Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\JkYLrIl.exe	N/A
N/A	N/A	C:\Windows\System\vpqiwre.exe	N/A
N/A	N/A	C:\Windows\System\pcvfPRl.exe	N/A
N/A	N/A	C:\Windows\System\cYtAGvh.exe	N/A
N/A	N/A	C:\Windows\System\QlOEmQj.exe	N/A
N/A	N/A	C:\Windows\System\pFQawDa.exe	N/A
N/A	N/A	C:\Windows\System\jZxLZOY.exe	N/A
N/A	N/A	C:\Windows\System\iDwsRqC.exe	N/A
N/A	N/A	C:\Windows\System\qREQLTs.exe	N/A
N/A	N/A	C:\Windows\System\ynFlFYf.exe	N/A
N/A	N/A	C:\Windows\System\iolSFNj.exe	N/A
N/A	N/A	C:\Windows\System\LXgEyDE.exe	N/A
N/A	N/A	C:\Windows\System\bqIXuWN.exe	N/A
N/A	N/A	C:\Windows\System\PWqaluP.exe	N/A
N/A	N/A	C:\Windows\System\sAJRxvK.exe	N/A
N/A	N/A	C:\Windows\System\VIjvYvs.exe	N/A
N/A	N/A	C:\Windows\System\kimecOQ.exe	N/A
N/A	N/A	C:\Windows\System\YLeLXot.exe	N/A
N/A	N/A	C:\Windows\System\fWeRZyV.exe	N/A
N/A	N/A	C:\Windows\System\feFkKJu.exe	N/A
N/A	N/A	C:\Windows\System\DIGOtSV.exe	N/A
N/A	N/A	C:\Windows\System\pauHHqh.exe	N/A
N/A	N/A	C:\Windows\System\jkiPtsb.exe	N/A
N/A	N/A	C:\Windows\System\gmvKDUb.exe	N/A
N/A	N/A	C:\Windows\System\ihuljeH.exe	N/A
N/A	N/A	C:\Windows\System\CtHdeCo.exe	N/A
N/A	N/A	C:\Windows\System\KrtTqLA.exe	N/A
N/A	N/A	C:\Windows\System\McELQeL.exe	N/A
N/A	N/A	C:\Windows\System\tpDvrkG.exe	N/A
N/A	N/A	C:\Windows\System\iiWHMVV.exe	N/A
N/A	N/A	C:\Windows\System\XRUIzcZ.exe	N/A
N/A	N/A	C:\Windows\System\JZVHneC.exe	N/A
N/A	N/A	C:\Windows\System\pqjCvTb.exe	N/A
N/A	N/A	C:\Windows\System\RvgdwhJ.exe	N/A
N/A	N/A	C:\Windows\System\MAKFcIu.exe	N/A
N/A	N/A	C:\Windows\System\YmriSRZ.exe	N/A
N/A	N/A	C:\Windows\System\jOREXVM.exe	N/A
N/A	N/A	C:\Windows\System\fAXZhWS.exe	N/A
N/A	N/A	C:\Windows\System\nnuGMaC.exe	N/A
N/A	N/A	C:\Windows\System\cYMoRCv.exe	N/A
N/A	N/A	C:\Windows\System\JfJwGtV.exe	N/A
N/A	N/A	C:\Windows\System\LbTjgxV.exe	N/A
N/A	N/A	C:\Windows\System\rBOpHGm.exe	N/A
N/A	N/A	C:\Windows\System\XXEMyyO.exe	N/A
N/A	N/A	C:\Windows\System\zifbgXm.exe	N/A
N/A	N/A	C:\Windows\System\xdOwNTo.exe	N/A
N/A	N/A	C:\Windows\System\WGnAHyC.exe	N/A
N/A	N/A	C:\Windows\System\DMrWrFX.exe	N/A
N/A	N/A	C:\Windows\System\fYKsITt.exe	N/A
N/A	N/A	C:\Windows\System\PHkbptW.exe	N/A
N/A	N/A	C:\Windows\System\urDKPOK.exe	N/A
N/A	N/A	C:\Windows\System\YUIligY.exe	N/A
N/A	N/A	C:\Windows\System\fnNIMQV.exe	N/A
N/A	N/A	C:\Windows\System\GwFRDCb.exe	N/A
N/A	N/A	C:\Windows\System\cRAnCcm.exe	N/A
N/A	N/A	C:\Windows\System\iuSjnJz.exe	N/A
N/A	N/A	C:\Windows\System\IVNCFGb.exe	N/A
N/A	N/A	C:\Windows\System\TLKGPOF.exe	N/A
N/A	N/A	C:\Windows\System\HULGoTt.exe	N/A
N/A	N/A	C:\Windows\System\pXdsPuE.exe	N/A
N/A	N/A	C:\Windows\System\OZXdpwS.exe	N/A
N/A	N/A	C:\Windows\System\mpthGbB.exe	N/A
N/A	N/A	C:\Windows\System\uWJQVth.exe	N/A
N/A	N/A	C:\Windows\System\fCFbVoN.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\onGDzJg.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bryIroG.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vbOHTsw.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VJJebWo.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WUlzAzY.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GSNDFda.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DyzdgBZ.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oPrxpUZ.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iwBsgrS.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eySIWaH.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RVqCivw.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FJMrOyN.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bnMGwoo.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PKDnONh.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SpsjJvc.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IcKhlMt.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eGGIARC.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\viLfYgf.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MGjjVaG.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bwAdnmP.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\amxwmvD.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xOEmUOi.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WdpwoAg.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JLCJAzu.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BVGAGIk.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LranCwh.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ngtjQaZ.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zgWdRdF.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eHuTqji.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\czrFAbx.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RrbNbEZ.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nIaHoXs.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dpYoCTg.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gFnCSOA.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gQpzfVe.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oHOsijZ.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qbFFFDl.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eEdSifb.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fvvgOqb.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RZclYHB.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XyzznWG.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nIIvYJn.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BABTauc.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GVGfADM.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ERuAduq.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FZZfhJE.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PofJvis.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lRcSuMl.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SvNnKIt.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VajdHAH.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\prxRgCP.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HTkmmde.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PBlnIMT.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\reAdRlC.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oRdUIXM.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aIVdXkl.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fwbhiBv.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VJnEwDX.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WzTkXkW.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ODBaQgf.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kULoFkr.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wymHiLF.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iHnhfZm.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wrMSzwN.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2088 wrote to memory of 2160	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2088 wrote to memory of 2160	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2088 wrote to memory of 2160	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2088 wrote to memory of 2052	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\JkYLrIl.exe
PID 2088 wrote to memory of 2052	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\JkYLrIl.exe
PID 2088 wrote to memory of 2052	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\JkYLrIl.exe
PID 2088 wrote to memory of 2604	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\vpqiwre.exe
PID 2088 wrote to memory of 2604	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\vpqiwre.exe
PID 2088 wrote to memory of 2604	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\vpqiwre.exe
PID 2088 wrote to memory of 1804	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\pcvfPRl.exe
PID 2088 wrote to memory of 1804	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\pcvfPRl.exe
PID 2088 wrote to memory of 1804	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\pcvfPRl.exe
PID 2088 wrote to memory of 2664	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\cYtAGvh.exe
PID 2088 wrote to memory of 2664	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\cYtAGvh.exe
PID 2088 wrote to memory of 2664	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\cYtAGvh.exe
PID 2088 wrote to memory of 2764	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\QlOEmQj.exe
PID 2088 wrote to memory of 2764	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\QlOEmQj.exe
PID 2088 wrote to memory of 2764	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\QlOEmQj.exe
PID 2088 wrote to memory of 2600	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\jZxLZOY.exe
PID 2088 wrote to memory of 2600	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\jZxLZOY.exe
PID 2088 wrote to memory of 2600	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\jZxLZOY.exe
PID 2088 wrote to memory of 2520	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\pFQawDa.exe
PID 2088 wrote to memory of 2520	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\pFQawDa.exe
PID 2088 wrote to memory of 2520	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\pFQawDa.exe
PID 2088 wrote to memory of 2508	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\iDwsRqC.exe
PID 2088 wrote to memory of 2508	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\iDwsRqC.exe
PID 2088 wrote to memory of 2508	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\iDwsRqC.exe
PID 2088 wrote to memory of 2632	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\qREQLTs.exe
PID 2088 wrote to memory of 2632	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\qREQLTs.exe
PID 2088 wrote to memory of 2632	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\qREQLTs.exe
PID 2088 wrote to memory of 2516	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\LXgEyDE.exe
PID 2088 wrote to memory of 2516	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\LXgEyDE.exe
PID 2088 wrote to memory of 2516	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\LXgEyDE.exe
PID 2088 wrote to memory of 2936	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\ynFlFYf.exe
PID 2088 wrote to memory of 2936	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\ynFlFYf.exe
PID 2088 wrote to memory of 2936	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\ynFlFYf.exe
PID 2088 wrote to memory of 1040	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\bqIXuWN.exe
PID 2088 wrote to memory of 1040	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\bqIXuWN.exe
PID 2088 wrote to memory of 1040	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\bqIXuWN.exe
PID 2088 wrote to memory of 812	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\iolSFNj.exe
PID 2088 wrote to memory of 812	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\iolSFNj.exe
PID 2088 wrote to memory of 812	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\iolSFNj.exe
PID 2088 wrote to memory of 2524	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\sAJRxvK.exe
PID 2088 wrote to memory of 2524	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\sAJRxvK.exe
PID 2088 wrote to memory of 2524	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\sAJRxvK.exe
PID 2088 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\PWqaluP.exe
PID 2088 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\PWqaluP.exe
PID 2088 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\PWqaluP.exe
PID 2088 wrote to memory of 2276	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\kimecOQ.exe
PID 2088 wrote to memory of 2276	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\kimecOQ.exe
PID 2088 wrote to memory of 2276	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\kimecOQ.exe
PID 2088 wrote to memory of 2140	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\VIjvYvs.exe
PID 2088 wrote to memory of 2140	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\VIjvYvs.exe
PID 2088 wrote to memory of 2140	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\VIjvYvs.exe
PID 2088 wrote to memory of 2136	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\YsPOCSI.exe
PID 2088 wrote to memory of 2136	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\YsPOCSI.exe
PID 2088 wrote to memory of 2136	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\YsPOCSI.exe
PID 2088 wrote to memory of 316	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\YLeLXot.exe
PID 2088 wrote to memory of 316	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\YLeLXot.exe
PID 2088 wrote to memory of 316	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\YLeLXot.exe
PID 2088 wrote to memory of 1964	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\acviclV.exe
PID 2088 wrote to memory of 1964	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\acviclV.exe
PID 2088 wrote to memory of 1964	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\acviclV.exe
PID 2088 wrote to memory of 2916	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\fWeRZyV.exe

