Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\AWZYtUc.exe	N/A
N/A	N/A	C:\Windows\System\nrMiFiX.exe	N/A
N/A	N/A	C:\Windows\System\qqbFzCh.exe	N/A
N/A	N/A	C:\Windows\System\VlqvUdd.exe	N/A
N/A	N/A	C:\Windows\System\bnNMwXB.exe	N/A
N/A	N/A	C:\Windows\System\uzSlvJz.exe	N/A
N/A	N/A	C:\Windows\System\QpghnYu.exe	N/A
N/A	N/A	C:\Windows\System\MmBXhpK.exe	N/A
N/A	N/A	C:\Windows\System\kNJQKIS.exe	N/A
N/A	N/A	C:\Windows\System\BOptnxD.exe	N/A
N/A	N/A	C:\Windows\System\YFmpSLF.exe	N/A
N/A	N/A	C:\Windows\System\JrGaDXV.exe	N/A
N/A	N/A	C:\Windows\System\WFXxQTn.exe	N/A
N/A	N/A	C:\Windows\System\AOBAVHt.exe	N/A
N/A	N/A	C:\Windows\System\zuZQbif.exe	N/A
N/A	N/A	C:\Windows\System\lzRSdWm.exe	N/A
N/A	N/A	C:\Windows\System\jJbKPCi.exe	N/A
N/A	N/A	C:\Windows\System\kCRwsoE.exe	N/A
N/A	N/A	C:\Windows\System\nkIKlFM.exe	N/A
N/A	N/A	C:\Windows\System\xNhFcXc.exe	N/A
N/A	N/A	C:\Windows\System\uxRPSdK.exe	N/A
N/A	N/A	C:\Windows\System\etTqfnA.exe	N/A
N/A	N/A	C:\Windows\System\xpfpqVc.exe	N/A
N/A	N/A	C:\Windows\System\KlHImmI.exe	N/A
N/A	N/A	C:\Windows\System\YbByply.exe	N/A
N/A	N/A	C:\Windows\System\SGMnpYK.exe	N/A
N/A	N/A	C:\Windows\System\SdQTUIa.exe	N/A
N/A	N/A	C:\Windows\System\rTUkHrS.exe	N/A
N/A	N/A	C:\Windows\System\Pjwnbnl.exe	N/A
N/A	N/A	C:\Windows\System\IkNqgQn.exe	N/A
N/A	N/A	C:\Windows\System\alrFqbL.exe	N/A
N/A	N/A	C:\Windows\System\HDeDeyC.exe	N/A
N/A	N/A	C:\Windows\System\SAqRzHS.exe	N/A
N/A	N/A	C:\Windows\System\ojluapu.exe	N/A
N/A	N/A	C:\Windows\System\RXQqJoa.exe	N/A
N/A	N/A	C:\Windows\System\PcgRwIT.exe	N/A
N/A	N/A	C:\Windows\System\WduJvtt.exe	N/A
N/A	N/A	C:\Windows\System\RJCreTp.exe	N/A
N/A	N/A	C:\Windows\System\HZyamcI.exe	N/A
N/A	N/A	C:\Windows\System\KsFxxPm.exe	N/A
N/A	N/A	C:\Windows\System\gUwJICo.exe	N/A
N/A	N/A	C:\Windows\System\zBibPYM.exe	N/A
N/A	N/A	C:\Windows\System\wWJZNiC.exe	N/A
N/A	N/A	C:\Windows\System\hPzcqMh.exe	N/A
N/A	N/A	C:\Windows\System\gdnHSqS.exe	N/A
N/A	N/A	C:\Windows\System\hWbczbS.exe	N/A
N/A	N/A	C:\Windows\System\CQVahRn.exe	N/A
N/A	N/A	C:\Windows\System\UYZMvTT.exe	N/A
N/A	N/A	C:\Windows\System\nbRtzHu.exe	N/A
N/A	N/A	C:\Windows\System\JMcZakL.exe	N/A
N/A	N/A	C:\Windows\System\PINcOcC.exe	N/A
N/A	N/A	C:\Windows\System\nKwOUFj.exe	N/A
N/A	N/A	C:\Windows\System\ybdhDGs.exe	N/A
N/A	N/A	C:\Windows\System\DgVLwjB.exe	N/A
N/A	N/A	C:\Windows\System\gSiHPkz.exe	N/A
N/A	N/A	C:\Windows\System\ktKqCeU.exe	N/A
N/A	N/A	C:\Windows\System\EaMGGPz.exe	N/A
N/A	N/A	C:\Windows\System\KuswQro.exe	N/A
N/A	N/A	C:\Windows\System\AGuffro.exe	N/A
N/A	N/A	C:\Windows\System\eFDNfqt.exe	N/A
N/A	N/A	C:\Windows\System\nmYCHvs.exe	N/A
N/A	N/A	C:\Windows\System\PulYuTj.exe	N/A
N/A	N/A	C:\Windows\System\PWwJNfp.exe	N/A
N/A	N/A	C:\Windows\System\xLAisEF.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\VXUplWB.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DKoSghd.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DEgufsi.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qOJqEly.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uXyotSM.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lrDLcYY.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CKSzYdx.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QHJSHTh.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EaMGGPz.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YNUJYvm.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GoEbFuz.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DMspIiq.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cpMxifI.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GdfMwLi.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\miGjTSD.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UtNqFLS.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cONMXTA.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yabUlHh.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NusWTHK.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IIjOuNs.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IWJPJou.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hFWBIfb.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JxIzWkj.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bjueiHT.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FBcWIRS.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ihXAZYI.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cDsgBXB.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kCRwsoE.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tMEOWhw.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KpMQPoZ.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nxOVEhg.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WAOGEmr.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EvDsTch.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KRfcHmJ.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nNpWrmh.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xdbjAFa.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YIJspSY.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ruNOUFU.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ozcgQuJ.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eMIfYlD.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\faATOjv.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RMdpnPY.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TUqPBJT.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZncAHZG.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hnDuGld.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HFQKUvv.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MdLWWis.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LrTaPKs.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vrxHuqm.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lFtDxUd.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FHMnqdr.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jKHhorf.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\exhRVoQ.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wYMzelS.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UVwnoIK.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HqOktnb.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NVFMEiB.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TRebVrI.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VAcMpaI.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aPZtYCQ.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FwMBfZX.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DaFcIfG.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TXprURE.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oszImmE.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2916 wrote to memory of 2156	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2916 wrote to memory of 2156	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2916 wrote to memory of 2156	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2916 wrote to memory of 2752	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\AWZYtUc.exe
PID 2916 wrote to memory of 2752	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\AWZYtUc.exe
PID 2916 wrote to memory of 2752	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\AWZYtUc.exe
PID 2916 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\nrMiFiX.exe
PID 2916 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\nrMiFiX.exe
PID 2916 wrote to memory of 2620	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\nrMiFiX.exe
PID 2916 wrote to memory of 2616	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\qqbFzCh.exe
PID 2916 wrote to memory of 2616	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\qqbFzCh.exe
PID 2916 wrote to memory of 2616	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\qqbFzCh.exe
PID 2916 wrote to memory of 2680	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\uzSlvJz.exe
PID 2916 wrote to memory of 2680	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\uzSlvJz.exe
PID 2916 wrote to memory of 2680	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\uzSlvJz.exe
PID 2916 wrote to memory of 2812	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\VlqvUdd.exe
PID 2916 wrote to memory of 2812	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\VlqvUdd.exe
PID 2916 wrote to memory of 2812	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\VlqvUdd.exe
PID 2916 wrote to memory of 1504	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\QpghnYu.exe
PID 2916 wrote to memory of 1504	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\QpghnYu.exe
PID 2916 wrote to memory of 1504	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\QpghnYu.exe
PID 2916 wrote to memory of 2496	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\bnNMwXB.exe
PID 2916 wrote to memory of 2496	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\bnNMwXB.exe
PID 2916 wrote to memory of 2496	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\bnNMwXB.exe
PID 2916 wrote to memory of 2640	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\kNJQKIS.exe
PID 2916 wrote to memory of 2640	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\kNJQKIS.exe
PID 2916 wrote to memory of 2640	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\kNJQKIS.exe
PID 2916 wrote to memory of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\MmBXhpK.exe
PID 2916 wrote to memory of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\MmBXhpK.exe
PID 2916 wrote to memory of 2472	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\MmBXhpK.exe
PID 2916 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\BOptnxD.exe
PID 2916 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\BOptnxD.exe
PID 2916 wrote to memory of 2548	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\BOptnxD.exe
PID 2916 wrote to memory of 2524	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\YFmpSLF.exe
PID 2916 wrote to memory of 2524	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\YFmpSLF.exe
PID 2916 wrote to memory of 2524	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\YFmpSLF.exe
PID 2916 wrote to memory of 1484	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\zuZQbif.exe
PID 2916 wrote to memory of 1484	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\zuZQbif.exe
PID 2916 wrote to memory of 1484	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\zuZQbif.exe
PID 2916 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\JrGaDXV.exe
PID 2916 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\JrGaDXV.exe
PID 2916 wrote to memory of 2456	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\JrGaDXV.exe
PID 2916 wrote to memory of 1808	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\lzRSdWm.exe
PID 2916 wrote to memory of 1808	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\lzRSdWm.exe
PID 2916 wrote to memory of 1808	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\lzRSdWm.exe
PID 2916 wrote to memory of 1520	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\WFXxQTn.exe
PID 2916 wrote to memory of 1520	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\WFXxQTn.exe
PID 2916 wrote to memory of 1520	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\WFXxQTn.exe
PID 2916 wrote to memory of 1796	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\jJbKPCi.exe
PID 2916 wrote to memory of 1796	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\jJbKPCi.exe
PID 2916 wrote to memory of 1796	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\jJbKPCi.exe
PID 2916 wrote to memory of 1788	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\AOBAVHt.exe
PID 2916 wrote to memory of 1788	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\AOBAVHt.exe
PID 2916 wrote to memory of 1788	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\AOBAVHt.exe
PID 2916 wrote to memory of 1936	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\kCRwsoE.exe
PID 2916 wrote to memory of 1936	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\kCRwsoE.exe
PID 2916 wrote to memory of 1936	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\kCRwsoE.exe
PID 2916 wrote to memory of 2180	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\nkIKlFM.exe
PID 2916 wrote to memory of 2180	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\nkIKlFM.exe
PID 2916 wrote to memory of 2180	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\nkIKlFM.exe
PID 2916 wrote to memory of 1728	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\xNhFcXc.exe
PID 2916 wrote to memory of 1728	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\xNhFcXc.exe
PID 2916 wrote to memory of 1728	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\xNhFcXc.exe
PID 2916 wrote to memory of 2404	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\uxRPSdK.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\AWZYtUc.exe

