjna.exe

C:\Windows\System\HnPDjna.exe

C:\Windows\System\kCvzeXV.exe

C:\Windows\System\kCvzeXV.exe

C:\Windows\System\LvzRwAF.exe

C:\Windows\System\LvzRwAF.exe

C:\Windows\System\ninAXpY.exe

C:\Windows\System\ninAXpY.exe

C:\Windows\System\JDTbmsr.exe

C:\Windows\System\JDTbmsr.exe

C:\Windows\System\ZyRBBbE.exe

C:\Windows\System\ZyRBBbE.exe

C:\Windows\System\mqmRfzN.exe

C:\Windows\System\mqmRfzN.exe

C:\Windows\System\bJimDwA.exe

C:\Windows\System\bJimDwA.exe

C:\Windows\System\ckKsHNE.exe

C:\Windows\System\ckKsHNE.exe

C:\Windows\System\tkilQKa.exe

C:\Windows\System\tkilQKa.exe

C:\Windows\System\KrywgkP.exe

C:\Windows\System\KrywgkP.exe

C:\Windows\System\GIrlrKP.exe

C:\Windows\System\GIrlrKP.exe

C:\Windows\System\bwAEhPM.exe

C:\Windows\System\bwAEhPM.exe

C:\Windows\System\ACGWfPM.exe

C:\Windows\System\ACGWfPM.exe

C:\Windows\System\ABmNSsg.exe

C:\Windows\System\ABmNSsg.exe

C:\Windows\System\sXMQESk.exe

C:\Windows\System\sXMQESk.exe

C:\Windows\System\MupftqG.exe

C:\Windows\System\MupftqG.exe

C:\Windows\System\hgQXBbX.exe

C:\Windows\System\hgQXBbX.exe

C:\Windows\System\ZBmXjeH.exe

C:\Windows\System\ZBmXjeH.exe

C:\Windows\System\UoTRtch.exe

C:\Windows\System\UoTRtch.exe

C:\Windows\System\AstyrZH.exe

C:\Windows\System\AstyrZH.exe

C:\Windows\System\OYpDGli.exe

C:\Windows\System\OYpDGli.exe

C:\Windows\System\LsNRZXw.exe

C:\Windows\System\LsNRZXw.exe

C:\Windows\System\PEQKDXf.exe

C:\Windows\System\PEQKDXf.exe

C:\Windows\System\gLqErNH.exe

C:\Windows\System\gLqErNH.exe

C:\Windows\System\ztXEwmC.exe

C:\Windows\System\ztXEwmC.exe

C:\Windows\System\YWiqdyp.exe

C:\Windows\System\YWiqdyp.exe

C:\Windows\System\cNxjLRg.exe

C:\Windows\System\cNxjLRg.exe

C:\Windows\System\GVaFtnZ.exe

C:\Windows\System\GVaFtnZ.exe

C:\Windows\System\bLYrLWB.exe

C:\Windows\System\bLYrLWB.exe

C:\Windows\System\ImoVRyS.exe

C:\Windows\System\ImoVRyS.exe

C:\Windows\System\lvKNjAy.exe

C:\Windows\System\lvKNjAy.exe

C:\Windows\System\CVvLdwR.exe

C:\Windows\System\CVvLdwR.exe

C:\Windows\System\erNsjsJ.exe

C:\Windows\System\erNsjsJ.exe

C:\Windows\System\iCbfGFw.exe

C:\Windows\System\iCbfGFw.exe

C:\Windows\System\axyjOWy.exe

C:\Windows\System\axyjOWy.exe

C:\Windows\System\zGCVWgW.exe

C:\Windows\System\zGCVWgW.exe

C:\Windows\System\XXpONwV.exe

C:\Windows\System\XXpONwV.exe

C:\Windows\System\GOGxzvD.exe

C:\Windows\System\GOGxzvD.exe

C:\Windows\System\dtQntGl.exe

C:\Windows\System\dtQntGl.exe

C:\Windows\System\alaQAie.exe

C:\Windows\System\alaQAie.exe

C:\Windows\System\YoHsvRq.exe

C:\Windows\System\YoHsvRq.exe

C:\Windows\System\tDLrsWZ.exe

C:\Windows\System\tDLrsWZ.exe

C:\Windows\System\NIqDHRq.exe

C:\Windows\System\NIqDHRq.exe

C:\Windows\System\IxEfSAf.exe

C:\Windows\System\IxEfSAf.exe

C:\Windows\System\HgDBcjO.exe

C:\Windows\System\HgDBcjO.exe

C:\Windows\System\tPgbTSh.exe

C:\Windows\System\tPgbTSh.exe

C:\Windows\System\hJWJIOn.exe

C:\Windows\System\hJWJIOn.exe

C:\Windows\System\oAEPPqJ.exe

C:\Windows\System\oAEPPqJ.exe

C:\Windows\System\xqsAzHa.exe

C:\Windows\System\xqsAzHa.exe

C:\Windows\System\uKbSvVc.exe

C:\Windows\System\uKbSvVc.exe

C:\Windows\System\uwwCveK.exe

C:\Windows\System\uwwCveK.exe

C:\Windows\System\MuqhBPN.exe

C:\Windows\System\MuqhBPN.exe

C:\Windows\System\ejMVUqX.exe

C:\Windows\System\ejMVUqX.exe

C:\Windows\System\ElDHWaq.exe

C:\Windows\System\ElDHWaq.exe

C:\Windows\System\KqPTqxP.exe

C:\Windows\System\KqPTqxP.exe

C:\Windows\System\zkwoJsq.exe

C:\Windows\System\zkwoJsq.exe

C:\Windows\System\icleira.exe

C:\Windows\System\icleira.exe

C:\Windows\System\xZvepGQ.exe

C:\Windows\System\xZvepGQ.exe

C:\Windows\System\TMaBRmq.exe

C:\Windows\System\TMaBRmq.exe

C:\Windows\System\oejMHua.exe

C:\Windows\System\oejMHua.exe

C:\Windows\System\rkHYYdS.exe

C:\Windows\System\rkHYYdS.exe

C:\Windows\System\ggKoPLg.exe

C:\Windows\System\ggKoPLg.exe

C:\Windows\System\NfSjJEB.exe

C:\Windows\System\NfSjJEB.exe

C:\Windows\System\cBVGNAU.exe

C:\Windows\System\cBVGNAU.exe

C:\Windows\System\KWUeDVc.exe

C:\Windows\System\KWUeDVc.exe

C:\Windows\System\xUIHafm.exe

C:\Windows\System\xUIHafm.exe

C:\Windows\System\gaDCDba.exe

C:\Windows\System\gaDCDba.exe

C:\Windows\System\TEmHnIs.exe

C:\Windows\System\TEmHnIs.exe

C:\Windows\System\CRoEVqc.exe

C:\Windows\System\CRoEVqc.exe

C:\Windows\System\QKhDsDo.exe

C:\Windows\System\QKhDsDo.exe

C:\Windows\System\BxrkZoR.exe

C:\Windows\System\BxrkZoR.exe

C:\Windows\System\lpfAzzV.exe

C:\Windows\System\lpfAzzV.exe

C:\Windows\System\HbMBoxH.exe

C:\Windows\System\HbMBoxH.exe

C:\Windows\System\KZrVDcR.exe

C:\Windows\System\KZrVDcR.exe

C:\Windows\System\cqagPbq.exe

C:\Windows\System\cqagPbq.exe

C:\Windows\System\Vqzdpez.exe

C:\Windows\System\Vqzdpez.exe

C:\Windows\System\cogTGIT.exe

C:\Windows\System\cogTGIT.exe

C:\Windows\System\ncYFqcf.exe

C:\Windows\System\ncYFqcf.exe

C:\Windows\System\PLvLrIg.exe

C:\Windows\System\PLvLrIg.exe

C:\Windows\System\lTOBVum.exe

C:\Windows\System\lTOBVum.exe

C:\Windows\System\KcyDrtl.exe

C:\Windows\System\KcyDrtl.exe

C:\Windows\System\ssfhxtL.exe

C:\Windows\System\ssfhxtL.exe

C:\Windows\System\PeJTLZX.exe

C:\Windows\System\PeJTLZX.exe

C:\Windows\System\dOucOys.exe

C:\Windows\System\dOucOys.exe

C:\Windows\System\VYZLXes.exe

C:\Windows\System\VYZLXes.exe

C:\Windows\System\ZIbAUbs.exe

C:\Windows\System\ZIbAUbs.exe

C:\Windows\System\qmtPtmX.exe

C:\Windows\System\qmtPtmX.exe

C:\Windows\System\FRWujAT.exe

C:\Windows\System\FRWujAT.exe

C:\Windows\System\RpDiLPP.exe

C:\Windows\System\RpDiLPP.exe

C:\Windows\System\FiGlMXY.exe

C:\Windows\System\FiGlMXY.exe

C:\Windows\System\Ebdorkj.exe

C:\Windows\System\Ebdorkj.exe

C:\Windows\System\wBwCscu.exe

C:\Windows\System\wBwCscu.exe

C:\Windows\System\DLYOEhE.exe

C:\Windows\System\DLYOEhE.exe

C:\Windows\System\WcQgntd.exe

C:\Windows\System\WcQgntd.exe

C:\Windows\System\VhFPRFs.exe

C:\Windows\System\VhFPRFs.exe

C:\Windows\System\qPtUbaD.exe

C:\Windows\System\qPtUbaD.exe

C:\Windows\System\kUGUgct.exe

C:\Windows\System\kUGUgct.exe

C:\Windows\System\WaOzDxs.exe

C:\Windows\System\WaOzDxs.exe

C:\Windows\System\nDSurDO.exe

C:\Windows\System\nDSurDO.exe

C:\Windows\System\jCmKtsW.exe

C:\Windows\System\jCmKtsW.exe

C:\Windows\System\zGEHqAI.exe

C:\Windows\System\zGEHqAI.exe

C:\Windows\System\nLIWMra.exe

C:\Windows\System\nLIWMra.exe

C:\Windows\System\tQDmmdh.exe

C:\Windows\System\tQDmmdh.exe

C:\Windows\System\zALNeod.exe

C:\Windows\System\zALNeod.exe

C:\Windows\System\QivOyhS.exe

C:\Windows\System\QivOyhS.exe

C:\Windows\System\ELHzQcE.exe

C:\Windows\System\ELHzQcE.exe

C:\Windows\System\thEweIW.exe

C:\Windows\System\thEweIW.exe

C:\Windows\System\hYLxSRA.exe

C:\Windows\System\hYLxSRA.exe

C:\Windows\System\jFqGRWi.exe

C:\Windows\System\jFqGRWi.exe

C:\Windows\System\YkDsxOO.exe

C:\Windows\System\YkDsxOO.exe

C:\Windows\System\zbpEyOQ.exe

C:\Windows\System\zbpEyOQ.exe

C:\Windows\System\EdUtHPk.exe

C:\Windows\System\EdUtHPk.exe

C:\Windows\System\amOwmcp.exe

C:\Windows\System\amOwmcp.exe

C:\Windows\System\zxnyAQI.exe

C:\Windows\System\zxnyAQI.exe

C:\Windows\System\fBaRjSu.exe

C:\Windows\System\fBaRjSu.exe

C:\Windows\System\LvQxLUG.exe

C:\Windows\System\LvQxLUG.exe

C:\Windows\System\AzYNhkF.exe

C:\Windows\System\AzYNhkF.exe

C:\Windows\System\xVgIRGB.exe

C:\Windows\System\xVgIRGB.exe

C:\Windows\System\TczPLYJ.exe

C:\Windows\System\TczPLYJ.exe

C:\Windows\System\yLNyCOD.exe

C:\Windows\System\yLNyCOD.exe

C:\Windows\System\BjPNgkW.exe

C:\Windows\System\BjPNgkW.exe

C:\Windows\System\lDipBeN.exe

C:\Windows\System\lDipBeN.exe

C:\Windows\System\xbhoxKR.exe

C:\Windows\System\xbhoxKR.exe

C:\Windows\System\qaJUKio.exe

C:\Windows\System\qaJUKio.exe

C:\Windows\System\zyvdmAv.exe

C:\Windows\System\zyvdmAv.exe

C:\Windows\System\igiIvRx.exe

C:\Windows\System\igiIvRx.exe

C:\Windows\System\BydhHGM.exe

C:\Windows\System\BydhHGM.exe

C:\Windows\System\jvCBmPn.exe

C:\Windows\System\jvCBmPn.exe

C:\Windows\System\XsMlGTs.exe

C:\Windows\System\XsMlGTs.exe

C:\Windows\System\uUacBgy.exe

C:\Windows\System\uUacBgy.exe

C:\Windows\System\iDlHOvo.exe

C:\Windows\System\iDlHOvo.exe

C:\Windows\System\YbkXpED.exe

C:\Windows\System\YbkXpED.exe

C:\Windows\System\EMSPxnD.exe

C:\Windows\System\EMSPxnD.exe

C:\Windows\System\vQOTIVW.exe

C:\Windows\System\vQOTIVW.exe

C:\Windows\System\HjwKIYo.exe

C:\Windows\System\HjwKIYo.exe

C:\Windows\System\SnWqfoD.exe

C:\Windows\System\SnWqfoD.exe

C:\Windows\System\YpHgOpu.exe

C:\Windows\System\YpHgOpu.exe

C:\Windows\System\lroFgcp.exe

C:\Windows\System\lroFgcp.exe

C:\Windows\System\abAwHfp.exe

C:\Windows\System\abAwHfp.exe

C:\Windows\System\muSGOFF.exe

C:\Windows\System\muSGOFF.exe

C:\Windows\System\NCcwYvZ.exe

C:\Windows\System\NCcwYvZ.exe

C:\Windows\System\WIRHaAu.exe

C:\Windows\System\WIRHaAu.exe

C:\Windows\System\ZRPKGDb.exe

C:\Windows\System\ZRPKGDb.exe

C:\Windows\System\YkCOhdd.exe

C:\Windows\System\YkCOhdd.exe

C:\Windows\System\yZAnHXN.exe

C:\Windows\System\yZAnHXN.exe

C:\Windows\System\nnVulRJ.exe

C:\Windows\System\nnVulRJ.exe

C:\Windows\System\wxsGPcV.exe

C:\Windows\System\wxsGPcV.exe

C:\Windows\System\KCOlDks.exe

C:\Windows\System\KCOlDks.exe

C:\Windows\System\NkQuspu.exe

C:\Windows\System\NkQuspu.exe

C:\Windows\System\MMWwDcX.exe

C:\Windows\System\MMWwDcX.exe

C:\Windows\System\hPHZppp.exe

C:\Windows\System\hPHZppp.exe

C:\Windows\System\YjthOmS.exe

C:\Windows\System\YjthOmS.exe

C:\Windows\System\WvHTHEf.exe

C:\Windows\System\WvHTHEf.exe

C:\Windows\System\FFZEMiG.exe

C:\Windows\System\FFZEMiG.exe

C:\Windows\System\QPgaXtF.exe

C:\Windows\System\QPgaXtF.exe

C:\Windows\System\lvWSpWV.exe

C:\Windows\System\lvWSpWV.exe

C:\Windows\System\LkxQLeW.exe

C:\Windows\System\LkxQLeW.exe

C:\Windows\System\wGKRpzg.exe

C:\Windows\System\wGKRpzg.exe

C:\Windows\System\sxrccuJ.exe

C:\Windows\System\sxrccuJ.exe

C:\Windows\System\PKZSHTS.exe

C:\Windows\System\PKZSHTS.exe

C:\Windows\System\MPzKPBO.exe

C:\Windows\System\MPzKPBO.exe

C:\Windows\System\Ixyndmz.exe

C:\Windows\System\Ixyndmz.exe

C:\Windows\System\dSxLwfj.exe

C:\Windows\System\dSxLwfj.exe

C:\Windows\System\REzEyFw.exe

C:\Windows\System\REzEyFw.exe

C:\Windows\System\jKtpRbL.exe

C:\Windows\System\jKtpRbL.exe

C:\Windows\System\ZFAhIvM.exe

C:\Windows\System\ZFAhIvM.exe

C:\Windows\System\zFKqgyb.exe

C:\Windows\System\zFKqgyb.exe

C:\Windows\System\ywPMucB.exe

C:\Windows\System\ywPMucB.exe

C:\Windows\System\brXXDeF.exe

C:\Windows\System\brXXDeF.exe

C:\Windows\System\nRMmNvh.exe

C:\Windows\System\nRMmNvh.exe

C:\Windows\System\aQZjhNp.exe

C:\Windows\System\aQZjhNp.exe

C:\Windows\System\eeuujvi.exe

C:\Windows\System\eeuujvi.exe

C:\Windows\System\tFbxEJv.exe

C:\Windows\System\tFbxEJv.exe

C:\Windows\System\ITpiqtb.exe

C:\Windows\System\ITpiqtb.exe

C:\Windows\System\tPNzrvI.exe

C:\Windows\System\tPNzrvI.exe

C:\Windows\System\ODjkjgk.exe

C:\Windows\System\ODjkjgk.exe

C:\Windows\System\VpYsWQS.exe

C:\Windows\System\VpYsWQS.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp

Files

memory/2384-0-0x00000000000F0000-0x0000000000100000-memory.dmp

C:\Windows\system\LbPEzHD.exe

MD5	2cea16e4af054851ead2ef4e79d5d204
SHA1	40c4522ccb29a094b63a9d75816ffa8eedbc6665
SHA256	b80f62e3513d2ef43243bc71e92dbd207a0a8b0b342c0968d7bcc98d6115d532
SHA512	735b4567e464ab3e147f938af95184fe80333675fb2303a313a3966c9159961bc3361cac1f4e61dd3fda3996ab5a2037a5be3b530e69f78a515e73e483be8de9

memory/2384-2-0x000000013FCA0000-0x0000000140092000-memory.dmp

memory/2384-12-0x000000013F070000-0x000000013F462000-memory.dmp

memory/1920-15-0x000007FEF58CE000-0x000007FEF58CF000-memory.dmp

C:\Windows\system\CowsqlJ.exe

MD5	df2f265aaeb5a679192306f2172dc5cc
SHA1	f7bae2f262300ddf60c88f3aa8e60b0109a89674
SHA256	97b0aa8c8b08465d15af0cf771ac70184d06e8885c586f5033f8c3fd08139262
SHA512	18387181ec567d85430ef751181cda359d4a3b3a03c2741858132a9ed25df2a2f13f281e0f9333edb9dd60ffd6c62b16b7fa3ed5cac88d3628b6a014a2d81489

C:\Windows\system\nNXlfcM.exe

MD5	086f7f4dd3b48b6f000293e9d73bad12
SHA1	a1156f2b5b5a803ca7414e9f3848ab6f71a838ea
SHA256	7d9fae1e317afed6bcf6e87015337a83186e15fa350867d4be111ffc4336ac6f
SHA512	eded0bb85b3a1cfd1df62e7d6ec5ad9c88438d1bac51477b151df37f671eb2bb21a6252fd76913cd70b21ef3d0313e5d68b4b98580af94ce369ed77f2a400d92

\Windows\system\DSaqwKz.exe

MD5	94f437f316b304e2375f790c51089c3d
SHA1	69cb60fc9c59c51618892df9be6db51d8732016e
SHA256	0562f29698db0df9762a1eca5e886adb24e31d370870f77f101a494fdf9d3346
SHA512	8890382a55d1189b387e6602b1af7001257f6e1af69590b20a306774f60bd2311f744f20358a72e5268099ce2fb9427d32458bf4e3a87aac7ad8e03aa948838f

\Windows\system\ZruFqUX.exe

MD5	37b96f14bdebe8f8641fa3297d30e8fb
SHA1	e5ddb4ced461b1757f83d45b2c25143d89050311
SHA256	af41f374b8c022276f6c9d7e5f7c676545a1a473bcce55f844436bdd51aeb205
SHA512	8fe0ddbed4c77cad93eb9163d7b07073b574d4150bcf1ce6bc64c0e4757071f71a635bf9b6892cb9b888642ecfad842a1323beb23a644403bcef64a72bfb8fe1

C:\Windows\system\JmvYOeD.exe

MD5	b39087248c9b17d6fa9e704ef21d1102
SHA1	c6b0ec526cdd64112aff865348a120d4dcee3c3c
SHA256	763ef56b9c8d496a509edceeaab5ebe95f5dc7c70c2fbae2418a8e3fa1f53cce
SHA512	2e716738b8aed0e485c68eb2e7ffdb08405dccd512c1bdfc4a472e756a47447b646bee8d7e29834c83c6f1aa4769084edc9b5feac7ebaaf6ced11a908ba924c8

\Windows\system\DTOEncV.exe

MD5	2cf2eb8266e594d33daac6f8a6cfbc3f
SHA1	db017779b26a23a28e2a3ccf56e9fafc4c9f91ff
SHA256	d72b609d6ad21489b5f09a9a509e5bb6681edc30526bb9bdd5dfe4d0887a7c47
SHA512	fdb15a10d770911129b048a40f61a2030e77a383b3a494313d0600aba1c8094bf55461e4ae2fe76c39ea077fb1f7f815ee1d09e920496ac5cf01c8d219cea9b6

\Windows\system\YVPXILi.exe

MD5	3fd0c4c69923858cb6813aed75acb5d9
SHA1	f60edbf3c4532a2b75ce5e025ce8da502efc8c5c
SHA256	b9bdc67c1837fafadccce6b9e8dce3f0b17c49e5d664870fe3379b64b977c672
SHA512	5e73be4f6394795dc25ae5889badf0226a6d2c4b681f8819479598186186817e5ba7c298440d31e27f4ec2ef59952a841207c82f7623d6efe03074c1bb9f2822

memory/1920-72-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

memory/2384-76-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

\Windows\system\hfUHvQp.exe

MD5	9b4d85a581891f3a1f7fcf07d69e99ba
SHA1	1c38184c5d539940a1c473feedbf1efebd9cc396
SHA256	33e6ed1b2ab198c628e2f191ce20081a741b1f67310ddfd7fc5db77375eddac5
SHA512	bff4757e2dee437c21f61ff3a0f17f0065b84bb9cbe28a28d6165943d219cf763023bb8313e69a021fcc6db716e795cebbec9715dda65386603c49cf2fb2a7e1

