Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\ZzTCIKe.exe	N/A
N/A	N/A	C:\Windows\System\dTMYTPA.exe	N/A
N/A	N/A	C:\Windows\System\IbstkDM.exe	N/A
N/A	N/A	C:\Windows\System\ntgixZI.exe	N/A
N/A	N/A	C:\Windows\System\RrTYKxH.exe	N/A
N/A	N/A	C:\Windows\System\mEItMWw.exe	N/A
N/A	N/A	C:\Windows\System\QnDutaO.exe	N/A
N/A	N/A	C:\Windows\System\dYBJskA.exe	N/A
N/A	N/A	C:\Windows\System\GvlHyam.exe	N/A
N/A	N/A	C:\Windows\System\zWUxqeZ.exe	N/A
N/A	N/A	C:\Windows\System\BUsJzOq.exe	N/A
N/A	N/A	C:\Windows\System\CNUagbs.exe	N/A
N/A	N/A	C:\Windows\System\ZYgChQx.exe	N/A
N/A	N/A	C:\Windows\System\RAbgCfj.exe	N/A
N/A	N/A	C:\Windows\System\BacNnSx.exe	N/A
N/A	N/A	C:\Windows\System\sAOKKJL.exe	N/A
N/A	N/A	C:\Windows\System\JAeyWGb.exe	N/A
N/A	N/A	C:\Windows\System\LbhaDQT.exe	N/A
N/A	N/A	C:\Windows\System\hYjnhll.exe	N/A
N/A	N/A	C:\Windows\System\jxrsJbq.exe	N/A
N/A	N/A	C:\Windows\System\GeJNGHe.exe	N/A
N/A	N/A	C:\Windows\System\TYTgykB.exe	N/A
N/A	N/A	C:\Windows\System\uxdLYfa.exe	N/A
N/A	N/A	C:\Windows\System\FHDYYJA.exe	N/A
N/A	N/A	C:\Windows\System\dqtJeKy.exe	N/A
N/A	N/A	C:\Windows\System\SnAXHUt.exe	N/A
N/A	N/A	C:\Windows\System\LMNiLtB.exe	N/A
N/A	N/A	C:\Windows\System\gOCMQqq.exe	N/A
N/A	N/A	C:\Windows\System\xUojPvu.exe	N/A
N/A	N/A	C:\Windows\System\MCpLvQc.exe	N/A
N/A	N/A	C:\Windows\System\zPxPywC.exe	N/A
N/A	N/A	C:\Windows\System\DQphVEU.exe	N/A
N/A	N/A	C:\Windows\System\gxjrxdM.exe	N/A
N/A	N/A	C:\Windows\System\mHSEuxW.exe	N/A
N/A	N/A	C:\Windows\System\rOtbnfP.exe	N/A
N/A	N/A	C:\Windows\System\YximktC.exe	N/A
N/A	N/A	C:\Windows\System\JvsZxGn.exe	N/A
N/A	N/A	C:\Windows\System\GKqEewV.exe	N/A
N/A	N/A	C:\Windows\System\CJwYpkj.exe	N/A
N/A	N/A	C:\Windows\System\BLkbfDv.exe	N/A
N/A	N/A	C:\Windows\System\FsDGctO.exe	N/A
N/A	N/A	C:\Windows\System\EAihNtI.exe	N/A
N/A	N/A	C:\Windows\System\lZrQqHL.exe	N/A
N/A	N/A	C:\Windows\System\WXuKLbj.exe	N/A
N/A	N/A	C:\Windows\System\lkSAskZ.exe	N/A
N/A	N/A	C:\Windows\System\nRIGpQo.exe	N/A
N/A	N/A	C:\Windows\System\jYUvaUS.exe	N/A
N/A	N/A	C:\Windows\System\mnKBdqn.exe	N/A
N/A	N/A	C:\Windows\System\JzvGGjW.exe	N/A
N/A	N/A	C:\Windows\System\EoSoaty.exe	N/A
N/A	N/A	C:\Windows\System\VyjOOZY.exe	N/A
N/A	N/A	C:\Windows\System\dslOJXF.exe	N/A
N/A	N/A	C:\Windows\System\Hwhexkz.exe	N/A
N/A	N/A	C:\Windows\System\jEEAeCK.exe	N/A
N/A	N/A	C:\Windows\System\ddigMuQ.exe	N/A
N/A	N/A	C:\Windows\System\mLLgofI.exe	N/A
N/A	N/A	C:\Windows\System\jCLAwtK.exe	N/A
N/A	N/A	C:\Windows\System\CaADRga.exe	N/A
N/A	N/A	C:\Windows\System\ltZMeCA.exe	N/A
N/A	N/A	C:\Windows\System\fiSOgeQ.exe	N/A
N/A	N/A	C:\Windows\System\bVglLRb.exe	N/A
N/A	N/A	C:\Windows\System\owSuKil.exe	N/A
N/A	N/A	C:\Windows\System\ZWbNJqK.exe	N/A
N/A	N/A	C:\Windows\System\LtxFdni.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\BgXqAYT.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WaTZqmL.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QnRCOXm.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wPnrlCR.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ADkZWaX.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JvsZxGn.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\btTenzw.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dDCJuwZ.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GhhDoDA.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FOsMhsQ.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RHHNeaj.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lWwdmJB.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kUZcBqK.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WvvqAMS.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MosYIJF.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\etSFjzQ.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dqsEctZ.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lpeosjK.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bjPJupu.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tOFevPX.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mlXTLdA.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RErocTv.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GqTnWSj.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qkpfnRq.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BNsjIVx.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zLDtdWp.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XhVmOsy.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qaGsgTD.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mkygWvA.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CspFgNI.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AXeajgP.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WlpokVI.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DSFGbUw.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oQbVKMQ.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pzSgXJP.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jiXaUCm.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eJvjcWO.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DAiqUGQ.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dOezKqF.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zPuHfjc.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vOfHaVD.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LFAXQYW.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OxuVLBd.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LlTkBjv.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BenJkvm.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NxLWCJj.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fADmIxY.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CFscUwt.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EDNKYsa.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rfmwYSk.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BFLdbHa.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NVPznMc.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MMGuugD.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ekHhpdp.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GaFLdkS.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XKltNyN.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RrDnVVL.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BWiqPJd.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EvbObnB.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\icnvnKN.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iHoffZg.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VTdgSfj.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zfIvsYj.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MJHxdgi.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\System\vNguRPt.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\System\vNguRPt.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\System\ahKgJpN.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\System\ahKgJpN.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\System\cTnsdTM.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\System\hvGDMrB.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\System\qeqHrem.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\System\cTnsdTM.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\System\hvGDMrB.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\System\qeqHrem.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\System\XgTJXuH.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\System\XgTJXuH.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\System\XgPUjcs.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Windows\System\XgPUjcs.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2844 wrote to memory of 2904	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2844 wrote to memory of 2904	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2844 wrote to memory of 2904	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2844 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\ZzTCIKe.exe
PID 2844 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\ZzTCIKe.exe
PID 2844 wrote to memory of 2792	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\ZzTCIKe.exe
PID 2844 wrote to memory of 2404	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\dTMYTPA.exe
PID 2844 wrote to memory of 2404	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\dTMYTPA.exe
PID 2844 wrote to memory of 2404	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\dTMYTPA.exe
PID 2844 wrote to memory of 2608	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\IbstkDM.exe
PID 2844 wrote to memory of 2608	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\IbstkDM.exe
PID 2844 wrote to memory of 2608	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\IbstkDM.exe
PID 2844 wrote to memory of 2676	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\ntgixZI.exe
PID 2844 wrote to memory of 2676	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\ntgixZI.exe
PID 2844 wrote to memory of 2676	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\ntgixZI.exe
PID 2844 wrote to memory of 2688	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\RrTYKxH.exe
PID 2844 wrote to memory of 2688	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\RrTYKxH.exe
PID 2844 wrote to memory of 2688	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\RrTYKxH.exe
PID 2844 wrote to memory of 2708	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\mEItMWw.exe
PID 2844 wrote to memory of 2708	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\mEItMWw.exe
PID 2844 wrote to memory of 2708	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\mEItMWw.exe
PID 2844 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\QnDutaO.exe
PID 2844 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\QnDutaO.exe
PID 2844 wrote to memory of 2476	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\QnDutaO.exe
PID 2844 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\dYBJskA.exe
PID 2844 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\dYBJskA.exe
PID 2844 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\dYBJskA.exe
PID 2844 wrote to memory of 2764	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\GvlHyam.exe
PID 2844 wrote to memory of 2764	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\GvlHyam.exe
PID 2844 wrote to memory of 2764	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\GvlHyam.exe
PID 2844 wrote to memory of 2604	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\zWUxqeZ.exe
PID 2844 wrote to memory of 2604	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\zWUxqeZ.exe
PID 2844 wrote to memory of 2604	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\zWUxqeZ.exe
PID 2844 wrote to memory of 2288	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\BUsJzOq.exe
PID 2844 wrote to memory of 2288	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\BUsJzOq.exe
PID 2844 wrote to memory of 2288	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\BUsJzOq.exe
PID 2844 wrote to memory of 2488	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\CNUagbs.exe
PID 2844 wrote to memory of 2488	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\CNUagbs.exe
PID 2844 wrote to memory of 2488	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\CNUagbs.exe
PID 2844 wrote to memory of 2872	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\ZYgChQx.exe
PID 2844 wrote to memory of 2872	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\ZYgChQx.exe
PID 2844 wrote to memory of 2872	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\ZYgChQx.exe
PID 2844 wrote to memory of 1980	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\RAbgCfj.exe
PID 2844 wrote to memory of 1980	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\RAbgCfj.exe
PID 2844 wrote to memory of 1980	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\RAbgCfj.exe
PID 2844 wrote to memory of 1676	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\BacNnSx.exe
PID 2844 wrote to memory of 1676	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\BacNnSx.exe
PID 2844 wrote to memory of 1676	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\BacNnSx.exe
PID 2844 wrote to memory of 1612	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\LbhaDQT.exe
PID 2844 wrote to memory of 1612	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\LbhaDQT.exe
PID 2844 wrote to memory of 1612	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\LbhaDQT.exe
PID 2844 wrote to memory of 2172	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\sAOKKJL.exe
PID 2844 wrote to memory of 2172	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\sAOKKJL.exe
PID 2844 wrote to memory of 2172	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\sAOKKJL.exe
PID 2844 wrote to memory of 764	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\GeJNGHe.exe
PID 2844 wrote to memory of 764	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\GeJNGHe.exe
PID 2844 wrote to memory of 764	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\GeJNGHe.exe
PID 2844 wrote to memory of 1884	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\JAeyWGb.exe
PID 2844 wrote to memory of 1884	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\JAeyWGb.exe
PID 2844 wrote to memory of 1884	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\JAeyWGb.exe
PID 2844 wrote to memory of 1656	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\uxdLYfa.exe
PID 2844 wrote to memory of 1656	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\uxdLYfa.exe
PID 2844 wrote to memory of 1656	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\uxdLYfa.exe
PID 2844 wrote to memory of 1696	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\hYjnhll.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\ZzTCIKe.exe