C:\Windows\System\AWZYtUc.exe

C:\Windows\System\nrMiFiX.exe

C:\Windows\System\nrMiFiX.exe

C:\Windows\System\qqbFzCh.exe

C:\Windows\System\qqbFzCh.exe

C:\Windows\System\uzSlvJz.exe

C:\Windows\System\uzSlvJz.exe

C:\Windows\System\VlqvUdd.exe

C:\Windows\System\VlqvUdd.exe

C:\Windows\System\QpghnYu.exe

C:\Windows\System\QpghnYu.exe

C:\Windows\System\bnNMwXB.exe

C:\Windows\System\bnNMwXB.exe

C:\Windows\System\kNJQKIS.exe

C:\Windows\System\kNJQKIS.exe

C:\Windows\System\MmBXhpK.exe

C:\Windows\System\MmBXhpK.exe

C:\Windows\System\BOptnxD.exe

C:\Windows\System\BOptnxD.exe

C:\Windows\System\YFmpSLF.exe

C:\Windows\System\YFmpSLF.exe

C:\Windows\System\zuZQbif.exe

C:\Windows\System\zuZQbif.exe

C:\Windows\System\JrGaDXV.exe

C:\Windows\System\JrGaDXV.exe

C:\Windows\System\lzRSdWm.exe

C:\Windows\System\lzRSdWm.exe

C:\Windows\System\WFXxQTn.exe

C:\Windows\System\WFXxQTn.exe

C:\Windows\System\jJbKPCi.exe

C:\Windows\System\jJbKPCi.exe

C:\Windows\System\AOBAVHt.exe

C:\Windows\System\AOBAVHt.exe

C:\Windows\System\kCRwsoE.exe

C:\Windows\System\kCRwsoE.exe

C:\Windows\System\nkIKlFM.exe

C:\Windows\System\nkIKlFM.exe

C:\Windows\System\xNhFcXc.exe

C:\Windows\System\xNhFcXc.exe

C:\Windows\System\uxRPSdK.exe

C:\Windows\System\uxRPSdK.exe

C:\Windows\System\etTqfnA.exe

C:\Windows\System\etTqfnA.exe

C:\Windows\System\xpfpqVc.exe

C:\Windows\System\xpfpqVc.exe

C:\Windows\System\KlHImmI.exe

C:\Windows\System\KlHImmI.exe

C:\Windows\System\YbByply.exe

C:\Windows\System\YbByply.exe

C:\Windows\System\SGMnpYK.exe

C:\Windows\System\SGMnpYK.exe

C:\Windows\System\SdQTUIa.exe

C:\Windows\System\SdQTUIa.exe

C:\Windows\System\Pjwnbnl.exe

C:\Windows\System\Pjwnbnl.exe

C:\Windows\System\rTUkHrS.exe

C:\Windows\System\rTUkHrS.exe

C:\Windows\System\IkNqgQn.exe

C:\Windows\System\IkNqgQn.exe

C:\Windows\System\alrFqbL.exe

C:\Windows\System\alrFqbL.exe

C:\Windows\System\HDeDeyC.exe

C:\Windows\System\HDeDeyC.exe

C:\Windows\System\SAqRzHS.exe

C:\Windows\System\SAqRzHS.exe

C:\Windows\System\ojluapu.exe

C:\Windows\System\ojluapu.exe

C:\Windows\System\RXQqJoa.exe

C:\Windows\System\RXQqJoa.exe

C:\Windows\System\PcgRwIT.exe

C:\Windows\System\PcgRwIT.exe

C:\Windows\System\WduJvtt.exe

C:\Windows\System\WduJvtt.exe

C:\Windows\System\RJCreTp.exe

C:\Windows\System\RJCreTp.exe

C:\Windows\System\HZyamcI.exe

C:\Windows\System\HZyamcI.exe

C:\Windows\System\KsFxxPm.exe

C:\Windows\System\KsFxxPm.exe

C:\Windows\System\gUwJICo.exe

C:\Windows\System\gUwJICo.exe

C:\Windows\System\zBibPYM.exe

C:\Windows\System\zBibPYM.exe

C:\Windows\System\wWJZNiC.exe

C:\Windows\System\wWJZNiC.exe

C:\Windows\System\hPzcqMh.exe

C:\Windows\System\hPzcqMh.exe

C:\Windows\System\gdnHSqS.exe

C:\Windows\System\gdnHSqS.exe

C:\Windows\System\hWbczbS.exe

C:\Windows\System\hWbczbS.exe

C:\Windows\System\CQVahRn.exe

C:\Windows\System\CQVahRn.exe

C:\Windows\System\UYZMvTT.exe

C:\Windows\System\UYZMvTT.exe

C:\Windows\System\nbRtzHu.exe

C:\Windows\System\nbRtzHu.exe

C:\Windows\System\JMcZakL.exe

C:\Windows\System\JMcZakL.exe

C:\Windows\System\PINcOcC.exe

C:\Windows\System\PINcOcC.exe

C:\Windows\System\nKwOUFj.exe

C:\Windows\System\nKwOUFj.exe

C:\Windows\System\ybdhDGs.exe

C:\Windows\System\ybdhDGs.exe

C:\Windows\System\DgVLwjB.exe

C:\Windows\System\DgVLwjB.exe

C:\Windows\System\gSiHPkz.exe

C:\Windows\System\gSiHPkz.exe

C:\Windows\System\ktKqCeU.exe

C:\Windows\System\ktKqCeU.exe

C:\Windows\System\EaMGGPz.exe

C:\Windows\System\EaMGGPz.exe

C:\Windows\System\KuswQro.exe

C:\Windows\System\KuswQro.exe

C:\Windows\System\AGuffro.exe

C:\Windows\System\AGuffro.exe

C:\Windows\System\eFDNfqt.exe

C:\Windows\System\eFDNfqt.exe

C:\Windows\System\nmYCHvs.exe

C:\Windows\System\nmYCHvs.exe

C:\Windows\System\PulYuTj.exe

C:\Windows\System\PulYuTj.exe

C:\Windows\System\PWwJNfp.exe

C:\Windows\System\PWwJNfp.exe

C:\Windows\System\xLAisEF.exe

C:\Windows\System\xLAisEF.exe

C:\Windows\System\SNfHXXS.exe

C:\Windows\System\SNfHXXS.exe

C:\Windows\System\HtEFeTi.exe

C:\Windows\System\HtEFeTi.exe

C:\Windows\System\zdvZrxF.exe

C:\Windows\System\zdvZrxF.exe

C:\Windows\System\GPHawjh.exe

C:\Windows\System\GPHawjh.exe

C:\Windows\System\NxWlDny.exe

C:\Windows\System\NxWlDny.exe

C:\Windows\System\PAZxsfY.exe

C:\Windows\System\PAZxsfY.exe

C:\Windows\System\EvfbVRa.exe

C:\Windows\System\EvfbVRa.exe

C:\Windows\System\IWJPJou.exe

C:\Windows\System\IWJPJou.exe

C:\Windows\System\SNtcfSR.exe

C:\Windows\System\SNtcfSR.exe

C:\Windows\System\pCxQwAI.exe

C:\Windows\System\pCxQwAI.exe

C:\Windows\System\KuUAxDE.exe

C:\Windows\System\KuUAxDE.exe

C:\Windows\System\shRjvij.exe

C:\Windows\System\shRjvij.exe

C:\Windows\System\SwbPAxh.exe

C:\Windows\System\SwbPAxh.exe

C:\Windows\System\LMTbmWU.exe

C:\Windows\System\LMTbmWU.exe

C:\Windows\System\BjFNfur.exe

C:\Windows\System\BjFNfur.exe

C:\Windows\System\XWmDqAA.exe

C:\Windows\System\XWmDqAA.exe

C:\Windows\System\xpRImPy.exe

C:\Windows\System\xpRImPy.exe

C:\Windows\System\zJDvVte.exe

C:\Windows\System\zJDvVte.exe

C:\Windows\System\FzhLMFo.exe

C:\Windows\System\FzhLMFo.exe

C:\Windows\System\NLmBvqH.exe

C:\Windows\System\NLmBvqH.exe

C:\Windows\System\BxzAorF.exe

C:\Windows\System\BxzAorF.exe

C:\Windows\System\czXHJzN.exe

C:\Windows\System\czXHJzN.exe

C:\Windows\System\mSAzjJJ.exe

C:\Windows\System\mSAzjJJ.exe

C:\Windows\System\FvmPdZi.exe

C:\Windows\System\FvmPdZi.exe

C:\Windows\System\yOkOkBk.exe

C:\Windows\System\yOkOkBk.exe

C:\Windows\System\mWcPcwT.exe

C:\Windows\System\mWcPcwT.exe

C:\Windows\System\BNqbHBd.exe

C:\Windows\System\BNqbHBd.exe

C:\Windows\System\UKjJniM.exe

C:\Windows\System\UKjJniM.exe

C:\Windows\System\bVAZAVB.exe

C:\Windows\System\bVAZAVB.exe

C:\Windows\System\CaOWWPY.exe

C:\Windows\System\CaOWWPY.exe

C:\Windows\System\phLiBfo.exe

C:\Windows\System\phLiBfo.exe

C:\Windows\System\hcrrYkm.exe

C:\Windows\System\hcrrYkm.exe

C:\Windows\System\UcWFmsg.exe

C:\Windows\System\UcWFmsg.exe

C:\Windows\System\ojpfhYV.exe

C:\Windows\System\ojpfhYV.exe

C:\Windows\System\WconoxC.exe

C:\Windows\System\WconoxC.exe

C:\Windows\System\HtbTvEl.exe

C:\Windows\System\HtbTvEl.exe

C:\Windows\System\lUMTeft.exe

C:\Windows\System\lUMTeft.exe

C:\Windows\System\PxyEdrS.exe

C:\Windows\System\PxyEdrS.exe

C:\Windows\System\iTUMxaS.exe

C:\Windows\System\iTUMxaS.exe

C:\Windows\System\SCInyJm.exe

C:\Windows\System\SCInyJm.exe

C:\Windows\System\cpMxifI.exe

C:\Windows\System\cpMxifI.exe

C:\Windows\System\mVvZBbk.exe

C:\Windows\System\mVvZBbk.exe

C:\Windows\System\FPwUACE.exe

C:\Windows\System\FPwUACE.exe

C:\Windows\System\glLSZoe.exe

C:\Windows\System\glLSZoe.exe

C:\Windows\System\jnYqpPW.exe

C:\Windows\System\jnYqpPW.exe

C:\Windows\System\cONMXTA.exe

C:\Windows\System\cONMXTA.exe

C:\Windows\System\JyJXala.exe

C:\Windows\System\JyJXala.exe

C:\Windows\System\GZqhZOH.exe

C:\Windows\System\GZqhZOH.exe

C:\Windows\System\fWUyZam.exe

C:\Windows\System\fWUyZam.exe

C:\Windows\System\pNyiBcq.exe

C:\Windows\System\pNyiBcq.exe

C:\Windows\System\yZhvenH.exe

C:\Windows\System\yZhvenH.exe

C:\Windows\System\YQvksJm.exe

C:\Windows\System\YQvksJm.exe

C:\Windows\System\rycjVvK.exe

C:\Windows\System\rycjVvK.exe

C:\Windows\System\hnDuGld.exe

C:\Windows\System\hnDuGld.exe

C:\Windows\System\rFnIDYl.exe

C:\Windows\System\rFnIDYl.exe

C:\Windows\System\cRgzTQD.exe

C:\Windows\System\cRgzTQD.exe

C:\Windows\System\EfbJDjy.exe

C:\Windows\System\EfbJDjy.exe

C:\Windows\System\BNhkybM.exe

C:\Windows\System\BNhkybM.exe

C:\Windows\System\JyZnDwu.exe

C:\Windows\System\JyZnDwu.exe

C:\Windows\System\xriOOMm.exe

C:\Windows\System\xriOOMm.exe

C:\Windows\System\oOUwNEr.exe

C:\Windows\System\oOUwNEr.exe

C:\Windows\System\HebnDON.exe

C:\Windows\System\HebnDON.exe

C:\Windows\System\lrawIhS.exe

C:\Windows\System\lrawIhS.exe

C:\Windows\System\WkrquLH.exe

C:\Windows\System\WkrquLH.exe

C:\Windows\System\DVaUXpX.exe

C:\Windows\System\DVaUXpX.exe

C:\Windows\System\vCrQzVK.exe

C:\Windows\System\vCrQzVK.exe

C:\Windows\System\hsusUAl.exe

C:\Windows\System\hsusUAl.exe

C:\Windows\System\dEwRAZC.exe

C:\Windows\System\dEwRAZC.exe

C:\Windows\System\rvqInWw.exe

C:\Windows\System\rvqInWw.exe

C:\Windows\System\uMHPIMB.exe

C:\Windows\System\uMHPIMB.exe

C:\Windows\System\tFZlzqa.exe

C:\Windows\System\tFZlzqa.exe

C:\Windows\System\JNjjbYG.exe

C:\Windows\System\JNjjbYG.exe

C:\Windows\System\AkRIjLB.exe

C:\Windows\System\AkRIjLB.exe

C:\Windows\System\mugXdzm.exe

C:\Windows\System\mugXdzm.exe

C:\Windows\System\GLVyUQY.exe

C:\Windows\System\GLVyUQY.exe

C:\Windows\System\txmMEyy.exe

C:\Windows\System\txmMEyy.exe

C:\Windows\System\RTTnZse.exe

C:\Windows\System\RTTnZse.exe

C:\Windows\System\ZOCfMtX.exe

C:\Windows\System\ZOCfMtX.exe

C:\Windows\System\BybLwjI.exe

C:\Windows\System\BybLwjI.exe

C:\Windows\System\gVhEtgC.exe

C:\Windows\System\gVhEtgC.exe

C:\Windows\System\qMiXZPW.exe

C:\Windows\System\qMiXZPW.exe

C:\Windows\System\zkdamHN.exe

C:\Windows\System\zkdamHN.exe

C:\Windows\System\QpRlabe.exe

C:\Windows\System\QpRlabe.exe

C:\Windows\System\WNYcYfg.exe

C:\Windows\System\WNYcYfg.exe

C:\Windows\System\xRYdKxV.exe

C:\Windows\System\xRYdKxV.exe

C:\Windows\System\SqXHjGI.exe

C:\Windows\System\SqXHjGI.exe

C:\Windows\System\rgpfqts.exe

C:\Windows\System\rgpfqts.exe

C:\Windows\System\ywzTXWG.exe

C:\Windows\System\ywzTXWG.exe

C:\Windows\System\fprgYUF.exe

C:\Windows\System\fprgYUF.exe

C:\Windows\System\EAjDytR.exe

C:\Windows\System\EAjDytR.exe

C:\Windows\System\dRenbHJ.exe

C:\Windows\System\dRenbHJ.exe

C:\Windows\System\RTDNpUv.exe

C:\Windows\System\RTDNpUv.exe

C:\Windows\System\WaTlEBd.exe

C:\Windows\System\WaTlEBd.exe

C:\Windows\System\kokgJxL.exe

C:\Windows\System\kokgJxL.exe

C:\Windows\System\DLzuKPl.exe

C:\Windows\System\DLzuKPl.exe

C:\Windows\System\QZrHZbC.exe

C:\Windows\System\QZrHZbC.exe

C:\Windows\System\pIHXmrc.exe

C:\Windows\System\pIHXmrc.exe

C:\Windows\System\ZVHErUl.exe

C:\Windows\System\ZVHErUl.exe

C:\Windows\System\RkOAuLK.exe

C:\Windows\System\RkOAuLK.exe

C:\Windows\System\ynHUjjV.exe

C:\Windows\System\ynHUjjV.exe

C:\Windows\System\CqQGdzR.exe

C:\Windows\System\CqQGdzR.exe

C:\Windows\System\OBCHVSa.exe

C:\Windows\System\OBCHVSa.exe

C:\Windows\System\hTvtDiX.exe

C:\Windows\System\hTvtDiX.exe

C:\Windows\System\xfSkSIq.exe

C:\Windows\System\xfSkSIq.exe

C:\Windows\System\brZwgUW.exe

C:\Windows\System\brZwgUW.exe

C:\Windows\System\OEUYuos.exe

C:\Windows\System\OEUYuos.exe

C:\Windows\System\kXCjmHG.exe

C:\Windows\System\kXCjmHG.exe

C:\Windows\System\jLkKlDi.exe

C:\Windows\System\jLkKlDi.exe

C:\Windows\System\GUfczFj.exe

C:\Windows\System\GUfczFj.exe

C:\Windows\System\UiErBGJ.exe

C:\Windows\System\UiErBGJ.exe

C:\Windows\System\wmVWXMX.exe

C:\Windows\System\wmVWXMX.exe

C:\Windows\System\usSOwOo.exe

C:\Windows\System\usSOwOo.exe

C:\Windows\System\wCrGRzx.exe

C:\Windows\System\wCrGRzx.exe

C:\Windows\System\WyPTTsl.exe

C:\Windows\System\WyPTTsl.exe

C:\Windows\System\eJMnKIF.exe

C:\Windows\System\eJMnKIF.exe

C:\Windows\System\cjzUlwP.exe

C:\Windows\System\cjzUlwP.exe

C:\Windows\System\PVrYDmA.exe

C:\Windows\System\PVrYDmA.exe

C:\Windows\System\mORGtGz.exe

C:\Windows\System\mORGtGz.exe

C:\Windows\System\uNFjFLq.exe

C:\Windows\System\uNFjFLq.exe

C:\Windows\System\aIgZvjD.exe

C:\Windows\System\aIgZvjD.exe

C:\Windows\System\HRLXLFE.exe

C:\Windows\System\HRLXLFE.exe

C:\Windows\System\lDBQMlU.exe

C:\Windows\System\lDBQMlU.exe

C:\Windows\System\wJWSaTQ.exe

C:\Windows\System\wJWSaTQ.exe

C:\Windows\System\YSKdPiy.exe

C:\Windows\System\YSKdPiy.exe

C:\Windows\System\ghRzjaH.exe

C:\Windows\System\ghRzjaH.exe

C:\Windows\System\KHJcRvC.exe

C:\Windows\System\KHJcRvC.exe

C:\Windows\System\bGhMlax.exe

C:\Windows\System\bGhMlax.exe

C:\Windows\System\IRcWLmO.exe

C:\Windows\System\IRcWLmO.exe

C:\Windows\System\oalrUuT.exe

C:\Windows\System\oalrUuT.exe

C:\Windows\System\SOMPnsq.exe

C:\Windows\System\SOMPnsq.exe

C:\Windows\System\QtUQohW.exe

C:\Windows\System\QtUQohW.exe

C:\Windows\System\EXajRpu.exe

C:\Windows\System\EXajRpu.exe

C:\Windows\System\LAAWeOH.exe

C:\Windows\System\LAAWeOH.exe

C:\Windows\System\whyThxp.exe

C:\Windows\System\whyThxp.exe

C:\Windows\System\qLYITOY.exe

C:\Windows\System\qLYITOY.exe

C:\Windows\System\wIJzlZX.exe

C:\Windows\System\wIJzlZX.exe

C:\Windows\System\ehqFBux.exe

C:\Windows\System\ehqFBux.exe

C:\Windows\System\RUyFGEl.exe

C:\Windows\System\RUyFGEl.exe

C:\Windows\System\HHwdiCt.exe

C:\Windows\System\HHwdiCt.exe

C:\Windows\System\GfXMndb.exe

C:\Windows\System\GfXMndb.exe

C:\Windows\System\CWhIZgH.exe

C:\Windows\System\CWhIZgH.exe

C:\Windows\System\CaRRtwW.exe

C:\Windows\System\CaRRtwW.exe

C:\Windows\System\ruGTrYt.exe

C:\Windows\System\ruGTrYt.exe

C:\Windows\System\jAxlTxR.exe

C:\Windows\System\jAxlTxR.exe

C:\Windows\System\CAfzWOo.exe

C:\Windows\System\CAfzWOo.exe

C:\Windows\System\tGhxCjQ.exe

C:\Windows\System\tGhxCjQ.exe

C:\Windows\System\VXPCcaE.exe

C:\Windows\System\VXPCcaE.exe

C:\Windows\System\KlmJfHx.exe

C:\Windows\System\KlmJfHx.exe

C:\Windows\System\PvkHAEa.exe

C:\Windows\System\PvkHAEa.exe

C:\Windows\System\TDzVEhe.exe

C:\Windows\System\TDzVEhe.exe

C:\Windows\System\IaDFPkq.exe

C:\Windows\System\IaDFPkq.exe

C:\Windows\System\QpTTpMO.exe

C:\Windows\System\QpTTpMO.exe

C:\Windows\System\AizcSDQ.exe

C:\Windows\System\AizcSDQ.exe

C:\Windows\System\bNsGgDo.exe

C:\Windows\System\bNsGgDo.exe

C:\Windows\System\XDtmuTK.exe

C:\Windows\System\XDtmuTK.exe

C:\Windows\System\eFITcGP.exe

C:\Windows\System\eFITcGP.exe

C:\Windows\System\SiQysFO.exe

C:\Windows\System\SiQysFO.exe

C:\Windows\System\ZwCoCet.exe

C:\Windows\System\ZwCoCet.exe

C:\Windows\System\BjMXQRs.exe

C:\Windows\System\BjMXQRs.exe

C:\Windows\System\aMiTjYL.exe

C:\Windows\System\aMiTjYL.exe

C:\Windows\System\qiwvoKD.exe

C:\Windows\System\qiwvoKD.exe

C:\Windows\System\VjIxlGe.exe

C:\Windows\System\VjIxlGe.exe

C:\Windows\System\GjTugWv.exe

C:\Windows\System\GjTugWv.exe

C:\Windows\System\FGrSlVE.exe

C:\Windows\System\FGrSlVE.exe

C:\Windows\System\pPodMzW.exe

C:\Windows\System\pPodMzW.exe

C:\Windows\System\EvDsTch.exe

C:\Windows\System\EvDsTch.exe

C:\Windows\System\LgqrmWP.exe

C:\Windows\System\LgqrmWP.exe

C:\Windows\System\QEviisE.exe

C:\Windows\System\QEviisE.exe

C:\Windows\System\HqOktnb.exe

C:\Windows\System\HqOktnb.exe

C:\Windows\System\bWvXLBd.exe

C:\Windows\System\bWvXLBd.exe

C:\Windows\System\UCjqIWt.exe

C:\Windows\System\UCjqIWt.exe

C:\Windows\System\lzOFzWN.exe

C:\Windows\System\lzOFzWN.exe

C:\Windows\System\IJxXVDt.exe

C:\Windows\System\IJxXVDt.exe

C:\Windows\System\XcQsQcl.exe

C:\Windows\System\XcQsQcl.exe

C:\Windows\System\XOKrrry.exe

C:\Windows\System\XOKrrry.exe

C:\Windows\System\giETCgx.exe

C:\Windows\System\giETCgx.exe

C:\Windows\System\oPyfyjG.exe

C:\Windows\System\oPyfyjG.exe

C:\Windows\System\YVPgpKA.exe

C:\Windows\System\YVPgpKA.exe

C:\Windows\System\UDeKOZT.exe

C:\Windows\System\UDeKOZT.exe

C:\Windows\System\boEuEuS.exe

C:\Windows\System\boEuEuS.exe

C:\Windows\System\ETYGhmX.exe

C:\Windows\System\ETYGhmX.exe

C:\Windows\System\nbExamx.exe

C:\Windows\System\nbExamx.exe

C:\Windows\System\ozcgQuJ.exe

C:\Windows\System\ozcgQuJ.exe

C:\Windows\System\tSnnSoH.exe

C:\Windows\System\tSnnSoH.exe

C:\Windows\System\mIMCbzo.exe

C:\Windows\System\mIMCbzo.exe

C:\Windows\System\vYMHRsR.exe

C:\Windows\System\vYMHRsR.exe

C:\Windows\System\BTHGlLb.exe

C:\Windows\System\BTHGlLb.exe

C:\Windows\System\GiziZfg.exe

C:\Windows\System\GiziZfg.exe

C:\Windows\System\YXGKRaM.exe

C:\Windows\System\YXGKRaM.exe

C:\Windows\System\FKzzcoF.exe

C:\Windows\System\FKzzcoF.exe

C:\Windows\System\FKYrYuE.exe

C:\Windows\System\FKYrYuE.exe

C:\Windows\System\okoqMrJ.exe

C:\Windows\System\okoqMrJ.exe

C:\Windows\System\BQsMfWp.exe

C:\Windows\System\BQsMfWp.exe

C:\Windows\System\GRwSzIH.exe

C:\Windows\System\GRwSzIH.exe

C:\Windows\System\iqQjTyr.exe

C:\Windows\System\iqQjTyr.exe

C:\Windows\System\fHlvvRA.exe

C:\Windows\System\fHlvvRA.exe

C:\Windows\System\YxIpIXy.exe

C:\Windows\System\YxIpIXy.exe

C:\Windows\System\NbVePdv.exe

C:\Windows\System\NbVePdv.exe

C:\Windows\System\GbAyxFZ.exe

C:\Windows\System\GbAyxFZ.exe

C:\Windows\System\JqoDXYF.exe

C:\Windows\System\JqoDXYF.exe

C:\Windows\System\yWsRANH.exe

C:\Windows\System\yWsRANH.exe

C:\Windows\System\puyQHGs.exe

C:\Windows\System\puyQHGs.exe

C:\Windows\System\HeqwQlu.exe

C:\Windows\System\HeqwQlu.exe

C:\Windows\System\mhtyIvf.exe

C:\Windows\System\mhtyIvf.exe

C:\Windows\System\sMLBAih.exe

C:\Windows\System\sMLBAih.exe

C:\Windows\System\XutVnhr.exe

C:\Windows\System\XutVnhr.exe

C:\Windows\System\SnahbEo.exe

C:\Windows\System\SnahbEo.exe

C:\Windows\System\syVOdrs.exe

C:\Windows\System\syVOdrs.exe

C:\Windows\System\JupKUUB.exe

C:\Windows\System\JupKUUB.exe

C:\Windows\System\cDsgBXB.exe

C:\Windows\System\cDsgBXB.exe

C:\Windows\System\AnIwNyW.exe

C:\Windows\System\AnIwNyW.exe

C:\Windows\System\VCxdvfI.exe

C:\Windows\System\VCxdvfI.exe

C:\Windows\System\zMOtmIf.exe

C:\Windows\System\zMOtmIf.exe

C:\Windows\System\jAoIeeX.exe

C:\Windows\System\jAoIeeX.exe

C:\Windows\System\YOqtlWj.exe

C:\Windows\System\YOqtlWj.exe

C:\Windows\System\kwJXXbX.exe

C:\Windows\System\kwJXXbX.exe

C:\Windows\System\ZEIrSEy.exe

C:\Windows\System\ZEIrSEy.exe

C:\Windows\System\IOobVqk.exe

C:\Windows\System\IOobVqk.exe

C:\Windows\System\DlDalHA.exe

C:\Windows\System\DlDalHA.exe

C:\Windows\System\qzRTBLb.exe

C:\Windows\System\qzRTBLb.exe

C:\Windows\System\oqcLLLj.exe

C:\Windows\System\oqcLLLj.exe

C:\Windows\System\GFpiAaK.exe

C:\Windows\System\GFpiAaK.exe

C:\Windows\System\uLKvzzx.exe

C:\Windows\System\uLKvzzx.exe

C:\Windows\System\xTXnfpV.exe

C:\Windows\System\xTXnfpV.exe

C:\Windows\System\uZOxYjw.exe

C:\Windows\System\uZOxYjw.exe

C:\Windows\System\enTCzBX.exe

C:\Windows\System\enTCzBX.exe

C:\Windows\System\EqvYRih.exe

C:\Windows\System\EqvYRih.exe

C:\Windows\System\TegnAey.exe

C:\Windows\System\TegnAey.exe

C:\Windows\System\ZDlrONX.exe

C:\Windows\System\ZDlrONX.exe

C:\Windows\System\VZkIKai.exe

C:\Windows\System\VZkIKai.exe

C:\Windows\System\GXeUKpJ.exe

C:\Windows\System\GXeUKpJ.exe

C:\Windows\System\afuspFO.exe

C:\Windows\System\afuspFO.exe

C:\Windows\System\ZCUbbla.exe

C:\Windows\System\ZCUbbla.exe

C:\Windows\System\DEgufsi.exe

C:\Windows\System\DEgufsi.exe

C:\Windows\System\CZaxBKl.exe

C:\Windows\System\CZaxBKl.exe

C:\Windows\System\gkkiGze.exe

C:\Windows\System\gkkiGze.exe

C:\Windows\System\TcieLsj.exe

C:\Windows\System\TcieLsj.exe

C:\Windows\System\KjsfhdT.exe

C:\Windows\System\KjsfhdT.exe

C:\Windows\System\locywkd.exe

C:\Windows\System\locywkd.exe

C:\Windows\System\rUtBfun.exe

C:\Windows\System\rUtBfun.exe

C:\Windows\System\PNTvxji.exe

C:\Windows\System\PNTvxji.exe

C:\Windows\System\dDNJuhp.exe

C:\Windows\System\dDNJuhp.exe

C:\Windows\System\suSaRgy.exe

C:\Windows\System\suSaRgy.exe

C:\Windows\System\vdluFPN.exe

C:\Windows\System\vdluFPN.exe

C:\Windows\System\Ogfcufi.exe

C:\Windows\System\Ogfcufi.exe

C:\Windows\System\gZEWldZ.exe

C:\Windows\System\gZEWldZ.exe

C:\Windows\System\adLXZzb.exe

C:\Windows\System\adLXZzb.exe

C:\Windows\System\dHhhWlJ.exe

C:\Windows\System\dHhhWlJ.exe

C:\Windows\System\llJvaFA.exe

C:\Windows\System\llJvaFA.exe

C:\Windows\System\HApUPnj.exe

C:\Windows\System\HApUPnj.exe

C:\Windows\System\fAyCkwz.exe

C:\Windows\System\fAyCkwz.exe

C:\Windows\System\YQRBRwZ.exe

C:\Windows\System\YQRBRwZ.exe

C:\Windows\System\vwlxGiC.exe

C:\Windows\System\vwlxGiC.exe

C:\Windows\System\sxnZeQn.exe

C:\Windows\System\sxnZeQn.exe

C:\Windows\System\GuEXRNh.exe

C:\Windows\System\GuEXRNh.exe

C:\Windows\System\CKSzYdx.exe

C:\Windows\System\CKSzYdx.exe

C:\Windows\System\KzVnTVJ.exe

C:\Windows\System\KzVnTVJ.exe

C:\Windows\System\IDLFqBp.exe

C:\Windows\System\IDLFqBp.exe

C:\Windows\System\AaHrKBl.exe

C:\Windows\System\AaHrKBl.exe

C:\Windows\System\lvMIPAt.exe

C:\Windows\System\lvMIPAt.exe

C:\Windows\System\nhzIWBB.exe

C:\Windows\System\nhzIWBB.exe

C:\Windows\System\XOMiPcX.exe

C:\Windows\System\XOMiPcX.exe

C:\Windows\System\WUINxgd.exe

C:\Windows\System\WUINxgd.exe

C:\Windows\System\zPTzwgD.exe

C:\Windows\System\zPTzwgD.exe

C:\Windows\System\TRebVrI.exe

C:\Windows\System\TRebVrI.exe

C:\Windows\System\YnZsfSw.exe

C:\Windows\System\YnZsfSw.exe

C:\Windows\System\bUvzBRA.exe

C:\Windows\System\bUvzBRA.exe

C:\Windows\System\WtcZKIB.exe

C:\Windows\System\WtcZKIB.exe

C:\Windows\System\QlqGApf.exe

C:\Windows\System\QlqGApf.exe

C:\Windows\System\wQSDKGz.exe

C:\Windows\System\wQSDKGz.exe

C:\Windows\System\cleRNrh.exe

C:\Windows\System\cleRNrh.exe

C:\Windows\System\arTnWuw.exe

C:\Windows\System\arTnWuw.exe

C:\Windows\System\RofTwJY.exe

C:\Windows\System\RofTwJY.exe

C:\Windows\System\JjVvhRF.exe

C:\Windows\System\JjVvhRF.exe

C:\Windows\System\ozjKajZ.exe

C:\Windows\System\ozjKajZ.exe

C:\Windows\System\IMQCMNZ.exe

C:\Windows\System\IMQCMNZ.exe

C:\Windows\System\UBbebKR.exe

C:\Windows\System\UBbebKR.exe

C:\Windows\System\kHqypTe.exe

C:\Windows\System\kHqypTe.exe

C:\Windows\System\sfOHRDi.exe

C:\Windows\System\sfOHRDi.exe

C:\Windows\System\VDSncbQ.exe

C:\Windows\System\VDSncbQ.exe

C:\Windows\System\eXKjPVO.exe

C:\Windows\System\eXKjPVO.exe

C:\Windows\System\rSSTmTY.exe

C:\Windows\System\rSSTmTY.exe

C:\Windows\System\ASbCLwy.exe

C:\Windows\System\ASbCLwy.exe

C:\Windows\System\GPXBfKp.exe

C:\Windows\System\GPXBfKp.exe

C:\Windows\System\XZikXqk.exe

C:\Windows\System\XZikXqk.exe

C:\Windows\System\aHJPYZd.exe

C:\Windows\System\aHJPYZd.exe

C:\Windows\System\TkglMgO.exe

C:\Windows\System\TkglMgO.exe

C:\Windows\System\dxuEwDP.exe

C:\Windows\System\dxuEwDP.exe

C:\Windows\System\vxxWRck.exe

C:\Windows\System\vxxWRck.exe

C:\Windows\System\QDJwMVp.exe

C:\Windows\System\QDJwMVp.exe

C:\Windows\System\jPVZics.exe

C:\Windows\System\jPVZics.exe

C:\Windows\System\tvaGhTm.exe

C:\Windows\System\tvaGhTm.exe

C:\Windows\System\zeWqsYZ.exe

C:\Windows\System\zeWqsYZ.exe

C:\Windows\System\GteRzCG.exe

C:\Windows\System\GteRzCG.exe

C:\Windows\System\HmDXAmq.exe

C:\Windows\System\HmDXAmq.exe

C:\Windows\System\hmYjosM.exe

C:\Windows\System\hmYjosM.exe

C:\Windows\System\wjKcHTE.exe

C:\Windows\System\wjKcHTE.exe

C:\Windows\System\oQwVvIl.exe

C:\Windows\System\oQwVvIl.exe

C:\Windows\System\uSUQnGt.exe

C:\Windows\System\uSUQnGt.exe

C:\Windows\System\tTXdbwy.exe

C:\Windows\System\tTXdbwy.exe

C:\Windows\System\UudRQxq.exe

C:\Windows\System\UudRQxq.exe

C:\Windows\System\oQtEHdB.exe

C:\Windows\System\oQtEHdB.exe

C:\Windows\System\XamrvdO.exe

C:\Windows\System\XamrvdO.exe

C:\Windows\System\whgWdux.exe

C:\Windows\System\whgWdux.exe

C:\Windows\System\SkDtalx.exe

C:\Windows\System\SkDtalx.exe

C:\Windows\System\DxhrgZO.exe

C:\Windows\System\DxhrgZO.exe

C:\Windows\System\BLNmcnB.exe

C:\Windows\System\BLNmcnB.exe

C:\Windows\System\iUeIQDV.exe

C:\Windows\System\iUeIQDV.exe

C:\Windows\System\WUxpDhe.exe

C:\Windows\System\WUxpDhe.exe

C:\Windows\System\kMQhScD.exe

C:\Windows\System\kMQhScD.exe

C:\Windows\System\oxzlkMo.exe

C:\Windows\System\oxzlkMo.exe

C:\Windows\System\IcOrtQa.exe

C:\Windows\System\IcOrtQa.exe

C:\Windows\System\PyeDuhx.exe

C:\Windows\System\PyeDuhx.exe

C:\Windows\System\kfhQPVB.exe

C:\Windows\System\kfhQPVB.exe

C:\Windows\System\YZHeuSH.exe

C:\Windows\System\YZHeuSH.exe

C:\Windows\System\yWPvGzU.exe

C:\Windows\System\yWPvGzU.exe

C:\Windows\System\vUjwXzQ.exe

C:\Windows\System\vUjwXzQ.exe

C:\Windows\System\CqzoEfo.exe

C:\Windows\System\CqzoEfo.exe

C:\Windows\System\jMRmjTg.exe

C:\Windows\System\jMRmjTg.exe

C:\Windows\System\KAjDxge.exe

C:\Windows\System\KAjDxge.exe

C:\Windows\System\eIWRxsJ.exe

C:\Windows\System\eIWRxsJ.exe

C:\Windows\System\jUkZBkL.exe

C:\Windows\System\jUkZBkL.exe

C:\Windows\System\lRZDBtU.exe

C:\Windows\System\lRZDBtU.exe

C:\Windows\System\zNsMduF.exe

C:\Windows\System\zNsMduF.exe

C:\Windows\System\wgdXoBa.exe

C:\Windows\System\wgdXoBa.exe

C:\Windows\System\IzhhJif.exe

C:\Windows\System\IzhhJif.exe

C:\Windows\System\RxNfuxf.exe

C:\Windows\System\RxNfuxf.exe

C:\Windows\System\nPUXJxK.exe

C:\Windows\System\nPUXJxK.exe

C:\Windows\System\PlZPksj.exe

C:\Windows\System\PlZPksj.exe

C:\Windows\System\LXCXDuU.exe

C:\Windows\System\LXCXDuU.exe

C:\Windows\System\CNmauqb.exe

C:\Windows\System\CNmauqb.exe

C:\Windows\System\euXzesG.exe

C:\Windows\System\euXzesG.exe

C:\Windows\System\etxsTMO.exe

C:\Windows\System\etxsTMO.exe

C:\Windows\System\cbDDUtF.exe

C:\Windows\System\cbDDUtF.exe

C:\Windows\System\GUiAEpC.exe

C:\Windows\System\GUiAEpC.exe

C:\Windows\System\iwgBzqZ.exe

C:\Windows\System\iwgBzqZ.exe

C:\Windows\System\vgvWhpm.exe

C:\Windows\System\vgvWhpm.exe

C:\Windows\System\UqtPUTj.exe

C:\Windows\System\UqtPUTj.exe

C:\Windows\System\SOKYvpd.exe

C:\Windows\System\SOKYvpd.exe

C:\Windows\System\TPspzPF.exe

C:\Windows\System\TPspzPF.exe

C:\Windows\System\DIaQrpT.exe

C:\Windows\System\DIaQrpT.exe

C:\Windows\System\QSZqirg.exe

C:\Windows\System\QSZqirg.exe

C:\Windows\System\fhycWHg.exe

C:\Windows\System\fhycWHg.exe

C:\Windows\System\xZyjlsy.exe

C:\Windows\System\xZyjlsy.exe

C:\Windows\System\KzkeOxZ.exe

C:\Windows\System\KzkeOxZ.exe

C:\Windows\System\PsHHDgg.exe

C:\Windows\System\PsHHDgg.exe

C:\Windows\System\TOSHVPY.exe

C:\Windows\System\TOSHVPY.exe

C:\Windows\System\pIRSUpG.exe

C:\Windows\System\pIRSUpG.exe

C:\Windows\System\YWzFBqz.exe

C:\Windows\System\YWzFBqz.exe

C:\Windows\System\DqRBGEg.exe