Processes

C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\JkYLrIl.exe

C:\Windows\System\JkYLrIl.exe

C:\Windows\System\vpqiwre.exe

C:\Windows\System\vpqiwre.exe

C:\Windows\System\pcvfPRl.exe

C:\Windows\System\pcvfPRl.exe

C:\Windows\System\cYtAGvh.exe

C:\Windows\System\cYtAGvh.exe

C:\Windows\System\QlOEmQj.exe

C:\Windows\System\QlOEmQj.exe

C:\Windows\System\jZxLZOY.exe

C:\Windows\System\jZxLZOY.exe

C:\Windows\System\pFQawDa.exe

C:\Windows\System\pFQawDa.exe

C:\Windows\System\iDwsRqC.exe

C:\Windows\System\iDwsRqC.exe

C:\Windows\System\qREQLTs.exe

C:\Windows\System\qREQLTs.exe

C:\Windows\System\LXgEyDE.exe

C:\Windows\System\LXgEyDE.exe

C:\Windows\System\ynFlFYf.exe

C:\Windows\System\ynFlFYf.exe

C:\Windows\System\bqIXuWN.exe

C:\Windows\System\bqIXuWN.exe

C:\Windows\System\iolSFNj.exe

C:\Windows\System\iolSFNj.exe

C:\Windows\System\sAJRxvK.exe

C:\Windows\System\sAJRxvK.exe

C:\Windows\System\PWqaluP.exe

C:\Windows\System\PWqaluP.exe

C:\Windows\System\kimecOQ.exe

C:\Windows\System\kimecOQ.exe

C:\Windows\System\VIjvYvs.exe

C:\Windows\System\VIjvYvs.exe

C:\Windows\System\YsPOCSI.exe

C:\Windows\System\YsPOCSI.exe

C:\Windows\System\YLeLXot.exe

C:\Windows\System\YLeLXot.exe

C:\Windows\System\acviclV.exe

C:\Windows\System\acviclV.exe

C:\Windows\System\fWeRZyV.exe

C:\Windows\System\fWeRZyV.exe

C:\Windows\System\UVLzGqr.exe

C:\Windows\System\UVLzGqr.exe

C:\Windows\System\feFkKJu.exe

C:\Windows\System\feFkKJu.exe

C:\Windows\System\tYRwyQf.exe

C:\Windows\System\tYRwyQf.exe

C:\Windows\System\DIGOtSV.exe

C:\Windows\System\DIGOtSV.exe

C:\Windows\System\tNHdPOi.exe

C:\Windows\System\tNHdPOi.exe

C:\Windows\System\pauHHqh.exe

C:\Windows\System\pauHHqh.exe

C:\Windows\System\vgLIeVg.exe

C:\Windows\System\vgLIeVg.exe

C:\Windows\System\jkiPtsb.exe

C:\Windows\System\jkiPtsb.exe

C:\Windows\System\BtEJakZ.exe

C:\Windows\System\BtEJakZ.exe

C:\Windows\System\gmvKDUb.exe

C:\Windows\System\gmvKDUb.exe

C:\Windows\System\oLDtSLO.exe

C:\Windows\System\oLDtSLO.exe

C:\Windows\System\ihuljeH.exe

C:\Windows\System\ihuljeH.exe

C:\Windows\System\ayPCzdH.exe

C:\Windows\System\ayPCzdH.exe

C:\Windows\System\CtHdeCo.exe

C:\Windows\System\CtHdeCo.exe

C:\Windows\System\olSzfbc.exe

C:\Windows\System\olSzfbc.exe

C:\Windows\System\KrtTqLA.exe

C:\Windows\System\KrtTqLA.exe

C:\Windows\System\mKvqgQN.exe

C:\Windows\System\mKvqgQN.exe

C:\Windows\System\McELQeL.exe

C:\Windows\System\McELQeL.exe

C:\Windows\System\mgwPcpF.exe

C:\Windows\System\mgwPcpF.exe

C:\Windows\System\tpDvrkG.exe

C:\Windows\System\tpDvrkG.exe

C:\Windows\System\PvyGqRT.exe

C:\Windows\System\PvyGqRT.exe

C:\Windows\System\iiWHMVV.exe

C:\Windows\System\iiWHMVV.exe

C:\Windows\System\QNCtegp.exe

C:\Windows\System\QNCtegp.exe

C:\Windows\System\XRUIzcZ.exe

C:\Windows\System\XRUIzcZ.exe

C:\Windows\System\gVYDzFL.exe

C:\Windows\System\gVYDzFL.exe

C:\Windows\System\JZVHneC.exe

C:\Windows\System\JZVHneC.exe

C:\Windows\System\dCdXkPe.exe

C:\Windows\System\dCdXkPe.exe

C:\Windows\System\pqjCvTb.exe

C:\Windows\System\pqjCvTb.exe

C:\Windows\System\HPdKKCx.exe

C:\Windows\System\HPdKKCx.exe

C:\Windows\System\RvgdwhJ.exe

C:\Windows\System\RvgdwhJ.exe

C:\Windows\System\eUKHpNi.exe

C:\Windows\System\eUKHpNi.exe

C:\Windows\System\MAKFcIu.exe

C:\Windows\System\MAKFcIu.exe

C:\Windows\System\RkggQyM.exe

C:\Windows\System\RkggQyM.exe

C:\Windows\System\YmriSRZ.exe

C:\Windows\System\YmriSRZ.exe

C:\Windows\System\kImsxRq.exe

C:\Windows\System\kImsxRq.exe

C:\Windows\System\jOREXVM.exe

C:\Windows\System\jOREXVM.exe

C:\Windows\System\TABLzXP.exe

C:\Windows\System\TABLzXP.exe

C:\Windows\System\fAXZhWS.exe

C:\Windows\System\fAXZhWS.exe

C:\Windows\System\ZGpoIeQ.exe

C:\Windows\System\ZGpoIeQ.exe

C:\Windows\System\nnuGMaC.exe

C:\Windows\System\nnuGMaC.exe

C:\Windows\System\ULOvgrn.exe

C:\Windows\System\ULOvgrn.exe

C:\Windows\System\cYMoRCv.exe

C:\Windows\System\cYMoRCv.exe

C:\Windows\System\QXGHeYp.exe

C:\Windows\System\QXGHeYp.exe

C:\Windows\System\JfJwGtV.exe

C:\Windows\System\JfJwGtV.exe

C:\Windows\System\qhMKxtJ.exe

C:\Windows\System\qhMKxtJ.exe

C:\Windows\System\LbTjgxV.exe

C:\Windows\System\LbTjgxV.exe

C:\Windows\System\Srcevlu.exe

C:\Windows\System\Srcevlu.exe

C:\Windows\System\rBOpHGm.exe

C:\Windows\System\rBOpHGm.exe

C:\Windows\System\hojxuDB.exe

C:\Windows\System\hojxuDB.exe

C:\Windows\System\XXEMyyO.exe

C:\Windows\System\XXEMyyO.exe

C:\Windows\System\spqaPML.exe

C:\Windows\System\spqaPML.exe

C:\Windows\System\zifbgXm.exe

C:\Windows\System\zifbgXm.exe

C:\Windows\System\cWoSmfY.exe

C:\Windows\System\cWoSmfY.exe

C:\Windows\System\xdOwNTo.exe

C:\Windows\System\xdOwNTo.exe

C:\Windows\System\JENOtXA.exe

C:\Windows\System\JENOtXA.exe

C:\Windows\System\WGnAHyC.exe

C:\Windows\System\WGnAHyC.exe

C:\Windows\System\KPWKOtQ.exe

C:\Windows\System\KPWKOtQ.exe

C:\Windows\System\DMrWrFX.exe

C:\Windows\System\DMrWrFX.exe

C:\Windows\System\qJBJOmg.exe

C:\Windows\System\qJBJOmg.exe

C:\Windows\System\fYKsITt.exe

C:\Windows\System\fYKsITt.exe

C:\Windows\System\zzRRmzT.exe

C:\Windows\System\zzRRmzT.exe

C:\Windows\System\PHkbptW.exe

C:\Windows\System\PHkbptW.exe

C:\Windows\System\cnlvgAx.exe

C:\Windows\System\cnlvgAx.exe

C:\Windows\System\urDKPOK.exe

C:\Windows\System\urDKPOK.exe

C:\Windows\System\ZSoTPBk.exe

C:\Windows\System\ZSoTPBk.exe

C:\Windows\System\YUIligY.exe

C:\Windows\System\YUIligY.exe

C:\Windows\System\IMgomVr.exe

C:\Windows\System\IMgomVr.exe

C:\Windows\System\fnNIMQV.exe

C:\Windows\System\fnNIMQV.exe

C:\Windows\System\YDtGACC.exe

C:\Windows\System\YDtGACC.exe

C:\Windows\System\GwFRDCb.exe

C:\Windows\System\GwFRDCb.exe

C:\Windows\System\JmnSSGY.exe

C:\Windows\System\JmnSSGY.exe

C:\Windows\System\cRAnCcm.exe

C:\Windows\System\cRAnCcm.exe

C:\Windows\System\GMXsZWA.exe

C:\Windows\System\GMXsZWA.exe

C:\Windows\System\iuSjnJz.exe

C:\Windows\System\iuSjnJz.exe

C:\Windows\System\GMRxyVR.exe

C:\Windows\System\GMRxyVR.exe

C:\Windows\System\IVNCFGb.exe

C:\Windows\System\IVNCFGb.exe

C:\Windows\System\oidQhOO.exe

C:\Windows\System\oidQhOO.exe

C:\Windows\System\TLKGPOF.exe

C:\Windows\System\TLKGPOF.exe

C:\Windows\System\YxrpnAY.exe

C:\Windows\System\YxrpnAY.exe

C:\Windows\System\HULGoTt.exe

C:\Windows\System\HULGoTt.exe

C:\Windows\System\mOYVXwc.exe

C:\Windows\System\mOYVXwc.exe

C:\Windows\System\pXdsPuE.exe

C:\Windows\System\pXdsPuE.exe

C:\Windows\System\YFKPtjn.exe

C:\Windows\System\YFKPtjn.exe

C:\Windows\System\OZXdpwS.exe

C:\Windows\System\OZXdpwS.exe

C:\Windows\System\VjHUtrJ.exe

C:\Windows\System\VjHUtrJ.exe

C:\Windows\System\mpthGbB.exe

C:\Windows\System\mpthGbB.exe

C:\Windows\System\rTXiCPR.exe

C:\Windows\System\rTXiCPR.exe

C:\Windows\System\uWJQVth.exe

C:\Windows\System\uWJQVth.exe

C:\Windows\System\GcJSlce.exe

C:\Windows\System\GcJSlce.exe

C:\Windows\System\fCFbVoN.exe

C:\Windows\System\fCFbVoN.exe

C:\Windows\System\ciVFIkp.exe

C:\Windows\System\ciVFIkp.exe

C:\Windows\System\lthoaiw.exe

C:\Windows\System\lthoaiw.exe

C:\Windows\System\lxTqiTs.exe

C:\Windows\System\lxTqiTs.exe

C:\Windows\System\ceimOdj.exe

C:\Windows\System\ceimOdj.exe

C:\Windows\System\iMkJoiZ.exe

C:\Windows\System\iMkJoiZ.exe

C:\Windows\System\JyddNuu.exe

C:\Windows\System\JyddNuu.exe

C:\Windows\System\bObcosx.exe

C:\Windows\System\bObcosx.exe

C:\Windows\System\NjHMLVj.exe

C:\Windows\System\NjHMLVj.exe

C:\Windows\System\jaxlhuX.exe

C:\Windows\System\jaxlhuX.exe

C:\Windows\System\eNBovkS.exe

C:\Windows\System\eNBovkS.exe

C:\Windows\System\bLMIaRj.exe

C:\Windows\System\bLMIaRj.exe

C:\Windows\System\NmMurkO.exe

C:\Windows\System\NmMurkO.exe

C:\Windows\System\LHeUJEZ.exe

C:\Windows\System\LHeUJEZ.exe

C:\Windows\System\quAfpNl.exe

C:\Windows\System\quAfpNl.exe

C:\Windows\System\tlewgxU.exe

C:\Windows\System\tlewgxU.exe

C:\Windows\System\gqSJraP.exe

C:\Windows\System\gqSJraP.exe

C:\Windows\System\uZWmgHm.exe

C:\Windows\System\uZWmgHm.exe

C:\Windows\System\lxPlvxE.exe

C:\Windows\System\lxPlvxE.exe

C:\Windows\System\HURemSR.exe

C:\Windows\System\HURemSR.exe

C:\Windows\System\WEOFNlK.exe

C:\Windows\System\WEOFNlK.exe

C:\Windows\System\cdzQGVS.exe

C:\Windows\System\cdzQGVS.exe

C:\Windows\System\paObzgq.exe

C:\Windows\System\paObzgq.exe

C:\Windows\System\PmSAcWU.exe

C:\Windows\System\PmSAcWU.exe

C:\Windows\System\IORbbvQ.exe

C:\Windows\System\IORbbvQ.exe

C:\Windows\System\FwYGUSm.exe

C:\Windows\System\FwYGUSm.exe

C:\Windows\System\wmEYfwI.exe

C:\Windows\System\wmEYfwI.exe

C:\Windows\System\nePDnCW.exe

C:\Windows\System\nePDnCW.exe

C:\Windows\System\dVOKkDW.exe

C:\Windows\System\dVOKkDW.exe

C:\Windows\System\YOyJevR.exe

C:\Windows\System\YOyJevR.exe

C:\Windows\System\pifZlKG.exe

C:\Windows\System\pifZlKG.exe

C:\Windows\System\YfDDZNg.exe

C:\Windows\System\YfDDZNg.exe

C:\Windows\System\XiCKUma.exe

C:\Windows\System\XiCKUma.exe

C:\Windows\System\GWazcNF.exe

C:\Windows\System\GWazcNF.exe

C:\Windows\System\RoLTZMt.exe

C:\Windows\System\RoLTZMt.exe

C:\Windows\System\tHrOCXy.exe

C:\Windows\System\tHrOCXy.exe

C:\Windows\System\ZQFtjqt.exe

C:\Windows\System\ZQFtjqt.exe

C:\Windows\System\TZpdmYT.exe

C:\Windows\System\TZpdmYT.exe

C:\Windows\System\DubydpR.exe

C:\Windows\System\DubydpR.exe

C:\Windows\System\ditbKKw.exe

C:\Windows\System\ditbKKw.exe

C:\Windows\System\QZpFUko.exe

C:\Windows\System\QZpFUko.exe

C:\Windows\System\hOefyBl.exe

C:\Windows\System\hOefyBl.exe

C:\Windows\System\mOdPpNV.exe

C:\Windows\System\mOdPpNV.exe

C:\Windows\System\kPFdNZU.exe

C:\Windows\System\kPFdNZU.exe

C:\Windows\System\ALjRGlp.exe

C:\Windows\System\ALjRGlp.exe

C:\Windows\System\OqMnsMc.exe

C:\Windows\System\OqMnsMc.exe

C:\Windows\System\nLuxLvB.exe

C:\Windows\System\nLuxLvB.exe

C:\Windows\System\HOQXeBe.exe

C:\Windows\System\HOQXeBe.exe

C:\Windows\System\QOCUgkH.exe

C:\Windows\System\QOCUgkH.exe

C:\Windows\System\eGWzKCl.exe

C:\Windows\System\eGWzKCl.exe

C:\Windows\System\etdAtUG.exe

C:\Windows\System\etdAtUG.exe

C:\Windows\System\trdMWjz.exe

C:\Windows\System\trdMWjz.exe

C:\Windows\System\RDBaIam.exe

C:\Windows\System\RDBaIam.exe

C:\Windows\System\RCRgBTk.exe

C:\Windows\System\RCRgBTk.exe

C:\Windows\System\aeoIryE.exe

C:\Windows\System\aeoIryE.exe

C:\Windows\System\ujSIMRX.exe

C:\Windows\System\ujSIMRX.exe

C:\Windows\System\jRPRhkE.exe

C:\Windows\System\jRPRhkE.exe

C:\Windows\System\QrXZzwa.exe

C:\Windows\System\QrXZzwa.exe

C:\Windows\System\fEckhem.exe

C:\Windows\System\fEckhem.exe

C:\Windows\System\lIPkMYx.exe

C:\Windows\System\lIPkMYx.exe

C:\Windows\System\cyKqksZ.exe

C:\Windows\System\cyKqksZ.exe

C:\Windows\System\ttaQQvo.exe

C:\Windows\System\ttaQQvo.exe

C:\Windows\System\TddufFN.exe

C:\Windows\System\TddufFN.exe

C:\Windows\System\wLDmhAE.exe

C:\Windows\System\wLDmhAE.exe

C:\Windows\System\ZmejgHs.exe

C:\Windows\System\ZmejgHs.exe

C:\Windows\System\xIMbwxJ.exe

C:\Windows\System\xIMbwxJ.exe

C:\Windows\System\hrvHuOg.exe

C:\Windows\System\hrvHuOg.exe

C:\Windows\System\Clskrrs.exe

C:\Windows\System\Clskrrs.exe

C:\Windows\System\UhXOIaP.exe

C:\Windows\System\UhXOIaP.exe

C:\Windows\System\CZSLBhD.exe

C:\Windows\System\CZSLBhD.exe

C:\Windows\System\bFaURTj.exe

C:\Windows\System\bFaURTj.exe

C:\Windows\System\GZncygt.exe

C:\Windows\System\GZncygt.exe

C:\Windows\System\hVkYOWx.exe

C:\Windows\System\hVkYOWx.exe

C:\Windows\System\TfLJaGB.exe

C:\Windows\System\TfLJaGB.exe

C:\Windows\System\Wzltpin.exe

C:\Windows\System\Wzltpin.exe

C:\Windows\System\tzOOdiP.exe

C:\Windows\System\tzOOdiP.exe

C:\Windows\System\QPbWplT.exe

C:\Windows\System\QPbWplT.exe

C:\Windows\System\AIMwMvu.exe

C:\Windows\System\AIMwMvu.exe

C:\Windows\System\IDljiEh.exe

C:\Windows\System\IDljiEh.exe

C:\Windows\System\KDvmyVE.exe

C:\Windows\System\KDvmyVE.exe

C:\Windows\System\gcJScsi.exe

C:\Windows\System\gcJScsi.exe

C:\Windows\System\LIBEayY.exe

C:\Windows\System\LIBEayY.exe

C:\Windows\System\dPBzmlf.exe

C:\Windows\System\dPBzmlf.exe

C:\Windows\System\iwBsgrS.exe

C:\Windows\System\iwBsgrS.exe

C:\Windows\System\nmzDykd.exe

C:\Windows\System\nmzDykd.exe

C:\Windows\System\qHkosul.exe

C:\Windows\System\qHkosul.exe

C:\Windows\System\NSRxPFT.exe

C:\Windows\System\NSRxPFT.exe

C:\Windows\System\OZXooaS.exe

C:\Windows\System\OZXooaS.exe

C:\Windows\System\BkYSWdO.exe

C:\Windows\System\BkYSWdO.exe

C:\Windows\System\olUqZDS.exe

C:\Windows\System\olUqZDS.exe

C:\Windows\System\xpWZceU.exe

C:\Windows\System\xpWZceU.exe

C:\Windows\System\UsxfgVg.exe

C:\Windows\System\UsxfgVg.exe

C:\Windows\System\UrOaIKC.exe

C:\Windows\System\UrOaIKC.exe

C:\Windows\System\zIGtYEC.exe

C:\Windows\System\zIGtYEC.exe

C:\Windows\System\xsXMzuf.exe

C:\Windows\System\xsXMzuf.exe

C:\Windows\System\yOGVWWI.exe

C:\Windows\System\yOGVWWI.exe

C:\Windows\System\XkleLoz.exe

C:\Windows\System\XkleLoz.exe

C:\Windows\System\hIOIyUs.exe

C:\Windows\System\hIOIyUs.exe

C:\Windows\System\McQZNTw.exe

C:\Windows\System\McQZNTw.exe

C:\Windows\System\peDRfqu.exe

C:\Windows\System\peDRfqu.exe

C:\Windows\System\BbCSdCJ.exe

C:\Windows\System\BbCSdCJ.exe

C:\Windows\System\VvugOWN.exe

C:\Windows\System\VvugOWN.exe

C:\Windows\System\bbCgIYo.exe

C:\Windows\System\bbCgIYo.exe

C:\Windows\System\luQszZj.exe

C:\Windows\System\luQszZj.exe

C:\Windows\System\dGyrhuo.exe

C:\Windows\System\dGyrhuo.exe

C:\Windows\System\sxQcnxk.exe

C:\Windows\System\sxQcnxk.exe

C:\Windows\System\mFuOrnH.exe

C:\Windows\System\mFuOrnH.exe

C:\Windows\System\bQxXOwX.exe

C:\Windows\System\bQxXOwX.exe

C:\Windows\System\EVIgOAh.exe

C:\Windows\System\EVIgOAh.exe

C:\Windows\System\MbCKRhC.exe

C:\Windows\System\MbCKRhC.exe

C:\Windows\System\TPiXFNa.exe

C:\Windows\System\TPiXFNa.exe

C:\Windows\System\lQWEJZQ.exe

C:\Windows\System\lQWEJZQ.exe

C:\Windows\System\eCENnFx.exe

C:\Windows\System\eCENnFx.exe

C:\Windows\System\fimwrrR.exe

C:\Windows\System\fimwrrR.exe

C:\Windows\System\JBTODQA.exe

C:\Windows\System\JBTODQA.exe

C:\Windows\System\HGgAggk.exe

C:\Windows\System\HGgAggk.exe

C:\Windows\System\dYSwtlS.exe

C:\Windows\System\dYSwtlS.exe

C:\Windows\System\ZSkAmLq.exe

C:\Windows\System\ZSkAmLq.exe

C:\Windows\System\buBFttM.exe

C:\Windows\System\buBFttM.exe

C:\Windows\System\vPlkQxZ.exe

C:\Windows\System\vPlkQxZ.exe

C:\Windows\System\YPtWRbz.exe

C:\Windows\System\YPtWRbz.exe

C:\Windows\System\eXTKMFG.exe

C:\Windows\System\eXTKMFG.exe

C:\Windows\System\kUCDURU.exe

C:\Windows\System\kUCDURU.exe

C:\Windows\System\XePHHpD.exe

C:\Windows\System\XePHHpD.exe

C:\Windows\System\sRvaGpH.exe

C:\Windows\System\sRvaGpH.exe

C:\Windows\System\YmCeYFC.exe

C:\Windows\System\YmCeYFC.exe

C:\Windows\System\etBPtAL.exe

C:\Windows\System\etBPtAL.exe

C:\Windows\System\neKqEDB.exe

C:\Windows\System\neKqEDB.exe

C:\Windows\System\oNXwqgV.exe

C:\Windows\System\oNXwqgV.exe

C:\Windows\System\RPtKkOG.exe

C:\Windows\System\RPtKkOG.exe

C:\Windows\System\xwPKFoX.exe

C:\Windows\System\xwPKFoX.exe

C:\Windows\System\xiABLOZ.exe

C:\Windows\System\xiABLOZ.exe

C:\Windows\System\DHTQimn.exe

C:\Windows\System\DHTQimn.exe

C:\Windows\System\rRiWYed.exe

C:\Windows\System\rRiWYed.exe

C:\Windows\System\HTqVugt.exe

C:\Windows\System\HTqVugt.exe

C:\Windows\System\QrVVmas.exe

C:\Windows\System\QrVVmas.exe

C:\Windows\System\CBDjkUz.exe

C:\Windows\System\CBDjkUz.exe

C:\Windows\System\FJMrOyN.exe

C:\Windows\System\FJMrOyN.exe

C:\Windows\System\zWDnlYD.exe

C:\Windows\System\zWDnlYD.exe

C:\Windows\System\URbIcOE.exe

C:\Windows\System\URbIcOE.exe

C:\Windows\System\xNqMHuJ.exe

C:\Windows\System\xNqMHuJ.exe

C:\Windows\System\yYbVmlK.exe

C:\Windows\System\yYbVmlK.exe

C:\Windows\System\gOBBrnW.exe

C:\Windows\System\gOBBrnW.exe

C:\Windows\System\bpddGCn.exe

C:\Windows\System\bpddGCn.exe

C:\Windows\System\JpxZaXg.exe

C:\Windows\System\JpxZaXg.exe

C:\Windows\System\ekChglE.exe

C:\Windows\System\ekChglE.exe

C:\Windows\System\dcpdEzF.exe

C:\Windows\System\dcpdEzF.exe

C:\Windows\System\DNYUufR.exe

C:\Windows\System\DNYUufR.exe

C:\Windows\System\TysyHLs.exe

C:\Windows\System\TysyHLs.exe

C:\Windows\System\pdKwnRb.exe

C:\Windows\System\pdKwnRb.exe

C:\Windows\System\POYBYZy.exe

C:\Windows\System\POYBYZy.exe

C:\Windows\System\sClMnok.exe

C:\Windows\System\sClMnok.exe

C:\Windows\System\jBzqHpD.exe

C:\Windows\System\jBzqHpD.exe

C:\Windows\System\dIwgzov.exe

C:\Windows\System\dIwgzov.exe

C:\Windows\System\yANPbPA.exe

C:\Windows\System\yANPbPA.exe

C:\Windows\System\fLKdVvI.exe

C:\Windows\System\fLKdVvI.exe

C:\Windows\System\dqYlUkC.exe

C:\Windows\System\dqYlUkC.exe

C:\Windows\System\NVGqxSC.exe

C:\Windows\System\NVGqxSC.exe

C:\Windows\System\jveWVpd.exe

C:\Windows\System\jveWVpd.exe

C:\Windows\System\FdBAupT.exe

C:\Windows\System\FdBAupT.exe

C:\Windows\System\XBpHrMw.exe

C:\Windows\System\XBpHrMw.exe

C:\Windows\System\BseXZPs.exe

C:\Windows\System\BseXZPs.exe

C:\Windows\System\aHWhzkr.exe

C:\Windows\System\aHWhzkr.exe

C:\Windows\System\nefnAyQ.exe

C:\Windows\System\nefnAyQ.exe

C:\Windows\System\fXWRXCe.exe

C:\Windows\System\fXWRXCe.exe

C:\Windows\System\MBIHMOO.exe

C:\Windows\System\MBIHMOO.exe

C:\Windows\System\wxwUfuh.exe

C:\Windows\System\wxwUfuh.exe

C:\Windows\System\ieQZeZa.exe

C:\Windows\System\ieQZeZa.exe

C:\Windows\System\FTpdHJW.exe

C:\Windows\System\FTpdHJW.exe

C:\Windows\System\COwPHxc.exe

C:\Windows\System\COwPHxc.exe

C:\Windows\System\LzEuoix.exe

C:\Windows\System\LzEuoix.exe

C:\Windows\System\kvUYXWj.exe

C:\Windows\System\kvUYXWj.exe

C:\Windows\System\fbxaWqd.exe

C:\Windows\System\fbxaWqd.exe

C:\Windows\System\azCJLHc.exe

C:\Windows\System\azCJLHc.exe

C:\Windows\System\SpqqiMP.exe

C:\Windows\System\SpqqiMP.exe

C:\Windows\System\aKZECUo.exe

C:\Windows\System\aKZECUo.exe

C:\Windows\System\dhjAwLX.exe

C:\Windows\System\dhjAwLX.exe

C:\Windows\System\MbhUHEX.exe

C:\Windows\System\MbhUHEX.exe

C:\Windows\System\vctIkJp.exe

C:\Windows\System\vctIkJp.exe

C:\Windows\System\reDtCcf.exe

C:\Windows\System\reDtCcf.exe

C:\Windows\System\kOahDES.exe

C:\Windows\System\kOahDES.exe

C:\Windows\System\uiFUUNQ.exe

C:\Windows\System\uiFUUNQ.exe

C:\Windows\System\WbZYcvR.exe

C:\Windows\System\WbZYcvR.exe

C:\Windows\System\rTidJNr.exe

C:\Windows\System\rTidJNr.exe

C:\Windows\System\qUGcvLC.exe

C:\Windows\System\qUGcvLC.exe

C:\Windows\System\mALxCeb.exe

C:\Windows\System\mALxCeb.exe

C:\Windows\System\JbifMaB.exe

C:\Windows\System\JbifMaB.exe

C:\Windows\System\cPCoaFV.exe

C:\Windows\System\cPCoaFV.exe

C:\Windows\System\eJIUARy.exe

C:\Windows\System\eJIUARy.exe

C:\Windows\System\brWtKgM.exe

C:\Windows\System\brWtKgM.exe

C:\Windows\System\sbfqUIS.exe

C:\Windows\System\sbfqUIS.exe

C:\Windows\System\ppOHcmt.exe

C:\Windows\System\ppOHcmt.exe

C:\Windows\System\OYqJKHS.exe

C:\Windows\System\OYqJKHS.exe

C:\Windows\System\SAnFsep.exe

C:\Windows\System\SAnFsep.exe

C:\Windows\System\KRkiSwN.exe

C:\Windows\System\KRkiSwN.exe

C:\Windows\System\WBwxclj.exe

C:\Windows\System\WBwxclj.exe

C:\Windows\System\dOKJZiU.exe

C:\Windows\System\dOKJZiU.exe

C:\Windows\System\rMuuhAd.exe

C:\Windows\System\rMuuhAd.exe

C:\Windows\System\eGSlSgk.exe

C:\Windows\System\eGSlSgk.exe

C:\Windows\System\LJzrklC.exe

C:\Windows\System\LJzrklC.exe

C:\Windows\System\LeKUbgX.exe

C:\Windows\System\LeKUbgX.exe

C:\Windows\System\aRgILqe.exe

C:\Windows\System\aRgILqe.exe

C:\Windows\System\TIilbhm.exe

C:\Windows\System\TIilbhm.exe

C:\Windows\System\eRMQPjD.exe

C:\Windows\System\eRMQPjD.exe

C:\Windows\System\RkEpNSN.exe

C:\Windows\System\RkEpNSN.exe

C:\Windows\System\EonWVva.exe

C:\Windows\System\EonWVva.exe

C:\Windows\System\CrkSttg.exe

C:\Windows\System\CrkSttg.exe

C:\Windows\System\dqJkYVR.exe

C:\Windows\System\dqJkYVR.exe

C:\Windows\System\FuCDKEu.exe

C:\Windows\System\FuCDKEu.exe

C:\Windows\System\PyvkjnM.exe

C:\Windows\System\PyvkjnM.exe

C:\Windows\System\KlHwHvG.exe

C:\Windows\System\KlHwHvG.exe

C:\Windows\System\nIaHoXs.exe

C:\Windows\System\nIaHoXs.exe

C:\Windows\System\RIstQKR.exe

C:\Windows\System\RIstQKR.exe

C:\Windows\System\AThVxOB.exe

C:\Windows\System\AThVxOB.exe

C:\Windows\System\HVVPZKV.exe

C:\Windows\System\HVVPZKV.exe

C:\Windows\System\vcwRbcF.exe

C:\Windows\System\vcwRbcF.exe

C:\Windows\System\NPEuqyT.exe

C:\Windows\System\NPEuqyT.exe

C:\Windows\System\ccfkUIB.exe

C:\Windows\System\ccfkUIB.exe

C:\Windows\System\XbRBxUP.exe

C:\Windows\System\XbRBxUP.exe

C:\Windows\System\lZuKaGZ.exe

C:\Windows\System\lZuKaGZ.exe

C:\Windows\System\FfybAjs.exe

C:\Windows\System\FfybAjs.exe

C:\Windows\System\QFnYRON.exe

C:\Windows\System\QFnYRON.exe

C:\Windows\System\EUkHIgV.exe

C:\Windows\System\EUkHIgV.exe

C:\Windows\System\DbOjQOt.exe

C:\Windows\System\DbOjQOt.exe

C:\Windows\System\cKTRmxZ.exe

C:\Windows\System\cKTRmxZ.exe

C:\Windows\System\smIgTNV.exe

C:\Windows\System\smIgTNV.exe

C:\Windows\System\gGahXiI.exe

C:\Windows\System\gGahXiI.exe

C:\Windows\System\DvSQRxX.exe

C:\Windows\System\DvSQRxX.exe

C:\Windows\System\zVsnOhQ.exe

C:\Windows\System\zVsnOhQ.exe

C:\Windows\System\qvMfsni.exe

C:\Windows\System\qvMfsni.exe

C:\Windows\System\ktNbVpv.exe

C:\Windows\System\ktNbVpv.exe

C:\Windows\System\LWdjvLf.exe

C:\Windows\System\LWdjvLf.exe

C:\Windows\System\WPBEoeg.exe

C:\Windows\System\WPBEoeg.exe

C:\Windows\System\ltcqwdN.exe

C:\Windows\System\ltcqwdN.exe

C:\Windows\System\TEkbvMG.exe

C:\Windows\System\TEkbvMG.exe

C:\Windows\System\DoykwQw.exe

C:\Windows\System\DoykwQw.exe

C:\Windows\System\oQgyGdb.exe

C:\Windows\System\oQgyGdb.exe

C:\Windows\System\guWEQaM.exe

C:\Windows\System\guWEQaM.exe

C:\Windows\System\XMlVPmK.exe

C:\Windows\System\XMlVPmK.exe

C:\Windows\System\LTJOJUk.exe

C:\Windows\System\LTJOJUk.exe

C:\Windows\System\zwjLILw.exe

C:\Windows\System\zwjLILw.exe

C:\Windows\System\mOMLvMj.exe

C:\Windows\System\mOMLvMj.exe

C:\Windows\System\CTZsKzG.exe

C:\Windows\System\CTZsKzG.exe