C:\Windows\System\ZzTCIKe.exe

C:\Windows\System\dTMYTPA.exe

C:\Windows\System\dTMYTPA.exe

C:\Windows\System\IbstkDM.exe

C:\Windows\System\IbstkDM.exe

C:\Windows\System\ntgixZI.exe

C:\Windows\System\ntgixZI.exe

C:\Windows\System\RrTYKxH.exe

C:\Windows\System\RrTYKxH.exe

C:\Windows\System\mEItMWw.exe

C:\Windows\System\mEItMWw.exe

C:\Windows\System\QnDutaO.exe

C:\Windows\System\QnDutaO.exe

C:\Windows\System\dYBJskA.exe

C:\Windows\System\dYBJskA.exe

C:\Windows\System\GvlHyam.exe

C:\Windows\System\GvlHyam.exe

C:\Windows\System\zWUxqeZ.exe

C:\Windows\System\zWUxqeZ.exe

C:\Windows\System\BUsJzOq.exe

C:\Windows\System\BUsJzOq.exe

C:\Windows\System\CNUagbs.exe

C:\Windows\System\CNUagbs.exe

C:\Windows\System\ZYgChQx.exe

C:\Windows\System\ZYgChQx.exe

C:\Windows\System\RAbgCfj.exe

C:\Windows\System\RAbgCfj.exe

C:\Windows\System\BacNnSx.exe

C:\Windows\System\BacNnSx.exe

C:\Windows\System\LbhaDQT.exe

C:\Windows\System\LbhaDQT.exe

C:\Windows\System\sAOKKJL.exe

C:\Windows\System\sAOKKJL.exe

C:\Windows\System\GeJNGHe.exe

C:\Windows\System\GeJNGHe.exe

C:\Windows\System\JAeyWGb.exe

C:\Windows\System\JAeyWGb.exe

C:\Windows\System\uxdLYfa.exe

C:\Windows\System\uxdLYfa.exe

C:\Windows\System\hYjnhll.exe

C:\Windows\System\hYjnhll.exe

C:\Windows\System\SnAXHUt.exe

C:\Windows\System\SnAXHUt.exe

C:\Windows\System\jxrsJbq.exe

C:\Windows\System\jxrsJbq.exe

C:\Windows\System\xUojPvu.exe

C:\Windows\System\xUojPvu.exe

C:\Windows\System\TYTgykB.exe

C:\Windows\System\TYTgykB.exe

C:\Windows\System\gxjrxdM.exe

C:\Windows\System\gxjrxdM.exe

C:\Windows\System\FHDYYJA.exe

C:\Windows\System\FHDYYJA.exe

C:\Windows\System\rOtbnfP.exe

C:\Windows\System\rOtbnfP.exe

C:\Windows\System\dqtJeKy.exe

C:\Windows\System\dqtJeKy.exe

C:\Windows\System\lZrQqHL.exe

C:\Windows\System\lZrQqHL.exe

C:\Windows\System\LMNiLtB.exe

C:\Windows\System\LMNiLtB.exe

C:\Windows\System\nRIGpQo.exe

C:\Windows\System\nRIGpQo.exe

C:\Windows\System\gOCMQqq.exe

C:\Windows\System\gOCMQqq.exe

C:\Windows\System\JzvGGjW.exe

C:\Windows\System\JzvGGjW.exe

C:\Windows\System\MCpLvQc.exe

C:\Windows\System\MCpLvQc.exe

C:\Windows\System\VyjOOZY.exe

C:\Windows\System\VyjOOZY.exe

C:\Windows\System\zPxPywC.exe

C:\Windows\System\zPxPywC.exe

C:\Windows\System\dslOJXF.exe

C:\Windows\System\dslOJXF.exe

C:\Windows\System\DQphVEU.exe

C:\Windows\System\DQphVEU.exe

C:\Windows\System\ddigMuQ.exe

C:\Windows\System\ddigMuQ.exe

C:\Windows\System\mHSEuxW.exe

C:\Windows\System\mHSEuxW.exe

C:\Windows\System\jCLAwtK.exe

C:\Windows\System\jCLAwtK.exe

C:\Windows\System\YximktC.exe

C:\Windows\System\YximktC.exe

C:\Windows\System\fiSOgeQ.exe

C:\Windows\System\fiSOgeQ.exe

C:\Windows\System\JvsZxGn.exe

C:\Windows\System\JvsZxGn.exe

C:\Windows\System\bVglLRb.exe

C:\Windows\System\bVglLRb.exe

C:\Windows\System\GKqEewV.exe

C:\Windows\System\GKqEewV.exe

C:\Windows\System\owSuKil.exe

C:\Windows\System\owSuKil.exe

C:\Windows\System\CJwYpkj.exe

C:\Windows\System\CJwYpkj.exe

C:\Windows\System\ZWbNJqK.exe

C:\Windows\System\ZWbNJqK.exe

C:\Windows\System\BLkbfDv.exe

C:\Windows\System\BLkbfDv.exe

C:\Windows\System\LtxFdni.exe

C:\Windows\System\LtxFdni.exe

C:\Windows\System\FsDGctO.exe

C:\Windows\System\FsDGctO.exe

C:\Windows\System\LtZkosB.exe

C:\Windows\System\LtZkosB.exe

C:\Windows\System\EAihNtI.exe

C:\Windows\System\EAihNtI.exe

C:\Windows\System\MosYIJF.exe

C:\Windows\System\MosYIJF.exe

C:\Windows\System\WXuKLbj.exe

C:\Windows\System\WXuKLbj.exe

C:\Windows\System\SoXqakC.exe

C:\Windows\System\SoXqakC.exe

C:\Windows\System\lkSAskZ.exe

C:\Windows\System\lkSAskZ.exe

C:\Windows\System\LSxsQdU.exe

C:\Windows\System\LSxsQdU.exe

C:\Windows\System\jYUvaUS.exe

C:\Windows\System\jYUvaUS.exe

C:\Windows\System\KTVYPSH.exe

C:\Windows\System\KTVYPSH.exe

C:\Windows\System\mnKBdqn.exe

C:\Windows\System\mnKBdqn.exe

C:\Windows\System\aqhqMKj.exe

C:\Windows\System\aqhqMKj.exe

C:\Windows\System\EoSoaty.exe

C:\Windows\System\EoSoaty.exe

C:\Windows\System\QXxFaKm.exe

C:\Windows\System\QXxFaKm.exe

C:\Windows\System\Hwhexkz.exe

C:\Windows\System\Hwhexkz.exe

C:\Windows\System\ccnIiMT.exe

C:\Windows\System\ccnIiMT.exe

C:\Windows\System\jEEAeCK.exe

C:\Windows\System\jEEAeCK.exe

C:\Windows\System\ddylxoC.exe

C:\Windows\System\ddylxoC.exe

C:\Windows\System\mLLgofI.exe

C:\Windows\System\mLLgofI.exe

C:\Windows\System\DDvnEit.exe

C:\Windows\System\DDvnEit.exe

C:\Windows\System\CaADRga.exe

C:\Windows\System\CaADRga.exe

C:\Windows\System\DlVuVci.exe

C:\Windows\System\DlVuVci.exe

C:\Windows\System\ltZMeCA.exe

C:\Windows\System\ltZMeCA.exe

C:\Windows\System\bQjzOWu.exe

C:\Windows\System\bQjzOWu.exe

C:\Windows\System\rVzrGwW.exe

C:\Windows\System\rVzrGwW.exe

C:\Windows\System\bpsJAbv.exe

C:\Windows\System\bpsJAbv.exe

C:\Windows\System\NOPqyra.exe

C:\Windows\System\NOPqyra.exe

C:\Windows\System\JcQxoEV.exe

C:\Windows\System\JcQxoEV.exe

C:\Windows\System\xYafows.exe

C:\Windows\System\xYafows.exe

C:\Windows\System\RqPZIXb.exe

C:\Windows\System\RqPZIXb.exe

C:\Windows\System\umihTFb.exe

C:\Windows\System\umihTFb.exe

C:\Windows\System\HRwGDHr.exe

C:\Windows\System\HRwGDHr.exe

C:\Windows\System\ekHhpdp.exe

C:\Windows\System\ekHhpdp.exe

C:\Windows\System\GfEFpeu.exe

C:\Windows\System\GfEFpeu.exe

C:\Windows\System\LeiFtkm.exe

C:\Windows\System\LeiFtkm.exe

C:\Windows\System\frjAKee.exe

C:\Windows\System\frjAKee.exe

C:\Windows\System\NAtFWzH.exe

C:\Windows\System\NAtFWzH.exe

C:\Windows\System\OxuVLBd.exe

C:\Windows\System\OxuVLBd.exe

C:\Windows\System\WVqoTHt.exe

C:\Windows\System\WVqoTHt.exe

C:\Windows\System\aNXgKzi.exe

C:\Windows\System\aNXgKzi.exe

C:\Windows\System\rSgpyWh.exe

C:\Windows\System\rSgpyWh.exe

C:\Windows\System\GfPlxLM.exe

C:\Windows\System\GfPlxLM.exe

C:\Windows\System\twpmaih.exe

C:\Windows\System\twpmaih.exe

C:\Windows\System\btTenzw.exe

C:\Windows\System\btTenzw.exe

C:\Windows\System\ZMyqjvR.exe

C:\Windows\System\ZMyqjvR.exe

C:\Windows\System\meLHMJY.exe

C:\Windows\System\meLHMJY.exe

C:\Windows\System\hEFofDj.exe

C:\Windows\System\hEFofDj.exe

C:\Windows\System\zlLgJui.exe

C:\Windows\System\zlLgJui.exe

C:\Windows\System\pwqyGiC.exe

C:\Windows\System\pwqyGiC.exe

C:\Windows\System\VZopELp.exe

C:\Windows\System\VZopELp.exe

C:\Windows\System\ljdQtIH.exe

C:\Windows\System\ljdQtIH.exe

C:\Windows\System\eePnHXp.exe

C:\Windows\System\eePnHXp.exe

C:\Windows\System\wtxphKi.exe

C:\Windows\System\wtxphKi.exe

C:\Windows\System\IZsMYkx.exe

C:\Windows\System\IZsMYkx.exe

C:\Windows\System\YyrwVqm.exe

C:\Windows\System\YyrwVqm.exe

C:\Windows\System\bIQhzhj.exe

C:\Windows\System\bIQhzhj.exe

C:\Windows\System\ZdiDFBr.exe

C:\Windows\System\ZdiDFBr.exe

C:\Windows\System\JmWPdcg.exe

C:\Windows\System\JmWPdcg.exe

C:\Windows\System\vzrtbDQ.exe

C:\Windows\System\vzrtbDQ.exe

C:\Windows\System\mNvHwLk.exe

C:\Windows\System\mNvHwLk.exe

C:\Windows\System\UOetUgG.exe

C:\Windows\System\UOetUgG.exe

C:\Windows\System\icLqeJu.exe

C:\Windows\System\icLqeJu.exe

C:\Windows\System\MXamDsn.exe

C:\Windows\System\MXamDsn.exe

C:\Windows\System\NWhXixG.exe

C:\Windows\System\NWhXixG.exe

C:\Windows\System\KUTrexw.exe

C:\Windows\System\KUTrexw.exe

C:\Windows\System\QyOSrQV.exe

C:\Windows\System\QyOSrQV.exe

C:\Windows\System\QXQcZvQ.exe

C:\Windows\System\QXQcZvQ.exe

C:\Windows\System\phFnNKR.exe

C:\Windows\System\phFnNKR.exe

C:\Windows\System\UdoIjlR.exe

C:\Windows\System\UdoIjlR.exe

C:\Windows\System\gQCqFgp.exe

C:\Windows\System\gQCqFgp.exe

C:\Windows\System\nupCQrp.exe

C:\Windows\System\nupCQrp.exe

C:\Windows\System\GISXwNg.exe

C:\Windows\System\GISXwNg.exe

C:\Windows\System\rqOMdDV.exe

C:\Windows\System\rqOMdDV.exe

C:\Windows\System\ORBGmbg.exe

C:\Windows\System\ORBGmbg.exe

C:\Windows\System\lPdRqdS.exe

C:\Windows\System\lPdRqdS.exe

C:\Windows\System\SWQsPPB.exe

C:\Windows\System\SWQsPPB.exe

C:\Windows\System\OSTdvfH.exe

C:\Windows\System\OSTdvfH.exe

C:\Windows\System\ToIzErH.exe

C:\Windows\System\ToIzErH.exe

C:\Windows\System\KkQEPyZ.exe

C:\Windows\System\KkQEPyZ.exe

C:\Windows\System\nRIlfDT.exe

C:\Windows\System\nRIlfDT.exe

C:\Windows\System\hlihfUU.exe

C:\Windows\System\hlihfUU.exe

C:\Windows\System\mffjiOw.exe

C:\Windows\System\mffjiOw.exe

C:\Windows\System\LNikzPU.exe

C:\Windows\System\LNikzPU.exe

C:\Windows\System\pizniGa.exe

C:\Windows\System\pizniGa.exe

C:\Windows\System\sPjiYdb.exe

C:\Windows\System\sPjiYdb.exe

C:\Windows\System\ggAdNou.exe

C:\Windows\System\ggAdNou.exe

C:\Windows\System\uGfUQBF.exe

C:\Windows\System\uGfUQBF.exe

C:\Windows\System\WVAgVtu.exe

C:\Windows\System\WVAgVtu.exe

C:\Windows\System\Bdfltpm.exe

C:\Windows\System\Bdfltpm.exe

C:\Windows\System\MZxUWSY.exe

C:\Windows\System\MZxUWSY.exe

C:\Windows\System\wIRnZUb.exe

C:\Windows\System\wIRnZUb.exe

C:\Windows\System\elVsmam.exe

C:\Windows\System\elVsmam.exe

C:\Windows\System\klyfxyV.exe

C:\Windows\System\klyfxyV.exe

C:\Windows\System\EDNKYsa.exe

C:\Windows\System\EDNKYsa.exe

C:\Windows\System\zFLsPtW.exe

C:\Windows\System\zFLsPtW.exe

C:\Windows\System\NDBHOoW.exe

C:\Windows\System\NDBHOoW.exe

C:\Windows\System\bMQsgGB.exe

C:\Windows\System\bMQsgGB.exe

C:\Windows\System\RJzyOYJ.exe

C:\Windows\System\RJzyOYJ.exe

C:\Windows\System\mUIxZZz.exe

C:\Windows\System\mUIxZZz.exe

C:\Windows\System\dOezKqF.exe

C:\Windows\System\dOezKqF.exe

C:\Windows\System\CFmvaZt.exe

C:\Windows\System\CFmvaZt.exe

C:\Windows\System\oBZcXit.exe

C:\Windows\System\oBZcXit.exe

C:\Windows\System\IzJngLi.exe

C:\Windows\System\IzJngLi.exe

C:\Windows\System\nWjkNTv.exe

C:\Windows\System\nWjkNTv.exe

C:\Windows\System\ZShiTAo.exe

C:\Windows\System\ZShiTAo.exe

C:\Windows\System\ZffbgcT.exe

C:\Windows\System\ZffbgcT.exe

C:\Windows\System\iVJuhDn.exe

C:\Windows\System\iVJuhDn.exe

C:\Windows\System\cFrEPVn.exe

C:\Windows\System\cFrEPVn.exe

C:\Windows\System\zXyqqnJ.exe

C:\Windows\System\zXyqqnJ.exe

C:\Windows\System\jQomVdA.exe

C:\Windows\System\jQomVdA.exe

C:\Windows\System\TDDmBkh.exe

C:\Windows\System\TDDmBkh.exe

C:\Windows\System\rfmwYSk.exe

C:\Windows\System\rfmwYSk.exe

C:\Windows\System\jIAhVpy.exe

C:\Windows\System\jIAhVpy.exe

C:\Windows\System\TorvwHC.exe

C:\Windows\System\TorvwHC.exe

C:\Windows\System\EUsSoEj.exe

C:\Windows\System\EUsSoEj.exe

C:\Windows\System\OfVecSy.exe

C:\Windows\System\OfVecSy.exe

C:\Windows\System\ttDygXQ.exe

C:\Windows\System\ttDygXQ.exe

C:\Windows\System\dELthdG.exe

C:\Windows\System\dELthdG.exe

C:\Windows\System\BjWKHqt.exe

C:\Windows\System\BjWKHqt.exe

C:\Windows\System\tnlXpPb.exe

C:\Windows\System\tnlXpPb.exe

C:\Windows\System\pHQVbNu.exe

C:\Windows\System\pHQVbNu.exe

C:\Windows\System\FsWkPAB.exe

C:\Windows\System\FsWkPAB.exe

C:\Windows\System\reapUac.exe

C:\Windows\System\reapUac.exe

C:\Windows\System\TqkkfGj.exe

C:\Windows\System\TqkkfGj.exe

C:\Windows\System\IloUnZW.exe

C:\Windows\System\IloUnZW.exe

C:\Windows\System\vKxjqZu.exe

C:\Windows\System\vKxjqZu.exe

C:\Windows\System\oDWVase.exe

C:\Windows\System\oDWVase.exe

C:\Windows\System\wFYAjbj.exe

C:\Windows\System\wFYAjbj.exe

C:\Windows\System\ngJVKoF.exe

C:\Windows\System\ngJVKoF.exe

C:\Windows\System\YYzmKYW.exe

C:\Windows\System\YYzmKYW.exe

C:\Windows\System\ywmNmEO.exe

C:\Windows\System\ywmNmEO.exe

C:\Windows\System\VhzpZRU.exe

C:\Windows\System\VhzpZRU.exe

C:\Windows\System\bFNcPTg.exe

C:\Windows\System\bFNcPTg.exe

C:\Windows\System\KkGDKSS.exe

C:\Windows\System\KkGDKSS.exe

C:\Windows\System\VTdgSfj.exe

C:\Windows\System\VTdgSfj.exe

C:\Windows\System\eIChvoW.exe

C:\Windows\System\eIChvoW.exe

C:\Windows\System\IsZZBUH.exe

C:\Windows\System\IsZZBUH.exe

C:\Windows\System\sXwWNDD.exe

C:\Windows\System\sXwWNDD.exe

C:\Windows\System\DWCUDcL.exe

C:\Windows\System\DWCUDcL.exe

C:\Windows\System\rypEcpZ.exe

C:\Windows\System\rypEcpZ.exe

C:\Windows\System\hawZNRS.exe

C:\Windows\System\hawZNRS.exe

C:\Windows\System\CAwOnSr.exe

C:\Windows\System\CAwOnSr.exe

C:\Windows\System\OwgnkBz.exe

C:\Windows\System\OwgnkBz.exe

C:\Windows\System\kvNwcZI.exe

C:\Windows\System\kvNwcZI.exe

C:\Windows\System\bulrHMJ.exe

C:\Windows\System\bulrHMJ.exe

C:\Windows\System\ZrkQQvP.exe

C:\Windows\System\ZrkQQvP.exe