C:\Windows\System\DqRBGEg.exe

C:\Windows\System\cfnsLLN.exe

C:\Windows\System\cfnsLLN.exe

C:\Windows\System\DaFcIfG.exe

C:\Windows\System\DaFcIfG.exe

C:\Windows\System\CaQIgEL.exe

C:\Windows\System\CaQIgEL.exe

C:\Windows\System\kayBlWD.exe

C:\Windows\System\kayBlWD.exe

C:\Windows\System\pEerzmP.exe

C:\Windows\System\pEerzmP.exe

C:\Windows\System\DeELUeF.exe

C:\Windows\System\DeELUeF.exe

C:\Windows\System\exhRVoQ.exe

C:\Windows\System\exhRVoQ.exe

C:\Windows\System\XexNKeJ.exe

C:\Windows\System\XexNKeJ.exe

C:\Windows\System\BWkXwvh.exe

C:\Windows\System\BWkXwvh.exe

C:\Windows\System\RPApnPT.exe

C:\Windows\System\RPApnPT.exe

C:\Windows\System\aKNjgLV.exe

C:\Windows\System\aKNjgLV.exe

C:\Windows\System\uUrVexv.exe

C:\Windows\System\uUrVexv.exe

C:\Windows\System\vzAjgsC.exe

C:\Windows\System\vzAjgsC.exe

C:\Windows\System\PKvyyvc.exe

C:\Windows\System\PKvyyvc.exe

C:\Windows\System\msfRwrt.exe

C:\Windows\System\msfRwrt.exe

C:\Windows\System\aVWjrcM.exe

C:\Windows\System\aVWjrcM.exe

C:\Windows\System\hWiqfMV.exe

C:\Windows\System\hWiqfMV.exe

C:\Windows\System\CkiTGDM.exe

C:\Windows\System\CkiTGDM.exe

C:\Windows\System\tVxxoXq.exe

C:\Windows\System\tVxxoXq.exe

C:\Windows\System\OOhoUfD.exe

C:\Windows\System\OOhoUfD.exe

C:\Windows\System\fTqeHAF.exe

C:\Windows\System\fTqeHAF.exe

C:\Windows\System\IDlNwWF.exe

C:\Windows\System\IDlNwWF.exe

C:\Windows\System\cHejrwj.exe

C:\Windows\System\cHejrwj.exe

C:\Windows\System\vlFWMVp.exe

C:\Windows\System\vlFWMVp.exe

C:\Windows\System\FRrgMoP.exe

C:\Windows\System\FRrgMoP.exe

C:\Windows\System\QHJSHTh.exe

C:\Windows\System\QHJSHTh.exe

C:\Windows\System\NFRMMMK.exe

C:\Windows\System\NFRMMMK.exe

C:\Windows\System\rdHcwbk.exe

C:\Windows\System\rdHcwbk.exe

C:\Windows\System\FsfjQBA.exe

C:\Windows\System\FsfjQBA.exe

C:\Windows\System\DOFWdCK.exe

C:\Windows\System\DOFWdCK.exe

C:\Windows\System\hgvcAyK.exe

C:\Windows\System\hgvcAyK.exe

C:\Windows\System\UXXKhtH.exe

C:\Windows\System\UXXKhtH.exe

C:\Windows\System\zcGvWJj.exe

C:\Windows\System\zcGvWJj.exe

C:\Windows\System\vIbwUEL.exe

C:\Windows\System\vIbwUEL.exe

C:\Windows\System\RqPYFFb.exe

C:\Windows\System\RqPYFFb.exe

C:\Windows\System\YNUJYvm.exe

C:\Windows\System\YNUJYvm.exe

C:\Windows\System\rXxPAGH.exe

C:\Windows\System\rXxPAGH.exe

C:\Windows\System\pYtOBLv.exe

C:\Windows\System\pYtOBLv.exe

C:\Windows\System\WSKelRX.exe

C:\Windows\System\WSKelRX.exe

C:\Windows\System\pQSBpjo.exe

C:\Windows\System\pQSBpjo.exe

C:\Windows\System\hUTDcuY.exe

C:\Windows\System\hUTDcuY.exe

C:\Windows\System\QGYbqbV.exe

C:\Windows\System\QGYbqbV.exe

C:\Windows\System\rSYJEcu.exe

C:\Windows\System\rSYJEcu.exe

C:\Windows\System\NOKiSDm.exe

C:\Windows\System\NOKiSDm.exe

C:\Windows\System\GpABnFe.exe

C:\Windows\System\GpABnFe.exe

C:\Windows\System\ZQDDrPK.exe

C:\Windows\System\ZQDDrPK.exe

C:\Windows\System\xYOhRly.exe

C:\Windows\System\xYOhRly.exe

C:\Windows\System\UHUFXMC.exe

C:\Windows\System\UHUFXMC.exe

C:\Windows\System\nlksyCk.exe

C:\Windows\System\nlksyCk.exe

C:\Windows\System\fnPCsEG.exe

C:\Windows\System\fnPCsEG.exe

C:\Windows\System\aJabkgL.exe

C:\Windows\System\aJabkgL.exe

C:\Windows\System\BMQDCvh.exe

C:\Windows\System\BMQDCvh.exe

C:\Windows\System\xnOazkC.exe

C:\Windows\System\xnOazkC.exe

C:\Windows\System\BUBvoUA.exe

C:\Windows\System\BUBvoUA.exe

C:\Windows\System\QbRnXYy.exe

C:\Windows\System\QbRnXYy.exe

C:\Windows\System\XDolhON.exe

C:\Windows\System\XDolhON.exe

C:\Windows\System\adyWpOw.exe

C:\Windows\System\adyWpOw.exe

C:\Windows\System\RmBTled.exe

C:\Windows\System\RmBTled.exe

C:\Windows\System\iYmmffX.exe

C:\Windows\System\iYmmffX.exe

C:\Windows\System\VuvvXne.exe

C:\Windows\System\VuvvXne.exe

C:\Windows\System\PBfrjzg.exe

C:\Windows\System\PBfrjzg.exe

C:\Windows\System\sbggSvR.exe

C:\Windows\System\sbggSvR.exe

C:\Windows\System\SDDrAbS.exe

C:\Windows\System\SDDrAbS.exe

C:\Windows\System\aKSyhZM.exe

C:\Windows\System\aKSyhZM.exe

C:\Windows\System\gTmmgqG.exe

C:\Windows\System\gTmmgqG.exe

C:\Windows\System\raSpjgB.exe

C:\Windows\System\raSpjgB.exe

C:\Windows\System\GAwdgLo.exe

C:\Windows\System\GAwdgLo.exe

C:\Windows\System\WUpjeAW.exe

C:\Windows\System\WUpjeAW.exe

C:\Windows\System\IXZRPiq.exe

C:\Windows\System\IXZRPiq.exe

C:\Windows\System\wtHyMVa.exe

C:\Windows\System\wtHyMVa.exe

C:\Windows\System\DqbMDlv.exe

C:\Windows\System\DqbMDlv.exe

C:\Windows\System\wYMzelS.exe

C:\Windows\System\wYMzelS.exe

C:\Windows\System\yEKGKMf.exe

C:\Windows\System\yEKGKMf.exe

C:\Windows\System\bcfrREf.exe

C:\Windows\System\bcfrREf.exe

C:\Windows\System\zNlEzbh.exe

C:\Windows\System\zNlEzbh.exe

C:\Windows\System\LKkwRvz.exe

C:\Windows\System\LKkwRvz.exe

C:\Windows\System\Cvfusjr.exe

C:\Windows\System\Cvfusjr.exe

C:\Windows\System\sCfVeiN.exe

C:\Windows\System\sCfVeiN.exe

C:\Windows\System\iRLYhvt.exe

C:\Windows\System\iRLYhvt.exe

C:\Windows\System\EsxAlae.exe

C:\Windows\System\EsxAlae.exe

C:\Windows\System\andkBDf.exe

C:\Windows\System\andkBDf.exe

C:\Windows\System\bDrhGtA.exe

C:\Windows\System\bDrhGtA.exe

C:\Windows\System\fyXboYu.exe

C:\Windows\System\fyXboYu.exe

C:\Windows\System\PiTutlq.exe

C:\Windows\System\PiTutlq.exe

C:\Windows\System\cnOuFCK.exe

C:\Windows\System\cnOuFCK.exe

C:\Windows\System\vYkDFBb.exe

C:\Windows\System\vYkDFBb.exe

C:\Windows\System\nFyqLZF.exe

C:\Windows\System\nFyqLZF.exe

C:\Windows\System\vWOaneZ.exe

C:\Windows\System\vWOaneZ.exe

C:\Windows\System\CXAqmvd.exe

C:\Windows\System\CXAqmvd.exe

C:\Windows\System\tyykaUA.exe

C:\Windows\System\tyykaUA.exe

C:\Windows\System\fFUAnjd.exe

C:\Windows\System\fFUAnjd.exe

C:\Windows\System\kXMJwyI.exe

C:\Windows\System\kXMJwyI.exe

C:\Windows\System\QfWTxNu.exe

C:\Windows\System\QfWTxNu.exe

C:\Windows\System\ILRcWXT.exe

C:\Windows\System\ILRcWXT.exe

C:\Windows\System\semrEON.exe

C:\Windows\System\semrEON.exe

C:\Windows\System\CClyfOZ.exe

C:\Windows\System\CClyfOZ.exe

C:\Windows\System\PkASUJn.exe

C:\Windows\System\PkASUJn.exe

C:\Windows\System\RklEQRp.exe

C:\Windows\System\RklEQRp.exe

C:\Windows\System\sEuyGuD.exe

C:\Windows\System\sEuyGuD.exe

C:\Windows\System\nZPcCUR.exe

C:\Windows\System\nZPcCUR.exe

C:\Windows\System\TAbXWgP.exe

C:\Windows\System\TAbXWgP.exe

C:\Windows\System\KTltejw.exe

C:\Windows\System\KTltejw.exe

C:\Windows\System\lfDgaPt.exe

C:\Windows\System\lfDgaPt.exe

C:\Windows\System\XhBpshv.exe

C:\Windows\System\XhBpshv.exe

C:\Windows\System\zZyQGKJ.exe

C:\Windows\System\zZyQGKJ.exe

C:\Windows\System\XYoRpXa.exe

C:\Windows\System\XYoRpXa.exe

C:\Windows\System\IwhCNqD.exe

C:\Windows\System\IwhCNqD.exe

C:\Windows\System\sQENLAS.exe

C:\Windows\System\sQENLAS.exe

C:\Windows\System\AXHemlY.exe

C:\Windows\System\AXHemlY.exe

C:\Windows\System\RCuevzb.exe

C:\Windows\System\RCuevzb.exe

C:\Windows\System\TkjtvKu.exe

C:\Windows\System\TkjtvKu.exe

C:\Windows\System\ICaDgGu.exe

C:\Windows\System\ICaDgGu.exe

C:\Windows\System\iKZcous.exe

C:\Windows\System\iKZcous.exe

C:\Windows\System\QnnWhKG.exe

C:\Windows\System\QnnWhKG.exe

C:\Windows\System\bOhOkoP.exe

C:\Windows\System\bOhOkoP.exe

C:\Windows\System\vkOkEBv.exe

C:\Windows\System\vkOkEBv.exe

C:\Windows\System\TtOSfcq.exe

C:\Windows\System\TtOSfcq.exe

C:\Windows\System\elhVXlm.exe

C:\Windows\System\elhVXlm.exe

C:\Windows\System\uxftKsY.exe

C:\Windows\System\uxftKsY.exe

C:\Windows\System\tVkTmNX.exe

C:\Windows\System\tVkTmNX.exe

C:\Windows\System\kiCExmE.exe

C:\Windows\System\kiCExmE.exe

C:\Windows\System\pzlBFmP.exe

C:\Windows\System\pzlBFmP.exe

C:\Windows\System\ZnloLXk.exe

C:\Windows\System\ZnloLXk.exe

C:\Windows\System\lrDLcYY.exe

C:\Windows\System\lrDLcYY.exe

C:\Windows\System\TaEVRFL.exe

C:\Windows\System\TaEVRFL.exe

C:\Windows\System\yrhwimd.exe

C:\Windows\System\yrhwimd.exe

C:\Windows\System\ybENGuv.exe

C:\Windows\System\ybENGuv.exe

C:\Windows\System\cDqHeRC.exe

C:\Windows\System\cDqHeRC.exe

C:\Windows\System\YaReaxB.exe

C:\Windows\System\YaReaxB.exe

C:\Windows\System\pnxoSNs.exe

C:\Windows\System\pnxoSNs.exe

C:\Windows\System\eWfFKDK.exe

C:\Windows\System\eWfFKDK.exe

C:\Windows\System\AqjQHuv.exe

C:\Windows\System\AqjQHuv.exe

C:\Windows\System\dyuzeTe.exe

C:\Windows\System\dyuzeTe.exe

C:\Windows\System\SPPEzPr.exe

C:\Windows\System\SPPEzPr.exe

C:\Windows\System\orUGgva.exe

C:\Windows\System\orUGgva.exe

C:\Windows\System\ijkMtvA.exe

C:\Windows\System\ijkMtvA.exe

C:\Windows\System\nQdSHdo.exe

C:\Windows\System\nQdSHdo.exe

C:\Windows\System\VmuULSb.exe

C:\Windows\System\VmuULSb.exe

C:\Windows\System\ZEoQQqz.exe

C:\Windows\System\ZEoQQqz.exe

C:\Windows\System\jmdygfh.exe

C:\Windows\System\jmdygfh.exe

C:\Windows\System\UAcugIB.exe

C:\Windows\System\UAcugIB.exe

C:\Windows\System\PYGcNHa.exe

C:\Windows\System\PYGcNHa.exe

C:\Windows\System\RvPEgEL.exe

C:\Windows\System\RvPEgEL.exe

C:\Windows\System\vtlgsxA.exe

C:\Windows\System\vtlgsxA.exe

C:\Windows\System\MOCreYs.exe

C:\Windows\System\MOCreYs.exe

C:\Windows\System\FtCweMZ.exe

C:\Windows\System\FtCweMZ.exe

C:\Windows\System\yFrABpN.exe

C:\Windows\System\yFrABpN.exe

C:\Windows\System\adtWDVA.exe

C:\Windows\System\adtWDVA.exe

C:\Windows\System\QWPkluk.exe

C:\Windows\System\QWPkluk.exe

C:\Windows\System\sHEobKv.exe

C:\Windows\System\sHEobKv.exe

C:\Windows\System\eMIfYlD.exe

C:\Windows\System\eMIfYlD.exe

C:\Windows\System\jGaxhtx.exe

C:\Windows\System\jGaxhtx.exe

C:\Windows\System\hgzPXCj.exe

C:\Windows\System\hgzPXCj.exe

C:\Windows\System\ciLyoci.exe

C:\Windows\System\ciLyoci.exe

C:\Windows\System\KgktAqU.exe

C:\Windows\System\KgktAqU.exe

C:\Windows\System\RVTMaLo.exe

C:\Windows\System\RVTMaLo.exe

C:\Windows\System\BwNMAIS.exe

C:\Windows\System\BwNMAIS.exe

C:\Windows\System\pMcLQLN.exe

C:\Windows\System\pMcLQLN.exe

C:\Windows\System\jSDQLaS.exe

C:\Windows\System\jSDQLaS.exe

C:\Windows\System\TpWTPND.exe

C:\Windows\System\TpWTPND.exe

C:\Windows\System\hTGNvAv.exe

C:\Windows\System\hTGNvAv.exe

C:\Windows\System\XsZKdeL.exe

C:\Windows\System\XsZKdeL.exe

C:\Windows\System\jPcwAiJ.exe

C:\Windows\System\jPcwAiJ.exe

C:\Windows\System\UNlvIoA.exe

C:\Windows\System\UNlvIoA.exe

C:\Windows\System\jKHhorf.exe

C:\Windows\System\jKHhorf.exe

C:\Windows\System\fzTEjir.exe

C:\Windows\System\fzTEjir.exe

C:\Windows\System\tGddcDg.exe

C:\Windows\System\tGddcDg.exe

C:\Windows\System\WWQpCYR.exe

C:\Windows\System\WWQpCYR.exe

C:\Windows\System\EiztZeS.exe

C:\Windows\System\EiztZeS.exe

C:\Windows\System\qjxQBKK.exe

C:\Windows\System\qjxQBKK.exe

C:\Windows\System\xCWdvme.exe

C:\Windows\System\xCWdvme.exe

C:\Windows\System\TTLQrpi.exe

C:\Windows\System\TTLQrpi.exe

C:\Windows\System\angGXHt.exe

C:\Windows\System\angGXHt.exe

C:\Windows\System\kUEIxmI.exe

C:\Windows\System\kUEIxmI.exe

C:\Windows\System\OeqAxrY.exe

C:\Windows\System\OeqAxrY.exe

C:\Windows\System\dNsftmu.exe

C:\Windows\System\dNsftmu.exe

C:\Windows\System\CfNCAeD.exe

C:\Windows\System\CfNCAeD.exe

C:\Windows\System\GqcsTEY.exe

C:\Windows\System\GqcsTEY.exe

C:\Windows\System\WmxuqCO.exe

C:\Windows\System\WmxuqCO.exe

C:\Windows\System\NdAObCd.exe

C:\Windows\System\NdAObCd.exe

C:\Windows\System\RosEHPW.exe

C:\Windows\System\RosEHPW.exe

C:\Windows\System\aORrbDj.exe

C:\Windows\System\aORrbDj.exe

C:\Windows\System\NAAfwpG.exe

C:\Windows\System\NAAfwpG.exe

C:\Windows\System\zPepkqh.exe

C:\Windows\System\zPepkqh.exe

C:\Windows\System\kahRNKY.exe

C:\Windows\System\kahRNKY.exe

C:\Windows\System\cOBatDa.exe

C:\Windows\System\cOBatDa.exe

C:\Windows\System\CQKVWYu.exe

C:\Windows\System\CQKVWYu.exe

C:\Windows\System\hASQxew.exe

C:\Windows\System\hASQxew.exe

C:\Windows\System\yOEAGxU.exe

C:\Windows\System\yOEAGxU.exe

C:\Windows\System\gzKiwNe.exe

C:\Windows\System\gzKiwNe.exe

C:\Windows\System\JiWWxWV.exe

C:\Windows\System\JiWWxWV.exe

C:\Windows\System\UprBSiF.exe

C:\Windows\System\UprBSiF.exe

C:\Windows\System\YoXTxsS.exe

C:\Windows\System\YoXTxsS.exe

C:\Windows\System\oQSdmjT.exe

C:\Windows\System\oQSdmjT.exe

C:\Windows\System\biXbVPC.exe

C:\Windows\System\biXbVPC.exe

C:\Windows\System\zMESLYT.exe

C:\Windows\System\zMESLYT.exe

C:\Windows\System\mIKDRIN.exe

C:\Windows\System\mIKDRIN.exe

C:\Windows\System\yvCDomr.exe

C:\Windows\System\yvCDomr.exe

C:\Windows\System\EQkcfMk.exe

C:\Windows\System\EQkcfMk.exe

C:\Windows\System\KaPTVhn.exe

C:\Windows\System\KaPTVhn.exe

C:\Windows\System\lTdwlgd.exe

C:\Windows\System\lTdwlgd.exe

C:\Windows\System\FYjFGYP.exe

C:\Windows\System\FYjFGYP.exe

C:\Windows\System\QNPbvGs.exe

C:\Windows\System\QNPbvGs.exe

C:\Windows\System\lwNJAVM.exe

C:\Windows\System\lwNJAVM.exe

C:\Windows\System\lPthzZL.exe

C:\Windows\System\lPthzZL.exe

C:\Windows\System\HLUHEhT.exe

C:\Windows\System\HLUHEhT.exe

C:\Windows\System\OsDdVJb.exe

C:\Windows\System\OsDdVJb.exe

C:\Windows\System\vwehxqM.exe

C:\Windows\System\vwehxqM.exe

C:\Windows\System\QDEdqYp.exe

C:\Windows\System\QDEdqYp.exe

C:\Windows\System\nUZKxLq.exe

C:\Windows\System\nUZKxLq.exe

C:\Windows\System\TruugRs.exe

C:\Windows\System\TruugRs.exe

C:\Windows\System\xrbbsJe.exe

C:\Windows\System\xrbbsJe.exe

C:\Windows\System\iRwfyTX.exe

C:\Windows\System\iRwfyTX.exe

C:\Windows\System\nXsuapB.exe

C:\Windows\System\nXsuapB.exe

C:\Windows\System\cQrvXAM.exe

C:\Windows\System\cQrvXAM.exe

C:\Windows\System\bqUXymo.exe

C:\Windows\System\bqUXymo.exe

C:\Windows\System\KZmptpf.exe

C:\Windows\System\KZmptpf.exe

C:\Windows\System\tgvSPJz.exe

C:\Windows\System\tgvSPJz.exe

C:\Windows\System\KLGSXsd.exe

C:\Windows\System\KLGSXsd.exe

C:\Windows\System\YJDMzNT.exe

C:\Windows\System\YJDMzNT.exe

C:\Windows\System\FTBWsUU.exe

C:\Windows\System\FTBWsUU.exe

C:\Windows\System\kEUmYtS.exe

C:\Windows\System\kEUmYtS.exe

C:\Windows\System\IzlMkSR.exe

C:\Windows\System\IzlMkSR.exe

C:\Windows\System\GUpjnUV.exe

C:\Windows\System\GUpjnUV.exe

C:\Windows\System\fJRymPO.exe

C:\Windows\System\fJRymPO.exe

C:\Windows\System\exUgCVM.exe

C:\Windows\System\exUgCVM.exe

C:\Windows\System\ZhswyJO.exe

C:\Windows\System\ZhswyJO.exe

C:\Windows\System\foRshQx.exe

C:\Windows\System\foRshQx.exe

C:\Windows\System\rkiFhZZ.exe

C:\Windows\System\rkiFhZZ.exe

C:\Windows\System\KGfcvpp.exe

C:\Windows\System\KGfcvpp.exe

C:\Windows\System\gjEchVO.exe

C:\Windows\System\gjEchVO.exe

C:\Windows\System\cgnsWaK.exe

C:\Windows\System\cgnsWaK.exe

C:\Windows\System\inzxRTI.exe

C:\Windows\System\inzxRTI.exe

C:\Windows\System\soqwejf.exe

C:\Windows\System\soqwejf.exe

C:\Windows\System\nCytqzV.exe

C:\Windows\System\nCytqzV.exe

C:\Windows\System\osYADTT.exe

C:\Windows\System\osYADTT.exe

C:\Windows\System\YMSMZoN.exe

C:\Windows\System\YMSMZoN.exe

C:\Windows\System\sUByKXJ.exe

C:\Windows\System\sUByKXJ.exe

C:\Windows\System\lxpgxwN.exe

C:\Windows\System\lxpgxwN.exe

C:\Windows\System\RQgWPZx.exe

C:\Windows\System\RQgWPZx.exe

C:\Windows\System\BspoULS.exe

C:\Windows\System\BspoULS.exe

C:\Windows\System\fjpLDRc.exe

C:\Windows\System\fjpLDRc.exe

C:\Windows\System\wWrmXSC.exe

C:\Windows\System\wWrmXSC.exe

C:\Windows\System\CYhcaRT.exe

C:\Windows\System\CYhcaRT.exe

C:\Windows\System\uXyotSM.exe

C:\Windows\System\uXyotSM.exe

C:\Windows\System\XSPWSbA.exe

C:\Windows\System\XSPWSbA.exe

C:\Windows\System\AsVEzKu.exe

C:\Windows\System\AsVEzKu.exe

C:\Windows\System\BlAmsjR.exe

C:\Windows\System\BlAmsjR.exe

C:\Windows\System\SEQRYIR.exe

C:\Windows\System\SEQRYIR.exe

C:\Windows\System\TzyJinA.exe

C:\Windows\System\TzyJinA.exe

C:\Windows\System\UnyxpOV.exe

C:\Windows\System\UnyxpOV.exe

C:\Windows\System\iVTEVFp.exe

C:\Windows\System\iVTEVFp.exe

C:\Windows\System\oQJpRsT.exe

C:\Windows\System\oQJpRsT.exe

C:\Windows\System\whOwduu.exe

C:\Windows\System\whOwduu.exe

C:\Windows\System\fdEVBBu.exe

C:\Windows\System\fdEVBBu.exe

C:\Windows\System\fcdxnKz.exe

C:\Windows\System\fcdxnKz.exe

C:\Windows\System\kOAgwAX.exe

C:\Windows\System\kOAgwAX.exe

C:\Windows\System\ihMgkfk.exe

C:\Windows\System\ihMgkfk.exe

C:\Windows\System\tNyhJVz.exe

C:\Windows\System\tNyhJVz.exe

C:\Windows\System\yJfUWfF.exe

C:\Windows\System\yJfUWfF.exe

C:\Windows\System\WXvIbYK.exe

C:\Windows\System\WXvIbYK.exe

C:\Windows\System\oWwmcvM.exe

C:\Windows\System\oWwmcvM.exe

C:\Windows\System\nFxZcwx.exe

C:\Windows\System\nFxZcwx.exe

C:\Windows\System\iLXUgfl.exe

C:\Windows\System\iLXUgfl.exe

C:\Windows\System\cNkTWge.exe

C:\Windows\System\cNkTWge.exe

C:\Windows\System\uHIBNxS.exe

C:\Windows\System\uHIBNxS.exe

C:\Windows\System\ZFgTNTp.exe

C:\Windows\System\ZFgTNTp.exe

C:\Windows\System\NJoBjTL.exe

C:\Windows\System\NJoBjTL.exe

C:\Windows\System\xPbbASA.exe

C:\Windows\System\xPbbASA.exe

C:\Windows\System\neoXDUx.exe

C:\Windows\System\neoXDUx.exe

C:\Windows\System\PeTxQAh.exe

C:\Windows\System\PeTxQAh.exe

C:\Windows\System\vFwBcKq.exe

C:\Windows\System\vFwBcKq.exe

C:\Windows\System\NjoHtFK.exe

C:\Windows\System\NjoHtFK.exe

C:\Windows\System\ItRTeNW.exe

C:\Windows\System\ItRTeNW.exe

C:\Windows\System\BwMAMfg.exe

C:\Windows\System\BwMAMfg.exe

C:\Windows\System\fUXbFSo.exe

C:\Windows\System\fUXbFSo.exe

C:\Windows\System\rlwsIDd.exe

C:\Windows\System\rlwsIDd.exe

C:\Windows\System\zfEZNBJ.exe

C:\Windows\System\zfEZNBJ.exe

C:\Windows\System\HdeEMuo.exe

C:\Windows\System\HdeEMuo.exe

C:\Windows\System\bITnBKq.exe

C:\Windows\System\bITnBKq.exe

C:\Windows\System\oszImmE.exe

C:\Windows\System\oszImmE.exe

C:\Windows\System\tTcYblu.exe

C:\Windows\System\tTcYblu.exe

C:\Windows\System\YGPviLj.exe

C:\Windows\System\YGPviLj.exe

C:\Windows\System\ElOlXJT.exe

C:\Windows\System\ElOlXJT.exe

C:\Windows\System\xgWaRnt.exe

C:\Windows\System\xgWaRnt.exe

C:\Windows\System\UonKvkD.exe

C:\Windows\System\UonKvkD.exe

C:\Windows\System\sZseHcj.exe

C:\Windows\System\sZseHcj.exe

C:\Windows\System\JXdgNSy.exe

C:\Windows\System\JXdgNSy.exe

C:\Windows\System\fWcfocO.exe

C:\Windows\System\fWcfocO.exe

C:\Windows\System\gLkYIfZ.exe

C:\Windows\System\gLkYIfZ.exe

C:\Windows\System\AavQHFP.exe

C:\Windows\System\AavQHFP.exe

C:\Windows\System\gfUUyGH.exe

C:\Windows\System\gfUUyGH.exe

C:\Windows\System\zrRsvDG.exe

C:\Windows\System\zrRsvDG.exe

C:\Windows\System\rFObbWh.exe

C:\Windows\System\rFObbWh.exe

C:\Windows\System\nhMRbrG.exe

C:\Windows\System\nhMRbrG.exe

C:\Windows\System\yorcnnl.exe

C:\Windows\System\yorcnnl.exe

C:\Windows\System\yvhKYKu.exe

C:\Windows\System\yvhKYKu.exe

C:\Windows\System\LJsPMAI.exe

C:\Windows\System\LJsPMAI.exe

C:\Windows\System\XaBlQxU.exe

C:\Windows\System\XaBlQxU.exe

C:\Windows\System\DNFoOmJ.exe

C:\Windows\System\DNFoOmJ.exe

C:\Windows\System\uCsVhrf.exe

C:\Windows\System\uCsVhrf.exe

C:\Windows\System\ZsYPXQw.exe

C:\Windows\System\ZsYPXQw.exe

C:\Windows\System\YGePWHE.exe

C:\Windows\System\YGePWHE.exe

C:\Windows\System\dBvzSiu.exe

C:\Windows\System\dBvzSiu.exe

C:\Windows\System\NseWnxu.exe

C:\Windows\System\NseWnxu.exe

C:\Windows\System\AYUNVAj.exe

C:\Windows\System\AYUNVAj.exe

C:\Windows\System\TFMqpiv.exe

C:\Windows\System\TFMqpiv.exe

C:\Windows\System\QiIbFhm.exe

C:\Windows\System\QiIbFhm.exe

C:\Windows\System\vQiuULy.exe

C:\Windows\System\vQiuULy.exe

C:\Windows\System\yabUlHh.exe

C:\Windows\System\yabUlHh.exe

C:\Windows\System\mySbVtB.exe

C:\Windows\System\mySbVtB.exe

C:\Windows\System\zlPVJbA.exe

C:\Windows\System\zlPVJbA.exe

C:\Windows\System\FScaDDa.exe

C:\Windows\System\FScaDDa.exe

C:\Windows\System\FdzaJGI.exe

C:\Windows\System\FdzaJGI.exe

C:\Windows\System\pNouElt.exe

C:\Windows\System\pNouElt.exe

C:\Windows\System\ZEXJlhr.exe

C:\Windows\System\ZEXJlhr.exe

C:\Windows\System\lXCgRPd.exe

C:\Windows\System\lXCgRPd.exe

C:\Windows\System\xeEZOPE.exe

C:\Windows\System\xeEZOPE.exe

C:\Windows\System\mmkaffx.exe

C:\Windows\System\mmkaffx.exe

C:\Windows\System\yIrkKaf.exe

C:\Windows\System\yIrkKaf.exe

C:\Windows\System\WOApSBJ.exe

C:\Windows\System\WOApSBJ.exe

C:\Windows\System\gYaBDDc.exe

C:\Windows\System\gYaBDDc.exe

C:\Windows\System\CUoXIAl.exe

C:\Windows\System\CUoXIAl.exe

C:\Windows\System\IBRHhDv.exe

C:\Windows\System\IBRHhDv.exe

C:\Windows\System\ubYMpbG.exe

C:\Windows\System\ubYMpbG.exe

C:\Windows\System\fUgSXkW.exe

C:\Windows\System\fUgSXkW.exe

C:\Windows\System\mYzbvzB.exe

C:\Windows\System\mYzbvzB.exe

C:\Windows\System\GdfMwLi.exe

C:\Windows\System\GdfMwLi.exe

C:\Windows\System\dnNWfNR.exe

C:\Windows\System\dnNWfNR.exe

C:\Windows\System\CHmaLVk.exe

C:\Windows\System\CHmaLVk.exe

C:\Windows\System\spcnGqf.exe

C:\Windows\System\spcnGqf.exe

C:\Windows\System\CNuteiT.exe

C:\Windows\System\CNuteiT.exe

C:\Windows\System\EfOWLpL.exe

C:\Windows\System\EfOWLpL.exe

C:\Windows\System\OzzvGIo.exe

C:\Windows\System\OzzvGIo.exe

C:\Windows\System\vpnjsPS.exe

C:\Windows\System\vpnjsPS.exe

C:\Windows\System\zGmnJpK.exe

C:\Windows\System\zGmnJpK.exe

C:\Windows\System\MfDtsAA.exe

C:\Windows\System\MfDtsAA.exe

C:\Windows\System\JXOZAis.exe

C:\Windows\System\JXOZAis.exe

C:\Windows\System\tUUmGSJ.exe

C:\Windows\System\tUUmGSJ.exe

C:\Windows\System\dINAKZc.exe

C:\Windows\System\dINAKZc.exe

C:\Windows\System\AHafYWi.exe

C:\Windows\System\AHafYWi.exe

C:\Windows\System\FSerYVB.exe

C:\Windows\System\FSerYVB.exe

C:\Windows\System\hnKEWzu.exe

C:\Windows\System\hnKEWzu.exe

C:\Windows\System\eaCJpWK.exe

C:\Windows\System\eaCJpWK.exe

C:\Windows\System\EIDfHHi.exe

C:\Windows\System\EIDfHHi.exe

C:\Windows\System\FgicxoX.exe

C:\Windows\System\FgicxoX.exe

C:\Windows\System\jciAoGd.exe

C:\Windows\System\jciAoGd.exe

C:\Windows\System\CcHODGf.exe

C:\Windows\System\CcHODGf.exe

C:\Windows\System\olsEgBY.exe

C:\Windows\System\olsEgBY.exe

C:\Windows\System\KjRSKYh.exe

C:\Windows\System\KjRSKYh.exe

C:\Windows\System\YUUOQaj.exe

C:\Windows\System\YUUOQaj.exe

C:\Windows\System\QIpkFvh.exe

C:\Windows\System\QIpkFvh.exe

C:\Windows\System\saUUKxS.exe

C:\Windows\System\saUUKxS.exe

C:\Windows\System\CDhuYMI.exe

C:\Windows\System\CDhuYMI.exe

C:\Windows\System\SWUZryx.exe

C:\Windows\System\SWUZryx.exe

C:\Windows\System\GNdBXkV.exe

C:\Windows\System\GNdBXkV.exe

C:\Windows\System\OIosisd.exe

C:\Windows\System\OIosisd.exe

C:\Windows\System\xjwLuxh.exe

C:\Windows\System\xjwLuxh.exe

C:\Windows\System\CdEVWMV.exe

C:\Windows\System\CdEVWMV.exe

C:\Windows\System\TIwvizL.exe

C:\Windows\System\TIwvizL.exe

C:\Windows\System\kKCTCGk.exe

C:\Windows\System\kKCTCGk.exe

C:\Windows\System\lUrMxYH.exe

C:\Windows\System\lUrMxYH.exe

C:\Windows\System\AZqRJEN.exe

C:\Windows\System\AZqRJEN.exe

C:\Windows\System\rFkQZOf.exe

C:\Windows\System\rFkQZOf.exe

C:\Windows\System\HKfbKmM.exe

C:\Windows\System\HKfbKmM.exe

C:\Windows\System\xabRwjX.exe

C:\Windows\System\xabRwjX.exe

C:\Windows\System\izropRO.exe

C:\Windows\System\izropRO.exe

C:\Windows\System\QrIeLjq.exe

C:\Windows\System\QrIeLjq.exe

C:\Windows\System\CzXEWMC.exe

C:\Windows\System\CzXEWMC.exe

C:\Windows\System\NTrFITN.exe

C:\Windows\System\NTrFITN.exe

C:\Windows\System\fXYPdDs.exe

C:\Windows\System\fXYPdDs.exe

C:\Windows\System\fEOGIOu.exe

C:\Windows\System\fEOGIOu.exe

C:\Windows\System\AetGprm.exe

C:\Windows\System\AetGprm.exe

C:\Windows\System\DcnrnEf.exe

C:\Windows\System\DcnrnEf.exe

C:\Windows\System\XsZcIkb.exe

C:\Windows\System\XsZcIkb.exe

C:\Windows\System\kWbediK.exe

C:\Windows\System\kWbediK.exe

C:\Windows\System\myYvxWU.exe

C:\Windows\System\myYvxWU.exe

C:\Windows\System\HglBqRb.exe

C:\Windows\System\HglBqRb.exe

C:\Windows\System\LzxjHeJ.exe

C:\Windows\System\LzxjHeJ.exe

C:\Windows\System\erJKxCK.exe

C:\Windows\System\erJKxCK.exe

C:\Windows\System\uSYdbAy.exe

C:\Windows\System\uSYdbAy.exe

C:\Windows\System\vrxHuqm.exe

C:\Windows\System\vrxHuqm.exe

C:\Windows\System\IMYeWcP.exe

C:\Windows\System\IMYeWcP.exe

C:\Windows\System\EWFkvsZ.exe

C:\Windows\System\EWFkvsZ.exe

C:\Windows\System\Seimogw.exe

C:\Windows\System\Seimogw.exe

C:\Windows\System\BAlsLKC.exe

C:\Windows\System\BAlsLKC.exe

C:\Windows\System\YGZVyDv.exe

C:\Windows\System\YGZVyDv.exe

C:\Windows\System\fJmGXJa.exe

C:\Windows\System\fJmGXJa.exe

C:\Windows\System\JUipytB.exe

C:\Windows\System\JUipytB.exe

C:\Windows\System\UpDqfjZ.exe

C:\Windows\System\UpDqfjZ.exe

C:\Windows\System\pMdrUNX.exe

C:\Windows\System\pMdrUNX.exe

C:\Windows\System\RVwZxzF.exe

C:\Windows\System\RVwZxzF.exe

C:\Windows\System\jDWdbXI.exe

C:\Windows\System\jDWdbXI.exe

C:\Windows\System\yAduCYZ.exe

C:\Windows\System\yAduCYZ.exe

C:\Windows\System\QzyDUmt.exe

C:\Windows\System\QzyDUmt.exe

C:\Windows\System\BpiFFLI.exe

C:\Windows\System\BpiFFLI.exe

C:\Windows\System\vapoTLq.exe

C:\Windows\System\vapoTLq.exe

C:\Windows\System\CHUrphv.exe

C:\Windows\System\CHUrphv.exe

C:\Windows\System\bRMGeBp.exe

C:\Windows\System\bRMGeBp.exe

C:\Windows\System\CxxcLEq.exe

C:\Windows\System\CxxcLEq.exe

C:\Windows\System\EdBvPcD.exe

C:\Windows\System\EdBvPcD.exe

C:\Windows\System\JqHGkXV.exe

C:\Windows\System\JqHGkXV.exe

C:\Windows\System\GgEYBWS.exe

C:\Windows\System\GgEYBWS.exe

C:\Windows\System\Gnmoeow.exe

C:\Windows\System\Gnmoeow.exe

C:\Windows\System\sRwgqYN.exe

C:\Windows\System\sRwgqYN.exe

C:\Windows\System\VMeqiXJ.exe

C:\Windows\System\VMeqiXJ.exe

C:\Windows\System\SWySWrD.exe

C:\Windows\System\SWySWrD.exe

C:\Windows\System\hFypHUt.exe

C:\Windows\System\hFypHUt.exe

C:\Windows\System\GSyKbxM.exe

C:\Windows\System\GSyKbxM.exe

C:\Windows\System\JdcWkur.exe

C:\Windows\System\JdcWkur.exe

C:\Windows\System\IxUlDTn.exe

C:\Windows\System\IxUlDTn.exe

C:\Windows\System\NDPzPXI.exe

C:\Windows\System\NDPzPXI.exe

C:\Windows\System\fXjkdyi.exe

C:\Windows\System\fXjkdyi.exe