\Windows\system\hcujssD.exe

MD5	0dcf1bfe5a3d731d3e9cf87660f07259
SHA1	a66bc8f39f17d73d75d687f81e300d41fefa1858
SHA256	09ab16633ebcde4df53003033da277372897824cf71d6a8c9d81db27e08cb0d5
SHA512	a553908d5d70032a849f9b4dbbef1cdaf37a1004a298f8a0fb3a36ceda510e142b11396a126b133f7c89fc34fff7e66cd677a47878024c556ed2960d49862526

memory/2384-89-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

\Windows\system\odXcUpX.exe

MD5	4e560b56d0b142004933cefbb67bb8f5
SHA1	96d34910a097943d500614c865be77eea64dbc0f
SHA256	cb393bb623fe88060108b39fc39b360c35d4df037c97ee0ab60beff6ff370037
SHA512	eb91280c66fb974b2f1346b0f1a669cd9b5ac3a9b8b83f95d04a9a772edb816d93a37792d43c959ad0e48339807b2b350c2a8bc9264d4f716918672bd7c0043e

memory/2384-113-0x00000000030D0000-0x00000000034C2000-memory.dmp

C:\Windows\system\LytIgOn.exe

MD5	a894ec644f7399f20368ffbc7f6050fd
SHA1	ba015d0a24c0547a00230ec4bff694244f8cacd7
SHA256	32c7b068622103cb3a69423b90bfe6b503318c74c0419d58c0c805b45626f8da
SHA512	8da8c4a5b08ffdea8772e6d02476f2b3e53222e0d39b07b5a329757131660f26f150db12f44facf1e69916666ed9385b93072cf10aa0d108e250d71e5f8c1fc5

memory/3012-123-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

memory/2384-127-0x00000000030D0000-0x00000000034C2000-memory.dmp

memory/2384-136-0x000000013F030000-0x000000013F422000-memory.dmp

C:\Windows\system\FMeazxQ.exe

MD5	276c6bc4a896e528ab7ec57192d75eb1
SHA1	9897975c50941bb030d1f23d4a3c81d0cba3b82b
SHA256	49b7b50d4f765d98e64366cf3a3e67e73882c1f981ca9519992f58915fd3b6e7
SHA512	611e41e6308f9663e3450abc8513f93a821041a76af141a2370ed83930e13d84642575b8ca724e9392dff910b13c0a285fb26a323fb25176a5cdf65f39d5e441

C:\Windows\system\jQoDnMS.exe

MD5	f540fecdc415f30e460a03547b745dec
SHA1	c96ff1cd32a4cd96f6fd99aaf615b387a5e39b2f
SHA256	67783d4971634d2a15d0cbad1b344463f9b452baf7a66ef45b9b1856b911deb7
SHA512	e9f1c647ea9c83f2a035303745d82db2199785cba0cf8620dde3743dfa7341d06b255e1d6d902ad6c6bd5015b6a221bd28e9aa3f8e9b1383d69a4c5b5f3aa6d2

memory/588-131-0x000000013FDA0000-0x0000000140192000-memory.dmp

C:\Windows\system\uoSDMuk.exe

MD5	167d84be7792012e121d149839768d25
SHA1	696f52bb9da65d993f7b971118a0bc7fc9b359a2
SHA256	d853cb49c1156804f72d8b23e851eea7b168195cf2d6507e8d20cdd15a550159
SHA512	240635340ca00be8cbd65ba3f50278024f46cd9dcbfdc33507e02141e6eea4b15943f74618afb7fbbba24c4c8b248826aa32e2870f299f7966c911ec8408158b

memory/1920-142-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

\Windows\system\jpWiktU.exe

MD5	9dde6549dd2d27ebd4c2c673378e477c
SHA1	10ae0d9e63fb758bba91ee2ae7c9fc06d673e0b5
SHA256	d212b2d453f3a5e4241bf3f2f24e6ea42eca008cc7dc8ad4b3b9df3419254bbb
SHA512	3db8fed10ec06220b934536bfe041a428a6ae417d84e41e226b54252f58446eecedd540b2ff450b9ee875ac88bc728d6135978ba9b1397bf1a74e9f3f917b6fc

\Windows\system\xcJoHwC.exe

MD5	a79c566b702715b41afe72c7c49ff299
SHA1	a9ba82964ea7bf648a7956ff336ddbaab809ddd5
SHA256	93ed2187205d8a3bd0567e3e028ca4e1c024baffad74c8b9fd71e8ae07e7ac96
SHA512	f42679babc283609f72eff5e343ae5dd374a44153e13650eee1db12fc9000c6a76001d96e2b16c408cc69aac87be3ebe18aaaeb307a7e2ca06e19ec5240d68d4

\Windows\system\kOBkUhM.exe

MD5	d210f8fccb80dc5bc82823a311e6467e
SHA1	55ff1e26f9f0cc61e4bc0727a8edbf2b593d05d5
SHA256	53834913fdd0ae5731a35ba0b6b113d9e3b888be018ceeef242392d8cd9ac223
SHA512	c497e934696742dc52de5947049d036346af9e9eede738f230c6f3b399fbef12533b8c0ff4a19470d8fdd1c598257bcdb3a5e34fba5561e4ee7361827ed7402a

\Windows\system\FVtHQtW.exe

MD5	3826d1bba698d2392e5624c3f4ee1b43
SHA1	add22cd12ce6d2d10c0144702742f6526fb21c86
SHA256	aed5445e10567f9ace4a042aaaecdbbb19ed81755bef592242c4cd23f9251138
SHA512	878f472707aa60b192f1afe804cd3f046f4f0d023c8fc7994703ced5788147734ff6662d0fccce915a62fdf2655df47e7282a7f842968f65858e32938e4b8218

\Windows\system\Khodcis.exe

MD5	b4238e1147f2fa37a14be8d88eaea670
SHA1	0e5180ae5146594390e8c734373bc2877a88e541
SHA256	c0e7d9327700c554e94a0826517d91a6de12f7d8a2263e02f025809007475aac
SHA512	bd3b5c15998a8b992ab832e135dde8c399caa54f53ae50ada4de25576f2e15e7b7e856bb505810ee97d366985b5fd419a4a9ff12a103a5267f6bbe6da88a6c32

memory/2384-143-0x0000000002C20000-0x0000000003012000-memory.dmp

\Windows\system\cFZQaIj.exe

MD5	9faef8a413ffe496ff09d26f1c79e3a7
SHA1	aa44c126b37b200fd78df7ba14f8a8dbd35a7d98
SHA256	786687016f69aa3dcbfc85eaf5563f8a41979b9df44504b1d419c05f74a63d03
SHA512	85ee6e26c4f9d0e9dc431be168eb95352730e12b19f8f95d105f318ea7b795556731698b0c347e05411501c1feeed9a9e2ef92458044e62c85c0ce65e6a9ff12

\Windows\system\VgzNHqZ.exe

MD5	280842ad01b11d26e96d13aa70e59ffb
SHA1	489b6e374f4ae8e743e0657260deda61ac91b43a
SHA256	1a7b22de417f240b0814f957ea38e6ac8b89dcb609c458c136d156f0e5cd9efe
SHA512	649331f14229c505953e7f7976b640c06d3d3e187835fcc42aed576aef0838ea9830714624e60c0b70b9585727dbba85ca8105277fff42266709d36e6ea4f793

\Windows\system\WAfnUWZ.exe

MD5	6e04fd1cfbc0b3a9bfd5492f4f28e0e5
SHA1	54df98c8b3216c25759dc0a0ed37f12602196d10
SHA256	4284df3833f10bf4a31e1500cbeb48d95c23c0fdf2f31902f288a14bf33914df
SHA512	f8c0d12da83929bc0314b8dc30c8fffb5d16e28bebc89fb86e22965d842907597ae40aca10a4859f92d5a93fefe768f84b6904924376e09db09d7a38d575a6cc

C:\Windows\system\yWEsdxT.exe

MD5	decb72d5f9c68972081fd57f35f5fd60
SHA1	4bb0e5d911068caa16250769b6d2add58827d91c
SHA256	1dc66a4c594c1c6e51c8425935bc21d489f9438d3f5b6a47cb66e97f57014262
SHA512	c6755554e4e08dd95f8089e45ddd012ca7d600f7db0303cd90e15a6763df834b507dfcd2ac233f837292558acda1a3c954a079f55d422f4579bc56ae8b972f07

memory/1920-370-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

C:\Windows\system\aZZJMDU.exe

MD5	23c16fd0ee81c36b21d7d0e671d4fcc8
SHA1	e4801acddc1c295700cf5feb0009cd1a673df8ce
SHA256	e413f994e110fefc4a603a0fe823a864b5c8c2e82e7a679ccab37f66373eb709
SHA512	1f7e9f81fde0fd1aa78a8679ff1d3ad9e7b97a0defb3696237c54af854462cb01c44370a0b8e99915069a704cfa772ebc4ea4cb1dea70fa980a8ae3cf9760589

\Windows\system\AIjfbDY.exe

MD5	fdc9c64f082fe7a7a3e3c472876dd30e
SHA1	6221bf08085c7628fd591c2cfd6a0746aeb4234d
SHA256	d82e3e352ddfacd55b9630c175d03bf61d05e6c53232a15cc7b0af5e74687539
SHA512	4f9fb87732922858216790a45eee15d20a403e5100fd60972b4e1519763583baac7a5f8af8307a3addb5a836a694594f3d3a72f51f80028d25a2d7f67ad2bbba

memory/1012-140-0x000000013F030000-0x000000013F422000-memory.dmp

C:\Windows\system\mBKdwTk.exe

MD5	5ac39ad5f89c750d0f745eb193fdee8a
SHA1	c467ac1f04d9efcc773464b9898248b43c604cef
SHA256	7f0ee74cd7e2370754d4a95309cc322dba61da2fcf5bcf739b9a48469240633a
SHA512	614a01fc961bdf8db0ca0788839348dbd82de72f3fd82af861f9f900b8286c110603e520360f76ea29051d0e78feebe28e59611a551441b29da3ea39df190127

C:\Windows\system\ItbeNxn.exe

MD5	a85766d754ce2b6bc034b98c4371fc43
SHA1	2faf5f9ea4d696e18710186f10f186ea25d8244d
SHA256	a7c555a55b59eeed6fce045f399b1de2f3e670ec3f0387de95900a081d7cfca5
SHA512	436a09a3461027f0da45d1ce21ad39351cc95c12752ec77d8edd557e2337432c17834ea4e2708adc1e5f56aada443adc17c687cfda70fb56cdbd286f7502f076

C:\Windows\system\gPcVOsC.exe

MD5	26f184ab2ba1dfa6ff4dd04217338838
SHA1	6f10f942d5e0a56e7d763a18f53f5a8e9a10e7d0
SHA256	ffd3f63419dd21ba6138dbe8fdbaf3176a7131134ebde53ebb37970548556dd6
SHA512	e5b167debd0804c30de9ae0b470a9fec1b72977c21f8d0751599db4d6338c66e75358d74892655ed531d83f370579ad8f72762c4c73cc796636edbb3a3f9a869

memory/2436-126-0x000000013F580000-0x000000013F972000-memory.dmp

memory/2384-125-0x000000013F580000-0x000000013F972000-memory.dmp

C:\Windows\system\HAhfRkW.exe

MD5	28c9e7d67b930e0ac9dc461bbd931f2d
SHA1	cb3dfa9b4a5d17fddd7ec38437b5f7c776adda2b
SHA256	ecb8308a9cc27e01a0ffba23d93479a475710c521596ee9d91575cb118e5a52d
SHA512	b016916d9c9e4ab19a10846cd66beb137632fe1eca5127c54927c984179f3246d5bfbc044b6f4709924f64ce6926534230ec692ee170fc6761069c075945b025

memory/2508-110-0x000000013FFF0000-0x00000001403E2000-memory.dmp

memory/2384-109-0x00000000030D0000-0x00000000034C2000-memory.dmp

memory/3016-124-0x000000013F220000-0x000000013F612000-memory.dmp

memory/2384-122-0x000000013F220000-0x000000013F612000-memory.dmp

memory/2456-106-0x000000013F450000-0x000000013F842000-memory.dmp

memory/2384-105-0x000000013F450000-0x000000013F842000-memory.dmp

memory/1920-121-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

memory/2632-102-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

C:\Windows\system\LJpdZiv.exe

MD5	1f2015e6c17fc58f683b5216746f2cd3
SHA1	1e9920d74ba673697cf2a969ecb38a1ee949c5c4
SHA256	9b6792f4546013ad3c227a4ae4fa3bf13c1120addce138b3b5a2378bf4c6e7fd
SHA512	2b859722d2ea83ac4037faa23f04672d9bfde0e2d204de8c4f2e7c71f8da9a4a8f10fd8b0ad72e92d64bbb7842cddacba7b61a6cde126bb5a7cd83adbb1f2799

C:\Windows\system\nbZAueb.exe

MD5	a6a6c201d837ddbd847ee13b625f8685
SHA1	657d569f3f665649f4f486c6eaca0d34fad402db
SHA256	9669a2902c80f822d47353b7c11789072df800bc3c8396b4abf66f2317be80b6
SHA512	8c7662e289c5bd1bd18ec9303cf8555852de882c8ebfa47f8b78f3821f1f0132a35bfa499e761901aeb9148a974467d6e8dc553d4b4c658cd664eeceee1bc8f5

memory/2484-77-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

memory/2592-75-0x000000013F560000-0x000000013F952000-memory.dmp

memory/2956-73-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

memory/2384-74-0x000000013F560000-0x000000013F952000-memory.dmp

C:\Windows\system\xQVuKEc.exe

MD5	54e93c7ed995d7dd91ba91c2af23cf4b
SHA1	786946c8d23991a9efb4157cc9478ddb86eba580
SHA256	f3324a48466af7d0f80aa457bfc3dbeb77c9253b208c84e55d865de36d4a0732
SHA512	3138c906e482fe5558da9856146d26e6305cdb8c42d6ff2ebb66aea8685434daa45a87db060c11449fef65a59d51f2cd7fae09054e8e2890024ab07a404c1183

memory/1920-58-0x0000000001F40000-0x0000000001F48000-memory.dmp

memory/1920-49-0x000000001B290000-0x000000001B572000-memory.dmp

C:\Windows\system\iDPPkMn.exe

MD5	fb82c6d91a76d8cee14b7a7d21b453e0
SHA1	5146ba58ddf51f21c79a1b449da7890b7d597435
SHA256	ca518e8488333fd6de0c360b539a1e69b06bb18d8b93020cb0cbadbedfbf19a6
SHA512	d3d4a7c9bb99a014ff72cafb8afa708f0951f58b75997dd38262bfe547ca86db12a2c09378eb161359c09c567536253328cd2e39e068cefad5cf2e5caa3aeb89

C:\Windows\system\qAqwbLB.exe

MD5	4cfdeec3e3d8dd84140323a56f543089
SHA1	5b937d7574566ab884c8ed403cf4a9b74a3d24c9
SHA256	a75dd621d15c045cc8ae2c18156b2f18a4e9c149b2549350047268c6fdc09c44
SHA512	9a909be9d1318d448c45c65fa4fca9aaf218f7e6338cc5664c6754004dfc932f52a6a6ad9069256bc189fbe28ccbd02fbec97fb8d1d5ca0d41f562d5a9fe92f6

C:\Windows\system\KdYZdTh.exe

MD5	193baf6cb9d330480d191ee46e69db10
SHA1	7889dee9ea60222d923373e7fa0294f24ebd935b
SHA256	19071e7ac844b84de813032e86c9527ebcd5febebc9bc09bc481b8f46c4c6e50
SHA512	eb549a3c27da0b624ef8c21a2aba0363a84841e311896bb0ab11d64d7ae75f66c8bce9032f88daf3f4517a6b27291dbc9ca31bf5f178a84c175f06cf1da012e2

memory/1920-14-0x0000000002730000-0x00000000027B0000-memory.dmp

memory/2300-13-0x000000013F070000-0x000000013F462000-memory.dmp

memory/2484-4247-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

memory/2632-4260-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

memory/588-4259-0x000000013FDA0000-0x0000000140192000-memory.dmp

memory/2508-4257-0x000000013FFF0000-0x00000001403E2000-memory.dmp

memory/3016-4255-0x000000013F220000-0x000000013F612000-memory.dmp

memory/2456-4289-0x000000013F450000-0x000000013F842000-memory.dmp

memory/1012-4284-0x000000013F030000-0x000000013F422000-memory.dmp

memory/3012-4282-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

memory/2956-4273-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

memory/2436-4280-0x000000013F580000-0x000000013F972000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 22:24