C:\Windows\System\JEdzDfl.exe

C:\Windows\System\JEdzDfl.exe

C:\Windows\System\ckTaWfx.exe

C:\Windows\System\ckTaWfx.exe

C:\Windows\System\UpAgklp.exe

C:\Windows\System\UpAgklp.exe

C:\Windows\System\prnowqR.exe

C:\Windows\System\prnowqR.exe

C:\Windows\System\SizIrNh.exe

C:\Windows\System\SizIrNh.exe

C:\Windows\System\jPVnnza.exe

C:\Windows\System\jPVnnza.exe

C:\Windows\System\IERvCUQ.exe

C:\Windows\System\IERvCUQ.exe

C:\Windows\System\HqhKARj.exe

C:\Windows\System\HqhKARj.exe

C:\Windows\System\RUqiAxG.exe

C:\Windows\System\RUqiAxG.exe

C:\Windows\System\UqfPLGX.exe

C:\Windows\System\UqfPLGX.exe

C:\Windows\System\JYwFPAs.exe

C:\Windows\System\JYwFPAs.exe

C:\Windows\System\PXJsirl.exe

C:\Windows\System\PXJsirl.exe

C:\Windows\System\dHqbMbN.exe

C:\Windows\System\dHqbMbN.exe

C:\Windows\System\aHJApkB.exe

C:\Windows\System\aHJApkB.exe

C:\Windows\System\AnmkyOA.exe

C:\Windows\System\AnmkyOA.exe

C:\Windows\System\qUdRjpA.exe

C:\Windows\System\qUdRjpA.exe

C:\Windows\System\zsmYKGV.exe

C:\Windows\System\zsmYKGV.exe

C:\Windows\System\YwrKhYE.exe

C:\Windows\System\YwrKhYE.exe

C:\Windows\System\UDbhCCB.exe

C:\Windows\System\UDbhCCB.exe

C:\Windows\System\SEWPxps.exe

C:\Windows\System\SEWPxps.exe

C:\Windows\System\xYOYHMW.exe

C:\Windows\System\xYOYHMW.exe

C:\Windows\System\TBHHZKF.exe

C:\Windows\System\TBHHZKF.exe

C:\Windows\System\veeUzUB.exe

C:\Windows\System\veeUzUB.exe

C:\Windows\System\XFqxjEy.exe

C:\Windows\System\XFqxjEy.exe

C:\Windows\System\sloXQYu.exe

C:\Windows\System\sloXQYu.exe

C:\Windows\System\wBtBVcp.exe

C:\Windows\System\wBtBVcp.exe

C:\Windows\System\kLMFCLu.exe

C:\Windows\System\kLMFCLu.exe

C:\Windows\System\xumVvyk.exe

C:\Windows\System\xumVvyk.exe

C:\Windows\System\cRBxNma.exe

C:\Windows\System\cRBxNma.exe

C:\Windows\System\RqxvjCg.exe

C:\Windows\System\RqxvjCg.exe

C:\Windows\System\BtoNRVp.exe

C:\Windows\System\BtoNRVp.exe

C:\Windows\System\MElfbSs.exe

C:\Windows\System\MElfbSs.exe

C:\Windows\System\paqWIMQ.exe

C:\Windows\System\paqWIMQ.exe

C:\Windows\System\ybcLTiZ.exe

C:\Windows\System\ybcLTiZ.exe

C:\Windows\System\ROklDEP.exe

C:\Windows\System\ROklDEP.exe

C:\Windows\System\amvyVHL.exe

C:\Windows\System\amvyVHL.exe

C:\Windows\System\ibCsITW.exe

C:\Windows\System\ibCsITW.exe

C:\Windows\System\tAdTDVg.exe

C:\Windows\System\tAdTDVg.exe

C:\Windows\System\dhwIPTc.exe

C:\Windows\System\dhwIPTc.exe

C:\Windows\System\eUhvhzs.exe

C:\Windows\System\eUhvhzs.exe

C:\Windows\System\lPVvZtZ.exe

C:\Windows\System\lPVvZtZ.exe

C:\Windows\System\tevOZTd.exe

C:\Windows\System\tevOZTd.exe

C:\Windows\System\SBkJncT.exe

C:\Windows\System\SBkJncT.exe

C:\Windows\System\sArBnmA.exe

C:\Windows\System\sArBnmA.exe

C:\Windows\System\fXnhqoo.exe

C:\Windows\System\fXnhqoo.exe

C:\Windows\System\SVqLYZN.exe

C:\Windows\System\SVqLYZN.exe

C:\Windows\System\MfAXUAx.exe

C:\Windows\System\MfAXUAx.exe

C:\Windows\System\mkygWvA.exe

C:\Windows\System\mkygWvA.exe

C:\Windows\System\WDfdyVU.exe

C:\Windows\System\WDfdyVU.exe

C:\Windows\System\BRaUuhy.exe

C:\Windows\System\BRaUuhy.exe

C:\Windows\System\RztTrcU.exe

C:\Windows\System\RztTrcU.exe

C:\Windows\System\ELQkRSv.exe

C:\Windows\System\ELQkRSv.exe

C:\Windows\System\KkPzqiB.exe

C:\Windows\System\KkPzqiB.exe

C:\Windows\System\RRtNrHo.exe

C:\Windows\System\RRtNrHo.exe

C:\Windows\System\cpFPQas.exe

C:\Windows\System\cpFPQas.exe

C:\Windows\System\RErocTv.exe

C:\Windows\System\RErocTv.exe

C:\Windows\System\CKflgWA.exe

C:\Windows\System\CKflgWA.exe

C:\Windows\System\AZzkrlJ.exe

C:\Windows\System\AZzkrlJ.exe

C:\Windows\System\XDIPybx.exe

C:\Windows\System\XDIPybx.exe

C:\Windows\System\qXAxtWy.exe

C:\Windows\System\qXAxtWy.exe

C:\Windows\System\tglWzHM.exe

C:\Windows\System\tglWzHM.exe

C:\Windows\System\PLFWRqD.exe

C:\Windows\System\PLFWRqD.exe

C:\Windows\System\xiZhcxF.exe

C:\Windows\System\xiZhcxF.exe

C:\Windows\System\PUnnpsI.exe

C:\Windows\System\PUnnpsI.exe

C:\Windows\System\BFLdbHa.exe

C:\Windows\System\BFLdbHa.exe

C:\Windows\System\eOJjcGU.exe

C:\Windows\System\eOJjcGU.exe

C:\Windows\System\ChlcDCl.exe

C:\Windows\System\ChlcDCl.exe

C:\Windows\System\KxcjNxw.exe

C:\Windows\System\KxcjNxw.exe

C:\Windows\System\zCvhJXo.exe

C:\Windows\System\zCvhJXo.exe

C:\Windows\System\WrdkeJg.exe

C:\Windows\System\WrdkeJg.exe

C:\Windows\System\agfmFxG.exe

C:\Windows\System\agfmFxG.exe

C:\Windows\System\YdwyicG.exe

C:\Windows\System\YdwyicG.exe

C:\Windows\System\AtqUfVh.exe

C:\Windows\System\AtqUfVh.exe

C:\Windows\System\iCqQlEy.exe

C:\Windows\System\iCqQlEy.exe

C:\Windows\System\hNeCoxw.exe

C:\Windows\System\hNeCoxw.exe

C:\Windows\System\qKavbvj.exe

C:\Windows\System\qKavbvj.exe

C:\Windows\System\HNZoQru.exe

C:\Windows\System\HNZoQru.exe

C:\Windows\System\YEdSFLO.exe

C:\Windows\System\YEdSFLO.exe

C:\Windows\System\VGeMpyO.exe

C:\Windows\System\VGeMpyO.exe

C:\Windows\System\QxWPZCB.exe

C:\Windows\System\QxWPZCB.exe

C:\Windows\System\etSFjzQ.exe

C:\Windows\System\etSFjzQ.exe

C:\Windows\System\SihpZbR.exe

C:\Windows\System\SihpZbR.exe

C:\Windows\System\VIeNDoC.exe

C:\Windows\System\VIeNDoC.exe

C:\Windows\System\QAAmxRe.exe

C:\Windows\System\QAAmxRe.exe

C:\Windows\System\DpcZsbR.exe

C:\Windows\System\DpcZsbR.exe

C:\Windows\System\tpRpoJs.exe

C:\Windows\System\tpRpoJs.exe

C:\Windows\System\uFNiNxK.exe

C:\Windows\System\uFNiNxK.exe

C:\Windows\System\yEvlbHn.exe

C:\Windows\System\yEvlbHn.exe

C:\Windows\System\pxmoYMS.exe

C:\Windows\System\pxmoYMS.exe

C:\Windows\System\loroxJq.exe

C:\Windows\System\loroxJq.exe

C:\Windows\System\rGSrWKc.exe

C:\Windows\System\rGSrWKc.exe

C:\Windows\System\iTSYwtL.exe

C:\Windows\System\iTSYwtL.exe

C:\Windows\System\aaxZPzv.exe

C:\Windows\System\aaxZPzv.exe

C:\Windows\System\NzOcyCl.exe

C:\Windows\System\NzOcyCl.exe

C:\Windows\System\LtFyQUO.exe

C:\Windows\System\LtFyQUO.exe

C:\Windows\System\OiCxHtL.exe

C:\Windows\System\OiCxHtL.exe

C:\Windows\System\JWntfkb.exe

C:\Windows\System\JWntfkb.exe

C:\Windows\System\zfIvsYj.exe

C:\Windows\System\zfIvsYj.exe

C:\Windows\System\aYkjvUv.exe

C:\Windows\System\aYkjvUv.exe

C:\Windows\System\PwZYjTL.exe

C:\Windows\System\PwZYjTL.exe

C:\Windows\System\rvbUSpb.exe

C:\Windows\System\rvbUSpb.exe

C:\Windows\System\HbtmmDu.exe

C:\Windows\System\HbtmmDu.exe

C:\Windows\System\GyZvxrK.exe

C:\Windows\System\GyZvxrK.exe

C:\Windows\System\aGERMZU.exe

C:\Windows\System\aGERMZU.exe

C:\Windows\System\Fxbcrvr.exe

C:\Windows\System\Fxbcrvr.exe

C:\Windows\System\vmWYMpm.exe

C:\Windows\System\vmWYMpm.exe

C:\Windows\System\uGvmHsu.exe

C:\Windows\System\uGvmHsu.exe

C:\Windows\System\FhzYSCS.exe

C:\Windows\System\FhzYSCS.exe

C:\Windows\System\bnJSlTF.exe

C:\Windows\System\bnJSlTF.exe

C:\Windows\System\mYXROvI.exe

C:\Windows\System\mYXROvI.exe

C:\Windows\System\qOoxAFd.exe

C:\Windows\System\qOoxAFd.exe

C:\Windows\System\mqZWBiX.exe

C:\Windows\System\mqZWBiX.exe

C:\Windows\System\wXTsfJM.exe

C:\Windows\System\wXTsfJM.exe

C:\Windows\System\eFXwOUv.exe

C:\Windows\System\eFXwOUv.exe

C:\Windows\System\lSsgQJB.exe

C:\Windows\System\lSsgQJB.exe

C:\Windows\System\WOWuizO.exe

C:\Windows\System\WOWuizO.exe

C:\Windows\System\ApVSAWt.exe

C:\Windows\System\ApVSAWt.exe

C:\Windows\System\KMDrimM.exe

C:\Windows\System\KMDrimM.exe

C:\Windows\System\wmWtZeo.exe

C:\Windows\System\wmWtZeo.exe

C:\Windows\System\PKMibSV.exe

C:\Windows\System\PKMibSV.exe

C:\Windows\System\cbGcCIL.exe

C:\Windows\System\cbGcCIL.exe

C:\Windows\System\hUehArw.exe

C:\Windows\System\hUehArw.exe

C:\Windows\System\rOUAYUK.exe

C:\Windows\System\rOUAYUK.exe

C:\Windows\System\diedtwV.exe

C:\Windows\System\diedtwV.exe

C:\Windows\System\VjQCJGM.exe

C:\Windows\System\VjQCJGM.exe

C:\Windows\System\UdYXeUu.exe

C:\Windows\System\UdYXeUu.exe

C:\Windows\System\vGeQUcA.exe

C:\Windows\System\vGeQUcA.exe

C:\Windows\System\GXKlHFx.exe

C:\Windows\System\GXKlHFx.exe

C:\Windows\System\sMTNqeR.exe

C:\Windows\System\sMTNqeR.exe

C:\Windows\System\xYMckOW.exe

C:\Windows\System\xYMckOW.exe

C:\Windows\System\rHhvXix.exe

C:\Windows\System\rHhvXix.exe

C:\Windows\System\XbmPcFV.exe

C:\Windows\System\XbmPcFV.exe

C:\Windows\System\UKFLwaj.exe

C:\Windows\System\UKFLwaj.exe

C:\Windows\System\QcgFQDv.exe

C:\Windows\System\QcgFQDv.exe

C:\Windows\System\MvrSKcH.exe

C:\Windows\System\MvrSKcH.exe

C:\Windows\System\jKWhduC.exe

C:\Windows\System\jKWhduC.exe

C:\Windows\System\tcOUflG.exe

C:\Windows\System\tcOUflG.exe

C:\Windows\System\IqHcabV.exe

C:\Windows\System\IqHcabV.exe

C:\Windows\System\iUDVyfF.exe

C:\Windows\System\iUDVyfF.exe

C:\Windows\System\ahMiFdQ.exe

C:\Windows\System\ahMiFdQ.exe

C:\Windows\System\cKmRCcj.exe

C:\Windows\System\cKmRCcj.exe

C:\Windows\System\xbAMcTn.exe

C:\Windows\System\xbAMcTn.exe

C:\Windows\System\ipuOqtX.exe

C:\Windows\System\ipuOqtX.exe

C:\Windows\System\KXuAaSP.exe

C:\Windows\System\KXuAaSP.exe

C:\Windows\System\TwSZrzo.exe

C:\Windows\System\TwSZrzo.exe

C:\Windows\System\tzQuYYa.exe

C:\Windows\System\tzQuYYa.exe

C:\Windows\System\oeJvnMb.exe

C:\Windows\System\oeJvnMb.exe

C:\Windows\System\yrvjkzj.exe

C:\Windows\System\yrvjkzj.exe

C:\Windows\System\hFHzPoU.exe

C:\Windows\System\hFHzPoU.exe

C:\Windows\System\JTbokbg.exe

C:\Windows\System\JTbokbg.exe

C:\Windows\System\IgJBYwO.exe

C:\Windows\System\IgJBYwO.exe

C:\Windows\System\IdgkCXB.exe

C:\Windows\System\IdgkCXB.exe

C:\Windows\System\jADDLgH.exe

C:\Windows\System\jADDLgH.exe

C:\Windows\System\eyuboDu.exe

C:\Windows\System\eyuboDu.exe

C:\Windows\System\gBuDhlL.exe

C:\Windows\System\gBuDhlL.exe

C:\Windows\System\bYSQTyp.exe

C:\Windows\System\bYSQTyp.exe

C:\Windows\System\YkylYoS.exe

C:\Windows\System\YkylYoS.exe

C:\Windows\System\kNOAWFj.exe

C:\Windows\System\kNOAWFj.exe

C:\Windows\System\ZYePtrP.exe

C:\Windows\System\ZYePtrP.exe

C:\Windows\System\DWOiiLn.exe

C:\Windows\System\DWOiiLn.exe

C:\Windows\System\LvnmXbu.exe

C:\Windows\System\LvnmXbu.exe

C:\Windows\System\YKpVgHx.exe

C:\Windows\System\YKpVgHx.exe

C:\Windows\System\BNofKUo.exe

C:\Windows\System\BNofKUo.exe

C:\Windows\System\IWrWHYS.exe

C:\Windows\System\IWrWHYS.exe

C:\Windows\System\AyNffBn.exe

C:\Windows\System\AyNffBn.exe

C:\Windows\System\wPQYpdi.exe

C:\Windows\System\wPQYpdi.exe

C:\Windows\System\CTYvVoW.exe

C:\Windows\System\CTYvVoW.exe

C:\Windows\System\MZapKTp.exe

C:\Windows\System\MZapKTp.exe

C:\Windows\System\YlAgQcX.exe

C:\Windows\System\YlAgQcX.exe

C:\Windows\System\RJXoiBG.exe

C:\Windows\System\RJXoiBG.exe

C:\Windows\System\wKChOXF.exe

C:\Windows\System\wKChOXF.exe

C:\Windows\System\DerHIDa.exe

C:\Windows\System\DerHIDa.exe

C:\Windows\System\fCoHuLd.exe

C:\Windows\System\fCoHuLd.exe

C:\Windows\System\ATPenUs.exe

C:\Windows\System\ATPenUs.exe

C:\Windows\System\vItRvtw.exe

C:\Windows\System\vItRvtw.exe

C:\Windows\System\YxbuJYY.exe

C:\Windows\System\YxbuJYY.exe

C:\Windows\System\wdKlMVh.exe

C:\Windows\System\wdKlMVh.exe

C:\Windows\System\TUZhcDX.exe

C:\Windows\System\TUZhcDX.exe

C:\Windows\System\HvegBeE.exe

C:\Windows\System\HvegBeE.exe

C:\Windows\System\ttCBGmd.exe

C:\Windows\System\ttCBGmd.exe

C:\Windows\System\ymYycLV.exe

C:\Windows\System\ymYycLV.exe

C:\Windows\System\VplAigQ.exe

C:\Windows\System\VplAigQ.exe

C:\Windows\System\FTVRoMD.exe

C:\Windows\System\FTVRoMD.exe

C:\Windows\System\oapOjpn.exe

C:\Windows\System\oapOjpn.exe

C:\Windows\System\PTJPUGO.exe

C:\Windows\System\PTJPUGO.exe

C:\Windows\System\aTKmYSi.exe

C:\Windows\System\aTKmYSi.exe

C:\Windows\System\BneISRs.exe

C:\Windows\System\BneISRs.exe

C:\Windows\System\dZtqrvm.exe

C:\Windows\System\dZtqrvm.exe

C:\Windows\System\Jjzycui.exe

C:\Windows\System\Jjzycui.exe

C:\Windows\System\wgWTsVj.exe

C:\Windows\System\wgWTsVj.exe

C:\Windows\System\txNreRP.exe

C:\Windows\System\txNreRP.exe

C:\Windows\System\UArClBQ.exe

C:\Windows\System\UArClBQ.exe

C:\Windows\System\xcPkGNR.exe

C:\Windows\System\xcPkGNR.exe

C:\Windows\System\wNoKvVL.exe

C:\Windows\System\wNoKvVL.exe

C:\Windows\System\RSQxexn.exe

C:\Windows\System\RSQxexn.exe

C:\Windows\System\xJNQlga.exe

C:\Windows\System\xJNQlga.exe

C:\Windows\System\RpYxurU.exe

C:\Windows\System\RpYxurU.exe

C:\Windows\System\PLGkbwf.exe