C:\Windows\System\dNJqQJD.exe

C:\Windows\System\dNJqQJD.exe

C:\Windows\System\EtIpGnP.exe

C:\Windows\System\EtIpGnP.exe

C:\Windows\System\qOSlnXv.exe

C:\Windows\System\qOSlnXv.exe

C:\Windows\System\SKsWvcj.exe

C:\Windows\System\SKsWvcj.exe

C:\Windows\System\XzmjtES.exe

C:\Windows\System\XzmjtES.exe

C:\Windows\System\sCjxAcw.exe

C:\Windows\System\sCjxAcw.exe

C:\Windows\System\ORliHsA.exe

C:\Windows\System\ORliHsA.exe

C:\Windows\System\GapbczD.exe

C:\Windows\System\GapbczD.exe

C:\Windows\System\RjsXJQa.exe

C:\Windows\System\RjsXJQa.exe

C:\Windows\System\NVoeHsP.exe

C:\Windows\System\NVoeHsP.exe

C:\Windows\System\wWZzGHg.exe

C:\Windows\System\wWZzGHg.exe

C:\Windows\System\zQpwlmj.exe

C:\Windows\System\zQpwlmj.exe

C:\Windows\System\ekqSDrl.exe

C:\Windows\System\ekqSDrl.exe

C:\Windows\System\sPyFasp.exe

C:\Windows\System\sPyFasp.exe

C:\Windows\System\pYRAnDC.exe

C:\Windows\System\pYRAnDC.exe

C:\Windows\System\ADDEucE.exe

C:\Windows\System\ADDEucE.exe

C:\Windows\System\qcjLIeS.exe

C:\Windows\System\qcjLIeS.exe

C:\Windows\System\faATOjv.exe

C:\Windows\System\faATOjv.exe

C:\Windows\System\kOpzKnV.exe

C:\Windows\System\kOpzKnV.exe

C:\Windows\System\lByiQEv.exe

C:\Windows\System\lByiQEv.exe

C:\Windows\System\BCeyFJK.exe

C:\Windows\System\BCeyFJK.exe

C:\Windows\System\lcHDiSB.exe

C:\Windows\System\lcHDiSB.exe

C:\Windows\System\dkbUWom.exe

C:\Windows\System\dkbUWom.exe

C:\Windows\System\gZWhYns.exe

C:\Windows\System\gZWhYns.exe

C:\Windows\System\BmAqtHO.exe

C:\Windows\System\BmAqtHO.exe

C:\Windows\System\ZoHHENz.exe

C:\Windows\System\ZoHHENz.exe

C:\Windows\System\BgkGpku.exe

C:\Windows\System\BgkGpku.exe

C:\Windows\System\ROKIMoW.exe

C:\Windows\System\ROKIMoW.exe

C:\Windows\System\oITTITE.exe

C:\Windows\System\oITTITE.exe

C:\Windows\System\WAotNXy.exe

C:\Windows\System\WAotNXy.exe

C:\Windows\System\IIXjcVp.exe

C:\Windows\System\IIXjcVp.exe

C:\Windows\System\PLvYTZJ.exe

C:\Windows\System\PLvYTZJ.exe

C:\Windows\System\jzkSfil.exe

C:\Windows\System\jzkSfil.exe

C:\Windows\System\BzljHtT.exe

C:\Windows\System\BzljHtT.exe

C:\Windows\System\GoEbFuz.exe

C:\Windows\System\GoEbFuz.exe

C:\Windows\System\oBmnJDX.exe

C:\Windows\System\oBmnJDX.exe

C:\Windows\System\zpluprb.exe

C:\Windows\System\zpluprb.exe

C:\Windows\System\DmUgQQy.exe

C:\Windows\System\DmUgQQy.exe

C:\Windows\System\IDlgVHV.exe

C:\Windows\System\IDlgVHV.exe

C:\Windows\System\AOdhQOi.exe

C:\Windows\System\AOdhQOi.exe

C:\Windows\System\DJVCuXk.exe

C:\Windows\System\DJVCuXk.exe

C:\Windows\System\TUwiqbk.exe

C:\Windows\System\TUwiqbk.exe

C:\Windows\System\MFCJlWj.exe

C:\Windows\System\MFCJlWj.exe

C:\Windows\System\XTEMznH.exe

C:\Windows\System\XTEMznH.exe

C:\Windows\System\lihEbXY.exe

C:\Windows\System\lihEbXY.exe

C:\Windows\System\WorHFqN.exe

C:\Windows\System\WorHFqN.exe

C:\Windows\System\SXddzZt.exe

C:\Windows\System\SXddzZt.exe

C:\Windows\System\CVpYFNa.exe

C:\Windows\System\CVpYFNa.exe

C:\Windows\System\MjYDfPb.exe

C:\Windows\System\MjYDfPb.exe

C:\Windows\System\KauUVqn.exe

C:\Windows\System\KauUVqn.exe

C:\Windows\System\tMEOWhw.exe

C:\Windows\System\tMEOWhw.exe

C:\Windows\System\unJOJkL.exe

C:\Windows\System\unJOJkL.exe

C:\Windows\System\xGlByHd.exe

C:\Windows\System\xGlByHd.exe

C:\Windows\System\NahTnLI.exe

C:\Windows\System\NahTnLI.exe

C:\Windows\System\MBaBSNI.exe

C:\Windows\System\MBaBSNI.exe

C:\Windows\System\Qtrwyhv.exe

C:\Windows\System\Qtrwyhv.exe

C:\Windows\System\SttdILy.exe

C:\Windows\System\SttdILy.exe

C:\Windows\System\XGMejzb.exe

C:\Windows\System\XGMejzb.exe

C:\Windows\System\QqfcfSS.exe

C:\Windows\System\QqfcfSS.exe

C:\Windows\System\BbQlnBy.exe

C:\Windows\System\BbQlnBy.exe

C:\Windows\System\cYKLBTC.exe

C:\Windows\System\cYKLBTC.exe

C:\Windows\System\WaxOQNz.exe

C:\Windows\System\WaxOQNz.exe

C:\Windows\System\eAlUOGt.exe

C:\Windows\System\eAlUOGt.exe

C:\Windows\System\eXmSTCm.exe

C:\Windows\System\eXmSTCm.exe

C:\Windows\System\eXwKugK.exe

C:\Windows\System\eXwKugK.exe

C:\Windows\System\vKxpKXY.exe

C:\Windows\System\vKxpKXY.exe

C:\Windows\System\slYNCqc.exe

C:\Windows\System\slYNCqc.exe

C:\Windows\System\PMKflEh.exe

C:\Windows\System\PMKflEh.exe

C:\Windows\System\EMQxsDe.exe

C:\Windows\System\EMQxsDe.exe

C:\Windows\System\RwKtgAP.exe

C:\Windows\System\RwKtgAP.exe

C:\Windows\System\fBLqDlg.exe

C:\Windows\System\fBLqDlg.exe

C:\Windows\System\NVmcaiP.exe

C:\Windows\System\NVmcaiP.exe

C:\Windows\System\CfTTkgH.exe

C:\Windows\System\CfTTkgH.exe

C:\Windows\System\rSOiWbb.exe

C:\Windows\System\rSOiWbb.exe

C:\Windows\System\ARPOgVn.exe

C:\Windows\System\ARPOgVn.exe

C:\Windows\System\ItvJbsf.exe

C:\Windows\System\ItvJbsf.exe

C:\Windows\System\XNCTGVp.exe

C:\Windows\System\XNCTGVp.exe

C:\Windows\System\FwMBfZX.exe

C:\Windows\System\FwMBfZX.exe

C:\Windows\System\UqhAFNt.exe

C:\Windows\System\UqhAFNt.exe

C:\Windows\System\ZoPzmBS.exe

C:\Windows\System\ZoPzmBS.exe

C:\Windows\System\QtbGYDq.exe

C:\Windows\System\QtbGYDq.exe

C:\Windows\System\gSqgEoe.exe

C:\Windows\System\gSqgEoe.exe

C:\Windows\System\GDvPPeO.exe

C:\Windows\System\GDvPPeO.exe

C:\Windows\System\CabVaFR.exe

C:\Windows\System\CabVaFR.exe

C:\Windows\System\BbWCfDZ.exe

C:\Windows\System\BbWCfDZ.exe

C:\Windows\System\VAcMpaI.exe

C:\Windows\System\VAcMpaI.exe

C:\Windows\System\kwefgbT.exe

C:\Windows\System\kwefgbT.exe

C:\Windows\System\QxvxUmN.exe

C:\Windows\System\QxvxUmN.exe

C:\Windows\System\ZmhxXym.exe

C:\Windows\System\ZmhxXym.exe

C:\Windows\System\qALsDCG.exe

C:\Windows\System\qALsDCG.exe

C:\Windows\System\hLVjoVZ.exe

C:\Windows\System\hLVjoVZ.exe

C:\Windows\System\dxXSdep.exe

C:\Windows\System\dxXSdep.exe

C:\Windows\System\BRiecDY.exe

C:\Windows\System\BRiecDY.exe

C:\Windows\System\YvOiySc.exe

C:\Windows\System\YvOiySc.exe

C:\Windows\System\khiAfQY.exe

C:\Windows\System\khiAfQY.exe

C:\Windows\System\QNeGkRi.exe

C:\Windows\System\QNeGkRi.exe

C:\Windows\System\VtWsyPc.exe

C:\Windows\System\VtWsyPc.exe

C:\Windows\System\arqPace.exe

C:\Windows\System\arqPace.exe

C:\Windows\System\kwwwlLm.exe

C:\Windows\System\kwwwlLm.exe

C:\Windows\System\rLOlWof.exe

C:\Windows\System\rLOlWof.exe

C:\Windows\System\XLpRxcn.exe

C:\Windows\System\XLpRxcn.exe

C:\Windows\System\sOxGKiW.exe

C:\Windows\System\sOxGKiW.exe

C:\Windows\System\eNfPjLt.exe

C:\Windows\System\eNfPjLt.exe

C:\Windows\System\LKkzbzy.exe

C:\Windows\System\LKkzbzy.exe

C:\Windows\System\bVhGAcf.exe

C:\Windows\System\bVhGAcf.exe

C:\Windows\System\NekuBUI.exe

C:\Windows\System\NekuBUI.exe

C:\Windows\System\OyYbhwg.exe

C:\Windows\System\OyYbhwg.exe

C:\Windows\System\FtCnDvn.exe

C:\Windows\System\FtCnDvn.exe

C:\Windows\System\YStUZoW.exe

C:\Windows\System\YStUZoW.exe

C:\Windows\System\ihXAZYI.exe

C:\Windows\System\ihXAZYI.exe

C:\Windows\System\wRaVRgz.exe

C:\Windows\System\wRaVRgz.exe

C:\Windows\System\IxVmxGu.exe

C:\Windows\System\IxVmxGu.exe

C:\Windows\System\jZbnBiY.exe

C:\Windows\System\jZbnBiY.exe

C:\Windows\System\RMdpnPY.exe

C:\Windows\System\RMdpnPY.exe

C:\Windows\System\bdoGMGQ.exe

C:\Windows\System\bdoGMGQ.exe

C:\Windows\System\dMMoreL.exe

C:\Windows\System\dMMoreL.exe

C:\Windows\System\ZwfmtlM.exe

C:\Windows\System\ZwfmtlM.exe

C:\Windows\System\ZUCVlaX.exe

C:\Windows\System\ZUCVlaX.exe

C:\Windows\System\suBaqvB.exe

C:\Windows\System\suBaqvB.exe

C:\Windows\System\saepvhf.exe

C:\Windows\System\saepvhf.exe

C:\Windows\System\sRfotzw.exe

C:\Windows\System\sRfotzw.exe

C:\Windows\System\ozpkGFN.exe

C:\Windows\System\ozpkGFN.exe

C:\Windows\System\SEQUIDG.exe

C:\Windows\System\SEQUIDG.exe

C:\Windows\System\eUkFTOu.exe

C:\Windows\System\eUkFTOu.exe

C:\Windows\System\vcmVswr.exe

C:\Windows\System\vcmVswr.exe

C:\Windows\System\iNIjSBX.exe

C:\Windows\System\iNIjSBX.exe

C:\Windows\System\hFWBIfb.exe

C:\Windows\System\hFWBIfb.exe

C:\Windows\System\YPZXjWp.exe

C:\Windows\System\YPZXjWp.exe

C:\Windows\System\RTNykYO.exe

C:\Windows\System\RTNykYO.exe

C:\Windows\System\KRfcHmJ.exe

C:\Windows\System\KRfcHmJ.exe

C:\Windows\System\tBafysL.exe

C:\Windows\System\tBafysL.exe

C:\Windows\System\dGOBxVr.exe

C:\Windows\System\dGOBxVr.exe

C:\Windows\System\JLjKNqB.exe

C:\Windows\System\JLjKNqB.exe

C:\Windows\System\HZzWYAf.exe

C:\Windows\System\HZzWYAf.exe

C:\Windows\System\HtoLqzZ.exe

C:\Windows\System\HtoLqzZ.exe

C:\Windows\System\zFXHzse.exe

C:\Windows\System\zFXHzse.exe

C:\Windows\System\iOsbCmB.exe

C:\Windows\System\iOsbCmB.exe

C:\Windows\System\MRULDFG.exe

C:\Windows\System\MRULDFG.exe

C:\Windows\System\RVhvArl.exe

C:\Windows\System\RVhvArl.exe

C:\Windows\System\GlQPcXY.exe

C:\Windows\System\GlQPcXY.exe

C:\Windows\System\QLivXao.exe

C:\Windows\System\QLivXao.exe

C:\Windows\System\bQFmTwl.exe

C:\Windows\System\bQFmTwl.exe

C:\Windows\System\JHEgPVa.exe

C:\Windows\System\JHEgPVa.exe

C:\Windows\System\NfswFGW.exe

C:\Windows\System\NfswFGW.exe

C:\Windows\System\sSpkABT.exe

C:\Windows\System\sSpkABT.exe

C:\Windows\System\lSVfIkw.exe

C:\Windows\System\lSVfIkw.exe

C:\Windows\System\lsRIhYG.exe

C:\Windows\System\lsRIhYG.exe

C:\Windows\System\UXUwcjH.exe

C:\Windows\System\UXUwcjH.exe

C:\Windows\System\tRzNDvO.exe

C:\Windows\System\tRzNDvO.exe

C:\Windows\System\ezbQNDL.exe

C:\Windows\System\ezbQNDL.exe

C:\Windows\System\YrsmJkU.exe

C:\Windows\System\YrsmJkU.exe

C:\Windows\System\HCAoWAB.exe

C:\Windows\System\HCAoWAB.exe

C:\Windows\System\bagIIDy.exe

C:\Windows\System\bagIIDy.exe

C:\Windows\System\OeLXmWc.exe

C:\Windows\System\OeLXmWc.exe

C:\Windows\System\xvqCsSq.exe

C:\Windows\System\xvqCsSq.exe

C:\Windows\System\HHeLjtl.exe

C:\Windows\System\HHeLjtl.exe

C:\Windows\System\WXWQtzH.exe

C:\Windows\System\WXWQtzH.exe

C:\Windows\System\uufLXKa.exe

C:\Windows\System\uufLXKa.exe

C:\Windows\System\GtlSGpl.exe

C:\Windows\System\GtlSGpl.exe

C:\Windows\System\kQmBfcr.exe

C:\Windows\System\kQmBfcr.exe

C:\Windows\System\drviyhA.exe

C:\Windows\System\drviyhA.exe

C:\Windows\System\XggEqbU.exe

C:\Windows\System\XggEqbU.exe

C:\Windows\System\ZEtbqLp.exe

C:\Windows\System\ZEtbqLp.exe

C:\Windows\System\gcYOfBE.exe

C:\Windows\System\gcYOfBE.exe

C:\Windows\System\QKWLLIN.exe

C:\Windows\System\QKWLLIN.exe

C:\Windows\System\DNCRINK.exe

C:\Windows\System\DNCRINK.exe

C:\Windows\System\ONknoLO.exe

C:\Windows\System\ONknoLO.exe

C:\Windows\System\VCEPlvB.exe

C:\Windows\System\VCEPlvB.exe

C:\Windows\System\xjkaqGY.exe

C:\Windows\System\xjkaqGY.exe

C:\Windows\System\etEdWLO.exe

C:\Windows\System\etEdWLO.exe

C:\Windows\System\EZrHYZD.exe

C:\Windows\System\EZrHYZD.exe

C:\Windows\System\onyPWJk.exe

C:\Windows\System\onyPWJk.exe

C:\Windows\System\DGKeBpm.exe

C:\Windows\System\DGKeBpm.exe

C:\Windows\System\bVeERHF.exe

C:\Windows\System\bVeERHF.exe

C:\Windows\System\gCiNXsZ.exe

C:\Windows\System\gCiNXsZ.exe

C:\Windows\System\afWmyVY.exe

C:\Windows\System\afWmyVY.exe

C:\Windows\System\QLggivx.exe

C:\Windows\System\QLggivx.exe

C:\Windows\System\cQArJir.exe

C:\Windows\System\cQArJir.exe

C:\Windows\System\STVFKKP.exe

C:\Windows\System\STVFKKP.exe

C:\Windows\System\TUqPBJT.exe

C:\Windows\System\TUqPBJT.exe

C:\Windows\System\QuKlifw.exe

C:\Windows\System\QuKlifw.exe

C:\Windows\System\AxYcmNu.exe

C:\Windows\System\AxYcmNu.exe

C:\Windows\System\pzeHliH.exe

C:\Windows\System\pzeHliH.exe

C:\Windows\System\rzeNBZq.exe

C:\Windows\System\rzeNBZq.exe

C:\Windows\System\JxIzWkj.exe

C:\Windows\System\JxIzWkj.exe

C:\Windows\System\IhIYDqa.exe

C:\Windows\System\IhIYDqa.exe

C:\Windows\System\ELGuvKt.exe

C:\Windows\System\ELGuvKt.exe

C:\Windows\System\BrqgaEu.exe

C:\Windows\System\BrqgaEu.exe

C:\Windows\System\KUCyADI.exe

C:\Windows\System\KUCyADI.exe

C:\Windows\System\orLprtj.exe

C:\Windows\System\orLprtj.exe

C:\Windows\System\FkeSrMS.exe

C:\Windows\System\FkeSrMS.exe

C:\Windows\System\KZWxRUD.exe

C:\Windows\System\KZWxRUD.exe

C:\Windows\System\pqVPhAe.exe

C:\Windows\System\pqVPhAe.exe

C:\Windows\System\lJFhGcv.exe

C:\Windows\System\lJFhGcv.exe

C:\Windows\System\uudDVCl.exe

C:\Windows\System\uudDVCl.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp

Files

memory/2916-1-0x000000013F1A0000-0x000000013F592000-memory.dmp

memory/2916-0-0x0000000000080000-0x0000000000090000-memory.dmp

C:\Windows\system\AWZYtUc.exe

MD5	a48e62a40f491d3b3a00a3d88d95562e
SHA1	59632bcd04e8f83afe9df1a4961407ea0c466dec
SHA256	1640ae838abd5c07bc697f87e0eef0609f4828e45f203c8ad2656ab39b9349ab
SHA512	7bfa909cae7c44848906061cc0dc07d4ab4549492b78af9a6ffafaa322a8b0104e249c6d5ee08c6187b786d6329dc29f29c1848c93f519adf063dd82f39d8529

memory/2916-8-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

C:\Windows\system\nrMiFiX.exe

MD5	d3b1353015843b731fb12e93d7919925
SHA1	a61e9aa83a06b571fb6ff9acf04a61320f4967b8
SHA256	994e743a1975d0c6ad9b65d097684c471050407a6fe5bdcf843c8152608f2b90
SHA512	9c15ca24cd24e79f5aabc4e960d85e5c3f2a33fc4898a15541b28bad8189c759430ceadf3ad2d0ac9bbe95260ee792c0a92afd0946b70711b8f7dcaaa0211b3c

C:\Windows\system\qqbFzCh.exe

MD5	c90b9cae0558528e54b8f576b611d5ad
SHA1	d39e41b04119ca7127a6207e7c8c6a15b5778167
SHA256	17a34c536c6f197cc2256382a6cec8a2ac60273ea57bd440c2a2695bce29e841
SHA512	1afd941a3431293af7a955b7da2f68f261c63152fe9dd17a2aa510999923dddcaed991a376e3c060eb29bb1491be1006bec870eb972d10e8e6965436ec4e7766

memory/2752-17-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

memory/2156-30-0x000000001B350000-0x000000001B632000-memory.dmp

memory/2156-47-0x0000000002320000-0x0000000002328000-memory.dmp

\Windows\system\YFmpSLF.exe

MD5	7241a3f2bfc676497b0e7eb049342ae3
SHA1	49e3f94e19e17c9e44a49f104e2042cab6be4a0c
SHA256	23eb8c132954be9ad1171bcf02cabbdc6a34a2ea253380859fb913ca9ddf26d8
SHA512	e53520a5542030b3663eadb81c50dc6f71fe6147063d408519cae286942d4452e6f4fd570c6d71407e5834642dd459e38d2c84fa52df899c7b9441b63d8a628d

C:\Windows\system\BOptnxD.exe

MD5	fe7e9fe4d785c42bca55d4593ced4a3c
SHA1	94734092342d4985f2b4e1aff2bb7b7a15d3f31e
SHA256	db25ccaa90a985c050e6545a603a43965b74761ba2857229eff3923f087bb576
SHA512	1ddb17bb4319194e5fa757d017da2c6d4d6320537a2afb59ebd6095e690c31325363d5c8e386ca8da36d0c74c8c5647b59f1fab366524188e8d2664267f45f52

C:\Windows\system\QpghnYu.exe

MD5	cac1b6bf50a217f968e6c8c78a726997
SHA1	46a280cdaac01e8fdff385c0ce8863750c56753c
SHA256	f46cd2c7b3d13f01b4f7ba1c2c76c35518613c03846d5041fdb4707969335b76
SHA512	7c76033ba54c841ad840348f912f370c9342e7d604664888dbff4d6f156634d160eee469a4a7df482c1c2b440ad375d2886e58b9ea732b1fc7ac1a5e596cf48f

C:\Windows\system\uzSlvJz.exe

MD5	1fcd8376504ac6876ac7d3ed14497d9f
SHA1	976a3c0c293a73b583dbf54a7bd20adb02172f76
SHA256	62af7a52dbfb1de32aa442052828f021a6e029e0430d88f3602c4b7d860d6c69
SHA512	ede974c04badbd2fb3f4ddf7c516990e94f50f5f04a952cccc325c4de2f9091ffa1c153010b4ba28b07b1936004c5566325ac74b58ce649344487024180e23c8

\Windows\system\kNJQKIS.exe

MD5	c6a3bbea9d979db0d922ff99d1202274
SHA1	43f68c94119d550b28d7857c3da7ce64830e9f06
SHA256	183b025deccf2be4086ba767bb9c831d6b5507a3d86fdbffd5cdce9dbc72492e
SHA512	64063e041bf94b85bd74d284697e4b90e8f4631f8aeefbd07168ff8b809fa60deb0c3d5fe6379533b3ee109342460d683e6a4bd34dda0cc5f30dc41f30a18fca

memory/2156-36-0x000007FEF504E000-0x000007FEF504F000-memory.dmp

memory/2156-71-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

C:\Windows\system\jJbKPCi.exe

MD5	4012eb8b08006727d8c5893800a7d250
SHA1	126b756942a9213a0eb11246db9af0389456839f
SHA256	6912905d334a85eac610d7ec6a19fc7f105a14d9817f8af70d89115bc3aabd80
SHA512	12d6f1ec9d73e1db4c6f7e3cd3ad1be39f01ea0497aba13cc8fd4e9dc421cc34440c41fbce6fa96f5e1ececf5bfe2502b50db1a9f8de6a74a1f06bfda1aca7dc

C:\Windows\system\nkIKlFM.exe

MD5	6086523a10a76108a4b3d4673570ca2e
SHA1	9fde00adac25ce17691c62f0114a1e838a72ae5d
SHA256	fc52c022257e90545a55b894c4a85b212d6b9032ddf6e0d89aedcf14ff416467
SHA512	461ca42278762e205e4860dca27d14eee8067f558ccb8a5801ba8eaa2ec9797b5a392b783912792f4bfd18bc9ce36a65772a8f3685579aa6fef63232cb8a156e

memory/2156-125-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

C:\Windows\system\kCRwsoE.exe

MD5	d1bbd268d6e39e2035a4e8c3fa4e165f
SHA1	25372d7dc59ca80b4e95667c736cf2883d7e9c63
SHA256	18f3ce27f5392c4beafa2d7ed1acc899d23c44789c9d6f9af287cafe61450ec9
SHA512	4de411fad72212170b70430fee3a200c7375d4c800be0bc842fe54f7655aa7eec230839a08fa9686765f4cb5af7e4eeeadc9775ac95f5e045649cd645c43c526

C:\Windows\system\lzRSdWm.exe

MD5	9114753af5096964b6f8381034d5f23b
SHA1	f8ccbe65f15f0dac36e019f546614d5d5a769648
SHA256	7d0bee12fe8ebf48e25d97e41732172f68c7798d5b89eb0c447a42445621004b
SHA512	9dff70b8e626719c6830ff48a8c76422e5e07f0c1f99d5a8853e6480ef37ee7a4f27fea9125eacaf013db4a1aed4366fb35518be8d073c21812bad279cbccd14

memory/2812-86-0x000000013FE10000-0x0000000140202000-memory.dmp

memory/2156-85-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

memory/2916-83-0x000000013FE10000-0x0000000140202000-memory.dmp

memory/2916-82-0x000000013FEB0000-0x00000001402A2000-memory.dmp

memory/2616-81-0x000000013F240000-0x000000013F632000-memory.dmp

\Windows\system\zuZQbif.exe

MD5	3dac169c9ddbad771138fc1d5c8d60ca
SHA1	d353a51ede46aa2d79c9d0cbfbe606d2867af7ed
SHA256	030f4169a6bff872d32e1425ce938c983cda9de9b2cd925cc65192fa045c9957
SHA512	bd28775486c7ea68152fda662e5995a57db0afc1878b5b7893b98591e74a43478c3e4009da65648f4adda3756afec3f93ebfd9e10eed31991e712c81794c1c49

memory/2916-114-0x0000000003190000-0x0000000003582000-memory.dmp

C:\Windows\system\uxRPSdK.exe

MD5	363ad6b759c6bb14bbfed3d0975dc52f
SHA1	b365a0d1ea9c36f2e202c01cbe473e7326194ec9
SHA256	d73009a71b5b06bbbe3c4bc9b6af1f97c38ec7cf5792c5b5a2393e3332228c95
SHA512	56037ed47379ae69d7aa60af03cf28aa8e3af84ccc1d05a15fee724e5fd13ce4a2d259b004a5b9b1a14903c2bf6cae23401aabae4e41746a59146f542fb4fa09

C:\Windows\system\xpfpqVc.exe

MD5	7d308749804b78baa504a389fc6eb2ee
SHA1	a8779b939acc29cd7e03a81576a35db031c67578
SHA256	6cf35319b1996f599e7096a4fe3f53fa21bf7b5ae24acb22b96aad1197d5c5e6
SHA512	137def7ae44435aebdc32d084bd4ce617cfe66005f2fb172f20d228f5446911feedf89252df9d1fc08f2c72c385742a8b1db09f0db793710d01e6a32844410d2

C:\Windows\system\YbByply.exe

MD5	f2ebea13b2b5dc2fc7d55a0077491583
SHA1	6b18129d853627521838a881c048bbdc76d7611c
SHA256	9c4b95d3b2ba0e879dae6b57f797b9d132e352fc623ec275d65a79dfefa286f2
SHA512	5451c003c983769e739344f83e0b0025e789f0cc4d6a31009e99b9e3d4a733b158b60fd5cf78d7a8903617f74d0f7ffbc3d57426a062c3fc1201609b5ef860a1

C:\Windows\system\KlHImmI.exe

MD5	03ed717bc36f6fd6b10095667c36c68a
SHA1	605db452f008f8cd70be9e9d8bd42ea90d703839
SHA256	89dbec1fffe347c58673b053ec7c70cf68192546c11793c779f0dcf0f0a00e31
SHA512	15f6546dfad6afc8bef7e782383e54fdb6ae80fdb06d140f928c4380828a7d199b29018b4e39fc29072fa16437a44fab9a108311dca249d8cc39538f5cb7ceac

\Windows\system\SGMnpYK.exe

MD5	67abd0f4452439598061f97084e3eb2e
SHA1	aca41663d46818c8e6e88ed185e8b2c7de7cec65
SHA256	7208de090ed25b74e5e3d4bdfdc2a96a1ed6cbec73ed8ac0449d4b6d1a536562
SHA512	63d6a86b5842391444dc3981061d0f8dbe0e2927bc465f7d01c9fcbf55551785a8feec4e61752c16737d8a45f4154ef0eeade9b97c5ec19bacddc533a8557513

C:\Windows\system\SdQTUIa.exe

MD5	ceb177ddcc1d2f3c1ce50b26b7ae1447
SHA1	6eee1d699443e49e14b62f64a4ce1e32bdc07163
SHA256	cec34c41695c5b0a3592e3ff59560d9cbbaebb9eff15f57f6cd1e15037295dc1
SHA512	6eb4fcd6574acfdeaa15ef19c4aa99dc1516088c40914ce40770061bbda1261e7fa64076d42465fd8f1ecfb8f6113283170ae9d21c010ebc06626f300f371d38

C:\Windows\system\Pjwnbnl.exe

MD5	547257848d7dd40ddcc8817c5659f3fb
SHA1	bdaf6610800982fa2458a77e39d69356bb599ef5
SHA256	7f3451576b00c903231852bee36ecad7ffb3a0b0842c9934eda8e426fd0d5d9c
SHA512	ffb60666b73a22035f6a059da3bfa504701431efbd34b07708445fe7e644141c54a8b89e65294a9bb942b5906e10242d07ea10758db63612a4b5b5a9fc7dddb2

\Windows\system\IkNqgQn.exe

MD5	d475b20fc62235bd4ac77b6f3f55063c
SHA1	7ac3ed4ad8f29684cad1538491b43b6bf4fa9a58
SHA256	8830a4f7cb0631b5972889dce489c950b9039545a5207e4529794eb7bfbe7dee
SHA512	e628c01fd3678184d61911c002e60a5d77bbb4796ecc0f688d130fb1e585235a4517fc85dcda99f1462961d3743069eeb8fec46d678c58c30a82c4f09c7f7ff2

C:\Windows\system\rTUkHrS.exe

MD5	da57860228b24ee168bcbe2f43fef42a
SHA1	a87a7985bbd3519b7737d5ae9b9d1a037ac78b25
SHA256	f54943cf2af1a157ce208c1c7c16198019b21abedd09bd2646de263f5abbe812
SHA512	3e48292ef0d0e82a6286e1145146dd7aa635c4341d923281c0b21f8fb56eec4dc00f72960a45f4a856950dfb09aec6a82519953b123925ecb3e2cf26d55d8d66

C:\Windows\system\alrFqbL.exe

MD5	d6d97da7f986b6135704a8d8a55718ce
SHA1	1008661a022112f01786f0ad3f7885c886734e04
SHA256	4a5874c0fa9cb7fb6e93c481612a14df68817be0833ba1e3f084e3c1811950c6
SHA512	8c8a1a5b3c4487ea46a64b19dfbb69e667d4bd25651733a79cd4af7ed04750a74af8dde88b9581efc6491f1e075ef43cea06e28fff68ca5ed10df715dbd83608

memory/2680-1969-0x000000013FEB0000-0x00000001402A2000-memory.dmp

memory/2472-1968-0x000000013F380000-0x000000013F772000-memory.dmp

memory/2620-1967-0x000000013FB60000-0x000000013FF52000-memory.dmp

memory/2496-1973-0x000000013F880000-0x000000013FC72000-memory.dmp

memory/2812-1990-0x000000013FE10000-0x0000000140202000-memory.dmp

memory/2616-1977-0x000000013F240000-0x000000013F632000-memory.dmp

memory/1504-2052-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

memory/2640-2106-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

memory/2548-2066-0x000000013F7A0000-0x000000013FB92000-memory.dmp

memory/2752-1976-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

memory/2524-1975-0x000000013F980000-0x000000013FD72000-memory.dmp

C:\Windows\system\HDeDeyC.exe

MD5	93523d5c6acaef3f623426e90ebf8040
SHA1	22633a23470688a994a7b07f14c64379215b2e38
SHA256	c5b8bbc9f79fc10be64cb092b2627c06af8e2ddb02aa3faadc41cee825aa2eb4
SHA512	f0a83929251098560bb362248f5720c2a30dd031702702739816a7a98d0e9731ea61d4a175d0507cf84d8a76146194a4bc2c95677a40957bf4089481e5b9d1ff

C:\Windows\system\etTqfnA.exe

MD5	829b8835ec41fe0355a9ffcbaea8e727
SHA1	bca8df634bd4ba629d09f8edf8fd67cb5b8c0b63
SHA256	7f41b9a16ee5f7420cb7e2183c810cf6a91ac0a68bb596c22c94c8171bd14377
SHA512	997090688484672a78069fe3bd57457c7dc78458c1bb1318c87986f0d9db39a2cbeb410f709d2231636d179621c2ed0881e2d32be7fa80776519e3d761cf2fb0

C:\Windows\system\xNhFcXc.exe

MD5	a140a24789e63841c98982b5dac0c424
SHA1	25866e4b1b5fad9e7bcef5e1ea706493b34f3cea
SHA256	eed1ddfb84b6311e4145907381548f30e06068f76e60dd4a261c73160706d7d5
SHA512	0632b1ac0a8abbf4c3c695bdb8d1cdfcaf4ae8252b1573e493eae8896cd734c0101665d00069c3a349811083c539c1b1e67afd563c4caca6fdf3e5184674a857

C:\Windows\system\AOBAVHt.exe

MD5	5e0ce4c86f42d181815a9196cad864ac
SHA1	9e2b9ccaafaf7c6880422ebf7d807ed0853ab880
SHA256	a1c3a9a75ebfb176aea24dedc742eb42323f26ff0b9592cfe622861a58851f84
SHA512	94f2452d92a10997895cfa0b95d1ec2660b892e7ad559ef693979a3959be87dce0da1e8e182d73d2540ee79ad76e9702dda7a5617639e37dd7778a37851ba7dc

memory/2524-112-0x000000013F980000-0x000000013FD72000-memory.dmp

memory/2916-110-0x000000013F880000-0x000000013FC72000-memory.dmp

memory/2156-108-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

memory/2916-103-0x0000000003190000-0x0000000003582000-memory.dmp

memory/2916-102-0x000000013F980000-0x000000013FD72000-memory.dmp

memory/2548-101-0x000000013F7A0000-0x000000013FB92000-memory.dmp

memory/2916-100-0x000000013F7A0000-0x000000013FB92000-memory.dmp

memory/2640-99-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

memory/2472-97-0x000000013F380000-0x000000013F772000-memory.dmp

memory/2916-96-0x0000000003190000-0x0000000003582000-memory.dmp

memory/1504-95-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

memory/2680-94-0x000000013FEB0000-0x00000001402A2000-memory.dmp

memory/2916-93-0x0000000003190000-0x0000000003582000-memory.dmp

C:\Windows\system\WFXxQTn.exe

MD5	a2ccf2c443ef691b911c6ef782bcc8d9
SHA1	e8c401da9eb8204291bfd9f3cb2c38b98270ef91
SHA256	456cd45e59b703c7146222bcb04af2913071bf2215c49b0127ed2aa6f4225068
SHA512	ac75d36f09e509d9424e7aee643101bf7ec3133cf3bcc52079cdcf1ebbe413c441b2a71ccd586149ec56d068a11071bfa837980b38a2efb18b1d9ff412d98087

memory/2496-90-0x000000013F880000-0x000000013FC72000-memory.dmp

memory/2916-88-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

memory/2916-76-0x0000000003190000-0x0000000003582000-memory.dmp

C:\Windows\system\JrGaDXV.exe

MD5	e3ac08c309c059826884abd27dffb481
SHA1	e3ee43b0b271d0aaa5d1af548142332c26b8684e
SHA256	9c1f6a2a37b5fca54236af4e4c6916b5687b74c7997988884df90787c91ba063
SHA512	fe3c794a55b59b9cf9acd09180eb3a7b6c439dfe7a4b818d3431c56230a837c3d76ff3e89385f6cea37130903fe7a1cae1ac5cfb487b5d1b5dd6fa3e29775884

memory/2156-62-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

C:\Windows\system\MmBXhpK.exe

MD5	4b0faca3f3bbb572a956c38ef25c2dc8
SHA1	5a092ea626b8a51806dd1a80a68d01a2a0743e57
SHA256	4899042392915384844e93b502b002a8d01994175a87bec6b39848ce5f30b86c
SHA512	ce61015377eb6753565223a4f91192cdbc0c0b3a7fd6ece05659b259ccee80927cc9a896058c8ee213640f46d567f3ae900d191470e572bc2611bee80602a4fb

C:\Windows\system\bnNMwXB.exe

MD5	52ecab4d51aa71f111eeb03522f6626b
SHA1	f1b02ebfeaee465baf5319606804a590f7c5ceb5
SHA256	76e4be1d5e0c9b1c81d6ec4a8993a6921577082e1cdb8205654434e1b6c5e49f
SHA512	5eaf053e5272293c98b13b8da626dff9b49be410492654531a1dadfd95049e88c5b001e384958fee29bd1969f546279b7df9838212a5f0fe9881c3ab6aa5e367

C:\Windows\system\VlqvUdd.exe

MD5	90d3345ef2a5776c966e71ffef967882
SHA1	41fb1dc7f505b74c2b271088fbe338fbbbe625b7
SHA256	db2a9d2b4e94e9d62bd77cab92c4886670f826577c6b342c6eeaa78d44186560
SHA512	bb28096fa9bafaf60957621827758ada4acb8bb86643a0617e6f0bfa096041cdbcf6dacd7e0562d3f82cfbd717c130ca77a54f1ce18606418618e6d51275567c

memory/2620-31-0x000000013FB60000-0x000000013FF52000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 22:36

Reported

2024-06-13 22:39

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Blocklisted process makes network request