Reported

2024-06-13 22:27

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\qApPejD.exe	N/A
N/A	N/A	C:\Windows\System\uzcduqp.exe	N/A
N/A	N/A	C:\Windows\System\yqNFgPZ.exe	N/A
N/A	N/A	C:\Windows\System\inXNSkE.exe	N/A
N/A	N/A	C:\Windows\System\otcyenN.exe	N/A
N/A	N/A	C:\Windows\System\xQiiGgY.exe	N/A
N/A	N/A	C:\Windows\System\yxJFZvY.exe	N/A
N/A	N/A	C:\Windows\System\VAbpNSK.exe	N/A
N/A	N/A	C:\Windows\System\XMkhSoJ.exe	N/A
N/A	N/A	C:\Windows\System\JPKfhHk.exe	N/A
N/A	N/A	C:\Windows\System\ZtpCNiZ.exe	N/A
N/A	N/A	C:\Windows\System\hzecnfp.exe	N/A
N/A	N/A	C:\Windows\System\kjWvPhZ.exe	N/A
N/A	N/A	C:\Windows\System\wyGhSXq.exe	N/A
N/A	N/A	C:\Windows\System\CPcPvyh.exe	N/A
N/A	N/A	C:\Windows\System\gYzngZs.exe	N/A
N/A	N/A	C:\Windows\System\BWNsKtK.exe	N/A
N/A	N/A	C:\Windows\System\YdENmOq.exe	N/A
N/A	N/A	C:\Windows\System\KelWjxU.exe	N/A
N/A	N/A	C:\Windows\System\EJHtgKt.exe	N/A
N/A	N/A	C:\Windows\System\zjENJtE.exe	N/A
N/A	N/A	C:\Windows\System\xVDbZGz.exe	N/A
N/A	N/A	C:\Windows\System\tLhvkzF.exe	N/A
N/A	N/A	C:\Windows\System\qzpvDUI.exe	N/A
N/A	N/A	C:\Windows\System\TaUJUSM.exe	N/A
N/A	N/A	C:\Windows\System\Ttmmvto.exe	N/A
N/A	N/A	C:\Windows\System\ivFEDEu.exe	N/A
N/A	N/A	C:\Windows\System\yMltmDh.exe	N/A
N/A	N/A	C:\Windows\System\vpnCSNJ.exe	N/A
N/A	N/A	C:\Windows\System\zhAdFab.exe	N/A
N/A	N/A	C:\Windows\System\sdePyTZ.exe	N/A
N/A	N/A	C:\Windows\System\itDvJuM.exe	N/A
N/A	N/A	C:\Windows\System\kKTQXwC.exe	N/A
N/A	N/A	C:\Windows\System\TxWzFvp.exe	N/A
N/A	N/A	C:\Windows\System\Qwhlozh.exe	N/A
N/A	N/A	C:\Windows\System\cAuvuUF.exe	N/A
N/A	N/A	C:\Windows\System\JIyTJRR.exe	N/A
N/A	N/A	C:\Windows\System\AEBpgcy.exe	N/A
N/A	N/A	C:\Windows\System\iCESrdR.exe	N/A
N/A	N/A	C:\Windows\System\goqSNiV.exe	N/A
N/A	N/A	C:\Windows\System\sVnRtKe.exe	N/A
N/A	N/A	C:\Windows\System\ZlNODHD.exe	N/A
N/A	N/A	C:\Windows\System\sqnFvHl.exe	N/A
N/A	N/A	C:\Windows\System\cIcBPYU.exe	N/A
N/A	N/A	C:\Windows\System\cZWeGIh.exe	N/A
N/A	N/A	C:\Windows\System\AdlAJXY.exe	N/A
N/A	N/A	C:\Windows\System\KRbKfIH.exe	N/A
N/A	N/A	C:\Windows\System\xaJsIux.exe	N/A
N/A	N/A	C:\Windows\System\OLafFWn.exe	N/A
N/A	N/A	C:\Windows\System\rMWjBjf.exe	N/A
N/A	N/A	C:\Windows\System\qXaPvan.exe	N/A
N/A	N/A	C:\Windows\System\NokMnyn.exe	N/A
N/A	N/A	C:\Windows\System\TKslDzJ.exe	N/A
N/A	N/A	C:\Windows\System\HivFswg.exe	N/A
N/A	N/A	C:\Windows\System\MieeDIS.exe	N/A
N/A	N/A	C:\Windows\System\tpIcLUQ.exe	N/A
N/A	N/A	C:\Windows\System\bVuWuuL.exe	N/A
N/A	N/A	C:\Windows\System\WRSOTPj.exe	N/A
N/A	N/A	C:\Windows\System\CbapfVg.exe	N/A
N/A	N/A	C:\Windows\System\eptnZgT.exe	N/A
N/A	N/A	C:\Windows\System\ijxmWjm.exe	N/A
N/A	N/A	C:\Windows\System\GclSFWV.exe	N/A
N/A	N/A	C:\Windows\System\sGSQiqN.exe	N/A
N/A	N/A	C:\Windows\System\pXjydWL.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\IrzYhtI.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VSWnlDM.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aXFkGAc.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FEolVmg.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qXHzouh.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TZQDFrk.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GENEDXs.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FYvPosi.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RzmwqJa.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FNwceas.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ADuyHKH.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ntkUQyb.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\egGsqqX.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NUCfirh.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oFaQJjP.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vVyGhlU.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eetabQQ.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sYGywoS.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HqNVxbZ.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\elbLsUr.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xWMfeQu.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LAmDdKf.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lzpkoFG.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ktvAZWu.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SaCZxri.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hlfDsWO.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QNVXWpd.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PYHWhTk.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sToxxQd.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lSbaIRh.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wJCwplc.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wWoFqHT.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xmnOTua.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jouCqED.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OSELpEU.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gkmCHZI.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JYWvNcV.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DcLXDOS.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fgQTpxS.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OIHzUuN.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UZlHQRN.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\miWLnQU.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RZzxruU.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ySuylAH.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VnUKlCh.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tfFIbKD.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sQizvES.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kXnNrzz.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nJeXvWG.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OUABQcR.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BNcxNwL.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bPTUSZr.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YHhWQbq.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mMLNnUX.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wTVXgqP.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PuRYAjM.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MsHJvCK.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pVOwQnG.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xnBfvdn.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XbgyGCc.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tCcCNNz.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tcFETaq.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MhxpeLQ.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FSjzfwY.exe	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2592 wrote to memory of 5040	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2592 wrote to memory of 5040	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2592 wrote to memory of 3468	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\qApPejD.exe
PID 2592 wrote to memory of 3468	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\qApPejD.exe
PID 2592 wrote to memory of 4036	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\uzcduqp.exe
PID 2592 wrote to memory of 4036	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\uzcduqp.exe
PID 2592 wrote to memory of 1560	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\yqNFgPZ.exe
PID 2592 wrote to memory of 1560	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\yqNFgPZ.exe
PID 2592 wrote to memory of 2724	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\yxJFZvY.exe
PID 2592 wrote to memory of 2724	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\yxJFZvY.exe
PID 2592 wrote to memory of 1656	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\inXNSkE.exe
PID 2592 wrote to memory of 1656	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\inXNSkE.exe
PID 2592 wrote to memory of 3980	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\otcyenN.exe
PID 2592 wrote to memory of 3980	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\otcyenN.exe
PID 2592 wrote to memory of 3352	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\xQiiGgY.exe
PID 2592 wrote to memory of 3352	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\xQiiGgY.exe
PID 2592 wrote to memory of 4540	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\VAbpNSK.exe
PID 2592 wrote to memory of 4540	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\VAbpNSK.exe
PID 2592 wrote to memory of 3068	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\wyGhSXq.exe
PID 2592 wrote to memory of 3068	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\wyGhSXq.exe
PID 2592 wrote to memory of 5064	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\XMkhSoJ.exe
PID 2592 wrote to memory of 5064	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\XMkhSoJ.exe
PID 2592 wrote to memory of 2324	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\JPKfhHk.exe
PID 2592 wrote to memory of 2324	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\JPKfhHk.exe
PID 2592 wrote to memory of 4264	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\ZtpCNiZ.exe
PID 2592 wrote to memory of 4264	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\ZtpCNiZ.exe
PID 2592 wrote to memory of 2380	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\hzecnfp.exe
PID 2592 wrote to memory of 2380	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\hzecnfp.exe
PID 2592 wrote to memory of 3340	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\kjWvPhZ.exe
PID 2592 wrote to memory of 3340	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\kjWvPhZ.exe
PID 2592 wrote to memory of 3168	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\CPcPvyh.exe
PID 2592 wrote to memory of 3168	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\CPcPvyh.exe
PID 2592 wrote to memory of 2196	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\gYzngZs.exe
PID 2592 wrote to memory of 2196	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\gYzngZs.exe
PID 2592 wrote to memory of 3348	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\BWNsKtK.exe
PID 2592 wrote to memory of 3348	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\BWNsKtK.exe
PID 2592 wrote to memory of 1472	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\YdENmOq.exe
PID 2592 wrote to memory of 1472	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\YdENmOq.exe
PID 2592 wrote to memory of 4088	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\KelWjxU.exe
PID 2592 wrote to memory of 4088	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\KelWjxU.exe
PID 2592 wrote to memory of 908	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\EJHtgKt.exe
PID 2592 wrote to memory of 908	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\EJHtgKt.exe
PID 2592 wrote to memory of 4576	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\zjENJtE.exe
PID 2592 wrote to memory of 4576	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\zjENJtE.exe
PID 2592 wrote to memory of 1060	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\xVDbZGz.exe
PID 2592 wrote to memory of 1060	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\xVDbZGz.exe
PID 2592 wrote to memory of 4296	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\tLhvkzF.exe
PID 2592 wrote to memory of 4296	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\tLhvkzF.exe
PID 2592 wrote to memory of 1940	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\qzpvDUI.exe
PID 2592 wrote to memory of 1940	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\qzpvDUI.exe
PID 2592 wrote to memory of 2904	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\TaUJUSM.exe
PID 2592 wrote to memory of 2904	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\TaUJUSM.exe
PID 2592 wrote to memory of 3876	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\kKTQXwC.exe
PID 2592 wrote to memory of 3876	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\kKTQXwC.exe
PID 2592 wrote to memory of 5000	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\Ttmmvto.exe
PID 2592 wrote to memory of 5000	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\Ttmmvto.exe
PID 2592 wrote to memory of 4692	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\ivFEDEu.exe
PID 2592 wrote to memory of 4692	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\ivFEDEu.exe
PID 2592 wrote to memory of 4148	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\yMltmDh.exe
PID 2592 wrote to memory of 4148	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\yMltmDh.exe
PID 2592 wrote to memory of 1488	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\vpnCSNJ.exe
PID 2592 wrote to memory of 1488	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\vpnCSNJ.exe
PID 2592 wrote to memory of 3164	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\zhAdFab.exe
PID 2592 wrote to memory of 3164	N/A	C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe	C:\Windows\System\zhAdFab.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\qApPejD.exe