C:\Windows\System\ycEWAQD.exe

C:\Windows\System\ycEWAQD.exe

C:\Windows\System\hPKVgWX.exe

C:\Windows\System\hPKVgWX.exe

C:\Windows\System\jxKVJsZ.exe

C:\Windows\System\jxKVJsZ.exe

C:\Windows\System\jPQiPtr.exe

C:\Windows\System\jPQiPtr.exe

C:\Windows\System\IiLChML.exe

C:\Windows\System\IiLChML.exe

C:\Windows\System\EVTHzCn.exe

C:\Windows\System\EVTHzCn.exe

C:\Windows\System\wDZTvTC.exe

C:\Windows\System\wDZTvTC.exe

C:\Windows\System\XlukvdS.exe

C:\Windows\System\XlukvdS.exe

C:\Windows\System\ipzNtps.exe

C:\Windows\System\ipzNtps.exe

C:\Windows\System\WKXRWNL.exe

C:\Windows\System\WKXRWNL.exe

C:\Windows\System\ugUJOJo.exe

C:\Windows\System\ugUJOJo.exe

C:\Windows\System\jHRgGuu.exe

C:\Windows\System\jHRgGuu.exe

C:\Windows\System\rrslzAl.exe

C:\Windows\System\rrslzAl.exe

C:\Windows\System\dvvPwfJ.exe

C:\Windows\System\dvvPwfJ.exe

C:\Windows\System\eijKxmU.exe

C:\Windows\System\eijKxmU.exe

C:\Windows\System\OCmaZle.exe

C:\Windows\System\OCmaZle.exe

C:\Windows\System\xdSPNsO.exe

C:\Windows\System\xdSPNsO.exe

C:\Windows\System\ovosXVX.exe

C:\Windows\System\ovosXVX.exe

C:\Windows\System\kEcisUd.exe

C:\Windows\System\kEcisUd.exe

C:\Windows\System\uSMnLsp.exe

C:\Windows\System\uSMnLsp.exe

C:\Windows\System\xeLeYhL.exe

C:\Windows\System\xeLeYhL.exe

C:\Windows\System\ruXRdyi.exe

C:\Windows\System\ruXRdyi.exe

C:\Windows\System\VegsotM.exe

C:\Windows\System\VegsotM.exe

C:\Windows\System\DlODzHo.exe

C:\Windows\System\DlODzHo.exe

C:\Windows\System\mGLryTm.exe

C:\Windows\System\mGLryTm.exe

C:\Windows\System\vNVMjSt.exe

C:\Windows\System\vNVMjSt.exe

C:\Windows\System\WfUgjoA.exe

C:\Windows\System\WfUgjoA.exe

C:\Windows\System\WZfOWrU.exe

C:\Windows\System\WZfOWrU.exe

C:\Windows\System\SLhDgCi.exe

C:\Windows\System\SLhDgCi.exe

C:\Windows\System\qjgGJTi.exe

C:\Windows\System\qjgGJTi.exe

C:\Windows\System\LanpBxC.exe

C:\Windows\System\LanpBxC.exe

C:\Windows\System\qqxcVdJ.exe

C:\Windows\System\qqxcVdJ.exe

C:\Windows\System\IRvBarx.exe

C:\Windows\System\IRvBarx.exe

C:\Windows\System\sfbeqgH.exe

C:\Windows\System\sfbeqgH.exe

C:\Windows\System\uQlqwYd.exe

C:\Windows\System\uQlqwYd.exe

C:\Windows\System\dFBkWmG.exe

C:\Windows\System\dFBkWmG.exe

C:\Windows\System\atgvmpF.exe

C:\Windows\System\atgvmpF.exe

C:\Windows\System\zIubPhm.exe

C:\Windows\System\zIubPhm.exe

C:\Windows\System\hSNgqlU.exe

C:\Windows\System\hSNgqlU.exe

C:\Windows\System\sOyYFkh.exe

C:\Windows\System\sOyYFkh.exe

C:\Windows\System\gPqFXwP.exe

C:\Windows\System\gPqFXwP.exe

C:\Windows\System\uKffVlL.exe

C:\Windows\System\uKffVlL.exe

C:\Windows\System\juCeqsH.exe

C:\Windows\System\juCeqsH.exe

C:\Windows\System\fHVGKDt.exe

C:\Windows\System\fHVGKDt.exe

C:\Windows\System\CFETDwK.exe

C:\Windows\System\CFETDwK.exe

C:\Windows\System\cvOUMgk.exe

C:\Windows\System\cvOUMgk.exe

C:\Windows\System\pRWVOTD.exe

C:\Windows\System\pRWVOTD.exe

C:\Windows\System\rhqqlOl.exe

C:\Windows\System\rhqqlOl.exe

C:\Windows\System\ReowqPK.exe

C:\Windows\System\ReowqPK.exe

C:\Windows\System\yMmsEYT.exe

C:\Windows\System\yMmsEYT.exe

C:\Windows\System\dQMryJp.exe

C:\Windows\System\dQMryJp.exe

C:\Windows\System\JOBtAjK.exe

C:\Windows\System\JOBtAjK.exe

C:\Windows\System\PZEWijA.exe

C:\Windows\System\PZEWijA.exe

C:\Windows\System\LranCwh.exe

C:\Windows\System\LranCwh.exe

C:\Windows\System\jBzqBQo.exe

C:\Windows\System\jBzqBQo.exe

C:\Windows\System\TywkZLp.exe

C:\Windows\System\TywkZLp.exe

C:\Windows\System\IunaJSW.exe

C:\Windows\System\IunaJSW.exe

C:\Windows\System\PaDZCGi.exe

C:\Windows\System\PaDZCGi.exe

C:\Windows\System\uCgFeEE.exe

C:\Windows\System\uCgFeEE.exe

C:\Windows\System\XpadtPu.exe

C:\Windows\System\XpadtPu.exe

C:\Windows\System\RciIOln.exe

C:\Windows\System\RciIOln.exe

C:\Windows\System\uDLWyYY.exe

C:\Windows\System\uDLWyYY.exe

C:\Windows\System\qDtYgLL.exe

C:\Windows\System\qDtYgLL.exe

C:\Windows\System\MiyMXkd.exe

C:\Windows\System\MiyMXkd.exe

C:\Windows\System\yDRpiEU.exe

C:\Windows\System\yDRpiEU.exe

C:\Windows\System\wIRXqol.exe

C:\Windows\System\wIRXqol.exe

C:\Windows\System\ngtjQaZ.exe

C:\Windows\System\ngtjQaZ.exe

C:\Windows\System\azeHeTO.exe

C:\Windows\System\azeHeTO.exe

C:\Windows\System\NNGcPwe.exe

C:\Windows\System\NNGcPwe.exe

C:\Windows\System\iOtXJaI.exe

C:\Windows\System\iOtXJaI.exe

C:\Windows\System\IIjDFme.exe

C:\Windows\System\IIjDFme.exe

C:\Windows\System\wMQtfdR.exe

C:\Windows\System\wMQtfdR.exe

C:\Windows\System\rosXMtF.exe

C:\Windows\System\rosXMtF.exe

C:\Windows\System\EmdcwVQ.exe

C:\Windows\System\EmdcwVQ.exe

C:\Windows\System\tczSckY.exe

C:\Windows\System\tczSckY.exe

C:\Windows\System\xgxFVVr.exe

C:\Windows\System\xgxFVVr.exe

C:\Windows\System\usSLkvv.exe

C:\Windows\System\usSLkvv.exe

C:\Windows\System\bqcCJpg.exe

C:\Windows\System\bqcCJpg.exe

C:\Windows\System\kGWJKmo.exe

C:\Windows\System\kGWJKmo.exe

C:\Windows\System\nztLXbG.exe

C:\Windows\System\nztLXbG.exe

C:\Windows\System\eTYoqSH.exe

C:\Windows\System\eTYoqSH.exe

C:\Windows\System\hFaKtwH.exe

C:\Windows\System\hFaKtwH.exe

C:\Windows\System\xKfWpmU.exe

C:\Windows\System\xKfWpmU.exe

C:\Windows\System\hVCVocK.exe

C:\Windows\System\hVCVocK.exe

C:\Windows\System\EPUtWEX.exe

C:\Windows\System\EPUtWEX.exe

C:\Windows\System\opMiwFF.exe

C:\Windows\System\opMiwFF.exe

C:\Windows\System\xpqGAIa.exe

C:\Windows\System\xpqGAIa.exe

C:\Windows\System\viDfhLS.exe

C:\Windows\System\viDfhLS.exe

C:\Windows\System\NJaEByn.exe

C:\Windows\System\NJaEByn.exe

C:\Windows\System\nklXduL.exe

C:\Windows\System\nklXduL.exe

C:\Windows\System\kOmSrip.exe

C:\Windows\System\kOmSrip.exe

C:\Windows\System\BYIEEQw.exe

C:\Windows\System\BYIEEQw.exe

C:\Windows\System\EwTsLJe.exe

C:\Windows\System\EwTsLJe.exe

C:\Windows\System\DHAeiLO.exe

C:\Windows\System\DHAeiLO.exe

C:\Windows\System\IwamEPB.exe

C:\Windows\System\IwamEPB.exe

C:\Windows\System\DmIQZQB.exe

C:\Windows\System\DmIQZQB.exe

C:\Windows\System\gDPioKy.exe

C:\Windows\System\gDPioKy.exe

C:\Windows\System\iUaNnyG.exe

C:\Windows\System\iUaNnyG.exe

C:\Windows\System\tNyMSMV.exe

C:\Windows\System\tNyMSMV.exe

C:\Windows\System\JKpcjNo.exe

C:\Windows\System\JKpcjNo.exe

C:\Windows\System\xaZVbck.exe

C:\Windows\System\xaZVbck.exe

C:\Windows\System\hYZFCuY.exe

C:\Windows\System\hYZFCuY.exe

C:\Windows\System\NhGGgcQ.exe

C:\Windows\System\NhGGgcQ.exe

C:\Windows\System\akgLTZe.exe

C:\Windows\System\akgLTZe.exe

C:\Windows\System\WAcnkBq.exe

C:\Windows\System\WAcnkBq.exe

C:\Windows\System\tSuJFCn.exe

C:\Windows\System\tSuJFCn.exe

C:\Windows\System\DmVldTI.exe

C:\Windows\System\DmVldTI.exe

C:\Windows\System\HPxUlVT.exe

C:\Windows\System\HPxUlVT.exe

C:\Windows\System\kKrodUW.exe

C:\Windows\System\kKrodUW.exe

C:\Windows\System\JLBfbFS.exe

C:\Windows\System\JLBfbFS.exe

C:\Windows\System\wiTAIce.exe

C:\Windows\System\wiTAIce.exe

C:\Windows\System\GbIXWgp.exe

C:\Windows\System\GbIXWgp.exe

C:\Windows\System\xLlSXhD.exe

C:\Windows\System\xLlSXhD.exe

C:\Windows\System\mFPLfDX.exe

C:\Windows\System\mFPLfDX.exe

C:\Windows\System\QEJMSOg.exe

C:\Windows\System\QEJMSOg.exe

C:\Windows\System\hhsGvkS.exe

C:\Windows\System\hhsGvkS.exe

C:\Windows\System\wIPhUAk.exe

C:\Windows\System\wIPhUAk.exe

C:\Windows\System\cOwLfwV.exe

C:\Windows\System\cOwLfwV.exe

C:\Windows\System\zHtmmiP.exe

C:\Windows\System\zHtmmiP.exe

C:\Windows\System\QTaNIPI.exe

C:\Windows\System\QTaNIPI.exe

C:\Windows\System\ghvGiUZ.exe

C:\Windows\System\ghvGiUZ.exe

C:\Windows\System\YZombgj.exe

C:\Windows\System\YZombgj.exe

C:\Windows\System\cczhraP.exe

C:\Windows\System\cczhraP.exe

C:\Windows\System\wXHNfgH.exe

C:\Windows\System\wXHNfgH.exe

C:\Windows\System\rcUDOwp.exe

C:\Windows\System\rcUDOwp.exe

C:\Windows\System\hdqPFrz.exe

C:\Windows\System\hdqPFrz.exe

C:\Windows\System\YZCvFPw.exe

C:\Windows\System\YZCvFPw.exe

C:\Windows\System\XUcUuCo.exe

C:\Windows\System\XUcUuCo.exe

C:\Windows\System\RJFjMTD.exe

C:\Windows\System\RJFjMTD.exe

C:\Windows\System\dUKUHah.exe

C:\Windows\System\dUKUHah.exe

C:\Windows\System\sfZthIY.exe

C:\Windows\System\sfZthIY.exe

C:\Windows\System\TqfmdgH.exe

C:\Windows\System\TqfmdgH.exe

C:\Windows\System\igRurNB.exe

C:\Windows\System\igRurNB.exe

C:\Windows\System\smxXljc.exe

C:\Windows\System\smxXljc.exe

C:\Windows\System\XmQWbiy.exe

C:\Windows\System\XmQWbiy.exe

C:\Windows\System\uCHPufE.exe

C:\Windows\System\uCHPufE.exe

C:\Windows\System\aRslEku.exe

C:\Windows\System\aRslEku.exe

C:\Windows\System\tzrmDcO.exe

C:\Windows\System\tzrmDcO.exe

C:\Windows\System\AQXzJEX.exe

C:\Windows\System\AQXzJEX.exe

C:\Windows\System\BrZkwrx.exe

C:\Windows\System\BrZkwrx.exe

C:\Windows\System\ReeSjvJ.exe

C:\Windows\System\ReeSjvJ.exe

C:\Windows\System\ScuGjJG.exe

C:\Windows\System\ScuGjJG.exe

C:\Windows\System\gMkAytm.exe

C:\Windows\System\gMkAytm.exe

C:\Windows\System\Mvedmgx.exe

C:\Windows\System\Mvedmgx.exe

C:\Windows\System\dfoDXos.exe

C:\Windows\System\dfoDXos.exe

C:\Windows\System\ddHDcSY.exe

C:\Windows\System\ddHDcSY.exe

C:\Windows\System\CNDwRFS.exe

C:\Windows\System\CNDwRFS.exe

C:\Windows\System\udDIRvx.exe

C:\Windows\System\udDIRvx.exe

C:\Windows\System\bryIroG.exe

C:\Windows\System\bryIroG.exe

C:\Windows\System\ZBzQCmi.exe

C:\Windows\System\ZBzQCmi.exe

C:\Windows\System\AWIXNPS.exe

C:\Windows\System\AWIXNPS.exe

C:\Windows\System\MXRjxYe.exe

C:\Windows\System\MXRjxYe.exe

C:\Windows\System\ZSksVWd.exe

C:\Windows\System\ZSksVWd.exe

C:\Windows\System\NBsTEta.exe

C:\Windows\System\NBsTEta.exe

C:\Windows\System\ixyCNli.exe

C:\Windows\System\ixyCNli.exe

C:\Windows\System\ZKERuBe.exe

C:\Windows\System\ZKERuBe.exe

C:\Windows\System\dcKZXRW.exe

C:\Windows\System\dcKZXRW.exe

C:\Windows\System\rzxPNFs.exe

C:\Windows\System\rzxPNFs.exe

C:\Windows\System\HrQovMh.exe

C:\Windows\System\HrQovMh.exe

C:\Windows\System\sithjtj.exe

C:\Windows\System\sithjtj.exe

C:\Windows\System\CDbhedl.exe

C:\Windows\System\CDbhedl.exe

C:\Windows\System\mSnYNLa.exe

C:\Windows\System\mSnYNLa.exe

C:\Windows\System\wBwKeWX.exe

C:\Windows\System\wBwKeWX.exe

C:\Windows\System\ouLDgEP.exe

C:\Windows\System\ouLDgEP.exe

C:\Windows\System\warcGYi.exe

C:\Windows\System\warcGYi.exe

C:\Windows\System\bwpbrxK.exe

C:\Windows\System\bwpbrxK.exe

C:\Windows\System\yqDqmoB.exe

C:\Windows\System\yqDqmoB.exe

C:\Windows\System\jxgkuIz.exe

C:\Windows\System\jxgkuIz.exe

C:\Windows\System\iGGwWei.exe

C:\Windows\System\iGGwWei.exe

C:\Windows\System\Xgyzxjs.exe

C:\Windows\System\Xgyzxjs.exe

C:\Windows\System\SluUThw.exe

C:\Windows\System\SluUThw.exe

C:\Windows\System\mYQIUHC.exe

C:\Windows\System\mYQIUHC.exe

C:\Windows\System\PfTJFVt.exe

C:\Windows\System\PfTJFVt.exe

C:\Windows\System\abOmkoA.exe

C:\Windows\System\abOmkoA.exe

C:\Windows\System\hBTJThu.exe

C:\Windows\System\hBTJThu.exe

C:\Windows\System\NJbpYHc.exe

C:\Windows\System\NJbpYHc.exe

C:\Windows\System\zhNTUbN.exe

C:\Windows\System\zhNTUbN.exe

C:\Windows\System\BEshZeQ.exe

C:\Windows\System\BEshZeQ.exe

C:\Windows\System\zhEGdwR.exe

C:\Windows\System\zhEGdwR.exe

C:\Windows\System\HmfJCRr.exe

C:\Windows\System\HmfJCRr.exe

C:\Windows\System\xasBjnX.exe

C:\Windows\System\xasBjnX.exe

C:\Windows\System\tlYjmWA.exe

C:\Windows\System\tlYjmWA.exe

C:\Windows\System\deuErpo.exe

C:\Windows\System\deuErpo.exe

C:\Windows\System\IfYsJBC.exe

C:\Windows\System\IfYsJBC.exe

C:\Windows\System\tLHKgJG.exe

C:\Windows\System\tLHKgJG.exe

C:\Windows\System\nmVWHpg.exe

C:\Windows\System\nmVWHpg.exe

C:\Windows\System\vPPTevZ.exe

C:\Windows\System\vPPTevZ.exe

C:\Windows\System\DzXXlBZ.exe

C:\Windows\System\DzXXlBZ.exe

C:\Windows\System\MMQKXpm.exe

C:\Windows\System\MMQKXpm.exe

C:\Windows\System\zXZjncB.exe

C:\Windows\System\zXZjncB.exe

C:\Windows\System\VZOVqGL.exe

C:\Windows\System\VZOVqGL.exe

C:\Windows\System\KKrBnld.exe

C:\Windows\System\KKrBnld.exe

C:\Windows\System\OnoXqJO.exe

C:\Windows\System\OnoXqJO.exe

C:\Windows\System\UZzAhXu.exe

C:\Windows\System\UZzAhXu.exe

C:\Windows\System\VtWcMNW.exe

C:\Windows\System\VtWcMNW.exe

C:\Windows\System\DmrrURY.exe

C:\Windows\System\DmrrURY.exe

C:\Windows\System\bSKJBBb.exe

C:\Windows\System\bSKJBBb.exe

C:\Windows\System\SOdLkir.exe

C:\Windows\System\SOdLkir.exe

C:\Windows\System\fOscNtA.exe

C:\Windows\System\fOscNtA.exe

C:\Windows\System\XrfVLrW.exe

C:\Windows\System\XrfVLrW.exe

C:\Windows\System\HQQZrrV.exe

C:\Windows\System\HQQZrrV.exe

C:\Windows\System\bNXHxLa.exe

C:\Windows\System\bNXHxLa.exe

C:\Windows\System\oblArmJ.exe

C:\Windows\System\oblArmJ.exe

C:\Windows\System\PzceTNN.exe

C:\Windows\System\PzceTNN.exe

C:\Windows\System\wbOJAxi.exe

C:\Windows\System\wbOJAxi.exe

C:\Windows\System\lRWqDKH.exe

C:\Windows\System\lRWqDKH.exe

C:\Windows\System\mfGoTEN.exe

C:\Windows\System\mfGoTEN.exe

C:\Windows\System\piPYQqg.exe

C:\Windows\System\piPYQqg.exe

C:\Windows\System\XYotFaD.exe

C:\Windows\System\XYotFaD.exe

C:\Windows\System\SvqqTJN.exe

C:\Windows\System\SvqqTJN.exe

C:\Windows\System\bLEeqWH.exe

C:\Windows\System\bLEeqWH.exe

C:\Windows\System\luTTDSF.exe

C:\Windows\System\luTTDSF.exe

C:\Windows\System\erBdxqx.exe

C:\Windows\System\erBdxqx.exe

C:\Windows\System\Hvnzidv.exe

C:\Windows\System\Hvnzidv.exe

C:\Windows\System\VwoaHdw.exe

C:\Windows\System\VwoaHdw.exe

C:\Windows\System\VDUkQDS.exe

C:\Windows\System\VDUkQDS.exe

C:\Windows\System\PMVLYIk.exe

C:\Windows\System\PMVLYIk.exe

C:\Windows\System\xPLnGAR.exe

C:\Windows\System\xPLnGAR.exe

C:\Windows\System\tjuxpri.exe

C:\Windows\System\tjuxpri.exe

C:\Windows\System\ThcwUVw.exe

C:\Windows\System\ThcwUVw.exe

C:\Windows\System\vkyyeOp.exe

C:\Windows\System\vkyyeOp.exe

C:\Windows\System\cvasaYS.exe

C:\Windows\System\cvasaYS.exe

C:\Windows\System\lQiimle.exe

C:\Windows\System\lQiimle.exe

C:\Windows\System\ZWrKfLc.exe

C:\Windows\System\ZWrKfLc.exe

C:\Windows\System\iRZnccR.exe

C:\Windows\System\iRZnccR.exe

C:\Windows\System\UWstLkf.exe

C:\Windows\System\UWstLkf.exe

C:\Windows\System\ANAlMpZ.exe

C:\Windows\System\ANAlMpZ.exe

C:\Windows\System\gfpgRrL.exe

C:\Windows\System\gfpgRrL.exe

C:\Windows\System\ruynXWv.exe

C:\Windows\System\ruynXWv.exe

C:\Windows\System\twSCvti.exe

C:\Windows\System\twSCvti.exe

C:\Windows\System\mdiNEnA.exe

C:\Windows\System\mdiNEnA.exe

C:\Windows\System\FPEcogm.exe

C:\Windows\System\FPEcogm.exe

C:\Windows\System\QxWnrPb.exe

C:\Windows\System\QxWnrPb.exe

C:\Windows\System\fnovWkm.exe

C:\Windows\System\fnovWkm.exe

C:\Windows\System\dpYoCTg.exe

C:\Windows\System\dpYoCTg.exe

C:\Windows\System\HgvUvIG.exe

C:\Windows\System\HgvUvIG.exe

C:\Windows\System\OoAHTok.exe

C:\Windows\System\OoAHTok.exe

C:\Windows\System\bnYHozg.exe

C:\Windows\System\bnYHozg.exe

C:\Windows\System\ItOxmSP.exe

C:\Windows\System\ItOxmSP.exe

C:\Windows\System\MDbEtse.exe

C:\Windows\System\MDbEtse.exe

C:\Windows\System\YKlGNVt.exe

C:\Windows\System\YKlGNVt.exe

C:\Windows\System\hRLewUf.exe

C:\Windows\System\hRLewUf.exe

C:\Windows\System\OlowZgm.exe

C:\Windows\System\OlowZgm.exe

C:\Windows\System\fYkTaat.exe

C:\Windows\System\fYkTaat.exe

C:\Windows\System\PQpKloJ.exe

C:\Windows\System\PQpKloJ.exe

C:\Windows\System\CQkQjiy.exe

C:\Windows\System\CQkQjiy.exe

C:\Windows\System\BMiBgnW.exe

C:\Windows\System\BMiBgnW.exe

C:\Windows\System\VboDFJQ.exe

C:\Windows\System\VboDFJQ.exe

C:\Windows\System\saZoVNj.exe

C:\Windows\System\saZoVNj.exe

C:\Windows\System\MpFdcWq.exe

C:\Windows\System\MpFdcWq.exe

C:\Windows\System\lJghflX.exe

C:\Windows\System\lJghflX.exe

C:\Windows\System\ZhbIXqM.exe

C:\Windows\System\ZhbIXqM.exe

C:\Windows\System\aAwuLkK.exe

C:\Windows\System\aAwuLkK.exe

C:\Windows\System\GEZFPOn.exe

C:\Windows\System\GEZFPOn.exe

C:\Windows\System\IHcKXsm.exe

C:\Windows\System\IHcKXsm.exe

C:\Windows\System\FzfzaGe.exe

C:\Windows\System\FzfzaGe.exe

C:\Windows\System\JUGiEoy.exe

C:\Windows\System\JUGiEoy.exe

C:\Windows\System\RgYmfsb.exe

C:\Windows\System\RgYmfsb.exe

C:\Windows\System\zPMjpbM.exe

C:\Windows\System\zPMjpbM.exe

C:\Windows\System\cseELSf.exe

C:\Windows\System\cseELSf.exe

C:\Windows\System\kwQNhqo.exe

C:\Windows\System\kwQNhqo.exe

C:\Windows\System\cSrxUbF.exe

C:\Windows\System\cSrxUbF.exe

C:\Windows\System\SjTtMEL.exe

C:\Windows\System\SjTtMEL.exe

C:\Windows\System\lcgROoP.exe

C:\Windows\System\lcgROoP.exe

C:\Windows\System\yZSLnSZ.exe

C:\Windows\System\yZSLnSZ.exe

C:\Windows\System\sSjiUmv.exe

C:\Windows\System\sSjiUmv.exe

C:\Windows\System\TyrjcRy.exe

C:\Windows\System\TyrjcRy.exe

C:\Windows\System\HmSWWeB.exe

C:\Windows\System\HmSWWeB.exe

C:\Windows\System\rLIdzRi.exe

C:\Windows\System\rLIdzRi.exe

C:\Windows\System\kPuqaJD.exe

C:\Windows\System\kPuqaJD.exe

C:\Windows\System\GADUIPh.exe

C:\Windows\System\GADUIPh.exe

C:\Windows\System\CateLFK.exe

C:\Windows\System\CateLFK.exe

C:\Windows\System\SrDeunH.exe

C:\Windows\System\SrDeunH.exe

C:\Windows\System\KaFYCKh.exe

C:\Windows\System\KaFYCKh.exe

C:\Windows\System\MhLsGkv.exe

C:\Windows\System\MhLsGkv.exe

C:\Windows\System\mpyQwRa.exe

C:\Windows\System\mpyQwRa.exe

C:\Windows\System\ybhJaZC.exe

C:\Windows\System\ybhJaZC.exe

C:\Windows\System\UCcHwpT.exe

C:\Windows\System\UCcHwpT.exe

C:\Windows\System\tUgkgKy.exe

C:\Windows\System\tUgkgKy.exe

C:\Windows\System\mfFhtTQ.exe

C:\Windows\System\mfFhtTQ.exe

C:\Windows\System\kMRwwzE.exe

C:\Windows\System\kMRwwzE.exe

C:\Windows\System\zKsEhCu.exe

C:\Windows\System\zKsEhCu.exe

C:\Windows\System\fVcGjuE.exe

C:\Windows\System\fVcGjuE.exe

C:\Windows\System\gFnCSOA.exe

C:\Windows\System\gFnCSOA.exe

C:\Windows\System\lHXhfFC.exe

C:\Windows\System\lHXhfFC.exe

C:\Windows\System\GWFyxaj.exe

C:\Windows\System\GWFyxaj.exe

C:\Windows\System\NuaWJxI.exe

C:\Windows\System\NuaWJxI.exe

C:\Windows\System\mFZIFHs.exe

C:\Windows\System\mFZIFHs.exe

C:\Windows\System\IMzPfaS.exe

C:\Windows\System\IMzPfaS.exe

C:\Windows\System\dPjsJhW.exe

C:\Windows\System\dPjsJhW.exe

C:\Windows\System\TNUFFGe.exe

C:\Windows\System\TNUFFGe.exe

C:\Windows\System\LVWUeCQ.exe

C:\Windows\System\LVWUeCQ.exe

C:\Windows\System\GWzHbyU.exe

C:\Windows\System\GWzHbyU.exe

C:\Windows\System\nAIGgeG.exe

C:\Windows\System\nAIGgeG.exe

C:\Windows\System\zJpbXtz.exe

C:\Windows\System\zJpbXtz.exe

C:\Windows\System\TQmqtCN.exe

C:\Windows\System\TQmqtCN.exe

C:\Windows\System\UeOltPG.exe

C:\Windows\System\UeOltPG.exe

C:\Windows\System\QIJJHpl.exe

C:\Windows\System\QIJJHpl.exe

C:\Windows\System\JnHIMgS.exe

C:\Windows\System\JnHIMgS.exe

C:\Windows\System\aNdJitn.exe

C:\Windows\System\aNdJitn.exe

C:\Windows\System\RICxohZ.exe

C:\Windows\System\RICxohZ.exe

C:\Windows\System\EGzUNBM.exe

C:\Windows\System\EGzUNBM.exe

C:\Windows\System\VWAcVGu.exe

C:\Windows\System\VWAcVGu.exe

C:\Windows\System\bIAzjyf.exe

C:\Windows\System\bIAzjyf.exe

C:\Windows\System\iTTMjKZ.exe

C:\Windows\System\iTTMjKZ.exe

C:\Windows\System\wnhprZi.exe

C:\Windows\System\wnhprZi.exe

C:\Windows\System\yQxXMBW.exe

C:\Windows\System\yQxXMBW.exe

C:\Windows\System\xklTRWF.exe

C:\Windows\System\xklTRWF.exe

C:\Windows\System\MZsjBeG.exe

C:\Windows\System\MZsjBeG.exe

C:\Windows\System\YauKaHI.exe

C:\Windows\System\YauKaHI.exe

C:\Windows\System\AKOkWgd.exe

C:\Windows\System\AKOkWgd.exe

C:\Windows\System\KvhyjmY.exe

C:\Windows\System\KvhyjmY.exe

C:\Windows\System\GSXYLFi.exe

C:\Windows\System\GSXYLFi.exe

C:\Windows\System\raUaVyy.exe

C:\Windows\System\raUaVyy.exe

C:\Windows\System\AbmszZv.exe

C:\Windows\System\AbmszZv.exe

C:\Windows\System\RhtItKg.exe

C:\Windows\System\RhtItKg.exe

C:\Windows\System\gTimxcl.exe

C:\Windows\System\gTimxcl.exe

C:\Windows\System\eBbXyyX.exe

C:\Windows\System\eBbXyyX.exe

C:\Windows\System\EGGKIrH.exe

C:\Windows\System\EGGKIrH.exe

C:\Windows\System\UIZWvta.exe

C:\Windows\System\UIZWvta.exe

C:\Windows\System\uqQkLyQ.exe

C:\Windows\System\uqQkLyQ.exe

C:\Windows\System\AITDxUa.exe

C:\Windows\System\AITDxUa.exe

C:\Windows\System\sgrvwyc.exe

C:\Windows\System\sgrvwyc.exe

C:\Windows\System\YvBfvGP.exe

C:\Windows\System\YvBfvGP.exe

C:\Windows\System\lhvuTMc.exe

C:\Windows\System\lhvuTMc.exe

C:\Windows\System\vNavrCm.exe

C:\Windows\System\vNavrCm.exe

C:\Windows\System\DLBEuHL.exe

C:\Windows\System\DLBEuHL.exe

C:\Windows\System\bhOwUbv.exe

C:\Windows\System\bhOwUbv.exe

C:\Windows\System\TTLELgu.exe

C:\Windows\System\TTLELgu.exe

C:\Windows\System\TUqkygI.exe

C:\Windows\System\TUqkygI.exe

C:\Windows\System\jJfZbSq.exe

C:\Windows\System\jJfZbSq.exe

C:\Windows\System\ZRjthTz.exe

C:\Windows\System\ZRjthTz.exe

C:\Windows\System\mLfOhbN.exe

C:\Windows\System\mLfOhbN.exe

C:\Windows\System\XIszvNz.exe

C:\Windows\System\XIszvNz.exe

C:\Windows\System\crquVBe.exe

C:\Windows\System\crquVBe.exe

C:\Windows\System\ntZyxHW.exe

C:\Windows\System\ntZyxHW.exe

C:\Windows\System\gfBVjwP.exe

C:\Windows\System\gfBVjwP.exe

C:\Windows\System\czfwFwl.exe

C:\Windows\System\czfwFwl.exe

C:\Windows\System\eGGIARC.exe

C:\Windows\System\eGGIARC.exe

C:\Windows\System\ByoEhzw.exe

C:\Windows\System\ByoEhzw.exe

C:\Windows\System\tTirBWD.exe

C:\Windows\System\tTirBWD.exe

C:\Windows\System\JgiPlzC.exe

C:\Windows\System\JgiPlzC.exe

C:\Windows\System\uSTZRgJ.exe

C:\Windows\System\uSTZRgJ.exe

C:\Windows\System\HzWrbSu.exe

C:\Windows\System\HzWrbSu.exe

C:\Windows\System\XZcggtt.exe

C:\Windows\System\XZcggtt.exe

C:\Windows\System\sMhFQdk.exe

C:\Windows\System\sMhFQdk.exe

C:\Windows\System\WPnffiu.exe

C:\Windows\System\WPnffiu.exe

C:\Windows\System\fvBjAad.exe

C:\Windows\System\fvBjAad.exe

C:\Windows\System\sCNHieP.exe

C:\Windows\System\sCNHieP.exe

C:\Windows\System\rplECYb.exe

C:\Windows\System\rplECYb.exe

C:\Windows\System\OGKVQZP.exe

C:\Windows\System\OGKVQZP.exe

C:\Windows\System\fQRHZxU.exe

C:\Windows\System\fQRHZxU.exe

C:\Windows\System\MpkWhnc.exe

C:\Windows\System\MpkWhnc.exe

C:\Windows\System\zfOyHZJ.exe

C:\Windows\System\zfOyHZJ.exe