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\sJcEHyl.exe	N/A
N/A	N/A	C:\Windows\System\NzEFnJE.exe	N/A
N/A	N/A	C:\Windows\System\ZabLnGx.exe	N/A
N/A	N/A	C:\Windows\System\NrVhwAG.exe	N/A
N/A	N/A	C:\Windows\System\EldnTBm.exe	N/A
N/A	N/A	C:\Windows\System\TcrsXlE.exe	N/A
N/A	N/A	C:\Windows\System\ULmUwsS.exe	N/A
N/A	N/A	C:\Windows\System\WqElqYD.exe	N/A
N/A	N/A	C:\Windows\System\MsaKpuF.exe	N/A
N/A	N/A	C:\Windows\System\SRCkadK.exe	N/A
N/A	N/A	C:\Windows\System\ctcoSod.exe	N/A
N/A	N/A	C:\Windows\System\AqkEjyK.exe	N/A
N/A	N/A	C:\Windows\System\FZqmJGE.exe	N/A
N/A	N/A	C:\Windows\System\MSZTUPq.exe	N/A
N/A	N/A	C:\Windows\System\SBsnhgr.exe	N/A
N/A	N/A	C:\Windows\System\UdQdwvF.exe	N/A
N/A	N/A	C:\Windows\System\eSWVqkQ.exe	N/A
N/A	N/A	C:\Windows\System\HicLRkF.exe	N/A
N/A	N/A	C:\Windows\System\LUQnQAA.exe	N/A
N/A	N/A	C:\Windows\System\xBxWlbI.exe	N/A
N/A	N/A	C:\Windows\System\FdVOnTJ.exe	N/A
N/A	N/A	C:\Windows\System\EKSWRMo.exe	N/A
N/A	N/A	C:\Windows\System\SRqCDUr.exe	N/A
N/A	N/A	C:\Windows\System\atHUNrr.exe	N/A
N/A	N/A	C:\Windows\System\zAFbQlh.exe	N/A
N/A	N/A	C:\Windows\System\HwIsEwX.exe	N/A
N/A	N/A	C:\Windows\System\eZMIUNT.exe	N/A
N/A	N/A	C:\Windows\System\refKjbK.exe	N/A
N/A	N/A	C:\Windows\System\muJAseK.exe	N/A
N/A	N/A	C:\Windows\System\ZhJKZFg.exe	N/A
N/A	N/A	C:\Windows\System\vdkMHgC.exe	N/A
N/A	N/A	C:\Windows\System\TSGMNSD.exe	N/A
N/A	N/A	C:\Windows\System\dkWlPGF.exe	N/A
N/A	N/A	C:\Windows\System\ukiInhQ.exe	N/A
N/A	N/A	C:\Windows\System\ecPmrEl.exe	N/A
N/A	N/A	C:\Windows\System\mbJALYw.exe	N/A
N/A	N/A	C:\Windows\System\OYhCPRG.exe	N/A
N/A	N/A	C:\Windows\System\yZZAxmF.exe	N/A
N/A	N/A	C:\Windows\System\bKSuOBV.exe	N/A
N/A	N/A	C:\Windows\System\BrympqK.exe	N/A
N/A	N/A	C:\Windows\System\IZIkNbz.exe	N/A
N/A	N/A	C:\Windows\System\vgbrrTD.exe	N/A
N/A	N/A	C:\Windows\System\JtcTCeG.exe	N/A
N/A	N/A	C:\Windows\System\eHcvEwo.exe	N/A
N/A	N/A	C:\Windows\System\tSUXQeD.exe	N/A
N/A	N/A	C:\Windows\System\NeWcxLR.exe	N/A
N/A	N/A	C:\Windows\System\xEBOilz.exe	N/A
N/A	N/A	C:\Windows\System\TQrIMui.exe	N/A
N/A	N/A	C:\Windows\System\vhjtmIt.exe	N/A
N/A	N/A	C:\Windows\System\ScoZqXb.exe	N/A
N/A	N/A	C:\Windows\System\RYWtSoK.exe	N/A
N/A	N/A	C:\Windows\System\CexaQNp.exe	N/A
N/A	N/A	C:\Windows\System\aaOJECV.exe	N/A
N/A	N/A	C:\Windows\System\jMejHFe.exe	N/A
N/A	N/A	C:\Windows\System\IPZPOQE.exe	N/A
N/A	N/A	C:\Windows\System\IajLdCH.exe	N/A
N/A	N/A	C:\Windows\System\MCoiCDP.exe	N/A
N/A	N/A	C:\Windows\System\WxBTQfQ.exe	N/A
N/A	N/A	C:\Windows\System\JuPfIko.exe	N/A
N/A	N/A	C:\Windows\System\OUYBTWl.exe	N/A
N/A	N/A	C:\Windows\System\WbNbwnH.exe	N/A
N/A	N/A	C:\Windows\System\WdlBngm.exe	N/A
N/A	N/A	C:\Windows\System\AdsiIiY.exe	N/A
N/A	N/A	C:\Windows\System\ZbbvhXV.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	raw.githubusercontent.com	N/A	N/A
N/A	raw.githubusercontent.com	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\WIpaHlO.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xohYobG.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mCyVVOv.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wmgMtSZ.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HpCFINE.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AqkEjyK.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HkIEpxq.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EpcCigP.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NzEFnJE.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\refKjbK.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WbNbwnH.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OJgdAuV.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YkiGPnR.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kpnagtr.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CwfJkyC.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OFNHohQ.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FZqmJGE.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xjhmYvb.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KhIYaLW.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TtVbbqL.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tSUXQeD.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\whfazlU.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UZtAjoJ.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VafvOno.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MSZTUPq.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KEMLplR.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Chximvr.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MmqpzSv.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zPYbGPr.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iqqqsqo.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZabLnGx.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bOsSePi.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dkWlPGF.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZcNXJbX.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KHKArON.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MBWoafA.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RJQhejy.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xpiQQVc.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SBsnhgr.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\StHKxNc.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZbbvhXV.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tfErZMO.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DZChFgz.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bMWAUnr.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RmEGxqc.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ISMMJBl.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mNmjuZM.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tGYkYKi.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LUQnQAA.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WdlBngm.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RHjsstE.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eSWVqkQ.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gwxGqIi.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VVqyqnG.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WRTVQaU.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\byKiELB.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GPesBOu.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zQDTUOC.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SVnhsgk.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\muJAseK.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qfGpBvu.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sNcnKAz.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QCyzoJu.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FzdbXSd.exe	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2260 wrote to memory of 3236	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2260 wrote to memory of 3236	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2260 wrote to memory of 3620	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\sJcEHyl.exe
PID 2260 wrote to memory of 3620	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\sJcEHyl.exe
PID 2260 wrote to memory of 4700	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\NzEFnJE.exe
PID 2260 wrote to memory of 4700	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\NzEFnJE.exe
PID 2260 wrote to memory of 2900	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\ZabLnGx.exe
PID 2260 wrote to memory of 2900	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\ZabLnGx.exe
PID 2260 wrote to memory of 4972	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\NrVhwAG.exe
PID 2260 wrote to memory of 4972	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\NrVhwAG.exe
PID 2260 wrote to memory of 416	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\EldnTBm.exe
PID 2260 wrote to memory of 416	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\EldnTBm.exe
PID 2260 wrote to memory of 700	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\TcrsXlE.exe
PID 2260 wrote to memory of 700	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\TcrsXlE.exe
PID 2260 wrote to memory of 2556	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\ULmUwsS.exe
PID 2260 wrote to memory of 2556	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\ULmUwsS.exe
PID 2260 wrote to memory of 3548	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\WqElqYD.exe
PID 2260 wrote to memory of 3548	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\WqElqYD.exe
PID 2260 wrote to memory of 5152	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\MsaKpuF.exe
PID 2260 wrote to memory of 5152	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\MsaKpuF.exe
PID 2260 wrote to memory of 5444	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\SRCkadK.exe
PID 2260 wrote to memory of 5444	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\SRCkadK.exe
PID 2260 wrote to memory of 5628	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\ctcoSod.exe
PID 2260 wrote to memory of 5628	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\ctcoSod.exe
PID 2260 wrote to memory of 5772	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\AqkEjyK.exe
PID 2260 wrote to memory of 5772	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\AqkEjyK.exe
PID 2260 wrote to memory of 5364	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\FZqmJGE.exe
PID 2260 wrote to memory of 5364	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\FZqmJGE.exe
PID 2260 wrote to memory of 5380	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\MSZTUPq.exe
PID 2260 wrote to memory of 5380	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\MSZTUPq.exe
PID 2260 wrote to memory of 5516	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\SBsnhgr.exe
PID 2260 wrote to memory of 5516	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\SBsnhgr.exe
PID 2260 wrote to memory of 4676	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\UdQdwvF.exe
PID 2260 wrote to memory of 4676	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\UdQdwvF.exe
PID 2260 wrote to memory of 4628	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\eSWVqkQ.exe
PID 2260 wrote to memory of 4628	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\eSWVqkQ.exe
PID 2260 wrote to memory of 560	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\HicLRkF.exe
PID 2260 wrote to memory of 560	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\HicLRkF.exe
PID 2260 wrote to memory of 1796	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\LUQnQAA.exe
PID 2260 wrote to memory of 1796	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\LUQnQAA.exe
PID 2260 wrote to memory of 4640	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\xBxWlbI.exe
PID 2260 wrote to memory of 4640	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\xBxWlbI.exe
PID 2260 wrote to memory of 5936	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\FdVOnTJ.exe
PID 2260 wrote to memory of 5936	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\FdVOnTJ.exe
PID 2260 wrote to memory of 5900	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\EKSWRMo.exe
PID 2260 wrote to memory of 5900	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\EKSWRMo.exe
PID 2260 wrote to memory of 5916	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\SRqCDUr.exe
PID 2260 wrote to memory of 5916	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\SRqCDUr.exe
PID 2260 wrote to memory of 5984	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\atHUNrr.exe
PID 2260 wrote to memory of 5984	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\atHUNrr.exe
PID 2260 wrote to memory of 5872	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\zAFbQlh.exe
PID 2260 wrote to memory of 5872	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\zAFbQlh.exe
PID 2260 wrote to memory of 5824	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\HwIsEwX.exe
PID 2260 wrote to memory of 5824	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\HwIsEwX.exe
PID 2260 wrote to memory of 5500	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\eZMIUNT.exe
PID 2260 wrote to memory of 5500	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\eZMIUNT.exe
PID 2260 wrote to memory of 5508	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\refKjbK.exe
PID 2260 wrote to memory of 5508	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\refKjbK.exe
PID 2260 wrote to memory of 5968	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\muJAseK.exe
PID 2260 wrote to memory of 5968	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\muJAseK.exe
PID 2260 wrote to memory of 3576	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\ZhJKZFg.exe
PID 2260 wrote to memory of 3576	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\ZhJKZFg.exe
PID 2260 wrote to memory of 2704	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\vdkMHgC.exe
PID 2260 wrote to memory of 2704	N/A	C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe	C:\Windows\System\vdkMHgC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\sJcEHyl.exe