C:\Windows\System\PLGkbwf.exe

C:\Windows\System\zRAqaAH.exe

C:\Windows\System\zRAqaAH.exe

C:\Windows\System\gAvXjYk.exe

C:\Windows\System\gAvXjYk.exe

C:\Windows\System\cZsvzAU.exe

C:\Windows\System\cZsvzAU.exe

C:\Windows\System\axIyhDm.exe

C:\Windows\System\axIyhDm.exe

C:\Windows\System\hAbwkXr.exe

C:\Windows\System\hAbwkXr.exe

C:\Windows\System\pMgxGtw.exe

C:\Windows\System\pMgxGtw.exe

C:\Windows\System\qTDqmHf.exe

C:\Windows\System\qTDqmHf.exe

C:\Windows\System\wQKcXKa.exe

C:\Windows\System\wQKcXKa.exe

C:\Windows\System\IDkvCBn.exe

C:\Windows\System\IDkvCBn.exe

C:\Windows\System\xPKLIDu.exe

C:\Windows\System\xPKLIDu.exe

C:\Windows\System\XhYvALe.exe

C:\Windows\System\XhYvALe.exe

C:\Windows\System\YcwaNKG.exe

C:\Windows\System\YcwaNKG.exe

C:\Windows\System\pRTVIRi.exe

C:\Windows\System\pRTVIRi.exe

C:\Windows\System\FxDsIjc.exe

C:\Windows\System\FxDsIjc.exe

C:\Windows\System\HKHpgzR.exe

C:\Windows\System\HKHpgzR.exe

C:\Windows\System\brofsdB.exe

C:\Windows\System\brofsdB.exe

C:\Windows\System\jjqwaRV.exe

C:\Windows\System\jjqwaRV.exe

C:\Windows\System\DLkZyxD.exe

C:\Windows\System\DLkZyxD.exe

C:\Windows\System\QcbgPbZ.exe

C:\Windows\System\QcbgPbZ.exe

C:\Windows\System\TdHLMPS.exe

C:\Windows\System\TdHLMPS.exe

C:\Windows\System\zPOWhoz.exe

C:\Windows\System\zPOWhoz.exe

C:\Windows\System\RpwpYkK.exe

C:\Windows\System\RpwpYkK.exe

C:\Windows\System\ZswBCQF.exe

C:\Windows\System\ZswBCQF.exe

C:\Windows\System\otyDtUS.exe

C:\Windows\System\otyDtUS.exe

C:\Windows\System\onFRwVH.exe

C:\Windows\System\onFRwVH.exe

C:\Windows\System\pYhSGVc.exe

C:\Windows\System\pYhSGVc.exe

C:\Windows\System\bCDKbpj.exe

C:\Windows\System\bCDKbpj.exe

C:\Windows\System\dRonVsd.exe

C:\Windows\System\dRonVsd.exe

C:\Windows\System\HfWeWHC.exe

C:\Windows\System\HfWeWHC.exe

C:\Windows\System\RLeJRLM.exe

C:\Windows\System\RLeJRLM.exe

C:\Windows\System\FFtkmLy.exe

C:\Windows\System\FFtkmLy.exe

C:\Windows\System\atdYsCS.exe

C:\Windows\System\atdYsCS.exe

C:\Windows\System\TvrUwXa.exe

C:\Windows\System\TvrUwXa.exe

C:\Windows\System\FazExRb.exe

C:\Windows\System\FazExRb.exe

C:\Windows\System\EGoieOv.exe

C:\Windows\System\EGoieOv.exe

C:\Windows\System\jBVjyyx.exe

C:\Windows\System\jBVjyyx.exe

C:\Windows\System\NDYGypq.exe

C:\Windows\System\NDYGypq.exe

C:\Windows\System\NLlDjVa.exe

C:\Windows\System\NLlDjVa.exe

C:\Windows\System\DtIpRts.exe

C:\Windows\System\DtIpRts.exe

C:\Windows\System\MJHxdgi.exe

C:\Windows\System\MJHxdgi.exe

C:\Windows\System\UynZfKa.exe

C:\Windows\System\UynZfKa.exe

C:\Windows\System\QqMEJCF.exe

C:\Windows\System\QqMEJCF.exe

C:\Windows\System\WAAVlED.exe

C:\Windows\System\WAAVlED.exe

C:\Windows\System\IbDyItX.exe

C:\Windows\System\IbDyItX.exe

C:\Windows\System\blrWhWn.exe

C:\Windows\System\blrWhWn.exe

C:\Windows\System\PTnMQbL.exe

C:\Windows\System\PTnMQbL.exe

C:\Windows\System\VGdnjag.exe

C:\Windows\System\VGdnjag.exe

C:\Windows\System\iXBUaiW.exe

C:\Windows\System\iXBUaiW.exe

C:\Windows\System\qrswNTq.exe

C:\Windows\System\qrswNTq.exe

C:\Windows\System\GHwZagi.exe

C:\Windows\System\GHwZagi.exe

C:\Windows\System\xXfcpDP.exe

C:\Windows\System\xXfcpDP.exe

C:\Windows\System\LlTkBjv.exe

C:\Windows\System\LlTkBjv.exe

C:\Windows\System\JZfCkaz.exe

C:\Windows\System\JZfCkaz.exe

C:\Windows\System\YQxbHUP.exe

C:\Windows\System\YQxbHUP.exe

C:\Windows\System\hRcXtIJ.exe

C:\Windows\System\hRcXtIJ.exe

C:\Windows\System\NhXAeZE.exe

C:\Windows\System\NhXAeZE.exe

C:\Windows\System\cIYDSDw.exe

C:\Windows\System\cIYDSDw.exe

C:\Windows\System\juAFPZY.exe

C:\Windows\System\juAFPZY.exe

C:\Windows\System\AyKOazj.exe

C:\Windows\System\AyKOazj.exe

C:\Windows\System\TaRcjAD.exe

C:\Windows\System\TaRcjAD.exe

C:\Windows\System\WTetSJa.exe

C:\Windows\System\WTetSJa.exe

C:\Windows\System\KyxeUMt.exe

C:\Windows\System\KyxeUMt.exe

C:\Windows\System\mYIoyul.exe

C:\Windows\System\mYIoyul.exe

C:\Windows\System\BkglCRE.exe

C:\Windows\System\BkglCRE.exe

C:\Windows\System\mQRDHay.exe

C:\Windows\System\mQRDHay.exe

C:\Windows\System\bHgjqmD.exe

C:\Windows\System\bHgjqmD.exe

C:\Windows\System\mzWdqML.exe

C:\Windows\System\mzWdqML.exe

C:\Windows\System\YwqAKpv.exe

C:\Windows\System\YwqAKpv.exe

C:\Windows\System\nijIuEe.exe

C:\Windows\System\nijIuEe.exe

C:\Windows\System\ZGUOUHw.exe

C:\Windows\System\ZGUOUHw.exe

C:\Windows\System\kvusTMd.exe

C:\Windows\System\kvusTMd.exe

C:\Windows\System\RGzCvYG.exe

C:\Windows\System\RGzCvYG.exe

C:\Windows\System\xRnlrTb.exe

C:\Windows\System\xRnlrTb.exe

C:\Windows\System\qNkpCWy.exe

C:\Windows\System\qNkpCWy.exe

C:\Windows\System\UzilBWU.exe

C:\Windows\System\UzilBWU.exe

C:\Windows\System\fpakkqR.exe

C:\Windows\System\fpakkqR.exe

C:\Windows\System\IWDhRNn.exe

C:\Windows\System\IWDhRNn.exe

C:\Windows\System\nzMBLpj.exe

C:\Windows\System\nzMBLpj.exe

C:\Windows\System\KtYwsbq.exe

C:\Windows\System\KtYwsbq.exe

C:\Windows\System\LkIAgPT.exe

C:\Windows\System\LkIAgPT.exe

C:\Windows\System\ulcVTzP.exe

C:\Windows\System\ulcVTzP.exe

C:\Windows\System\VowhxUH.exe

C:\Windows\System\VowhxUH.exe

C:\Windows\System\jWDMnCJ.exe

C:\Windows\System\jWDMnCJ.exe

C:\Windows\System\QvlzvlM.exe

C:\Windows\System\QvlzvlM.exe

C:\Windows\System\ImNoxOZ.exe

C:\Windows\System\ImNoxOZ.exe

C:\Windows\System\jteOoQO.exe

C:\Windows\System\jteOoQO.exe

C:\Windows\System\PVfDGpe.exe

C:\Windows\System\PVfDGpe.exe

C:\Windows\System\nfBgVOW.exe

C:\Windows\System\nfBgVOW.exe

C:\Windows\System\GaFLdkS.exe

C:\Windows\System\GaFLdkS.exe

C:\Windows\System\ijkVCrq.exe

C:\Windows\System\ijkVCrq.exe

C:\Windows\System\tXZRvHd.exe

C:\Windows\System\tXZRvHd.exe

C:\Windows\System\GQPVluZ.exe

C:\Windows\System\GQPVluZ.exe

C:\Windows\System\GCMfiWC.exe

C:\Windows\System\GCMfiWC.exe

C:\Windows\System\joXplst.exe

C:\Windows\System\joXplst.exe

C:\Windows\System\asZhDPd.exe

C:\Windows\System\asZhDPd.exe

C:\Windows\System\rICPWWQ.exe

C:\Windows\System\rICPWWQ.exe

C:\Windows\System\MfDhEEN.exe

C:\Windows\System\MfDhEEN.exe

C:\Windows\System\DgDJDLj.exe

C:\Windows\System\DgDJDLj.exe

C:\Windows\System\KtvnQLl.exe

C:\Windows\System\KtvnQLl.exe

C:\Windows\System\hYQYFdk.exe

C:\Windows\System\hYQYFdk.exe

C:\Windows\System\MhguXvA.exe

C:\Windows\System\MhguXvA.exe

C:\Windows\System\SbkMFxd.exe

C:\Windows\System\SbkMFxd.exe

C:\Windows\System\nHtgion.exe

C:\Windows\System\nHtgion.exe

C:\Windows\System\CwdPbBk.exe

C:\Windows\System\CwdPbBk.exe

C:\Windows\System\OQqVigO.exe

C:\Windows\System\OQqVigO.exe

C:\Windows\System\CcMZFkk.exe

C:\Windows\System\CcMZFkk.exe

C:\Windows\System\bhSLmny.exe

C:\Windows\System\bhSLmny.exe

C:\Windows\System\NefguEh.exe

C:\Windows\System\NefguEh.exe

C:\Windows\System\lFbQaSI.exe

C:\Windows\System\lFbQaSI.exe

C:\Windows\System\xZBonZE.exe

C:\Windows\System\xZBonZE.exe

C:\Windows\System\bBrYvzm.exe

C:\Windows\System\bBrYvzm.exe

C:\Windows\System\BfFvOkh.exe

C:\Windows\System\BfFvOkh.exe

C:\Windows\System\bPlVkkj.exe

C:\Windows\System\bPlVkkj.exe

C:\Windows\System\PanaWWP.exe

C:\Windows\System\PanaWWP.exe

C:\Windows\System\JOUrHER.exe

C:\Windows\System\JOUrHER.exe

C:\Windows\System\MudXxZP.exe

C:\Windows\System\MudXxZP.exe

C:\Windows\System\nBQPamT.exe

C:\Windows\System\nBQPamT.exe

C:\Windows\System\QyroiHu.exe

C:\Windows\System\QyroiHu.exe

C:\Windows\System\lnRFVcC.exe

C:\Windows\System\lnRFVcC.exe

C:\Windows\System\JDXlHyj.exe

C:\Windows\System\JDXlHyj.exe

C:\Windows\System\DvRwojd.exe

C:\Windows\System\DvRwojd.exe

C:\Windows\System\RGgfBsF.exe

C:\Windows\System\RGgfBsF.exe

C:\Windows\System\FxMeCZN.exe

C:\Windows\System\FxMeCZN.exe

C:\Windows\System\GqTnWSj.exe

C:\Windows\System\GqTnWSj.exe

C:\Windows\System\kRbkKHG.exe

C:\Windows\System\kRbkKHG.exe

C:\Windows\System\wLaINhA.exe

C:\Windows\System\wLaINhA.exe

C:\Windows\System\YWJPACh.exe

C:\Windows\System\YWJPACh.exe

C:\Windows\System\lqgBFRm.exe

C:\Windows\System\lqgBFRm.exe

C:\Windows\System\RxAxjZx.exe

C:\Windows\System\RxAxjZx.exe

C:\Windows\System\AxDWlPH.exe

C:\Windows\System\AxDWlPH.exe

C:\Windows\System\RHHNeaj.exe

C:\Windows\System\RHHNeaj.exe

C:\Windows\System\aLeLpFf.exe

C:\Windows\System\aLeLpFf.exe

C:\Windows\System\DpZgUoj.exe

C:\Windows\System\DpZgUoj.exe

C:\Windows\System\ZgeGVGS.exe

C:\Windows\System\ZgeGVGS.exe

C:\Windows\System\GEqvEqb.exe

C:\Windows\System\GEqvEqb.exe

C:\Windows\System\BmvHvCP.exe

C:\Windows\System\BmvHvCP.exe

C:\Windows\System\bzuYnmZ.exe

C:\Windows\System\bzuYnmZ.exe

C:\Windows\System\FwGZACT.exe

C:\Windows\System\FwGZACT.exe

C:\Windows\System\MXfsrVw.exe

C:\Windows\System\MXfsrVw.exe

C:\Windows\System\mxwyCIj.exe

C:\Windows\System\mxwyCIj.exe

C:\Windows\System\JhTHyhw.exe

C:\Windows\System\JhTHyhw.exe

C:\Windows\System\qJHbgEW.exe

C:\Windows\System\qJHbgEW.exe

C:\Windows\System\ApGEdMp.exe

C:\Windows\System\ApGEdMp.exe

C:\Windows\System\hyfUIEj.exe

C:\Windows\System\hyfUIEj.exe

C:\Windows\System\NKbxtrE.exe

C:\Windows\System\NKbxtrE.exe

C:\Windows\System\BJafhOQ.exe

C:\Windows\System\BJafhOQ.exe

C:\Windows\System\YJBDvxB.exe

C:\Windows\System\YJBDvxB.exe

C:\Windows\System\GsEUIQe.exe

C:\Windows\System\GsEUIQe.exe

C:\Windows\System\fPPgKkY.exe

C:\Windows\System\fPPgKkY.exe

C:\Windows\System\ptOBFNV.exe

C:\Windows\System\ptOBFNV.exe

C:\Windows\System\CtXtFLr.exe

C:\Windows\System\CtXtFLr.exe

C:\Windows\System\gmjUlcg.exe

C:\Windows\System\gmjUlcg.exe

C:\Windows\System\ZdGikNF.exe

C:\Windows\System\ZdGikNF.exe

C:\Windows\System\ZbNOSsO.exe

C:\Windows\System\ZbNOSsO.exe

C:\Windows\System\hBvrwRT.exe

C:\Windows\System\hBvrwRT.exe

C:\Windows\System\reMVHnk.exe

C:\Windows\System\reMVHnk.exe

C:\Windows\System\okUbmxu.exe

C:\Windows\System\okUbmxu.exe

C:\Windows\System\QFhOobq.exe

C:\Windows\System\QFhOobq.exe

C:\Windows\System\DWbrawO.exe

C:\Windows\System\DWbrawO.exe

C:\Windows\System\uKGwCij.exe

C:\Windows\System\uKGwCij.exe

C:\Windows\System\ZfdTHSD.exe

C:\Windows\System\ZfdTHSD.exe

C:\Windows\System\TsOeucn.exe

C:\Windows\System\TsOeucn.exe

C:\Windows\System\vapWuzL.exe

C:\Windows\System\vapWuzL.exe

C:\Windows\System\XiQNpqV.exe

C:\Windows\System\XiQNpqV.exe

C:\Windows\System\YdghrBH.exe

C:\Windows\System\YdghrBH.exe

C:\Windows\System\svcZJrX.exe

C:\Windows\System\svcZJrX.exe

C:\Windows\System\zVYDxBU.exe

C:\Windows\System\zVYDxBU.exe

C:\Windows\System\aEDMoRA.exe

C:\Windows\System\aEDMoRA.exe

C:\Windows\System\MZvrXIP.exe

C:\Windows\System\MZvrXIP.exe

C:\Windows\System\jkXBtFU.exe

C:\Windows\System\jkXBtFU.exe

C:\Windows\System\yEmEvOW.exe

C:\Windows\System\yEmEvOW.exe

C:\Windows\System\qYUyDYn.exe

C:\Windows\System\qYUyDYn.exe

C:\Windows\System\ZfnfryS.exe

C:\Windows\System\ZfnfryS.exe

C:\Windows\System\sGEIBlc.exe

C:\Windows\System\sGEIBlc.exe

C:\Windows\System\dgWuqGD.exe

C:\Windows\System\dgWuqGD.exe

C:\Windows\System\uhcMahR.exe

C:\Windows\System\uhcMahR.exe

C:\Windows\System\cjTytfY.exe

C:\Windows\System\cjTytfY.exe

C:\Windows\System\OOhuucE.exe

C:\Windows\System\OOhuucE.exe

C:\Windows\System\TWIZRxc.exe

C:\Windows\System\TWIZRxc.exe

C:\Windows\System\tsByfFC.exe

C:\Windows\System\tsByfFC.exe

C:\Windows\System\vHMGkGQ.exe

C:\Windows\System\vHMGkGQ.exe

C:\Windows\System\UDBHKjZ.exe

C:\Windows\System\UDBHKjZ.exe

C:\Windows\System\RdYzbVi.exe

C:\Windows\System\RdYzbVi.exe

C:\Windows\System\vffEdSz.exe

C:\Windows\System\vffEdSz.exe

C:\Windows\System\FxqmpdB.exe

C:\Windows\System\FxqmpdB.exe

C:\Windows\System\VDXXfbv.exe

C:\Windows\System\VDXXfbv.exe

C:\Windows\System\sOWsnPQ.exe

C:\Windows\System\sOWsnPQ.exe

C:\Windows\System\BGeajNZ.exe

C:\Windows\System\BGeajNZ.exe

C:\Windows\System\dxcWaCj.exe

C:\Windows\System\dxcWaCj.exe

C:\Windows\System\lrsuBYC.exe

C:\Windows\System\lrsuBYC.exe

C:\Windows\System\JIfYtgU.exe

C:\Windows\System\JIfYtgU.exe

C:\Windows\System\yacgUxh.exe

C:\Windows\System\yacgUxh.exe

C:\Windows\System\wngHxem.exe

C:\Windows\System\wngHxem.exe

C:\Windows\System\MUWAEos.exe

C:\Windows\System\MUWAEos.exe

C:\Windows\System\PxvIOBl.exe

C:\Windows\System\PxvIOBl.exe

C:\Windows\System\ptLqTre.exe

C:\Windows\System\ptLqTre.exe

C:\Windows\System\UmSaqkw.exe

C:\Windows\System\UmSaqkw.exe