C:\Windows\System\akShfoK.exe

C:\Windows\System\akShfoK.exe

C:\Windows\System\sdWCQoy.exe

C:\Windows\System\sdWCQoy.exe

C:\Windows\System\iFMIsfn.exe

C:\Windows\System\iFMIsfn.exe

C:\Windows\System\KDMqIud.exe

C:\Windows\System\KDMqIud.exe

C:\Windows\System\TrvDVYA.exe

C:\Windows\System\TrvDVYA.exe

C:\Windows\System\dAlwvOe.exe

C:\Windows\System\dAlwvOe.exe

C:\Windows\System\yBZiTbt.exe

C:\Windows\System\yBZiTbt.exe

C:\Windows\System\MHNmPBh.exe

C:\Windows\System\MHNmPBh.exe

C:\Windows\System\lKXiolA.exe

C:\Windows\System\lKXiolA.exe

C:\Windows\System\kvBGRyl.exe

C:\Windows\System\kvBGRyl.exe

C:\Windows\System\sUmcmXS.exe

C:\Windows\System\sUmcmXS.exe

C:\Windows\System\NUwJVwf.exe

C:\Windows\System\NUwJVwf.exe

C:\Windows\System\AGVmEmZ.exe

C:\Windows\System\AGVmEmZ.exe

C:\Windows\System\ytGbYWf.exe

C:\Windows\System\ytGbYWf.exe

C:\Windows\System\vSBtQCa.exe

C:\Windows\System\vSBtQCa.exe

C:\Windows\System\pKfPGyv.exe

C:\Windows\System\pKfPGyv.exe

C:\Windows\System\drHuFUI.exe

C:\Windows\System\drHuFUI.exe

C:\Windows\System\iypWJqW.exe

C:\Windows\System\iypWJqW.exe

C:\Windows\System\pzkxbVG.exe

C:\Windows\System\pzkxbVG.exe

C:\Windows\System\VYEJTFs.exe

C:\Windows\System\VYEJTFs.exe

C:\Windows\System\EPIaLNF.exe

C:\Windows\System\EPIaLNF.exe

C:\Windows\System\bDjOPFM.exe

C:\Windows\System\bDjOPFM.exe

C:\Windows\System\SdkEtFK.exe

C:\Windows\System\SdkEtFK.exe

C:\Windows\System\VwviFKO.exe

C:\Windows\System\VwviFKO.exe

C:\Windows\System\aQerQmK.exe

C:\Windows\System\aQerQmK.exe

C:\Windows\System\XyymnNq.exe

C:\Windows\System\XyymnNq.exe

C:\Windows\System\Heowppc.exe

C:\Windows\System\Heowppc.exe

C:\Windows\System\FaVWusn.exe

C:\Windows\System\FaVWusn.exe

C:\Windows\System\nWAUhpN.exe

C:\Windows\System\nWAUhpN.exe

C:\Windows\System\bFvNPyZ.exe

C:\Windows\System\bFvNPyZ.exe

C:\Windows\System\VWIgZbj.exe

C:\Windows\System\VWIgZbj.exe

C:\Windows\System\GqVWXkS.exe

C:\Windows\System\GqVWXkS.exe

C:\Windows\System\WJXAJAw.exe

C:\Windows\System\WJXAJAw.exe

C:\Windows\System\yoGZGOb.exe

C:\Windows\System\yoGZGOb.exe

C:\Windows\System\viLfYgf.exe

C:\Windows\System\viLfYgf.exe

C:\Windows\System\NIGFgye.exe

C:\Windows\System\NIGFgye.exe

C:\Windows\System\WjeNABN.exe

C:\Windows\System\WjeNABN.exe

C:\Windows\System\ZpSxnDa.exe

C:\Windows\System\ZpSxnDa.exe

C:\Windows\System\aWUECeE.exe

C:\Windows\System\aWUECeE.exe

C:\Windows\System\gzUtNmH.exe

C:\Windows\System\gzUtNmH.exe

C:\Windows\System\uTfZopl.exe

C:\Windows\System\uTfZopl.exe

C:\Windows\System\mnXLUfO.exe

C:\Windows\System\mnXLUfO.exe

C:\Windows\System\NnDjIqb.exe

C:\Windows\System\NnDjIqb.exe

C:\Windows\System\rkjlBnl.exe

C:\Windows\System\rkjlBnl.exe

C:\Windows\System\xfpfePM.exe

C:\Windows\System\xfpfePM.exe

C:\Windows\System\MLGetie.exe

C:\Windows\System\MLGetie.exe

C:\Windows\System\AJWXNht.exe

C:\Windows\System\AJWXNht.exe

C:\Windows\System\QVonAlS.exe

C:\Windows\System\QVonAlS.exe

C:\Windows\System\LrTbYKN.exe

C:\Windows\System\LrTbYKN.exe

C:\Windows\System\LUSevEv.exe

C:\Windows\System\LUSevEv.exe

C:\Windows\System\hGFhiwv.exe

C:\Windows\System\hGFhiwv.exe

C:\Windows\System\jmNwXKk.exe

C:\Windows\System\jmNwXKk.exe

C:\Windows\System\lRxAzZC.exe

C:\Windows\System\lRxAzZC.exe

C:\Windows\System\gSFtYpv.exe

C:\Windows\System\gSFtYpv.exe

C:\Windows\System\XMavIfE.exe

C:\Windows\System\XMavIfE.exe

C:\Windows\System\WCNAqiU.exe

C:\Windows\System\WCNAqiU.exe

C:\Windows\System\JcvJKkL.exe

C:\Windows\System\JcvJKkL.exe

C:\Windows\System\EXGfGxH.exe

C:\Windows\System\EXGfGxH.exe

C:\Windows\System\Slobbhb.exe

C:\Windows\System\Slobbhb.exe

C:\Windows\System\ETSfxNm.exe

C:\Windows\System\ETSfxNm.exe

C:\Windows\System\CXEWfZQ.exe

C:\Windows\System\CXEWfZQ.exe

C:\Windows\System\dDyuQYv.exe

C:\Windows\System\dDyuQYv.exe

C:\Windows\System\ioIPUtT.exe

C:\Windows\System\ioIPUtT.exe

C:\Windows\System\kkYPVZS.exe

C:\Windows\System\kkYPVZS.exe

C:\Windows\System\ObhmTJx.exe

C:\Windows\System\ObhmTJx.exe

C:\Windows\System\bntjFJS.exe

C:\Windows\System\bntjFJS.exe

C:\Windows\System\pEHdbeS.exe

C:\Windows\System\pEHdbeS.exe

C:\Windows\System\IZgPSSq.exe

C:\Windows\System\IZgPSSq.exe

C:\Windows\System\JnLughq.exe

C:\Windows\System\JnLughq.exe

C:\Windows\System\HEljnDj.exe

C:\Windows\System\HEljnDj.exe

C:\Windows\System\qKXtRHq.exe

C:\Windows\System\qKXtRHq.exe

C:\Windows\System\ODBaQgf.exe

C:\Windows\System\ODBaQgf.exe

C:\Windows\System\oswHqJl.exe

C:\Windows\System\oswHqJl.exe

C:\Windows\System\roBxJfB.exe

C:\Windows\System\roBxJfB.exe

C:\Windows\System\QQPMPTq.exe

C:\Windows\System\QQPMPTq.exe

C:\Windows\System\TTNITxh.exe

C:\Windows\System\TTNITxh.exe

C:\Windows\System\CnyiQyu.exe

C:\Windows\System\CnyiQyu.exe

C:\Windows\System\lpVIHEf.exe

C:\Windows\System\lpVIHEf.exe

C:\Windows\System\WDlAeDR.exe

C:\Windows\System\WDlAeDR.exe

C:\Windows\System\QPETCbh.exe

C:\Windows\System\QPETCbh.exe

C:\Windows\System\VaCzQAW.exe

C:\Windows\System\VaCzQAW.exe

C:\Windows\System\YtQkoar.exe

C:\Windows\System\YtQkoar.exe

C:\Windows\System\vDhELzS.exe

C:\Windows\System\vDhELzS.exe

C:\Windows\System\DSIAzak.exe

C:\Windows\System\DSIAzak.exe

C:\Windows\System\WFWvBaS.exe

C:\Windows\System\WFWvBaS.exe

C:\Windows\System\MGjjVaG.exe

C:\Windows\System\MGjjVaG.exe

C:\Windows\System\khgtHNb.exe

C:\Windows\System\khgtHNb.exe

C:\Windows\System\EMMUqqM.exe

C:\Windows\System\EMMUqqM.exe

C:\Windows\System\pZWLUpp.exe

C:\Windows\System\pZWLUpp.exe

C:\Windows\System\roTmClB.exe

C:\Windows\System\roTmClB.exe

C:\Windows\System\NAYJfVF.exe

C:\Windows\System\NAYJfVF.exe

C:\Windows\System\ImpFgre.exe

C:\Windows\System\ImpFgre.exe

C:\Windows\System\MdwQOqc.exe

C:\Windows\System\MdwQOqc.exe

C:\Windows\System\fVDUUwM.exe

C:\Windows\System\fVDUUwM.exe

C:\Windows\System\bbfjcQW.exe

C:\Windows\System\bbfjcQW.exe

C:\Windows\System\BqzspQg.exe

C:\Windows\System\BqzspQg.exe

C:\Windows\System\jqAJtbn.exe

C:\Windows\System\jqAJtbn.exe

C:\Windows\System\CHvpWuN.exe

C:\Windows\System\CHvpWuN.exe

C:\Windows\System\UrUsTOt.exe

C:\Windows\System\UrUsTOt.exe

C:\Windows\System\IKbsjny.exe

C:\Windows\System\IKbsjny.exe

C:\Windows\System\byCCLaf.exe

C:\Windows\System\byCCLaf.exe

C:\Windows\System\XxWSMdl.exe

C:\Windows\System\XxWSMdl.exe

C:\Windows\System\LvIDWXv.exe

C:\Windows\System\LvIDWXv.exe

C:\Windows\System\DshEoPf.exe

C:\Windows\System\DshEoPf.exe

C:\Windows\System\mtRNDJU.exe

C:\Windows\System\mtRNDJU.exe

C:\Windows\System\YSzroQO.exe

C:\Windows\System\YSzroQO.exe

C:\Windows\System\ADsdKKJ.exe

C:\Windows\System\ADsdKKJ.exe

C:\Windows\System\usTAuLf.exe

C:\Windows\System\usTAuLf.exe

C:\Windows\System\vRjSYUz.exe

C:\Windows\System\vRjSYUz.exe

C:\Windows\System\yiYTrCF.exe

C:\Windows\System\yiYTrCF.exe

C:\Windows\System\mZuwLNl.exe

C:\Windows\System\mZuwLNl.exe

C:\Windows\System\CxJtLCp.exe

C:\Windows\System\CxJtLCp.exe

C:\Windows\System\NYQAqSu.exe

C:\Windows\System\NYQAqSu.exe

C:\Windows\System\ecWzlCn.exe

C:\Windows\System\ecWzlCn.exe

C:\Windows\System\EUcwdZq.exe

C:\Windows\System\EUcwdZq.exe

C:\Windows\System\dXeNvbp.exe

C:\Windows\System\dXeNvbp.exe

C:\Windows\System\vieakNE.exe

C:\Windows\System\vieakNE.exe

C:\Windows\System\NxpAPfg.exe

C:\Windows\System\NxpAPfg.exe

C:\Windows\System\yhMwIsf.exe

C:\Windows\System\yhMwIsf.exe

C:\Windows\System\zroKhoM.exe

C:\Windows\System\zroKhoM.exe

C:\Windows\System\MxsbOcU.exe

C:\Windows\System\MxsbOcU.exe

C:\Windows\System\HxKNZIC.exe

C:\Windows\System\HxKNZIC.exe

C:\Windows\System\IQlHqlC.exe

C:\Windows\System\IQlHqlC.exe

C:\Windows\System\yVpbnzZ.exe

C:\Windows\System\yVpbnzZ.exe

C:\Windows\System\hTieiwx.exe

C:\Windows\System\hTieiwx.exe

C:\Windows\System\WNdaspQ.exe

C:\Windows\System\WNdaspQ.exe

C:\Windows\System\vIrwriM.exe

C:\Windows\System\vIrwriM.exe

C:\Windows\System\KCBufRE.exe

C:\Windows\System\KCBufRE.exe

C:\Windows\System\FJRoemI.exe

C:\Windows\System\FJRoemI.exe

C:\Windows\System\MGQCffq.exe

C:\Windows\System\MGQCffq.exe

C:\Windows\System\JTrTdzI.exe

C:\Windows\System\JTrTdzI.exe

C:\Windows\System\XLyZORL.exe

C:\Windows\System\XLyZORL.exe

C:\Windows\System\lsLwaTF.exe

C:\Windows\System\lsLwaTF.exe

C:\Windows\System\tsOymCX.exe

C:\Windows\System\tsOymCX.exe

C:\Windows\System\ZoxDDuQ.exe

C:\Windows\System\ZoxDDuQ.exe

C:\Windows\System\jpgFBUR.exe

C:\Windows\System\jpgFBUR.exe

C:\Windows\System\QuOSeOB.exe

C:\Windows\System\QuOSeOB.exe

C:\Windows\System\hNIHUvF.exe

C:\Windows\System\hNIHUvF.exe

C:\Windows\System\rTUwhUV.exe

C:\Windows\System\rTUwhUV.exe

C:\Windows\System\UZIarsm.exe

C:\Windows\System\UZIarsm.exe

C:\Windows\System\pSSkfhg.exe

C:\Windows\System\pSSkfhg.exe

C:\Windows\System\RFCxwPG.exe

C:\Windows\System\RFCxwPG.exe

C:\Windows\System\fyBqoLF.exe

C:\Windows\System\fyBqoLF.exe

C:\Windows\System\umXKdEk.exe

C:\Windows\System\umXKdEk.exe

C:\Windows\System\kImjBub.exe

C:\Windows\System\kImjBub.exe

C:\Windows\System\tCOIgpO.exe

C:\Windows\System\tCOIgpO.exe

C:\Windows\System\RUPLxCE.exe

C:\Windows\System\RUPLxCE.exe

C:\Windows\System\hzNTUcn.exe

C:\Windows\System\hzNTUcn.exe

C:\Windows\System\TQvCqjM.exe

C:\Windows\System\TQvCqjM.exe

C:\Windows\System\ZtDZNoM.exe

C:\Windows\System\ZtDZNoM.exe

C:\Windows\System\gKjKxwd.exe

C:\Windows\System\gKjKxwd.exe

C:\Windows\System\CJgxAlj.exe

C:\Windows\System\CJgxAlj.exe

C:\Windows\System\QiwIhhz.exe

C:\Windows\System\QiwIhhz.exe

C:\Windows\System\ZdTOIco.exe

C:\Windows\System\ZdTOIco.exe

C:\Windows\System\zfhwXyW.exe

C:\Windows\System\zfhwXyW.exe

C:\Windows\System\IqOBVsg.exe

C:\Windows\System\IqOBVsg.exe

C:\Windows\System\XNfggnU.exe

C:\Windows\System\XNfggnU.exe

C:\Windows\System\mxMNEUN.exe

C:\Windows\System\mxMNEUN.exe

C:\Windows\System\ySqhnhX.exe

C:\Windows\System\ySqhnhX.exe

C:\Windows\System\vjrRzsu.exe

C:\Windows\System\vjrRzsu.exe

C:\Windows\System\lOPHLzd.exe

C:\Windows\System\lOPHLzd.exe

C:\Windows\System\cHvkiRt.exe

C:\Windows\System\cHvkiRt.exe

C:\Windows\System\WYfLLJK.exe

C:\Windows\System\WYfLLJK.exe

C:\Windows\System\LEBckDY.exe

C:\Windows\System\LEBckDY.exe

C:\Windows\System\miKNacT.exe

C:\Windows\System\miKNacT.exe

C:\Windows\System\mtAXMhW.exe

C:\Windows\System\mtAXMhW.exe

C:\Windows\System\PyeAzUP.exe

C:\Windows\System\PyeAzUP.exe

C:\Windows\System\sXByTRl.exe

C:\Windows\System\sXByTRl.exe

C:\Windows\System\qiUOUHZ.exe

C:\Windows\System\qiUOUHZ.exe

C:\Windows\System\piRyHTH.exe

C:\Windows\System\piRyHTH.exe

C:\Windows\System\MCvAllJ.exe

C:\Windows\System\MCvAllJ.exe

C:\Windows\System\OoUXtwD.exe

C:\Windows\System\OoUXtwD.exe

C:\Windows\System\wQlURhs.exe

C:\Windows\System\wQlURhs.exe

C:\Windows\System\DDLFvkn.exe

C:\Windows\System\DDLFvkn.exe

C:\Windows\System\SmynpEt.exe

C:\Windows\System\SmynpEt.exe

C:\Windows\System\Gjsajqg.exe

C:\Windows\System\Gjsajqg.exe

C:\Windows\System\DoTtmeL.exe

C:\Windows\System\DoTtmeL.exe

C:\Windows\System\gaeiGTI.exe

C:\Windows\System\gaeiGTI.exe

C:\Windows\System\QaZbymY.exe

C:\Windows\System\QaZbymY.exe

C:\Windows\System\vkrHamt.exe

C:\Windows\System\vkrHamt.exe

C:\Windows\System\TwvvSWm.exe

C:\Windows\System\TwvvSWm.exe

C:\Windows\System\ekBYsaL.exe

C:\Windows\System\ekBYsaL.exe

C:\Windows\System\jXoQAFE.exe

C:\Windows\System\jXoQAFE.exe

C:\Windows\System\uxCnNJx.exe

C:\Windows\System\uxCnNJx.exe

C:\Windows\System\XxiSBZb.exe

C:\Windows\System\XxiSBZb.exe

C:\Windows\System\cEdZbXj.exe

C:\Windows\System\cEdZbXj.exe

C:\Windows\System\zxmATXR.exe

C:\Windows\System\zxmATXR.exe

C:\Windows\System\njwLSTS.exe

C:\Windows\System\njwLSTS.exe

C:\Windows\System\NozZGvE.exe

C:\Windows\System\NozZGvE.exe

C:\Windows\System\kiMjTMN.exe

C:\Windows\System\kiMjTMN.exe

C:\Windows\System\JOtPOTJ.exe

C:\Windows\System\JOtPOTJ.exe

C:\Windows\System\ruNBqEm.exe

C:\Windows\System\ruNBqEm.exe

C:\Windows\System\VcCGbaF.exe

C:\Windows\System\VcCGbaF.exe

C:\Windows\System\rsZlVYU.exe

C:\Windows\System\rsZlVYU.exe

C:\Windows\System\pxoShJN.exe

C:\Windows\System\pxoShJN.exe

C:\Windows\System\SBxLkdk.exe

C:\Windows\System\SBxLkdk.exe

C:\Windows\System\AzGoNsh.exe

C:\Windows\System\AzGoNsh.exe

C:\Windows\System\owwiTma.exe

C:\Windows\System\owwiTma.exe

C:\Windows\System\abxvRhX.exe

C:\Windows\System\abxvRhX.exe

C:\Windows\System\VVxOfbV.exe

C:\Windows\System\VVxOfbV.exe

C:\Windows\System\ozuNcVg.exe

C:\Windows\System\ozuNcVg.exe

C:\Windows\System\EJqDwyb.exe

C:\Windows\System\EJqDwyb.exe

C:\Windows\System\bODBekf.exe

C:\Windows\System\bODBekf.exe

C:\Windows\System\OKLutUW.exe

C:\Windows\System\OKLutUW.exe

C:\Windows\System\DikyTQX.exe

C:\Windows\System\DikyTQX.exe

C:\Windows\System\oRLrXIr.exe

C:\Windows\System\oRLrXIr.exe

C:\Windows\System\qaoyCqx.exe

C:\Windows\System\qaoyCqx.exe

C:\Windows\System\JrKgcAY.exe

C:\Windows\System\JrKgcAY.exe

C:\Windows\System\gafRAOo.exe

C:\Windows\System\gafRAOo.exe

C:\Windows\System\zMXDIgm.exe

C:\Windows\System\zMXDIgm.exe

C:\Windows\System\eEmeZyO.exe

C:\Windows\System\eEmeZyO.exe

C:\Windows\System\DUrwoHV.exe

C:\Windows\System\DUrwoHV.exe

C:\Windows\System\uZbIQbH.exe

C:\Windows\System\uZbIQbH.exe

C:\Windows\System\LvgPrgp.exe

C:\Windows\System\LvgPrgp.exe

C:\Windows\System\ChdRjjY.exe

C:\Windows\System\ChdRjjY.exe

C:\Windows\System\KIIVdYz.exe

C:\Windows\System\KIIVdYz.exe

C:\Windows\System\XiLJdkg.exe

C:\Windows\System\XiLJdkg.exe

C:\Windows\System\xSCwvKJ.exe

C:\Windows\System\xSCwvKJ.exe

C:\Windows\System\CMUnFYW.exe

C:\Windows\System\CMUnFYW.exe

C:\Windows\System\YpEijjV.exe

C:\Windows\System\YpEijjV.exe

C:\Windows\System\hfqmRQx.exe

C:\Windows\System\hfqmRQx.exe

C:\Windows\System\eFdihhW.exe

C:\Windows\System\eFdihhW.exe

C:\Windows\System\IDodaKl.exe

C:\Windows\System\IDodaKl.exe

C:\Windows\System\LSrtubR.exe

C:\Windows\System\LSrtubR.exe

C:\Windows\System\LSuWahW.exe

C:\Windows\System\LSuWahW.exe

C:\Windows\System\YlGllgp.exe

C:\Windows\System\YlGllgp.exe

C:\Windows\System\oEGZGiX.exe

C:\Windows\System\oEGZGiX.exe

C:\Windows\System\OqFhnAC.exe

C:\Windows\System\OqFhnAC.exe

C:\Windows\System\zbVyZRb.exe

C:\Windows\System\zbVyZRb.exe

C:\Windows\System\sMruOKH.exe

C:\Windows\System\sMruOKH.exe

C:\Windows\System\pzogfpt.exe

C:\Windows\System\pzogfpt.exe

C:\Windows\System\EPNGjVz.exe

C:\Windows\System\EPNGjVz.exe

C:\Windows\System\yAwnDrm.exe

C:\Windows\System\yAwnDrm.exe

C:\Windows\System\AtTwPfh.exe

C:\Windows\System\AtTwPfh.exe

C:\Windows\System\PgePPRt.exe

C:\Windows\System\PgePPRt.exe

C:\Windows\System\hLaLvHv.exe

C:\Windows\System\hLaLvHv.exe

C:\Windows\System\fSdJjWl.exe

C:\Windows\System\fSdJjWl.exe

C:\Windows\System\BZDHxEB.exe

C:\Windows\System\BZDHxEB.exe

C:\Windows\System\cNkdrMq.exe

C:\Windows\System\cNkdrMq.exe

C:\Windows\System\lOGdmSd.exe

C:\Windows\System\lOGdmSd.exe

C:\Windows\System\dMfPcdf.exe

C:\Windows\System\dMfPcdf.exe

C:\Windows\System\oJNdkoz.exe

C:\Windows\System\oJNdkoz.exe

C:\Windows\System\MoXnaKl.exe

C:\Windows\System\MoXnaKl.exe

C:\Windows\System\BVmpXuR.exe

C:\Windows\System\BVmpXuR.exe

C:\Windows\System\RoGuYmG.exe

C:\Windows\System\RoGuYmG.exe

C:\Windows\System\MuDFgzp.exe

C:\Windows\System\MuDFgzp.exe

C:\Windows\System\njoCweC.exe

C:\Windows\System\njoCweC.exe

C:\Windows\System\PVLekhQ.exe

C:\Windows\System\PVLekhQ.exe

C:\Windows\System\WFtxysx.exe

C:\Windows\System\WFtxysx.exe

C:\Windows\System\nAMdmVQ.exe

C:\Windows\System\nAMdmVQ.exe

C:\Windows\System\RLZtOyO.exe

C:\Windows\System\RLZtOyO.exe

C:\Windows\System\JMJcwwX.exe

C:\Windows\System\JMJcwwX.exe

C:\Windows\System\bKvyyag.exe

C:\Windows\System\bKvyyag.exe

C:\Windows\System\VQscswB.exe

C:\Windows\System\VQscswB.exe

C:\Windows\System\uxiEZbk.exe

C:\Windows\System\uxiEZbk.exe

C:\Windows\System\SUINcXy.exe

C:\Windows\System\SUINcXy.exe

C:\Windows\System\hZcVKjy.exe

C:\Windows\System\hZcVKjy.exe

C:\Windows\System\AyOtjAz.exe

C:\Windows\System\AyOtjAz.exe

C:\Windows\System\ITeJzFV.exe

C:\Windows\System\ITeJzFV.exe

C:\Windows\System\trFGYLX.exe

C:\Windows\System\trFGYLX.exe

C:\Windows\System\QHhXARa.exe

C:\Windows\System\QHhXARa.exe

C:\Windows\System\ujvfpcY.exe

C:\Windows\System\ujvfpcY.exe

C:\Windows\System\QtsOUzL.exe

C:\Windows\System\QtsOUzL.exe

C:\Windows\System\JmiKgJa.exe

C:\Windows\System\JmiKgJa.exe

C:\Windows\System\xwiBhRK.exe

C:\Windows\System\xwiBhRK.exe

C:\Windows\System\euXykCt.exe

C:\Windows\System\euXykCt.exe

C:\Windows\System\OBvWxwk.exe

C:\Windows\System\OBvWxwk.exe

C:\Windows\System\gIUKGJC.exe

C:\Windows\System\gIUKGJC.exe

C:\Windows\System\zQWeyPn.exe

C:\Windows\System\zQWeyPn.exe

C:\Windows\System\QMaRxjI.exe

C:\Windows\System\QMaRxjI.exe

C:\Windows\System\TcWSYlz.exe

C:\Windows\System\TcWSYlz.exe

C:\Windows\System\qFgYowO.exe

C:\Windows\System\qFgYowO.exe

C:\Windows\System\EgejOvH.exe

C:\Windows\System\EgejOvH.exe

C:\Windows\System\QArssCb.exe

C:\Windows\System\QArssCb.exe

C:\Windows\System\MgTvQdH.exe

C:\Windows\System\MgTvQdH.exe

C:\Windows\System\JErsGoS.exe

C:\Windows\System\JErsGoS.exe

C:\Windows\System\HgORKWI.exe

C:\Windows\System\HgORKWI.exe

C:\Windows\System\sNbKTGt.exe

C:\Windows\System\sNbKTGt.exe

C:\Windows\System\CyyPKlo.exe

C:\Windows\System\CyyPKlo.exe

C:\Windows\System\oEPkWao.exe

C:\Windows\System\oEPkWao.exe

C:\Windows\System\imfTPUs.exe

C:\Windows\System\imfTPUs.exe

C:\Windows\System\nWUUWYf.exe

C:\Windows\System\nWUUWYf.exe

C:\Windows\System\hubDOkR.exe

C:\Windows\System\hubDOkR.exe

C:\Windows\System\DQnbAvV.exe

C:\Windows\System\DQnbAvV.exe

C:\Windows\System\cGnCLwQ.exe

C:\Windows\System\cGnCLwQ.exe

C:\Windows\System\GQwnpEp.exe

C:\Windows\System\GQwnpEp.exe

C:\Windows\System\gdVwhGJ.exe

C:\Windows\System\gdVwhGJ.exe

C:\Windows\System\tDaOVZK.exe

C:\Windows\System\tDaOVZK.exe

C:\Windows\System\FeXpkde.exe

C:\Windows\System\FeXpkde.exe

C:\Windows\System\LYghRue.exe

C:\Windows\System\LYghRue.exe

C:\Windows\System\eTTNzNu.exe

C:\Windows\System\eTTNzNu.exe

C:\Windows\System\BEhCgCD.exe

C:\Windows\System\BEhCgCD.exe

C:\Windows\System\SiGOrtB.exe

C:\Windows\System\SiGOrtB.exe

C:\Windows\System\yPntOhn.exe

C:\Windows\System\yPntOhn.exe

C:\Windows\System\wZdObZQ.exe

C:\Windows\System\wZdObZQ.exe

C:\Windows\System\pdbtWOi.exe

C:\Windows\System\pdbtWOi.exe

C:\Windows\System\bQFNooh.exe

C:\Windows\System\bQFNooh.exe

C:\Windows\System\kVjMPao.exe

C:\Windows\System\kVjMPao.exe

C:\Windows\System\bnXbTmA.exe

C:\Windows\System\bnXbTmA.exe

C:\Windows\System\NSqXyri.exe

C:\Windows\System\NSqXyri.exe

C:\Windows\System\MQAkZyg.exe

C:\Windows\System\MQAkZyg.exe

C:\Windows\System\LeEZetR.exe

C:\Windows\System\LeEZetR.exe

C:\Windows\System\oWeFJrl.exe

C:\Windows\System\oWeFJrl.exe

C:\Windows\System\FjkaGNz.exe

C:\Windows\System\FjkaGNz.exe

C:\Windows\System\rTwZZtx.exe

C:\Windows\System\rTwZZtx.exe

C:\Windows\System\tOTxasX.exe

C:\Windows\System\tOTxasX.exe

C:\Windows\System\cSqAPTS.exe

C:\Windows\System\cSqAPTS.exe

C:\Windows\System\vtOFKYz.exe

C:\Windows\System\vtOFKYz.exe

C:\Windows\System\cedQedL.exe

C:\Windows\System\cedQedL.exe

C:\Windows\System\lwXKFVX.exe

C:\Windows\System\lwXKFVX.exe

C:\Windows\System\gpTHEmA.exe

C:\Windows\System\gpTHEmA.exe

C:\Windows\System\aGDfLSg.exe

C:\Windows\System\aGDfLSg.exe

C:\Windows\System\JJOqNlL.exe

C:\Windows\System\JJOqNlL.exe

C:\Windows\System\NTRCdHD.exe

C:\Windows\System\NTRCdHD.exe

C:\Windows\System\AEdvQXG.exe

C:\Windows\System\AEdvQXG.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp

Files

memory/2088-1-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

memory/2088-0-0x00000000000F0000-0x0000000000100000-memory.dmp

C:\Windows\system\JkYLrIl.exe

MD5	7045690ae46f4f4309634c298f8a5434
SHA1	d9641583c6691c95a3ae8444d81953235382f754
SHA256	53f491760fb9ce01ef6878eb0a683b0a17a37fd3eeafad32a4a26b93f9af8cf7
SHA512	27e889cf5e1e4d404d600bc957e44c350c5a8b2657e2de6cedf6f66433e4b2ac4a8ee38d7bfbf4820adf29ba394b5f5b7c370dc67c76b2e00fdf30f57e61f0eb

\Windows\system\vpqiwre.exe

MD5	27e1cde3d2baaa455aa81e13f5316234
SHA1	fc30476df1307178192ea8097b7685fc4ea33682
SHA256	304494f538bc4a097bcb8f9c6593d6335952528f00619f4b445be20a92154466
SHA512	b2cfde7eb361077775d454bc7a695ac9751bd1d8fc1cfe3176499294d15ecb62bf6f0bc14e04977d8e8b446dc2f8cf9ea6ab30aff45ba1232061f5db6ede7c9f

C:\Windows\system\cYtAGvh.exe

MD5	1c9a1a9892cae6c7d19d07417dbdd195
SHA1	5dddf5155de4ac82a135d996b9e2c370cc13ad0d
SHA256	ce2ec8715b9abef93e375f9e7b0217fcc87604fa65cc3c0fecd855d855cf0fba
SHA512	481e120f18672ac3c095115ca28a92ea0a1072222e5b9b95d2c390fa310f198433014a914be90e62bd8fb87b235a65b959b47d81927100ac2af9286da17c0868

\Windows\system\pcvfPRl.exe

MD5	8bbd3603e3d3b5abf2ef4dca27ae55fc
SHA1	1587d15859a7187745233ccdaac9bbd247cbd9db
SHA256	239f7d5789030dbf2b9dcbafa81ca2e7e159a3e728285ca88c05013897b3a132
SHA512	6108c8ed7d4a45ae0996ceeae26786ff9836a719b0dd6770c0de4e359eb9e09f41ba6171adbeac89e60ae0515cf26bc1560f89537d0a1295e3aeda25f00d13a5

memory/2088-29-0x0000000002ED0000-0x00000000032C2000-memory.dmp

memory/2088-34-0x000000013F8A0000-0x000000013FC92000-memory.dmp

memory/2160-32-0x000007FEF608E000-0x000007FEF608F000-memory.dmp

memory/2160-31-0x0000000002AF0000-0x0000000002B70000-memory.dmp

memory/1804-30-0x000000013FA20000-0x000000013FE12000-memory.dmp

memory/2604-28-0x000000013F8A0000-0x000000013FC92000-memory.dmp

memory/2088-27-0x000000013FA20000-0x000000013FE12000-memory.dmp

memory/2052-26-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

memory/2160-37-0x0000000002810000-0x0000000002818000-memory.dmp

C:\Windows\system\qREQLTs.exe

MD5	44bc226730fdb3a77771988989827539
SHA1	19edabd04d4bac264f6a7fde23602cb732b9b9eb
SHA256	772a92e49da0131ad8e6a486b5e8c0b4a5680dced1b3fc874da50e20f712b686
SHA512	3dfeb244d07c06c923be0e2a4745573e141f3388717549cc33e9a60319371d7863f4bde7f23b5d0bb9fd3d9ad762246f44f0742c8996feb1d206887e02feb94f