C:\Windows\System\sJcEHyl.exe

C:\Windows\System\NzEFnJE.exe

C:\Windows\System\NzEFnJE.exe

C:\Windows\System\ZabLnGx.exe

C:\Windows\System\ZabLnGx.exe

C:\Windows\System\NrVhwAG.exe

C:\Windows\System\NrVhwAG.exe

C:\Windows\System\EldnTBm.exe

C:\Windows\System\EldnTBm.exe

C:\Windows\System\TcrsXlE.exe

C:\Windows\System\TcrsXlE.exe

C:\Windows\System\ULmUwsS.exe

C:\Windows\System\ULmUwsS.exe

C:\Windows\System\WqElqYD.exe

C:\Windows\System\WqElqYD.exe

C:\Windows\System\MsaKpuF.exe

C:\Windows\System\MsaKpuF.exe

C:\Windows\System\SRCkadK.exe

C:\Windows\System\SRCkadK.exe

C:\Windows\System\ctcoSod.exe

C:\Windows\System\ctcoSod.exe

C:\Windows\System\AqkEjyK.exe

C:\Windows\System\AqkEjyK.exe

C:\Windows\System\FZqmJGE.exe

C:\Windows\System\FZqmJGE.exe

C:\Windows\System\MSZTUPq.exe

C:\Windows\System\MSZTUPq.exe

C:\Windows\System\SBsnhgr.exe

C:\Windows\System\SBsnhgr.exe

C:\Windows\System\UdQdwvF.exe

C:\Windows\System\UdQdwvF.exe

C:\Windows\System\eSWVqkQ.exe

C:\Windows\System\eSWVqkQ.exe

C:\Windows\System\HicLRkF.exe

C:\Windows\System\HicLRkF.exe

C:\Windows\System\LUQnQAA.exe

C:\Windows\System\LUQnQAA.exe

C:\Windows\System\xBxWlbI.exe

C:\Windows\System\xBxWlbI.exe

C:\Windows\System\FdVOnTJ.exe

C:\Windows\System\FdVOnTJ.exe

C:\Windows\System\EKSWRMo.exe

C:\Windows\System\EKSWRMo.exe

C:\Windows\System\SRqCDUr.exe

C:\Windows\System\SRqCDUr.exe

C:\Windows\System\atHUNrr.exe

C:\Windows\System\atHUNrr.exe

C:\Windows\System\zAFbQlh.exe

C:\Windows\System\zAFbQlh.exe

C:\Windows\System\HwIsEwX.exe

C:\Windows\System\HwIsEwX.exe

C:\Windows\System\eZMIUNT.exe

C:\Windows\System\eZMIUNT.exe

C:\Windows\System\refKjbK.exe

C:\Windows\System\refKjbK.exe

C:\Windows\System\muJAseK.exe

C:\Windows\System\muJAseK.exe

C:\Windows\System\ZhJKZFg.exe

C:\Windows\System\ZhJKZFg.exe

C:\Windows\System\vdkMHgC.exe

C:\Windows\System\vdkMHgC.exe

C:\Windows\System\TSGMNSD.exe

C:\Windows\System\TSGMNSD.exe

C:\Windows\System\ukiInhQ.exe

C:\Windows\System\ukiInhQ.exe

C:\Windows\System\dkWlPGF.exe

C:\Windows\System\dkWlPGF.exe

C:\Windows\System\ecPmrEl.exe

C:\Windows\System\ecPmrEl.exe

C:\Windows\System\mbJALYw.exe

C:\Windows\System\mbJALYw.exe

C:\Windows\System\OYhCPRG.exe

C:\Windows\System\OYhCPRG.exe

C:\Windows\System\yZZAxmF.exe

C:\Windows\System\yZZAxmF.exe

C:\Windows\System\bKSuOBV.exe

C:\Windows\System\bKSuOBV.exe

C:\Windows\System\BrympqK.exe

C:\Windows\System\BrympqK.exe

C:\Windows\System\IZIkNbz.exe

C:\Windows\System\IZIkNbz.exe

C:\Windows\System\vgbrrTD.exe

C:\Windows\System\vgbrrTD.exe

C:\Windows\System\JtcTCeG.exe

C:\Windows\System\JtcTCeG.exe

C:\Windows\System\eHcvEwo.exe

C:\Windows\System\eHcvEwo.exe

C:\Windows\System\tSUXQeD.exe

C:\Windows\System\tSUXQeD.exe

C:\Windows\System\NeWcxLR.exe

C:\Windows\System\NeWcxLR.exe

C:\Windows\System\xEBOilz.exe

C:\Windows\System\xEBOilz.exe

C:\Windows\System\TQrIMui.exe

C:\Windows\System\TQrIMui.exe

C:\Windows\System\vhjtmIt.exe

C:\Windows\System\vhjtmIt.exe

C:\Windows\System\ScoZqXb.exe

C:\Windows\System\ScoZqXb.exe

C:\Windows\System\RYWtSoK.exe

C:\Windows\System\RYWtSoK.exe

C:\Windows\System\CexaQNp.exe

C:\Windows\System\CexaQNp.exe

C:\Windows\System\aaOJECV.exe

C:\Windows\System\aaOJECV.exe

C:\Windows\System\jMejHFe.exe

C:\Windows\System\jMejHFe.exe

C:\Windows\System\IPZPOQE.exe

C:\Windows\System\IPZPOQE.exe

C:\Windows\System\IajLdCH.exe

C:\Windows\System\IajLdCH.exe

C:\Windows\System\MCoiCDP.exe

C:\Windows\System\MCoiCDP.exe

C:\Windows\System\WxBTQfQ.exe

C:\Windows\System\WxBTQfQ.exe

C:\Windows\System\JuPfIko.exe

C:\Windows\System\JuPfIko.exe

C:\Windows\System\OUYBTWl.exe

C:\Windows\System\OUYBTWl.exe

C:\Windows\System\WbNbwnH.exe

C:\Windows\System\WbNbwnH.exe

C:\Windows\System\WdlBngm.exe

C:\Windows\System\WdlBngm.exe

C:\Windows\System\AdsiIiY.exe

C:\Windows\System\AdsiIiY.exe

C:\Windows\System\ZbbvhXV.exe

C:\Windows\System\ZbbvhXV.exe

C:\Windows\System\yRXALLB.exe

C:\Windows\System\yRXALLB.exe

C:\Windows\System\KwBSWTk.exe

C:\Windows\System\KwBSWTk.exe

C:\Windows\System\whfazlU.exe

C:\Windows\System\whfazlU.exe

C:\Windows\System\xsYLNvn.exe

C:\Windows\System\xsYLNvn.exe

C:\Windows\System\sgtOFzA.exe

C:\Windows\System\sgtOFzA.exe

C:\Windows\System\gwxGqIi.exe

C:\Windows\System\gwxGqIi.exe

C:\Windows\System\TzvgIMA.exe

C:\Windows\System\TzvgIMA.exe

C:\Windows\System\tfErZMO.exe

C:\Windows\System\tfErZMO.exe

C:\Windows\System\fRtYTDK.exe

C:\Windows\System\fRtYTDK.exe

C:\Windows\System\deeJAQc.exe

C:\Windows\System\deeJAQc.exe

C:\Windows\System\ieuUhaR.exe

C:\Windows\System\ieuUhaR.exe

C:\Windows\System\VVqyqnG.exe

C:\Windows\System\VVqyqnG.exe

C:\Windows\System\iFfWzJC.exe

C:\Windows\System\iFfWzJC.exe

C:\Windows\System\uFebZuN.exe

C:\Windows\System\uFebZuN.exe

C:\Windows\System\AbCIdSW.exe

C:\Windows\System\AbCIdSW.exe

C:\Windows\System\HiQKRof.exe

C:\Windows\System\HiQKRof.exe

C:\Windows\System\UZtAjoJ.exe

C:\Windows\System\UZtAjoJ.exe

C:\Windows\System\MiPXYKG.exe

C:\Windows\System\MiPXYKG.exe

C:\Windows\System\KEMLplR.exe

C:\Windows\System\KEMLplR.exe

C:\Windows\System\qfGpBvu.exe

C:\Windows\System\qfGpBvu.exe

C:\Windows\System\VmqTdEC.exe

C:\Windows\System\VmqTdEC.exe

C:\Windows\System\VafvOno.exe

C:\Windows\System\VafvOno.exe

C:\Windows\System\hpXWOUQ.exe

C:\Windows\System\hpXWOUQ.exe

C:\Windows\System\WWxQMHe.exe

C:\Windows\System\WWxQMHe.exe

C:\Windows\System\OJgdAuV.exe

C:\Windows\System\OJgdAuV.exe

C:\Windows\System\guGSTYT.exe

C:\Windows\System\guGSTYT.exe

C:\Windows\System\WCBAwDx.exe

C:\Windows\System\WCBAwDx.exe

C:\Windows\System\EUReUxV.exe

C:\Windows\System\EUReUxV.exe

C:\Windows\System\clAaNRp.exe

C:\Windows\System\clAaNRp.exe

C:\Windows\System\DZChFgz.exe

C:\Windows\System\DZChFgz.exe

C:\Windows\System\cWKytpu.exe

C:\Windows\System\cWKytpu.exe

C:\Windows\System\apLDMRd.exe

C:\Windows\System\apLDMRd.exe

C:\Windows\System\YkiGPnR.exe

C:\Windows\System\YkiGPnR.exe

C:\Windows\System\LqdyIzc.exe

C:\Windows\System\LqdyIzc.exe

C:\Windows\System\HkIEpxq.exe

C:\Windows\System\HkIEpxq.exe

C:\Windows\System\ysSYkcg.exe

C:\Windows\System\ysSYkcg.exe

C:\Windows\System\hVUvmTV.exe

C:\Windows\System\hVUvmTV.exe

C:\Windows\System\kZzRFCl.exe

C:\Windows\System\kZzRFCl.exe

C:\Windows\System\HsxXdPb.exe

C:\Windows\System\HsxXdPb.exe

C:\Windows\System\sNcnKAz.exe

C:\Windows\System\sNcnKAz.exe

C:\Windows\System\dcZqKjk.exe

C:\Windows\System\dcZqKjk.exe

C:\Windows\System\lYPCxVh.exe

C:\Windows\System\lYPCxVh.exe

C:\Windows\System\mENBpzb.exe

C:\Windows\System\mENBpzb.exe

C:\Windows\System\hcxJCMT.exe

C:\Windows\System\hcxJCMT.exe

C:\Windows\System\jDDWQTd.exe

C:\Windows\System\jDDWQTd.exe

C:\Windows\System\tzBwNcw.exe

C:\Windows\System\tzBwNcw.exe

C:\Windows\System\KewQHAn.exe

C:\Windows\System\KewQHAn.exe

C:\Windows\System\ZsDSNmQ.exe

C:\Windows\System\ZsDSNmQ.exe

C:\Windows\System\kpnagtr.exe

C:\Windows\System\kpnagtr.exe

C:\Windows\System\RJQhejy.exe

C:\Windows\System\RJQhejy.exe

C:\Windows\System\KhIYaLW.exe

C:\Windows\System\KhIYaLW.exe

C:\Windows\System\HYbLRCJ.exe

C:\Windows\System\HYbLRCJ.exe

C:\Windows\System\ZufnGfL.exe

C:\Windows\System\ZufnGfL.exe

C:\Windows\System\wfgmRFk.exe

C:\Windows\System\wfgmRFk.exe

C:\Windows\System\kxMnHbJ.exe

C:\Windows\System\kxMnHbJ.exe

C:\Windows\System\BMjrmUE.exe

C:\Windows\System\BMjrmUE.exe

C:\Windows\System\ZcNXJbX.exe

C:\Windows\System\ZcNXJbX.exe

C:\Windows\System\SdcVXnU.exe

C:\Windows\System\SdcVXnU.exe

C:\Windows\System\dOskgHy.exe

C:\Windows\System\dOskgHy.exe

C:\Windows\System\VUSqjeL.exe

C:\Windows\System\VUSqjeL.exe

C:\Windows\System\lfxBEAQ.exe

C:\Windows\System\lfxBEAQ.exe

C:\Windows\System\iGIQiiU.exe

C:\Windows\System\iGIQiiU.exe

C:\Windows\System\JKyfDUG.exe

C:\Windows\System\JKyfDUG.exe

C:\Windows\System\rlXvRqf.exe

C:\Windows\System\rlXvRqf.exe

C:\Windows\System\MtHJQhX.exe

C:\Windows\System\MtHJQhX.exe

C:\Windows\System\QCyzoJu.exe

C:\Windows\System\QCyzoJu.exe

C:\Windows\System\iJCkrcc.exe

C:\Windows\System\iJCkrcc.exe

C:\Windows\System\JxhGwgU.exe

C:\Windows\System\JxhGwgU.exe

C:\Windows\System\WIHYghU.exe

C:\Windows\System\WIHYghU.exe

C:\Windows\System\ykYmYZk.exe

C:\Windows\System\ykYmYZk.exe

C:\Windows\System\hGxRyhi.exe

C:\Windows\System\hGxRyhi.exe

C:\Windows\System\uGHPsYS.exe

C:\Windows\System\uGHPsYS.exe

C:\Windows\System\TtVbbqL.exe

C:\Windows\System\TtVbbqL.exe

C:\Windows\System\Chximvr.exe

C:\Windows\System\Chximvr.exe

C:\Windows\System\WUkHsny.exe

C:\Windows\System\WUkHsny.exe

C:\Windows\System\KHKArON.exe

C:\Windows\System\KHKArON.exe

C:\Windows\System\JTbwIMu.exe

C:\Windows\System\JTbwIMu.exe

C:\Windows\System\EQrfkOg.exe

C:\Windows\System\EQrfkOg.exe

C:\Windows\System\xpiQQVc.exe

C:\Windows\System\xpiQQVc.exe

C:\Windows\System\YdolZQi.exe

C:\Windows\System\YdolZQi.exe

C:\Windows\System\FENfaeV.exe

C:\Windows\System\FENfaeV.exe

C:\Windows\System\IUpWikE.exe

C:\Windows\System\IUpWikE.exe

C:\Windows\System\MmqpzSv.exe

C:\Windows\System\MmqpzSv.exe

C:\Windows\System\bZYssua.exe

C:\Windows\System\bZYssua.exe

C:\Windows\System\kBBOfJp.exe

C:\Windows\System\kBBOfJp.exe

C:\Windows\System\iwaUGXr.exe

C:\Windows\System\iwaUGXr.exe

C:\Windows\System\PIFWCtU.exe

C:\Windows\System\PIFWCtU.exe

C:\Windows\System\dkmTvDe.exe

C:\Windows\System\dkmTvDe.exe

C:\Windows\System\edsvbxN.exe

C:\Windows\System\edsvbxN.exe

C:\Windows\System\EpcCigP.exe

C:\Windows\System\EpcCigP.exe

C:\Windows\System\ZtsDIpA.exe

C:\Windows\System\ZtsDIpA.exe

C:\Windows\System\ljtsEcP.exe

C:\Windows\System\ljtsEcP.exe

C:\Windows\System\BqSkDQN.exe

C:\Windows\System\BqSkDQN.exe

C:\Windows\System\lIQIKFI.exe

C:\Windows\System\lIQIKFI.exe

C:\Windows\System\wzottUS.exe

C:\Windows\System\wzottUS.exe

C:\Windows\System\UeDYrUr.exe

C:\Windows\System\UeDYrUr.exe

C:\Windows\System\qAXeqqd.exe

C:\Windows\System\qAXeqqd.exe

C:\Windows\System\WRTVQaU.exe

C:\Windows\System\WRTVQaU.exe

C:\Windows\System\CZJdvGZ.exe

C:\Windows\System\CZJdvGZ.exe

C:\Windows\System\CwfJkyC.exe

C:\Windows\System\CwfJkyC.exe

C:\Windows\System\idvKhgB.exe

C:\Windows\System\idvKhgB.exe

C:\Windows\System\uRPXcHT.exe

C:\Windows\System\uRPXcHT.exe

C:\Windows\System\MBWoafA.exe

C:\Windows\System\MBWoafA.exe

C:\Windows\System\WIpaHlO.exe

C:\Windows\System\WIpaHlO.exe

C:\Windows\System\veYxpsJ.exe

C:\Windows\System\veYxpsJ.exe

C:\Windows\System\BRJcbMR.exe

C:\Windows\System\BRJcbMR.exe

C:\Windows\System\tCWCBQB.exe

C:\Windows\System\tCWCBQB.exe

C:\Windows\System\cMUbyxu.exe

C:\Windows\System\cMUbyxu.exe

C:\Windows\System\XpsIzwf.exe

C:\Windows\System\XpsIzwf.exe

C:\Windows\System\xohYobG.exe

C:\Windows\System\xohYobG.exe

C:\Windows\System\IrsDfgz.exe

C:\Windows\System\IrsDfgz.exe

C:\Windows\System\BtOntiw.exe

C:\Windows\System\BtOntiw.exe

C:\Windows\System\FjXXgHV.exe

C:\Windows\System\FjXXgHV.exe

C:\Windows\System\mvsfPuW.exe

C:\Windows\System\mvsfPuW.exe

C:\Windows\System\JEgyOlW.exe

C:\Windows\System\JEgyOlW.exe

C:\Windows\System\sOSshlf.exe

C:\Windows\System\sOSshlf.exe

C:\Windows\System\bMWAUnr.exe

C:\Windows\System\bMWAUnr.exe

C:\Windows\System\RmEGxqc.exe

C:\Windows\System\RmEGxqc.exe

C:\Windows\System\BOhnePt.exe

C:\Windows\System\BOhnePt.exe

C:\Windows\System\NfplDez.exe

C:\Windows\System\NfplDez.exe

C:\Windows\System\bGEWDNn.exe

C:\Windows\System\bGEWDNn.exe

C:\Windows\System\FzdbXSd.exe

C:\Windows\System\FzdbXSd.exe

C:\Windows\System\bkLYMoR.exe

C:\Windows\System\bkLYMoR.exe

C:\Windows\System\wNEkSkJ.exe

C:\Windows\System\wNEkSkJ.exe

C:\Windows\System\bhJerpr.exe

C:\Windows\System\bhJerpr.exe

C:\Windows\System\qDJUuut.exe

C:\Windows\System\qDJUuut.exe

C:\Windows\System\iqJoLfL.exe

C:\Windows\System\iqJoLfL.exe

C:\Windows\System\INfWYQy.exe

C:\Windows\System\INfWYQy.exe

C:\Windows\System\OFNHohQ.exe

C:\Windows\System\OFNHohQ.exe

C:\Windows\System\RWFernl.exe

C:\Windows\System\RWFernl.exe

C:\Windows\System\DTwkruR.exe

C:\Windows\System\DTwkruR.exe

C:\Windows\System\FyrWlKl.exe

C:\Windows\System\FyrWlKl.exe

C:\Windows\System\aWhpzWU.exe

C:\Windows\System\aWhpzWU.exe

C:\Windows\System\wslJUkk.exe

C:\Windows\System\wslJUkk.exe

C:\Windows\System\TegntnK.exe

C:\Windows\System\TegntnK.exe

C:\Windows\System\xjhmYvb.exe

C:\Windows\System\xjhmYvb.exe

C:\Windows\System\KtiuVOs.exe

C:\Windows\System\KtiuVOs.exe

C:\Windows\System\hhvxVhM.exe

C:\Windows\System\hhvxVhM.exe

C:\Windows\System\AUYBbrd.exe

C:\Windows\System\AUYBbrd.exe

C:\Windows\System\jGnHqCD.exe

C:\Windows\System\jGnHqCD.exe

C:\Windows\System\mCyVVOv.exe

C:\Windows\System\mCyVVOv.exe

C:\Windows\System\ObiYpEK.exe

C:\Windows\System\ObiYpEK.exe

C:\Windows\System\byKiELB.exe

C:\Windows\System\byKiELB.exe

C:\Windows\System\rtSomoS.exe

C:\Windows\System\rtSomoS.exe

C:\Windows\System\GPirXls.exe

C:\Windows\System\GPirXls.exe

C:\Windows\System\GPesBOu.exe

C:\Windows\System\GPesBOu.exe

C:\Windows\System\QisWNmf.exe

C:\Windows\System\QisWNmf.exe

C:\Windows\System\NOPjsiC.exe

C:\Windows\System\NOPjsiC.exe

C:\Windows\System\ISMMJBl.exe

C:\Windows\System\ISMMJBl.exe

C:\Windows\System\jvuirNl.exe

C:\Windows\System\jvuirNl.exe

C:\Windows\System\tLcGswH.exe

C:\Windows\System\tLcGswH.exe

C:\Windows\System\dECAWzr.exe

C:\Windows\System\dECAWzr.exe

C:\Windows\System\dptxLyk.exe

C:\Windows\System\dptxLyk.exe

C:\Windows\System\hqxgZnB.exe

C:\Windows\System\hqxgZnB.exe

C:\Windows\System\CWospzv.exe

C:\Windows\System\CWospzv.exe

C:\Windows\System\StHKxNc.exe

C:\Windows\System\StHKxNc.exe

C:\Windows\System\zQDTUOC.exe

C:\Windows\System\zQDTUOC.exe

C:\Windows\System\sLDYujR.exe

C:\Windows\System\sLDYujR.exe

C:\Windows\System\RDkcjtJ.exe

C:\Windows\System\RDkcjtJ.exe

C:\Windows\System\HleEXbX.exe

C:\Windows\System\HleEXbX.exe

C:\Windows\System\JrZazew.exe

C:\Windows\System\JrZazew.exe

C:\Windows\System\wmgMtSZ.exe

C:\Windows\System\wmgMtSZ.exe

C:\Windows\System\zAwRZKM.exe

C:\Windows\System\zAwRZKM.exe

C:\Windows\System\mNmjuZM.exe

C:\Windows\System\mNmjuZM.exe

C:\Windows\System\tGYkYKi.exe

C:\Windows\System\tGYkYKi.exe

C:\Windows\System\AsAxwqV.exe

C:\Windows\System\AsAxwqV.exe

C:\Windows\System\wunKVJM.exe

C:\Windows\System\wunKVJM.exe

C:\Windows\System\rFMsJLN.exe

C:\Windows\System\rFMsJLN.exe

C:\Windows\System\EbbBKjE.exe

C:\Windows\System\EbbBKjE.exe

C:\Windows\System\vYPQmiG.exe

C:\Windows\System\vYPQmiG.exe

C:\Windows\System\HpCFINE.exe

C:\Windows\System\HpCFINE.exe

C:\Windows\System\jsjqclg.exe

C:\Windows\System\jsjqclg.exe

C:\Windows\System\tBhceEu.exe

C:\Windows\System\tBhceEu.exe

C:\Windows\System\SVnhsgk.exe

C:\Windows\System\SVnhsgk.exe

C:\Windows\System\KRhXMmu.exe

C:\Windows\System\KRhXMmu.exe

C:\Windows\System\HYkjihB.exe

C:\Windows\System\HYkjihB.exe

C:\Windows\System\bOsSePi.exe

C:\Windows\System\bOsSePi.exe

C:\Windows\System\xYfIoSo.exe

C:\Windows\System\xYfIoSo.exe

C:\Windows\System\NIrKOEQ.exe

C:\Windows\System\NIrKOEQ.exe

C:\Windows\System\pLtieug.exe

C:\Windows\System\pLtieug.exe

C:\Windows\System\zPYbGPr.exe

C:\Windows\System\zPYbGPr.exe

C:\Windows\System\qAEGrlA.exe

C:\Windows\System\qAEGrlA.exe

C:\Windows\System\RHjsstE.exe

C:\Windows\System\RHjsstE.exe

C:\Windows\System\GLLysHv.exe

C:\Windows\System\GLLysHv.exe

C:\Windows\System\sUARHod.exe

C:\Windows\System\sUARHod.exe

C:\Windows\System\mzNLyhH.exe

C:\Windows\System\mzNLyhH.exe

C:\Windows\System\mDSzdmO.exe

C:\Windows\System\mDSzdmO.exe

C:\Windows\System\jwsGKQd.exe

C:\Windows\System\jwsGKQd.exe

C:\Windows\System\eAvhulb.exe

C:\Windows\System\eAvhulb.exe

C:\Windows\System\GjbMZzh.exe

C:\Windows\System\GjbMZzh.exe

C:\Windows\System\eOtCvlE.exe

C:\Windows\System\eOtCvlE.exe

C:\Windows\System\GXlDcLK.exe

C:\Windows\System\GXlDcLK.exe

C:\Windows\System\ZscZqih.exe

C:\Windows\System\ZscZqih.exe

C:\Windows\System\DogDeYY.exe

C:\Windows\System\DogDeYY.exe

C:\Windows\System\xrlfbAL.exe

C:\Windows\System\xrlfbAL.exe

C:\Windows\System\iqqqsqo.exe

C:\Windows\System\iqqqsqo.exe

C:\Windows\System\YiDAXjC.exe

C:\Windows\System\YiDAXjC.exe

C:\Windows\System\GDyaqwb.exe

C:\Windows\System\GDyaqwb.exe

C:\Windows\System\WUIZkAS.exe

C:\Windows\System\WUIZkAS.exe

C:\Windows\System\atOHzjV.exe

C:\Windows\System\atOHzjV.exe

C:\Windows\System\WNsyZsn.exe

C:\Windows\System\WNsyZsn.exe

C:\Windows\System\izJuXLd.exe

C:\Windows\System\izJuXLd.exe

C:\Windows\System\YGjtPsd.exe

C:\Windows\System\YGjtPsd.exe

C:\Windows\System\xgVuToc.exe

C:\Windows\System\xgVuToc.exe

C:\Windows\System\VbEVapJ.exe

C:\Windows\System\VbEVapJ.exe

C:\Windows\System\kGeBIov.exe

C:\Windows\System\kGeBIov.exe

C:\Windows\System\tTbgzFd.exe

C:\Windows\System\tTbgzFd.exe

C:\Windows\System\crsJaLk.exe

C:\Windows\System\crsJaLk.exe

C:\Windows\System\YpQXDBq.exe

C:\Windows\System\YpQXDBq.exe

C:\Windows\System\qQHMgfu.exe

C:\Windows\System\qQHMgfu.exe

C:\Windows\System\tHtBQyf.exe

C:\Windows\System\tHtBQyf.exe

C:\Windows\System\WroMTjx.exe

C:\Windows\System\WroMTjx.exe

C:\Windows\System\vQilPJW.exe

C:\Windows\System\vQilPJW.exe

C:\Windows\System\QhuxOMa.exe

C:\Windows\System\QhuxOMa.exe

C:\Windows\System\QCBkFpa.exe

C:\Windows\System\QCBkFpa.exe

C:\Windows\System\sVZUqui.exe

C:\Windows\System\sVZUqui.exe

C:\Windows\System\BAUkuEa.exe

C:\Windows\System\BAUkuEa.exe

C:\Windows\System\RtFalyk.exe

C:\Windows\System\RtFalyk.exe

C:\Windows\System\AMWxhog.exe

C:\Windows\System\AMWxhog.exe

C:\Windows\System\LbBABLA.exe

C:\Windows\System\LbBABLA.exe

C:\Windows\System\gdDGpkc.exe

C:\Windows\System\gdDGpkc.exe

C:\Windows\System\atgtwDF.exe

C:\Windows\System\atgtwDF.exe

C:\Windows\System\ivRcrbP.exe

C:\Windows\System\ivRcrbP.exe

C:\Windows\System\hGwbHBA.exe

C:\Windows\System\hGwbHBA.exe

C:\Windows\System\DSNiFkT.exe

C:\Windows\System\DSNiFkT.exe

C:\Windows\System\rMYhKJv.exe

C:\Windows\System\rMYhKJv.exe

C:\Windows\System\zFfnPCR.exe

C:\Windows\System\zFfnPCR.exe

C:\Windows\System\XZZqvqp.exe

C:\Windows\System\XZZqvqp.exe

C:\Windows\System\qYhELKE.exe

C:\Windows\System\qYhELKE.exe

C:\Windows\System\GvvkTPS.exe

C:\Windows\System\GvvkTPS.exe

C:\Windows\System\ZHeQakM.exe

C:\Windows\System\ZHeQakM.exe

C:\Windows\System\lEDNqsi.exe

C:\Windows\System\lEDNqsi.exe

C:\Windows\System\yJIiyYz.exe

C:\Windows\System\yJIiyYz.exe

C:\Windows\System\XdULsgc.exe

C:\Windows\System\XdULsgc.exe

C:\Windows\System\KZhCTNQ.exe

C:\Windows\System\KZhCTNQ.exe

C:\Windows\System\rUkaVKt.exe

C:\Windows\System\rUkaVKt.exe

C:\Windows\System\GvBnaIT.exe

C:\Windows\System\GvBnaIT.exe

C:\Windows\System\GRNjyOU.exe

C:\Windows\System\GRNjyOU.exe

C:\Windows\System\wtPHcpM.exe

C:\Windows\System\wtPHcpM.exe

C:\Windows\System\HtZpjYn.exe

C:\Windows\System\HtZpjYn.exe

C:\Windows\System\sIvMeIa.exe

C:\Windows\System\sIvMeIa.exe

C:\Windows\System\qNBYoZC.exe

C:\Windows\System\qNBYoZC.exe

C:\Windows\System\MuKBORf.exe

C:\Windows\System\MuKBORf.exe

C:\Windows\System\voOBCAR.exe

C:\Windows\System\voOBCAR.exe

C:\Windows\System\ZQahFrg.exe

C:\Windows\System\ZQahFrg.exe

C:\Windows\System\biFbkRK.exe

C:\Windows\System\biFbkRK.exe

C:\Windows\System\WUypwAS.exe

C:\Windows\System\WUypwAS.exe

C:\Windows\System\WtAZGEk.exe

C:\Windows\System\WtAZGEk.exe

C:\Windows\System\SBJEJJz.exe

C:\Windows\System\SBJEJJz.exe

C:\Windows\System\gwRleoz.exe

C:\Windows\System\gwRleoz.exe

C:\Windows\System\EMTxlbD.exe

C:\Windows\System\EMTxlbD.exe

C:\Windows\System\ekRVNJh.exe

C:\Windows\System\ekRVNJh.exe

C:\Windows\System\sxlaytH.exe

C:\Windows\System\sxlaytH.exe

C:\Windows\System\DgWhipI.exe

C:\Windows\System\DgWhipI.exe

C:\Windows\System\LqfoIok.exe

C:\Windows\System\LqfoIok.exe

C:\Windows\System\fSDrcRk.exe

C:\Windows\System\fSDrcRk.exe

C:\Windows\System\zDQsWBN.exe

C:\Windows\System\zDQsWBN.exe

C:\Windows\System\IHqXpRR.exe

C:\Windows\System\IHqXpRR.exe

C:\Windows\System\ZFOsnuu.exe

C:\Windows\System\ZFOsnuu.exe

C:\Windows\System\iyTOJAy.exe

C:\Windows\System\iyTOJAy.exe

C:\Windows\System\ssPRCYl.exe

C:\Windows\System\ssPRCYl.exe

C:\Windows\System\kCZvhJZ.exe

C:\Windows\System\kCZvhJZ.exe

C:\Windows\System\tTFnklN.exe

C:\Windows\System\tTFnklN.exe

C:\Windows\System\uozTzVE.exe

C:\Windows\System\uozTzVE.exe

C:\Windows\System\OQjLwPR.exe

C:\Windows\System\OQjLwPR.exe

C:\Windows\System\dzNjKhw.exe

C:\Windows\System\dzNjKhw.exe

C:\Windows\System\fZacewx.exe

C:\Windows\System\fZacewx.exe

C:\Windows\System\OREaOwB.exe

C:\Windows\System\OREaOwB.exe

C:\Windows\System\rRqzACs.exe

C:\Windows\System\rRqzACs.exe

C:\Windows\System\fIvjahP.exe

C:\Windows\System\fIvjahP.exe

C:\Windows\System\TkyWICx.exe

C:\Windows\System\TkyWICx.exe

C:\Windows\System\fjoQjqH.exe

C:\Windows\System\fjoQjqH.exe

C:\Windows\System\JaHkgMA.exe

C:\Windows\System\JaHkgMA.exe

C:\Windows\System\FXCzWYg.exe

C:\Windows\System\FXCzWYg.exe

C:\Windows\System\lKxDOml.exe

C:\Windows\System\lKxDOml.exe

C:\Windows\System\oMJBEyc.exe

C:\Windows\System\oMJBEyc.exe

C:\Windows\System\kYPsOhE.exe

C:\Windows\System\kYPsOhE.exe

C:\Windows\System\ZLJkUSW.exe

C:\Windows\System\ZLJkUSW.exe

C:\Windows\System\LMSCIDP.exe

C:\Windows\System\LMSCIDP.exe

C:\Windows\System\pkvftod.exe

C:\Windows\System\pkvftod.exe

C:\Windows\System\JDfIvIn.exe

C:\Windows\System\JDfIvIn.exe

C:\Windows\System\LxQmRYk.exe

C:\Windows\System\LxQmRYk.exe

C:\Windows\System\ZnfLulG.exe

C:\Windows\System\ZnfLulG.exe

C:\Windows\System\psQsvrw.exe

C:\Windows\System\psQsvrw.exe

C:\Windows\System\XGCjzGE.exe

C:\Windows\System\XGCjzGE.exe

C:\Windows\System\sjpmQFD.exe

C:\Windows\System\sjpmQFD.exe

C:\Windows\System\TKThhbN.exe

C:\Windows\System\TKThhbN.exe

C:\Windows\System\NceIzzu.exe

C:\Windows\System\NceIzzu.exe

C:\Windows\System\OtRjCkw.exe

C:\Windows\System\OtRjCkw.exe

C:\Windows\System\xsQAXYy.exe

C:\Windows\System\xsQAXYy.exe

C:\Windows\System\YrdjmxL.exe

C:\Windows\System\YrdjmxL.exe

C:\Windows\System\QsaVdQl.exe

C:\Windows\System\QsaVdQl.exe

C:\Windows\System\mYdDfbk.exe

C:\Windows\System\mYdDfbk.exe

C:\Windows\System\IuCAISW.exe

C:\Windows\System\IuCAISW.exe

C:\Windows\System\ifSzBMq.exe

C:\Windows\System\ifSzBMq.exe

C:\Windows\System\RNxIgYE.exe

C:\Windows\System\RNxIgYE.exe

C:\Windows\System\IKiLveN.exe

C:\Windows\System\IKiLveN.exe

C:\Windows\System\hEYNjhU.exe

C:\Windows\System\hEYNjhU.exe

C:\Windows\System\bbrfnBx.exe

C:\Windows\System\bbrfnBx.exe

C:\Windows\System\iTOaLER.exe

C:\Windows\System\iTOaLER.exe

C:\Windows\System\cSMZZMV.exe

C:\Windows\System\cSMZZMV.exe

C:\Windows\System\ullNrSo.exe

C:\Windows\System\ullNrSo.exe

C:\Windows\System\iKOwqqB.exe

C:\Windows\System\iKOwqqB.exe

C:\Windows\System\Bgdusva.exe

C:\Windows\System\Bgdusva.exe

C:\Windows\System\KlTcJcl.exe

C:\Windows\System\KlTcJcl.exe

C:\Windows\System\adyGNbW.exe

C:\Windows\System\adyGNbW.exe

C:\Windows\System\taYibzk.exe

C:\Windows\System\taYibzk.exe

C:\Windows\System\REcgggx.exe

C:\Windows\System\REcgggx.exe

C:\Windows\System\FrmSbeb.exe

C:\Windows\System\FrmSbeb.exe

C:\Windows\System\QogJGjg.exe

C:\Windows\System\QogJGjg.exe

C:\Windows\System\PkGshRT.exe

C:\Windows\System\PkGshRT.exe

C:\Windows\System\AFHzcke.exe

C:\Windows\System\AFHzcke.exe

C:\Windows\System\EWvMBwf.exe

C:\Windows\System\EWvMBwf.exe

C:\Windows\System\pHUXBaH.exe

C:\Windows\System\pHUXBaH.exe

C:\Windows\System\AOAMCLd.exe

C:\Windows\System\AOAMCLd.exe

C:\Windows\System\aPTYKYE.exe

C:\Windows\System\aPTYKYE.exe

C:\Windows\System\woueVgd.exe

C:\Windows\System\woueVgd.exe

C:\Windows\System\XryfZKj.exe

C:\Windows\System\XryfZKj.exe

C:\Windows\System\oxRjPsq.exe

C:\Windows\System\oxRjPsq.exe

C:\Windows\System\GLwyQjG.exe

C:\Windows\System\GLwyQjG.exe

C:\Windows\System\ChtQMpI.exe

C:\Windows\System\ChtQMpI.exe

C:\Windows\System\ToWScNL.exe

C:\Windows\System\ToWScNL.exe

C:\Windows\System\IQhwrYf.exe

C:\Windows\System\IQhwrYf.exe

C:\Windows\System\DVwAxjU.exe

C:\Windows\System\DVwAxjU.exe

C:\Windows\System\vruKdIN.exe

C:\Windows\System\vruKdIN.exe

C:\Windows\System\DQRVgtT.exe

C:\Windows\System\DQRVgtT.exe

C:\Windows\System\zFQfWJD.exe

C:\Windows\System\zFQfWJD.exe

C:\Windows\System\LyfCiAt.exe

C:\Windows\System\LyfCiAt.exe

C:\Windows\System\ueEwAEz.exe

C:\Windows\System\ueEwAEz.exe

C:\Windows\System\XkFakOw.exe

C:\Windows\System\XkFakOw.exe

C:\Windows\System\DmXmaHr.exe

C:\Windows\System\DmXmaHr.exe

C:\Windows\System\PaMPjRQ.exe

C:\Windows\System\PaMPjRQ.exe

C:\Windows\System\ehyYiQI.exe

C:\Windows\System\ehyYiQI.exe

C:\Windows\System\FCOuNbW.exe

C:\Windows\System\FCOuNbW.exe

C:\Windows\System\poyNOUn.exe

C:\Windows\System\poyNOUn.exe

C:\Windows\System\RcoqUMS.exe

C:\Windows\System\RcoqUMS.exe

C:\Windows\System\HwvOwoN.exe

C:\Windows\System\HwvOwoN.exe

C:\Windows\System\dXdQZsO.exe

C:\Windows\System\dXdQZsO.exe

C:\Windows\System\vylAYpw.exe

C:\Windows\System\vylAYpw.exe

C:\Windows\System\eccCrvh.exe

C:\Windows\System\eccCrvh.exe

C:\Windows\System\XhvugAP.exe

C:\Windows\System\XhvugAP.exe

C:\Windows\System\TtYAnIZ.exe

C:\Windows\System\TtYAnIZ.exe

C:\Windows\System\OmlIRTM.exe

C:\Windows\System\OmlIRTM.exe

C:\Windows\System\QVZkpPu.exe

C:\Windows\System\QVZkpPu.exe

C:\Windows\System\ZmgxmFU.exe

C:\Windows\System\ZmgxmFU.exe

C:\Windows\System\vqPswmp.exe

C:\Windows\System\vqPswmp.exe

C:\Windows\System\QNnEGiN.exe

C:\Windows\System\QNnEGiN.exe

C:\Windows\System\OJprXBy.exe

C:\Windows\System\OJprXBy.exe

C:\Windows\System\IWgSZDs.exe

C:\Windows\System\IWgSZDs.exe

C:\Windows\System\fdUDmQZ.exe

C:\Windows\System\fdUDmQZ.exe

C:\Windows\System\kCOmOsB.exe

C:\Windows\System\kCOmOsB.exe

C:\Windows\System\jrSEvYl.exe

C:\Windows\System\jrSEvYl.exe

C:\Windows\System\YPnxhpM.exe

C:\Windows\System\YPnxhpM.exe

C:\Windows\System\RyKmYez.exe

C:\Windows\System\RyKmYez.exe

C:\Windows\System\wnebIZm.exe

C:\Windows\System\wnebIZm.exe

C:\Windows\System\kjUMJhI.exe

C:\Windows\System\kjUMJhI.exe

C:\Windows\System\zmQFmfE.exe

C:\Windows\System\zmQFmfE.exe

C:\Windows\System\PhycHeZ.exe

C:\Windows\System\PhycHeZ.exe

C:\Windows\System\WzXbzLo.exe

C:\Windows\System\WzXbzLo.exe

C:\Windows\System\oDfyiED.exe

C:\Windows\System\oDfyiED.exe

C:\Windows\System\KGtUPyW.exe

C:\Windows\System\KGtUPyW.exe

C:\Windows\System\qcLhOig.exe

C:\Windows\System\qcLhOig.exe

C:\Windows\System\vfwWTkD.exe

C:\Windows\System\vfwWTkD.exe

C:\Windows\System\SeovPsA.exe

C:\Windows\System\SeovPsA.exe

C:\Windows\System\BvmppTg.exe

C:\Windows\System\BvmppTg.exe

C:\Windows\System\jlqgFQj.exe

C:\Windows\System\jlqgFQj.exe

C:\Windows\System\YGaSyxx.exe

C:\Windows\System\YGaSyxx.exe

C:\Windows\System\GsxdFSP.exe

C:\Windows\System\GsxdFSP.exe

C:\Windows\System\IKIMhID.exe

C:\Windows\System\IKIMhID.exe

C:\Windows\System\nqiXOaf.exe

C:\Windows\System\nqiXOaf.exe

C:\Windows\System\srxqbEZ.exe

C:\Windows\System\srxqbEZ.exe

C:\Windows\System\rckYIqU.exe

C:\Windows\System\rckYIqU.exe

C:\Windows\System\PjaVKVf.exe

C:\Windows\System\PjaVKVf.exe

C:\Windows\System\xVsTzWZ.exe

C:\Windows\System\xVsTzWZ.exe

C:\Windows\System\gfjXVgP.exe

C:\Windows\System\gfjXVgP.exe

C:\Windows\System\AXmPxwF.exe

C:\Windows\System\AXmPxwF.exe

C:\Windows\System\eKKJfcj.exe

C:\Windows\System\eKKJfcj.exe

C:\Windows\System\UrCPxsF.exe

C:\Windows\System\UrCPxsF.exe

C:\Windows\System\OXQHPEJ.exe

C:\Windows\System\OXQHPEJ.exe

C:\Windows\System\lCSlttO.exe

C:\Windows\System\lCSlttO.exe

C:\Windows\System\OYKxprd.exe

C:\Windows\System\OYKxprd.exe

C:\Windows\System\sTHdycM.exe

C:\Windows\System\sTHdycM.exe

C:\Windows\System\WglbACc.exe

C:\Windows\System\WglbACc.exe

C:\Windows\System\DdEDscG.exe

C:\Windows\System\DdEDscG.exe

C:\Windows\System\pPbEUDm.exe

C:\Windows\System\pPbEUDm.exe

C:\Windows\System\oOWwLye.exe

C:\Windows\System\oOWwLye.exe

C:\Windows\System\AsQfklE.exe

C:\Windows\System\AsQfklE.exe

C:\Windows\System\MEyuyQE.exe

C:\Windows\System\MEyuyQE.exe

C:\Windows\System\rDZlxYe.exe

C:\Windows\System\rDZlxYe.exe

C:\Windows\System\FPafcGM.exe

C:\Windows\System\FPafcGM.exe

C:\Windows\System\iKTDzek.exe

C:\Windows\System\iKTDzek.exe

C:\Windows\System\bEdfGua.exe

C:\Windows\System\bEdfGua.exe

C:\Windows\System\StFuXXD.exe

C:\Windows\System\StFuXXD.exe

C:\Windows\System\izbLLHN.exe

C:\Windows\System\izbLLHN.exe

C:\Windows\System\mZQyeCy.exe

C:\Windows\System\mZQyeCy.exe

C:\Windows\System\JfacjkH.exe

C:\Windows\System\JfacjkH.exe

C:\Windows\System\QvSUUxi.exe

C:\Windows\System\QvSUUxi.exe

C:\Windows\System\wrNtXgp.exe

C:\Windows\System\wrNtXgp.exe

C:\Windows\System\HQnBXDN.exe

C:\Windows\System\HQnBXDN.exe

C:\Windows\System\UfvrRXz.exe

C:\Windows\System\UfvrRXz.exe

C:\Windows\System\FtEQNxE.exe

C:\Windows\System\FtEQNxE.exe

C:\Windows\System\AtvgVwJ.exe

C:\Windows\System\AtvgVwJ.exe

C:\Windows\System\HIzXjcf.exe

C:\Windows\System\HIzXjcf.exe

C:\Windows\System\TYsoAFV.exe

C:\Windows\System\TYsoAFV.exe

C:\Windows\System\gcKvTuf.exe

C:\Windows\System\gcKvTuf.exe

C:\Windows\System\oSQtxRk.exe

C:\Windows\System\oSQtxRk.exe

C:\Windows\System\lkMbQZw.exe

C:\Windows\System\lkMbQZw.exe

C:\Windows\System\hndcFRA.exe

C:\Windows\System\hndcFRA.exe

C:\Windows\System\BYayPcH.exe

C:\Windows\System\BYayPcH.exe

C:\Windows\System\NKoZgAX.exe

C:\Windows\System\NKoZgAX.exe

C:\Windows\System\KkXYXyp.exe

C:\Windows\System\KkXYXyp.exe

C:\Windows\System\cSfYNwU.exe

C:\Windows\System\cSfYNwU.exe

C:\Windows\System\HjScTUC.exe

C:\Windows\System\HjScTUC.exe

C:\Windows\System\ieXGyND.exe

C:\Windows\System\ieXGyND.exe

C:\Windows\System\lgaQETx.exe

C:\Windows\System\lgaQETx.exe

C:\Windows\System\PdumrJN.exe

C:\Windows\System\PdumrJN.exe

C:\Windows\System\zNpAWQw.exe

C:\Windows\System\zNpAWQw.exe

C:\Windows\System\DFYntss.exe

C:\Windows\System\DFYntss.exe

C:\Windows\System\tYGhXfO.exe

C:\Windows\System\tYGhXfO.exe

C:\Windows\System\ZyXFImq.exe

C:\Windows\System\ZyXFImq.exe

C:\Windows\System\jmuRKii.exe

C:\Windows\System\jmuRKii.exe

C:\Windows\System\BLkQVoz.exe

C:\Windows\System\BLkQVoz.exe

C:\Windows\System\bjVnKTA.exe

C:\Windows\System\bjVnKTA.exe

C:\Windows\System\wvTvQID.exe

C:\Windows\System\wvTvQID.exe

C:\Windows\System\sWFKEve.exe

C:\Windows\System\sWFKEve.exe

C:\Windows\System\MeFMRvy.exe

C:\Windows\System\MeFMRvy.exe

C:\Windows\System\NYQDvjr.exe

C:\Windows\System\NYQDvjr.exe

C:\Windows\System\NIENCqm.exe

C:\Windows\System\NIENCqm.exe

C:\Windows\System\vhnAtGv.exe

C:\Windows\System\vhnAtGv.exe

C:\Windows\System\sIUQOzM.exe

C:\Windows\System\sIUQOzM.exe

C:\Windows\System\WSwkwCY.exe

C:\Windows\System\WSwkwCY.exe

C:\Windows\System\wtLUSgs.exe

C:\Windows\System\wtLUSgs.exe

C:\Windows\System\iDmYcfA.exe

C:\Windows\System\iDmYcfA.exe

C:\Windows\System\LxmOsQp.exe

C:\Windows\System\LxmOsQp.exe

C:\Windows\System\diItgRz.exe

C:\Windows\System\diItgRz.exe

C:\Windows\System\EgcQGle.exe

C:\Windows\System\EgcQGle.exe

C:\Windows\System\rJtXcAA.exe

C:\Windows\System\rJtXcAA.exe

C:\Windows\System\DKRyGzB.exe

C:\Windows\System\DKRyGzB.exe

C:\Windows\System\tbJaTIW.exe

C:\Windows\System\tbJaTIW.exe

C:\Windows\System\eKJnDst.exe

C:\Windows\System\eKJnDst.exe

C:\Windows\System\gSDTXOa.exe

C:\Windows\System\gSDTXOa.exe

C:\Windows\System\BSrRVWA.exe

C:\Windows\System\BSrRVWA.exe

C:\Windows\System\ygXUssS.exe

C:\Windows\System\ygXUssS.exe

C:\Windows\System\FQypSzP.exe

C:\Windows\System\FQypSzP.exe

C:\Windows\System\jGhfRiZ.exe

C:\Windows\System\jGhfRiZ.exe

C:\Windows\System\tKxviDB.exe

C:\Windows\System\tKxviDB.exe

C:\Windows\System\rDRrUOV.exe

C:\Windows\System\rDRrUOV.exe

C:\Windows\System\qVsXsli.exe

C:\Windows\System\qVsXsli.exe

C:\Windows\System\sdOBKjr.exe

C:\Windows\System\sdOBKjr.exe

C:\Windows\System\DCiIiJm.exe

C:\Windows\System\DCiIiJm.exe

C:\Windows\System\XWNsVxD.exe

C:\Windows\System\XWNsVxD.exe

C:\Windows\System\hfqsKfc.exe

C:\Windows\System\hfqsKfc.exe

C:\Windows\System\miWmhLc.exe

C:\Windows\System\miWmhLc.exe

C:\Windows\System\AYAbCAQ.exe

C:\Windows\System\AYAbCAQ.exe

C:\Windows\System\NAoIZdE.exe

C:\Windows\System\NAoIZdE.exe

C:\Windows\System\EZPfmrt.exe

C:\Windows\System\EZPfmrt.exe

C:\Windows\System\avkRTfr.exe

C:\Windows\System\avkRTfr.exe

C:\Windows\System\ogVLWHH.exe

C:\Windows\System\ogVLWHH.exe

C:\Windows\System\vxEhKVC.exe

C:\Windows\System\vxEhKVC.exe

C:\Windows\System\bPQuhhR.exe

C:\Windows\System\bPQuhhR.exe

C:\Windows\System\XmpGyiM.exe

C:\Windows\System\XmpGyiM.exe

C:\Windows\System\rQWNXua.exe

C:\Windows\System\rQWNXua.exe

C:\Windows\System\xrdmzkq.exe

C:\Windows\System\xrdmzkq.exe

C:\Windows\System\iHZfDBN.exe

C:\Windows\System\iHZfDBN.exe

C:\Windows\System\XWXzFQD.exe

C:\Windows\System\XWXzFQD.exe

C:\Windows\System\QZEroMC.exe

C:\Windows\System\QZEroMC.exe

C:\Windows\System\OwBdVWU.exe

C:\Windows\System\OwBdVWU.exe

C:\Windows\System\JchbPdd.exe

C:\Windows\System\JchbPdd.exe

C:\Windows\System\rxFmudZ.exe

C:\Windows\System\rxFmudZ.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5384 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8