C:\Windows\System\ZeUUwys.exe

C:\Windows\System\ZeUUwys.exe

C:\Windows\System\QrTHWiI.exe

C:\Windows\System\QrTHWiI.exe

C:\Windows\System\WHSjbQR.exe

C:\Windows\System\WHSjbQR.exe

C:\Windows\System\xkfYBzr.exe

C:\Windows\System\xkfYBzr.exe

C:\Windows\System\jxnkmBl.exe

C:\Windows\System\jxnkmBl.exe

C:\Windows\System\BsHrAfY.exe

C:\Windows\System\BsHrAfY.exe

C:\Windows\System\BNgFhoI.exe

C:\Windows\System\BNgFhoI.exe

C:\Windows\System\peugjYC.exe

C:\Windows\System\peugjYC.exe

C:\Windows\System\pyyqHow.exe

C:\Windows\System\pyyqHow.exe

C:\Windows\System\zYaEJTU.exe

C:\Windows\System\zYaEJTU.exe

C:\Windows\System\pTCOcVL.exe

C:\Windows\System\pTCOcVL.exe

C:\Windows\System\MMsLdoA.exe

C:\Windows\System\MMsLdoA.exe

C:\Windows\System\jVrZRAP.exe

C:\Windows\System\jVrZRAP.exe

C:\Windows\System\PCPdfzn.exe

C:\Windows\System\PCPdfzn.exe

C:\Windows\System\HVMRCVP.exe

C:\Windows\System\HVMRCVP.exe

C:\Windows\System\MlRWmub.exe

C:\Windows\System\MlRWmub.exe

C:\Windows\System\TRPToQL.exe

C:\Windows\System\TRPToQL.exe

C:\Windows\System\ABILiTD.exe

C:\Windows\System\ABILiTD.exe

C:\Windows\System\zrguVSO.exe

C:\Windows\System\zrguVSO.exe

C:\Windows\System\QnRCOXm.exe

C:\Windows\System\QnRCOXm.exe

C:\Windows\System\SqiKKtL.exe

C:\Windows\System\SqiKKtL.exe

C:\Windows\System\TFofUrn.exe

C:\Windows\System\TFofUrn.exe

C:\Windows\System\UMiorgy.exe

C:\Windows\System\UMiorgy.exe

C:\Windows\System\MbIamTI.exe

C:\Windows\System\MbIamTI.exe

C:\Windows\System\mRoLcOZ.exe

C:\Windows\System\mRoLcOZ.exe

C:\Windows\System\pcdNHmH.exe

C:\Windows\System\pcdNHmH.exe

C:\Windows\System\XgJMJWe.exe

C:\Windows\System\XgJMJWe.exe

C:\Windows\System\qiXpUGg.exe

C:\Windows\System\qiXpUGg.exe

C:\Windows\System\yKEpxcY.exe

C:\Windows\System\yKEpxcY.exe

C:\Windows\System\KUPsofj.exe

C:\Windows\System\KUPsofj.exe

C:\Windows\System\aYNvjUG.exe

C:\Windows\System\aYNvjUG.exe

C:\Windows\System\bjfqbnv.exe

C:\Windows\System\bjfqbnv.exe

C:\Windows\System\aKWbjfI.exe

C:\Windows\System\aKWbjfI.exe

C:\Windows\System\vHLWOoh.exe

C:\Windows\System\vHLWOoh.exe

C:\Windows\System\YjErmcU.exe

C:\Windows\System\YjErmcU.exe

C:\Windows\System\xeUYRqS.exe

C:\Windows\System\xeUYRqS.exe

C:\Windows\System\liNkROp.exe

C:\Windows\System\liNkROp.exe

C:\Windows\System\msCANJz.exe

C:\Windows\System\msCANJz.exe

C:\Windows\System\zCbRpXT.exe

C:\Windows\System\zCbRpXT.exe

C:\Windows\System\cWyaYpF.exe

C:\Windows\System\cWyaYpF.exe

C:\Windows\System\zAAhFmE.exe

C:\Windows\System\zAAhFmE.exe

C:\Windows\System\MjGZzWf.exe

C:\Windows\System\MjGZzWf.exe

C:\Windows\System\mkGwqiW.exe

C:\Windows\System\mkGwqiW.exe

C:\Windows\System\JSWoVTk.exe

C:\Windows\System\JSWoVTk.exe

C:\Windows\System\nsOkeWz.exe

C:\Windows\System\nsOkeWz.exe

C:\Windows\System\sEzWzFg.exe

C:\Windows\System\sEzWzFg.exe

C:\Windows\System\XplGvHp.exe

C:\Windows\System\XplGvHp.exe

C:\Windows\System\yyDoPFm.exe

C:\Windows\System\yyDoPFm.exe

C:\Windows\System\ohoichb.exe

C:\Windows\System\ohoichb.exe

C:\Windows\System\azUuLVV.exe

C:\Windows\System\azUuLVV.exe

C:\Windows\System\fhRCvVU.exe

C:\Windows\System\fhRCvVU.exe

C:\Windows\System\MTVQrkw.exe

C:\Windows\System\MTVQrkw.exe

C:\Windows\System\HXJSpuK.exe

C:\Windows\System\HXJSpuK.exe

C:\Windows\System\xVaOzwN.exe

C:\Windows\System\xVaOzwN.exe

C:\Windows\System\YSXXiJf.exe

C:\Windows\System\YSXXiJf.exe

C:\Windows\System\YrjquYx.exe

C:\Windows\System\YrjquYx.exe

C:\Windows\System\LrzuyVT.exe

C:\Windows\System\LrzuyVT.exe

C:\Windows\System\DumkrTu.exe

C:\Windows\System\DumkrTu.exe

C:\Windows\System\CoPqzBm.exe

C:\Windows\System\CoPqzBm.exe

C:\Windows\System\vYCGZRb.exe

C:\Windows\System\vYCGZRb.exe

C:\Windows\System\WQAIPYq.exe

C:\Windows\System\WQAIPYq.exe

C:\Windows\System\HsaBHDX.exe

C:\Windows\System\HsaBHDX.exe

C:\Windows\System\fPcGiGE.exe

C:\Windows\System\fPcGiGE.exe

C:\Windows\System\strTtvb.exe

C:\Windows\System\strTtvb.exe

C:\Windows\System\JHwmtQw.exe

C:\Windows\System\JHwmtQw.exe

C:\Windows\System\zHFrWzt.exe

C:\Windows\System\zHFrWzt.exe

C:\Windows\System\xKkSPtx.exe

C:\Windows\System\xKkSPtx.exe

C:\Windows\System\ipWMBuP.exe

C:\Windows\System\ipWMBuP.exe

C:\Windows\System\nwvulDp.exe

C:\Windows\System\nwvulDp.exe

C:\Windows\System\tTGsViq.exe

C:\Windows\System\tTGsViq.exe

C:\Windows\System\YlZcuVd.exe

C:\Windows\System\YlZcuVd.exe

C:\Windows\System\WoNMAPG.exe

C:\Windows\System\WoNMAPG.exe

C:\Windows\System\PPLKsKU.exe

C:\Windows\System\PPLKsKU.exe

C:\Windows\System\xKaRfYC.exe

C:\Windows\System\xKaRfYC.exe

C:\Windows\System\gNvkoWt.exe

C:\Windows\System\gNvkoWt.exe

C:\Windows\System\zBZZQvD.exe

C:\Windows\System\zBZZQvD.exe

C:\Windows\System\TOEkdFC.exe

C:\Windows\System\TOEkdFC.exe

C:\Windows\System\hUkVvph.exe

C:\Windows\System\hUkVvph.exe

C:\Windows\System\JCZHrwv.exe

C:\Windows\System\JCZHrwv.exe

C:\Windows\System\UVhcuvA.exe

C:\Windows\System\UVhcuvA.exe

C:\Windows\System\VMBWmpB.exe

C:\Windows\System\VMBWmpB.exe

C:\Windows\System\ykzupVC.exe

C:\Windows\System\ykzupVC.exe

C:\Windows\System\khEPlbi.exe

C:\Windows\System\khEPlbi.exe

C:\Windows\System\TFESlPz.exe

C:\Windows\System\TFESlPz.exe

C:\Windows\System\ByRYHyw.exe

C:\Windows\System\ByRYHyw.exe

C:\Windows\System\TzAJcMB.exe

C:\Windows\System\TzAJcMB.exe

C:\Windows\System\ZpNJxEH.exe

C:\Windows\System\ZpNJxEH.exe

C:\Windows\System\ObngSRz.exe

C:\Windows\System\ObngSRz.exe

C:\Windows\System\kBjwXIc.exe

C:\Windows\System\kBjwXIc.exe

C:\Windows\System\zaxITXa.exe

C:\Windows\System\zaxITXa.exe

C:\Windows\System\KVQPkWn.exe

C:\Windows\System\KVQPkWn.exe

C:\Windows\System\LVPNPrs.exe

C:\Windows\System\LVPNPrs.exe

C:\Windows\System\jSpGAhr.exe

C:\Windows\System\jSpGAhr.exe

C:\Windows\System\norlGLM.exe

C:\Windows\System\norlGLM.exe

C:\Windows\System\tiAhUou.exe

C:\Windows\System\tiAhUou.exe

C:\Windows\System\cvJCMEY.exe

C:\Windows\System\cvJCMEY.exe

C:\Windows\System\NRstjEE.exe

C:\Windows\System\NRstjEE.exe

C:\Windows\System\fkQfaMM.exe

C:\Windows\System\fkQfaMM.exe

C:\Windows\System\BenJkvm.exe

C:\Windows\System\BenJkvm.exe

C:\Windows\System\zrrrPJY.exe

C:\Windows\System\zrrrPJY.exe

C:\Windows\System\GxLVJmH.exe

C:\Windows\System\GxLVJmH.exe

C:\Windows\System\NGkueja.exe

C:\Windows\System\NGkueja.exe

C:\Windows\System\oHytWCv.exe

C:\Windows\System\oHytWCv.exe

C:\Windows\System\ILoHpwZ.exe

C:\Windows\System\ILoHpwZ.exe

C:\Windows\System\qkpfnRq.exe

C:\Windows\System\qkpfnRq.exe

C:\Windows\System\bKbAmvv.exe

C:\Windows\System\bKbAmvv.exe

C:\Windows\System\LpfWems.exe

C:\Windows\System\LpfWems.exe

C:\Windows\System\mdWGuhH.exe

C:\Windows\System\mdWGuhH.exe

C:\Windows\System\bYqJubL.exe

C:\Windows\System\bYqJubL.exe

C:\Windows\System\ejFFqIS.exe

C:\Windows\System\ejFFqIS.exe

C:\Windows\System\MVnqxaO.exe

C:\Windows\System\MVnqxaO.exe

C:\Windows\System\enIxBcq.exe

C:\Windows\System\enIxBcq.exe

C:\Windows\System\MyFNRUk.exe

C:\Windows\System\MyFNRUk.exe

C:\Windows\System\CspFgNI.exe

C:\Windows\System\CspFgNI.exe

C:\Windows\System\hgzzJYO.exe

C:\Windows\System\hgzzJYO.exe

C:\Windows\System\zkFmkFi.exe

C:\Windows\System\zkFmkFi.exe

C:\Windows\System\Ufaovtm.exe

C:\Windows\System\Ufaovtm.exe

C:\Windows\System\hhVusxv.exe

C:\Windows\System\hhVusxv.exe

C:\Windows\System\HRsHPgP.exe

C:\Windows\System\HRsHPgP.exe

C:\Windows\System\hmCgGKt.exe

C:\Windows\System\hmCgGKt.exe

C:\Windows\System\RzgSWoD.exe

C:\Windows\System\RzgSWoD.exe

C:\Windows\System\AXeajgP.exe

C:\Windows\System\AXeajgP.exe

C:\Windows\System\xXMaPgn.exe

C:\Windows\System\xXMaPgn.exe

C:\Windows\System\OBkRrFj.exe

C:\Windows\System\OBkRrFj.exe

C:\Windows\System\RWVnidd.exe

C:\Windows\System\RWVnidd.exe

C:\Windows\System\VJglDYf.exe

C:\Windows\System\VJglDYf.exe

C:\Windows\System\GITHsfm.exe

C:\Windows\System\GITHsfm.exe

C:\Windows\System\yFXCraO.exe

C:\Windows\System\yFXCraO.exe

C:\Windows\System\BsBdpks.exe

C:\Windows\System\BsBdpks.exe

C:\Windows\System\NqgrheM.exe

C:\Windows\System\NqgrheM.exe

C:\Windows\System\LjCvrCh.exe

C:\Windows\System\LjCvrCh.exe

C:\Windows\System\Qdhlbuf.exe

C:\Windows\System\Qdhlbuf.exe

C:\Windows\System\oQiPLex.exe

C:\Windows\System\oQiPLex.exe

C:\Windows\System\XcYLHrl.exe

C:\Windows\System\XcYLHrl.exe

C:\Windows\System\wYekmbA.exe

C:\Windows\System\wYekmbA.exe

C:\Windows\System\mouXVma.exe

C:\Windows\System\mouXVma.exe

C:\Windows\System\qYtifOQ.exe

C:\Windows\System\qYtifOQ.exe

C:\Windows\System\UVISzXD.exe

C:\Windows\System\UVISzXD.exe

C:\Windows\System\EFsDpaQ.exe

C:\Windows\System\EFsDpaQ.exe

C:\Windows\System\aNMPQEK.exe

C:\Windows\System\aNMPQEK.exe

C:\Windows\System\qkUDVSL.exe

C:\Windows\System\qkUDVSL.exe

C:\Windows\System\AZIEPjZ.exe

C:\Windows\System\AZIEPjZ.exe

C:\Windows\System\ebbiPgK.exe

C:\Windows\System\ebbiPgK.exe

C:\Windows\System\pDlIfUa.exe

C:\Windows\System\pDlIfUa.exe

C:\Windows\System\DjkOePJ.exe

C:\Windows\System\DjkOePJ.exe

C:\Windows\System\RLKKqhY.exe

C:\Windows\System\RLKKqhY.exe

C:\Windows\System\LhHTNcq.exe

C:\Windows\System\LhHTNcq.exe

C:\Windows\System\yiUnrFu.exe

C:\Windows\System\yiUnrFu.exe

C:\Windows\System\DHUtLSL.exe

C:\Windows\System\DHUtLSL.exe

C:\Windows\System\iObDtlT.exe

C:\Windows\System\iObDtlT.exe

C:\Windows\System\Typmphr.exe

C:\Windows\System\Typmphr.exe

C:\Windows\System\ORyoKyv.exe

C:\Windows\System\ORyoKyv.exe

C:\Windows\System\eRhGAvC.exe

C:\Windows\System\eRhGAvC.exe

C:\Windows\System\cHKEIIZ.exe

C:\Windows\System\cHKEIIZ.exe

C:\Windows\System\nrVdIxK.exe

C:\Windows\System\nrVdIxK.exe

C:\Windows\System\ETgkgWH.exe

C:\Windows\System\ETgkgWH.exe

C:\Windows\System\CHaqbAf.exe

C:\Windows\System\CHaqbAf.exe

C:\Windows\System\ZmfJJjv.exe

C:\Windows\System\ZmfJJjv.exe

C:\Windows\System\fzDwSlV.exe

C:\Windows\System\fzDwSlV.exe

C:\Windows\System\fArVAda.exe

C:\Windows\System\fArVAda.exe

C:\Windows\System\XsXwJiQ.exe

C:\Windows\System\XsXwJiQ.exe

C:\Windows\System\QVGsfyj.exe

C:\Windows\System\QVGsfyj.exe

C:\Windows\System\soPxfSl.exe

C:\Windows\System\soPxfSl.exe

C:\Windows\System\uLXOaSl.exe

C:\Windows\System\uLXOaSl.exe

C:\Windows\System\ByosCuq.exe

C:\Windows\System\ByosCuq.exe

C:\Windows\System\GeiPsQx.exe

C:\Windows\System\GeiPsQx.exe

C:\Windows\System\KMqpwgi.exe

C:\Windows\System\KMqpwgi.exe

C:\Windows\System\vigXTyq.exe

C:\Windows\System\vigXTyq.exe

C:\Windows\System\xpXyYCs.exe

C:\Windows\System\xpXyYCs.exe

C:\Windows\System\lwhgzjN.exe

C:\Windows\System\lwhgzjN.exe

C:\Windows\System\brXLHiM.exe

C:\Windows\System\brXLHiM.exe

C:\Windows\System\DPbpaAl.exe

C:\Windows\System\DPbpaAl.exe

C:\Windows\System\kKtxOkQ.exe

C:\Windows\System\kKtxOkQ.exe

C:\Windows\System\zMLHIgQ.exe

C:\Windows\System\zMLHIgQ.exe

C:\Windows\System\quybpXr.exe

C:\Windows\System\quybpXr.exe

C:\Windows\System\FuywIrq.exe

C:\Windows\System\FuywIrq.exe

C:\Windows\System\ZerKwNE.exe

C:\Windows\System\ZerKwNE.exe

C:\Windows\System\HFLNVXC.exe

C:\Windows\System\HFLNVXC.exe

C:\Windows\System\tlUeIDe.exe

C:\Windows\System\tlUeIDe.exe

C:\Windows\System\upCaqTb.exe

C:\Windows\System\upCaqTb.exe

C:\Windows\System\qqfUqbY.exe

C:\Windows\System\qqfUqbY.exe

C:\Windows\System\aHUcgOl.exe

C:\Windows\System\aHUcgOl.exe

C:\Windows\System\PwHBqgT.exe

C:\Windows\System\PwHBqgT.exe

C:\Windows\System\EvbObnB.exe

C:\Windows\System\EvbObnB.exe

C:\Windows\System\fyqSYoz.exe

C:\Windows\System\fyqSYoz.exe

C:\Windows\System\ywMIKHs.exe

C:\Windows\System\ywMIKHs.exe

C:\Windows\System\lQJguLi.exe

C:\Windows\System\lQJguLi.exe

C:\Windows\System\OxXJLDB.exe

C:\Windows\System\OxXJLDB.exe

C:\Windows\System\HWtURIp.exe

C:\Windows\System\HWtURIp.exe

C:\Windows\System\VvpknGo.exe

C:\Windows\System\VvpknGo.exe

C:\Windows\System\BqLwUte.exe

C:\Windows\System\BqLwUte.exe

C:\Windows\System\TnOkyQv.exe

C:\Windows\System\TnOkyQv.exe

C:\Windows\System\Rkbcamv.exe

C:\Windows\System\Rkbcamv.exe

C:\Windows\System\gRFRRbX.exe

C:\Windows\System\gRFRRbX.exe

C:\Windows\System\HtWHrLP.exe

C:\Windows\System\HtWHrLP.exe

C:\Windows\System\DNZKnEK.exe

C:\Windows\System\DNZKnEK.exe

C:\Windows\System\gGMKqEn.exe

C:\Windows\System\gGMKqEn.exe

C:\Windows\System\XTGCwRd.exe