C:\Windows\system\iolSFNj.exe

MD5	dd1e4c441196b12b4b29f64e4032be19
SHA1	055ce1f3d60ef8e342abc400b576465bdea339d4
SHA256	a5a6f94ee00920182bb60c81b8ae9672d6cc2eecb204aa0c28b00b4dc6b73ec0
SHA512	73be08708fc5b3abc3f65b419c00f2bd9c1ba4c4275291178c0c989ecb5d23bc0f1919bf175cdf0a6314c6ad00e6a94274cbe76de9c3b6750ddae19e66e2f0b2

\Windows\system\jZxLZOY.exe

MD5	5858ef8a5984dc2188b1416a4cab3f5e
SHA1	2a53b154b27d683f996a7bfe5b5a70c7752896a4
SHA256	b37a07854ba0e9df88d3b339b73f78229d574d2e3d1365a5c72905dc3bd985ac
SHA512	114d0b1f6ee466c61d80c2085066886790db93db86b34ae0ac9bc056fcdc53c88c8309a89c6d297d4437f49484820dbecef3955b879d7b9c58f1ffe4830c5836

\Windows\system\VIjvYvs.exe

MD5	ea8cbb924bac2a6a2f14422fedb74a2a
SHA1	eacf16669162c7c26868f22500d33ea918fbe4d6
SHA256	0aceefb1c8025e881c60d0a27f16670ee1a15c0e7e22caa2b758e333ff1770ef
SHA512	c49d6b4d92a55ae3739bd7ab2a70b0a2510f785ebf17f32629807f8de07d396f362ac3c5201185d002628cc9d1c372dd5588d11ebacb08753199f528ea828e85

C:\Windows\system\YLeLXot.exe

MD5	1e13cb8f9f580f6474f16f595884e3c5
SHA1	75a452a5bfbcb7cc4e66047c97c0406d8aa6fb9f
SHA256	8f39da51da5f36f3a3495aae7409fa2877243aded49db1ee892edfb8132561f4
SHA512	06d7c03e234397150ed93167b7064ee7b41697a78d12ac02a9e86478cc0fc500076130090827a577c83016b5f847efd1c4876890bcc9bd74a6e75cc5f4507944

memory/2160-110-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

memory/2160-112-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

memory/2088-115-0x0000000003340000-0x0000000003732000-memory.dmp

memory/2088-114-0x000000013FD40000-0x0000000140132000-memory.dmp

memory/2764-113-0x000000013F170000-0x000000013F562000-memory.dmp

\Windows\system\pauHHqh.exe

MD5	7a019c0a3fe40e09a7741dce523ed18f
SHA1	bd824db99b472a6bd4551c2a0c9db75ba6b18094
SHA256	2ada21e1b6b62de2fd55ca50048f3424401e5f209f94c338da07958d14f47bfd
SHA512	4786bf882917e69442d949dc19bbf9ad9db3a1a618702b2316274495f0b2b96da1b5f3d9fb483925229373343bd4e20b286d6bdbdd6a0d2a8fc9f06cd3b3c44d

C:\Windows\system\jkiPtsb.exe

MD5	d2901d9f87981641f1011cad8800f430
SHA1	e574b8645dde7930b07f302c13ea2a4d743de068
SHA256	5b13bfbdb8f2392fe76e22170631d5d1bc8c2d14fe503e510e7eb5668290eee8
SHA512	8a42ccf6c2bc579f4397ab493e61309337d18dc5cc792bf6ab678e4f7b770b364c03e2a9f7046235721f603ebb01934ad49739797112bc13b3e638b0253b1636

C:\Windows\system\CtHdeCo.exe

MD5	56bad08f8265a03ee361734bd418f0b6
SHA1	cf397a7d60bf91f6afc1f7fb3fe0f8189b9e7479
SHA256	8eb230178ca0261e976e2edfea7a2f39b2872dc0299bc7eb5012e43390806a5a
SHA512	2d2c8195d90a04a00ffb14d5d9bb1f3878420eb21fa06db4e1390dfd000d14186d5f21c541a23734fe2b099b24fdd1d818a19e3ede9316ecbc8cac362fcd198e

C:\Windows\system\KrtTqLA.exe

MD5	a3fd4149be36567bbd9c50d55bef9d18
SHA1	1eeaf1d4b37c5baa84fa35d1c499f1ca20925683
SHA256	1c66d697a4502c4669023de891eff59ff4e070a28a4b98465c28824077bfc8ec
SHA512	0df4cb60f2be740073121ac5f6a75663916c107d1e5bb5582ec02e5a130db258088866d001f438b43a377dd4a5575f63dc65c584e3dc0303ce08f3126e885980

C:\Windows\system\ihuljeH.exe

MD5	a2f28f62c1866092e7e9a546fcc37f61
SHA1	28de928536e235dce4ba685acfca2e429e434862
SHA256	2238487f0e16efcd456d17afcb850e85f5ae1ebf19755ab7d1746672b7ba43a9
SHA512	83a78e1e215587ffcfe237faceef3b5cef775445e28a27058dfc62c02b54388b038aa7f494fa738f2367c7d90ff7d4c11f8a5418120c4a353584b9c746edba75

C:\Windows\system\gmvKDUb.exe

MD5	8b5cd0f0ad949e0d5c0ca5ce5c79bf0e
SHA1	fa3a0864531a1f73bc2ff899bf8d5d462c0d449c
SHA256	16d15c29ce02405a175146a6df9a6cc65df1a8b902d0f7b553bf980904e2a8b9
SHA512	e7f935d74f70983cecb550b1f7f460f65b59a6f511e14028150cdd18abf2ddebfc3a086aea7e49a58d897c6c7cded3f373b7861dea1b5dc76d7cdf0729ef5680

C:\Windows\system\DIGOtSV.exe

MD5	b36b5c5b449cba9498982381f063a520
SHA1	860bab386833d9c9a1a52050408ae65265e3de23
SHA256	f2456dd731611544a384125135f2c2af8485fca7f2e5825dd3c62b81f2dc9503
SHA512	5823fdbe21bca4518931c54d0f01178df8dd88897b44ac571241d12917571cad3836a8c8c374925c5e65e0cc496574eacb806cd3c50a1088f6f1ad84a0538227

C:\Windows\system\feFkKJu.exe

MD5	aa660a57350fb8cf45998e8f62adf5e9
SHA1	883acbf5e7dfc85188a1ddba18de64cb6a65a0bb
SHA256	ed1df75acc30005a469378cd38cceedd2efe41101de60902c64a2540ced77087
SHA512	d30c16cae81ac9970143238a307d6afbca8ab0f041402c0d1bd7f8d9a77e03dcc4ac03d252ae96da0a38378ca5dd22a7874ef3b95bf848b1b33f6c8b02830717

C:\Windows\system\fWeRZyV.exe

MD5	72a7040ee0872601c1b5a9a1e58dca35
SHA1	ffda8ce512df34a4bc67fba6f67a8d0082838d33
SHA256	080fae43f64304b558c13bf43fde20f8cf8f79bf8872094b0cb9dc104f3ec04c
SHA512	4ff1b70321da35408b59766015899de33010f93ea4f7dd8f63236a95c5e2404d20be71aa2462e04941e9cebe8480f606e39298d57778ddee277aec85dd984a28

memory/2160-111-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

C:\Windows\system\kimecOQ.exe

MD5	c9d792a449d5ff65717af3294d7f6baf
SHA1	6ada2fcc931b90413dad1733873f470790f5ee4e
SHA256	27bd992c8186c02f9887ef81360a299d5ceaf8434c077878745d690025b427c7
SHA512	6025c049701c1e19ffceb3d320c9f1a03c9d91eeb83127687dff44ed1da60be9f3026a57f5c7bc08dc63da9ac11cf04e1d230f0679343b7944b714a87d6955e7

C:\Windows\system\bqIXuWN.exe

MD5	6bd1b3dae6c0db7f5d3ef04188879e69
SHA1	79200e12d83d41332fa8ae34ec72dc3c6407e419
SHA256	72003955fac72e6338bd407732eb6abafd2bde98f805c8ea28475e91c7cc5f9f
SHA512	699bbc369b190d28ee3bd7d123a3b34bfc690d2f36e7b41f23b33cd070e4472c42362f2360cb1a55dab9ca8ae7aad1cb903b6c0217673b57e43d3bb295e5ca4e

C:\Windows\system\LXgEyDE.exe

MD5	0370a16830f10505e5801a5f28edbd22
SHA1	d3d080f2461ad750ccc3c7660ad0169139145256
SHA256	0412318161bf42d34d6fdcb23d00a8b2f3df62229bc8acbfe4b786485c229689
SHA512	d8e50308eb0dd7cf3755322f0ae2ce271cc152e7c371c99923ee577c0d54f3efc805ab856de426b319a425a0b4e807c26c5c7d01ffec38a70e6dd8578383d609

\Windows\system\sAJRxvK.exe

MD5	cf3d2d087631ed7c0624a8eb973d7a70
SHA1	2bf13b7ee6d5df56c8ba8ba4d951fcd0b7c65205
SHA256	0d02454519028337dd3c8798e048efd8c74292400c4a18627471661a746c906c
SHA512	8cc47ae74891e1a5af1cbbd531d060035299dcdf9f43e1dcd9e820d1c5872bb8e4150025f096cde036618feff761b5199af88fb3734499b3198c6443b55de82b

C:\Windows\system\iDwsRqC.exe

MD5	fbbbf90d97f99cd3271391f69a7a962d
SHA1	24a95a7cb50c0d208ae87d12a6e0fc639ed77d96
SHA256	5bee1f5bfa62536262e85c3548d714d6be280fd1e07a0ab2616217a6ba01d5bd
SHA512	49706d51bdf968b95c863b544a0cd7193a9a65ca14dbbec63e89f2a07ebe5a76ddb194b0d6535d923ad3fdcb7de5a44ec2fbeb3443645b56b5c12ba779154cd9

\Windows\system\YsPOCSI.exe

MD5	236a1df6879dbd04b0126d46a4c81afd
SHA1	aa2be5e84a3b6bbfb6d56ba51e67f4ecee7324c7
SHA256	af406b02acaa03f38964817e8e4f030ea5613436d4c055152b0f13c3a142cf92
SHA512	23bc088493babdf0467c059fab9e3f9342f47ee26fccbb1b71ab21f5490cf8072a09e50a6e08b0a3a603de7e6db0ba82ebd212d4f2a29d6486d0877d610d8a5c

C:\Windows\system\PWqaluP.exe

MD5	25c3f905878b00889a56480b1a03f81c
SHA1	c908ddf2a5842f4a46eaa857da4a335e36413779
SHA256	61f3c30d1cbcd596a746e035433ac1d72956f2cbaab05c4f25fb76b00e65b918
SHA512	7da62e0027aad0efdb2e9b927c2281c8549013b93b999b768335571f889d444010d4e2b5928296bf0e4900f517fedcc03b5633a07f133b0fcf4b0bdebc3192a7

\Windows\system\olSzfbc.exe

MD5	c8ebe1e21ff3ccfdf9b705cc99918bf0
SHA1	1b821d88cf2273a0fd29cc162b99f667d46f3328
SHA256	84a147a218f6fa6fbd7c9430c55ca5d57d2b1cbe639802422908c7649dad4259
SHA512	cc0d8e1b2bff2b15f157aa7513308a85056e5947673861901b5b1eb7a8c270a2e5604b9710fa7182e4685f8787af806f5d6274cb69b3841b58b83a9f751d8b60

\Windows\system\ayPCzdH.exe

MD5	b050ab59e40875d8d23d229ecd8a8a5c
SHA1	d895d089328073cb8ac72eb2fb747890f44fa742
SHA256	0ac283a826ec7458065ddfa56c511c9095230f7d3d7f3d1d355cde369f15941f
SHA512	a0075e18988b87f68f8c82449a803426c2e9c9ae88631c471bc791027c64891fa36763ceab4297ab968e71730f74f68bed8e7cf60bdfc859125f7ab2b7e732a8

\Windows\system\oLDtSLO.exe

MD5	b143462ae0824d18794668bac46c510b
SHA1	0a45234b6a06f9f765845d185043eb209f624ad3
SHA256	73834bcf81aa12cc105f65852f08c3a12e7939cdf8b683ce4966613c659fbfe1
SHA512	e3e9e4bcce4ebaff6bc7cbbe4a8517a18b00f6c563b1308dd7eb146647203e62a983e2ddcabd09a39e41870e7c6bd19ba5c745f7df533bc645d8878d21457c4d

\Windows\system\BtEJakZ.exe

MD5	f28cc11f5f5873b57d5bc6de8bd6a11a
SHA1	1102654eff9c8c801cc52f973ffd31c1eac6cb3b
SHA256	2426a179744461db86f53912e2ae6ed253134559e65583f9850b755de3bc4b71
SHA512	f2072308ad0c58d1cccf4e76bb5cac91c36675ebdb80ae9c7d03307ea6dcd88421479e5c57736ee025ded9ffa137d7a3d73fdfa3cc3f2038f5e4ced5a705948a

\Windows\system\vgLIeVg.exe

MD5	c632009c743a425f112fe8eec7f90241
SHA1	c978fa1ff8ef38ffd5fb0413e1e1ee54e685c858
SHA256	29223934c725265cf2761a7c16807adc849e896a6dda1d6a652c78264be3022e
SHA512	9d4bf090753e6efbeb9352251ed54fc8a27df7bf3048fd3f043fe26c12dc51c104956190bac31efa043e37a6e632bda9a0259e1c59753d3e170e87e420170dd7

\Windows\system\tNHdPOi.exe

MD5	fa57f10f81c9dfd564b85eb451fa15c9
SHA1	9e5c72312af85ca400744948615561c3c5c0fa6f
SHA256	eb288352fb0f0478ad04717b872df0f255f1973b5c5c07b6cff75d7517981efd
SHA512	f87e9165b149dba8c472fbdbfd1141595f30062fe96bba8f83176b52aba615724d1e2bd9f51095119ac3283f062ee6264f41d6b15a7c4fc0b8e1c4e3e3de1c08

\Windows\system\tYRwyQf.exe

MD5	7d400bf315fc1c7e6717d17d12b82998
SHA1	27f6dae781e426518d431fc036b8517e19c26967
SHA256	50d2c260e03c059b84ac9b01f4fc821a6e510682023d8f604e04c738a77f1aff
SHA512	500d397d20a9a10d75c0ea86ef613c633719c88224e2aa6b7f0168de893eadce83ae1e5318d7d3f144744739216ff1e5068ece861c5b2acc43014948549d9cc7

\Windows\system\UVLzGqr.exe

MD5	efb94bfe09bce4e68ace558803d22ec0
SHA1	afe6abcd82a14aca6df2743a751262d134ada9d3
SHA256	4346bffce22f90467ea6b71f6c685b61c41973c050c3f9b0450cdc440ac300aa
SHA512	97df0841b6c2c4c4d744cfe6b3af3068db63196c7140fe51dc8f0aeb04b64d9e038fbf4f701ad5eaf914d5aac996ec6816017374ab50aad3fa7387acc6571845

memory/2088-131-0x0000000003340000-0x0000000003732000-memory.dmp

memory/2664-130-0x000000013F260000-0x000000013F652000-memory.dmp

memory/812-129-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

memory/2088-128-0x0000000003340000-0x0000000003732000-memory.dmp

memory/2088-127-0x0000000003340000-0x0000000003732000-memory.dmp

memory/2936-126-0x000000013F680000-0x000000013FA72000-memory.dmp

memory/2088-125-0x0000000003340000-0x0000000003732000-memory.dmp

memory/2632-124-0x000000013F660000-0x000000013FA52000-memory.dmp

memory/2088-123-0x000000013F660000-0x000000013FA52000-memory.dmp

memory/2508-122-0x000000013F940000-0x000000013FD32000-memory.dmp

memory/2600-121-0x000000013FD40000-0x0000000140132000-memory.dmp

memory/2088-120-0x000000013F940000-0x000000013FD32000-memory.dmp

memory/2520-119-0x000000013F4A0000-0x000000013F892000-memory.dmp

\Windows\system\acviclV.exe

MD5	8167d1d7d490c8a0558abbf2a54d38f1
SHA1	8161c96ca00b4575036182d088f084f682533912
SHA256	d44034924879817cf0c05275285dc7c4dbf995d9b82c08f39b7c51fc48f1b4f5
SHA512	5da5438ba54339411d2ef1086df53d0e0a472237bb9bfb0c18edd72b05558c03856418e28bfd482edc4d6aa0bcae95a425838dff0ba6eed237da09bc5f806c88

C:\Windows\system\ynFlFYf.exe

MD5	aa6b0eea5613daf4729226731825c977
SHA1	17e24828287fbd0f812f9fcffc446def671c5cbe
SHA256	049fedd81e84bd22467f0d07f42a75414e4bc7a90a916bfafd3b4ef332e6df51
SHA512	47610d40b3bb46989f589080fcddce8aa5eabc0b6649cc47b6a77e288907941b8f660e3a5d0b588f9dbce5667cdc35a9c60861fe4a00b687087ee0a85a1d9da8

C:\Windows\system\pFQawDa.exe

MD5	2364f73eb743b3251094944dbf52bd1b
SHA1	37fcb6ecd70f3b15cf68cdad0b9434b8e138106a
SHA256	c07b077e80359d4d350c645905244732705bab0484c2c7f20edd5476531704d7
SHA512	75efd331b0c801979b41b2c6fc068a366e2d80b0757f7c7d0ccc4d3e397a2da489b444c893f1b7a86a597f0a3ac784363f416d8a42d0b2a1ac3bfebc425c6e73

C:\Windows\system\QlOEmQj.exe

MD5	af0333c4cbc6838befa6959783cedead
SHA1	6ee79fe0351dd06af0e8e72007775d7841cd7f74
SHA256	c23d8dec7f293c785c200f518b6f5fb533fd401f37d0aa79a76e576e22ffb5f0
SHA512	6fab6553fd02a6c851bfdd63b2d6a3130088854e80b1c5ce65d5c9d86bfc064106ea32f3a5295abab5657cd2f00e14b9833533692121c8d536cc776732a967e9

memory/2160-36-0x000000001B580000-0x000000001B862000-memory.dmp

memory/2088-7-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

memory/2160-534-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

C:\Windows\system\jaEoWGx.exe

MD5	71e0e9a01c07c9af3d26de48f425201d
SHA1	0428e838f0440f448214021201dccc3b0cd9314d
SHA256	c3558c958ef14ea5da64069945aac0435e2391341e2da791416812aed335e45b
SHA512	69137ecd2fa8a765e623ee3270350595212a21c7d849338768b929e0e0bcf6cc828bf542e28ee333c298d574dbbea34bd07daa602194212c7e6c0a564cfbc33e

memory/2632-4783-0x000000013F660000-0x000000013FA52000-memory.dmp

memory/2764-4782-0x000000013F170000-0x000000013F562000-memory.dmp

memory/2936-4784-0x000000013F680000-0x000000013FA72000-memory.dmp

memory/2052-4882-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

memory/2508-4896-0x000000013F940000-0x000000013FD32000-memory.dmp

memory/1804-4898-0x000000013FA20000-0x000000013FE12000-memory.dmp

memory/812-4901-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

memory/2520-4904-0x000000013F4A0000-0x000000013F892000-memory.dmp

memory/2600-4905-0x000000013FD40000-0x0000000140132000-memory.dmp

memory/2664-4906-0x000000013F260000-0x000000013F652000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 13:49

Reported

2024-06-13 13:52

Platform

win10v2004-20240508-en

Max time kernel

61s

Max time network

41s

Command Line

"C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\JkYLrIl.exe	N/A
N/A	N/A	C:\Windows\System\vpqiwre.exe	N/A
N/A	N/A	C:\Windows\System\cYtAGvh.exe	N/A
N/A	N/A	C:\Windows\System\QlOEmQj.exe	N/A
N/A	N/A	C:\Windows\System\jZxLZOY.exe	N/A
N/A	N/A	C:\Windows\System\pcvfPRl.exe	N/A
N/A	N/A	C:\Windows\System\pFQawDa.exe	N/A
N/A	N/A	C:\Windows\System\iDwsRqC.exe	N/A
N/A	N/A	C:\Windows\System\qREQLTs.exe	N/A
N/A	N/A	C:\Windows\System\LXgEyDE.exe	N/A
N/A	N/A	C:\Windows\System\ynFlFYf.exe	N/A
N/A	N/A	C:\Windows\System\bqIXuWN.exe	N/A
N/A	N/A	C:\Windows\System\iolSFNj.exe	N/A
N/A	N/A	C:\Windows\System\sAJRxvK.exe	N/A
N/A	N/A	C:\Windows\System\PWqaluP.exe	N/A
N/A	N/A	C:\Windows\System\kimecOQ.exe	N/A
N/A	N/A	C:\Windows\System\VIjvYvs.exe	N/A
N/A	N/A	C:\Windows\System\YsPOCSI.exe	N/A
N/A	N/A	C:\Windows\System\YLeLXot.exe	N/A
N/A	N/A	C:\Windows\System\acviclV.exe	N/A
N/A	N/A	C:\Windows\System\fWeRZyV.exe	N/A
N/A	N/A	C:\Windows\System\UVLzGqr.exe	N/A
N/A	N/A	C:\Windows\System\feFkKJu.exe	N/A
N/A	N/A	C:\Windows\System\tYRwyQf.exe	N/A
N/A	N/A	C:\Windows\System\DIGOtSV.exe	N/A
N/A	N/A	C:\Windows\System\tNHdPOi.exe	N/A
N/A	N/A	C:\Windows\System\pauHHqh.exe	N/A
N/A	N/A	C:\Windows\System\vgLIeVg.exe	N/A
N/A	N/A	C:\Windows\System\jkiPtsb.exe	N/A
N/A	N/A	C:\Windows\System\BtEJakZ.exe	N/A
N/A	N/A	C:\Windows\System\gmvKDUb.exe	N/A
N/A	N/A	C:\Windows\System\oLDtSLO.exe	N/A
N/A	N/A	C:\Windows\System\ihuljeH.exe	N/A
N/A	N/A	C:\Windows\System\ayPCzdH.exe	N/A
N/A	N/A	C:\Windows\System\CtHdeCo.exe	N/A
N/A	N/A	C:\Windows\System\olSzfbc.exe	N/A
N/A	N/A	C:\Windows\System\KrtTqLA.exe	N/A
N/A	N/A	C:\Windows\System\mKvqgQN.exe	N/A
N/A	N/A	C:\Windows\System\McELQeL.exe	N/A
N/A	N/A	C:\Windows\System\mgwPcpF.exe	N/A
N/A	N/A	C:\Windows\System\tpDvrkG.exe	N/A
N/A	N/A	C:\Windows\System\PvyGqRT.exe	N/A
N/A	N/A	C:\Windows\System\iiWHMVV.exe	N/A
N/A	N/A	C:\Windows\System\QNCtegp.exe	N/A
N/A	N/A	C:\Windows\System\XRUIzcZ.exe	N/A
N/A	N/A	C:\Windows\System\gVYDzFL.exe	N/A
N/A	N/A	C:\Windows\System\JZVHneC.exe	N/A
N/A	N/A	C:\Windows\System\dCdXkPe.exe	N/A
N/A	N/A	C:\Windows\System\pqjCvTb.exe	N/A
N/A	N/A	C:\Windows\System\HPdKKCx.exe	N/A
N/A	N/A	C:\Windows\System\RvgdwhJ.exe	N/A
N/A	N/A	C:\Windows\System\eUKHpNi.exe	N/A
N/A	N/A	C:\Windows\System\MAKFcIu.exe	N/A
N/A	N/A	C:\Windows\System\RkggQyM.exe	N/A
N/A	N/A	C:\Windows\System\YmriSRZ.exe	N/A
N/A	N/A	C:\Windows\System\kImsxRq.exe	N/A
N/A	N/A	C:\Windows\System\jOREXVM.exe	N/A
N/A	N/A	C:\Windows\System\TABLzXP.exe	N/A
N/A	N/A	C:\Windows\System\fAXZhWS.exe	N/A
N/A	N/A	C:\Windows\System\ZGpoIeQ.exe	N/A
N/A	N/A	C:\Windows\System\nnuGMaC.exe	N/A
N/A	N/A	C:\Windows\System\ULOvgrn.exe	N/A
N/A	N/A	C:\Windows\System\cYMoRCv.exe	N/A
N/A	N/A	C:\Windows\System\QXGHeYp.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	raw.githubusercontent.com	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\hdqPFrz.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YOyJevR.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ujSIMRX.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VvugOWN.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\etBPtAL.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AWIXNPS.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VOIfnGR.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rcAwjuw.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dPBzmlf.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lQWEJZQ.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dIwgzov.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GbIXWgp.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QTaNIPI.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NJbpYHc.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MMQKXpm.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OnoXqJO.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JZVHneC.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HULGoTt.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uDLWyYY.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xgxFVVr.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fLosgom.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xuqbbIB.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LFIZjug.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\otBdcTo.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vpqiwre.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\warcGYi.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DgHlWEo.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XpadtPu.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XYotFaD.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tjuxpri.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ANAlMpZ.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ltcqwdN.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jHRgGuu.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VegsotM.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SLhDgCi.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cKTRmxZ.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UZzAhXu.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oblArmJ.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XwMIYGc.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tYRwyQf.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KrtTqLA.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hVkYOWx.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nmzDykd.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UfTbSsR.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qREQLTs.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jPQiPtr.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VZOVqGL.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VwoaHdw.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\McELQeL.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TZpdmYT.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kGWJKmo.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rgUwQNS.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aZjIrgr.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sYKMjLa.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QFvxlfG.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dVOKkDW.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LeKUbgX.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cTjXMoV.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qwYNSVM.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QEJMSOg.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZBzQCmi.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bNXHxLa.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\twSCvti.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qJBJOmg.exe	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3184 wrote to memory of 4440	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 4440	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3184 wrote to memory of 4804	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\JkYLrIl.exe
PID 3184 wrote to memory of 4804	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\JkYLrIl.exe
PID 3184 wrote to memory of 3500	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\vpqiwre.exe
PID 3184 wrote to memory of 3500	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\vpqiwre.exe
PID 3184 wrote to memory of 3408	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\pcvfPRl.exe
PID 3184 wrote to memory of 3408	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\pcvfPRl.exe
PID 3184 wrote to memory of 2928	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\cYtAGvh.exe
PID 3184 wrote to memory of 2928	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\cYtAGvh.exe
PID 3184 wrote to memory of 6088	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\QlOEmQj.exe
PID 3184 wrote to memory of 6088	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\QlOEmQj.exe
PID 3184 wrote to memory of 3288	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\jZxLZOY.exe
PID 3184 wrote to memory of 3288	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\jZxLZOY.exe
PID 3184 wrote to memory of 3900	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\pFQawDa.exe
PID 3184 wrote to memory of 3900	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\pFQawDa.exe
PID 3184 wrote to memory of 532	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\iDwsRqC.exe
PID 3184 wrote to memory of 532	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\iDwsRqC.exe
PID 3184 wrote to memory of 1020	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\qREQLTs.exe
PID 3184 wrote to memory of 1020	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\qREQLTs.exe
PID 3184 wrote to memory of 936	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\LXgEyDE.exe
PID 3184 wrote to memory of 936	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\LXgEyDE.exe
PID 3184 wrote to memory of 3360	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\ynFlFYf.exe
PID 3184 wrote to memory of 3360	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\ynFlFYf.exe
PID 3184 wrote to memory of 3088	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\bqIXuWN.exe
PID 3184 wrote to memory of 3088	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\bqIXuWN.exe
PID 3184 wrote to memory of 4984	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\iolSFNj.exe
PID 3184 wrote to memory of 4984	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\iolSFNj.exe
PID 3184 wrote to memory of 3860	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\sAJRxvK.exe
PID 3184 wrote to memory of 3860	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\sAJRxvK.exe
PID 3184 wrote to memory of 4192	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\PWqaluP.exe
PID 3184 wrote to memory of 4192	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\PWqaluP.exe
PID 3184 wrote to memory of 4328	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\kimecOQ.exe
PID 3184 wrote to memory of 4328	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\kimecOQ.exe
PID 3184 wrote to memory of 1376	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\VIjvYvs.exe
PID 3184 wrote to memory of 1376	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\VIjvYvs.exe
PID 3184 wrote to memory of 4436	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\YsPOCSI.exe
PID 3184 wrote to memory of 4436	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\YsPOCSI.exe
PID 3184 wrote to memory of 1232	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\YLeLXot.exe
PID 3184 wrote to memory of 1232	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\YLeLXot.exe
PID 3184 wrote to memory of 3624	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\acviclV.exe
PID 3184 wrote to memory of 3624	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\acviclV.exe
PID 3184 wrote to memory of 5940	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\fWeRZyV.exe
PID 3184 wrote to memory of 5940	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\fWeRZyV.exe
PID 3184 wrote to memory of 4996	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\UVLzGqr.exe
PID 3184 wrote to memory of 4996	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\UVLzGqr.exe
PID 3184 wrote to memory of 4484	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\feFkKJu.exe
PID 3184 wrote to memory of 4484	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\feFkKJu.exe
PID 3184 wrote to memory of 3952	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\tYRwyQf.exe
PID 3184 wrote to memory of 3952	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\tYRwyQf.exe
PID 3184 wrote to memory of 5508	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\DIGOtSV.exe
PID 3184 wrote to memory of 5508	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\DIGOtSV.exe
PID 3184 wrote to memory of 4052	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\tNHdPOi.exe
PID 3184 wrote to memory of 4052	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\tNHdPOi.exe
PID 3184 wrote to memory of 2820	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\pauHHqh.exe
PID 3184 wrote to memory of 2820	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\pauHHqh.exe
PID 3184 wrote to memory of 1824	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\vgLIeVg.exe
PID 3184 wrote to memory of 1824	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\vgLIeVg.exe
PID 3184 wrote to memory of 5588	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\jkiPtsb.exe
PID 3184 wrote to memory of 5588	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\jkiPtsb.exe
PID 3184 wrote to memory of 1872	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\BtEJakZ.exe
PID 3184 wrote to memory of 1872	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\BtEJakZ.exe
PID 3184 wrote to memory of 1408	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\gmvKDUb.exe
PID 3184 wrote to memory of 1408	N/A	C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe	C:\Windows\System\gmvKDUb.exe