C:\Windows\System\qApPejD.exe

C:\Windows\System\uzcduqp.exe

C:\Windows\System\uzcduqp.exe

C:\Windows\System\yqNFgPZ.exe

C:\Windows\System\yqNFgPZ.exe

C:\Windows\System\yxJFZvY.exe

C:\Windows\System\yxJFZvY.exe

C:\Windows\System\inXNSkE.exe

C:\Windows\System\inXNSkE.exe

C:\Windows\System\otcyenN.exe

C:\Windows\System\otcyenN.exe

C:\Windows\System\xQiiGgY.exe

C:\Windows\System\xQiiGgY.exe

C:\Windows\System\VAbpNSK.exe

C:\Windows\System\VAbpNSK.exe

C:\Windows\System\wyGhSXq.exe

C:\Windows\System\wyGhSXq.exe

C:\Windows\System\XMkhSoJ.exe

C:\Windows\System\XMkhSoJ.exe

C:\Windows\System\JPKfhHk.exe

C:\Windows\System\JPKfhHk.exe

C:\Windows\System\ZtpCNiZ.exe

C:\Windows\System\ZtpCNiZ.exe

C:\Windows\System\hzecnfp.exe

C:\Windows\System\hzecnfp.exe

C:\Windows\System\kjWvPhZ.exe

C:\Windows\System\kjWvPhZ.exe

C:\Windows\System\CPcPvyh.exe

C:\Windows\System\CPcPvyh.exe

C:\Windows\System\gYzngZs.exe

C:\Windows\System\gYzngZs.exe

C:\Windows\System\BWNsKtK.exe

C:\Windows\System\BWNsKtK.exe

C:\Windows\System\YdENmOq.exe

C:\Windows\System\YdENmOq.exe

C:\Windows\System\KelWjxU.exe

C:\Windows\System\KelWjxU.exe

C:\Windows\System\EJHtgKt.exe

C:\Windows\System\EJHtgKt.exe

C:\Windows\System\zjENJtE.exe

C:\Windows\System\zjENJtE.exe

C:\Windows\System\xVDbZGz.exe

C:\Windows\System\xVDbZGz.exe

C:\Windows\System\tLhvkzF.exe

C:\Windows\System\tLhvkzF.exe

C:\Windows\System\qzpvDUI.exe

C:\Windows\System\qzpvDUI.exe

C:\Windows\System\TaUJUSM.exe

C:\Windows\System\TaUJUSM.exe

C:\Windows\System\kKTQXwC.exe

C:\Windows\System\kKTQXwC.exe

C:\Windows\System\Ttmmvto.exe

C:\Windows\System\Ttmmvto.exe

C:\Windows\System\ivFEDEu.exe

C:\Windows\System\ivFEDEu.exe

C:\Windows\System\yMltmDh.exe

C:\Windows\System\yMltmDh.exe

C:\Windows\System\vpnCSNJ.exe

C:\Windows\System\vpnCSNJ.exe

C:\Windows\System\zhAdFab.exe

C:\Windows\System\zhAdFab.exe

C:\Windows\System\sdePyTZ.exe

C:\Windows\System\sdePyTZ.exe

C:\Windows\System\itDvJuM.exe

C:\Windows\System\itDvJuM.exe

C:\Windows\System\TxWzFvp.exe

C:\Windows\System\TxWzFvp.exe

C:\Windows\System\Qwhlozh.exe

C:\Windows\System\Qwhlozh.exe

C:\Windows\System\cAuvuUF.exe

C:\Windows\System\cAuvuUF.exe

C:\Windows\System\JIyTJRR.exe

C:\Windows\System\JIyTJRR.exe

C:\Windows\System\AEBpgcy.exe

C:\Windows\System\AEBpgcy.exe

C:\Windows\System\iCESrdR.exe

C:\Windows\System\iCESrdR.exe

C:\Windows\System\goqSNiV.exe

C:\Windows\System\goqSNiV.exe

C:\Windows\System\sVnRtKe.exe

C:\Windows\System\sVnRtKe.exe

C:\Windows\System\ZlNODHD.exe

C:\Windows\System\ZlNODHD.exe

C:\Windows\System\sqnFvHl.exe

C:\Windows\System\sqnFvHl.exe

C:\Windows\System\cIcBPYU.exe

C:\Windows\System\cIcBPYU.exe

C:\Windows\System\cZWeGIh.exe

C:\Windows\System\cZWeGIh.exe

C:\Windows\System\AdlAJXY.exe

C:\Windows\System\AdlAJXY.exe

C:\Windows\System\KRbKfIH.exe

C:\Windows\System\KRbKfIH.exe

C:\Windows\System\xaJsIux.exe

C:\Windows\System\xaJsIux.exe

C:\Windows\System\OLafFWn.exe

C:\Windows\System\OLafFWn.exe

C:\Windows\System\rMWjBjf.exe

C:\Windows\System\rMWjBjf.exe

C:\Windows\System\qXaPvan.exe

C:\Windows\System\qXaPvan.exe

C:\Windows\System\NokMnyn.exe

C:\Windows\System\NokMnyn.exe

C:\Windows\System\TKslDzJ.exe

C:\Windows\System\TKslDzJ.exe

C:\Windows\System\HivFswg.exe

C:\Windows\System\HivFswg.exe

C:\Windows\System\MieeDIS.exe

C:\Windows\System\MieeDIS.exe

C:\Windows\System\tpIcLUQ.exe

C:\Windows\System\tpIcLUQ.exe

C:\Windows\System\bVuWuuL.exe

C:\Windows\System\bVuWuuL.exe

C:\Windows\System\WRSOTPj.exe

C:\Windows\System\WRSOTPj.exe

C:\Windows\System\CbapfVg.exe

C:\Windows\System\CbapfVg.exe

C:\Windows\System\eptnZgT.exe

C:\Windows\System\eptnZgT.exe

C:\Windows\System\ijxmWjm.exe

C:\Windows\System\ijxmWjm.exe

C:\Windows\System\GclSFWV.exe

C:\Windows\System\GclSFWV.exe

C:\Windows\System\sGSQiqN.exe

C:\Windows\System\sGSQiqN.exe

C:\Windows\System\pXjydWL.exe

C:\Windows\System\pXjydWL.exe

C:\Windows\System\BCcOORy.exe

C:\Windows\System\BCcOORy.exe

C:\Windows\System\UrRymgE.exe

C:\Windows\System\UrRymgE.exe

C:\Windows\System\BDeesDW.exe

C:\Windows\System\BDeesDW.exe

C:\Windows\System\OqauSCn.exe

C:\Windows\System\OqauSCn.exe

C:\Windows\System\avaJvRA.exe

C:\Windows\System\avaJvRA.exe

C:\Windows\System\QVcsloU.exe

C:\Windows\System\QVcsloU.exe

C:\Windows\System\zCQmOFO.exe

C:\Windows\System\zCQmOFO.exe

C:\Windows\System\PjovBhy.exe

C:\Windows\System\PjovBhy.exe

C:\Windows\System\JJfbwAw.exe

C:\Windows\System\JJfbwAw.exe

C:\Windows\System\jHEmuoV.exe

C:\Windows\System\jHEmuoV.exe

C:\Windows\System\lYtAZiJ.exe

C:\Windows\System\lYtAZiJ.exe

C:\Windows\System\XUcAjRq.exe

C:\Windows\System\XUcAjRq.exe

C:\Windows\System\ynzUfBr.exe

C:\Windows\System\ynzUfBr.exe

C:\Windows\System\KnjXCFW.exe

C:\Windows\System\KnjXCFW.exe

C:\Windows\System\YESQrME.exe

C:\Windows\System\YESQrME.exe

C:\Windows\System\NStPaFe.exe

C:\Windows\System\NStPaFe.exe

C:\Windows\System\ZVzgKwD.exe

C:\Windows\System\ZVzgKwD.exe

C:\Windows\System\GhEkECy.exe

C:\Windows\System\GhEkECy.exe

C:\Windows\System\LapneMg.exe

C:\Windows\System\LapneMg.exe

C:\Windows\System\YEiyngs.exe

C:\Windows\System\YEiyngs.exe

C:\Windows\System\Ojhubqb.exe

C:\Windows\System\Ojhubqb.exe

C:\Windows\System\nxXeYgw.exe

C:\Windows\System\nxXeYgw.exe

C:\Windows\System\VyPCuly.exe

C:\Windows\System\VyPCuly.exe

C:\Windows\System\crISsZp.exe

C:\Windows\System\crISsZp.exe

C:\Windows\System\iGlOaUt.exe

C:\Windows\System\iGlOaUt.exe

C:\Windows\System\JiKAHaj.exe

C:\Windows\System\JiKAHaj.exe

C:\Windows\System\klUHyWm.exe

C:\Windows\System\klUHyWm.exe

C:\Windows\System\nfQwmti.exe

C:\Windows\System\nfQwmti.exe

C:\Windows\System\PEQfkew.exe

C:\Windows\System\PEQfkew.exe

C:\Windows\System\kistWGd.exe

C:\Windows\System\kistWGd.exe

C:\Windows\System\ezVAJVQ.exe

C:\Windows\System\ezVAJVQ.exe

C:\Windows\System\sPgwRQX.exe

C:\Windows\System\sPgwRQX.exe

C:\Windows\System\xmLmLEh.exe

C:\Windows\System\xmLmLEh.exe

C:\Windows\System\fgqmgWv.exe

C:\Windows\System\fgqmgWv.exe

C:\Windows\System\hhUjmXF.exe

C:\Windows\System\hhUjmXF.exe

C:\Windows\System\BbxBdGT.exe

C:\Windows\System\BbxBdGT.exe

C:\Windows\System\ptqnOAt.exe

C:\Windows\System\ptqnOAt.exe

C:\Windows\System\dqGDkAQ.exe

C:\Windows\System\dqGDkAQ.exe

C:\Windows\System\qdiVXvT.exe

C:\Windows\System\qdiVXvT.exe

C:\Windows\System\LDqmjWl.exe

C:\Windows\System\LDqmjWl.exe

C:\Windows\System\AsyGyIA.exe

C:\Windows\System\AsyGyIA.exe

C:\Windows\System\gdBDwtf.exe

C:\Windows\System\gdBDwtf.exe

C:\Windows\System\MxqnfML.exe

C:\Windows\System\MxqnfML.exe

C:\Windows\System\pLhihlV.exe

C:\Windows\System\pLhihlV.exe

C:\Windows\System\bwNwJKm.exe

C:\Windows\System\bwNwJKm.exe

C:\Windows\System\BVYTMLS.exe

C:\Windows\System\BVYTMLS.exe

C:\Windows\System\YZSdRtU.exe

C:\Windows\System\YZSdRtU.exe

C:\Windows\System\idvBWdo.exe

C:\Windows\System\idvBWdo.exe

C:\Windows\System\uDhsnHu.exe

C:\Windows\System\uDhsnHu.exe

C:\Windows\System\efYkiLi.exe

C:\Windows\System\efYkiLi.exe

C:\Windows\System\AOgZRNK.exe

C:\Windows\System\AOgZRNK.exe

C:\Windows\System\RNIJrPg.exe

C:\Windows\System\RNIJrPg.exe

C:\Windows\System\ycgxOuF.exe

C:\Windows\System\ycgxOuF.exe

C:\Windows\System\ddfdcWo.exe

C:\Windows\System\ddfdcWo.exe

C:\Windows\System\eCkvUHj.exe

C:\Windows\System\eCkvUHj.exe

C:\Windows\System\FcONXFU.exe

C:\Windows\System\FcONXFU.exe

C:\Windows\System\xRGVoOo.exe

C:\Windows\System\xRGVoOo.exe

C:\Windows\System\KiSenMJ.exe

C:\Windows\System\KiSenMJ.exe

C:\Windows\System\bXEWLln.exe

C:\Windows\System\bXEWLln.exe

C:\Windows\System\VdjaLLz.exe

C:\Windows\System\VdjaLLz.exe

C:\Windows\System\gTOCrjA.exe

C:\Windows\System\gTOCrjA.exe

C:\Windows\System\xtRzFZG.exe

C:\Windows\System\xtRzFZG.exe

C:\Windows\System\ICgsnwg.exe

C:\Windows\System\ICgsnwg.exe

C:\Windows\System\NpmngFu.exe

C:\Windows\System\NpmngFu.exe

C:\Windows\System\RRhfWmJ.exe

C:\Windows\System\RRhfWmJ.exe

C:\Windows\System\ptvfPUW.exe

C:\Windows\System\ptvfPUW.exe

C:\Windows\System\MrniRUU.exe

C:\Windows\System\MrniRUU.exe

C:\Windows\System\cvSUSHj.exe

C:\Windows\System\cvSUSHj.exe

C:\Windows\System\iOOphKW.exe

C:\Windows\System\iOOphKW.exe

C:\Windows\System\OuWrKkI.exe

C:\Windows\System\OuWrKkI.exe

C:\Windows\System\FVcESpM.exe

C:\Windows\System\FVcESpM.exe

C:\Windows\System\MRKUBCN.exe

C:\Windows\System\MRKUBCN.exe

C:\Windows\System\PkFjVwe.exe

C:\Windows\System\PkFjVwe.exe

C:\Windows\System\OAAmIEG.exe

C:\Windows\System\OAAmIEG.exe

C:\Windows\System\wlQlSJb.exe

C:\Windows\System\wlQlSJb.exe

C:\Windows\System\WEUHMPM.exe

C:\Windows\System\WEUHMPM.exe

C:\Windows\System\KJcAMoc.exe

C:\Windows\System\KJcAMoc.exe

C:\Windows\System\xLxZNrs.exe

C:\Windows\System\xLxZNrs.exe

C:\Windows\System\fKabLoW.exe

C:\Windows\System\fKabLoW.exe

C:\Windows\System\qujIBSG.exe

C:\Windows\System\qujIBSG.exe

C:\Windows\System\uHjyBNk.exe

C:\Windows\System\uHjyBNk.exe

C:\Windows\System\nbrTXqw.exe

C:\Windows\System\nbrTXqw.exe

C:\Windows\System\HcajHUN.exe

C:\Windows\System\HcajHUN.exe

C:\Windows\System\gfzIpIf.exe

C:\Windows\System\gfzIpIf.exe

C:\Windows\System\ZlaGanE.exe

C:\Windows\System\ZlaGanE.exe

C:\Windows\System\GiIWFxe.exe

C:\Windows\System\GiIWFxe.exe

C:\Windows\System\JGsKOaD.exe

C:\Windows\System\JGsKOaD.exe

C:\Windows\System\spMVvOs.exe

C:\Windows\System\spMVvOs.exe

C:\Windows\System\HbUEUhe.exe

C:\Windows\System\HbUEUhe.exe

C:\Windows\System\FpNDstS.exe

C:\Windows\System\FpNDstS.exe

C:\Windows\System\gHCXaod.exe

C:\Windows\System\gHCXaod.exe

C:\Windows\System\UIdaUtf.exe

C:\Windows\System\UIdaUtf.exe

C:\Windows\System\vzfBwOB.exe

C:\Windows\System\vzfBwOB.exe

C:\Windows\System\JjcNeay.exe

C:\Windows\System\JjcNeay.exe

C:\Windows\System\mAVMISJ.exe

C:\Windows\System\mAVMISJ.exe

C:\Windows\System\DDLSFRr.exe

C:\Windows\System\DDLSFRr.exe

C:\Windows\System\KLpHkDe.exe

C:\Windows\System\KLpHkDe.exe

C:\Windows\System\SVNRjGY.exe

C:\Windows\System\SVNRjGY.exe

C:\Windows\System\hIrNxIn.exe

C:\Windows\System\hIrNxIn.exe

C:\Windows\System\XTmMWPQ.exe

C:\Windows\System\XTmMWPQ.exe

C:\Windows\System\hGyfAfY.exe

C:\Windows\System\hGyfAfY.exe

C:\Windows\System\TJlnAwN.exe

C:\Windows\System\TJlnAwN.exe

C:\Windows\System\kkNhuMR.exe

C:\Windows\System\kkNhuMR.exe

C:\Windows\System\iUZoaTP.exe

C:\Windows\System\iUZoaTP.exe

C:\Windows\System\wIDNLxu.exe

C:\Windows\System\wIDNLxu.exe

C:\Windows\System\rDtbOcC.exe

C:\Windows\System\rDtbOcC.exe

C:\Windows\System\jnVAtqm.exe

C:\Windows\System\jnVAtqm.exe

C:\Windows\System\PjhQKob.exe

C:\Windows\System\PjhQKob.exe

C:\Windows\System\YaoZldF.exe

C:\Windows\System\YaoZldF.exe

C:\Windows\System\LmuEOnL.exe

C:\Windows\System\LmuEOnL.exe

C:\Windows\System\skyZGhI.exe

C:\Windows\System\skyZGhI.exe

C:\Windows\System\mfdNelF.exe

C:\Windows\System\mfdNelF.exe

C:\Windows\System\EwmCXEO.exe

C:\Windows\System\EwmCXEO.exe

C:\Windows\System\dVlEXgX.exe

C:\Windows\System\dVlEXgX.exe

C:\Windows\System\mArPRxa.exe

C:\Windows\System\mArPRxa.exe

C:\Windows\System\KjqAzex.exe

C:\Windows\System\KjqAzex.exe

C:\Windows\System\kgViJJE.exe

C:\Windows\System\kgViJJE.exe

C:\Windows\System\dwKGfOw.exe

C:\Windows\System\dwKGfOw.exe

C:\Windows\System\mKgKwqA.exe

C:\Windows\System\mKgKwqA.exe

C:\Windows\System\PCXqgjr.exe

C:\Windows\System\PCXqgjr.exe

C:\Windows\System\AOnKGsh.exe

C:\Windows\System\AOnKGsh.exe

C:\Windows\System\xqJBghZ.exe

C:\Windows\System\xqJBghZ.exe

C:\Windows\System\yDqekIk.exe

C:\Windows\System\yDqekIk.exe

C:\Windows\System\dGzzBEE.exe

C:\Windows\System\dGzzBEE.exe

C:\Windows\System\mGTWtDP.exe

C:\Windows\System\mGTWtDP.exe

C:\Windows\System\hbzKEqS.exe

C:\Windows\System\hbzKEqS.exe

C:\Windows\System\dSUVUAz.exe

C:\Windows\System\dSUVUAz.exe

C:\Windows\System\TDVQpwK.exe

C:\Windows\System\TDVQpwK.exe

C:\Windows\System\ScQFIpQ.exe

C:\Windows\System\ScQFIpQ.exe

C:\Windows\System\ZVZcoMm.exe

C:\Windows\System\ZVZcoMm.exe

C:\Windows\System\RZoRGZB.exe

C:\Windows\System\RZoRGZB.exe

C:\Windows\System\apwxlDK.exe

C:\Windows\System\apwxlDK.exe

C:\Windows\System\pEaQsHR.exe

C:\Windows\System\pEaQsHR.exe

C:\Windows\System\VreALvU.exe

C:\Windows\System\VreALvU.exe

C:\Windows\System\tszDJfG.exe

C:\Windows\System\tszDJfG.exe

C:\Windows\System\piksPzO.exe

C:\Windows\System\piksPzO.exe

C:\Windows\System\vchYdOY.exe

C:\Windows\System\vchYdOY.exe

C:\Windows\System\wIZqjWe.exe

C:\Windows\System\wIZqjWe.exe

C:\Windows\System\HULaElf.exe

C:\Windows\System\HULaElf.exe

C:\Windows\System\XwXwtsJ.exe

C:\Windows\System\XwXwtsJ.exe

C:\Windows\System\VqFLjze.exe

C:\Windows\System\VqFLjze.exe

C:\Windows\System\JQiouLZ.exe

C:\Windows\System\JQiouLZ.exe

C:\Windows\System\LIcUxTV.exe

C:\Windows\System\LIcUxTV.exe

C:\Windows\System\hlBHhAc.exe

C:\Windows\System\hlBHhAc.exe

C:\Windows\System\ZrCVrNe.exe

C:\Windows\System\ZrCVrNe.exe

C:\Windows\System\nRbpXLo.exe

C:\Windows\System\nRbpXLo.exe

C:\Windows\System\yqPWRQt.exe

C:\Windows\System\yqPWRQt.exe

C:\Windows\System\ejmvlve.exe

C:\Windows\System\ejmvlve.exe

C:\Windows\System\TvifflE.exe

C:\Windows\System\TvifflE.exe

C:\Windows\System\SzMNaMI.exe

C:\Windows\System\SzMNaMI.exe

C:\Windows\System\PaHIySQ.exe

C:\Windows\System\PaHIySQ.exe

C:\Windows\System\xekfTop.exe

C:\Windows\System\xekfTop.exe

C:\Windows\System\dcFERtf.exe

C:\Windows\System\dcFERtf.exe

C:\Windows\System\LmNueor.exe

C:\Windows\System\LmNueor.exe

C:\Windows\System\MMwiAyD.exe

C:\Windows\System\MMwiAyD.exe

C:\Windows\System\fBxCRLr.exe

C:\Windows\System\fBxCRLr.exe

C:\Windows\System\iJuetSw.exe

C:\Windows\System\iJuetSw.exe

C:\Windows\System\XhxDoYn.exe

C:\Windows\System\XhxDoYn.exe

C:\Windows\System\ovyaCCC.exe

C:\Windows\System\ovyaCCC.exe

C:\Windows\System\FiumCTR.exe

C:\Windows\System\FiumCTR.exe

C:\Windows\System\zktScSH.exe

C:\Windows\System\zktScSH.exe

C:\Windows\System\jVxzPGb.exe

C:\Windows\System\jVxzPGb.exe

C:\Windows\System\oquOpCD.exe

C:\Windows\System\oquOpCD.exe

C:\Windows\System\WTtNHPF.exe

C:\Windows\System\WTtNHPF.exe

C:\Windows\System\vQGSAvx.exe

C:\Windows\System\vQGSAvx.exe

C:\Windows\System\ToSBmGn.exe

C:\Windows\System\ToSBmGn.exe

C:\Windows\System\WTmAlAb.exe

C:\Windows\System\WTmAlAb.exe

C:\Windows\System\owxPGIy.exe

C:\Windows\System\owxPGIy.exe

C:\Windows\System\bcbtjMw.exe

C:\Windows\System\bcbtjMw.exe

C:\Windows\System\csyLRYy.exe

C:\Windows\System\csyLRYy.exe

C:\Windows\System\NnVQTgE.exe

C:\Windows\System\NnVQTgE.exe

C:\Windows\System\yvbMtOs.exe

C:\Windows\System\yvbMtOs.exe

C:\Windows\System\harOGNT.exe

C:\Windows\System\harOGNT.exe

C:\Windows\System\lnamfNd.exe

C:\Windows\System\lnamfNd.exe

C:\Windows\System\UFpSVrh.exe

C:\Windows\System\UFpSVrh.exe

C:\Windows\System\ZozYCtk.exe

C:\Windows\System\ZozYCtk.exe

C:\Windows\System\DqmGfjx.exe

C:\Windows\System\DqmGfjx.exe

C:\Windows\System\GGPtGZa.exe

C:\Windows\System\GGPtGZa.exe

C:\Windows\System\ypSURud.exe

C:\Windows\System\ypSURud.exe

C:\Windows\System\JdrAdsz.exe

C:\Windows\System\JdrAdsz.exe

C:\Windows\System\dSGhCZs.exe

C:\Windows\System\dSGhCZs.exe

C:\Windows\System\tvLBawU.exe

C:\Windows\System\tvLBawU.exe

C:\Windows\System\eXSSDzh.exe

C:\Windows\System\eXSSDzh.exe

C:\Windows\System\NXFmPaP.exe

C:\Windows\System\NXFmPaP.exe

C:\Windows\System\dQXBuVm.exe

C:\Windows\System\dQXBuVm.exe

C:\Windows\System\DxtcjnI.exe

C:\Windows\System\DxtcjnI.exe

C:\Windows\System\NFMpuhn.exe

C:\Windows\System\NFMpuhn.exe

C:\Windows\System\yACtZLB.exe

C:\Windows\System\yACtZLB.exe

C:\Windows\System\yfkREwd.exe

C:\Windows\System\yfkREwd.exe

C:\Windows\System\imIzCVn.exe

C:\Windows\System\imIzCVn.exe

C:\Windows\System\rDzYEnu.exe

C:\Windows\System\rDzYEnu.exe

C:\Windows\System\BjQhnxt.exe

C:\Windows\System\BjQhnxt.exe

C:\Windows\System\tMsAqKv.exe

C:\Windows\System\tMsAqKv.exe

C:\Windows\System\phOgboD.exe

C:\Windows\System\phOgboD.exe

C:\Windows\System\pGFxlOh.exe

C:\Windows\System\pGFxlOh.exe

C:\Windows\System\yQUCbOW.exe

C:\Windows\System\yQUCbOW.exe

C:\Windows\System\ToqXAdn.exe

C:\Windows\System\ToqXAdn.exe

C:\Windows\System\xlxeUkA.exe

C:\Windows\System\xlxeUkA.exe

C:\Windows\System\aYnEesQ.exe

C:\Windows\System\aYnEesQ.exe

C:\Windows\System\MVZUdQR.exe

C:\Windows\System\MVZUdQR.exe

C:\Windows\System\flIPIvq.exe

C:\Windows\System\flIPIvq.exe

C:\Windows\System\laxCLro.exe

C:\Windows\System\laxCLro.exe

C:\Windows\System\seeuLOe.exe

C:\Windows\System\seeuLOe.exe

C:\Windows\System\IlAngvj.exe

C:\Windows\System\IlAngvj.exe

C:\Windows\System\QGqaqDj.exe

C:\Windows\System\QGqaqDj.exe

C:\Windows\System\PmxpnLz.exe

C:\Windows\System\PmxpnLz.exe

C:\Windows\System\kHImXtY.exe

C:\Windows\System\kHImXtY.exe