C:\Windows\System\iWNaRXZ.exe

C:\Windows\System\iWNaRXZ.exe

C:\Windows\System\stlHZkr.exe

C:\Windows\System\stlHZkr.exe

C:\Windows\System\kjRjJGn.exe

C:\Windows\System\kjRjJGn.exe

C:\Windows\System\NqBguBi.exe

C:\Windows\System\NqBguBi.exe

C:\Windows\System\pjNtYev.exe

C:\Windows\System\pjNtYev.exe

C:\Windows\System\dIeHMJD.exe

C:\Windows\System\dIeHMJD.exe

C:\Windows\System\qmRhlFE.exe

C:\Windows\System\qmRhlFE.exe

C:\Windows\System\EBiRBdd.exe

C:\Windows\System\EBiRBdd.exe

C:\Windows\System\RbElBHf.exe

C:\Windows\System\RbElBHf.exe

C:\Windows\System\nvHflEP.exe

C:\Windows\System\nvHflEP.exe

C:\Windows\System\RrVzLyy.exe

C:\Windows\System\RrVzLyy.exe

C:\Windows\System\SDZrWNP.exe

C:\Windows\System\SDZrWNP.exe

C:\Windows\System\HKoWuSL.exe

C:\Windows\System\HKoWuSL.exe

C:\Windows\System\VbVNBmP.exe

C:\Windows\System\VbVNBmP.exe

C:\Windows\System\eFzShCj.exe

C:\Windows\System\eFzShCj.exe

C:\Windows\System\lbDQhqM.exe

C:\Windows\System\lbDQhqM.exe

C:\Windows\System\YsTmUDd.exe

C:\Windows\System\YsTmUDd.exe

C:\Windows\System\tCwkogo.exe

C:\Windows\System\tCwkogo.exe

C:\Windows\System\nkyqSoQ.exe

C:\Windows\System\nkyqSoQ.exe

C:\Windows\System\COCFoyq.exe

C:\Windows\System\COCFoyq.exe

C:\Windows\System\tFnNkjY.exe

C:\Windows\System\tFnNkjY.exe

C:\Windows\System\EHonDxw.exe

C:\Windows\System\EHonDxw.exe

C:\Windows\System\djNjnBE.exe

C:\Windows\System\djNjnBE.exe

C:\Windows\System\gBXxpQx.exe

C:\Windows\System\gBXxpQx.exe

C:\Windows\System\JDLEZwx.exe

C:\Windows\System\JDLEZwx.exe

C:\Windows\System\cNKbkoL.exe

C:\Windows\System\cNKbkoL.exe

C:\Windows\System\ZpFcDdD.exe

C:\Windows\System\ZpFcDdD.exe

C:\Windows\System\sIllJDJ.exe

C:\Windows\System\sIllJDJ.exe

C:\Windows\System\dNQopxg.exe

C:\Windows\System\dNQopxg.exe

C:\Windows\System\Ziwmwxf.exe

C:\Windows\System\Ziwmwxf.exe

C:\Windows\System\ufxhuSP.exe

C:\Windows\System\ufxhuSP.exe

C:\Windows\System\JwPILyi.exe

C:\Windows\System\JwPILyi.exe

C:\Windows\System\RuDOGuo.exe

C:\Windows\System\RuDOGuo.exe

C:\Windows\System\iGZKkmB.exe

C:\Windows\System\iGZKkmB.exe

C:\Windows\System\ebSwVzf.exe

C:\Windows\System\ebSwVzf.exe

C:\Windows\System\nWQNJdA.exe

C:\Windows\System\nWQNJdA.exe

C:\Windows\System\wNrapno.exe

C:\Windows\System\wNrapno.exe

C:\Windows\System\xMGwxfU.exe

C:\Windows\System\xMGwxfU.exe

C:\Windows\System\pKQfhXT.exe

C:\Windows\System\pKQfhXT.exe

C:\Windows\System\FRHLNkq.exe

C:\Windows\System\FRHLNkq.exe

C:\Windows\System\aRIHXZl.exe

C:\Windows\System\aRIHXZl.exe

C:\Windows\System\oJXceIy.exe

C:\Windows\System\oJXceIy.exe

C:\Windows\System\gLyZAdw.exe

C:\Windows\System\gLyZAdw.exe

C:\Windows\System\LnyWKZb.exe

C:\Windows\System\LnyWKZb.exe

C:\Windows\System\MMYDtho.exe

C:\Windows\System\MMYDtho.exe

C:\Windows\System\AOesRJn.exe

C:\Windows\System\AOesRJn.exe

C:\Windows\System\qxfYsXr.exe

C:\Windows\System\qxfYsXr.exe

C:\Windows\System\TqDjMKf.exe

C:\Windows\System\TqDjMKf.exe

C:\Windows\System\eqQmWMn.exe

C:\Windows\System\eqQmWMn.exe

C:\Windows\System\FxlZqJn.exe

C:\Windows\System\FxlZqJn.exe

C:\Windows\System\QfMxWpt.exe

C:\Windows\System\QfMxWpt.exe

C:\Windows\System\GEgEKlK.exe

C:\Windows\System\GEgEKlK.exe

C:\Windows\System\EeSuZzS.exe

C:\Windows\System\EeSuZzS.exe

C:\Windows\System\CHfyyon.exe

C:\Windows\System\CHfyyon.exe

C:\Windows\System\tHslQXe.exe

C:\Windows\System\tHslQXe.exe

C:\Windows\System\JTfrAWY.exe

C:\Windows\System\JTfrAWY.exe

C:\Windows\System\eNHhttL.exe

C:\Windows\System\eNHhttL.exe

C:\Windows\System\AmMzkLW.exe

C:\Windows\System\AmMzkLW.exe

C:\Windows\System\yeeBcKQ.exe

C:\Windows\System\yeeBcKQ.exe

C:\Windows\System\xKPLfZd.exe

C:\Windows\System\xKPLfZd.exe

C:\Windows\System\TiEtHDL.exe

C:\Windows\System\TiEtHDL.exe

C:\Windows\System\eRVaosm.exe

C:\Windows\System\eRVaosm.exe

C:\Windows\System\Ebfjwrf.exe

C:\Windows\System\Ebfjwrf.exe

C:\Windows\System\dfqwkjX.exe

C:\Windows\System\dfqwkjX.exe

C:\Windows\System\onYYLqG.exe

C:\Windows\System\onYYLqG.exe

C:\Windows\System\rOjHYIJ.exe

C:\Windows\System\rOjHYIJ.exe

C:\Windows\System\MJzQGLp.exe

C:\Windows\System\MJzQGLp.exe

C:\Windows\System\zzYCJvn.exe

C:\Windows\System\zzYCJvn.exe

C:\Windows\System\OEXAFWV.exe

C:\Windows\System\OEXAFWV.exe

C:\Windows\System\Gkpsohg.exe

C:\Windows\System\Gkpsohg.exe

C:\Windows\System\dhQjTOA.exe

C:\Windows\System\dhQjTOA.exe

C:\Windows\System\lArAUyp.exe

C:\Windows\System\lArAUyp.exe

C:\Windows\System\VzycYIK.exe

C:\Windows\System\VzycYIK.exe

C:\Windows\System\PVNsPxL.exe

C:\Windows\System\PVNsPxL.exe

C:\Windows\System\BysjyQZ.exe

C:\Windows\System\BysjyQZ.exe

C:\Windows\System\IiYbuKA.exe

C:\Windows\System\IiYbuKA.exe

C:\Windows\System\uQIKTQZ.exe

C:\Windows\System\uQIKTQZ.exe

C:\Windows\System\zfTyFGa.exe

C:\Windows\System\zfTyFGa.exe

C:\Windows\System\TkssezG.exe

C:\Windows\System\TkssezG.exe

C:\Windows\System\JPWOgeP.exe

C:\Windows\System\JPWOgeP.exe

C:\Windows\System\VqpbcMO.exe

C:\Windows\System\VqpbcMO.exe

C:\Windows\System\IJXCMam.exe

C:\Windows\System\IJXCMam.exe

C:\Windows\System\Vubtzrk.exe

C:\Windows\System\Vubtzrk.exe

C:\Windows\System\FXeNIrJ.exe

C:\Windows\System\FXeNIrJ.exe

C:\Windows\System\OMwAcFk.exe

C:\Windows\System\OMwAcFk.exe

C:\Windows\System\Mpsoddm.exe

C:\Windows\System\Mpsoddm.exe

C:\Windows\System\sbqwvdj.exe

C:\Windows\System\sbqwvdj.exe

C:\Windows\System\gzYlyFS.exe

C:\Windows\System\gzYlyFS.exe

C:\Windows\System\GyMUsNx.exe

C:\Windows\System\GyMUsNx.exe

C:\Windows\System\hNcuObg.exe

C:\Windows\System\hNcuObg.exe

C:\Windows\System\dJsxMOe.exe

C:\Windows\System\dJsxMOe.exe

C:\Windows\System\ASCzbAp.exe

C:\Windows\System\ASCzbAp.exe

C:\Windows\System\LxdZpou.exe

C:\Windows\System\LxdZpou.exe

C:\Windows\System\TgJIXPg.exe

C:\Windows\System\TgJIXPg.exe

C:\Windows\System\mVtZqyZ.exe

C:\Windows\System\mVtZqyZ.exe

C:\Windows\System\JnELcmG.exe

C:\Windows\System\JnELcmG.exe

C:\Windows\System\veKKjhW.exe

C:\Windows\System\veKKjhW.exe

C:\Windows\System\VDqIAfM.exe

C:\Windows\System\VDqIAfM.exe

C:\Windows\System\ThkCzIl.exe

C:\Windows\System\ThkCzIl.exe

C:\Windows\System\QTIinZU.exe

C:\Windows\System\QTIinZU.exe

C:\Windows\System\XYbwNhE.exe

C:\Windows\System\XYbwNhE.exe

C:\Windows\System\KsQkLTb.exe

C:\Windows\System\KsQkLTb.exe

C:\Windows\System\BecgWtz.exe

C:\Windows\System\BecgWtz.exe

C:\Windows\System\bqzlVQR.exe

C:\Windows\System\bqzlVQR.exe

C:\Windows\System\qhrqdrF.exe

C:\Windows\System\qhrqdrF.exe

C:\Windows\System\CmLoLPm.exe

C:\Windows\System\CmLoLPm.exe

C:\Windows\System\qPsRJNI.exe

C:\Windows\System\qPsRJNI.exe

C:\Windows\System\RoPFTZn.exe

C:\Windows\System\RoPFTZn.exe

C:\Windows\System\MlzkjoH.exe

C:\Windows\System\MlzkjoH.exe

C:\Windows\System\GoGzQdh.exe

C:\Windows\System\GoGzQdh.exe

C:\Windows\System\OGEvbeT.exe

C:\Windows\System\OGEvbeT.exe

C:\Windows\System\dvcgWNE.exe

C:\Windows\System\dvcgWNE.exe

C:\Windows\System\lLqAxUY.exe

C:\Windows\System\lLqAxUY.exe

C:\Windows\System\gqocSqQ.exe

C:\Windows\System\gqocSqQ.exe

C:\Windows\System\WKSDcDW.exe

C:\Windows\System\WKSDcDW.exe

C:\Windows\System\TlOebCf.exe

C:\Windows\System\TlOebCf.exe

C:\Windows\System\GIxkzgE.exe

C:\Windows\System\GIxkzgE.exe

C:\Windows\System\EJOmAID.exe

C:\Windows\System\EJOmAID.exe

C:\Windows\System\oWJOuJM.exe

C:\Windows\System\oWJOuJM.exe

C:\Windows\System\zBJOPGL.exe

C:\Windows\System\zBJOPGL.exe

C:\Windows\System\wkWmugY.exe

C:\Windows\System\wkWmugY.exe

C:\Windows\System\eQSIUPU.exe

C:\Windows\System\eQSIUPU.exe

C:\Windows\System\Gclcihm.exe

C:\Windows\System\Gclcihm.exe

C:\Windows\System\bskjNMg.exe

C:\Windows\System\bskjNMg.exe

C:\Windows\System\hrKroMy.exe

C:\Windows\System\hrKroMy.exe

C:\Windows\System\mkoWLQV.exe

C:\Windows\System\mkoWLQV.exe

C:\Windows\System\GxnpJQl.exe

C:\Windows\System\GxnpJQl.exe

C:\Windows\System\WWEjrTA.exe

C:\Windows\System\WWEjrTA.exe

C:\Windows\System\aczWFLU.exe

C:\Windows\System\aczWFLU.exe

C:\Windows\System\mDUERss.exe

C:\Windows\System\mDUERss.exe

C:\Windows\System\YzMucaW.exe

C:\Windows\System\YzMucaW.exe

C:\Windows\System\HLAUJNb.exe

C:\Windows\System\HLAUJNb.exe

C:\Windows\System\MqzDUPl.exe

C:\Windows\System\MqzDUPl.exe

C:\Windows\System\TTfUWeE.exe

C:\Windows\System\TTfUWeE.exe

C:\Windows\System\woWbpmz.exe

C:\Windows\System\woWbpmz.exe

C:\Windows\System\cYQMHMo.exe

C:\Windows\System\cYQMHMo.exe

C:\Windows\System\gugjCMB.exe

C:\Windows\System\gugjCMB.exe

C:\Windows\System\CznOkft.exe

C:\Windows\System\CznOkft.exe

C:\Windows\System\aaLLBXs.exe

C:\Windows\System\aaLLBXs.exe

C:\Windows\System\aQzttlF.exe

C:\Windows\System\aQzttlF.exe

C:\Windows\System\xwcjjgp.exe

C:\Windows\System\xwcjjgp.exe

C:\Windows\System\dOJvLFZ.exe

C:\Windows\System\dOJvLFZ.exe

C:\Windows\System\iFvEclU.exe

C:\Windows\System\iFvEclU.exe

C:\Windows\System\dXOVIxr.exe

C:\Windows\System\dXOVIxr.exe

C:\Windows\System\lmDVsIO.exe

C:\Windows\System\lmDVsIO.exe

C:\Windows\System\KppYTIy.exe

C:\Windows\System\KppYTIy.exe

C:\Windows\System\hFjtgaM.exe

C:\Windows\System\hFjtgaM.exe

C:\Windows\System\CnvSaQt.exe

C:\Windows\System\CnvSaQt.exe

C:\Windows\System\HYAvuNX.exe

C:\Windows\System\HYAvuNX.exe

C:\Windows\System\BniAXWo.exe

C:\Windows\System\BniAXWo.exe

C:\Windows\System\IWkfIEk.exe

C:\Windows\System\IWkfIEk.exe

C:\Windows\System\vWvrhNi.exe

C:\Windows\System\vWvrhNi.exe

C:\Windows\System\qkfmdqi.exe

C:\Windows\System\qkfmdqi.exe

C:\Windows\System\EZLbIHI.exe

C:\Windows\System\EZLbIHI.exe

C:\Windows\System\fiscVnb.exe

C:\Windows\System\fiscVnb.exe

C:\Windows\System\hDavGKs.exe

C:\Windows\System\hDavGKs.exe

C:\Windows\System\gnrxhJL.exe

C:\Windows\System\gnrxhJL.exe

C:\Windows\System\OOHsZDe.exe

C:\Windows\System\OOHsZDe.exe

C:\Windows\System\LDNxPkR.exe

C:\Windows\System\LDNxPkR.exe

C:\Windows\System\ArbxYFI.exe

C:\Windows\System\ArbxYFI.exe

C:\Windows\System\QxsArEI.exe

C:\Windows\System\QxsArEI.exe

C:\Windows\System\oLZcPWz.exe

C:\Windows\System\oLZcPWz.exe

C:\Windows\System\ITvQQwT.exe

C:\Windows\System\ITvQQwT.exe

C:\Windows\System\lHeoQio.exe

C:\Windows\System\lHeoQio.exe

C:\Windows\System\zDfxfFi.exe

C:\Windows\System\zDfxfFi.exe

C:\Windows\System\VxPSNcv.exe

C:\Windows\System\VxPSNcv.exe

C:\Windows\System\wDobCEY.exe

C:\Windows\System\wDobCEY.exe

C:\Windows\System\EEbHdTy.exe

C:\Windows\System\EEbHdTy.exe

C:\Windows\System\WBwKnXL.exe

C:\Windows\System\WBwKnXL.exe

C:\Windows\System\NZMJNvr.exe

C:\Windows\System\NZMJNvr.exe

C:\Windows\System\XDeffsV.exe

C:\Windows\System\XDeffsV.exe

C:\Windows\System\AfSxnaX.exe

C:\Windows\System\AfSxnaX.exe

C:\Windows\System\aNkSmTA.exe

C:\Windows\System\aNkSmTA.exe

C:\Windows\System\rIlZbSK.exe

C:\Windows\System\rIlZbSK.exe

C:\Windows\System\AXZLWPG.exe

C:\Windows\System\AXZLWPG.exe

C:\Windows\System\NSMuqKC.exe

C:\Windows\System\NSMuqKC.exe

C:\Windows\System\KBClKHf.exe

C:\Windows\System\KBClKHf.exe

C:\Windows\System\pUnyrVR.exe

C:\Windows\System\pUnyrVR.exe

C:\Windows\System\qmSEnlj.exe

C:\Windows\System\qmSEnlj.exe

C:\Windows\System\MBFkLsi.exe

C:\Windows\System\MBFkLsi.exe

C:\Windows\System\IjzcNNr.exe

C:\Windows\System\IjzcNNr.exe

C:\Windows\System\iWvYjSY.exe

C:\Windows\System\iWvYjSY.exe

C:\Windows\System\SUYjaLo.exe

C:\Windows\System\SUYjaLo.exe

C:\Windows\System\OknGoKl.exe

C:\Windows\System\OknGoKl.exe

C:\Windows\System\egyomde.exe

C:\Windows\System\egyomde.exe

C:\Windows\System\HzMXbrC.exe

C:\Windows\System\HzMXbrC.exe

C:\Windows\System\gQuvBiy.exe

C:\Windows\System\gQuvBiy.exe

C:\Windows\System\KhLaQiZ.exe

C:\Windows\System\KhLaQiZ.exe

C:\Windows\System\JSldyUI.exe

C:\Windows\System\JSldyUI.exe

C:\Windows\System\RQyrnEd.exe

C:\Windows\System\RQyrnEd.exe

C:\Windows\System\sVLLleC.exe

C:\Windows\System\sVLLleC.exe

C:\Windows\System\XTDdnfZ.exe

C:\Windows\System\XTDdnfZ.exe

C:\Windows\System\kHnlaaT.exe

C:\Windows\System\kHnlaaT.exe

C:\Windows\System\eUpbfJB.exe

C:\Windows\System\eUpbfJB.exe

C:\Windows\System\piVRcfn.exe

C:\Windows\System\piVRcfn.exe

C:\Windows\System\IAlxnhX.exe

C:\Windows\System\IAlxnhX.exe

C:\Windows\System\aajsuxG.exe

C:\Windows\System\aajsuxG.exe

C:\Windows\System\hXGfZAX.exe

C:\Windows\System\hXGfZAX.exe

C:\Windows\System\pphWePh.exe

C:\Windows\System\pphWePh.exe

C:\Windows\System\kuKWZEO.exe

C:\Windows\System\kuKWZEO.exe

C:\Windows\System\OymtYAq.exe

C:\Windows\System\OymtYAq.exe

C:\Windows\System\DqUbfmH.exe

C:\Windows\System\DqUbfmH.exe

C:\Windows\System\URagwca.exe

C:\Windows\System\URagwca.exe

C:\Windows\System\pKXsuin.exe

C:\Windows\System\pKXsuin.exe

C:\Windows\System\ZlqoFLM.exe

C:\Windows\System\ZlqoFLM.exe

C:\Windows\System\ydKFueC.exe

C:\Windows\System\ydKFueC.exe

C:\Windows\System\QkSgZdN.exe

C:\Windows\System\QkSgZdN.exe

C:\Windows\System\gIvFqhA.exe

C:\Windows\System\gIvFqhA.exe

C:\Windows\System\tUeqlVC.exe

C:\Windows\System\tUeqlVC.exe

C:\Windows\System\ClWtaNB.exe

C:\Windows\System\ClWtaNB.exe

C:\Windows\System\mvNNjKU.exe

C:\Windows\System\mvNNjKU.exe

C:\Windows\System\OPfBeQa.exe

C:\Windows\System\OPfBeQa.exe

C:\Windows\System\vvNWUTg.exe

C:\Windows\System\vvNWUTg.exe

C:\Windows\System\EfKuuwP.exe

C:\Windows\System\EfKuuwP.exe

C:\Windows\System\XVjlQUs.exe

C:\Windows\System\XVjlQUs.exe

C:\Windows\System\nWBLGUs.exe

C:\Windows\System\nWBLGUs.exe

C:\Windows\System\PfdqNxZ.exe

C:\Windows\System\PfdqNxZ.exe

C:\Windows\System\XOJOYFY.exe

C:\Windows\System\XOJOYFY.exe

C:\Windows\System\MurCeVb.exe

C:\Windows\System\MurCeVb.exe

C:\Windows\System\Qsapprd.exe

C:\Windows\System\Qsapprd.exe

C:\Windows\System\vwXJwVj.exe

C:\Windows\System\vwXJwVj.exe

C:\Windows\System\noJjcTi.exe

C:\Windows\System\noJjcTi.exe

C:\Windows\System\DTumMeH.exe

C:\Windows\System\DTumMeH.exe

C:\Windows\System\EzuEfli.exe

C:\Windows\System\EzuEfli.exe

C:\Windows\System\dvkvbhT.exe

C:\Windows\System\dvkvbhT.exe

C:\Windows\System\ZwzQuEy.exe

C:\Windows\System\ZwzQuEy.exe

C:\Windows\System\vhcIxts.exe

C:\Windows\System\vhcIxts.exe

C:\Windows\System\GQDDDfZ.exe

C:\Windows\System\GQDDDfZ.exe

C:\Windows\System\mMXAMZV.exe

C:\Windows\System\mMXAMZV.exe

C:\Windows\System\kObAGIU.exe

C:\Windows\System\kObAGIU.exe

C:\Windows\System\lmcMxGY.exe

C:\Windows\System\lmcMxGY.exe

C:\Windows\System\ndEWfLN.exe

C:\Windows\System\ndEWfLN.exe

C:\Windows\System\rVjuabC.exe

C:\Windows\System\rVjuabC.exe

C:\Windows\System\cyLXjBS.exe

C:\Windows\System\cyLXjBS.exe

C:\Windows\System\iSuXAqm.exe

C:\Windows\System\iSuXAqm.exe

C:\Windows\System\tPIkaeQ.exe

C:\Windows\System\tPIkaeQ.exe

C:\Windows\System\SEBAsWD.exe

C:\Windows\System\SEBAsWD.exe

C:\Windows\System\ruaQejb.exe

C:\Windows\System\ruaQejb.exe

C:\Windows\System\IMvruij.exe

C:\Windows\System\IMvruij.exe

C:\Windows\System\NEiWiXy.exe

C:\Windows\System\NEiWiXy.exe

C:\Windows\System\MtAyebj.exe

C:\Windows\System\MtAyebj.exe

C:\Windows\System\sIAxDjR.exe

C:\Windows\System\sIAxDjR.exe

C:\Windows\System\WSDqGIA.exe

C:\Windows\System\WSDqGIA.exe

C:\Windows\System\tVduLBx.exe

C:\Windows\System\tVduLBx.exe

C:\Windows\System\wDmDRpW.exe

C:\Windows\System\wDmDRpW.exe

C:\Windows\System\jrZtgpp.exe

C:\Windows\System\jrZtgpp.exe

C:\Windows\System\OrnDSwF.exe

C:\Windows\System\OrnDSwF.exe

C:\Windows\System\OgJXlmc.exe

C:\Windows\System\OgJXlmc.exe

C:\Windows\System\jPcaStK.exe

C:\Windows\System\jPcaStK.exe

C:\Windows\System\kpJuaDu.exe

C:\Windows\System\kpJuaDu.exe

C:\Windows\System\nRKUQKR.exe

C:\Windows\System\nRKUQKR.exe

C:\Windows\System\sACseiJ.exe

C:\Windows\System\sACseiJ.exe

C:\Windows\System\DWlCtos.exe

C:\Windows\System\DWlCtos.exe

C:\Windows\System\VposmsB.exe

C:\Windows\System\VposmsB.exe

C:\Windows\System\fXrwGDU.exe

C:\Windows\System\fXrwGDU.exe

C:\Windows\System\QAXbnIZ.exe

C:\Windows\System\QAXbnIZ.exe

C:\Windows\System\yztRZea.exe

C:\Windows\System\yztRZea.exe

C:\Windows\System\nkIBjQp.exe

C:\Windows\System\nkIBjQp.exe

C:\Windows\System\kLBuZnJ.exe

C:\Windows\System\kLBuZnJ.exe

C:\Windows\System\eFLznHp.exe

C:\Windows\System\eFLznHp.exe

C:\Windows\System\OwhzRPE.exe

C:\Windows\System\OwhzRPE.exe

C:\Windows\System\tmvNsJa.exe

C:\Windows\System\tmvNsJa.exe

C:\Windows\System\VwCSmZq.exe

C:\Windows\System\VwCSmZq.exe

C:\Windows\System\mWybzAb.exe

C:\Windows\System\mWybzAb.exe

C:\Windows\System\zeuEwZq.exe

C:\Windows\System\zeuEwZq.exe

C:\Windows\System\ocpdNbN.exe

C:\Windows\System\ocpdNbN.exe

C:\Windows\System\xCMcngB.exe

C:\Windows\System\xCMcngB.exe

C:\Windows\System\UDofYlg.exe

C:\Windows\System\UDofYlg.exe

C:\Windows\System\obbPbdH.exe

C:\Windows\System\obbPbdH.exe

C:\Windows\System\drvKavs.exe

C:\Windows\System\drvKavs.exe

C:\Windows\System\TPbwMKy.exe

C:\Windows\System\TPbwMKy.exe

C:\Windows\System\enixxoa.exe

C:\Windows\System\enixxoa.exe

C:\Windows\System\pdCjNYS.exe

C:\Windows\System\pdCjNYS.exe

C:\Windows\System\phQCMHm.exe

C:\Windows\System\phQCMHm.exe

C:\Windows\System\NjKjHNG.exe

C:\Windows\System\NjKjHNG.exe

C:\Windows\System\jbkxUCX.exe

C:\Windows\System\jbkxUCX.exe

C:\Windows\System\AEhHbpS.exe

C:\Windows\System\AEhHbpS.exe

C:\Windows\System\OxZmlCH.exe

C:\Windows\System\OxZmlCH.exe

C:\Windows\System\HzTnBCf.exe

C:\Windows\System\HzTnBCf.exe

C:\Windows\System\KNmSYTM.exe

C:\Windows\System\KNmSYTM.exe

C:\Windows\System\nqUCatD.exe

C:\Windows\System\nqUCatD.exe

C:\Windows\System\yexGTcz.exe

C:\Windows\System\yexGTcz.exe

C:\Windows\System\skwrncg.exe

C:\Windows\System\skwrncg.exe

C:\Windows\System\EBUAKqh.exe

C:\Windows\System\EBUAKqh.exe

C:\Windows\System\QqHkcVY.exe

C:\Windows\System\QqHkcVY.exe

C:\Windows\System\fEPumzb.exe

C:\Windows\System\fEPumzb.exe

C:\Windows\System\MQhDPVk.exe

C:\Windows\System\MQhDPVk.exe

C:\Windows\System\nyfupMV.exe

C:\Windows\System\nyfupMV.exe

C:\Windows\System\hswYOEp.exe

C:\Windows\System\hswYOEp.exe

C:\Windows\System\ttgjHVI.exe

C:\Windows\System\ttgjHVI.exe

C:\Windows\System\WUlRwzT.exe

C:\Windows\System\WUlRwzT.exe

C:\Windows\System\ZEGtsIt.exe

C:\Windows\System\ZEGtsIt.exe

C:\Windows\System\fPtoxof.exe

C:\Windows\System\fPtoxof.exe

C:\Windows\System\pdriwKx.exe

C:\Windows\System\pdriwKx.exe

C:\Windows\System\GzBJsEl.exe

C:\Windows\System\GzBJsEl.exe

C:\Windows\System\SoqTWhn.exe

C:\Windows\System\SoqTWhn.exe

C:\Windows\System\YfIYnAa.exe

C:\Windows\System\YfIYnAa.exe

C:\Windows\System\toOzgru.exe

C:\Windows\System\toOzgru.exe

C:\Windows\System\kzYcZfc.exe

C:\Windows\System\kzYcZfc.exe

C:\Windows\System\eSEFmpj.exe

C:\Windows\System\eSEFmpj.exe

C:\Windows\System\WIERovy.exe

C:\Windows\System\WIERovy.exe

C:\Windows\System\QManLyw.exe

C:\Windows\System\QManLyw.exe

C:\Windows\System\zyUjGqk.exe

C:\Windows\System\zyUjGqk.exe

C:\Windows\System\aJisblg.exe

C:\Windows\System\aJisblg.exe

C:\Windows\System\SvwJqzX.exe

C:\Windows\System\SvwJqzX.exe

C:\Windows\System\hhxMNOu.exe

C:\Windows\System\hhxMNOu.exe

C:\Windows\System\EftjVXK.exe

C:\Windows\System\EftjVXK.exe

C:\Windows\System\LwgKInJ.exe

C:\Windows\System\LwgKInJ.exe

C:\Windows\System\OJSDGZN.exe

C:\Windows\System\OJSDGZN.exe

C:\Windows\System\IXAyYtA.exe

C:\Windows\System\IXAyYtA.exe

C:\Windows\System\fLSduhR.exe

C:\Windows\System\fLSduhR.exe

C:\Windows\System\fabgjnr.exe

C:\Windows\System\fabgjnr.exe

C:\Windows\System\Uneigit.exe

C:\Windows\System\Uneigit.exe

C:\Windows\System\GvfdSJs.exe

C:\Windows\System\GvfdSJs.exe

C:\Windows\System\fyeXiMX.exe

C:\Windows\System\fyeXiMX.exe

C:\Windows\System\kTmcvqI.exe

C:\Windows\System\kTmcvqI.exe

C:\Windows\System\kNXVrFX.exe

C:\Windows\System\kNXVrFX.exe

C:\Windows\System\xrPhuOx.exe

C:\Windows\System\xrPhuOx.exe

C:\Windows\System\RYGNgVO.exe

C:\Windows\System\RYGNgVO.exe

C:\Windows\System\deZDmLC.exe

C:\Windows\System\deZDmLC.exe

C:\Windows\System\ZeeFdlo.exe

C:\Windows\System\ZeeFdlo.exe

C:\Windows\System\sWUGxKW.exe

C:\Windows\System\sWUGxKW.exe

C:\Windows\System\mDeVJju.exe

C:\Windows\System\mDeVJju.exe

C:\Windows\System\DPKMPsi.exe

C:\Windows\System\DPKMPsi.exe

C:\Windows\System\ManeAEy.exe

C:\Windows\System\ManeAEy.exe

C:\Windows\System\WLveelG.exe

C:\Windows\System\WLveelG.exe

C:\Windows\System\DiJNSED.exe

C:\Windows\System\DiJNSED.exe

C:\Windows\System\YqXilAq.exe

C:\Windows\System\YqXilAq.exe

C:\Windows\System\nmKUKeM.exe

C:\Windows\System\nmKUKeM.exe

C:\Windows\System\rLJaeea.exe

C:\Windows\System\rLJaeea.exe

C:\Windows\System\ZnkjIUQ.exe

C:\Windows\System\ZnkjIUQ.exe

C:\Windows\System\EoxnsuF.exe

C:\Windows\System\EoxnsuF.exe

C:\Windows\System\uUVANXX.exe

C:\Windows\System\uUVANXX.exe

C:\Windows\System\layQTtW.exe

C:\Windows\System\layQTtW.exe

C:\Windows\System\ihNqXVH.exe

C:\Windows\System\ihNqXVH.exe

C:\Windows\System\dhEQwdA.exe

C:\Windows\System\dhEQwdA.exe

C:\Windows\System\HbabfgF.exe

C:\Windows\System\HbabfgF.exe

C:\Windows\System\zTeJvfe.exe

C:\Windows\System\zTeJvfe.exe

C:\Windows\System\mZBOHgO.exe

C:\Windows\System\mZBOHgO.exe

C:\Windows\System\UgxbvHq.exe

C:\Windows\System\UgxbvHq.exe

C:\Windows\System\wPydqCi.exe

C:\Windows\System\wPydqCi.exe

C:\Windows\System\SPjKrwk.exe

C:\Windows\System\SPjKrwk.exe

C:\Windows\System\jcIDxak.exe

C:\Windows\System\jcIDxak.exe

C:\Windows\System\FNkeNta.exe

C:\Windows\System\FNkeNta.exe

C:\Windows\System\AWppmrv.exe

C:\Windows\System\AWppmrv.exe

C:\Windows\System\iAXLOJE.exe

C:\Windows\System\iAXLOJE.exe

C:\Windows\System\avCjzOR.exe

C:\Windows\System\avCjzOR.exe

C:\Windows\System\JkHkYJS.exe

C:\Windows\System\JkHkYJS.exe

C:\Windows\System\qIrsAXR.exe

C:\Windows\System\qIrsAXR.exe

C:\Windows\System\uCNijtz.exe

C:\Windows\System\uCNijtz.exe

C:\Windows\System\txxtsZw.exe

C:\Windows\System\txxtsZw.exe

C:\Windows\System\ssSSkkg.exe

C:\Windows\System\ssSSkkg.exe

C:\Windows\System\MMEABiU.exe

C:\Windows\System\MMEABiU.exe

C:\Windows\System\EwURirX.exe

C:\Windows\System\EwURirX.exe

C:\Windows\System\aRmqNjk.exe

C:\Windows\System\aRmqNjk.exe

C:\Windows\System\OzfRUTn.exe

C:\Windows\System\OzfRUTn.exe

C:\Windows\System\gEVeKdQ.exe

C:\Windows\System\gEVeKdQ.exe

C:\Windows\System\pFSMQsA.exe

C:\Windows\System\pFSMQsA.exe

C:\Windows\System\PWzzOHB.exe

C:\Windows\System\PWzzOHB.exe

C:\Windows\System\JDVXNQa.exe

C:\Windows\System\JDVXNQa.exe

C:\Windows\System\bObfEHl.exe

C:\Windows\System\bObfEHl.exe

C:\Windows\System\NzXQtAb.exe

C:\Windows\System\NzXQtAb.exe

C:\Windows\System\LeVJdDt.exe

C:\Windows\System\LeVJdDt.exe

C:\Windows\System\wTGGvul.exe

C:\Windows\System\wTGGvul.exe

C:\Windows\System\rRmTsOk.exe

C:\Windows\System\rRmTsOk.exe

C:\Windows\System\urTxBFg.exe

C:\Windows\System\urTxBFg.exe

C:\Windows\System\hSySaAZ.exe

C:\Windows\System\hSySaAZ.exe

C:\Windows\System\XNwGBTT.exe

C:\Windows\System\XNwGBTT.exe

C:\Windows\System\nyEFYZi.exe

C:\Windows\System\nyEFYZi.exe

C:\Windows\System\vjxGMlM.exe

C:\Windows\System\vjxGMlM.exe

C:\Windows\System\lQrDfcT.exe

C:\Windows\System\lQrDfcT.exe

C:\Windows\System\VvuuisA.exe