Processes

C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\JkYLrIl.exe

C:\Windows\System\JkYLrIl.exe

C:\Windows\System\vpqiwre.exe

C:\Windows\System\vpqiwre.exe

C:\Windows\System\pcvfPRl.exe

C:\Windows\System\pcvfPRl.exe

C:\Windows\System\cYtAGvh.exe

C:\Windows\System\cYtAGvh.exe

C:\Windows\System\QlOEmQj.exe

C:\Windows\System\QlOEmQj.exe

C:\Windows\System\jZxLZOY.exe

C:\Windows\System\jZxLZOY.exe

C:\Windows\System\pFQawDa.exe

C:\Windows\System\pFQawDa.exe

C:\Windows\System\iDwsRqC.exe

C:\Windows\System\iDwsRqC.exe

C:\Windows\System\qREQLTs.exe

C:\Windows\System\qREQLTs.exe

C:\Windows\System\LXgEyDE.exe

C:\Windows\System\LXgEyDE.exe

C:\Windows\System\ynFlFYf.exe

C:\Windows\System\ynFlFYf.exe

C:\Windows\System\bqIXuWN.exe

C:\Windows\System\bqIXuWN.exe

C:\Windows\System\iolSFNj.exe

C:\Windows\System\iolSFNj.exe

C:\Windows\System\sAJRxvK.exe

C:\Windows\System\sAJRxvK.exe

C:\Windows\System\PWqaluP.exe

C:\Windows\System\PWqaluP.exe

C:\Windows\System\kimecOQ.exe

C:\Windows\System\kimecOQ.exe

C:\Windows\System\VIjvYvs.exe

C:\Windows\System\VIjvYvs.exe

C:\Windows\System\YsPOCSI.exe

C:\Windows\System\YsPOCSI.exe

C:\Windows\System\YLeLXot.exe

C:\Windows\System\YLeLXot.exe

C:\Windows\System\acviclV.exe

C:\Windows\System\acviclV.exe

C:\Windows\System\fWeRZyV.exe

C:\Windows\System\fWeRZyV.exe

C:\Windows\System\UVLzGqr.exe

C:\Windows\System\UVLzGqr.exe

C:\Windows\System\feFkKJu.exe

C:\Windows\System\feFkKJu.exe

C:\Windows\System\tYRwyQf.exe

C:\Windows\System\tYRwyQf.exe

C:\Windows\System\DIGOtSV.exe

C:\Windows\System\DIGOtSV.exe

C:\Windows\System\tNHdPOi.exe

C:\Windows\System\tNHdPOi.exe

C:\Windows\System\pauHHqh.exe

C:\Windows\System\pauHHqh.exe

C:\Windows\System\vgLIeVg.exe

C:\Windows\System\vgLIeVg.exe

C:\Windows\System\jkiPtsb.exe

C:\Windows\System\jkiPtsb.exe

C:\Windows\System\BtEJakZ.exe

C:\Windows\System\BtEJakZ.exe

C:\Windows\System\gmvKDUb.exe

C:\Windows\System\gmvKDUb.exe

C:\Windows\System\oLDtSLO.exe

C:\Windows\System\oLDtSLO.exe

C:\Windows\System\ihuljeH.exe

C:\Windows\System\ihuljeH.exe

C:\Windows\System\ayPCzdH.exe

C:\Windows\System\ayPCzdH.exe

C:\Windows\System\CtHdeCo.exe

C:\Windows\System\CtHdeCo.exe

C:\Windows\System\olSzfbc.exe

C:\Windows\System\olSzfbc.exe

C:\Windows\System\KrtTqLA.exe

C:\Windows\System\KrtTqLA.exe

C:\Windows\System\mKvqgQN.exe

C:\Windows\System\mKvqgQN.exe

C:\Windows\System\McELQeL.exe

C:\Windows\System\McELQeL.exe

C:\Windows\System\mgwPcpF.exe

C:\Windows\System\mgwPcpF.exe

C:\Windows\System\tpDvrkG.exe

C:\Windows\System\tpDvrkG.exe

C:\Windows\System\PvyGqRT.exe

C:\Windows\System\PvyGqRT.exe

C:\Windows\System\iiWHMVV.exe

C:\Windows\System\iiWHMVV.exe

C:\Windows\System\QNCtegp.exe

C:\Windows\System\QNCtegp.exe

C:\Windows\System\XRUIzcZ.exe

C:\Windows\System\XRUIzcZ.exe

C:\Windows\System\gVYDzFL.exe

C:\Windows\System\gVYDzFL.exe

C:\Windows\System\JZVHneC.exe

C:\Windows\System\JZVHneC.exe

C:\Windows\System\dCdXkPe.exe

C:\Windows\System\dCdXkPe.exe

C:\Windows\System\pqjCvTb.exe

C:\Windows\System\pqjCvTb.exe

C:\Windows\System\HPdKKCx.exe

C:\Windows\System\HPdKKCx.exe

C:\Windows\System\RvgdwhJ.exe

C:\Windows\System\RvgdwhJ.exe

C:\Windows\System\eUKHpNi.exe

C:\Windows\System\eUKHpNi.exe

C:\Windows\System\MAKFcIu.exe

C:\Windows\System\MAKFcIu.exe

C:\Windows\System\RkggQyM.exe

C:\Windows\System\RkggQyM.exe

C:\Windows\System\YmriSRZ.exe

C:\Windows\System\YmriSRZ.exe

C:\Windows\System\kImsxRq.exe

C:\Windows\System\kImsxRq.exe

C:\Windows\System\jOREXVM.exe

C:\Windows\System\jOREXVM.exe

C:\Windows\System\TABLzXP.exe

C:\Windows\System\TABLzXP.exe

C:\Windows\System\fAXZhWS.exe

C:\Windows\System\fAXZhWS.exe

C:\Windows\System\ZGpoIeQ.exe

C:\Windows\System\ZGpoIeQ.exe

C:\Windows\System\nnuGMaC.exe

C:\Windows\System\nnuGMaC.exe

C:\Windows\System\ULOvgrn.exe

C:\Windows\System\ULOvgrn.exe

C:\Windows\System\cYMoRCv.exe

C:\Windows\System\cYMoRCv.exe

C:\Windows\System\QXGHeYp.exe

C:\Windows\System\QXGHeYp.exe

C:\Windows\System\JfJwGtV.exe

C:\Windows\System\JfJwGtV.exe

C:\Windows\System\qhMKxtJ.exe

C:\Windows\System\qhMKxtJ.exe

C:\Windows\System\LbTjgxV.exe

C:\Windows\System\LbTjgxV.exe

C:\Windows\System\Srcevlu.exe

C:\Windows\System\Srcevlu.exe

C:\Windows\System\rBOpHGm.exe

C:\Windows\System\rBOpHGm.exe

C:\Windows\System\hojxuDB.exe

C:\Windows\System\hojxuDB.exe

C:\Windows\System\XXEMyyO.exe

C:\Windows\System\XXEMyyO.exe

C:\Windows\System\spqaPML.exe

C:\Windows\System\spqaPML.exe

C:\Windows\System\zifbgXm.exe

C:\Windows\System\zifbgXm.exe

C:\Windows\System\cWoSmfY.exe

C:\Windows\System\cWoSmfY.exe

C:\Windows\System\xdOwNTo.exe

C:\Windows\System\xdOwNTo.exe

C:\Windows\System\JENOtXA.exe

C:\Windows\System\JENOtXA.exe

C:\Windows\System\WGnAHyC.exe

C:\Windows\System\WGnAHyC.exe

C:\Windows\System\KPWKOtQ.exe

C:\Windows\System\KPWKOtQ.exe

C:\Windows\System\DMrWrFX.exe

C:\Windows\System\DMrWrFX.exe

C:\Windows\System\qJBJOmg.exe

C:\Windows\System\qJBJOmg.exe

C:\Windows\System\fYKsITt.exe

C:\Windows\System\fYKsITt.exe

C:\Windows\System\zzRRmzT.exe

C:\Windows\System\zzRRmzT.exe

C:\Windows\System\PHkbptW.exe

C:\Windows\System\PHkbptW.exe

C:\Windows\System\cnlvgAx.exe

C:\Windows\System\cnlvgAx.exe

C:\Windows\System\urDKPOK.exe

C:\Windows\System\urDKPOK.exe

C:\Windows\System\ZSoTPBk.exe

C:\Windows\System\ZSoTPBk.exe

C:\Windows\System\YUIligY.exe

C:\Windows\System\YUIligY.exe

C:\Windows\System\IMgomVr.exe

C:\Windows\System\IMgomVr.exe

C:\Windows\System\fnNIMQV.exe

C:\Windows\System\fnNIMQV.exe

C:\Windows\System\YDtGACC.exe

C:\Windows\System\YDtGACC.exe

C:\Windows\System\GwFRDCb.exe

C:\Windows\System\GwFRDCb.exe

C:\Windows\System\JmnSSGY.exe

C:\Windows\System\JmnSSGY.exe

C:\Windows\System\cRAnCcm.exe

C:\Windows\System\cRAnCcm.exe

C:\Windows\System\GMXsZWA.exe

C:\Windows\System\GMXsZWA.exe

C:\Windows\System\iuSjnJz.exe

C:\Windows\System\iuSjnJz.exe

C:\Windows\System\GMRxyVR.exe

C:\Windows\System\GMRxyVR.exe

C:\Windows\System\IVNCFGb.exe

C:\Windows\System\IVNCFGb.exe

C:\Windows\System\oidQhOO.exe

C:\Windows\System\oidQhOO.exe

C:\Windows\System\TLKGPOF.exe

C:\Windows\System\TLKGPOF.exe

C:\Windows\System\YxrpnAY.exe

C:\Windows\System\YxrpnAY.exe

C:\Windows\System\HULGoTt.exe

C:\Windows\System\HULGoTt.exe

C:\Windows\System\mOYVXwc.exe

C:\Windows\System\mOYVXwc.exe

C:\Windows\System\pXdsPuE.exe

C:\Windows\System\pXdsPuE.exe

C:\Windows\System\YFKPtjn.exe

C:\Windows\System\YFKPtjn.exe

C:\Windows\System\OZXdpwS.exe

C:\Windows\System\OZXdpwS.exe

C:\Windows\System\VjHUtrJ.exe

C:\Windows\System\VjHUtrJ.exe

C:\Windows\System\mpthGbB.exe

C:\Windows\System\mpthGbB.exe

C:\Windows\System\rTXiCPR.exe

C:\Windows\System\rTXiCPR.exe

C:\Windows\System\uWJQVth.exe

C:\Windows\System\uWJQVth.exe

C:\Windows\System\GcJSlce.exe

C:\Windows\System\GcJSlce.exe

C:\Windows\System\fCFbVoN.exe

C:\Windows\System\fCFbVoN.exe

C:\Windows\System\ciVFIkp.exe

C:\Windows\System\ciVFIkp.exe

C:\Windows\System\lthoaiw.exe

C:\Windows\System\lthoaiw.exe

C:\Windows\System\lxTqiTs.exe

C:\Windows\System\lxTqiTs.exe

C:\Windows\System\ceimOdj.exe

C:\Windows\System\ceimOdj.exe

C:\Windows\System\iMkJoiZ.exe

C:\Windows\System\iMkJoiZ.exe

C:\Windows\System\JyddNuu.exe

C:\Windows\System\JyddNuu.exe

C:\Windows\System\bObcosx.exe

C:\Windows\System\bObcosx.exe

C:\Windows\System\NjHMLVj.exe

C:\Windows\System\NjHMLVj.exe

C:\Windows\System\jaxlhuX.exe

C:\Windows\System\jaxlhuX.exe

C:\Windows\System\eNBovkS.exe

C:\Windows\System\eNBovkS.exe

C:\Windows\System\bLMIaRj.exe

C:\Windows\System\bLMIaRj.exe

C:\Windows\System\NmMurkO.exe

C:\Windows\System\NmMurkO.exe

C:\Windows\System\LHeUJEZ.exe

C:\Windows\System\LHeUJEZ.exe

C:\Windows\System\quAfpNl.exe

C:\Windows\System\quAfpNl.exe

C:\Windows\System\tlewgxU.exe

C:\Windows\System\tlewgxU.exe

C:\Windows\System\gqSJraP.exe

C:\Windows\System\gqSJraP.exe

C:\Windows\System\uZWmgHm.exe

C:\Windows\System\uZWmgHm.exe

C:\Windows\System\lxPlvxE.exe

C:\Windows\System\lxPlvxE.exe

C:\Windows\System\HURemSR.exe

C:\Windows\System\HURemSR.exe

C:\Windows\System\WEOFNlK.exe

C:\Windows\System\WEOFNlK.exe

C:\Windows\System\cdzQGVS.exe

C:\Windows\System\cdzQGVS.exe

C:\Windows\System\paObzgq.exe

C:\Windows\System\paObzgq.exe

C:\Windows\System\PmSAcWU.exe

C:\Windows\System\PmSAcWU.exe

C:\Windows\System\IORbbvQ.exe

C:\Windows\System\IORbbvQ.exe

C:\Windows\System\FwYGUSm.exe

C:\Windows\System\FwYGUSm.exe

C:\Windows\System\wmEYfwI.exe

C:\Windows\System\wmEYfwI.exe

C:\Windows\System\nePDnCW.exe

C:\Windows\System\nePDnCW.exe

C:\Windows\System\dVOKkDW.exe

C:\Windows\System\dVOKkDW.exe

C:\Windows\System\YOyJevR.exe

C:\Windows\System\YOyJevR.exe

C:\Windows\System\pifZlKG.exe

C:\Windows\System\pifZlKG.exe

C:\Windows\System\YfDDZNg.exe

C:\Windows\System\YfDDZNg.exe

C:\Windows\System\XiCKUma.exe

C:\Windows\System\XiCKUma.exe

C:\Windows\System\GWazcNF.exe

C:\Windows\System\GWazcNF.exe

C:\Windows\System\RoLTZMt.exe

C:\Windows\System\RoLTZMt.exe

C:\Windows\System\tHrOCXy.exe

C:\Windows\System\tHrOCXy.exe

C:\Windows\System\ZQFtjqt.exe

C:\Windows\System\ZQFtjqt.exe

C:\Windows\System\TZpdmYT.exe

C:\Windows\System\TZpdmYT.exe

C:\Windows\System\DubydpR.exe

C:\Windows\System\DubydpR.exe

C:\Windows\System\ditbKKw.exe

C:\Windows\System\ditbKKw.exe

C:\Windows\System\QZpFUko.exe

C:\Windows\System\QZpFUko.exe

C:\Windows\System\hOefyBl.exe

C:\Windows\System\hOefyBl.exe

C:\Windows\System\mOdPpNV.exe

C:\Windows\System\mOdPpNV.exe

C:\Windows\System\kPFdNZU.exe

C:\Windows\System\kPFdNZU.exe

C:\Windows\System\ALjRGlp.exe

C:\Windows\System\ALjRGlp.exe

C:\Windows\System\OqMnsMc.exe

C:\Windows\System\OqMnsMc.exe

C:\Windows\System\nLuxLvB.exe

C:\Windows\System\nLuxLvB.exe

C:\Windows\System\HOQXeBe.exe

C:\Windows\System\HOQXeBe.exe

C:\Windows\System\QOCUgkH.exe

C:\Windows\System\QOCUgkH.exe

C:\Windows\System\eGWzKCl.exe

C:\Windows\System\eGWzKCl.exe

C:\Windows\System\etdAtUG.exe

C:\Windows\System\etdAtUG.exe

C:\Windows\System\trdMWjz.exe

C:\Windows\System\trdMWjz.exe

C:\Windows\System\RDBaIam.exe

C:\Windows\System\RDBaIam.exe

C:\Windows\System\RCRgBTk.exe

C:\Windows\System\RCRgBTk.exe

C:\Windows\System\aeoIryE.exe

C:\Windows\System\aeoIryE.exe

C:\Windows\System\ujSIMRX.exe

C:\Windows\System\ujSIMRX.exe

C:\Windows\System\jRPRhkE.exe

C:\Windows\System\jRPRhkE.exe

C:\Windows\System\QrXZzwa.exe

C:\Windows\System\QrXZzwa.exe

C:\Windows\System\fEckhem.exe

C:\Windows\System\fEckhem.exe

C:\Windows\System\lIPkMYx.exe

C:\Windows\System\lIPkMYx.exe

C:\Windows\System\cyKqksZ.exe

C:\Windows\System\cyKqksZ.exe

C:\Windows\System\ttaQQvo.exe

C:\Windows\System\ttaQQvo.exe

C:\Windows\System\TddufFN.exe

C:\Windows\System\TddufFN.exe

C:\Windows\System\wLDmhAE.exe

C:\Windows\System\wLDmhAE.exe

C:\Windows\System\ZmejgHs.exe

C:\Windows\System\ZmejgHs.exe

C:\Windows\System\xIMbwxJ.exe

C:\Windows\System\xIMbwxJ.exe

C:\Windows\System\hrvHuOg.exe

C:\Windows\System\hrvHuOg.exe

C:\Windows\System\Clskrrs.exe

C:\Windows\System\Clskrrs.exe

C:\Windows\System\UhXOIaP.exe

C:\Windows\System\UhXOIaP.exe

C:\Windows\System\CZSLBhD.exe

C:\Windows\System\CZSLBhD.exe

C:\Windows\System\bFaURTj.exe

C:\Windows\System\bFaURTj.exe

C:\Windows\System\GZncygt.exe

C:\Windows\System\GZncygt.exe

C:\Windows\System\hVkYOWx.exe

C:\Windows\System\hVkYOWx.exe

C:\Windows\System\TfLJaGB.exe

C:\Windows\System\TfLJaGB.exe

C:\Windows\System\Wzltpin.exe

C:\Windows\System\Wzltpin.exe

C:\Windows\System\tzOOdiP.exe

C:\Windows\System\tzOOdiP.exe

C:\Windows\System\QPbWplT.exe

C:\Windows\System\QPbWplT.exe

C:\Windows\System\AIMwMvu.exe

C:\Windows\System\AIMwMvu.exe

C:\Windows\System\IDljiEh.exe

C:\Windows\System\IDljiEh.exe

C:\Windows\System\KDvmyVE.exe

C:\Windows\System\KDvmyVE.exe

C:\Windows\System\gcJScsi.exe

C:\Windows\System\gcJScsi.exe

C:\Windows\System\LIBEayY.exe

C:\Windows\System\LIBEayY.exe

C:\Windows\System\dPBzmlf.exe

C:\Windows\System\dPBzmlf.exe

C:\Windows\System\iwBsgrS.exe

C:\Windows\System\iwBsgrS.exe

C:\Windows\System\nmzDykd.exe

C:\Windows\System\nmzDykd.exe

C:\Windows\System\qHkosul.exe

C:\Windows\System\qHkosul.exe

C:\Windows\System\NSRxPFT.exe

C:\Windows\System\NSRxPFT.exe

C:\Windows\System\OZXooaS.exe

C:\Windows\System\OZXooaS.exe

C:\Windows\System\BkYSWdO.exe

C:\Windows\System\BkYSWdO.exe

C:\Windows\System\olUqZDS.exe

C:\Windows\System\olUqZDS.exe

C:\Windows\System\xpWZceU.exe

C:\Windows\System\xpWZceU.exe

C:\Windows\System\UsxfgVg.exe

C:\Windows\System\UsxfgVg.exe

C:\Windows\System\UrOaIKC.exe

C:\Windows\System\UrOaIKC.exe

C:\Windows\System\zIGtYEC.exe

C:\Windows\System\zIGtYEC.exe

C:\Windows\System\xsXMzuf.exe

C:\Windows\System\xsXMzuf.exe

C:\Windows\System\yOGVWWI.exe

C:\Windows\System\yOGVWWI.exe

C:\Windows\System\XkleLoz.exe

C:\Windows\System\XkleLoz.exe

C:\Windows\System\hIOIyUs.exe

C:\Windows\System\hIOIyUs.exe

C:\Windows\System\McQZNTw.exe

C:\Windows\System\McQZNTw.exe

C:\Windows\System\peDRfqu.exe

C:\Windows\System\peDRfqu.exe

C:\Windows\System\BbCSdCJ.exe

C:\Windows\System\BbCSdCJ.exe

C:\Windows\System\VvugOWN.exe

C:\Windows\System\VvugOWN.exe

C:\Windows\System\bbCgIYo.exe

C:\Windows\System\bbCgIYo.exe

C:\Windows\System\luQszZj.exe

C:\Windows\System\luQszZj.exe

C:\Windows\System\dGyrhuo.exe

C:\Windows\System\dGyrhuo.exe

C:\Windows\System\sxQcnxk.exe

C:\Windows\System\sxQcnxk.exe

C:\Windows\System\mFuOrnH.exe

C:\Windows\System\mFuOrnH.exe

C:\Windows\System\bQxXOwX.exe

C:\Windows\System\bQxXOwX.exe

C:\Windows\System\EVIgOAh.exe

C:\Windows\System\EVIgOAh.exe

C:\Windows\System\MbCKRhC.exe

C:\Windows\System\MbCKRhC.exe

C:\Windows\System\TPiXFNa.exe

C:\Windows\System\TPiXFNa.exe

C:\Windows\System\lQWEJZQ.exe

C:\Windows\System\lQWEJZQ.exe

C:\Windows\System\eCENnFx.exe

C:\Windows\System\eCENnFx.exe

C:\Windows\System\fimwrrR.exe

C:\Windows\System\fimwrrR.exe

C:\Windows\System\JBTODQA.exe

C:\Windows\System\JBTODQA.exe

C:\Windows\System\HGgAggk.exe

C:\Windows\System\HGgAggk.exe

C:\Windows\System\dYSwtlS.exe

C:\Windows\System\dYSwtlS.exe

C:\Windows\System\ZSkAmLq.exe

C:\Windows\System\ZSkAmLq.exe

C:\Windows\System\buBFttM.exe

C:\Windows\System\buBFttM.exe

C:\Windows\System\vPlkQxZ.exe

C:\Windows\System\vPlkQxZ.exe

C:\Windows\System\YPtWRbz.exe

C:\Windows\System\YPtWRbz.exe

C:\Windows\System\eXTKMFG.exe

C:\Windows\System\eXTKMFG.exe

C:\Windows\System\kUCDURU.exe

C:\Windows\System\kUCDURU.exe

C:\Windows\System\XePHHpD.exe

C:\Windows\System\XePHHpD.exe

C:\Windows\System\sRvaGpH.exe

C:\Windows\System\sRvaGpH.exe

C:\Windows\System\YmCeYFC.exe

C:\Windows\System\YmCeYFC.exe

C:\Windows\System\etBPtAL.exe

C:\Windows\System\etBPtAL.exe

C:\Windows\System\neKqEDB.exe

C:\Windows\System\neKqEDB.exe

C:\Windows\System\oNXwqgV.exe

C:\Windows\System\oNXwqgV.exe

C:\Windows\System\RPtKkOG.exe

C:\Windows\System\RPtKkOG.exe

C:\Windows\System\xwPKFoX.exe

C:\Windows\System\xwPKFoX.exe

C:\Windows\System\xiABLOZ.exe

C:\Windows\System\xiABLOZ.exe

C:\Windows\System\DHTQimn.exe

C:\Windows\System\DHTQimn.exe

C:\Windows\System\rRiWYed.exe

C:\Windows\System\rRiWYed.exe

C:\Windows\System\HTqVugt.exe

C:\Windows\System\HTqVugt.exe

C:\Windows\System\QrVVmas.exe

C:\Windows\System\QrVVmas.exe

C:\Windows\System\CBDjkUz.exe

C:\Windows\System\CBDjkUz.exe

C:\Windows\System\FJMrOyN.exe

C:\Windows\System\FJMrOyN.exe

C:\Windows\System\zWDnlYD.exe

C:\Windows\System\zWDnlYD.exe

C:\Windows\System\URbIcOE.exe

C:\Windows\System\URbIcOE.exe

C:\Windows\System\xNqMHuJ.exe

C:\Windows\System\xNqMHuJ.exe

C:\Windows\System\yYbVmlK.exe

C:\Windows\System\yYbVmlK.exe

C:\Windows\System\gOBBrnW.exe

C:\Windows\System\gOBBrnW.exe

C:\Windows\System\bpddGCn.exe

C:\Windows\System\bpddGCn.exe

C:\Windows\System\JpxZaXg.exe

C:\Windows\System\JpxZaXg.exe

C:\Windows\System\ekChglE.exe

C:\Windows\System\ekChglE.exe

C:\Windows\System\dcpdEzF.exe

C:\Windows\System\dcpdEzF.exe

C:\Windows\System\DNYUufR.exe

C:\Windows\System\DNYUufR.exe

C:\Windows\System\TysyHLs.exe

C:\Windows\System\TysyHLs.exe

C:\Windows\System\pdKwnRb.exe

C:\Windows\System\pdKwnRb.exe

C:\Windows\System\POYBYZy.exe

C:\Windows\System\POYBYZy.exe

C:\Windows\System\sClMnok.exe

C:\Windows\System\sClMnok.exe

C:\Windows\System\jBzqHpD.exe

C:\Windows\System\jBzqHpD.exe

C:\Windows\System\dIwgzov.exe

C:\Windows\System\dIwgzov.exe

C:\Windows\System\yANPbPA.exe

C:\Windows\System\yANPbPA.exe

C:\Windows\System\fLKdVvI.exe

C:\Windows\System\fLKdVvI.exe

C:\Windows\System\dqYlUkC.exe

C:\Windows\System\dqYlUkC.exe

C:\Windows\System\NVGqxSC.exe

C:\Windows\System\NVGqxSC.exe

C:\Windows\System\jveWVpd.exe

C:\Windows\System\jveWVpd.exe

C:\Windows\System\FdBAupT.exe

C:\Windows\System\FdBAupT.exe

C:\Windows\System\XBpHrMw.exe

C:\Windows\System\XBpHrMw.exe

C:\Windows\System\BseXZPs.exe

C:\Windows\System\BseXZPs.exe

C:\Windows\System\aHWhzkr.exe

C:\Windows\System\aHWhzkr.exe

C:\Windows\System\nefnAyQ.exe

C:\Windows\System\nefnAyQ.exe

C:\Windows\System\fXWRXCe.exe

C:\Windows\System\fXWRXCe.exe

C:\Windows\System\MBIHMOO.exe

C:\Windows\System\MBIHMOO.exe

C:\Windows\System\wxwUfuh.exe

C:\Windows\System\wxwUfuh.exe

C:\Windows\System\ieQZeZa.exe

C:\Windows\System\ieQZeZa.exe

C:\Windows\System\FTpdHJW.exe