C:\Windows\System\gbTfWax.exe

C:\Windows\System\gbTfWax.exe

C:\Windows\System\QDSWgPf.exe

C:\Windows\System\QDSWgPf.exe

C:\Windows\System\KMffsJS.exe

C:\Windows\System\KMffsJS.exe

C:\Windows\System\cZQZNZK.exe

C:\Windows\System\cZQZNZK.exe

C:\Windows\System\pAQMCEq.exe

C:\Windows\System\pAQMCEq.exe

C:\Windows\System\wGjmYvp.exe

C:\Windows\System\wGjmYvp.exe

C:\Windows\System\ThmRaWe.exe

C:\Windows\System\ThmRaWe.exe

C:\Windows\System\mTMrwpJ.exe

C:\Windows\System\mTMrwpJ.exe

C:\Windows\System\kqniIvV.exe

C:\Windows\System\kqniIvV.exe

C:\Windows\System\UigGZgM.exe

C:\Windows\System\UigGZgM.exe

C:\Windows\System\ViAhNUv.exe

C:\Windows\System\ViAhNUv.exe

C:\Windows\System\GfvWHFg.exe

C:\Windows\System\GfvWHFg.exe

C:\Windows\System\DjGrREQ.exe

C:\Windows\System\DjGrREQ.exe

C:\Windows\System\AGpbWfR.exe

C:\Windows\System\AGpbWfR.exe

C:\Windows\System\DwQWuVj.exe

C:\Windows\System\DwQWuVj.exe

C:\Windows\System\mayCgEj.exe

C:\Windows\System\mayCgEj.exe

C:\Windows\System\SLRTQdJ.exe

C:\Windows\System\SLRTQdJ.exe

C:\Windows\System\yaHXPbJ.exe

C:\Windows\System\yaHXPbJ.exe

C:\Windows\System\oAhtdvI.exe

C:\Windows\System\oAhtdvI.exe

C:\Windows\System\KvVIjQF.exe

C:\Windows\System\KvVIjQF.exe

C:\Windows\System\mkCgjhH.exe

C:\Windows\System\mkCgjhH.exe

C:\Windows\System\RyOEQvQ.exe

C:\Windows\System\RyOEQvQ.exe

C:\Windows\System\vYSAoaB.exe

C:\Windows\System\vYSAoaB.exe

C:\Windows\System\pImHamZ.exe

C:\Windows\System\pImHamZ.exe

C:\Windows\System\JjxZjaQ.exe

C:\Windows\System\JjxZjaQ.exe

C:\Windows\System\OlsHxeO.exe

C:\Windows\System\OlsHxeO.exe

C:\Windows\System\ZcnnmEJ.exe

C:\Windows\System\ZcnnmEJ.exe

C:\Windows\System\GuEYDnv.exe

C:\Windows\System\GuEYDnv.exe

C:\Windows\System\epnWwHS.exe

C:\Windows\System\epnWwHS.exe

C:\Windows\System\RuOvcJW.exe

C:\Windows\System\RuOvcJW.exe

C:\Windows\System\BpkqzVj.exe

C:\Windows\System\BpkqzVj.exe

C:\Windows\System\aKvFdhC.exe

C:\Windows\System\aKvFdhC.exe

C:\Windows\System\ffNEsFi.exe

C:\Windows\System\ffNEsFi.exe

C:\Windows\System\voXUydI.exe

C:\Windows\System\voXUydI.exe

C:\Windows\System\vltNuvs.exe

C:\Windows\System\vltNuvs.exe

C:\Windows\System\qwClDrF.exe

C:\Windows\System\qwClDrF.exe

C:\Windows\System\Mghmjlk.exe

C:\Windows\System\Mghmjlk.exe

C:\Windows\System\GTTpsaX.exe

C:\Windows\System\GTTpsaX.exe

C:\Windows\System\ffmSHpk.exe

C:\Windows\System\ffmSHpk.exe

C:\Windows\System\oQCBpXn.exe

C:\Windows\System\oQCBpXn.exe

C:\Windows\System\JOnCuRS.exe

C:\Windows\System\JOnCuRS.exe

C:\Windows\System\yGxZmhX.exe

C:\Windows\System\yGxZmhX.exe

C:\Windows\System\RucibFI.exe

C:\Windows\System\RucibFI.exe

C:\Windows\System\PKDwRGU.exe

C:\Windows\System\PKDwRGU.exe

C:\Windows\System\NKOVNNF.exe

C:\Windows\System\NKOVNNF.exe

C:\Windows\System\WKlIMdF.exe

C:\Windows\System\WKlIMdF.exe

C:\Windows\System\YZyRHjo.exe

C:\Windows\System\YZyRHjo.exe

C:\Windows\System\CMPAbVl.exe

C:\Windows\System\CMPAbVl.exe

C:\Windows\System\qqnJqVG.exe

C:\Windows\System\qqnJqVG.exe

C:\Windows\System\QAcNbrP.exe

C:\Windows\System\QAcNbrP.exe

C:\Windows\System\raQYcBr.exe

C:\Windows\System\raQYcBr.exe

C:\Windows\System\JiqHhBm.exe

C:\Windows\System\JiqHhBm.exe

C:\Windows\System\bniqBbt.exe

C:\Windows\System\bniqBbt.exe

C:\Windows\System\pvGJNMM.exe

C:\Windows\System\pvGJNMM.exe

C:\Windows\System\WnxjfQg.exe

C:\Windows\System\WnxjfQg.exe

C:\Windows\System\IVuSvPb.exe

C:\Windows\System\IVuSvPb.exe

C:\Windows\System\zDLcdGC.exe

C:\Windows\System\zDLcdGC.exe

C:\Windows\System\tOgQyyQ.exe

C:\Windows\System\tOgQyyQ.exe

C:\Windows\System\VTCOMur.exe

C:\Windows\System\VTCOMur.exe

C:\Windows\System\BiKCUjv.exe

C:\Windows\System\BiKCUjv.exe

C:\Windows\System\XazjnNJ.exe

C:\Windows\System\XazjnNJ.exe

C:\Windows\System\hNLZToR.exe

C:\Windows\System\hNLZToR.exe

C:\Windows\System\xEykfIl.exe

C:\Windows\System\xEykfIl.exe

C:\Windows\System\nKaujun.exe

C:\Windows\System\nKaujun.exe

C:\Windows\System\pURGUlv.exe

C:\Windows\System\pURGUlv.exe

C:\Windows\System\hXJJdcx.exe

C:\Windows\System\hXJJdcx.exe

C:\Windows\System\VLzBLQj.exe

C:\Windows\System\VLzBLQj.exe

C:\Windows\System\hkyoRDu.exe

C:\Windows\System\hkyoRDu.exe

C:\Windows\System\xVrTdsV.exe

C:\Windows\System\xVrTdsV.exe

C:\Windows\System\gVUGWyl.exe

C:\Windows\System\gVUGWyl.exe

C:\Windows\System\ODWSpSQ.exe

C:\Windows\System\ODWSpSQ.exe

C:\Windows\System\LNfsmyC.exe

C:\Windows\System\LNfsmyC.exe

C:\Windows\System\OhzbGGy.exe

C:\Windows\System\OhzbGGy.exe

C:\Windows\System\woZdAFW.exe

C:\Windows\System\woZdAFW.exe

C:\Windows\System\CVkchBo.exe

C:\Windows\System\CVkchBo.exe

C:\Windows\System\kBFdqom.exe

C:\Windows\System\kBFdqom.exe

C:\Windows\System\Qautlcl.exe

C:\Windows\System\Qautlcl.exe

C:\Windows\System\JpInZZg.exe

C:\Windows\System\JpInZZg.exe

C:\Windows\System\kzOTSNg.exe

C:\Windows\System\kzOTSNg.exe

C:\Windows\System\upIDgeo.exe

C:\Windows\System\upIDgeo.exe

C:\Windows\System\jPovkZv.exe

C:\Windows\System\jPovkZv.exe

C:\Windows\System\mFvtdqW.exe

C:\Windows\System\mFvtdqW.exe

C:\Windows\System\RxFTDQT.exe

C:\Windows\System\RxFTDQT.exe

C:\Windows\System\HGcUduO.exe

C:\Windows\System\HGcUduO.exe

C:\Windows\System\jxlgCJs.exe

C:\Windows\System\jxlgCJs.exe

C:\Windows\System\yOiuOIx.exe

C:\Windows\System\yOiuOIx.exe

C:\Windows\System\BBzdNhX.exe

C:\Windows\System\BBzdNhX.exe

C:\Windows\System\CokBXfQ.exe

C:\Windows\System\CokBXfQ.exe

C:\Windows\System\tcVLOIk.exe

C:\Windows\System\tcVLOIk.exe

C:\Windows\System\OLUqbXQ.exe

C:\Windows\System\OLUqbXQ.exe

C:\Windows\System\tOHKPdS.exe

C:\Windows\System\tOHKPdS.exe

C:\Windows\System\qUUYcjp.exe

C:\Windows\System\qUUYcjp.exe

C:\Windows\System\feltyuQ.exe

C:\Windows\System\feltyuQ.exe

C:\Windows\System\YryQTyg.exe

C:\Windows\System\YryQTyg.exe

C:\Windows\System\SDEfLQh.exe

C:\Windows\System\SDEfLQh.exe

C:\Windows\System\BYWqXEP.exe

C:\Windows\System\BYWqXEP.exe

C:\Windows\System\cBLuOfm.exe

C:\Windows\System\cBLuOfm.exe

C:\Windows\System\kXzcgxk.exe

C:\Windows\System\kXzcgxk.exe

C:\Windows\System\nTfovCf.exe

C:\Windows\System\nTfovCf.exe

C:\Windows\System\JFBqmFw.exe

C:\Windows\System\JFBqmFw.exe

C:\Windows\System\VsOObUC.exe

C:\Windows\System\VsOObUC.exe

C:\Windows\System\BLgcTfH.exe

C:\Windows\System\BLgcTfH.exe

C:\Windows\System\qsvsoZw.exe

C:\Windows\System\qsvsoZw.exe

C:\Windows\System\bGgoHlU.exe

C:\Windows\System\bGgoHlU.exe

C:\Windows\System\lghurQS.exe

C:\Windows\System\lghurQS.exe

C:\Windows\System\ZdeXQTU.exe

C:\Windows\System\ZdeXQTU.exe

C:\Windows\System\liUBgwy.exe

C:\Windows\System\liUBgwy.exe

C:\Windows\System\cFtTpYU.exe

C:\Windows\System\cFtTpYU.exe

C:\Windows\System\slhDoWe.exe

C:\Windows\System\slhDoWe.exe

C:\Windows\System\oVeGWzs.exe

C:\Windows\System\oVeGWzs.exe

C:\Windows\System\PkzoHgN.exe

C:\Windows\System\PkzoHgN.exe

C:\Windows\System\eWOKdiM.exe

C:\Windows\System\eWOKdiM.exe

C:\Windows\System\mLSBKHS.exe

C:\Windows\System\mLSBKHS.exe

C:\Windows\System\QRJcqqj.exe

C:\Windows\System\QRJcqqj.exe

C:\Windows\System\BDWnRzB.exe

C:\Windows\System\BDWnRzB.exe

C:\Windows\System\kRrGqQl.exe

C:\Windows\System\kRrGqQl.exe

C:\Windows\System\RDmTFnR.exe

C:\Windows\System\RDmTFnR.exe

C:\Windows\System\RkuHwYO.exe

C:\Windows\System\RkuHwYO.exe

C:\Windows\System\syIIFmo.exe

C:\Windows\System\syIIFmo.exe

C:\Windows\System\HmrqEpJ.exe

C:\Windows\System\HmrqEpJ.exe

C:\Windows\System\sXhIWBl.exe

C:\Windows\System\sXhIWBl.exe

C:\Windows\System\sIjiQgn.exe

C:\Windows\System\sIjiQgn.exe

C:\Windows\System\curVyZF.exe

C:\Windows\System\curVyZF.exe

C:\Windows\System\xdpitha.exe

C:\Windows\System\xdpitha.exe

C:\Windows\System\jUMJsuv.exe

C:\Windows\System\jUMJsuv.exe

C:\Windows\System\pmJToVO.exe

C:\Windows\System\pmJToVO.exe

C:\Windows\System\RDpEaND.exe

C:\Windows\System\RDpEaND.exe

C:\Windows\System\KSCkjxj.exe

C:\Windows\System\KSCkjxj.exe

C:\Windows\System\uDTpnVc.exe

C:\Windows\System\uDTpnVc.exe

C:\Windows\System\KlZlYPi.exe

C:\Windows\System\KlZlYPi.exe

C:\Windows\System\CYvamDJ.exe

C:\Windows\System\CYvamDJ.exe

C:\Windows\System\uJPWepA.exe

C:\Windows\System\uJPWepA.exe

C:\Windows\System\KTNDXCF.exe

C:\Windows\System\KTNDXCF.exe

C:\Windows\System\reKNKmb.exe

C:\Windows\System\reKNKmb.exe

C:\Windows\System\daYZHFm.exe

C:\Windows\System\daYZHFm.exe

C:\Windows\System\YEpqrps.exe

C:\Windows\System\YEpqrps.exe

C:\Windows\System\PCXlBey.exe

C:\Windows\System\PCXlBey.exe

C:\Windows\System\ZzIJCoH.exe

C:\Windows\System\ZzIJCoH.exe

C:\Windows\System\mqUeeqI.exe

C:\Windows\System\mqUeeqI.exe

C:\Windows\System\Yqsbjge.exe

C:\Windows\System\Yqsbjge.exe

C:\Windows\System\KlnWvSa.exe

C:\Windows\System\KlnWvSa.exe

C:\Windows\System\ZWYXFEZ.exe

C:\Windows\System\ZWYXFEZ.exe

C:\Windows\System\qLFNOTF.exe

C:\Windows\System\qLFNOTF.exe

C:\Windows\System\XRHKQxd.exe

C:\Windows\System\XRHKQxd.exe

C:\Windows\System\PioasAf.exe

C:\Windows\System\PioasAf.exe

C:\Windows\System\nMtQPZg.exe

C:\Windows\System\nMtQPZg.exe

C:\Windows\System\URtQzis.exe

C:\Windows\System\URtQzis.exe

C:\Windows\System\TXgEZOM.exe

C:\Windows\System\TXgEZOM.exe

C:\Windows\System\unGeUUS.exe

C:\Windows\System\unGeUUS.exe

C:\Windows\System\aByQxWl.exe

C:\Windows\System\aByQxWl.exe

C:\Windows\System\cybsYza.exe

C:\Windows\System\cybsYza.exe

C:\Windows\System\jiIjeGy.exe

C:\Windows\System\jiIjeGy.exe

C:\Windows\System\AApQlYb.exe

C:\Windows\System\AApQlYb.exe

C:\Windows\System\DhCjIWL.exe

C:\Windows\System\DhCjIWL.exe

C:\Windows\System\QbMBWCt.exe

C:\Windows\System\QbMBWCt.exe

C:\Windows\System\eITwSPt.exe

C:\Windows\System\eITwSPt.exe

C:\Windows\System\ihthEEK.exe

C:\Windows\System\ihthEEK.exe

C:\Windows\System\CUFsfYM.exe

C:\Windows\System\CUFsfYM.exe

C:\Windows\System\oeSOxab.exe

C:\Windows\System\oeSOxab.exe

C:\Windows\System\NeTcoLN.exe

C:\Windows\System\NeTcoLN.exe

C:\Windows\System\UJxNmZb.exe

C:\Windows\System\UJxNmZb.exe

C:\Windows\System\DjdZRUo.exe

C:\Windows\System\DjdZRUo.exe

C:\Windows\System\KfxLRhd.exe

C:\Windows\System\KfxLRhd.exe

C:\Windows\System\vaoGyzN.exe

C:\Windows\System\vaoGyzN.exe

C:\Windows\System\SsBvfGs.exe

C:\Windows\System\SsBvfGs.exe

C:\Windows\System\cVZbXdy.exe

C:\Windows\System\cVZbXdy.exe

C:\Windows\System\aWmgnvM.exe

C:\Windows\System\aWmgnvM.exe

C:\Windows\System\bFlObOS.exe

C:\Windows\System\bFlObOS.exe

C:\Windows\System\EYrtwIl.exe

C:\Windows\System\EYrtwIl.exe

C:\Windows\System\YMwPqoq.exe

C:\Windows\System\YMwPqoq.exe

C:\Windows\System\hpgHhAb.exe

C:\Windows\System\hpgHhAb.exe

C:\Windows\System\AHQxPuF.exe

C:\Windows\System\AHQxPuF.exe

C:\Windows\System\VRVyuiX.exe

C:\Windows\System\VRVyuiX.exe

C:\Windows\System\aSAcEWo.exe

C:\Windows\System\aSAcEWo.exe

C:\Windows\System\bwiSrQO.exe

C:\Windows\System\bwiSrQO.exe

C:\Windows\System\HUnmyFz.exe

C:\Windows\System\HUnmyFz.exe

C:\Windows\System\prNMDRf.exe

C:\Windows\System\prNMDRf.exe

C:\Windows\System\CXkVtvC.exe

C:\Windows\System\CXkVtvC.exe

C:\Windows\System\qGUqbqh.exe

C:\Windows\System\qGUqbqh.exe

C:\Windows\System\ZmtwtoX.exe

C:\Windows\System\ZmtwtoX.exe

C:\Windows\System\AzUlliZ.exe

C:\Windows\System\AzUlliZ.exe

C:\Windows\System\MwWxjYe.exe

C:\Windows\System\MwWxjYe.exe

C:\Windows\System\bWwknDk.exe

C:\Windows\System\bWwknDk.exe

C:\Windows\System\DYSkzyQ.exe

C:\Windows\System\DYSkzyQ.exe

C:\Windows\System\xibLssq.exe

C:\Windows\System\xibLssq.exe

C:\Windows\System\svsOppZ.exe

C:\Windows\System\svsOppZ.exe

C:\Windows\System\bVcApBq.exe

C:\Windows\System\bVcApBq.exe

C:\Windows\System\QShlokn.exe

C:\Windows\System\QShlokn.exe

C:\Windows\System\UbkxlRR.exe

C:\Windows\System\UbkxlRR.exe

C:\Windows\System\NRutfTd.exe

C:\Windows\System\NRutfTd.exe

C:\Windows\System\ByCqIkR.exe

C:\Windows\System\ByCqIkR.exe

C:\Windows\System\TjBHuiq.exe

C:\Windows\System\TjBHuiq.exe

C:\Windows\System\iURjMRH.exe

C:\Windows\System\iURjMRH.exe

C:\Windows\System\xDUzDKQ.exe

C:\Windows\System\xDUzDKQ.exe

C:\Windows\System\LYDPDmy.exe

C:\Windows\System\LYDPDmy.exe

C:\Windows\System\psBUNcw.exe

C:\Windows\System\psBUNcw.exe

C:\Windows\System\NatRUgB.exe

C:\Windows\System\NatRUgB.exe

C:\Windows\System\JGXrfeb.exe

C:\Windows\System\JGXrfeb.exe

C:\Windows\System\WOEOILF.exe

C:\Windows\System\WOEOILF.exe

C:\Windows\System\zTQKHIB.exe

C:\Windows\System\zTQKHIB.exe

C:\Windows\System\giTyVTk.exe

C:\Windows\System\giTyVTk.exe

C:\Windows\System\TztsIrJ.exe

C:\Windows\System\TztsIrJ.exe

C:\Windows\System\pWkbhot.exe

C:\Windows\System\pWkbhot.exe

C:\Windows\System\oVSdVNh.exe

C:\Windows\System\oVSdVNh.exe

C:\Windows\System\pRLExLT.exe

C:\Windows\System\pRLExLT.exe

C:\Windows\System\ArbPzfs.exe

C:\Windows\System\ArbPzfs.exe

C:\Windows\System\twDqdMu.exe

C:\Windows\System\twDqdMu.exe

C:\Windows\System\kyRLTQy.exe

C:\Windows\System\kyRLTQy.exe

C:\Windows\System\BnLiWZZ.exe

C:\Windows\System\BnLiWZZ.exe

C:\Windows\System\BQKmLaC.exe

C:\Windows\System\BQKmLaC.exe

C:\Windows\System\WnhZkZL.exe

C:\Windows\System\WnhZkZL.exe

C:\Windows\System\vobYSSB.exe

C:\Windows\System\vobYSSB.exe

C:\Windows\System\KidlFmY.exe

C:\Windows\System\KidlFmY.exe

C:\Windows\System\ViWiJkq.exe

C:\Windows\System\ViWiJkq.exe

C:\Windows\System\LgcEbvs.exe

C:\Windows\System\LgcEbvs.exe

C:\Windows\System\WwKERIZ.exe

C:\Windows\System\WwKERIZ.exe

C:\Windows\System\PutVqvz.exe

C:\Windows\System\PutVqvz.exe

C:\Windows\System\eYFWsQt.exe

C:\Windows\System\eYFWsQt.exe

C:\Windows\System\yHBYmVC.exe

C:\Windows\System\yHBYmVC.exe

C:\Windows\System\cHXbuwX.exe

C:\Windows\System\cHXbuwX.exe

C:\Windows\System\BsIEckA.exe

C:\Windows\System\BsIEckA.exe

C:\Windows\System\rvVTBut.exe

C:\Windows\System\rvVTBut.exe

C:\Windows\System\IOCrnvZ.exe

C:\Windows\System\IOCrnvZ.exe

C:\Windows\System\aljoFwe.exe

C:\Windows\System\aljoFwe.exe

C:\Windows\System\Qgknjjj.exe

C:\Windows\System\Qgknjjj.exe

C:\Windows\System\uzFsutc.exe

C:\Windows\System\uzFsutc.exe

C:\Windows\System\sObOUth.exe

C:\Windows\System\sObOUth.exe

C:\Windows\System\cZMuvTw.exe

C:\Windows\System\cZMuvTw.exe

C:\Windows\System\FdVayvm.exe

C:\Windows\System\FdVayvm.exe

C:\Windows\System\SPHxlUn.exe

C:\Windows\System\SPHxlUn.exe

C:\Windows\System\rsHGOUZ.exe

C:\Windows\System\rsHGOUZ.exe

C:\Windows\System\oEzpDaX.exe

C:\Windows\System\oEzpDaX.exe

C:\Windows\System\HjNwPpa.exe

C:\Windows\System\HjNwPpa.exe

C:\Windows\System\tgswvYA.exe

C:\Windows\System\tgswvYA.exe

C:\Windows\System\AyIQdcC.exe

C:\Windows\System\AyIQdcC.exe

C:\Windows\System\wnPXRFp.exe

C:\Windows\System\wnPXRFp.exe

C:\Windows\System\DNUDvoh.exe

C:\Windows\System\DNUDvoh.exe

C:\Windows\System\fVOWQRS.exe

C:\Windows\System\fVOWQRS.exe

C:\Windows\System\BpWNtWP.exe

C:\Windows\System\BpWNtWP.exe

C:\Windows\System\ujOYSeb.exe

C:\Windows\System\ujOYSeb.exe

C:\Windows\System\jaZjZMy.exe

C:\Windows\System\jaZjZMy.exe

C:\Windows\System\pdqnEDS.exe

C:\Windows\System\pdqnEDS.exe

C:\Windows\System\iUzBHtg.exe

C:\Windows\System\iUzBHtg.exe

C:\Windows\System\WZuugQC.exe

C:\Windows\System\WZuugQC.exe

C:\Windows\System\cUJqQvZ.exe

C:\Windows\System\cUJqQvZ.exe

C:\Windows\System\THuGAQd.exe

C:\Windows\System\THuGAQd.exe

C:\Windows\System\EyPBTzJ.exe

C:\Windows\System\EyPBTzJ.exe

C:\Windows\System\JDrXJZG.exe

C:\Windows\System\JDrXJZG.exe

C:\Windows\System\FQBarAK.exe

C:\Windows\System\FQBarAK.exe

C:\Windows\System\tSnockQ.exe

C:\Windows\System\tSnockQ.exe

C:\Windows\System\MBRqtFs.exe

C:\Windows\System\MBRqtFs.exe

C:\Windows\System\KbdIQTS.exe

C:\Windows\System\KbdIQTS.exe

C:\Windows\System\inlKpLb.exe

C:\Windows\System\inlKpLb.exe

C:\Windows\System\MMoaPlm.exe

C:\Windows\System\MMoaPlm.exe

C:\Windows\System\raCBdaT.exe

C:\Windows\System\raCBdaT.exe

C:\Windows\System\QkBoUzh.exe

C:\Windows\System\QkBoUzh.exe

C:\Windows\System\phkxlKI.exe

C:\Windows\System\phkxlKI.exe

C:\Windows\System\RhBGBfq.exe

C:\Windows\System\RhBGBfq.exe

C:\Windows\System\SGHEIqx.exe

C:\Windows\System\SGHEIqx.exe

C:\Windows\System\gTOSpPi.exe

C:\Windows\System\gTOSpPi.exe

C:\Windows\System\olPlxIF.exe

C:\Windows\System\olPlxIF.exe

C:\Windows\System\vYMJBPV.exe

C:\Windows\System\vYMJBPV.exe

C:\Windows\System\zPLUFHj.exe

C:\Windows\System\zPLUFHj.exe

C:\Windows\System\OeaIWpX.exe

C:\Windows\System\OeaIWpX.exe

C:\Windows\System\cwUTnEI.exe

C:\Windows\System\cwUTnEI.exe

C:\Windows\System\OXxEQIC.exe

C:\Windows\System\OXxEQIC.exe

C:\Windows\System\owIVNnd.exe

C:\Windows\System\owIVNnd.exe

C:\Windows\System\fHdHMGZ.exe

C:\Windows\System\fHdHMGZ.exe

C:\Windows\System\RZprpyg.exe

C:\Windows\System\RZprpyg.exe

C:\Windows\System\nqDLVKO.exe

C:\Windows\System\nqDLVKO.exe