C:\Windows\System\XTGCwRd.exe

C:\Windows\System\TzlpMMH.exe

C:\Windows\System\TzlpMMH.exe

C:\Windows\System\jlPQHwM.exe

C:\Windows\System\jlPQHwM.exe

C:\Windows\System\VMYTVAz.exe

C:\Windows\System\VMYTVAz.exe

C:\Windows\System\fLPNRbj.exe

C:\Windows\System\fLPNRbj.exe

C:\Windows\System\jWQKVOc.exe

C:\Windows\System\jWQKVOc.exe

C:\Windows\System\yOgPzOL.exe

C:\Windows\System\yOgPzOL.exe

C:\Windows\System\CxiUuPc.exe

C:\Windows\System\CxiUuPc.exe

C:\Windows\System\KKHFwwK.exe

C:\Windows\System\KKHFwwK.exe

C:\Windows\System\QLSiYZU.exe

C:\Windows\System\QLSiYZU.exe

C:\Windows\System\ZqbSIYt.exe

C:\Windows\System\ZqbSIYt.exe

C:\Windows\System\NRZjIbZ.exe

C:\Windows\System\NRZjIbZ.exe

C:\Windows\System\PGzfxuJ.exe

C:\Windows\System\PGzfxuJ.exe

C:\Windows\System\ETluNJI.exe

C:\Windows\System\ETluNJI.exe

C:\Windows\System\dDCJuwZ.exe

C:\Windows\System\dDCJuwZ.exe

C:\Windows\System\yqSVoqX.exe

C:\Windows\System\yqSVoqX.exe

C:\Windows\System\eqJXada.exe

C:\Windows\System\eqJXada.exe

C:\Windows\System\UvqcDgP.exe

C:\Windows\System\UvqcDgP.exe

C:\Windows\System\Adjijcg.exe

C:\Windows\System\Adjijcg.exe

C:\Windows\System\EQTFbMC.exe

C:\Windows\System\EQTFbMC.exe

C:\Windows\System\uoMMkQv.exe

C:\Windows\System\uoMMkQv.exe

C:\Windows\System\amdlDgd.exe

C:\Windows\System\amdlDgd.exe

C:\Windows\System\qGqVUzO.exe

C:\Windows\System\qGqVUzO.exe

C:\Windows\System\zxNBvgc.exe

C:\Windows\System\zxNBvgc.exe

C:\Windows\System\nRyHrie.exe

C:\Windows\System\nRyHrie.exe

C:\Windows\System\iAIfvJX.exe

C:\Windows\System\iAIfvJX.exe

C:\Windows\System\BqbOVxm.exe

C:\Windows\System\BqbOVxm.exe

C:\Windows\System\FSkMuLi.exe

C:\Windows\System\FSkMuLi.exe

C:\Windows\System\lBFtnBh.exe

C:\Windows\System\lBFtnBh.exe

C:\Windows\System\kLhAdBl.exe

C:\Windows\System\kLhAdBl.exe

C:\Windows\System\snYCfVO.exe

C:\Windows\System\snYCfVO.exe

C:\Windows\System\GxDjKWa.exe

C:\Windows\System\GxDjKWa.exe

C:\Windows\System\hnzzBCy.exe

C:\Windows\System\hnzzBCy.exe

C:\Windows\System\vNguRPt.exe

C:\Windows\System\vNguRPt.exe

C:\Windows\System\wytREYk.exe

C:\Windows\System\wytREYk.exe

C:\Windows\System\ENvheYM.exe

C:\Windows\System\ENvheYM.exe

C:\Windows\System\wNkYOAr.exe

C:\Windows\System\wNkYOAr.exe

C:\Windows\System\lfqDkCQ.exe

C:\Windows\System\lfqDkCQ.exe

C:\Windows\System\JtpckBC.exe

C:\Windows\System\JtpckBC.exe

C:\Windows\System\PVMTDEG.exe

C:\Windows\System\PVMTDEG.exe

C:\Windows\System\ZnQUTfo.exe

C:\Windows\System\ZnQUTfo.exe

C:\Windows\System\YhFhDiL.exe

C:\Windows\System\YhFhDiL.exe

C:\Windows\System\mSSCWdw.exe

C:\Windows\System\mSSCWdw.exe

C:\Windows\System\ZqCuBYg.exe

C:\Windows\System\ZqCuBYg.exe

C:\Windows\System\rlqifvr.exe

C:\Windows\System\rlqifvr.exe

C:\Windows\System\MzszSNK.exe

C:\Windows\System\MzszSNK.exe

C:\Windows\System\Cigdjfw.exe

C:\Windows\System\Cigdjfw.exe

C:\Windows\System\bGuTMou.exe

C:\Windows\System\bGuTMou.exe

C:\Windows\System\eDWCdOJ.exe

C:\Windows\System\eDWCdOJ.exe

C:\Windows\System\HfLPHdG.exe

C:\Windows\System\HfLPHdG.exe

C:\Windows\System\muwWHUn.exe

C:\Windows\System\muwWHUn.exe

C:\Windows\System\BNsjIVx.exe

C:\Windows\System\BNsjIVx.exe

C:\Windows\System\QJXqDPn.exe

C:\Windows\System\QJXqDPn.exe

C:\Windows\System\LGttKSC.exe

C:\Windows\System\LGttKSC.exe

C:\Windows\System\NNQmCSr.exe

C:\Windows\System\NNQmCSr.exe

C:\Windows\System\LsogcQT.exe

C:\Windows\System\LsogcQT.exe

C:\Windows\System\fvRpwjt.exe

C:\Windows\System\fvRpwjt.exe

C:\Windows\System\YalOdhy.exe

C:\Windows\System\YalOdhy.exe

C:\Windows\System\dKkwlvx.exe

C:\Windows\System\dKkwlvx.exe

C:\Windows\System\ahKgJpN.exe

C:\Windows\System\ahKgJpN.exe

C:\Windows\System\jbeGINk.exe

C:\Windows\System\jbeGINk.exe

C:\Windows\System\JZyFgzN.exe

C:\Windows\System\JZyFgzN.exe

C:\Windows\System\JFHkRPg.exe

C:\Windows\System\JFHkRPg.exe

C:\Windows\System\qZJbMxK.exe

C:\Windows\System\qZJbMxK.exe

C:\Windows\System\ZCGXqOL.exe

C:\Windows\System\ZCGXqOL.exe

C:\Windows\System\bRpOIKY.exe

C:\Windows\System\bRpOIKY.exe

C:\Windows\System\vwevQeT.exe

C:\Windows\System\vwevQeT.exe

C:\Windows\System\ZIYAcXq.exe

C:\Windows\System\ZIYAcXq.exe

C:\Windows\System\qciTNRa.exe

C:\Windows\System\qciTNRa.exe

C:\Windows\System\EpfyGBp.exe

C:\Windows\System\EpfyGBp.exe

C:\Windows\System\tSdCUGo.exe

C:\Windows\System\tSdCUGo.exe

C:\Windows\System\Vukgqbz.exe

C:\Windows\System\Vukgqbz.exe

C:\Windows\System\xiJhktI.exe

C:\Windows\System\xiJhktI.exe

C:\Windows\System\yqberFG.exe

C:\Windows\System\yqberFG.exe

C:\Windows\System\nzVAQEW.exe

C:\Windows\System\nzVAQEW.exe

C:\Windows\System\oHSMAMM.exe

C:\Windows\System\oHSMAMM.exe

C:\Windows\System\CUNUyIa.exe

C:\Windows\System\CUNUyIa.exe

C:\Windows\System\fmvLmpP.exe

C:\Windows\System\fmvLmpP.exe

C:\Windows\System\QzBbMdv.exe

C:\Windows\System\QzBbMdv.exe

C:\Windows\System\MrnrYFI.exe

C:\Windows\System\MrnrYFI.exe

C:\Windows\System\Zpqpapr.exe

C:\Windows\System\Zpqpapr.exe

C:\Windows\System\aEhafYx.exe

C:\Windows\System\aEhafYx.exe

C:\Windows\System\BujsTMK.exe

C:\Windows\System\BujsTMK.exe

C:\Windows\System\DGulQvv.exe

C:\Windows\System\DGulQvv.exe

C:\Windows\System\UQTteJg.exe

C:\Windows\System\UQTteJg.exe

C:\Windows\System\oEVXbaF.exe

C:\Windows\System\oEVXbaF.exe

C:\Windows\System\nvVylBX.exe

C:\Windows\System\nvVylBX.exe

C:\Windows\System\SZEqabm.exe

C:\Windows\System\SZEqabm.exe

C:\Windows\System\KaAnyAC.exe

C:\Windows\System\KaAnyAC.exe

C:\Windows\System\hVaECpc.exe

C:\Windows\System\hVaECpc.exe

C:\Windows\System\MfXaSNq.exe

C:\Windows\System\MfXaSNq.exe

C:\Windows\System\EcGlUZA.exe

C:\Windows\System\EcGlUZA.exe

C:\Windows\System\hCdUJqL.exe

C:\Windows\System\hCdUJqL.exe

C:\Windows\System\PIiGLfH.exe

C:\Windows\System\PIiGLfH.exe

C:\Windows\System\yvaeiRC.exe

C:\Windows\System\yvaeiRC.exe

C:\Windows\System\JhCMLVb.exe

C:\Windows\System\JhCMLVb.exe

C:\Windows\System\KCDJruY.exe

C:\Windows\System\KCDJruY.exe

C:\Windows\System\ZxOIIkS.exe

C:\Windows\System\ZxOIIkS.exe

C:\Windows\System\fvgaayo.exe

C:\Windows\System\fvgaayo.exe

C:\Windows\System\XgPUjcs.exe

C:\Windows\System\XgPUjcs.exe

C:\Windows\System\LjJlHSI.exe

C:\Windows\System\LjJlHSI.exe

C:\Windows\System\pFJZMlW.exe

C:\Windows\System\pFJZMlW.exe

C:\Windows\System\mvVNYEC.exe

C:\Windows\System\mvVNYEC.exe

C:\Windows\System\FdNgXkO.exe

C:\Windows\System\FdNgXkO.exe

C:\Windows\System\WDzfdNc.exe

C:\Windows\System\WDzfdNc.exe

C:\Windows\System\eJvjcWO.exe

C:\Windows\System\eJvjcWO.exe

C:\Windows\System\ZjVTFfH.exe

C:\Windows\System\ZjVTFfH.exe

C:\Windows\System\OmKQYsq.exe

C:\Windows\System\OmKQYsq.exe

C:\Windows\System\wRngnRG.exe

C:\Windows\System\wRngnRG.exe

C:\Windows\System\cTnsdTM.exe

C:\Windows\System\cTnsdTM.exe

C:\Windows\System\hLQKOtr.exe

C:\Windows\System\hLQKOtr.exe

C:\Windows\System\pnhprOe.exe

C:\Windows\System\pnhprOe.exe

C:\Windows\System\MMTKCuS.exe

C:\Windows\System\MMTKCuS.exe

C:\Windows\System\mpwOnAs.exe

C:\Windows\System\mpwOnAs.exe

C:\Windows\System\dqsEctZ.exe

C:\Windows\System\dqsEctZ.exe

C:\Windows\System\YUgFaxv.exe

C:\Windows\System\YUgFaxv.exe

C:\Windows\System\mhChGBK.exe

C:\Windows\System\mhChGBK.exe

C:\Windows\System\MWNNacD.exe

C:\Windows\System\MWNNacD.exe

C:\Windows\System\pNaISwo.exe

C:\Windows\System\pNaISwo.exe

C:\Windows\System\hvGDMrB.exe

C:\Windows\System\hvGDMrB.exe

C:\Windows\System\vJlRQrs.exe

C:\Windows\System\vJlRQrs.exe

C:\Windows\System\zLDtdWp.exe

C:\Windows\System\zLDtdWp.exe

C:\Windows\System\lsRssIw.exe

C:\Windows\System\lsRssIw.exe

C:\Windows\System\XgTJXuH.exe

C:\Windows\System\XgTJXuH.exe

C:\Windows\System\xdBhBdF.exe

C:\Windows\System\xdBhBdF.exe

C:\Windows\System\xnNiUzx.exe

C:\Windows\System\xnNiUzx.exe

C:\Windows\System\rgRzKMK.exe

C:\Windows\System\rgRzKMK.exe

C:\Windows\System\qeqHrem.exe

C:\Windows\System\qeqHrem.exe

C:\Windows\System\BQaSsbh.exe

C:\Windows\System\BQaSsbh.exe

C:\Windows\System\ngzcGxh.exe

C:\Windows\System\ngzcGxh.exe

C:\Windows\System\FQxFKPX.exe

C:\Windows\System\FQxFKPX.exe

C:\Windows\System\sHBWqHb.exe

C:\Windows\System\sHBWqHb.exe

C:\Windows\System\NNfjcEk.exe

C:\Windows\System\NNfjcEk.exe

C:\Windows\System\vpkOXJn.exe

C:\Windows\System\vpkOXJn.exe

C:\Windows\System\NVPznMc.exe

C:\Windows\System\NVPznMc.exe

C:\Windows\System\dSJWWzL.exe

C:\Windows\System\dSJWWzL.exe

C:\Windows\System\jfqoVZU.exe

C:\Windows\System\jfqoVZU.exe

C:\Windows\System\QCseBme.exe

C:\Windows\System\QCseBme.exe

C:\Windows\System\fqSDpIr.exe

C:\Windows\System\fqSDpIr.exe

C:\Windows\System\XhVmOsy.exe

C:\Windows\System\XhVmOsy.exe

C:\Windows\System\lWwdmJB.exe

C:\Windows\System\lWwdmJB.exe

C:\Windows\System\BTXuehH.exe

C:\Windows\System\BTXuehH.exe

C:\Windows\System\MAxSAbI.exe

C:\Windows\System\MAxSAbI.exe

C:\Windows\System\zSnkdJL.exe

C:\Windows\System\zSnkdJL.exe

C:\Windows\System\qBfCrNw.exe

C:\Windows\System\qBfCrNw.exe

C:\Windows\System\EUopOOD.exe

C:\Windows\System\EUopOOD.exe

C:\Windows\System\PdXwUFR.exe

C:\Windows\System\PdXwUFR.exe

C:\Windows\System\xVnZPHO.exe

C:\Windows\System\xVnZPHO.exe

C:\Windows\System\KUIfuUU.exe

C:\Windows\System\KUIfuUU.exe

C:\Windows\System\fPcoLcb.exe

C:\Windows\System\fPcoLcb.exe

C:\Windows\System\JxKTods.exe

C:\Windows\System\JxKTods.exe

C:\Windows\System\zrquaSB.exe

C:\Windows\System\zrquaSB.exe

C:\Windows\System\DAdiMHk.exe

C:\Windows\System\DAdiMHk.exe

C:\Windows\System\QJhFDQQ.exe

C:\Windows\System\QJhFDQQ.exe

C:\Windows\System\WNVFDJs.exe

C:\Windows\System\WNVFDJs.exe

C:\Windows\System\OehlZQF.exe

C:\Windows\System\OehlZQF.exe

C:\Windows\System\mluLpxH.exe

C:\Windows\System\mluLpxH.exe

C:\Windows\System\gaCmOdZ.exe

C:\Windows\System\gaCmOdZ.exe

C:\Windows\System\ZeNfIHc.exe

C:\Windows\System\ZeNfIHc.exe

C:\Windows\System\qHwzIwS.exe

C:\Windows\System\qHwzIwS.exe

C:\Windows\System\mGvSZrj.exe

C:\Windows\System\mGvSZrj.exe

C:\Windows\System\XBuGNmK.exe

C:\Windows\System\XBuGNmK.exe

C:\Windows\System\gTuawnA.exe

C:\Windows\System\gTuawnA.exe

C:\Windows\System\DwhBllT.exe

C:\Windows\System\DwhBllT.exe

C:\Windows\System\GkSbvuA.exe

C:\Windows\System\GkSbvuA.exe

C:\Windows\System\rNaKlwR.exe

C:\Windows\System\rNaKlwR.exe

C:\Windows\System\gYFVqJm.exe

C:\Windows\System\gYFVqJm.exe

C:\Windows\System\doaoEEa.exe

C:\Windows\System\doaoEEa.exe

C:\Windows\System\BtuRIgS.exe

C:\Windows\System\BtuRIgS.exe

C:\Windows\System\IApGawo.exe

C:\Windows\System\IApGawo.exe

C:\Windows\System\ePMGYYH.exe

C:\Windows\System\ePMGYYH.exe

C:\Windows\System\mizmlSE.exe

C:\Windows\System\mizmlSE.exe

C:\Windows\System\FhMGOgq.exe

C:\Windows\System\FhMGOgq.exe

C:\Windows\System\PBNnzNW.exe

C:\Windows\System\PBNnzNW.exe

C:\Windows\System\gDIzvsK.exe

C:\Windows\System\gDIzvsK.exe

C:\Windows\System\CTvxOer.exe

C:\Windows\System\CTvxOer.exe

C:\Windows\System\LrzQTth.exe

C:\Windows\System\LrzQTth.exe

C:\Windows\System\KvKpcNd.exe

C:\Windows\System\KvKpcNd.exe

C:\Windows\System\TcvmZld.exe

C:\Windows\System\TcvmZld.exe

C:\Windows\System\iiBUKKH.exe

C:\Windows\System\iiBUKKH.exe

C:\Windows\System\dBXZSlr.exe

C:\Windows\System\dBXZSlr.exe

C:\Windows\System\OQfwuyZ.exe

C:\Windows\System\OQfwuyZ.exe

C:\Windows\System\gUZGxiZ.exe

C:\Windows\System\gUZGxiZ.exe

C:\Windows\System\ezDoLVN.exe

C:\Windows\System\ezDoLVN.exe

C:\Windows\System\WMkcxHU.exe

C:\Windows\System\WMkcxHU.exe

C:\Windows\System\GPWMLGu.exe

C:\Windows\System\GPWMLGu.exe

C:\Windows\System\MqVhbGN.exe

C:\Windows\System\MqVhbGN.exe

C:\Windows\System\PgcyLcz.exe

C:\Windows\System\PgcyLcz.exe

C:\Windows\System\srlkQXh.exe

C:\Windows\System\srlkQXh.exe

C:\Windows\System\fqvaRfW.exe

C:\Windows\System\fqvaRfW.exe

C:\Windows\System\CzNigLG.exe

C:\Windows\System\CzNigLG.exe

C:\Windows\System\hFNGOfr.exe

C:\Windows\System\hFNGOfr.exe

C:\Windows\System\QLNQyDY.exe

C:\Windows\System\QLNQyDY.exe

C:\Windows\System\fhJyCyB.exe

C:\Windows\System\fhJyCyB.exe

C:\Windows\System\drTmYVk.exe

C:\Windows\System\drTmYVk.exe

C:\Windows\System\kejJVuQ.exe

C:\Windows\System\kejJVuQ.exe

C:\Windows\System\oOyDUFq.exe

C:\Windows\System\oOyDUFq.exe

C:\Windows\System\UPygsnr.exe

C:\Windows\System\UPygsnr.exe