C:\Windows\System\FTpdHJW.exe

C:\Windows\System\COwPHxc.exe

C:\Windows\System\COwPHxc.exe

C:\Windows\System\LzEuoix.exe

C:\Windows\System\LzEuoix.exe

C:\Windows\System\kvUYXWj.exe

C:\Windows\System\kvUYXWj.exe

C:\Windows\System\fbxaWqd.exe

C:\Windows\System\fbxaWqd.exe

C:\Windows\System\azCJLHc.exe

C:\Windows\System\azCJLHc.exe

C:\Windows\System\SpqqiMP.exe

C:\Windows\System\SpqqiMP.exe

C:\Windows\System\aKZECUo.exe

C:\Windows\System\aKZECUo.exe

C:\Windows\System\dhjAwLX.exe

C:\Windows\System\dhjAwLX.exe

C:\Windows\System\MbhUHEX.exe

C:\Windows\System\MbhUHEX.exe

C:\Windows\System\vctIkJp.exe

C:\Windows\System\vctIkJp.exe

C:\Windows\System\reDtCcf.exe

C:\Windows\System\reDtCcf.exe

C:\Windows\System\kOahDES.exe

C:\Windows\System\kOahDES.exe

C:\Windows\System\uiFUUNQ.exe

C:\Windows\System\uiFUUNQ.exe

C:\Windows\System\WbZYcvR.exe

C:\Windows\System\WbZYcvR.exe

C:\Windows\System\rTidJNr.exe

C:\Windows\System\rTidJNr.exe

C:\Windows\System\qUGcvLC.exe

C:\Windows\System\qUGcvLC.exe

C:\Windows\System\mALxCeb.exe

C:\Windows\System\mALxCeb.exe

C:\Windows\System\JbifMaB.exe

C:\Windows\System\JbifMaB.exe

C:\Windows\System\cPCoaFV.exe

C:\Windows\System\cPCoaFV.exe

C:\Windows\System\eJIUARy.exe

C:\Windows\System\eJIUARy.exe

C:\Windows\System\brWtKgM.exe

C:\Windows\System\brWtKgM.exe

C:\Windows\System\sbfqUIS.exe

C:\Windows\System\sbfqUIS.exe

C:\Windows\System\ppOHcmt.exe

C:\Windows\System\ppOHcmt.exe

C:\Windows\System\OYqJKHS.exe

C:\Windows\System\OYqJKHS.exe

C:\Windows\System\SAnFsep.exe

C:\Windows\System\SAnFsep.exe

C:\Windows\System\KRkiSwN.exe

C:\Windows\System\KRkiSwN.exe

C:\Windows\System\WBwxclj.exe

C:\Windows\System\WBwxclj.exe

C:\Windows\System\dOKJZiU.exe

C:\Windows\System\dOKJZiU.exe

C:\Windows\System\rMuuhAd.exe

C:\Windows\System\rMuuhAd.exe

C:\Windows\System\eGSlSgk.exe

C:\Windows\System\eGSlSgk.exe

C:\Windows\System\LJzrklC.exe

C:\Windows\System\LJzrklC.exe

C:\Windows\System\LeKUbgX.exe

C:\Windows\System\LeKUbgX.exe

C:\Windows\System\aRgILqe.exe

C:\Windows\System\aRgILqe.exe

C:\Windows\System\TIilbhm.exe

C:\Windows\System\TIilbhm.exe

C:\Windows\System\eRMQPjD.exe

C:\Windows\System\eRMQPjD.exe

C:\Windows\System\RkEpNSN.exe

C:\Windows\System\RkEpNSN.exe

C:\Windows\System\EonWVva.exe

C:\Windows\System\EonWVva.exe

C:\Windows\System\CrkSttg.exe

C:\Windows\System\CrkSttg.exe

C:\Windows\System\dqJkYVR.exe

C:\Windows\System\dqJkYVR.exe

C:\Windows\System\FuCDKEu.exe

C:\Windows\System\FuCDKEu.exe

C:\Windows\System\PyvkjnM.exe

C:\Windows\System\PyvkjnM.exe

C:\Windows\System\KlHwHvG.exe

C:\Windows\System\KlHwHvG.exe

C:\Windows\System\nIaHoXs.exe

C:\Windows\System\nIaHoXs.exe

C:\Windows\System\RIstQKR.exe

C:\Windows\System\RIstQKR.exe

C:\Windows\System\AThVxOB.exe

C:\Windows\System\AThVxOB.exe

C:\Windows\System\HVVPZKV.exe

C:\Windows\System\HVVPZKV.exe

C:\Windows\System\vcwRbcF.exe

C:\Windows\System\vcwRbcF.exe

C:\Windows\System\NPEuqyT.exe

C:\Windows\System\NPEuqyT.exe

C:\Windows\System\ccfkUIB.exe

C:\Windows\System\ccfkUIB.exe

C:\Windows\System\XbRBxUP.exe

C:\Windows\System\XbRBxUP.exe

C:\Windows\System\lZuKaGZ.exe

C:\Windows\System\lZuKaGZ.exe

C:\Windows\System\FfybAjs.exe

C:\Windows\System\FfybAjs.exe

C:\Windows\System\QFnYRON.exe

C:\Windows\System\QFnYRON.exe

C:\Windows\System\EUkHIgV.exe

C:\Windows\System\EUkHIgV.exe

C:\Windows\System\DbOjQOt.exe

C:\Windows\System\DbOjQOt.exe

C:\Windows\System\cKTRmxZ.exe

C:\Windows\System\cKTRmxZ.exe

C:\Windows\System\smIgTNV.exe

C:\Windows\System\smIgTNV.exe

C:\Windows\System\gGahXiI.exe

C:\Windows\System\gGahXiI.exe

C:\Windows\System\DvSQRxX.exe

C:\Windows\System\DvSQRxX.exe

C:\Windows\System\zVsnOhQ.exe

C:\Windows\System\zVsnOhQ.exe

C:\Windows\System\qvMfsni.exe

C:\Windows\System\qvMfsni.exe

C:\Windows\System\ktNbVpv.exe

C:\Windows\System\ktNbVpv.exe

C:\Windows\System\LWdjvLf.exe

C:\Windows\System\LWdjvLf.exe

C:\Windows\System\WPBEoeg.exe

C:\Windows\System\WPBEoeg.exe

C:\Windows\System\ltcqwdN.exe

C:\Windows\System\ltcqwdN.exe

C:\Windows\System\TEkbvMG.exe

C:\Windows\System\TEkbvMG.exe

C:\Windows\System\DoykwQw.exe

C:\Windows\System\DoykwQw.exe

C:\Windows\System\oQgyGdb.exe

C:\Windows\System\oQgyGdb.exe

C:\Windows\System\guWEQaM.exe

C:\Windows\System\guWEQaM.exe

C:\Windows\System\XMlVPmK.exe

C:\Windows\System\XMlVPmK.exe

C:\Windows\System\LTJOJUk.exe

C:\Windows\System\LTJOJUk.exe

C:\Windows\System\zwjLILw.exe

C:\Windows\System\zwjLILw.exe

C:\Windows\System\mOMLvMj.exe

C:\Windows\System\mOMLvMj.exe

C:\Windows\System\CTZsKzG.exe

C:\Windows\System\CTZsKzG.exe

C:\Windows\System\ycEWAQD.exe

C:\Windows\System\ycEWAQD.exe

C:\Windows\System\hPKVgWX.exe

C:\Windows\System\hPKVgWX.exe

C:\Windows\System\jxKVJsZ.exe

C:\Windows\System\jxKVJsZ.exe

C:\Windows\System\jPQiPtr.exe

C:\Windows\System\jPQiPtr.exe

C:\Windows\System\IiLChML.exe

C:\Windows\System\IiLChML.exe

C:\Windows\System\EVTHzCn.exe

C:\Windows\System\EVTHzCn.exe

C:\Windows\System\wDZTvTC.exe

C:\Windows\System\wDZTvTC.exe

C:\Windows\System\XlukvdS.exe

C:\Windows\System\XlukvdS.exe

C:\Windows\System\ipzNtps.exe

C:\Windows\System\ipzNtps.exe

C:\Windows\System\WKXRWNL.exe

C:\Windows\System\WKXRWNL.exe

C:\Windows\System\ugUJOJo.exe

C:\Windows\System\ugUJOJo.exe

C:\Windows\System\jHRgGuu.exe

C:\Windows\System\jHRgGuu.exe

C:\Windows\System\rrslzAl.exe

C:\Windows\System\rrslzAl.exe

C:\Windows\System\dvvPwfJ.exe

C:\Windows\System\dvvPwfJ.exe

C:\Windows\System\eijKxmU.exe

C:\Windows\System\eijKxmU.exe

C:\Windows\System\OCmaZle.exe

C:\Windows\System\OCmaZle.exe

C:\Windows\System\xdSPNsO.exe

C:\Windows\System\xdSPNsO.exe

C:\Windows\System\ovosXVX.exe

C:\Windows\System\ovosXVX.exe

C:\Windows\System\kEcisUd.exe

C:\Windows\System\kEcisUd.exe

C:\Windows\System\uSMnLsp.exe

C:\Windows\System\uSMnLsp.exe

C:\Windows\System\xeLeYhL.exe

C:\Windows\System\xeLeYhL.exe

C:\Windows\System\ruXRdyi.exe

C:\Windows\System\ruXRdyi.exe

C:\Windows\System\VegsotM.exe

C:\Windows\System\VegsotM.exe

C:\Windows\System\DlODzHo.exe

C:\Windows\System\DlODzHo.exe

C:\Windows\System\mGLryTm.exe

C:\Windows\System\mGLryTm.exe

C:\Windows\System\vNVMjSt.exe

C:\Windows\System\vNVMjSt.exe

C:\Windows\System\WfUgjoA.exe

C:\Windows\System\WfUgjoA.exe

C:\Windows\System\WZfOWrU.exe

C:\Windows\System\WZfOWrU.exe

C:\Windows\System\SLhDgCi.exe

C:\Windows\System\SLhDgCi.exe

C:\Windows\System\qjgGJTi.exe

C:\Windows\System\qjgGJTi.exe

C:\Windows\System\LanpBxC.exe

C:\Windows\System\LanpBxC.exe

C:\Windows\System\qqxcVdJ.exe

C:\Windows\System\qqxcVdJ.exe

C:\Windows\System\IRvBarx.exe

C:\Windows\System\IRvBarx.exe

C:\Windows\System\sfbeqgH.exe

C:\Windows\System\sfbeqgH.exe

C:\Windows\System\uQlqwYd.exe

C:\Windows\System\uQlqwYd.exe

C:\Windows\System\dFBkWmG.exe

C:\Windows\System\dFBkWmG.exe

C:\Windows\System\atgvmpF.exe

C:\Windows\System\atgvmpF.exe

C:\Windows\System\zIubPhm.exe

C:\Windows\System\zIubPhm.exe

C:\Windows\System\hSNgqlU.exe

C:\Windows\System\hSNgqlU.exe

C:\Windows\System\sOyYFkh.exe

C:\Windows\System\sOyYFkh.exe

C:\Windows\System\gPqFXwP.exe

C:\Windows\System\gPqFXwP.exe

C:\Windows\System\uKffVlL.exe

C:\Windows\System\uKffVlL.exe

C:\Windows\System\juCeqsH.exe

C:\Windows\System\juCeqsH.exe

C:\Windows\System\fHVGKDt.exe

C:\Windows\System\fHVGKDt.exe

C:\Windows\System\CFETDwK.exe

C:\Windows\System\CFETDwK.exe

C:\Windows\System\cvOUMgk.exe

C:\Windows\System\cvOUMgk.exe

C:\Windows\System\pRWVOTD.exe

C:\Windows\System\pRWVOTD.exe

C:\Windows\System\rhqqlOl.exe

C:\Windows\System\rhqqlOl.exe

C:\Windows\System\ReowqPK.exe

C:\Windows\System\ReowqPK.exe

C:\Windows\System\yMmsEYT.exe

C:\Windows\System\yMmsEYT.exe

C:\Windows\System\dQMryJp.exe

C:\Windows\System\dQMryJp.exe

C:\Windows\System\JOBtAjK.exe

C:\Windows\System\JOBtAjK.exe

C:\Windows\System\PZEWijA.exe

C:\Windows\System\PZEWijA.exe

C:\Windows\System\LranCwh.exe

C:\Windows\System\LranCwh.exe

C:\Windows\System\jBzqBQo.exe

C:\Windows\System\jBzqBQo.exe

C:\Windows\System\TywkZLp.exe

C:\Windows\System\TywkZLp.exe

C:\Windows\System\IunaJSW.exe

C:\Windows\System\IunaJSW.exe

C:\Windows\System\PaDZCGi.exe

C:\Windows\System\PaDZCGi.exe

C:\Windows\System\uCgFeEE.exe

C:\Windows\System\uCgFeEE.exe

C:\Windows\System\XpadtPu.exe

C:\Windows\System\XpadtPu.exe

C:\Windows\System\RciIOln.exe

C:\Windows\System\RciIOln.exe

C:\Windows\System\uDLWyYY.exe

C:\Windows\System\uDLWyYY.exe

C:\Windows\System\qDtYgLL.exe

C:\Windows\System\qDtYgLL.exe

C:\Windows\System\MiyMXkd.exe

C:\Windows\System\MiyMXkd.exe

C:\Windows\System\yDRpiEU.exe

C:\Windows\System\yDRpiEU.exe

C:\Windows\System\wIRXqol.exe

C:\Windows\System\wIRXqol.exe

C:\Windows\System\ngtjQaZ.exe

C:\Windows\System\ngtjQaZ.exe

C:\Windows\System\azeHeTO.exe

C:\Windows\System\azeHeTO.exe

C:\Windows\System\NNGcPwe.exe

C:\Windows\System\NNGcPwe.exe

C:\Windows\System\iOtXJaI.exe

C:\Windows\System\iOtXJaI.exe

C:\Windows\System\IIjDFme.exe

C:\Windows\System\IIjDFme.exe

C:\Windows\System\wMQtfdR.exe

C:\Windows\System\wMQtfdR.exe

C:\Windows\System\rosXMtF.exe

C:\Windows\System\rosXMtF.exe

C:\Windows\System\EmdcwVQ.exe

C:\Windows\System\EmdcwVQ.exe

C:\Windows\System\tczSckY.exe

C:\Windows\System\tczSckY.exe

C:\Windows\System\xgxFVVr.exe

C:\Windows\System\xgxFVVr.exe

C:\Windows\System\usSLkvv.exe

C:\Windows\System\usSLkvv.exe

C:\Windows\System\bqcCJpg.exe

C:\Windows\System\bqcCJpg.exe

C:\Windows\System\kGWJKmo.exe

C:\Windows\System\kGWJKmo.exe

C:\Windows\System\nztLXbG.exe

C:\Windows\System\nztLXbG.exe

C:\Windows\System\eTYoqSH.exe

C:\Windows\System\eTYoqSH.exe

C:\Windows\System\hFaKtwH.exe

C:\Windows\System\hFaKtwH.exe

C:\Windows\System\xKfWpmU.exe

C:\Windows\System\xKfWpmU.exe

C:\Windows\System\hVCVocK.exe

C:\Windows\System\hVCVocK.exe

C:\Windows\System\EPUtWEX.exe

C:\Windows\System\EPUtWEX.exe

C:\Windows\System\opMiwFF.exe

C:\Windows\System\opMiwFF.exe

C:\Windows\System\xpqGAIa.exe

C:\Windows\System\xpqGAIa.exe

C:\Windows\System\viDfhLS.exe

C:\Windows\System\viDfhLS.exe

C:\Windows\System\NJaEByn.exe

C:\Windows\System\NJaEByn.exe

C:\Windows\System\nklXduL.exe

C:\Windows\System\nklXduL.exe

C:\Windows\System\kOmSrip.exe

C:\Windows\System\kOmSrip.exe

C:\Windows\System\BYIEEQw.exe

C:\Windows\System\BYIEEQw.exe

C:\Windows\System\EwTsLJe.exe

C:\Windows\System\EwTsLJe.exe

C:\Windows\System\DHAeiLO.exe

C:\Windows\System\DHAeiLO.exe

C:\Windows\System\IwamEPB.exe

C:\Windows\System\IwamEPB.exe

C:\Windows\System\DmIQZQB.exe

C:\Windows\System\DmIQZQB.exe

C:\Windows\System\gDPioKy.exe

C:\Windows\System\gDPioKy.exe

C:\Windows\System\iUaNnyG.exe

C:\Windows\System\iUaNnyG.exe

C:\Windows\System\tNyMSMV.exe

C:\Windows\System\tNyMSMV.exe

C:\Windows\System\JKpcjNo.exe

C:\Windows\System\JKpcjNo.exe

C:\Windows\System\xaZVbck.exe

C:\Windows\System\xaZVbck.exe

C:\Windows\System\hYZFCuY.exe

C:\Windows\System\hYZFCuY.exe

C:\Windows\System\NhGGgcQ.exe

C:\Windows\System\NhGGgcQ.exe

C:\Windows\System\akgLTZe.exe

C:\Windows\System\akgLTZe.exe

C:\Windows\System\WAcnkBq.exe

C:\Windows\System\WAcnkBq.exe

C:\Windows\System\tSuJFCn.exe

C:\Windows\System\tSuJFCn.exe

C:\Windows\System\DmVldTI.exe

C:\Windows\System\DmVldTI.exe

C:\Windows\System\HPxUlVT.exe

C:\Windows\System\HPxUlVT.exe

C:\Windows\System\kKrodUW.exe

C:\Windows\System\kKrodUW.exe

C:\Windows\System\JLBfbFS.exe

C:\Windows\System\JLBfbFS.exe

C:\Windows\System\wiTAIce.exe

C:\Windows\System\wiTAIce.exe

C:\Windows\System\GbIXWgp.exe

C:\Windows\System\GbIXWgp.exe

C:\Windows\System\xLlSXhD.exe

C:\Windows\System\xLlSXhD.exe

C:\Windows\System\mFPLfDX.exe

C:\Windows\System\mFPLfDX.exe

C:\Windows\System\QEJMSOg.exe

C:\Windows\System\QEJMSOg.exe

C:\Windows\System\hhsGvkS.exe

C:\Windows\System\hhsGvkS.exe

C:\Windows\System\wIPhUAk.exe

C:\Windows\System\wIPhUAk.exe

C:\Windows\System\cOwLfwV.exe

C:\Windows\System\cOwLfwV.exe

C:\Windows\System\zHtmmiP.exe

C:\Windows\System\zHtmmiP.exe

C:\Windows\System\QTaNIPI.exe

C:\Windows\System\QTaNIPI.exe

C:\Windows\System\ghvGiUZ.exe

C:\Windows\System\ghvGiUZ.exe

C:\Windows\System\YZombgj.exe

C:\Windows\System\YZombgj.exe

C:\Windows\System\cczhraP.exe

C:\Windows\System\cczhraP.exe

C:\Windows\System\wXHNfgH.exe

C:\Windows\System\wXHNfgH.exe

C:\Windows\System\rcUDOwp.exe

C:\Windows\System\rcUDOwp.exe

C:\Windows\System\hdqPFrz.exe

C:\Windows\System\hdqPFrz.exe

C:\Windows\System\YZCvFPw.exe

C:\Windows\System\YZCvFPw.exe

C:\Windows\System\XUcUuCo.exe

C:\Windows\System\XUcUuCo.exe

C:\Windows\System\RJFjMTD.exe

C:\Windows\System\RJFjMTD.exe

C:\Windows\System\dUKUHah.exe

C:\Windows\System\dUKUHah.exe

C:\Windows\System\sfZthIY.exe

C:\Windows\System\sfZthIY.exe

C:\Windows\System\TqfmdgH.exe

C:\Windows\System\TqfmdgH.exe

C:\Windows\System\igRurNB.exe

C:\Windows\System\igRurNB.exe

C:\Windows\System\smxXljc.exe

C:\Windows\System\smxXljc.exe

C:\Windows\System\XmQWbiy.exe

C:\Windows\System\XmQWbiy.exe

C:\Windows\System\uCHPufE.exe

C:\Windows\System\uCHPufE.exe

C:\Windows\System\aRslEku.exe

C:\Windows\System\aRslEku.exe

C:\Windows\System\tzrmDcO.exe

C:\Windows\System\tzrmDcO.exe

C:\Windows\System\AQXzJEX.exe

C:\Windows\System\AQXzJEX.exe

C:\Windows\System\BrZkwrx.exe

C:\Windows\System\BrZkwrx.exe

C:\Windows\System\ReeSjvJ.exe

C:\Windows\System\ReeSjvJ.exe

C:\Windows\System\ScuGjJG.exe

C:\Windows\System\ScuGjJG.exe

C:\Windows\System\gMkAytm.exe

C:\Windows\System\gMkAytm.exe

C:\Windows\System\Mvedmgx.exe

C:\Windows\System\Mvedmgx.exe

C:\Windows\System\dfoDXos.exe

C:\Windows\System\dfoDXos.exe

C:\Windows\System\ddHDcSY.exe

C:\Windows\System\ddHDcSY.exe

C:\Windows\System\CNDwRFS.exe

C:\Windows\System\CNDwRFS.exe

C:\Windows\System\udDIRvx.exe

C:\Windows\System\udDIRvx.exe

C:\Windows\System\bryIroG.exe

C:\Windows\System\bryIroG.exe

C:\Windows\System\ZBzQCmi.exe

C:\Windows\System\ZBzQCmi.exe

C:\Windows\System\AWIXNPS.exe

C:\Windows\System\AWIXNPS.exe

C:\Windows\System\MXRjxYe.exe

C:\Windows\System\MXRjxYe.exe

C:\Windows\System\ZSksVWd.exe

C:\Windows\System\ZSksVWd.exe

C:\Windows\System\NBsTEta.exe

C:\Windows\System\NBsTEta.exe

C:\Windows\System\ixyCNli.exe

C:\Windows\System\ixyCNli.exe

C:\Windows\System\ZKERuBe.exe

C:\Windows\System\ZKERuBe.exe

C:\Windows\System\dcKZXRW.exe

C:\Windows\System\dcKZXRW.exe

C:\Windows\System\rzxPNFs.exe

C:\Windows\System\rzxPNFs.exe

C:\Windows\System\HrQovMh.exe

C:\Windows\System\HrQovMh.exe

C:\Windows\System\sithjtj.exe

C:\Windows\System\sithjtj.exe

C:\Windows\System\CDbhedl.exe

C:\Windows\System\CDbhedl.exe

C:\Windows\System\mSnYNLa.exe

C:\Windows\System\mSnYNLa.exe

C:\Windows\System\wBwKeWX.exe

C:\Windows\System\wBwKeWX.exe

C:\Windows\System\ouLDgEP.exe

C:\Windows\System\ouLDgEP.exe

C:\Windows\System\warcGYi.exe

C:\Windows\System\warcGYi.exe

C:\Windows\System\bwpbrxK.exe

C:\Windows\System\bwpbrxK.exe

C:\Windows\System\yqDqmoB.exe

C:\Windows\System\yqDqmoB.exe

C:\Windows\System\jxgkuIz.exe

C:\Windows\System\jxgkuIz.exe

C:\Windows\System\iGGwWei.exe

C:\Windows\System\iGGwWei.exe

C:\Windows\System\Xgyzxjs.exe

C:\Windows\System\Xgyzxjs.exe

C:\Windows\System\SluUThw.exe

C:\Windows\System\SluUThw.exe

C:\Windows\System\mYQIUHC.exe

C:\Windows\System\mYQIUHC.exe

C:\Windows\System\PfTJFVt.exe

C:\Windows\System\PfTJFVt.exe

C:\Windows\System\abOmkoA.exe

C:\Windows\System\abOmkoA.exe

C:\Windows\System\hBTJThu.exe

C:\Windows\System\hBTJThu.exe

C:\Windows\System\NJbpYHc.exe

C:\Windows\System\NJbpYHc.exe

C:\Windows\System\zhNTUbN.exe

C:\Windows\System\zhNTUbN.exe

C:\Windows\System\BEshZeQ.exe

C:\Windows\System\BEshZeQ.exe

C:\Windows\System\zhEGdwR.exe

C:\Windows\System\zhEGdwR.exe

C:\Windows\System\HmfJCRr.exe

C:\Windows\System\HmfJCRr.exe

C:\Windows\System\xasBjnX.exe

C:\Windows\System\xasBjnX.exe

C:\Windows\System\tlYjmWA.exe

C:\Windows\System\tlYjmWA.exe

C:\Windows\System\deuErpo.exe

C:\Windows\System\deuErpo.exe

C:\Windows\System\IfYsJBC.exe

C:\Windows\System\IfYsJBC.exe

C:\Windows\System\tLHKgJG.exe

C:\Windows\System\tLHKgJG.exe

C:\Windows\System\nmVWHpg.exe

C:\Windows\System\nmVWHpg.exe

C:\Windows\System\vPPTevZ.exe

C:\Windows\System\vPPTevZ.exe

C:\Windows\System\DzXXlBZ.exe

C:\Windows\System\DzXXlBZ.exe

C:\Windows\System\MMQKXpm.exe

C:\Windows\System\MMQKXpm.exe

C:\Windows\System\zXZjncB.exe

C:\Windows\System\zXZjncB.exe

C:\Windows\System\VZOVqGL.exe

C:\Windows\System\VZOVqGL.exe

C:\Windows\System\KKrBnld.exe

C:\Windows\System\KKrBnld.exe

C:\Windows\System\OnoXqJO.exe

C:\Windows\System\OnoXqJO.exe

C:\Windows\System\UZzAhXu.exe

C:\Windows\System\UZzAhXu.exe

C:\Windows\System\VtWcMNW.exe

C:\Windows\System\VtWcMNW.exe

C:\Windows\System\DmrrURY.exe

C:\Windows\System\DmrrURY.exe

C:\Windows\System\bSKJBBb.exe

C:\Windows\System\bSKJBBb.exe

C:\Windows\System\SOdLkir.exe

C:\Windows\System\SOdLkir.exe

C:\Windows\System\fOscNtA.exe

C:\Windows\System\fOscNtA.exe

C:\Windows\System\XrfVLrW.exe

C:\Windows\System\XrfVLrW.exe

C:\Windows\System\HQQZrrV.exe

C:\Windows\System\HQQZrrV.exe

C:\Windows\System\bNXHxLa.exe

C:\Windows\System\bNXHxLa.exe

C:\Windows\System\oblArmJ.exe

C:\Windows\System\oblArmJ.exe

C:\Windows\System\PzceTNN.exe

C:\Windows\System\PzceTNN.exe

C:\Windows\System\wbOJAxi.exe

C:\Windows\System\wbOJAxi.exe