C:\Windows\System\xtLjvDQ.exe

C:\Windows\System\xtLjvDQ.exe

C:\Windows\System\zoFJgZk.exe

C:\Windows\System\zoFJgZk.exe

C:\Windows\System\rHTNpeS.exe

C:\Windows\System\rHTNpeS.exe

C:\Windows\System\slEdrBc.exe

C:\Windows\System\slEdrBc.exe

C:\Windows\System\IINtqhE.exe

C:\Windows\System\IINtqhE.exe

C:\Windows\System\NXLYweD.exe

C:\Windows\System\NXLYweD.exe

C:\Windows\System\KBHyBPy.exe

C:\Windows\System\KBHyBPy.exe

C:\Windows\System\TmPLmra.exe

C:\Windows\System\TmPLmra.exe

C:\Windows\System\ATcOimv.exe

C:\Windows\System\ATcOimv.exe

C:\Windows\System\uzOqLoo.exe

C:\Windows\System\uzOqLoo.exe

C:\Windows\System\kPpyUgK.exe

C:\Windows\System\kPpyUgK.exe

C:\Windows\System\mocXwpI.exe

C:\Windows\System\mocXwpI.exe

C:\Windows\System\nVCCTfS.exe

C:\Windows\System\nVCCTfS.exe

C:\Windows\System\mFPemBn.exe

C:\Windows\System\mFPemBn.exe

C:\Windows\System\uvkAIbT.exe

C:\Windows\System\uvkAIbT.exe

C:\Windows\System\bQFffBW.exe

C:\Windows\System\bQFffBW.exe

C:\Windows\System\QihVEmn.exe

C:\Windows\System\QihVEmn.exe

C:\Windows\System\txoOUgE.exe

C:\Windows\System\txoOUgE.exe

C:\Windows\System\SeSBJqh.exe

C:\Windows\System\SeSBJqh.exe

C:\Windows\System\rsrYtlU.exe

C:\Windows\System\rsrYtlU.exe

C:\Windows\System\CMmcUCK.exe

C:\Windows\System\CMmcUCK.exe

C:\Windows\System\tmgdhSx.exe

C:\Windows\System\tmgdhSx.exe

C:\Windows\System\BCgzEec.exe

C:\Windows\System\BCgzEec.exe

C:\Windows\System\DqkTrPS.exe

C:\Windows\System\DqkTrPS.exe

C:\Windows\System\GmnFgsd.exe

C:\Windows\System\GmnFgsd.exe

C:\Windows\System\eIshqUV.exe

C:\Windows\System\eIshqUV.exe

C:\Windows\System\EJzeDTp.exe

C:\Windows\System\EJzeDTp.exe

C:\Windows\System\nFzLPSJ.exe

C:\Windows\System\nFzLPSJ.exe

C:\Windows\System\qmshhJv.exe

C:\Windows\System\qmshhJv.exe

C:\Windows\System\uzSdtZn.exe

C:\Windows\System\uzSdtZn.exe

C:\Windows\System\OeNVzxy.exe

C:\Windows\System\OeNVzxy.exe

C:\Windows\System\DEvjNlf.exe

C:\Windows\System\DEvjNlf.exe

C:\Windows\System\ozlBrnI.exe

C:\Windows\System\ozlBrnI.exe

C:\Windows\System\dnnnxHe.exe

C:\Windows\System\dnnnxHe.exe

C:\Windows\System\dfAaJHM.exe

C:\Windows\System\dfAaJHM.exe

C:\Windows\System\VkNfNqe.exe

C:\Windows\System\VkNfNqe.exe

C:\Windows\System\xcdTbQk.exe

C:\Windows\System\xcdTbQk.exe

C:\Windows\System\eMUnJFQ.exe

C:\Windows\System\eMUnJFQ.exe

C:\Windows\System\xqjvqqt.exe

C:\Windows\System\xqjvqqt.exe

C:\Windows\System\pAfvpKN.exe

C:\Windows\System\pAfvpKN.exe

C:\Windows\System\tDUfXNt.exe

C:\Windows\System\tDUfXNt.exe

C:\Windows\System\jSiIbbl.exe

C:\Windows\System\jSiIbbl.exe

C:\Windows\System\wEownxz.exe

C:\Windows\System\wEownxz.exe

C:\Windows\System\vhgPnuH.exe

C:\Windows\System\vhgPnuH.exe

C:\Windows\System\NhKwDaM.exe

C:\Windows\System\NhKwDaM.exe

C:\Windows\System\DyNHhmX.exe

C:\Windows\System\DyNHhmX.exe

C:\Windows\System\BjpVkra.exe

C:\Windows\System\BjpVkra.exe

C:\Windows\System\mESoEpd.exe

C:\Windows\System\mESoEpd.exe

C:\Windows\System\ybjmCmV.exe

C:\Windows\System\ybjmCmV.exe

C:\Windows\System\rCUGVKd.exe

C:\Windows\System\rCUGVKd.exe

C:\Windows\System\XUHfYMT.exe

C:\Windows\System\XUHfYMT.exe

C:\Windows\System\nCDIdLb.exe

C:\Windows\System\nCDIdLb.exe

C:\Windows\System\CRTofvu.exe

C:\Windows\System\CRTofvu.exe

C:\Windows\System\uXptjYL.exe

C:\Windows\System\uXptjYL.exe

C:\Windows\System\FzXKhZT.exe

C:\Windows\System\FzXKhZT.exe

C:\Windows\System\vjJjuJW.exe

C:\Windows\System\vjJjuJW.exe

C:\Windows\System\qQMJbHN.exe

C:\Windows\System\qQMJbHN.exe

C:\Windows\System\nCeznGE.exe

C:\Windows\System\nCeznGE.exe

C:\Windows\System\hjXHjcX.exe

C:\Windows\System\hjXHjcX.exe

C:\Windows\System\uoamobz.exe

C:\Windows\System\uoamobz.exe

C:\Windows\System\wzTBCvV.exe

C:\Windows\System\wzTBCvV.exe

C:\Windows\System\RntrHlf.exe

C:\Windows\System\RntrHlf.exe

C:\Windows\System\eOyWJyi.exe

C:\Windows\System\eOyWJyi.exe

C:\Windows\System\vwAysQE.exe

C:\Windows\System\vwAysQE.exe

C:\Windows\System\RnpCGIG.exe

C:\Windows\System\RnpCGIG.exe

C:\Windows\System\sCGiqFb.exe

C:\Windows\System\sCGiqFb.exe

C:\Windows\System\heFfeks.exe

C:\Windows\System\heFfeks.exe

C:\Windows\System\ggOHqDl.exe

C:\Windows\System\ggOHqDl.exe

C:\Windows\System\LEdtPtw.exe

C:\Windows\System\LEdtPtw.exe

C:\Windows\System\oKDaMnZ.exe

C:\Windows\System\oKDaMnZ.exe

C:\Windows\System\iauZpyG.exe

C:\Windows\System\iauZpyG.exe

C:\Windows\System\xAiAaDG.exe

C:\Windows\System\xAiAaDG.exe

C:\Windows\System\aEnOkgL.exe

C:\Windows\System\aEnOkgL.exe

C:\Windows\System\nmBgfnh.exe

C:\Windows\System\nmBgfnh.exe

C:\Windows\System\KjkwHbJ.exe

C:\Windows\System\KjkwHbJ.exe

C:\Windows\System\DRISLRM.exe

C:\Windows\System\DRISLRM.exe

C:\Windows\System\dAytBmB.exe

C:\Windows\System\dAytBmB.exe

C:\Windows\System\gQOxHsz.exe

C:\Windows\System\gQOxHsz.exe

C:\Windows\System\nQstudI.exe

C:\Windows\System\nQstudI.exe

C:\Windows\System\sRjeGoS.exe

C:\Windows\System\sRjeGoS.exe

C:\Windows\System\EbkBOqB.exe

C:\Windows\System\EbkBOqB.exe

C:\Windows\System\RVMdfaR.exe

C:\Windows\System\RVMdfaR.exe

C:\Windows\System\EQARHpa.exe

C:\Windows\System\EQARHpa.exe

C:\Windows\System\jmCeUPI.exe

C:\Windows\System\jmCeUPI.exe

C:\Windows\System\IpZqcxD.exe

C:\Windows\System\IpZqcxD.exe

C:\Windows\System\DWTKtic.exe

C:\Windows\System\DWTKtic.exe

C:\Windows\System\MSuvuck.exe

C:\Windows\System\MSuvuck.exe

C:\Windows\System\PSlXeNH.exe

C:\Windows\System\PSlXeNH.exe

C:\Windows\System\ouiuVyA.exe

C:\Windows\System\ouiuVyA.exe

C:\Windows\System\LFMOADP.exe

C:\Windows\System\LFMOADP.exe

C:\Windows\System\GhjPsAL.exe

C:\Windows\System\GhjPsAL.exe

C:\Windows\System\YOcioUN.exe

C:\Windows\System\YOcioUN.exe

C:\Windows\System\QsltCai.exe

C:\Windows\System\QsltCai.exe

C:\Windows\System\tQRTFgG.exe

C:\Windows\System\tQRTFgG.exe

C:\Windows\System\AWXFwKS.exe

C:\Windows\System\AWXFwKS.exe

C:\Windows\System\ozwhrub.exe

C:\Windows\System\ozwhrub.exe

C:\Windows\System\DyrCYqV.exe

C:\Windows\System\DyrCYqV.exe

C:\Windows\System\yJWSezw.exe

C:\Windows\System\yJWSezw.exe

C:\Windows\System\cyBFXaP.exe

C:\Windows\System\cyBFXaP.exe

C:\Windows\System\FwtltcE.exe

C:\Windows\System\FwtltcE.exe

C:\Windows\System\SkQUfPY.exe

C:\Windows\System\SkQUfPY.exe

C:\Windows\System\XtKyXac.exe

C:\Windows\System\XtKyXac.exe

C:\Windows\System\RZdTXwn.exe

C:\Windows\System\RZdTXwn.exe

C:\Windows\System\PJcYiAV.exe

C:\Windows\System\PJcYiAV.exe

C:\Windows\System\QTAUySL.exe

C:\Windows\System\QTAUySL.exe

C:\Windows\System\uUiNtKF.exe

C:\Windows\System\uUiNtKF.exe

C:\Windows\System\fudnYfS.exe

C:\Windows\System\fudnYfS.exe

C:\Windows\System\htyqZbz.exe

C:\Windows\System\htyqZbz.exe

C:\Windows\System\fSHTsyi.exe

C:\Windows\System\fSHTsyi.exe

C:\Windows\System\DrcaQvH.exe

C:\Windows\System\DrcaQvH.exe

C:\Windows\System\TQQrwJU.exe

C:\Windows\System\TQQrwJU.exe

C:\Windows\System\IHDoNwk.exe

C:\Windows\System\IHDoNwk.exe

C:\Windows\System\qWsmWco.exe

C:\Windows\System\qWsmWco.exe

C:\Windows\System\ktkdcgD.exe

C:\Windows\System\ktkdcgD.exe

C:\Windows\System\nGWeRhp.exe

C:\Windows\System\nGWeRhp.exe

C:\Windows\System\AxvFzqT.exe

C:\Windows\System\AxvFzqT.exe

C:\Windows\System\DRVyfEA.exe

C:\Windows\System\DRVyfEA.exe

C:\Windows\System\VeviLdF.exe

C:\Windows\System\VeviLdF.exe

C:\Windows\System\cYyVTUN.exe

C:\Windows\System\cYyVTUN.exe

C:\Windows\System\IdFzLro.exe

C:\Windows\System\IdFzLro.exe

C:\Windows\System\kuPoalC.exe

C:\Windows\System\kuPoalC.exe

C:\Windows\System\GKeUXqp.exe

C:\Windows\System\GKeUXqp.exe

C:\Windows\System\QrgVRfy.exe

C:\Windows\System\QrgVRfy.exe

C:\Windows\System\DANOwrT.exe

C:\Windows\System\DANOwrT.exe

C:\Windows\System\hdMvFhS.exe

C:\Windows\System\hdMvFhS.exe

C:\Windows\System\ndWoZDf.exe

C:\Windows\System\ndWoZDf.exe

C:\Windows\System\QgkyvoP.exe

C:\Windows\System\QgkyvoP.exe

C:\Windows\System\CHVYbOa.exe

C:\Windows\System\CHVYbOa.exe

C:\Windows\System\sMCpCxp.exe

C:\Windows\System\sMCpCxp.exe

C:\Windows\System\NpoowRn.exe

C:\Windows\System\NpoowRn.exe

C:\Windows\System\nQkJONq.exe

C:\Windows\System\nQkJONq.exe

C:\Windows\System\OSUxdPB.exe

C:\Windows\System\OSUxdPB.exe

C:\Windows\System\SsBPjzy.exe

C:\Windows\System\SsBPjzy.exe

C:\Windows\System\aHCTZwl.exe

C:\Windows\System\aHCTZwl.exe

C:\Windows\System\GAhSFCn.exe

C:\Windows\System\GAhSFCn.exe

C:\Windows\System\iUfyNMW.exe

C:\Windows\System\iUfyNMW.exe

C:\Windows\System\iYoaEFz.exe

C:\Windows\System\iYoaEFz.exe

C:\Windows\System\ILlutuK.exe

C:\Windows\System\ILlutuK.exe

C:\Windows\System\BztCwQN.exe

C:\Windows\System\BztCwQN.exe

C:\Windows\System\kAuvhjN.exe

C:\Windows\System\kAuvhjN.exe

C:\Windows\System\DEmHZWF.exe

C:\Windows\System\DEmHZWF.exe

C:\Windows\System\sXOgCZQ.exe

C:\Windows\System\sXOgCZQ.exe

C:\Windows\System\oqMRcyA.exe

C:\Windows\System\oqMRcyA.exe

C:\Windows\System\LZCiqRX.exe

C:\Windows\System\LZCiqRX.exe

C:\Windows\System\vNQdhjH.exe

C:\Windows\System\vNQdhjH.exe

C:\Windows\System\UWriBWk.exe

C:\Windows\System\UWriBWk.exe

C:\Windows\System\tshcBvy.exe

C:\Windows\System\tshcBvy.exe

C:\Windows\System\qJOYlAr.exe

C:\Windows\System\qJOYlAr.exe

C:\Windows\System\oqyAhkB.exe

C:\Windows\System\oqyAhkB.exe

C:\Windows\System\XIsHkEh.exe

C:\Windows\System\XIsHkEh.exe

C:\Windows\System\rFJCcTF.exe

C:\Windows\System\rFJCcTF.exe

C:\Windows\System\pkukIaA.exe

C:\Windows\System\pkukIaA.exe

C:\Windows\System\dQEUlCp.exe

C:\Windows\System\dQEUlCp.exe

C:\Windows\System\ZWiRpdA.exe

C:\Windows\System\ZWiRpdA.exe

C:\Windows\System\mahVsAU.exe

C:\Windows\System\mahVsAU.exe

C:\Windows\System\IMuhmxz.exe

C:\Windows\System\IMuhmxz.exe

C:\Windows\System\WmkwuBS.exe

C:\Windows\System\WmkwuBS.exe

C:\Windows\System\wbJJJth.exe

C:\Windows\System\wbJJJth.exe

C:\Windows\System\SubrgKl.exe

C:\Windows\System\SubrgKl.exe

C:\Windows\System\NXXlbsf.exe

C:\Windows\System\NXXlbsf.exe

C:\Windows\System\HGwFVRC.exe

C:\Windows\System\HGwFVRC.exe

C:\Windows\System\mcJatjx.exe

C:\Windows\System\mcJatjx.exe

C:\Windows\System\dmVIbPx.exe

C:\Windows\System\dmVIbPx.exe

C:\Windows\System\jeNksYH.exe

C:\Windows\System\jeNksYH.exe

C:\Windows\System\gPGFHCo.exe

C:\Windows\System\gPGFHCo.exe

C:\Windows\System\dvOOyWO.exe

C:\Windows\System\dvOOyWO.exe

C:\Windows\System\utMxbAB.exe

C:\Windows\System\utMxbAB.exe

C:\Windows\System\oHfLacx.exe

C:\Windows\System\oHfLacx.exe

C:\Windows\System\PDurVrd.exe

C:\Windows\System\PDurVrd.exe

C:\Windows\System\FrQlSoW.exe

C:\Windows\System\FrQlSoW.exe

C:\Windows\System\Rrpzwan.exe

C:\Windows\System\Rrpzwan.exe

C:\Windows\System\xBKQRMz.exe

C:\Windows\System\xBKQRMz.exe

C:\Windows\System\dLaxLqV.exe

C:\Windows\System\dLaxLqV.exe

C:\Windows\System\jqBsMTG.exe

C:\Windows\System\jqBsMTG.exe

C:\Windows\System\PzSgWAe.exe

C:\Windows\System\PzSgWAe.exe

C:\Windows\System\Twjisyu.exe

C:\Windows\System\Twjisyu.exe

C:\Windows\System\sSVbHPm.exe

C:\Windows\System\sSVbHPm.exe

C:\Windows\System\OgrxvCW.exe

C:\Windows\System\OgrxvCW.exe

C:\Windows\System\TRIdCgu.exe

C:\Windows\System\TRIdCgu.exe

C:\Windows\System\YTkXCGM.exe

C:\Windows\System\YTkXCGM.exe

C:\Windows\System\usBQFmH.exe

C:\Windows\System\usBQFmH.exe

C:\Windows\System\uhuiFGt.exe

C:\Windows\System\uhuiFGt.exe

C:\Windows\System\IFCRjAj.exe

C:\Windows\System\IFCRjAj.exe

C:\Windows\System\hvfAAqq.exe

C:\Windows\System\hvfAAqq.exe

C:\Windows\System\taRxqLM.exe

C:\Windows\System\taRxqLM.exe

C:\Windows\System\apZVraN.exe

C:\Windows\System\apZVraN.exe

C:\Windows\System\FHTptaq.exe

C:\Windows\System\FHTptaq.exe

C:\Windows\System\yoHeSAr.exe

C:\Windows\System\yoHeSAr.exe

C:\Windows\System\vCBRrxe.exe

C:\Windows\System\vCBRrxe.exe

C:\Windows\System\rCuzYTN.exe

C:\Windows\System\rCuzYTN.exe

C:\Windows\System\QSPWxPE.exe

C:\Windows\System\QSPWxPE.exe

C:\Windows\System\xhNuBLE.exe

C:\Windows\System\xhNuBLE.exe

C:\Windows\System\UYNeeyr.exe

C:\Windows\System\UYNeeyr.exe

C:\Windows\System\nXEQHnM.exe

C:\Windows\System\nXEQHnM.exe

C:\Windows\System\jBgvTBw.exe

C:\Windows\System\jBgvTBw.exe

C:\Windows\System\kCKLowl.exe

C:\Windows\System\kCKLowl.exe

C:\Windows\System\UbLIwvL.exe

C:\Windows\System\UbLIwvL.exe

C:\Windows\System\bYMJFLY.exe

C:\Windows\System\bYMJFLY.exe

C:\Windows\System\MrlMTDO.exe

C:\Windows\System\MrlMTDO.exe

C:\Windows\System\LJbJZmf.exe

C:\Windows\System\LJbJZmf.exe

C:\Windows\System\ORGGuPD.exe

C:\Windows\System\ORGGuPD.exe

C:\Windows\System\dAOsYXD.exe

C:\Windows\System\dAOsYXD.exe

C:\Windows\System\ObbUyOj.exe

C:\Windows\System\ObbUyOj.exe

C:\Windows\System\MaizPOj.exe

C:\Windows\System\MaizPOj.exe

C:\Windows\System\EvURgLX.exe

C:\Windows\System\EvURgLX.exe

C:\Windows\System\tpDXYUB.exe

C:\Windows\System\tpDXYUB.exe

C:\Windows\System\GrjsMrH.exe

C:\Windows\System\GrjsMrH.exe

C:\Windows\System\cazHHRN.exe

C:\Windows\System\cazHHRN.exe

C:\Windows\System\uSzgoAh.exe

C:\Windows\System\uSzgoAh.exe

C:\Windows\System\VLJZvLy.exe

C:\Windows\System\VLJZvLy.exe

C:\Windows\System\EPrbEwa.exe

C:\Windows\System\EPrbEwa.exe

C:\Windows\System\GQjdTFD.exe

C:\Windows\System\GQjdTFD.exe

C:\Windows\System\JRFJZBd.exe

C:\Windows\System\JRFJZBd.exe

C:\Windows\System\YDsMNth.exe

C:\Windows\System\YDsMNth.exe

C:\Windows\System\hEzAvGI.exe

C:\Windows\System\hEzAvGI.exe

C:\Windows\System\pLFjYCU.exe

C:\Windows\System\pLFjYCU.exe

C:\Windows\System\eaDhELg.exe

C:\Windows\System\eaDhELg.exe

C:\Windows\System\mbxHZco.exe

C:\Windows\System\mbxHZco.exe

C:\Windows\System\Lvvfges.exe

C:\Windows\System\Lvvfges.exe

C:\Windows\System\oqUzRyG.exe

C:\Windows\System\oqUzRyG.exe

C:\Windows\System\YCeQVzt.exe

C:\Windows\System\YCeQVzt.exe

C:\Windows\System\lNeCqVC.exe

C:\Windows\System\lNeCqVC.exe

C:\Windows\System\Qygzaip.exe

C:\Windows\System\Qygzaip.exe

C:\Windows\System\ZGTRtDD.exe

C:\Windows\System\ZGTRtDD.exe

C:\Windows\System\OEHnHwz.exe

C:\Windows\System\OEHnHwz.exe

C:\Windows\System\FrrkkdM.exe

C:\Windows\System\FrrkkdM.exe

C:\Windows\System\zxmocer.exe

C:\Windows\System\zxmocer.exe

C:\Windows\System\mUIyThS.exe

C:\Windows\System\mUIyThS.exe

C:\Windows\System\YvTakuz.exe

C:\Windows\System\YvTakuz.exe

C:\Windows\System\fijmJqz.exe

C:\Windows\System\fijmJqz.exe

C:\Windows\System\RCrBmMl.exe

C:\Windows\System\RCrBmMl.exe

C:\Windows\System\oAHsMtT.exe

C:\Windows\System\oAHsMtT.exe

C:\Windows\System\VeRYTVg.exe

C:\Windows\System\VeRYTVg.exe

C:\Windows\System\BKfuoTo.exe

C:\Windows\System\BKfuoTo.exe

C:\Windows\System\RRcchWV.exe

C:\Windows\System\RRcchWV.exe

C:\Windows\System\piSDwFX.exe

C:\Windows\System\piSDwFX.exe

C:\Windows\System\zEIfkAo.exe

C:\Windows\System\zEIfkAo.exe

C:\Windows\System\RuWMXtc.exe

C:\Windows\System\RuWMXtc.exe

C:\Windows\System\QJGOfAs.exe

C:\Windows\System\QJGOfAs.exe

C:\Windows\System\AFplAmk.exe

C:\Windows\System\AFplAmk.exe

C:\Windows\System\tqLFHdx.exe

C:\Windows\System\tqLFHdx.exe

C:\Windows\System\jKTIHeW.exe

C:\Windows\System\jKTIHeW.exe

C:\Windows\System\cLRxLNM.exe

C:\Windows\System\cLRxLNM.exe

C:\Windows\System\Idjzgus.exe

C:\Windows\System\Idjzgus.exe

C:\Windows\System\IVhbfJi.exe

C:\Windows\System\IVhbfJi.exe

C:\Windows\System\pRIMVcy.exe

C:\Windows\System\pRIMVcy.exe

C:\Windows\System\PEhDGpX.exe

C:\Windows\System\PEhDGpX.exe

C:\Windows\System\xNCDUnD.exe

C:\Windows\System\xNCDUnD.exe

C:\Windows\System\lxuFLpu.exe

C:\Windows\System\lxuFLpu.exe

C:\Windows\System\FpdMebg.exe

C:\Windows\System\FpdMebg.exe

C:\Windows\System\nHzMbDZ.exe

C:\Windows\System\nHzMbDZ.exe

C:\Windows\System\lSKnrzE.exe

C:\Windows\System\lSKnrzE.exe

C:\Windows\System\tAjnjOZ.exe

C:\Windows\System\tAjnjOZ.exe

C:\Windows\System\NflGdLl.exe

C:\Windows\System\NflGdLl.exe

C:\Windows\System\yjufuyE.exe

C:\Windows\System\yjufuyE.exe

C:\Windows\System\wcHYjFo.exe

C:\Windows\System\wcHYjFo.exe

C:\Windows\System\gPbaYFe.exe

C:\Windows\System\gPbaYFe.exe

C:\Windows\System\KfTUyTz.exe

C:\Windows\System\KfTUyTz.exe

C:\Windows\System\niRWGcQ.exe

C:\Windows\System\niRWGcQ.exe

C:\Windows\System\gmooEkL.exe

C:\Windows\System\gmooEkL.exe

C:\Windows\System\iwoHbFX.exe

C:\Windows\System\iwoHbFX.exe

C:\Windows\System\RExdkga.exe

C:\Windows\System\RExdkga.exe

C:\Windows\System\USihTmC.exe

C:\Windows\System\USihTmC.exe

C:\Windows\System\fMbLcXk.exe

C:\Windows\System\fMbLcXk.exe

C:\Windows\System\NGqfTyV.exe

C:\Windows\System\NGqfTyV.exe

C:\Windows\System\bOmomlb.exe

C:\Windows\System\bOmomlb.exe

C:\Windows\System\UHtAAci.exe

C:\Windows\System\UHtAAci.exe

C:\Windows\System\LOXDMQo.exe

C:\Windows\System\LOXDMQo.exe

C:\Windows\System\RQKnEgy.exe

C:\Windows\System\RQKnEgy.exe

C:\Windows\System\JYHfepm.exe

C:\Windows\System\JYHfepm.exe

C:\Windows\System\eAgnDHH.exe