C:\Windows\System\hkGIsrj.exe

C:\Windows\System\hkGIsrj.exe

C:\Windows\System\YLyPvWM.exe

C:\Windows\System\YLyPvWM.exe

C:\Windows\System\faDZKpk.exe

C:\Windows\System\faDZKpk.exe

C:\Windows\System\yYPYgAi.exe

C:\Windows\System\yYPYgAi.exe

C:\Windows\System\BuCCajO.exe

C:\Windows\System\BuCCajO.exe

C:\Windows\System\hWEYmgf.exe

C:\Windows\System\hWEYmgf.exe

C:\Windows\System\ELkYDnA.exe

C:\Windows\System\ELkYDnA.exe

C:\Windows\System\RyzFrIZ.exe

C:\Windows\System\RyzFrIZ.exe

C:\Windows\System\PTSJKsU.exe

C:\Windows\System\PTSJKsU.exe

C:\Windows\System\ZCzgaPC.exe

C:\Windows\System\ZCzgaPC.exe

C:\Windows\System\hTOSRoH.exe

C:\Windows\System\hTOSRoH.exe

C:\Windows\System\uTNhWWf.exe

C:\Windows\System\uTNhWWf.exe

C:\Windows\System\ECdKBhG.exe

C:\Windows\System\ECdKBhG.exe

C:\Windows\System\bHkGkNE.exe

C:\Windows\System\bHkGkNE.exe

C:\Windows\System\ZYppAMj.exe

C:\Windows\System\ZYppAMj.exe

C:\Windows\System\JTeIfKB.exe

C:\Windows\System\JTeIfKB.exe

C:\Windows\System\zOjCenz.exe

C:\Windows\System\zOjCenz.exe

C:\Windows\System\qLnJlsd.exe

C:\Windows\System\qLnJlsd.exe

C:\Windows\System\bQpkXdS.exe

C:\Windows\System\bQpkXdS.exe

C:\Windows\System\HhRSiIj.exe

C:\Windows\System\HhRSiIj.exe

C:\Windows\System\BgXqAYT.exe

C:\Windows\System\BgXqAYT.exe

C:\Windows\System\ZbdvEBV.exe

C:\Windows\System\ZbdvEBV.exe

C:\Windows\System\fNteziy.exe

C:\Windows\System\fNteziy.exe

C:\Windows\System\UGaFZil.exe

C:\Windows\System\UGaFZil.exe

C:\Windows\System\HAlRcHW.exe

C:\Windows\System\HAlRcHW.exe

C:\Windows\System\eTVJJLC.exe

C:\Windows\System\eTVJJLC.exe

C:\Windows\System\TEpdXfX.exe

C:\Windows\System\TEpdXfX.exe

C:\Windows\System\RQTdIyO.exe

C:\Windows\System\RQTdIyO.exe

C:\Windows\System\DkbotAm.exe

C:\Windows\System\DkbotAm.exe

C:\Windows\System\auAGuFd.exe

C:\Windows\System\auAGuFd.exe

C:\Windows\System\iQRVkwT.exe

C:\Windows\System\iQRVkwT.exe

C:\Windows\System\TFrByHB.exe

C:\Windows\System\TFrByHB.exe

C:\Windows\System\KFnbmvA.exe

C:\Windows\System\KFnbmvA.exe

C:\Windows\System\TgxqFvg.exe

C:\Windows\System\TgxqFvg.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp

Files

memory/2844-0-0x0000000000180000-0x0000000000190000-memory.dmp

\Windows\system\ZzTCIKe.exe

MD5	3f0403641127f8394af10bce78075d4f
SHA1	5a99efb011dd3e78014b79c90c2ac0b4e719fb9f
SHA256	4d50172c6a6100db4cbc9e2a2fdefb22bf634f349ea9ec8a3ee830ce0f6f4134
SHA512	1a0abe95945edc65c407dd659a61b0bc4f586a19c67b25ae31dea39d2050a8a1f1536aa153710a50771e4c26c40d85566ca29eb800e9cce36e32d445932a006c

memory/2844-2-0x000000013F980000-0x000000013FD72000-memory.dmp

memory/2844-7-0x0000000002F00000-0x00000000032F2000-memory.dmp

\Windows\system\dTMYTPA.exe

MD5	723e521b5a221ad127a540b518d7b8cf
SHA1	71e5d330ffd198512aaa1ff9c3503d618714dc39
SHA256	10a828a3b2ebc63fa966e7c79e79a33fef8513ebc562849917177c57669ac8b1
SHA512	5c199dda1b7bb41db6992c5101fbc674beb7d5c8d0d113d0a5b09c5f6ba153033c5c63423fd31498faa84d756dc8bb55174b7f2365e44477cfa4732c39072618

memory/2792-13-0x000000013F900000-0x000000013FCF2000-memory.dmp

memory/2904-20-0x000007FEF5ACE000-0x000007FEF5ACF000-memory.dmp

memory/2904-19-0x0000000002E70000-0x0000000002EF0000-memory.dmp

memory/2404-18-0x000000013F660000-0x000000013FA52000-memory.dmp

C:\Windows\system\IbstkDM.exe

MD5	3f6d92230e61e8290681a42d946c8f62
SHA1	5ae4a1f3e6da7add2364ec5af16686ac565c4e60
SHA256	5c004cb23b6b6033b2aa4e71bc3b5504d63cfc9e8729c28f04264888766bb34e
SHA512	7213f8373c78f20973a9448cd34ac14c307301ccaf94be87c5788c6479d0941d76b62b36ce22999945ab0f4b1c02518b27e7fb7608c95a8a2197a5782582e36b

C:\Windows\system\RrTYKxH.exe

MD5	d11121a1df14f8ca9f4b980bc903f6ca
SHA1	25cff13dcbe97b3337457ed225289da536d95b17
SHA256	6b372d7858d6f2b1a41873aef6d4c57a8f24b93ac49d022095738d8031fe645f
SHA512	a1e0c93a098ff079ee8e79a4af3c452f6d2f1d972a5aaf4451bc5e73eea6acbef761bbf1420930a8d58fae78b3240e6a6707f4ff577e2d094a7e7010437ed65b

C:\Windows\system\GvlHyam.exe

MD5	7b0eb3a0469cff25558bc841e2c9a335
SHA1	5002363d3b37a9cec4e75d0aac89a8730ee6b79d
SHA256	386caae6aaf807066c0d914818676b2ef1847db3b54bf61252c9f910cd5ed7e8
SHA512	3827be2e7fcf85d24bb14e9526f434877666828c28b5c242bebdb42278db3be66ee8b0d5aafc051c460014f9bf08a7254821e6a066aaaeff1eb260be0e033afd

\Windows\system\BUsJzOq.exe

MD5	12325c4016c9ed8950aadd55d1ea8b59
SHA1	0305b28faf9c025d89bee95f733b3bd1c6bf1503
SHA256	d3a133029aa25172b11b74c5ef5e165d5a0888f633819a57b616c0ccbc548d26
SHA512	07b0ef917883fa396325ebe3dbe03ff4da7136036cb6f9bb4c1b7df6c61fb98ae128edc075a0078a94526182b9af7256d543343932b27662ee1ce529c34fdfc8

C:\Windows\system\TYTgykB.exe

MD5	a0c3e0837337c62b2cdb32f84c0563cf
SHA1	fdfe64c440e3d256e4e5be59ccab1e356261a1df
SHA256	abf515d114930ef5ef64b9e1d308457764b74b93eb54301a2188a0fa9c897363
SHA512	afb03e2d3750f44536b2fcb34e56d47639be2470e8464607fb451e7d5ca9fb3fdac7f329ca58a5d089bbe73646bbae5090c46a06f026817d643ebdf0180cce08

C:\Windows\system\dqtJeKy.exe

MD5	57e0b4d30182f0e7a537fbbfa61386d6
SHA1	0ef3551e23c609adff7426fb6063a7b53e4b53f3
SHA256	b5a00c6453d1a8e8efd53fb2cd75439dde8d56171d60d4417674c3fe3bc04946
SHA512	6ec6131d152bc5ea3db8ac271ebf8fd17958bb95c2dc9d6398ae11b762b9e43072e65d6d84d32cd8d924b494594aa1f6139a43f9118ffe5dbc76486ebd92c839

\Windows\system\LMNiLtB.exe

MD5	c6ed1ebbfdc9a33ee298607fbf2f4a15
SHA1	38281bbb1cf9fd34a88c2795cde117518d2f8676
SHA256	69e0ff34e9ce7cd92d2f2be3e84365d4391343d0143de62351a9ae99760cda60
SHA512	2a0eb4adb26c7f830b1830a4e3fb42b054d7764ece2fe14e9d9c2bfa304b0f90758946dd455e35961259623ab3385174a3ca5090c6d284b4c640627fefe58a01

C:\Windows\system\gOCMQqq.exe

MD5	e5a8852ada45bdb7513bbda1d6c9b238
SHA1	ac44a0e9bbcf30a5eba6587bb739a310d080f993
SHA256	17e798f9ea2732d6031056848a138cee6fa673e4b813ed1faa20cbf17f633982
SHA512	e90a529816e7cb69d578f3823e8ff2a040515065492c706d667ad4915911e250eced86e78aa0c7496d7d5b73a4b262bf5ec5d7a6f57d87a5d22daa9c34760e2b

memory/2904-171-0x000000001B670000-0x000000001B952000-memory.dmp

memory/2904-181-0x0000000002920000-0x0000000002928000-memory.dmp

memory/2844-213-0x000000013F500000-0x000000013F8F2000-memory.dmp

memory/2476-223-0x000000013F550000-0x000000013F942000-memory.dmp

\Windows\system\GeJNGHe.exe

MD5	2366b735424bf01c902b8f09bf580123
SHA1	8c4d5265a740a2822522eb785364b54b36a82f9d
SHA256	8b0bd8c8f9640ac053a1037b7fc9521e65d95f4cca5f069403934ff0b31afb74
SHA512	87646fcec68b454632b9e1b0863d1353ba53f3e417136ae2fc0076ee64fba831035396347107e1e9d268ef6d1acacc49e4108fb454c56eba09543b8e874db57e

C:\Windows\system\uxdLYfa.exe

MD5	6232a969990a3601dc74b9da4988040a
SHA1	3d4aab200b21ecbf2bf439d8844d4718058e3c65
SHA256	66bb435f9f5b1a4038851c8e91c8ffdc936f3c27430238b0d6d1115540a12fb2
SHA512	82ced0d7c17976cb59abc293b5c12505128b3164ab4db19a9a51a7d146e36b968224ef1296a6f5c98dc5eee9e0d00408205864b44c5eefe2c8eb0d6d1bcb04ad

C:\Windows\system\FHDYYJA.exe

MD5	15f6a18c75a853b640eb564e0caf6e0c
SHA1	38aaadc196eb7db9c981f973df4122eb2c07376d
SHA256	baca34ae95568bf52449a838ec7b1a4d02c8f52d5a55743816c83b6b9d94fe49
SHA512	3d49eff84d705e45e93624f1378b7b9e31bff8e7281a0db22b7708abef12875cfcedd0d8ba008ff5b327d1e9c71a15ab2a795bd3915bd91e3f33ac444689d768

\Windows\system\rOtbnfP.exe

MD5	3edbae3a2a14345d76df715243d70ebb
SHA1	cefda84f27127b4ddd538067432730f6536f4a6a
SHA256	a8b60ec1ab8a15ee8f320565a242dbfa16f5b5218beb15454115ad27ab8dcbf2
SHA512	c656f7132e85185b8ef23045b663451eecc66a6e20a07202184119939e1cd58446aebaa9de4746e3bf9e8094c6cf10ac8d5cf3cc52ba6b74f3b979d859cb95a7

\Windows\system\gxjrxdM.exe

MD5	499848c92b714a8a6685f4cb27af0be0
SHA1	301e37a3d224b0d23143a2d6afeb14fbacf62db6
SHA256	c187b2a3c3f9f65f13d45da09b6f299f2e6c605852752f02663fcbccf4828344
SHA512	4713fd06cdc98924cdc726d9a7cdf50e7b3b7821218e22a5fc29ba2311ed0b6fb96a0c31eaa6b94b7ffda4ef8a3be17354989b8ac355dd60c6f9777fa4cac9bd

\Windows\system\xUojPvu.exe

MD5	411d55b938b2f91ec4df90e33143963e
SHA1	bfde02408042ed1a55eaf987550e627869cd3bbb
SHA256	f63f188cfa286699d9211ce2d50d8e8fbc4a3cb48101119cc5ad16d35677713b
SHA512	30a5fcf2378b8e5540cb689a87ab63d627da9e1ed94ae4c8b18d876c7ddecf07b303889ed0cfe0c951816e3f378dbcedec14dff7d7ab0d2067391227fd2512d6

\Windows\system\lZrQqHL.exe

MD5	110f863450d995b9962ae202d88249cf
SHA1	fd8168ea93b9ee13363a5ffed4b290b0293f7512
SHA256	d2ca76f5e20e6390612b3ffd1c0a9200303e667f6a73be01d959ac621837fda2
SHA512	a9a0be00f6d1e0a0750821d8f7abf5f0ab4b9a2b426be80d2dbb12dac423bbabb7fe1d88b567cab2c2128067e30d3ded5cba7aa0b6071d15841fce83d017361a

\Windows\system\JzvGGjW.exe

MD5	345d89e6e7173ab3cb6fc609ef202915
SHA1	7dd760c60ec91d3163061d459f093f62aa65a29d
SHA256	45ba990253b356de56ad992bd36363f7e5b727453a1e1d65e33b853c5e55e7b7
SHA512	9e4732dcf9626a5f4eb0619aeb59b93b858c55c11603f72712901fc1c105aedd2b34c4988fc62619d92d9d224daa8c3677a617d93735b91e1701c3bedbbd5f79

\Windows\system\nRIGpQo.exe

MD5	7bbd520e7bf893404dac6c0187650e9d
SHA1	6ae43eb78d8d887b936849888446b1006d85a69f
SHA256	87fcfc96a266970f1fa1249a436ddfc8b57fe5d4c7c666c8d09e521b6d26908d
SHA512	208d13eb55ace50052001e085e599351851900be2923070a0fd0259a25701ba7649bb4a0ab1418be657f73f240837aa24b1c05412ddc3eddf78f4bf0dae87903

memory/2844-241-0x000000013FF50000-0x0000000140342000-memory.dmp

memory/2904-240-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

memory/2844-239-0x0000000002F00000-0x00000000032F2000-memory.dmp

memory/2488-238-0x000000013F380000-0x000000013F772000-memory.dmp

memory/2844-237-0x000000013F380000-0x000000013F772000-memory.dmp

memory/2288-236-0x000000013F880000-0x000000013FC72000-memory.dmp

memory/2844-235-0x0000000002F00000-0x00000000032F2000-memory.dmp

memory/2604-234-0x000000013FA00000-0x000000013FDF2000-memory.dmp

memory/2844-233-0x0000000002F00000-0x00000000032F2000-memory.dmp

memory/2764-232-0x000000013F020000-0x000000013F412000-memory.dmp

memory/2844-231-0x000000013F020000-0x000000013F412000-memory.dmp

memory/2628-230-0x000000013F7A0000-0x000000013FB92000-memory.dmp

memory/2844-229-0x0000000002F00000-0x00000000032F2000-memory.dmp

memory/2708-219-0x000000013F500000-0x000000013F8F2000-memory.dmp

memory/2688-210-0x000000013F060000-0x000000013F452000-memory.dmp

memory/2844-208-0x000000013F060000-0x000000013F452000-memory.dmp

memory/2676-207-0x000000013FA30000-0x000000013FE22000-memory.dmp

C:\Windows\system\SnAXHUt.exe

MD5	94317e01828619b74ddabd855c5e552c
SHA1	c72b006fb3cbf291eee4c540d3c7f373930db1f2
SHA256	f221dd890e942af3847968595beefed1d21e2b2487903ee9d3942918e6f2bf04
SHA512	bf1fcce9e893ad63182cfbdaa3bdc4f4458372f14e4261e487c88d7484d9945ab791374a098ff835b48244b29b20d58deec84ccae665dddee8af141e7d712b7e

C:\Windows\system\LbhaDQT.exe

MD5	940048232f39946f9b173c40fc6f7746
SHA1	2b4717c89a8129c029358a3260d675a4a13d964b
SHA256	ef0254fef2f4aa0d24bebce485fd294f5f7161e55d34b0915e164a3dd1efed71
SHA512	162f5688bfb265292de0df08a8a2e9bee121cb917b916c9c2da3bc7d139eff8abe0adcfdfdf7c88a1c129f12ee923e2332ec063962c3e9989569235a83ca61f7

C:\Windows\system\sAOKKJL.exe

MD5	bbf9dd95cc624c1266055fa63bd1c754
SHA1	d3397ecb4a2d0b538db30a4cd0f4468587d59439
SHA256	b9306a75fec9e822490e8dea15c88b72ded8d4a83507a1463ed3d5cede67c6b4
SHA512	1b2aad2e268216b38382a81c4048c1eb200fb6399c977b512ce0a334448c9dad63e907da5eed8bcafddb630fc4a13a5e5b2669db15612a4546110d121afc85b7

memory/2844-205-0x0000000002F00000-0x00000000032F2000-memory.dmp

memory/2608-204-0x000000013FF50000-0x0000000140342000-memory.dmp

memory/2904-203-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

C:\Windows\system\BacNnSx.exe

MD5	8a6bdb72452475edcbad5da8c2e6bc37
SHA1	6da623a9acce23d6b0b7c16df2c6c02810d7720f
SHA256	81be96cc785d2275a4d562d5897c7b8bc2964016477548d3b5b343582ae2f74e
SHA512	a4c330dd4536300b696f1cef04a617d3b9ef1c147b843bb2898c3c8cbe0dce1e46bd0f1cf941a4dfb863951ceec083e45d26b7814aa3630f5f7f97439b63989e

\Windows\system\MCpLvQc.exe

MD5	92fb47a047419d92675d155fe5875c2e
SHA1	09a6889326fed6665ca9139d570573381a76f6ae
SHA256	4feacfd6b8e9e0aa8dc13b67944628b072a5cf379a34a4bfd6378725fd4e5c65
SHA512	ec31aeb6b0dc9403d9ed512eff051bd5eb6b1eaa144af1524a55fa031bbef4a64eb169525ef912ab97a5942487f8a58baeeebd1d1225f0f17a4c4c38e105f9d1

C:\Windows\system\RAbgCfj.exe

MD5	9357ce6ede8b7eb13b05d9787d5d9bbb
SHA1	956c27dadae4c086eb62f997ce7d03a7f4aa4d75
SHA256	542140ce78881222346babc10b532f6e01307479cee00ae473831b286610cefa
SHA512	8e5e7b8dc7c61ab32467d9a8be89dc5ef9e3866416c5801d7f571647426011d06bc8c410da7cbe9889e3b758e027aafe7617f30d09051874f7b1d4a96a446a74