C:\Windows\System\lRWqDKH.exe

C:\Windows\System\lRWqDKH.exe

C:\Windows\System\mfGoTEN.exe

C:\Windows\System\mfGoTEN.exe

C:\Windows\System\piPYQqg.exe

C:\Windows\System\piPYQqg.exe

C:\Windows\System\XYotFaD.exe

C:\Windows\System\XYotFaD.exe

C:\Windows\System\SvqqTJN.exe

C:\Windows\System\SvqqTJN.exe

C:\Windows\System\bLEeqWH.exe

C:\Windows\System\bLEeqWH.exe

C:\Windows\System\luTTDSF.exe

C:\Windows\System\luTTDSF.exe

C:\Windows\System\erBdxqx.exe

C:\Windows\System\erBdxqx.exe

C:\Windows\System\Hvnzidv.exe

C:\Windows\System\Hvnzidv.exe

C:\Windows\System\VwoaHdw.exe

C:\Windows\System\VwoaHdw.exe

C:\Windows\System\VDUkQDS.exe

C:\Windows\System\VDUkQDS.exe

C:\Windows\System\PMVLYIk.exe

C:\Windows\System\PMVLYIk.exe

C:\Windows\System\xPLnGAR.exe

C:\Windows\System\xPLnGAR.exe

C:\Windows\System\tjuxpri.exe

C:\Windows\System\tjuxpri.exe

C:\Windows\System\ThcwUVw.exe

C:\Windows\System\ThcwUVw.exe

C:\Windows\System\vkyyeOp.exe

C:\Windows\System\vkyyeOp.exe

C:\Windows\System\cvasaYS.exe

C:\Windows\System\cvasaYS.exe

C:\Windows\System\lQiimle.exe

C:\Windows\System\lQiimle.exe

C:\Windows\System\ZWrKfLc.exe

C:\Windows\System\ZWrKfLc.exe

C:\Windows\System\ASPSIYm.exe

C:\Windows\System\ASPSIYm.exe

C:\Windows\System\nwyvqfF.exe

C:\Windows\System\nwyvqfF.exe

C:\Windows\System\NtnEvWB.exe

C:\Windows\System\NtnEvWB.exe

C:\Windows\System\vGvNHqc.exe

C:\Windows\System\vGvNHqc.exe

C:\Windows\System\xYaombF.exe

C:\Windows\System\xYaombF.exe

C:\Windows\System\drZQsmn.exe

C:\Windows\System\drZQsmn.exe

C:\Windows\System\NzglBrE.exe

C:\Windows\System\NzglBrE.exe

C:\Windows\System\kZDowXZ.exe

C:\Windows\System\kZDowXZ.exe

C:\Windows\System\VfZUPRv.exe

C:\Windows\System\VfZUPRv.exe

C:\Windows\System\tPSSvLd.exe

C:\Windows\System\tPSSvLd.exe

C:\Windows\System\ebsPhtm.exe

C:\Windows\System\ebsPhtm.exe

C:\Windows\System\lifjUTB.exe

C:\Windows\System\lifjUTB.exe

C:\Windows\System\HhGVqFt.exe

C:\Windows\System\HhGVqFt.exe

C:\Windows\System\WlvdVUx.exe

C:\Windows\System\WlvdVUx.exe

C:\Windows\System\tQEhXbK.exe

C:\Windows\System\tQEhXbK.exe

C:\Windows\System\zyPzvGB.exe

C:\Windows\System\zyPzvGB.exe

C:\Windows\System\qwYNSVM.exe

C:\Windows\System\qwYNSVM.exe

C:\Windows\System\WKMiOFP.exe

C:\Windows\System\WKMiOFP.exe

C:\Windows\System\qkiFxRE.exe

C:\Windows\System\qkiFxRE.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	raw.githubusercontent.com	udp

Files

memory/3184-0-0x00007FF7542B0000-0x00007FF7546A2000-memory.dmp

memory/3184-1-0x00000160D4340000-0x00000160D4350000-memory.dmp

C:\Windows\System\JkYLrIl.exe

MD5	7045690ae46f4f4309634c298f8a5434
SHA1	d9641583c6691c95a3ae8444d81953235382f754
SHA256	53f491760fb9ce01ef6878eb0a683b0a17a37fd3eeafad32a4a26b93f9af8cf7
SHA512	27e889cf5e1e4d404d600bc957e44c350c5a8b2657e2de6cedf6f66433e4b2ac4a8ee38d7bfbf4820adf29ba394b5f5b7c370dc67c76b2e00fdf30f57e61f0eb

C:\Windows\System\vpqiwre.exe

MD5	27e1cde3d2baaa455aa81e13f5316234
SHA1	fc30476df1307178192ea8097b7685fc4ea33682
SHA256	304494f538bc4a097bcb8f9c6593d6335952528f00619f4b445be20a92154466
SHA512	b2cfde7eb361077775d454bc7a695ac9751bd1d8fc1cfe3176499294d15ecb62bf6f0bc14e04977d8e8b446dc2f8cf9ea6ab30aff45ba1232061f5db6ede7c9f

memory/4804-16-0x00007FF619BA0000-0x00007FF619F92000-memory.dmp

C:\Windows\System\pFQawDa.exe

MD5	2364f73eb743b3251094944dbf52bd1b
SHA1	37fcb6ecd70f3b15cf68cdad0b9434b8e138106a
SHA256	c07b077e80359d4d350c645905244732705bab0484c2c7f20edd5476531704d7
SHA512	75efd331b0c801979b41b2c6fc068a366e2d80b0757f7c7d0ccc4d3e397a2da489b444c893f1b7a86a597f0a3ac784363f416d8a42d0b2a1ac3bfebc425c6e73

memory/4440-42-0x00007FFA03790000-0x00007FFA04251000-memory.dmp

C:\Windows\System\pcvfPRl.exe

MD5	8bbd3603e3d3b5abf2ef4dca27ae55fc
SHA1	1587d15859a7187745233ccdaac9bbd247cbd9db
SHA256	239f7d5789030dbf2b9dcbafa81ca2e7e159a3e728285ca88c05013897b3a132
SHA512	6108c8ed7d4a45ae0996ceeae26786ff9836a719b0dd6770c0de4e359eb9e09f41ba6171adbeac89e60ae0515cf26bc1560f89537d0a1295e3aeda25f00d13a5

memory/6088-52-0x00007FF71C6B0000-0x00007FF71CAA2000-memory.dmp

C:\Windows\System\LXgEyDE.exe

MD5	0370a16830f10505e5801a5f28edbd22
SHA1	d3d080f2461ad750ccc3c7660ad0169139145256
SHA256	0412318161bf42d34d6fdcb23d00a8b2f3df62229bc8acbfe4b786485c229689
SHA512	d8e50308eb0dd7cf3755322f0ae2ce271cc152e7c371c99923ee577c0d54f3efc805ab856de426b319a425a0b4e807c26c5c7d01ffec38a70e6dd8578383d609

C:\Windows\System\ynFlFYf.exe

MD5	aa6b0eea5613daf4729226731825c977
SHA1	17e24828287fbd0f812f9fcffc446def671c5cbe
SHA256	049fedd81e84bd22467f0d07f42a75414e4bc7a90a916bfafd3b4ef332e6df51
SHA512	47610d40b3bb46989f589080fcddce8aa5eabc0b6649cc47b6a77e288907941b8f660e3a5d0b588f9dbce5667cdc35a9c60861fe4a00b687087ee0a85a1d9da8

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rynorfav.omj.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Windows\System\sAJRxvK.exe

MD5	cf3d2d087631ed7c0624a8eb973d7a70
SHA1	2bf13b7ee6d5df56c8ba8ba4d951fcd0b7c65205
SHA256	0d02454519028337dd3c8798e048efd8c74292400c4a18627471661a746c906c
SHA512	8cc47ae74891e1a5af1cbbd531d060035299dcdf9f43e1dcd9e820d1c5872bb8e4150025f096cde036618feff761b5199af88fb3734499b3198c6443b55de82b

memory/3088-94-0x00007FF797D40000-0x00007FF798132000-memory.dmp

memory/4440-100-0x00007FFA03790000-0x00007FFA04251000-memory.dmp

memory/532-102-0x00007FF71E210000-0x00007FF71E602000-memory.dmp

memory/3860-105-0x00007FF7C4010000-0x00007FF7C4402000-memory.dmp

memory/4328-106-0x00007FF79D0F0000-0x00007FF79D4E2000-memory.dmp

C:\Windows\System\VIjvYvs.exe

MD5	ea8cbb924bac2a6a2f14422fedb74a2a
SHA1	eacf16669162c7c26868f22500d33ea918fbe4d6
SHA256	0aceefb1c8025e881c60d0a27f16670ee1a15c0e7e22caa2b758e333ff1770ef
SHA512	c49d6b4d92a55ae3739bd7ab2a70b0a2510f785ebf17f32629807f8de07d396f362ac3c5201185d002628cc9d1c372dd5588d11ebacb08753199f528ea828e85

C:\Windows\System\YLeLXot.exe

MD5	1e13cb8f9f580f6474f16f595884e3c5
SHA1	75a452a5bfbcb7cc4e66047c97c0406d8aa6fb9f
SHA256	8f39da51da5f36f3a3495aae7409fa2877243aded49db1ee892edfb8132561f4
SHA512	06d7c03e234397150ed93167b7064ee7b41697a78d12ac02a9e86478cc0fc500076130090827a577c83016b5f847efd1c4876890bcc9bd74a6e75cc5f4507944

C:\Windows\System\UVLzGqr.exe

MD5	efb94bfe09bce4e68ace558803d22ec0
SHA1	afe6abcd82a14aca6df2743a751262d134ada9d3
SHA256	4346bffce22f90467ea6b71f6c685b61c41973c050c3f9b0450cdc440ac300aa
SHA512	97df0841b6c2c4c4d744cfe6b3af3068db63196c7140fe51dc8f0aeb04b64d9e038fbf4f701ad5eaf914d5aac996ec6816017374ab50aad3fa7387acc6571845

C:\Windows\System\DIGOtSV.exe

MD5	b36b5c5b449cba9498982381f063a520
SHA1	860bab386833d9c9a1a52050408ae65265e3de23
SHA256	f2456dd731611544a384125135f2c2af8485fca7f2e5825dd3c62b81f2dc9503
SHA512	5823fdbe21bca4518931c54d0f01178df8dd88897b44ac571241d12917571cad3836a8c8c374925c5e65e0cc496574eacb806cd3c50a1088f6f1ad84a0538227

C:\Windows\System\jkiPtsb.exe

MD5	d2901d9f87981641f1011cad8800f430
SHA1	e574b8645dde7930b07f302c13ea2a4d743de068
SHA256	5b13bfbdb8f2392fe76e22170631d5d1bc8c2d14fe503e510e7eb5668290eee8
SHA512	8a42ccf6c2bc579f4397ab493e61309337d18dc5cc792bf6ab678e4f7b770b364c03e2a9f7046235721f603ebb01934ad49739797112bc13b3e638b0253b1636

memory/1232-382-0x00007FF7F18C0000-0x00007FF7F1CB2000-memory.dmp

memory/4436-381-0x00007FF6EBBB0000-0x00007FF6EBFA2000-memory.dmp

memory/5940-391-0x00007FF709FE0000-0x00007FF70A3D2000-memory.dmp

memory/4484-405-0x00007FF69EF50000-0x00007FF69F342000-memory.dmp

memory/3952-406-0x00007FF65ABB0000-0x00007FF65AFA2000-memory.dmp

memory/4996-395-0x00007FF62AF40000-0x00007FF62B332000-memory.dmp

memory/3624-388-0x00007FF70B440000-0x00007FF70B832000-memory.dmp

memory/1376-376-0x00007FF7DC190000-0x00007FF7DC582000-memory.dmp

C:\Windows\System\ihuljeH.exe

MD5	a2f28f62c1866092e7e9a546fcc37f61
SHA1	28de928536e235dce4ba685acfca2e429e434862
SHA256	2238487f0e16efcd456d17afcb850e85f5ae1ebf19755ab7d1746672b7ba43a9
SHA512	83a78e1e215587ffcfe237faceef3b5cef775445e28a27058dfc62c02b54388b038aa7f494fa738f2367c7d90ff7d4c11f8a5418120c4a353584b9c746edba75

C:\Windows\System\gmvKDUb.exe

MD5	8b5cd0f0ad949e0d5c0ca5ce5c79bf0e
SHA1	fa3a0864531a1f73bc2ff899bf8d5d462c0d449c
SHA256	16d15c29ce02405a175146a6df9a6cc65df1a8b902d0f7b553bf980904e2a8b9
SHA512	e7f935d74f70983cecb550b1f7f460f65b59a6f511e14028150cdd18abf2ddebfc3a086aea7e49a58d897c6c7cded3f373b7861dea1b5dc76d7cdf0729ef5680

C:\Windows\System\oLDtSLO.exe

MD5	b143462ae0824d18794668bac46c510b
SHA1	0a45234b6a06f9f765845d185043eb209f624ad3
SHA256	73834bcf81aa12cc105f65852f08c3a12e7939cdf8b683ce4966613c659fbfe1
SHA512	e3e9e4bcce4ebaff6bc7cbbe4a8517a18b00f6c563b1308dd7eb146647203e62a983e2ddcabd09a39e41870e7c6bd19ba5c745f7df533bc645d8878d21457c4d

C:\Windows\System\BtEJakZ.exe

MD5	f28cc11f5f5873b57d5bc6de8bd6a11a
SHA1	1102654eff9c8c801cc52f973ffd31c1eac6cb3b
SHA256	2426a179744461db86f53912e2ae6ed253134559e65583f9850b755de3bc4b71
SHA512	f2072308ad0c58d1cccf4e76bb5cac91c36675ebdb80ae9c7d03307ea6dcd88421479e5c57736ee025ded9ffa137d7a3d73fdfa3cc3f2038f5e4ced5a705948a

C:\Windows\System\vgLIeVg.exe

MD5	c632009c743a425f112fe8eec7f90241
SHA1	c978fa1ff8ef38ffd5fb0413e1e1ee54e685c858
SHA256	29223934c725265cf2761a7c16807adc849e896a6dda1d6a652c78264be3022e
SHA512	9d4bf090753e6efbeb9352251ed54fc8a27df7bf3048fd3f043fe26c12dc51c104956190bac31efa043e37a6e632bda9a0259e1c59753d3e170e87e420170dd7

C:\Windows\System\pauHHqh.exe

MD5	7a019c0a3fe40e09a7741dce523ed18f
SHA1	bd824db99b472a6bd4551c2a0c9db75ba6b18094
SHA256	2ada21e1b6b62de2fd55ca50048f3424401e5f209f94c338da07958d14f47bfd
SHA512	4786bf882917e69442d949dc19bbf9ad9db3a1a618702b2316274495f0b2b96da1b5f3d9fb483925229373343bd4e20b286d6bdbdd6a0d2a8fc9f06cd3b3c44d

C:\Windows\System\tNHdPOi.exe

MD5	fa57f10f81c9dfd564b85eb451fa15c9
SHA1	9e5c72312af85ca400744948615561c3c5c0fa6f
SHA256	eb288352fb0f0478ad04717b872df0f255f1973b5c5c07b6cff75d7517981efd
SHA512	f87e9165b149dba8c472fbdbfd1141595f30062fe96bba8f83176b52aba615724d1e2bd9f51095119ac3283f062ee6264f41d6b15a7c4fc0b8e1c4e3e3de1c08

C:\Windows\System\tYRwyQf.exe

MD5	7d400bf315fc1c7e6717d17d12b82998
SHA1	27f6dae781e426518d431fc036b8517e19c26967
SHA256	50d2c260e03c059b84ac9b01f4fc821a6e510682023d8f604e04c738a77f1aff
SHA512	500d397d20a9a10d75c0ea86ef613c633719c88224e2aa6b7f0168de893eadce83ae1e5318d7d3f144744739216ff1e5068ece861c5b2acc43014948549d9cc7

C:\Windows\System\feFkKJu.exe

MD5	aa660a57350fb8cf45998e8f62adf5e9
SHA1	883acbf5e7dfc85188a1ddba18de64cb6a65a0bb
SHA256	ed1df75acc30005a469378cd38cceedd2efe41101de60902c64a2540ced77087
SHA512	d30c16cae81ac9970143238a307d6afbca8ab0f041402c0d1bd7f8d9a77e03dcc4ac03d252ae96da0a38378ca5dd22a7874ef3b95bf848b1b33f6c8b02830717

C:\Windows\System\fWeRZyV.exe

MD5	72a7040ee0872601c1b5a9a1e58dca35
SHA1	ffda8ce512df34a4bc67fba6f67a8d0082838d33
SHA256	080fae43f64304b558c13bf43fde20f8cf8f79bf8872094b0cb9dc104f3ec04c
SHA512	4ff1b70321da35408b59766015899de33010f93ea4f7dd8f63236a95c5e2404d20be71aa2462e04941e9cebe8480f606e39298d57778ddee277aec85dd984a28

C:\Windows\System\acviclV.exe

MD5	8167d1d7d490c8a0558abbf2a54d38f1
SHA1	8161c96ca00b4575036182d088f084f682533912
SHA256	d44034924879817cf0c05275285dc7c4dbf995d9b82c08f39b7c51fc48f1b4f5
SHA512	5da5438ba54339411d2ef1086df53d0e0a472237bb9bfb0c18edd72b05558c03856418e28bfd482edc4d6aa0bcae95a425838dff0ba6eed237da09bc5f806c88

C:\Windows\System\YsPOCSI.exe

MD5	236a1df6879dbd04b0126d46a4c81afd
SHA1	aa2be5e84a3b6bbfb6d56ba51e67f4ecee7324c7
SHA256	af406b02acaa03f38964817e8e4f030ea5613436d4c055152b0f13c3a142cf92
SHA512	23bc088493babdf0467c059fab9e3f9342f47ee26fccbb1b71ab21f5490cf8072a09e50a6e08b0a3a603de7e6db0ba82ebd212d4f2a29d6486d0877d610d8a5c

C:\Windows\System\kimecOQ.exe

MD5	c9d792a449d5ff65717af3294d7f6baf
SHA1	6ada2fcc931b90413dad1733873f470790f5ee4e
SHA256	27bd992c8186c02f9887ef81360a299d5ceaf8434c077878745d690025b427c7
SHA512	6025c049701c1e19ffceb3d320c9f1a03c9d91eeb83127687dff44ed1da60be9f3026a57f5c7bc08dc63da9ac11cf04e1d230f0679343b7944b714a87d6955e7

C:\Windows\System\PWqaluP.exe

MD5	25c3f905878b00889a56480b1a03f81c
SHA1	c908ddf2a5842f4a46eaa857da4a335e36413779
SHA256	61f3c30d1cbcd596a746e035433ac1d72956f2cbaab05c4f25fb76b00e65b918
SHA512	7da62e0027aad0efdb2e9b927c2281c8549013b93b999b768335571f889d444010d4e2b5928296bf0e4900f517fedcc03b5633a07f133b0fcf4b0bdebc3192a7

memory/3360-104-0x00007FF643C00000-0x00007FF643FF2000-memory.dmp

memory/936-103-0x00007FF6902C0000-0x00007FF6906B2000-memory.dmp

memory/2928-101-0x00007FF78CF30000-0x00007FF78D322000-memory.dmp

memory/4192-99-0x00007FF7304C0000-0x00007FF7308B2000-memory.dmp

memory/4440-97-0x0000025E15550000-0x0000025E15572000-memory.dmp

memory/4984-95-0x00007FF64F0E0000-0x00007FF64F4D2000-memory.dmp

memory/1020-91-0x00007FF701A70000-0x00007FF701E62000-memory.dmp

C:\Windows\System\iolSFNj.exe

MD5	dd1e4c441196b12b4b29f64e4032be19
SHA1	055ce1f3d60ef8e342abc400b576465bdea339d4
SHA256	a5a6f94ee00920182bb60c81b8ae9672d6cc2eecb204aa0c28b00b4dc6b73ec0
SHA512	73be08708fc5b3abc3f65b419c00f2bd9c1ba4c4275291178c0c989ecb5d23bc0f1919bf175cdf0a6314c6ad00e6a94274cbe76de9c3b6750ddae19e66e2f0b2

memory/3900-84-0x00007FF612CA0000-0x00007FF613092000-memory.dmp

C:\Windows\System\bqIXuWN.exe

MD5	6bd1b3dae6c0db7f5d3ef04188879e69
SHA1	79200e12d83d41332fa8ae34ec72dc3c6407e419
SHA256	72003955fac72e6338bd407732eb6abafd2bde98f805c8ea28475e91c7cc5f9f
SHA512	699bbc369b190d28ee3bd7d123a3b34bfc690d2f36e7b41f23b33cd070e4472c42362f2360cb1a55dab9ca8ae7aad1cb903b6c0217673b57e43d3bb295e5ca4e

C:\Windows\System\iDwsRqC.exe

MD5	fbbbf90d97f99cd3271391f69a7a962d
SHA1	24a95a7cb50c0d208ae87d12a6e0fc639ed77d96
SHA256	5bee1f5bfa62536262e85c3548d714d6be280fd1e07a0ab2616217a6ba01d5bd
SHA512	49706d51bdf968b95c863b544a0cd7193a9a65ca14dbbec63e89f2a07ebe5a76ddb194b0d6535d923ad3fdcb7de5a44ec2fbeb3443645b56b5c12ba779154cd9

memory/3408-59-0x00007FF6132F0000-0x00007FF6136E2000-memory.dmp

memory/3288-54-0x00007FF6AD0D0000-0x00007FF6AD4C2000-memory.dmp

C:\Windows\System\qREQLTs.exe

MD5	44bc226730fdb3a77771988989827539
SHA1	19edabd04d4bac264f6a7fde23602cb732b9b9eb
SHA256	772a92e49da0131ad8e6a486b5e8c0b4a5680dced1b3fc874da50e20f712b686
SHA512	3dfeb244d07c06c923be0e2a4745573e141f3388717549cc33e9a60319371d7863f4bde7f23b5d0bb9fd3d9ad762246f44f0742c8996feb1d206887e02feb94f

memory/3500-43-0x00007FF726870000-0x00007FF726C62000-memory.dmp

C:\Windows\System\QlOEmQj.exe

MD5	af0333c4cbc6838befa6959783cedead
SHA1	6ee79fe0351dd06af0e8e72007775d7841cd7f74
SHA256	c23d8dec7f293c785c200f518b6f5fb533fd401f37d0aa79a76e576e22ffb5f0
SHA512	6fab6553fd02a6c851bfdd63b2d6a3130088854e80b1c5ce65d5c9d86bfc064106ea32f3a5295abab5657cd2f00e14b9833533692121c8d536cc776732a967e9

C:\Windows\System\jZxLZOY.exe

MD5	5858ef8a5984dc2188b1416a4cab3f5e
SHA1	2a53b154b27d683f996a7bfe5b5a70c7752896a4
SHA256	b37a07854ba0e9df88d3b339b73f78229d574d2e3d1365a5c72905dc3bd985ac
SHA512	114d0b1f6ee466c61d80c2085066886790db93db86b34ae0ac9bc056fcdc53c88c8309a89c6d297d4437f49484820dbecef3955b879d7b9c58f1ffe4830c5836

C:\Windows\System\cYtAGvh.exe

MD5	1c9a1a9892cae6c7d19d07417dbdd195
SHA1	5dddf5155de4ac82a135d996b9e2c370cc13ad0d
SHA256	ce2ec8715b9abef93e375f9e7b0217fcc87604fa65cc3c0fecd855d855cf0fba
SHA512	481e120f18672ac3c095115ca28a92ea0a1072222e5b9b95d2c390fa310f198433014a914be90e62bd8fb87b235a65b959b47d81927100ac2af9286da17c0868

memory/4440-10-0x00007FFA03793000-0x00007FFA03795000-memory.dmp

memory/4192-2146-0x00007FF7304C0000-0x00007FF7308B2000-memory.dmp

memory/4804-2162-0x00007FF619BA0000-0x00007FF619F92000-memory.dmp

memory/3860-2163-0x00007FF7C4010000-0x00007FF7C4402000-memory.dmp

memory/4328-2164-0x00007FF79D0F0000-0x00007FF79D4E2000-memory.dmp

memory/4804-2182-0x00007FF619BA0000-0x00007FF619F92000-memory.dmp

memory/3500-2184-0x00007FF726870000-0x00007FF726C62000-memory.dmp

memory/2928-2186-0x00007FF78CF30000-0x00007FF78D322000-memory.dmp

memory/3288-2190-0x00007FF6AD0D0000-0x00007FF6AD4C2000-memory.dmp

memory/6088-2189-0x00007FF71C6B0000-0x00007FF71CAA2000-memory.dmp

memory/3408-2192-0x00007FF6132F0000-0x00007FF6136E2000-memory.dmp

memory/3900-2194-0x00007FF612CA0000-0x00007FF613092000-memory.dmp

memory/1020-2196-0x00007FF701A70000-0x00007FF701E62000-memory.dmp

memory/936-2199-0x00007FF6902C0000-0x00007FF6906B2000-memory.dmp

memory/3360-2201-0x00007FF643C00000-0x00007FF643FF2000-memory.dmp

memory/532-2203-0x00007FF71E210000-0x00007FF71E602000-memory.dmp

memory/3088-2206-0x00007FF797D40000-0x00007FF798132000-memory.dmp

memory/4984-2204-0x00007FF64F0E0000-0x00007FF64F4D2000-memory.dmp

memory/1232-2209-0x00007FF7F18C0000-0x00007FF7F1CB2000-memory.dmp

memory/4192-2219-0x00007FF7304C0000-0x00007FF7308B2000-memory.dmp

memory/4996-2225-0x00007FF62AF40000-0x00007FF62B332000-memory.dmp

memory/3952-2226-0x00007FF65ABB0000-0x00007FF65AFA2000-memory.dmp

memory/4484-2223-0x00007FF69EF50000-0x00007FF69F342000-memory.dmp

memory/5940-2220-0x00007FF709FE0000-0x00007FF70A3D2000-memory.dmp

memory/3624-2217-0x00007FF70B440000-0x00007FF70B832000-memory.dmp

memory/4328-2214-0x00007FF79D0F0000-0x00007FF79D4E2000-memory.dmp

memory/1376-2213-0x00007FF7DC190000-0x00007FF7DC582000-memory.dmp

memory/4436-2210-0x00007FF6EBBB0000-0x00007FF6EBFA2000-memory.dmp

memory/3860-2294-0x00007FF7C4010000-0x00007FF7C4402000-memory.dmp

Sample ID	240613-q4wclswank
Target	816e6f1c49eab89adef6b03378e29bf0_NeikiAnalytics.exe
SHA256	f3c379b76207bc15f05fa1bd89e352c50141f64890187ac25df4810b16ded3c9
Tags	upx miner xmrig execution

Malware Analysis Report

2024-07-28 19:56

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files