C:\Windows\System\eAgnDHH.exe

C:\Windows\System\PyMFqHL.exe

C:\Windows\System\PyMFqHL.exe

C:\Windows\System\IkltfNS.exe

C:\Windows\System\IkltfNS.exe

C:\Windows\System\LKyeqcl.exe

C:\Windows\System\LKyeqcl.exe

C:\Windows\System\HUPWaqO.exe

C:\Windows\System\HUPWaqO.exe

C:\Windows\System\UeBYFoU.exe

C:\Windows\System\UeBYFoU.exe

C:\Windows\System\RwwxvUq.exe

C:\Windows\System\RwwxvUq.exe

C:\Windows\System\yiNktwg.exe

C:\Windows\System\yiNktwg.exe

C:\Windows\System\iLWDuGq.exe

C:\Windows\System\iLWDuGq.exe

C:\Windows\System\EGpaSkV.exe

C:\Windows\System\EGpaSkV.exe

C:\Windows\System\wdImWlE.exe

C:\Windows\System\wdImWlE.exe

C:\Windows\System\DgMTTls.exe

C:\Windows\System\DgMTTls.exe

C:\Windows\System\oSTEmSf.exe

C:\Windows\System\oSTEmSf.exe

C:\Windows\System\WjDVSuL.exe

C:\Windows\System\WjDVSuL.exe

C:\Windows\System\ZHfQELU.exe

C:\Windows\System\ZHfQELU.exe

C:\Windows\System\dArrEYj.exe

C:\Windows\System\dArrEYj.exe

C:\Windows\System\dQXidAt.exe

C:\Windows\System\dQXidAt.exe

C:\Windows\System\kzFDRBv.exe

C:\Windows\System\kzFDRBv.exe

C:\Windows\System\OhaaJvj.exe

C:\Windows\System\OhaaJvj.exe

C:\Windows\System\gqJUYpZ.exe

C:\Windows\System\gqJUYpZ.exe

C:\Windows\System\IdYzDUk.exe

C:\Windows\System\IdYzDUk.exe

C:\Windows\System\EjKcOXO.exe

C:\Windows\System\EjKcOXO.exe

C:\Windows\System\MWnFjIP.exe

C:\Windows\System\MWnFjIP.exe

C:\Windows\System\UsZRBMd.exe

C:\Windows\System\UsZRBMd.exe

C:\Windows\System\tXwlnQY.exe

C:\Windows\System\tXwlnQY.exe

C:\Windows\System\jNylGkg.exe

C:\Windows\System\jNylGkg.exe

C:\Windows\System\NBoYXbv.exe

C:\Windows\System\NBoYXbv.exe

C:\Windows\System\EfTBSMa.exe

C:\Windows\System\EfTBSMa.exe

C:\Windows\System\UnzKEPM.exe

C:\Windows\System\UnzKEPM.exe

C:\Windows\System\pPCDcDg.exe

C:\Windows\System\pPCDcDg.exe

C:\Windows\System\rWEUfZf.exe

C:\Windows\System\rWEUfZf.exe

C:\Windows\System\hkuTQJy.exe

C:\Windows\System\hkuTQJy.exe

C:\Windows\System\dGceadG.exe

C:\Windows\System\dGceadG.exe

C:\Windows\System\pWTQInT.exe

C:\Windows\System\pWTQInT.exe

C:\Windows\System\SKAOeMB.exe

C:\Windows\System\SKAOeMB.exe

C:\Windows\System\QPvaVyT.exe

C:\Windows\System\QPvaVyT.exe

C:\Windows\System\YNjwKyW.exe

C:\Windows\System\YNjwKyW.exe

C:\Windows\System\VnDjXLh.exe

C:\Windows\System\VnDjXLh.exe

C:\Windows\System\vAyciqR.exe

C:\Windows\System\vAyciqR.exe

C:\Windows\System\gAItpju.exe

C:\Windows\System\gAItpju.exe

C:\Windows\System\WZtcgqJ.exe

C:\Windows\System\WZtcgqJ.exe

C:\Windows\System\pHAeZbP.exe

C:\Windows\System\pHAeZbP.exe

C:\Windows\System\ASfSwZY.exe

C:\Windows\System\ASfSwZY.exe

C:\Windows\System\rCgHukO.exe

C:\Windows\System\rCgHukO.exe

C:\Windows\System\JyxeCfQ.exe

C:\Windows\System\JyxeCfQ.exe

C:\Windows\System\PFsfszX.exe

C:\Windows\System\PFsfszX.exe

C:\Windows\System\KEsFspR.exe

C:\Windows\System\KEsFspR.exe

C:\Windows\System\DENKcFz.exe

C:\Windows\System\DENKcFz.exe

C:\Windows\System\qfPrQoW.exe

C:\Windows\System\qfPrQoW.exe

C:\Windows\System\xVVhKpr.exe

C:\Windows\System\xVVhKpr.exe

C:\Windows\System\PAjWKZd.exe

C:\Windows\System\PAjWKZd.exe

C:\Windows\System\cHhsvuo.exe

C:\Windows\System\cHhsvuo.exe

C:\Windows\System\BmlGRJG.exe

C:\Windows\System\BmlGRJG.exe

C:\Windows\System\DiVxGMH.exe

C:\Windows\System\DiVxGMH.exe

C:\Windows\System\ivLWUKi.exe

C:\Windows\System\ivLWUKi.exe

C:\Windows\System\tVXBNzv.exe

C:\Windows\System\tVXBNzv.exe

C:\Windows\System\sStGyuU.exe

C:\Windows\System\sStGyuU.exe

C:\Windows\System\KaStled.exe

C:\Windows\System\KaStled.exe

C:\Windows\System\ZKyIhbl.exe

C:\Windows\System\ZKyIhbl.exe

C:\Windows\System\OzGTwbF.exe

C:\Windows\System\OzGTwbF.exe

C:\Windows\System\JJKbpke.exe

C:\Windows\System\JJKbpke.exe

C:\Windows\System\ejElPbo.exe

C:\Windows\System\ejElPbo.exe

C:\Windows\System\FsDzddi.exe

C:\Windows\System\FsDzddi.exe

C:\Windows\System\gTaQYFd.exe

C:\Windows\System\gTaQYFd.exe

C:\Windows\System\pGqUZuV.exe

C:\Windows\System\pGqUZuV.exe

C:\Windows\System\SLXJMEq.exe

C:\Windows\System\SLXJMEq.exe

C:\Windows\System\qUMAbEF.exe

C:\Windows\System\qUMAbEF.exe

C:\Windows\System\fsrDqLT.exe

C:\Windows\System\fsrDqLT.exe

C:\Windows\System\JqUqjIh.exe

C:\Windows\System\JqUqjIh.exe

C:\Windows\System\bZBeaCH.exe

C:\Windows\System\bZBeaCH.exe

C:\Windows\System\yYXTpec.exe

C:\Windows\System\yYXTpec.exe

C:\Windows\System\LRXGvGg.exe

C:\Windows\System\LRXGvGg.exe

C:\Windows\System\DEMLqSB.exe

C:\Windows\System\DEMLqSB.exe

C:\Windows\System\etObbWe.exe

C:\Windows\System\etObbWe.exe

C:\Windows\System\JoJsPgG.exe

C:\Windows\System\JoJsPgG.exe

C:\Windows\System\ZXDgZBG.exe

C:\Windows\System\ZXDgZBG.exe

C:\Windows\System\LbYxSll.exe

C:\Windows\System\LbYxSll.exe

C:\Windows\System\psTWkDD.exe

C:\Windows\System\psTWkDD.exe

C:\Windows\System\VaPqJAW.exe

C:\Windows\System\VaPqJAW.exe

C:\Windows\System\imcBIAR.exe

C:\Windows\System\imcBIAR.exe

C:\Windows\System\YCjPFTC.exe

C:\Windows\System\YCjPFTC.exe

C:\Windows\System\sGVmrEf.exe

C:\Windows\System\sGVmrEf.exe

C:\Windows\System\egCuPri.exe

C:\Windows\System\egCuPri.exe

C:\Windows\System\HHBOwou.exe

C:\Windows\System\HHBOwou.exe

C:\Windows\System\rvqUFnG.exe

C:\Windows\System\rvqUFnG.exe

C:\Windows\System\mxJeDvj.exe

C:\Windows\System\mxJeDvj.exe

C:\Windows\System\OnwOpqW.exe

C:\Windows\System\OnwOpqW.exe

C:\Windows\System\EbFJyWl.exe

C:\Windows\System\EbFJyWl.exe

C:\Windows\System\XeKiAuZ.exe

C:\Windows\System\XeKiAuZ.exe

C:\Windows\System\oRgBWAt.exe

C:\Windows\System\oRgBWAt.exe

C:\Windows\System\GTyUsfL.exe

C:\Windows\System\GTyUsfL.exe

C:\Windows\System\hYwvDep.exe

C:\Windows\System\hYwvDep.exe

C:\Windows\System\JHYxico.exe

C:\Windows\System\JHYxico.exe

C:\Windows\System\YLaYnHv.exe

C:\Windows\System\YLaYnHv.exe

C:\Windows\System\vFMpAKm.exe

C:\Windows\System\vFMpAKm.exe

C:\Windows\System\MUqTAsG.exe

C:\Windows\System\MUqTAsG.exe

C:\Windows\System\wkLRSfW.exe

C:\Windows\System\wkLRSfW.exe

C:\Windows\System\CuPzqYQ.exe

C:\Windows\System\CuPzqYQ.exe

C:\Windows\System\SkLNmmt.exe

C:\Windows\System\SkLNmmt.exe

C:\Windows\System\IUgiSOp.exe

C:\Windows\System\IUgiSOp.exe

C:\Windows\System\JFhHHPZ.exe

C:\Windows\System\JFhHHPZ.exe

C:\Windows\System\oyhjIEt.exe

C:\Windows\System\oyhjIEt.exe

C:\Windows\System\ANuIUNp.exe

C:\Windows\System\ANuIUNp.exe

C:\Windows\System\RrnaQJt.exe

C:\Windows\System\RrnaQJt.exe

C:\Windows\System\HynZgjU.exe

C:\Windows\System\HynZgjU.exe

C:\Windows\System\TGghbPx.exe

C:\Windows\System\TGghbPx.exe

C:\Windows\System\hkotGep.exe

C:\Windows\System\hkotGep.exe

C:\Windows\System\fhdHYTl.exe

C:\Windows\System\fhdHYTl.exe

C:\Windows\System\ZYpDLuA.exe

C:\Windows\System\ZYpDLuA.exe

C:\Windows\System\cqddyQt.exe

C:\Windows\System\cqddyQt.exe

C:\Windows\System\gVhbCip.exe

C:\Windows\System\gVhbCip.exe

C:\Windows\System\IGhXhZK.exe

C:\Windows\System\IGhXhZK.exe

C:\Windows\System\DuiVQcO.exe

C:\Windows\System\DuiVQcO.exe

C:\Windows\System\bdVCdWF.exe

C:\Windows\System\bdVCdWF.exe

C:\Windows\System\xGgEJqW.exe

C:\Windows\System\xGgEJqW.exe

C:\Windows\System\IotqnKA.exe

C:\Windows\System\IotqnKA.exe

C:\Windows\System\ZYaGVFt.exe

C:\Windows\System\ZYaGVFt.exe

C:\Windows\System\ugYBZwJ.exe

C:\Windows\System\ugYBZwJ.exe

C:\Windows\System\tNFUNhf.exe

C:\Windows\System\tNFUNhf.exe

C:\Windows\System\WcTdXDS.exe

C:\Windows\System\WcTdXDS.exe

C:\Windows\System\ATxBchO.exe

C:\Windows\System\ATxBchO.exe

C:\Windows\System\qRkKeAF.exe

C:\Windows\System\qRkKeAF.exe

C:\Windows\System\UMYWexY.exe

C:\Windows\System\UMYWexY.exe

C:\Windows\System\QBguyyb.exe

C:\Windows\System\QBguyyb.exe

C:\Windows\System\BhYcSZI.exe

C:\Windows\System\BhYcSZI.exe

C:\Windows\System\KUwUAJg.exe

C:\Windows\System\KUwUAJg.exe

C:\Windows\System\UgAimmP.exe

C:\Windows\System\UgAimmP.exe

C:\Windows\System\QTMyIMI.exe

C:\Windows\System\QTMyIMI.exe

C:\Windows\System\bUibmpE.exe

C:\Windows\System\bUibmpE.exe

C:\Windows\System\wUlZKcu.exe

C:\Windows\System\wUlZKcu.exe

C:\Windows\System\iIEtpha.exe

C:\Windows\System\iIEtpha.exe

C:\Windows\System\fowrKlO.exe

C:\Windows\System\fowrKlO.exe

C:\Windows\System\JZrzlvn.exe

C:\Windows\System\JZrzlvn.exe

C:\Windows\System\kBvOlMN.exe

C:\Windows\System\kBvOlMN.exe

C:\Windows\System\oOjDvBe.exe

C:\Windows\System\oOjDvBe.exe

C:\Windows\System\bQvWQUm.exe

C:\Windows\System\bQvWQUm.exe

C:\Windows\System\UsXXzXu.exe

C:\Windows\System\UsXXzXu.exe

C:\Windows\System\fROAsyc.exe

C:\Windows\System\fROAsyc.exe

C:\Windows\System\GTatHpA.exe

C:\Windows\System\GTatHpA.exe

C:\Windows\System\tZUFuSs.exe

C:\Windows\System\tZUFuSs.exe

C:\Windows\System\JPvjyuP.exe

C:\Windows\System\JPvjyuP.exe

C:\Windows\System\nQiNgGT.exe

C:\Windows\System\nQiNgGT.exe

C:\Windows\System\IefZeCu.exe

C:\Windows\System\IefZeCu.exe

C:\Windows\System\nGOgXlo.exe

C:\Windows\System\nGOgXlo.exe

C:\Windows\System\awHbXvY.exe

C:\Windows\System\awHbXvY.exe

C:\Windows\System\HqPFuBF.exe

C:\Windows\System\HqPFuBF.exe

C:\Windows\System\JsfeZdC.exe

C:\Windows\System\JsfeZdC.exe

C:\Windows\System\ccipoWn.exe

C:\Windows\System\ccipoWn.exe

C:\Windows\System\ZspLbXp.exe

C:\Windows\System\ZspLbXp.exe

C:\Windows\System\foHTuSg.exe

C:\Windows\System\foHTuSg.exe

C:\Windows\System\oykWNbQ.exe

C:\Windows\System\oykWNbQ.exe

C:\Windows\System\tYpMcMW.exe

C:\Windows\System\tYpMcMW.exe

C:\Windows\System\SDaUsxm.exe

C:\Windows\System\SDaUsxm.exe

C:\Windows\System\fNxyQGs.exe

C:\Windows\System\fNxyQGs.exe

C:\Windows\System\HpVoEUn.exe

C:\Windows\System\HpVoEUn.exe

C:\Windows\System\dJRaGuN.exe

C:\Windows\System\dJRaGuN.exe

C:\Windows\System\etsMYty.exe

C:\Windows\System\etsMYty.exe

C:\Windows\System\PYSxDrl.exe

C:\Windows\System\PYSxDrl.exe

C:\Windows\System\TWHrcxP.exe

C:\Windows\System\TWHrcxP.exe

C:\Windows\System\MEigijp.exe

C:\Windows\System\MEigijp.exe

C:\Windows\System\bUrSFNP.exe

C:\Windows\System\bUrSFNP.exe

C:\Windows\System\QTIBOaY.exe

C:\Windows\System\QTIBOaY.exe

C:\Windows\System\FHoJUDs.exe

C:\Windows\System\FHoJUDs.exe

C:\Windows\System\nvlsPPu.exe

C:\Windows\System\nvlsPPu.exe

C:\Windows\System\WawiMsb.exe

C:\Windows\System\WawiMsb.exe

C:\Windows\System\wxPzQFa.exe

C:\Windows\System\wxPzQFa.exe

C:\Windows\System\VwkSpph.exe

C:\Windows\System\VwkSpph.exe

C:\Windows\System\iKfExVt.exe

C:\Windows\System\iKfExVt.exe

C:\Windows\System\hMKMwBp.exe

C:\Windows\System\hMKMwBp.exe

C:\Windows\System\VwlTcvU.exe

C:\Windows\System\VwlTcvU.exe

C:\Windows\System\grwCCfh.exe

C:\Windows\System\grwCCfh.exe

C:\Windows\System\JrDmFdu.exe

C:\Windows\System\JrDmFdu.exe

C:\Windows\System\glBSeKQ.exe

C:\Windows\System\glBSeKQ.exe

C:\Windows\System\zXayQYQ.exe

C:\Windows\System\zXayQYQ.exe

C:\Windows\System\duSOGLb.exe

C:\Windows\System\duSOGLb.exe

C:\Windows\System\XozFbud.exe

C:\Windows\System\XozFbud.exe

C:\Windows\System\XcxjByh.exe

C:\Windows\System\XcxjByh.exe

C:\Windows\System\OYwuCHV.exe

C:\Windows\System\OYwuCHV.exe

C:\Windows\System\SCYCUMA.exe

C:\Windows\System\SCYCUMA.exe

C:\Windows\System\DdIxSCK.exe

C:\Windows\System\DdIxSCK.exe

C:\Windows\System\aQjVPsU.exe

C:\Windows\System\aQjVPsU.exe

C:\Windows\System\ifomocO.exe

C:\Windows\System\ifomocO.exe

C:\Windows\System\frMEnZs.exe

C:\Windows\System\frMEnZs.exe

C:\Windows\System\eRjSqXY.exe

C:\Windows\System\eRjSqXY.exe

C:\Windows\System\ZsLGogN.exe

C:\Windows\System\ZsLGogN.exe

C:\Windows\System\yjVgyQF.exe

C:\Windows\System\yjVgyQF.exe

C:\Windows\System\yzQRmcx.exe

C:\Windows\System\yzQRmcx.exe

C:\Windows\System\dgcHiVi.exe

C:\Windows\System\dgcHiVi.exe

C:\Windows\System\VRiBiSo.exe

C:\Windows\System\VRiBiSo.exe

C:\Windows\System\vtXOBRZ.exe

C:\Windows\System\vtXOBRZ.exe

C:\Windows\System\ADXIQpo.exe

C:\Windows\System\ADXIQpo.exe

C:\Windows\System\hMdGDfm.exe

C:\Windows\System\hMdGDfm.exe

C:\Windows\System\BSmbjrt.exe

C:\Windows\System\BSmbjrt.exe

C:\Windows\System\RMSkVxA.exe

C:\Windows\System\RMSkVxA.exe

C:\Windows\System\wegkvAo.exe

C:\Windows\System\wegkvAo.exe

C:\Windows\System\EQgqxHM.exe

C:\Windows\System\EQgqxHM.exe

C:\Windows\System\VivyVYk.exe

C:\Windows\System\VivyVYk.exe

C:\Windows\System\ZTUIESp.exe

C:\Windows\System\ZTUIESp.exe

C:\Windows\System\GxzksbY.exe

C:\Windows\System\GxzksbY.exe

C:\Windows\System\HxRFvbU.exe

C:\Windows\System\HxRFvbU.exe

C:\Windows\System\MyAnjff.exe

C:\Windows\System\MyAnjff.exe

C:\Windows\System\fcOHZNE.exe

C:\Windows\System\fcOHZNE.exe

C:\Windows\System\UqXdyyu.exe

C:\Windows\System\UqXdyyu.exe

C:\Windows\System\ClXOEHZ.exe

C:\Windows\System\ClXOEHZ.exe

C:\Windows\System\kIuWAio.exe

C:\Windows\System\kIuWAio.exe

C:\Windows\System\ZhRsPVu.exe

C:\Windows\System\ZhRsPVu.exe

C:\Windows\System\PSGNQWk.exe

C:\Windows\System\PSGNQWk.exe

C:\Windows\System\RYnKZld.exe

C:\Windows\System\RYnKZld.exe

C:\Windows\System\hsOJYUX.exe

C:\Windows\System\hsOJYUX.exe

C:\Windows\System\yyEzkau.exe

C:\Windows\System\yyEzkau.exe

C:\Windows\System\KIyhyYm.exe

C:\Windows\System\KIyhyYm.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp

Files

memory/2592-0-0x00007FF794DB0000-0x00007FF7951A2000-memory.dmp

memory/2592-1-0x0000020ED9660000-0x0000020ED9670000-memory.dmp

C:\Windows\System\qApPejD.exe

MD5	c850aa87c18da7aaad562bbfee255c33
SHA1	56305ea255558065176bd71740ea656e48fd6385
SHA256	6b07c04ae30548efabb4594e8ef7eff2e4fa927d9ef1bda465ea685c1e0a955b
SHA512	12dc2fdd0f750e25cb4f6649e7ea5de1528b2d2a13bfee7cf9045078408ba6c60657d6e69973ae0db9a4bb5119e932463dfb9c9f4853fd80af6ef402e5bd6b2e

C:\Windows\System\yqNFgPZ.exe

MD5	6650cf7ad599bacd354f632447a7ad8e
SHA1	d19d72f876b1d0c1b1bb143a35ea6231bbf6d9bc
SHA256	2471f481c5123d8379ee6caccce128fa363de0015ab9a88ca1405ef215012520
SHA512	9b324691f80d0662baa745b1c0ac8f57f0d2e37c1c8182a42bce7f2f9653efea94949185cba3a9e5bccd47e11a4dd41a198ae7612cd98629035811d7f4fbddd3

C:\Windows\System\yxJFZvY.exe

MD5	a104bf436b1d0cd31b1b208cea8d7736
SHA1	68756b1a759c1966f221e5b7a57915edc486e41a
SHA256	43599bacacc3d7dc6ae0d05076b4dbeecd485766d6193b87e5b9ed17591ec5f0
SHA512	cf4f65394a650a6201e245fc6e66cda82568422db9868afd41b28f2b2fe85b32a7323d3f783dc47e0cc5c48322b48179545bca091e0e51d3f230ef94e569a195

memory/1560-27-0x00007FF7A3940000-0x00007FF7A3D32000-memory.dmp

C:\Windows\System\wyGhSXq.exe

MD5	a7b3c15ecd7a591c2cbd1cb7efa10aea
SHA1	0240abafb5cac9c1fbd499d47130793c25574a21
SHA256	36c06f9e04ca2da1318b4c7768d744c642868be5aa8fcf67520bc57d9063237d
SHA512	04f12a86e9125a5994f6d3312d848f29b2e053effe8d7d60bd2aff8c372266caf5d56cfb4b2bd7f6ca8d87540077da8e63b8f4b234d96fe90ec472cbd437cdd4

C:\Windows\System\Ttmmvto.exe

MD5	d0c845ce06a340137f6dd3e4e1e90666
SHA1	34850f77993f29abf0a8cd025a80cf9672411a7a
SHA256	9e2c5961335d377c4c6b9e13868492f15aa3978bb706ce01ade83de9adcd075b
SHA512	3fc592764fbc16a96a871115d18efdae279b7f6cc3d7078b5afd056c25be2debe7e59eb88ec3bf50ca21d676301b03a0e0c20cb0d7e260ddbd1d3ed78f7cd2ec

memory/5040-204-0x00007FFFEFE50000-0x00007FFFF0911000-memory.dmp

memory/2324-219-0x00007FF6EA630000-0x00007FF6EAA22000-memory.dmp

memory/3168-224-0x00007FF7C6690000-0x00007FF7C6A82000-memory.dmp

memory/908-229-0x00007FF7B7B90000-0x00007FF7B7F82000-memory.dmp

memory/1656-235-0x00007FF7D1070000-0x00007FF7D1462000-memory.dmp

memory/2724-236-0x00007FF739F20000-0x00007FF73A312000-memory.dmp

memory/4036-234-0x00007FF6EC210000-0x00007FF6EC602000-memory.dmp

memory/1940-233-0x00007FF7705B0000-0x00007FF7709A2000-memory.dmp

memory/4296-232-0x00007FF7B0F80000-0x00007FF7B1372000-memory.dmp

memory/1060-231-0x00007FF63D030000-0x00007FF63D422000-memory.dmp

memory/4576-230-0x00007FF724C00000-0x00007FF724FF2000-memory.dmp

memory/4088-228-0x00007FF6C8650000-0x00007FF6C8A42000-memory.dmp

memory/1472-227-0x00007FF604FF0000-0x00007FF6053E2000-memory.dmp

memory/3348-226-0x00007FF610490000-0x00007FF610882000-memory.dmp

memory/2196-225-0x00007FF717B60000-0x00007FF717F52000-memory.dmp

memory/3068-223-0x00007FF609ED0000-0x00007FF60A2C2000-memory.dmp

memory/3340-222-0x00007FF7F3960000-0x00007FF7F3D52000-memory.dmp

memory/2380-221-0x00007FF7E7280000-0x00007FF7E7672000-memory.dmp

memory/4264-220-0x00007FF7D1B80000-0x00007FF7D1F72000-memory.dmp

memory/5064-218-0x00007FF6CF8A0000-0x00007FF6CFC92000-memory.dmp

memory/4540-217-0x00007FF6891F0000-0x00007FF6895E2000-memory.dmp

memory/3352-216-0x00007FF749D50000-0x00007FF74A142000-memory.dmp

memory/3980-215-0x00007FF736380000-0x00007FF736772000-memory.dmp

C:\Windows\System\sVnRtKe.exe

MD5	2fe0005a293aa3585f46c887d411cdec
SHA1	2b8d97424a5c07e99829695b9acca93d173ac728
SHA256	7ab11c341f291a3dcc347005006c5d7b0ac3f0d2ae54ca6f8aa50609f6be9b49
SHA512	0c57435ab68ff281f6d718a279725b70b0a25457839bed7c3e1557859f6d82e50d237a9430d3f0be5cbd172f7d30945e4a9b33bcb80d8bdd6c0fca8ef5914de5