C:\Windows\System\VvuuisA.exe

C:\Windows\System\KJZaGOy.exe

C:\Windows\System\KJZaGOy.exe

C:\Windows\System\pHPdsls.exe

C:\Windows\System\pHPdsls.exe

C:\Windows\System\RoHlCsO.exe

C:\Windows\System\RoHlCsO.exe

C:\Windows\System\bzzNqNl.exe

C:\Windows\System\bzzNqNl.exe

C:\Windows\System\bKXbfjr.exe

C:\Windows\System\bKXbfjr.exe

C:\Windows\System\IpByqja.exe

C:\Windows\System\IpByqja.exe

C:\Windows\System\taFuUYH.exe

C:\Windows\System\taFuUYH.exe

C:\Windows\System\DPQLOcj.exe

C:\Windows\System\DPQLOcj.exe

C:\Windows\System\gHIhAni.exe

C:\Windows\System\gHIhAni.exe

C:\Windows\System\ZGwRCEv.exe

C:\Windows\System\ZGwRCEv.exe

C:\Windows\System\QSKpqrg.exe

C:\Windows\System\QSKpqrg.exe

C:\Windows\System\gZZFkSD.exe

C:\Windows\System\gZZFkSD.exe

C:\Windows\System\sCskeyJ.exe

C:\Windows\System\sCskeyJ.exe

C:\Windows\System\tvnOYHb.exe

C:\Windows\System\tvnOYHb.exe

C:\Windows\System\ayLFjxK.exe

C:\Windows\System\ayLFjxK.exe

C:\Windows\System\gHaRgth.exe

C:\Windows\System\gHaRgth.exe

C:\Windows\System\TFEPbzn.exe

C:\Windows\System\TFEPbzn.exe

C:\Windows\System\UQEtVol.exe

C:\Windows\System\UQEtVol.exe

C:\Windows\System\wuVHyNj.exe

C:\Windows\System\wuVHyNj.exe

C:\Windows\System\CJwkGLi.exe

C:\Windows\System\CJwkGLi.exe

C:\Windows\System\joEnHlP.exe

C:\Windows\System\joEnHlP.exe

C:\Windows\System\VViRmWE.exe

C:\Windows\System\VViRmWE.exe

C:\Windows\System\CdXYcoc.exe

C:\Windows\System\CdXYcoc.exe

C:\Windows\System\aRAcZLC.exe

C:\Windows\System\aRAcZLC.exe

C:\Windows\System\owrxkOX.exe

C:\Windows\System\owrxkOX.exe

C:\Windows\System\vTLfrrH.exe

C:\Windows\System\vTLfrrH.exe

C:\Windows\System\xbIRxCJ.exe

C:\Windows\System\xbIRxCJ.exe

C:\Windows\System\pOUurAV.exe

C:\Windows\System\pOUurAV.exe

C:\Windows\System\rKkPhvq.exe

C:\Windows\System\rKkPhvq.exe

C:\Windows\System\lpRwjYT.exe

C:\Windows\System\lpRwjYT.exe

C:\Windows\System\XMfHLIH.exe

C:\Windows\System\XMfHLIH.exe

C:\Windows\System\ewKCaLW.exe

C:\Windows\System\ewKCaLW.exe

C:\Windows\System\gzDOGhL.exe

C:\Windows\System\gzDOGhL.exe

C:\Windows\System\JHwafYW.exe

C:\Windows\System\JHwafYW.exe

C:\Windows\System\NSQMOyB.exe

C:\Windows\System\NSQMOyB.exe

C:\Windows\System\fsUeyyh.exe

C:\Windows\System\fsUeyyh.exe

C:\Windows\System\crJkDGF.exe

C:\Windows\System\crJkDGF.exe

C:\Windows\System\uICHFSX.exe

C:\Windows\System\uICHFSX.exe

C:\Windows\System\CyCKWOP.exe

C:\Windows\System\CyCKWOP.exe

C:\Windows\System\XMDqvfn.exe

C:\Windows\System\XMDqvfn.exe

C:\Windows\System\hkQQzxJ.exe

C:\Windows\System\hkQQzxJ.exe

C:\Windows\System\qfOLcCd.exe

C:\Windows\System\qfOLcCd.exe

C:\Windows\System\KtlIwrH.exe

C:\Windows\System\KtlIwrH.exe

C:\Windows\System\XspiKRE.exe

C:\Windows\System\XspiKRE.exe

C:\Windows\System\mInjlAr.exe

C:\Windows\System\mInjlAr.exe

C:\Windows\System\ZKFuadT.exe

C:\Windows\System\ZKFuadT.exe

C:\Windows\System\XinwFrg.exe

C:\Windows\System\XinwFrg.exe

C:\Windows\System\wNWwbXK.exe

C:\Windows\System\wNWwbXK.exe

C:\Windows\System\zIQcOaY.exe

C:\Windows\System\zIQcOaY.exe

C:\Windows\System\zFAmPvF.exe

C:\Windows\System\zFAmPvF.exe

C:\Windows\System\EftejJN.exe

C:\Windows\System\EftejJN.exe

C:\Windows\System\AdycAtD.exe

C:\Windows\System\AdycAtD.exe

C:\Windows\System\cGwsXJR.exe

C:\Windows\System\cGwsXJR.exe

C:\Windows\System\FYtSwEG.exe

C:\Windows\System\FYtSwEG.exe

C:\Windows\System\rIdFoQn.exe

C:\Windows\System\rIdFoQn.exe

C:\Windows\System\MjjMYDA.exe

C:\Windows\System\MjjMYDA.exe

C:\Windows\System\nMEnmFi.exe

C:\Windows\System\nMEnmFi.exe

C:\Windows\System\lRKbKCx.exe

C:\Windows\System\lRKbKCx.exe

C:\Windows\System\KyCHnxZ.exe

C:\Windows\System\KyCHnxZ.exe

C:\Windows\System\iyrtJXw.exe

C:\Windows\System\iyrtJXw.exe

C:\Windows\System\KoKNOJp.exe

C:\Windows\System\KoKNOJp.exe

C:\Windows\System\JGrTdDM.exe

C:\Windows\System\JGrTdDM.exe

C:\Windows\System\gsVjtPJ.exe

C:\Windows\System\gsVjtPJ.exe

C:\Windows\System\MtCLSmY.exe

C:\Windows\System\MtCLSmY.exe

C:\Windows\System\SKlAPGD.exe

C:\Windows\System\SKlAPGD.exe

C:\Windows\System\DOdkYZi.exe

C:\Windows\System\DOdkYZi.exe

C:\Windows\System\WHdUMdm.exe

C:\Windows\System\WHdUMdm.exe

C:\Windows\System\mJHNNNx.exe

C:\Windows\System\mJHNNNx.exe

C:\Windows\System\bQCgCRa.exe

C:\Windows\System\bQCgCRa.exe

C:\Windows\System\GTsJrPz.exe

C:\Windows\System\GTsJrPz.exe

C:\Windows\System\Aoymzce.exe

C:\Windows\System\Aoymzce.exe

C:\Windows\System\zjkywKi.exe

C:\Windows\System\zjkywKi.exe

C:\Windows\System\dhWEatj.exe

C:\Windows\System\dhWEatj.exe

C:\Windows\System\FshFdDl.exe

C:\Windows\System\FshFdDl.exe

C:\Windows\System\HZyXJlp.exe

C:\Windows\System\HZyXJlp.exe

C:\Windows\System\reWjngP.exe

C:\Windows\System\reWjngP.exe

C:\Windows\System\iBcDmlL.exe

C:\Windows\System\iBcDmlL.exe

C:\Windows\System\KtmYoGq.exe

C:\Windows\System\KtmYoGq.exe

C:\Windows\System\wMbRIvH.exe

C:\Windows\System\wMbRIvH.exe

C:\Windows\System\HzRqRIs.exe

C:\Windows\System\HzRqRIs.exe

C:\Windows\System\pNaCXhO.exe

C:\Windows\System\pNaCXhO.exe

C:\Windows\System\BUfHAjs.exe

C:\Windows\System\BUfHAjs.exe

C:\Windows\System\EAYDzQa.exe

C:\Windows\System\EAYDzQa.exe

C:\Windows\System\XqtUEkQ.exe

C:\Windows\System\XqtUEkQ.exe

C:\Windows\System\VeIWgFj.exe

C:\Windows\System\VeIWgFj.exe

C:\Windows\System\rwFvgRM.exe

C:\Windows\System\rwFvgRM.exe

C:\Windows\System\GXnpHiw.exe

C:\Windows\System\GXnpHiw.exe

C:\Windows\System\klfayZX.exe

C:\Windows\System\klfayZX.exe

C:\Windows\System\flyIxou.exe

C:\Windows\System\flyIxou.exe

C:\Windows\System\TnKLais.exe

C:\Windows\System\TnKLais.exe

C:\Windows\System\wjYWdbW.exe

C:\Windows\System\wjYWdbW.exe

C:\Windows\System\AHmDcia.exe

C:\Windows\System\AHmDcia.exe

C:\Windows\System\lMTvibs.exe

C:\Windows\System\lMTvibs.exe

C:\Windows\System\KNRqFTv.exe

C:\Windows\System\KNRqFTv.exe

C:\Windows\System\zdICOxt.exe

C:\Windows\System\zdICOxt.exe

C:\Windows\System\ysxUkHj.exe

C:\Windows\System\ysxUkHj.exe

C:\Windows\System\rtVsAXn.exe

C:\Windows\System\rtVsAXn.exe

C:\Windows\System\iZPRLVu.exe

C:\Windows\System\iZPRLVu.exe

C:\Windows\System\mCgMptt.exe

C:\Windows\System\mCgMptt.exe

C:\Windows\System\UxExxuX.exe

C:\Windows\System\UxExxuX.exe

C:\Windows\System\pqczALJ.exe

C:\Windows\System\pqczALJ.exe

C:\Windows\System\CRJxJiN.exe

C:\Windows\System\CRJxJiN.exe

C:\Windows\System\MMEOEXl.exe

C:\Windows\System\MMEOEXl.exe

C:\Windows\System\GPstsCU.exe

C:\Windows\System\GPstsCU.exe

C:\Windows\System\zKCRQaX.exe

C:\Windows\System\zKCRQaX.exe

C:\Windows\System\ryNZBzD.exe

C:\Windows\System\ryNZBzD.exe

C:\Windows\System\HjadCAi.exe

C:\Windows\System\HjadCAi.exe

C:\Windows\System\lhdsPtT.exe

C:\Windows\System\lhdsPtT.exe

C:\Windows\System\TONupAz.exe

C:\Windows\System\TONupAz.exe

C:\Windows\System\eVqVviV.exe

C:\Windows\System\eVqVviV.exe

C:\Windows\System\OVmuQhx.exe

C:\Windows\System\OVmuQhx.exe

C:\Windows\System\onAGuAd.exe

C:\Windows\System\onAGuAd.exe

C:\Windows\System\dwoMHOi.exe

C:\Windows\System\dwoMHOi.exe

C:\Windows\System\SMZlCgT.exe

C:\Windows\System\SMZlCgT.exe

C:\Windows\System\UCHrNCP.exe

C:\Windows\System\UCHrNCP.exe

C:\Windows\System\UIsbCaS.exe

C:\Windows\System\UIsbCaS.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	133.211.185.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	raw.githubusercontent.com	udp
US	185.199.108.133:443	raw.githubusercontent.com	tcp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	133.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
GB	142.250.187.202:443		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	nw-umwatson.events.data.microsoft.com	udp
US	52.168.117.173:443	nw-umwatson.events.data.microsoft.com	tcp
US	8.8.8.8:53	173.117.168.52.in-addr.arpa	udp
US	8.8.8.8:53	88.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	98.251.17.2.in-addr.arpa	udp
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	213.143.182.52.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp

Files

memory/2260-0-0x00007FF680110000-0x00007FF680502000-memory.dmp

memory/2260-1-0x000001C533080000-0x000001C533090000-memory.dmp

C:\Windows\System\sJcEHyl.exe

MD5	0655b511ceedccfbe479f2dc045086ce
SHA1	ba3ba12421c79628358dd7249f888cb664139f31
SHA256	66a4fe9bb26b998c8b1bf64ee837af3e9432158d74480c90d1518dd043470fc6
SHA512	1be2dce838e9c34f98d1f61bd462a2afee43dd44c23c9f90c2c4311cf0ef923352302752806af7bf369c589d485ca87749add3bcf519d30fc02ba3f156d40799

C:\Windows\System\ZabLnGx.exe

MD5	86d7264f0309368bad99d0ed3e047b15
SHA1	e8542425aa1c2081da897006f4a491d96b143a82
SHA256	c99035481e1423aa8fcfb00c9ab01f52fa3432564ffbd4a126307e9727af085a
SHA512	cd5e7b99ebf0ef405a2d1ef29b19a34162076b26fedcc8d1b9e4857ebbcf914732409779233aabd25504571a0f48dc5c2626b8f79f21de943ae64b53a8ed6357

memory/3620-11-0x00007FF70F6E0000-0x00007FF70FAD2000-memory.dmp

memory/4700-14-0x00007FF7F7930000-0x00007FF7F7D22000-memory.dmp

C:\Windows\System\NzEFnJE.exe

MD5	a56e07f1dc522cbbf5ff0b1bffc5edbf
SHA1	391101e91359bd6366ebc1e895efd39e2a54ee18
SHA256	d418e2a506787aa37ff74c30c0650ae2a78ae4bb7c0b8708133646e765d3e6e2
SHA512	77e92ae33731916fc0d425de59956858739690505339ad9b6290db95a1a56c3e38d02fc07456fd10bed0db4a634fc93de2178b801b96a35b99b2b3bc56ab616f

C:\Windows\System\TcrsXlE.exe

MD5	8e48000eb40ff8e43fa71157ab961c00
SHA1	7cbac2c7a4bf4071c40e92e583a3faa4a41e886c
SHA256	57b43a56fd09a4bb8ec03c666b63e793b11a813a2eef1b887e0e658a298ef885
SHA512	6055662052e9e16cdd1e20af552381e696128392d328c42bc71a901a0f6e3b6aba7656cf4276e02f1861cd33dc91169d3d333844c669ff1c8888b544e7f9decb

memory/2900-30-0x00007FF64B6E0000-0x00007FF64BAD2000-memory.dmp

C:\Windows\System\ULmUwsS.exe

MD5	5291b4f6168448c13ca466ba254a436c
SHA1	1299ab96846818e5432483ae1422485338a4db25
SHA256	48be08405957df2158b42a62c56f0457dc8e7a861cc23851b8a2cc6e3a42a74f
SHA512	481d9ef4a1cbca15757ec9c07f28f1d9826a0a5d0a17727942b646f55e78e28b8f0ea94fe4efbb79f722b66b242264cb92d2a540166b81516cda95e1dbf8d789

C:\Windows\System\MsaKpuF.exe

MD5	d4b28c73327eb302db56d4cf74481d84
SHA1	bb2ce296671cc97daeb82c0107a8dcc11bf14080
SHA256	9b4ca650d35c90875ea040053050dc5c8bbd96789ada03bdfbee9b6422bf36f2
SHA512	65c0c9f9f3ad84c07ce388a239979423d2060520696cb6db71bfb3987729d701aa9f9dadab04681c1bf4d5a6a28baafcfc60dddb7d72f19e89b6a9018c9ae172

C:\Windows\System\HicLRkF.exe

MD5	2367faa60d145e3392c05c9eb873fd21
SHA1	16617ba12f642827180e56f18326cbad94cdcb2f
SHA256	408fb6b8107ccf9524628dcd211d15c0d1d03158e7e7f110eed5181a9d206302
SHA512	9d091a92411ed1d02161dd97fa6dcb34c44d0950781e52130e553a41334dfb9f377eca6e3bc4b08d8a6fa19b975d7c512b2fd58b25a52f73222e0256429fd02f

C:\Windows\System\xBxWlbI.exe

MD5	3a599ff1994d6ac3bb9fbc5e725641fa
SHA1	f5cc9d5360cbfce03ecd166e1db00c443a1f2955
SHA256	3126345c43f86fe85de1a979985f48d4e72eb408816a9db38a24b04aff214f66
SHA512	43c56eba7f5b430ea9c5dbe2d8c87d2ba087e1eebe12cea57e3c10b8126e974891ff52330d0e191527760b9298131c7d85a52e456d31aca37681278ca2ac8f0b

C:\Windows\System\refKjbK.exe

MD5	f9709b81542f7c8865a975bdcc5f3b7b
SHA1	8891648e5fc1c543dfc2c5711bd72dbcab039a19
SHA256	6774a108158f134284d8511481b1d26d73dc6d38308068b21f7c100affc15c25
SHA512	31703a02f35957bf29f62e47a781492fc67d3b32877f90ba9f0cc69deb0757ad9c2a32ed361ec05ede01c280dcf2e96b4e0421672019ba88eef873f784a79be8

C:\Windows\System\FdVOnTJ.exe

MD5	53a9df9a633ea803edca1feb35ef62ba
SHA1	2e225a5e477defbcb75a19a9695d8638516f6bd8
SHA256	0d414ffb56ad490c55cd4ff9756092a37b783ed66e436f97ae09a8b9e43c8764
SHA512	3a1b9b53cb0d369d0a692583db0baba8f204ebf30caa7e34cdbe3bb0aeb09b03bf0974afd29b01aac98f4da956407c64ec8ed0e86b2c0b350fc56ddb6a979e6e

memory/4628-184-0x00007FF667560000-0x00007FF667952000-memory.dmp

memory/5984-189-0x00007FF685360000-0x00007FF685752000-memory.dmp

memory/4676-200-0x00007FF690BB0000-0x00007FF690FA2000-memory.dmp

memory/5916-202-0x00007FF7B3670000-0x00007FF7B3A62000-memory.dmp

memory/4640-201-0x00007FF638DC0000-0x00007FF6391B2000-memory.dmp

memory/5364-195-0x00007FF7999A0000-0x00007FF799D92000-memory.dmp

memory/5628-194-0x00007FF786810000-0x00007FF786C02000-memory.dmp

memory/2556-191-0x00007FF626490000-0x00007FF626882000-memory.dmp

memory/4972-190-0x00007FF7FFB90000-0x00007FF7FFF82000-memory.dmp

memory/5900-188-0x00007FF7C7500000-0x00007FF7C78F2000-memory.dmp

memory/5936-187-0x00007FF623100000-0x00007FF6234F2000-memory.dmp

memory/1796-186-0x00007FF6501D0000-0x00007FF6505C2000-memory.dmp

memory/560-185-0x00007FF690EF0000-0x00007FF6912E2000-memory.dmp

C:\Windows\System\vdkMHgC.exe

MD5	ec1a11b823416fc739c8b54c0f027e8e
SHA1	b021f634081f54d6c952faa13647541e5bb5d279
SHA256	c199d1e7f6e8e4996114c3d82e69cfaccb87d831cabb66af1aeca249890791c5
SHA512	dda8ed685b6e325206b84346693e064b2cb81f56cea582672165f015b210dcc55fca6e2334dacc7ecc0ec02bc4fc97629754e42bba9ca163853f1822379ca1ab

C:\Windows\System\ZhJKZFg.exe

MD5	7938e4e6100fff013829d7cca5058bce
SHA1	0e9bcdb1067cae9a966b56e9f6d04b4969cebe4c
SHA256	40e50ad66c11b4f710bb7c7d42ed624b942bb0c65ade3e3deae6e8e7d5cb556a
SHA512	48780453ffc96c0df36ee1e907eb242877ac5191ff0975d4d69b269957c7bd50fead8fddbeffe92d521ac2b6b35796979455ede2c1bd44ca67906c14f8e83f80

C:\Windows\System\muJAseK.exe

MD5	d9c7c9bb3efb7dcc6017428b82b96123
SHA1	8d22d6090f02dd6d3fd743f942aff1ca093f0ed8
SHA256	366e451c76833a13fd4584867aafeeccf5f19b28797b0e29cd225681c9f7a43c
SHA512	4d0ad19c4a799fdb82bfac563aadca6c5caa7ea347c5e803eb4e342966c6168072311fdc3e6cbaa7d5ed528d0fb70508b99f8c6c8dc1c7723ed48304324d97c2

memory/5516-171-0x00007FF6E3370000-0x00007FF6E3762000-memory.dmp

C:\Windows\System\ukiInhQ.exe

MD5	557904edb7fff5c4be8de77b95cc84cd
SHA1	bbf3955c982b07a0c4cc5d8748fd89f9e5277e9b
SHA256	b985b3b83091cfca7056c7edbd17ce433d2f281b1c9ac81f51bfc11a55539989
SHA512	c0b12b6fbb1600065f8d73874f831c1fdb5d583737692240cbc49c9aa63881025fef079c6b7f18dee9a2db9ec539c80f7603763a5a8607cab8b3f182f674a0a3

C:\Windows\System\zAFbQlh.exe

MD5	5be2d4084629b5870d54588eb99f2798
SHA1	14b54b9401ce7160fed3ac56d34069f8beeb120b
SHA256	a731c523722dd943c3ce358de94ccce112c0d121688ebabebe77bc3aec9f3c1e
SHA512	1ca3bbcc1dc644b591ee864955489842be6f3592fd9bbd00a14f9db4a55f60399aef11a19b2d9537629f94bd456f3362db8a798b3a2187e39bfb963c9f190b3f

memory/5380-160-0x00007FF740FE0000-0x00007FF7413D2000-memory.dmp

C:\Windows\System\EKSWRMo.exe

MD5	6bca811c5234cffd3d6f260858da6671
SHA1	d3c46945190f7cbceae24b80de6e0cb312d4128c
SHA256	628100dafee347bd2c565e4c49f6f8a9b4adae2af333081900aaff1bc61357b5
SHA512	235fbb74c4a095b04d175c0170adfb6052c195a2f68f89eadb22d35c059298b16dd5ee19ec201c4c0c3129c3af77f1befde9c836a5af798c4cb251868143f3e5

C:\Windows\System\dkWlPGF.exe

MD5	0587bd6ad171789661016464c44b1416
SHA1	9f27b22136fbf68baff5ea0dd99afb2fdf20c065
SHA256	4cfd0db5f388a59fdb1bbf2baba5cae5ee171be0151603ffe870e26d352e3ff1
SHA512	a4983a6181c894841408ebba3bb6e1269d4f15a0e8908a5c206c97c982ee1a12b2537971771cd1d72df8b0084d8c45fdf604550aaf1b72ff27530fa29f63f511

C:\Windows\System\HwIsEwX.exe

MD5	38cac0f7f4a977b78b6145726ceadcd1
SHA1	e904838d7faefa36f0090c788b7b1e582757b220
SHA256	2c2a2de3ef6655bd876e6b0b0fe3c76d100767f4b7d3a35c2c3403f41918bd33
SHA512	38b72cbfeaae61f6ef66e2e7ad0e1ae81dc4dfd18af538abb4ea8c8a26a3c8083b78fdfd14b553c352989a5885b409ae893fd60739f2cd4f499cffdedcd56062

memory/5772-151-0x00007FF63B810000-0x00007FF63BC02000-memory.dmp

C:\Windows\System\TSGMNSD.exe

MD5	51ff4234b24414285afc21377402a941
SHA1	956313470fdd84c533734b9802daf7ac241f235d
SHA256	264053113d51627357277838f825175a988161f4b69d55c100317366f805238b
SHA512	a70f1256fcca235e2ffdc7c5fd76615dc6d8f4d804e5c09683b75880163afe1014f66c34d5ca1b2a61edbb3e58b07dbad69cba0a7d5ae905f406b993a334200c

C:\Windows\System\eZMIUNT.exe

MD5	6f44620100738b7854b4e53c617ea98a
SHA1	f61bea3321828ae33979e829b3f6e78300e39619
SHA256	39f2bfa24be6c5b5d2aa5858b4fb719b2f5e3f7683daf47a52ace758f1e203b2
SHA512	51dd4bf7992dc0935df0154e2dca5798ee2f9c6d42e4ba69a85b55d114f0c0ab6ff454ae44d062212896702b051635b5603c3aed0d55768e4c72456a1de23e20

C:\Windows\System\atHUNrr.exe

MD5	531830d4fc9918e54e887df24490caca
SHA1	8edd1af05600ad4f0f31ca1c4ddedf9ac3857b0b
SHA256	62831ed8f988714eadc24ef53222929a3f175ed30e7ea87cea4d15270b899322
SHA512	eec6a834fe9ca1fa283eeb3c9659e292d9a2a4dc476c9c145452f8fd4c74a9b1de8bc7b6a8e90672fae3f68d93c23f23ffdeb44ddf37b9042e6594e06248513d

C:\Windows\System\SRqCDUr.exe

MD5	f16a0092103a9cdb68d8abef9844eeb0
SHA1	2d9d43d037a3ca336a5e1997fe43c97d80beea8c
SHA256	7994bab5a973be856c49c052194c403e76b5a10e254783801a8f890b2546b00d
SHA512	a619f97f443f3ca8786371adb882c0b83e4dc79ff7b14b4ca25d8426635b0bcedd26f2d59e7dd4e8b120f5cd787ff21a855b7a9ba54985900cba4742fcef3886

memory/5444-130-0x00007FF6367D0000-0x00007FF636BC2000-memory.dmp

C:\Windows\System\LUQnQAA.exe

MD5	1c0d730a9008864b65c4c81d16156f21
SHA1	c81beec6bb560a1ec8760cfffd0858ca44bed0b9
SHA256	2e1e4d2a0a242b5912dc178fa80c19cd5cb46747deca7eb439aa3d3bb45a6725
SHA512	c68e93238fe2afdd1fddfa053e3e613dc03587cf9f1fd2a42e1529336250dda6e98792ce35fc1f8b464062660d8b3d45b060e41fa471a6ba3090df6b35822633

C:\Windows\System\eSWVqkQ.exe

MD5	e3741a0879699f9f9b66699c49e570da
SHA1	f1d2c5e27483bd8530c53983fe3b4e6bd3616fd7
SHA256	72e94965ae7a22c9328e71836554bec6bab70ad54a2c2564fd4afac7912dae7f
SHA512	b0a25ac47aa29f6d77ca5ac8e6ea6cbcd17c965bdfad1268829e56bbac5347913d87554b6158d7512de82a0fcdd4ecf4a49d05109837564923e3503316c2d771

C:\Windows\System\UdQdwvF.exe

MD5	96d0d019f4da437997dd9f5799e35875
SHA1	aa87e22cb3d8388eb210c7b10e7b0721892b1186
SHA256	40f19d444d2a59cba34bcdc459b393ee15cc0760312abaaf218f742ed7665be5
SHA512	c06fc3710eb6787abe0ded0c79c46484e4cc7aff6af8a14d57247577f36a09f60b370a3b54a9c52fdcfb9b6b5ee23e925a960d27d936298aab9c39f39bc969c0

C:\Windows\System\SBsnhgr.exe

MD5	91bebb0466d63f14c50818b01ae428fa
SHA1	d27f02dff3617df5a8788734344f8e2a679b55f8
SHA256	5a09ccf4bf03273aca4637d1ffaff2d27258713bd22a4a5bcf83a6b1b354bdc5
SHA512	014ac5549f182081c8cc35ce83dd256b7dba244f1ea1f8b0f91fdf6fa3b1b12596f8dc9f9f35158ff79be8b593aa49a2129e5bea911494c681b64fd9e641a30c

C:\Windows\System\MSZTUPq.exe

MD5	f0abd3001a350dd3b5dd6633c8f70286
SHA1	90abb93e7de004c1e11822f57281401179cae215
SHA256	5d9e55d3a265c45115bc2fb8c658817e34f834c37b3d15e23fa9233c2305195e
SHA512	9400db83eba47da1ab5dcf3f5722c4cd55ab795781a6aa7cffd1e3a1877f68847b3d61c190a31e575ebd7aea26d7f9637dab49a252f5a0b2e871a1fb0caac673

memory/5152-97-0x00007FF7B3D30000-0x00007FF7B4122000-memory.dmp

C:\Windows\System\FZqmJGE.exe

MD5	8e6052cd4c71e17e2729a778aaa6705d
SHA1	0456b4f6279e5858cb080855188735f71dd22c81
SHA256	aa6a807279b69122e63f41ea649a693275b601a5a9bfcdc6cfbb14997e09234c
SHA512	56eebbae3234d0ea5b1b333125e0a16748db82dacff5912863ff89785e24f35c6e3924c64e0fbcd67563ad49d1bb5b38f93e736c1365302040667d9a685a779a

memory/3548-83-0x00007FF6E23D0000-0x00007FF6E27C2000-memory.dmp

C:\Windows\System\ctcoSod.exe

MD5	36cef536904d41a4cb9f08d128d0ac5c
SHA1	16f853e1f307d03f50b3b08c9cc14eef537d4ac9
SHA256	543cab01a59c49fd155f5432f2e1d0b91bad68e9dc259d0c49d854488339de28
SHA512	a0d24a8c5c2f004f310cbf929a858beea2b1827dcf964caa3f1e5509dbfd0eb4f5bc63b8bc71595bb6b1a0e964609c851935176f855b1fbf428a90a3e76ba207

C:\Windows\System\AqkEjyK.exe

MD5	e0692f5031d37c8c41e6175a5bfddcc7
SHA1	f24099e3bdf1d980a66a373d7a92042578b19255
SHA256	c234ffd4a20e772ce11f4db4a05add6520773122bc7731a4e82313f4b42b70bb
SHA512	a259f764f382a6ad52d47ba1c59145f9372d2116975746595e61f4caf71ba1e9835af4e688cc0cce9e7710cdddec26f46ec809b8dfbdd23d9f82aa85fc8129c6

C:\Windows\System\SRCkadK.exe

MD5	4fdf7a2e891eb3eb15ab430687031e6a
SHA1	ca6ef3b768cd67b042dca8c3d1e76c6b57029304
SHA256	43adef4e2a71531a04000c73f49b704751a49573527554aefcc80b47e9f7daea
SHA512	67b63970b454f4987ae200ad839ad49450a8220e89009a6b4b4a9663ad8c527e55b462eb40fd24bd4b25a62e68ae21066140fb390537a7bc7c04f99c1c11eb6c

memory/700-56-0x00007FF711240000-0x00007FF711632000-memory.dmp

memory/416-47-0x00007FF672EC0000-0x00007FF6732B2000-memory.dmp

C:\Windows\System\WqElqYD.exe

MD5	6eb3c19dcf68493919c8dd0e6fed5bcd
SHA1	1efd5b5945b384a47385e33dcf727f90d0e2d5d6
SHA256	87ae286c754be668b353a4bf9c5d1732f353992d227a8b471f5de50fbc8cc49d
SHA512	786852f1c724b5c3e5bc7736d2f205dab14f4dd6867f3971e3e7fa0f98c185fadc5925c6c81dc28c4021b04b2dd19e19b78a8ae30c1ca9a936d4940120ee1314

C:\Windows\System\EldnTBm.exe

MD5	adafd64a8f9855b1121fa77afc651830
SHA1	c5dd545800a1d6b896032d67ffd728ac31e1c85d
SHA256	482c8ae6638c0bfa0a14afd225f2e2ce0b086ed15aa0d410dd99affc85f0aecc
SHA512	4a637d195ebe121808d11a317de900664f4507487950866e48c30cc91a674cbb9e53768532f31a36c52457dede6d256d300c119a46b3d914a3263ff8bc3ba59c

C:\Windows\System\NrVhwAG.exe

MD5	c41419fbe41249ec5ae5c0e850c67c66
SHA1	00a63fb0cb5d72d84f1f9654593e4f247926547a
SHA256	19c1ccd06dbde9309e6f08c93bfb2101106de23044170a7b7a047ae0de5a9cdc
SHA512	182ed337a346abd687202a56a2dd8ada2df325dfad6e5c6e278f0dc03903e8a53efc20d5abc2b7f8da5b5fd9e4f003043d1bbf2731073614e108337239bf44b7

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tixdlw53.cku.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3236-226-0x0000028583D00000-0x0000028583D22000-memory.dmp

memory/4700-291-0x00007FF7F7930000-0x00007FF7F7D22000-memory.dmp

memory/3620-289-0x00007FF70F6E0000-0x00007FF70FAD2000-memory.dmp

memory/2260-287-0x00007FF680110000-0x00007FF680502000-memory.dmp

memory/3236-877-0x000002859EA30000-0x000002859F1D6000-memory.dmp

memory/3620-1689-0x00007FF70F6E0000-0x00007FF70FAD2000-memory.dmp

memory/2900-1819-0x00007FF64B6E0000-0x00007FF64BAD2000-memory.dmp

memory/2556-1826-0x00007FF626490000-0x00007FF626882000-memory.dmp

memory/5916-1841-0x00007FF7B3670000-0x00007FF7B3A62000-memory.dmp

memory/5936-1840-0x00007FF623100000-0x00007FF6234F2000-memory.dmp

memory/1796-1835-0x00007FF6501D0000-0x00007FF6505C2000-memory.dmp

memory/5380-1833-0x00007FF740FE0000-0x00007FF7413D2000-memory.dmp

memory/700-1817-0x00007FF711240000-0x00007FF711632000-memory.dmp

memory/4640-1810-0x00007FF638DC0000-0x00007FF6391B2000-memory.dmp

memory/5900-1808-0x00007FF7C7500000-0x00007FF7C78F2000-memory.dmp

memory/4676-1792-0x00007FF690BB0000-0x00007FF690FA2000-memory.dmp

memory/5984-1775-0x00007FF685360000-0x00007FF685752000-memory.dmp

memory/5628-1769-0x00007FF786810000-0x00007FF786C02000-memory.dmp

memory/560-1767-0x00007FF690EF0000-0x00007FF6912E2000-memory.dmp

memory/5772-1766-0x00007FF63B810000-0x00007FF63BC02000-memory.dmp

memory/4628-1759-0x00007FF667560000-0x00007FF667952000-memory.dmp

memory/5364-1758-0x00007FF7999A0000-0x00007FF799D92000-memory.dmp

memory/4972-1755-0x00007FF7FFB90000-0x00007FF7FFF82000-memory.dmp

memory/5516-1753-0x00007FF6E3370000-0x00007FF6E3762000-memory.dmp

memory/5152-1751-0x00007FF7B3D30000-0x00007FF7B4122000-memory.dmp

memory/3548-1830-0x00007FF6E23D0000-0x00007FF6E27C2000-memory.dmp

memory/5444-1768-0x00007FF6367D0000-0x00007FF636BC2000-memory.dmp

memory/416-1694-0x00007FF672EC0000-0x00007FF6732B2000-memory.dmp

memory/4700-1693-0x00007FF7F7930000-0x00007FF7F7D22000-memory.dmp

Sample ID	240613-2jed5sxbkl
Target	8caf19609eecff80d7b5873de7b09de0_NeikiAnalytics.exe
SHA256	6571c11b39f7c9cc331e9e8fae20b83c55e52bcdf22ed834dd9095892b54660a
Tags	upx miner xmrig execution

Malware Analysis Report

2024-07-28 21:32

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files