C:\Windows\System\xVDbZGz.exe

MD5	a9baf6ad3a7f4798fc338082d4f9ce2a
SHA1	cccaaf7200f33c0b68f92c196d6a170e251d14f5
SHA256	526899005891018f4d78b2fb978b34648bbf5b0fd48b6918cce168451abafb92
SHA512	ba703f7f91e2df039434d6f94042f5101072e93d7ca5ad740a98ba802e38fa5e8051d37b16584dd85fde3b33824a038e93ca0bbe0165b1f731cc28049f8f0b2c

C:\Windows\System\goqSNiV.exe

MD5	6e5274ff9830405556df972f6ce5bc2b
SHA1	16df645125eda0599d3816118648047192e7a714
SHA256	4d4ab833873baa5e4675315b2ca89cb5f96bf9568ac2808b989cc384337b2b67
SHA512	aa8d6b6eb92e372b953c986f3b68d743356433f27e46665ce6de11ad7f6ee01cd57bd8d9e74b08a6ba891f14b41a20eaf4fdebd377807d20be71a399ea76691c

C:\Windows\System\iCESrdR.exe

MD5	0a8f66471934c14227cc1e21010bfb79
SHA1	101e487f9f1a0f7b0c9abcd136f727ba7db2acfc
SHA256	ef906db5e7e4c2d25b0582fb26518dd9a686bd222bf5b9c220b5fcd13baf844f
SHA512	c12190f1e2777491d223ede79bf9c00359a608bac92efd840dc0f758c6d43e9dbde3d0611d8018717afaf12d20992850f27a29147f0e410d58f743bbac463d7a

C:\Windows\System\AEBpgcy.exe

MD5	5cfc9eae926f28836b814001808a7f8d
SHA1	3d3e461646da7b018c71f951fd033067f4a1f7af
SHA256	b8dab37cd4a15bbe37dfbc3b68950c8481037b92cb95e89e127013dc12c6d8d3
SHA512	efa2b0c230f19927aaf219538b06f899c2889bc1ea4b978a51663bb1811d4ad9ed26509286d9fdd8120d4c1d203b6604ed5fcee700a01bad519ca16b8c839623

C:\Windows\System\JIyTJRR.exe

MD5	0440a86e7ff30f5977cbf662386a3310
SHA1	09b259c88ac5c5f5d2293b6b3e3c5d478121fcd8
SHA256	73f59bc10c2ca1df78804289d706c83c48b4605a5553e3db0632bfc133a5e161
SHA512	059f279d45d9392cd0acc230b93c45c88f1720798cd34e5c0c8d439840a7d6b5e3b3f83354d40834c32bb99d646dbd2376c5cf388516d08f9a6414109863db84

C:\Windows\System\cAuvuUF.exe

MD5	3a682f583d0849ea7a5815a42c3bfe67
SHA1	84f6039dfa6b8d55e9e6564f54e6849f279c3430
SHA256	8c35c2d14f9a39b890b2769a601f8d76ba14161016d0a2f37fef2e5c59639409
SHA512	f732eb186acbc7130d882704a7089899fe460287d1cae2a7b583e9985c939cf0074f9a37ab556b46223e4d68bc05b00eab1d38fa68ea20dfd5562018b9566d26

C:\Windows\System\zjENJtE.exe

MD5	b5645da46a3ca1a515edf3ff1b8e3401
SHA1	6de479c0ccfaea0ec843626de87786edc2e194c2
SHA256	b3fb164dbef9eeb79ebf6043a77d1a3d168c11de4ba151270e3582703789afd0
SHA512	c2439a0c860731d5c83f001efce705d614842fd22c6ebca6a452c26ea53d4f98db21a2a480b284306a91aa81993f0c057a568396d33f8e5a5fdf49b9225be925

C:\Windows\System\Qwhlozh.exe

MD5	581cbc046160d57c3fce213b2a8d586c
SHA1	18d4757898d31a77c6b21043e4419627663f6b26
SHA256	6829b64177f3a575420a46e04205311ce70377b056ecd64dff50fa1a5de890b9
SHA512	52b57d5104336a277dddb11b8134102966f2d7c5ff850b2a6b254cd2f77af37c1bc62284f6bb67865b8972e4a12e382f9dc8d0c1cf3715bcc58d272dbd60d2bb

C:\Windows\System\YdENmOq.exe

MD5	a00e12d27babe7b75eda3d064a65dead
SHA1	461dfde4e4bfff742f587882ef1be7574a8b6549
SHA256	153ac386b2d15fd541bf3bf6f4738d8341241b56257b328f0cb151a32dece98f
SHA512	a189992532b43eefd12d8305ca5b597ff321ac3bc10c32d98d8c653060d1169e4a852ee104fb856fdf703e4d84890867d521ae44678401f98d432b51a0271469

C:\Windows\System\kKTQXwC.exe

MD5	c4d4dc53b0deb29e0ce9738fd1b022d2
SHA1	f08618ec51c020f4e1211c1433d300d92f78e154
SHA256	875898d819700662a7e1a08ffeabed7ffc603d354ef0604f68343387a5580635
SHA512	d7c08bbdabef85c42d791d5caa81267afe57196c7c72aa37bf34f00c5ac8993097266952b917d02965a998aa80e710e3c4e4b8ef643b3918a1f7516a94ddb544

C:\Windows\System\gYzngZs.exe

MD5	af5ca6d7d7d44807f3d02588f63f9ce3
SHA1	5b1bef7cacaa66f3db3285971427f2c7d27a6807
SHA256	ed582766138d195461a4e36980a943a6c34c1cf221bd4eca5304d781d1b418c2
SHA512	07792fe04e192547f309dcfb518ddf0031a387bfe5fb15135ce372f5ecabbda6c228700dc507b5cbcbf9b323eb0efd7c18c8ff4e9f425f6b215f29c9fece4e8b

C:\Windows\System\itDvJuM.exe

MD5	c4c75569e791b8f2a58eee7d00e2bfb1
SHA1	fb820252d2e56591fe9fd792c4cab32193862fbe
SHA256	d43081aec4dcf194d140ff32534423ace637221367fd1ba25bead0caaa59f822
SHA512	3f64c3b31ed294bec9ddba3c43e89f84693f0c029a7e699cc3fd8a0aa67e4e8d15bb5d4394af1ad93e348d88bbb79c23c8edb111ea8e3bdc4ed24ba9786100ec

C:\Windows\System\sdePyTZ.exe

MD5	a22a2a5ef023f500bd71d9ded8a4107e
SHA1	cb88b4c4cfecbe815541611d74774974173fea32
SHA256	37c73382487553c82ac3993e69a0c245b25c1ed8180d3eafbdc5c313435c265c
SHA512	6b290a2177192b9f36b5d5597b0712087487c953a43b7b7e514b4aa8ee4752d9a5f847526dd345c436ad64f8da1b2ba59164736f8a20932a6c50422bd250198a

C:\Windows\System\zhAdFab.exe

MD5	6e3ca74766c375e40aaace6d8ea51329
SHA1	54b7ccb1469ac5ffeba6dd717c205456adb4ba49
SHA256	e77aa0f444cb26c299b27755d49d8a4d3c2ee8372a12d98888ae7bb757bfad86
SHA512	c2faac6bc8fb65300bb9f327fc8d1c13fd18c37121ef048ed1a753098f449d6da188fde00483e5f794ea66161e6cb35144d574c3bbde6783b193c77d785c568d

C:\Windows\System\vpnCSNJ.exe

MD5	c88c4aeed069a03bb71ffe427de47bd7
SHA1	398d1d3b4dcf3f744d1d4ae1aec89bea398d9b02
SHA256	f3195d7ae533dd092000f13a5706df708ba1323014e94a9bc45fe2dbbc6e6871
SHA512	1d9dad60e6a21e1eb77887b334f485b616969b53b316c8ed7da21b284fb0147f44a577d23cd74bcc3a32770ffae6a967a53f5a4d7a9c40b07cbf0ffe7c2f643b

C:\Windows\System\yMltmDh.exe

MD5	0830545feb5e6b2ea38d56f2a80fef33
SHA1	c979b4297ad72ca6174b3321e2df35b3aec37d13
SHA256	9927f4e469547aeb8cbad4943b4d0802e74032acdfb337e98969c4755f987b16
SHA512	080961188c7212e46ea859628ee3ee8fdb749a3f51d3828f220ed489ff288d8954a4296a667e478a2e17bc0075a1e507a4b8f98dc7e37e0734e71b0b22cd1598

C:\Windows\System\hzecnfp.exe

MD5	81470047c781e65fb2b8cd511e9f9e34
SHA1	8f952e80ee87ad945d11e181f4fd8ed385eb3720
SHA256	43a6a739108324ce7e611a13cb1a2a87ac17f7aae32ddb1e5ade7ca3fd283805
SHA512	b9ca1088259089a43afbd9a8cb3bd28de8b98eb7a0276b96fb38b69905d489a599a11ce5a03616fcfae2915837aaf96bd119b2ea7604cfcaafdb18ec3979c77e

C:\Windows\System\kjWvPhZ.exe

MD5	5a0fd4153a13140bc076b19c06538208
SHA1	f285d0ad3f9d9cf4c12e0f90a0d8c866857195ad
SHA256	20e5b881466a20d9714b589a4166e86baddd740d73a51d999f34207476a5cc0c
SHA512	d02e1d29bd3a647972952cddafee6352894d8afe198e896ed6106e183bdb7dbd010837fb98d260db7bb9d35156b76131566098fadbb56acf178134d771915ef1

C:\Windows\System\ZtpCNiZ.exe

MD5	8a25d82b840ed9190cbfece6f0f42148
SHA1	697599b8518647395fa44fdc85869e02ecf2a1ea
SHA256	d77559902b6e217df28dbae83a4ee36760fad32708c921db31fb7f6df242beec
SHA512	02f47157ac810424a4c2467e3e0953dcf88370a860c934a60ac95b11bc861ce8143f91da3fb24c1669c7a3e1957de03036f9101d5a774b0c76a1260ab8822415

C:\Windows\System\KelWjxU.exe

MD5	0c43d772ce7c31ebbc5ef00abb0dae96
SHA1	4a7738f1a422aab5caf3b0ed079db9be50826c40
SHA256	686b69a05edc450bb1e2e4735cf96bf5263b73f38e2acfad4c131510ada676e0
SHA512	523fadfd3a51220a41f2e348393b4f4a7d0e72d17989444752693d04b75bb29c99d5dd4d2c1eed7e14cf9ef2fbb1b0bb6bbdb66b428ea143b93eddee66466541

C:\Windows\System\TxWzFvp.exe

MD5	4c20569ec25263109fad707c3afdc4cb
SHA1	478fe92e5033ed76b64dba28f5eb7e0087c5ff5d
SHA256	8a73e0eec11134280c634a6d79b54482a7fc87c1f6c98c23f9243b573fdc14b5
SHA512	8a8f8bb8b56146641f00c5b79e8da9a95bd2331ed475ffdeebfe7075a9a2e4a3d25bd9ed8916e3e45f0c0fcd9d462c007ef26fc78441f8ea181d87864c67e90e

memory/5040-2390-0x00007FFFEFE50000-0x00007FFFF0911000-memory.dmp

memory/5040-304-0x000001E32BDB0000-0x000001E32BDD2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ddgj5bj5.vgu.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Windows\System\BWNsKtK.exe

MD5	09bc6bad5d16d69ad0fb69c722cfdc86
SHA1	e642c2a90021e00c7241276a58eb11cce421868a
SHA256	666dcc689cb48a90b551f734971ae4e9e7ad29e372b8233914f168c0916ace3d
SHA512	f5cbcfc78b9cde92c851f049dbac2291fc34dcc7602cc36101bf4e5b4cd9a4844605866340cb6b4a8556eb3cc3a453a88ec22d7ee92ea3e83fbcc7badfdcb8a2

C:\Windows\System\TaUJUSM.exe

MD5	59dde1761b937a9520a10a5734615c59
SHA1	adb1320704b345e8d9e5aa8154cbdde7e4808d48
SHA256	f5c3a712095e809ba88b9d494b4e276899bcee31201ee099833567c4cdb7ce26
SHA512	7588d68671e7ba24d628950c065a03fb61fb597c35b9da013a662c9b0c127589c33c90dad1fa24754b1eb715cba4354e4716e056d6884c90b0bb187d06394e5b

C:\Windows\System\CPcPvyh.exe

MD5	686ff4b3121425db9bbc1c8da3be3f4e
SHA1	af8256be78bb67b53fb514291114dd6b723786fb
SHA256	9bf752786881e702b442bd5ff1577da18c3f5794fc8f0e208bb64475ce97317f
SHA512	fe77ac63a6e531ccf1c500b4c62aa19dfd7754b455acc03db721aac076d96ba6d77403afa00c6284344f69c3997306d0127c598469991fcd9c662eeb34c7578a

C:\Windows\System\qzpvDUI.exe

MD5	f3a6fa1c3c973e4d6421571d20a5e780
SHA1	c4972afbed2fdd08b176029f42542e81f207ece0
SHA256	5f7581cfdea45c0ba153d6f8fdc1eff7c02dd59ed25b68152f7406e25643cd08
SHA512	50dafd9efe1cb89360713e429e0ff5970fb9095f940234d38bb77c90e832646fa62de08f904cf5d246800430fb679616b4d8ffa400f50be97e9380e98a6de0f7

C:\Windows\System\ivFEDEu.exe

MD5	d61f483234ea6c8aa9179cc74e2a0dfa
SHA1	bd2663125a260316722d819b93c4ca00f64483f5
SHA256	8632633e9603fdf78e78c3f073762a22d06707100d81a361e1c143af9b3a3e46
SHA512	41f155e5eddd0bd83b9486122e6ec745a78f89d848f277e54db6feb49d592484d8871818b6c97cdf3eb21f77957d834217bfc8a9b0f98c4114cbf6b557354861

C:\Windows\System\XMkhSoJ.exe

MD5	1be1201599946657b016809857e8d019
SHA1	cdb903a530399c55a761b2ef8d17519b55ddf44d
SHA256	2d4626a7b3369db2f27734ee0c33c403bde9b398dec4597d5251964b551bb1a6
SHA512	99621726ce37e9b2c56cdf306802901d80fd3d2d0d26c0b9c4c90043c30db88a36017f72a2af7c69839d44d1929d35a48cd23b2484d263260b7e631865ba7cef

C:\Windows\System\EJHtgKt.exe

MD5	6bc5089807e5bba5696dfa9bfba848e5
SHA1	5371a681a1926192df4b4adc4e5621077d7f5737
SHA256	366f8c8be5b4745c425f77546b93b2177a7ad18857bfc534661943436aa0c79d
SHA512	49c24379388c5564334d0eb3652ae8b85e87232e80be5eb62e1b2afd9ed07941f88fad89f077d44a43f67428e8f461db4fd46870e738a8f54fb76ed9697ec06e

C:\Windows\System\VAbpNSK.exe

MD5	81851e982603e950f7cc2a12d73e5d1a
SHA1	46feff743f33133e63e85cbb4a07b441061264e9
SHA256	f90b184a01e0b7edbd7126f1395297605eedeba1570975c07879fb14e8d3d08e
SHA512	c4af8b468b822ade0e0208d3f62b12810adc32f2c3f075ba43b069b765596c46ddcff896bbbc8584f73341b8f998ccd95ac596338ae6a325284fe07ff506abcb

C:\Windows\System\JPKfhHk.exe

MD5	cdbc23834d108f7699290493a0c093ce
SHA1	39d53812edaaf3628b5fe2f394f74d6b7db2f60b
SHA256	2beb4e33f208d1ef26d153eabf85799eced8e6c645fe621de15e1b27fbb99479
SHA512	5ac94ed5d1b69590076cfdf12e23c160c5474f377a8d38702cf26e7555681e1760396ffe3e078ac4a2811907d5cf90ffce68712d4c49d701684bd81149026dfc

memory/5040-115-0x00007FFFEFE50000-0x00007FFFF0911000-memory.dmp

C:\Windows\System\tLhvkzF.exe

MD5	b9a8d6666c241f877ee6edf0464dd886
SHA1	ade1fa77ca27d90bc449a6d9fc3776070c92ff57
SHA256	90831ce91c5aba22908ddb78a0702af8feff6775e9f32dfbe8576ca145bbc784
SHA512	7fa74d9b428e8bc77926c01ec1b50bd09436606ac7ee2c63fa29f94ba1fdb05a4cfd96c0346ac312a06d167250af99a9473cf5d37c2895dcacfc93ed3ae6a08b

C:\Windows\System\uzcduqp.exe

MD5	f04cdb077995cb605ab1b560264c7c9f
SHA1	6885117618f8d33a0711e897bfc60d0291863dd0
SHA256	71da535b34e516fe721c2a47ea11707a136537022854ab4cc96cbb1807fe319a
SHA512	a0d29351d77c8e67746431c1bb4b81769809fd056398f195951ec86d0e8e57ee08c51e90edff37955ec63e98152b8aed213ce5f5a869944d4126ff8543752aff

C:\Windows\System\inXNSkE.exe

MD5	e8d457c362dcd8840c5648b901de98fa
SHA1	62c6b7cf9f5752f92493b0a0b0264d7d7aa1fc4c
SHA256	b9ca1ee76087ab1d3c1f2011e15b8086a97679218be23da48c1c914a286831fc
SHA512	b4c6de2c6fe8f11a053a2662f120c0cc34c42696ce676310cf36358d4adab2b2ac841d6e70bb971230d7cde99e1b0521024718de669314a53cb49ce11c9a25ff

C:\Windows\System\xQiiGgY.exe

MD5	0264f3f8ca58a3f1144a3c5bb1775e15
SHA1	f7ef4a7d459bba032d234c50e0e22690dfcb7ff9
SHA256	9e06ecf91c4d60fde075e40d5a6eefa5cc4001d2f220c4efeb18b580dfcd0e8d
SHA512	91d1173ea21bb364d36c1d59f56e7f80c7a15057f09a21794a56f781bb20b021ed7dbd88d07bbb49a997f42951c678ad72ee1bd08f3d950d98ac05abbd19e3f3

C:\Windows\System\otcyenN.exe

MD5	efada868e72683aa138d3b6932365399
SHA1	0f15b88180b04f9acc6db6f7ea2c350a4e0ecb73
SHA256	fa45e23130187d67454777bddb43038c1a4278f3e1d7f2122c1d0ca113416d77
SHA512	86d1db41368a35c2080db60e85bd2eb9e8ab0bed263b6fb85d776d59724ec5a7d27811c6ca8f21ae5b4d60081cf6daf5b2cf0e27c1141570d40710387c2b5e46

memory/5040-21-0x00007FFFEFE53000-0x00007FFFEFE55000-memory.dmp

memory/3468-20-0x00007FF69EB30000-0x00007FF69EF22000-memory.dmp

C:\Windows\System\QWpEUGN.exe

MD5	67d893d1a2095d39d451d08ee1cc05e9
SHA1	dad7ef4487e41ff3c3e600250e691ed16832dc94
SHA256	cc871666e89dd430f5e3dc9cc361cd1a4ecf7214b4b8daeb86cca2257079f3ce
SHA512	7799e4db272ac6c136cb55f2e50c1582a5027767dc6d148dbf159fdb6f776a047cf2ac573fbb2f2ca5a994173cf0465c93ef3f6e6c86e8981136e854def9801d

memory/4540-5244-0x00007FF6891F0000-0x00007FF6895E2000-memory.dmp

memory/1940-5270-0x00007FF7705B0000-0x00007FF7709A2000-memory.dmp

memory/4264-5278-0x00007FF7D1B80000-0x00007FF7D1F72000-memory.dmp

memory/2380-5297-0x00007FF7E7280000-0x00007FF7E7672000-memory.dmp

memory/1060-5324-0x00007FF63D030000-0x00007FF63D422000-memory.dmp

memory/908-5334-0x00007FF7B7B90000-0x00007FF7B7F82000-memory.dmp

memory/4296-5320-0x00007FF7B0F80000-0x00007FF7B1372000-memory.dmp

memory/3168-5313-0x00007FF7C6690000-0x00007FF7C6A82000-memory.dmp

memory/4088-5312-0x00007FF6C8650000-0x00007FF6C8A42000-memory.dmp

memory/1472-5310-0x00007FF604FF0000-0x00007FF6053E2000-memory.dmp

memory/3348-5307-0x00007FF610490000-0x00007FF610882000-memory.dmp

memory/3068-5301-0x00007FF609ED0000-0x00007FF60A2C2000-memory.dmp

memory/2324-5281-0x00007FF6EA630000-0x00007FF6EAA22000-memory.dmp

memory/5064-5274-0x00007FF6CF8A0000-0x00007FF6CFC92000-memory.dmp

memory/4576-5885-0x00007FF724C00000-0x00007FF724FF2000-memory.dmp

C:\Windows\System\ZCcWfsC.exe

MD5	7580b5fe4b8b558ed4e1e5f727b6eac9
SHA1	0f2289a47242ed56c652c4a9ce3f12a56ae88f62
SHA256	586c80437ec52f5bcd50c4b0a6d737eb9af47f504e94b6d79f8f35f7b766552a
SHA512	f2edb5137e96d6b97274de48766c4e118def9c7dac982b5d770578cfddac85c91754b56d48ca1235795bb3dac08b97d603feff9850943cec1bd88db3018a401f

Sample ID	240613-2bmesasfpg
Target	8bf1c8070950a8f84620b2c46b36aee0_NeikiAnalytics.exe
SHA256	1c4f1b822de2e7d3600c441d3e619bf469c19a673e8e6addc9c247795f251653
Tags	upx miner xmrig execution

Malware Analysis Report

2024-07-28 21:41

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files