C:\Windows\system\jxrsJbq.exe

MD5	54a93b19df05a17b0ca0d3443fce8bf1
SHA1	08f131d0ad31c745a1dc4f385f4b3d8637843743
SHA256	032619549e7e2a88d9c3a694a188367626b2773de4e58d5e07fc3d21c8566b31
SHA512	394f3182f2ebfe0c3f2777863bf6383a06e89598d1129270a56bd57fb3f602fbad43a212ec05f7475f61b5820f12263f1c13787ad7634b241aa8d4380d5a935a

C:\Windows\system\hYjnhll.exe

MD5	20bb26bcb62d06aee03ba16869dd0686
SHA1	e49bcaafc295d166929a26a1d5bb25aa7b55e4aa
SHA256	a1e32a05118d993b8368e69aa5941bffd1225c3b9570afbbb4850c2f2a4e7173
SHA512	99a36aef62f71b45e58e4161c6297940f662003f5197ffbe10ffa13e5b04e99e788429aeb90f1520ef7227de09f713925683a8d1d9491a16f6ddbce17b795abb

C:\Windows\system\CNUagbs.exe

MD5	8ba0ffef89645ac4813643150781f8c2
SHA1	ff66e2af0c3d9b6eda7f0c2f69e20a1dc366b435
SHA256	6d284706ef5aab0006f8f17e0d58d10a8d4afd57947a5a135197582593e57f36
SHA512	beda6e7693e76cc6681d59beccf29cab68f8b6ad75ff195f4d6cef952ad536e9fccfa3567ba4e7ac6294760ed95b41a6c7bf08b39bcc1aa1adf15a3915c0ba47

C:\Windows\system\JAeyWGb.exe

MD5	87fd113697c978269d4a8629b507712c
SHA1	a42f3f069f9e1790a3e063c156cae289adcbb5db
SHA256	238fb2bb88f2030103b7c6155bda58e0b1908cea3d0d59a60eac9d6da1095fe2
SHA512	675cdd25bc5d63ed3164088a57f2f0be8f236abc437a1692de471819515a221a7f66240939f3777d8192e1dbb879dd57ed1e239970852229c2d138c23adb603c

C:\Windows\system\ZYgChQx.exe

MD5	b1fe350819f53913b0233ea4d5d0352d
SHA1	d0d846b667ca5442603655b49b2a78bfc2d5fd69
SHA256	6a70b94c71ac0d69a189ec6e7f4a2656a959ebafcd62148acaaba1206a01a3c7
SHA512	5fe25a0d6a2353380c6ac8ff5550a532d4b430614afdf359e2323dffbf76c151e8e7d7987952fb3fbfe681ed94e6ec93991414b4a1be8b03b4a050f954ce3fee

C:\Windows\system\zWUxqeZ.exe

MD5	58f2ced25f4fa59af1be01e4efeaa6f8
SHA1	02d4232ad9b406aae4a96ff46cb8df68b0b1633b
SHA256	72c2c9673d540c1747857d2e0eb998db11239e66fc05744a395d653d1f8164ce
SHA512	ce12bbe5eb9e7dd0f0ed406d0ec38c660fd46538cdf2bf8af175c72a3b2edff87f377982c8df9d8c2310cca4bd02a4c3c0e83bc2f79b375be897b7a27b6b0738

C:\Windows\system\dYBJskA.exe

MD5	8d167945cf49c10346158679686e911b
SHA1	ea731523eeaabaa280598e7b1e3c7ba411084c7b
SHA256	1731fba942eba49cf6e95cb1d1d03318870489423e276a2f787ca2654b6e04eb
SHA512	64d434128774da7112e975afff2995a707429d297dc71e63bd2d71dafa474a18acca1c7e6ac38d5b9f70aaf83e8e12011a27b136baa5e8656abf3ec1547a0677

C:\Windows\system\QnDutaO.exe

MD5	cf355ea86154d618bc2118a2c4a0ab59
SHA1	21a27e06019d224db49004e90de13421ebe3fc6a
SHA256	0878c1e1423889b5b703365b4e25ea4b126c8ad8c770f2ad9ec0ebdc707da605
SHA512	3520490ae9201081d2db2277533eac40f140deb5703df3ac579ac35a4aa8e8df22f87fed758871576f4b3cb78664e362ff7792469538b83d21f09e581713afef

C:\Windows\system\mEItMWw.exe

MD5	de283ff7362652caef32bddbbbac2b3e
SHA1	6acf5df21906727c1d4d922f8d82c8b0fbb69505
SHA256	d89140aae06ec94490ea5523e9a42b2d4ef6a791c04981c668fb8c52cf0c4657
SHA512	80a2e02380979e16ed911e4c001edefdb0c05b56fd137634b0fe1074d93c05d04bf117fa17323c209d1c375583922ec88e13bcc26db38afbccc2ad07bfa007c8

C:\Windows\system\ntgixZI.exe

MD5	c00364473fd4613869f1bffb6c405e46
SHA1	3d6e3e6b467a58156d6725e330234acaa6c01bdc
SHA256	a0655d5fc1707014d1bed5cfebee9da269ba88c7454eb5a8c78c19dfbc7bca3f
SHA512	20408e08f4aabf75fe537731c5b4718919e3cbef26edaabfd31d360d110fdb4d00866bcc8dcaa3f16aa403ab3a569a7b5d96df3f795c765b2c99ff51fd4b6013

memory/2904-382-0x000007FEF5810000-0x000007FEF61AD000-memory.dmp

memory/2792-4329-0x000000013F900000-0x000000013FCF2000-memory.dmp

memory/2404-4333-0x000000013F660000-0x000000013FA52000-memory.dmp

memory/2708-4337-0x000000013F500000-0x000000013F8F2000-memory.dmp

memory/2688-4336-0x000000013F060000-0x000000013F452000-memory.dmp

memory/2608-4332-0x000000013FF50000-0x0000000140342000-memory.dmp

memory/2476-4340-0x000000013F550000-0x000000013F942000-memory.dmp

memory/2288-4351-0x000000013F880000-0x000000013FC72000-memory.dmp

memory/2628-4349-0x000000013F7A0000-0x000000013FB92000-memory.dmp

memory/2604-4345-0x000000013FA00000-0x000000013FDF2000-memory.dmp

memory/2764-4347-0x000000013F020000-0x000000013F412000-memory.dmp

memory/2488-4341-0x000000013F380000-0x000000013F772000-memory.dmp

memory/2676-4384-0x000000013FA30000-0x000000013FE22000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 13:15

Reported

2024-06-13 13:17

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\ZzTCIKe.exe	N/A
N/A	N/A	C:\Windows\System\dTMYTPA.exe	N/A
N/A	N/A	C:\Windows\System\IbstkDM.exe	N/A
N/A	N/A	C:\Windows\System\ntgixZI.exe	N/A
N/A	N/A	C:\Windows\System\RrTYKxH.exe	N/A
N/A	N/A	C:\Windows\System\mEItMWw.exe	N/A
N/A	N/A	C:\Windows\System\QnDutaO.exe	N/A
N/A	N/A	C:\Windows\System\dYBJskA.exe	N/A
N/A	N/A	C:\Windows\System\GvlHyam.exe	N/A
N/A	N/A	C:\Windows\System\zWUxqeZ.exe	N/A
N/A	N/A	C:\Windows\System\BUsJzOq.exe	N/A
N/A	N/A	C:\Windows\System\CNUagbs.exe	N/A
N/A	N/A	C:\Windows\System\ZYgChQx.exe	N/A
N/A	N/A	C:\Windows\System\RAbgCfj.exe	N/A
N/A	N/A	C:\Windows\System\BacNnSx.exe	N/A
N/A	N/A	C:\Windows\System\LbhaDQT.exe	N/A
N/A	N/A	C:\Windows\System\sAOKKJL.exe	N/A
N/A	N/A	C:\Windows\System\GeJNGHe.exe	N/A
N/A	N/A	C:\Windows\System\JAeyWGb.exe	N/A
N/A	N/A	C:\Windows\System\uxdLYfa.exe	N/A
N/A	N/A	C:\Windows\System\hYjnhll.exe	N/A
N/A	N/A	C:\Windows\System\jxrsJbq.exe	N/A
N/A	N/A	C:\Windows\System\TYTgykB.exe	N/A
N/A	N/A	C:\Windows\System\gxjrxdM.exe	N/A
N/A	N/A	C:\Windows\System\rOtbnfP.exe	N/A
N/A	N/A	C:\Windows\System\dqtJeKy.exe	N/A
N/A	N/A	C:\Windows\System\nRIGpQo.exe	N/A
N/A	N/A	C:\Windows\System\gOCMQqq.exe	N/A
N/A	N/A	C:\Windows\System\SnAXHUt.exe	N/A
N/A	N/A	C:\Windows\System\xUojPvu.exe	N/A
N/A	N/A	C:\Windows\System\JzvGGjW.exe	N/A
N/A	N/A	C:\Windows\System\MCpLvQc.exe	N/A
N/A	N/A	C:\Windows\System\FHDYYJA.exe	N/A
N/A	N/A	C:\Windows\System\VyjOOZY.exe	N/A
N/A	N/A	C:\Windows\System\zPxPywC.exe	N/A
N/A	N/A	C:\Windows\System\dslOJXF.exe	N/A
N/A	N/A	C:\Windows\System\DQphVEU.exe	N/A
N/A	N/A	C:\Windows\System\ddigMuQ.exe	N/A
N/A	N/A	C:\Windows\System\mHSEuxW.exe	N/A
N/A	N/A	C:\Windows\System\lZrQqHL.exe	N/A
N/A	N/A	C:\Windows\System\jCLAwtK.exe	N/A
N/A	N/A	C:\Windows\System\LMNiLtB.exe	N/A
N/A	N/A	C:\Windows\System\fiSOgeQ.exe	N/A
N/A	N/A	C:\Windows\System\JvsZxGn.exe	N/A
N/A	N/A	C:\Windows\System\bVglLRb.exe	N/A
N/A	N/A	C:\Windows\System\GKqEewV.exe	N/A
N/A	N/A	C:\Windows\System\owSuKil.exe	N/A
N/A	N/A	C:\Windows\System\CJwYpkj.exe	N/A
N/A	N/A	C:\Windows\System\ZWbNJqK.exe	N/A
N/A	N/A	C:\Windows\System\BLkbfDv.exe	N/A
N/A	N/A	C:\Windows\System\LtxFdni.exe	N/A
N/A	N/A	C:\Windows\System\FsDGctO.exe	N/A
N/A	N/A	C:\Windows\System\EAihNtI.exe	N/A
N/A	N/A	C:\Windows\System\MosYIJF.exe	N/A
N/A	N/A	C:\Windows\System\WXuKLbj.exe	N/A
N/A	N/A	C:\Windows\System\SoXqakC.exe	N/A
N/A	N/A	C:\Windows\System\lkSAskZ.exe	N/A
N/A	N/A	C:\Windows\System\LSxsQdU.exe	N/A
N/A	N/A	C:\Windows\System\jYUvaUS.exe	N/A
N/A	N/A	C:\Windows\System\KTVYPSH.exe	N/A
N/A	N/A	C:\Windows\System\YximktC.exe	N/A
N/A	N/A	C:\Windows\System\mnKBdqn.exe	N/A
N/A	N/A	C:\Windows\System\aqhqMKj.exe	N/A
N/A	N/A	C:\Windows\System\EoSoaty.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\YeAsjTh.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KrPjLdw.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cyQQHww.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BQFfksE.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iexVFhH.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YTLnQic.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WtrCBpH.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lwnMwJt.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pIKErJs.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vdUUAdv.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KCLUHrQ.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xBlihuH.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PvVbvTi.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GtSOqWX.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wNnOtDm.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UHyTTFz.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PLRgIIs.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lNPrvBl.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nuHifIw.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nXyXVNv.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vJBwLNr.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nINqzSq.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tPEeYDq.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zxAjYvX.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jlLPEYr.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KULJUXH.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NNcjnou.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AJncKzz.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QBHgofL.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kZVfBQE.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XdxpsKX.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MlicbJL.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QYeAxhL.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yurLhnJ.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SOnFupq.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MiAxDjW.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kDSlZjC.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uPhZeBu.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HLxKdaK.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tQzSKdH.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wmgLaqv.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WiPknzH.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IJXTMXv.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xwsruFy.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VoOYJgK.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ndhUoRF.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\irCvGXC.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DyGEvoM.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NDXkhTu.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dsgprvQ.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VHNejhs.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qeXExKz.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VsexqaJ.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bqZOpna.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\feJjGCc.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eebAwOl.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DXKNfVc.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dyUAzzN.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KQcNQrK.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ovWUxVS.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jJtmifM.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\buvQCbq.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hrcKVOj.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YJuOuBu.exe	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeCreateGlobalPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A
Token: SeChangeNotifyPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A
Token: 33	N/A	C:\Windows\system32\dwm.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3196 wrote to memory of 3936	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3196 wrote to memory of 3936	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3196 wrote to memory of 2584	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\ZzTCIKe.exe
PID 3196 wrote to memory of 2584	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\ZzTCIKe.exe
PID 3196 wrote to memory of 4384	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\dTMYTPA.exe
PID 3196 wrote to memory of 4384	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\dTMYTPA.exe
PID 3196 wrote to memory of 3552	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\IbstkDM.exe
PID 3196 wrote to memory of 3552	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\IbstkDM.exe
PID 3196 wrote to memory of 3852	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\ntgixZI.exe
PID 3196 wrote to memory of 3852	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\ntgixZI.exe
PID 3196 wrote to memory of 1132	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\RrTYKxH.exe
PID 3196 wrote to memory of 1132	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\RrTYKxH.exe
PID 3196 wrote to memory of 2808	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\mEItMWw.exe
PID 3196 wrote to memory of 2808	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\mEItMWw.exe
PID 3196 wrote to memory of 4152	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\QnDutaO.exe
PID 3196 wrote to memory of 4152	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\QnDutaO.exe
PID 3196 wrote to memory of 376	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\dYBJskA.exe
PID 3196 wrote to memory of 376	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\dYBJskA.exe
PID 3196 wrote to memory of 3984	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\GvlHyam.exe
PID 3196 wrote to memory of 3984	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\GvlHyam.exe
PID 3196 wrote to memory of 3224	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\zWUxqeZ.exe
PID 3196 wrote to memory of 3224	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\zWUxqeZ.exe
PID 3196 wrote to memory of 3728	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\BUsJzOq.exe
PID 3196 wrote to memory of 3728	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\BUsJzOq.exe
PID 3196 wrote to memory of 1084	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\CNUagbs.exe
PID 3196 wrote to memory of 1084	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\CNUagbs.exe
PID 3196 wrote to memory of 1792	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\ZYgChQx.exe
PID 3196 wrote to memory of 1792	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\ZYgChQx.exe
PID 3196 wrote to memory of 1572	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\RAbgCfj.exe
PID 3196 wrote to memory of 1572	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\RAbgCfj.exe
PID 3196 wrote to memory of 1580	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\BacNnSx.exe
PID 3196 wrote to memory of 1580	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\BacNnSx.exe
PID 3196 wrote to memory of 3404	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\LbhaDQT.exe
PID 3196 wrote to memory of 3404	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\LbhaDQT.exe
PID 3196 wrote to memory of 3144	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\sAOKKJL.exe
PID 3196 wrote to memory of 3144	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\sAOKKJL.exe
PID 3196 wrote to memory of 2396	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\GeJNGHe.exe
PID 3196 wrote to memory of 2396	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\GeJNGHe.exe
PID 3196 wrote to memory of 3148	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\JAeyWGb.exe
PID 3196 wrote to memory of 3148	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\JAeyWGb.exe
PID 3196 wrote to memory of 704	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\uxdLYfa.exe
PID 3196 wrote to memory of 704	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\uxdLYfa.exe
PID 3196 wrote to memory of 3024	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\hYjnhll.exe
PID 3196 wrote to memory of 3024	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\hYjnhll.exe
PID 3196 wrote to memory of 3388	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\SnAXHUt.exe
PID 3196 wrote to memory of 3388	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\SnAXHUt.exe
PID 3196 wrote to memory of 4484	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\jxrsJbq.exe
PID 3196 wrote to memory of 4484	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\jxrsJbq.exe
PID 3196 wrote to memory of 3460	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\xUojPvu.exe
PID 3196 wrote to memory of 3460	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\xUojPvu.exe
PID 3196 wrote to memory of 2676	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\TYTgykB.exe
PID 3196 wrote to memory of 2676	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\TYTgykB.exe
PID 3196 wrote to memory of 1768	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\gxjrxdM.exe
PID 3196 wrote to memory of 1768	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\gxjrxdM.exe
PID 3196 wrote to memory of 3504	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\FHDYYJA.exe
PID 3196 wrote to memory of 3504	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\FHDYYJA.exe
PID 3196 wrote to memory of 4424	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\rOtbnfP.exe
PID 3196 wrote to memory of 4424	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\rOtbnfP.exe
PID 3196 wrote to memory of 1096	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\dqtJeKy.exe
PID 3196 wrote to memory of 1096	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\dqtJeKy.exe
PID 3196 wrote to memory of 928	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\lZrQqHL.exe
PID 3196 wrote to memory of 928	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\lZrQqHL.exe
PID 3196 wrote to memory of 1116	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\LMNiLtB.exe
PID 3196 wrote to memory of 1116	N/A	C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe	C:\Windows\System\LMNiLtB.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\ZzTCIKe.exe

C:\Windows\System\ZzTCIKe.exe

C:\Windows\System\dTMYTPA.exe

C:\Windows\System\dTMYTPA.exe

C:\Windows\System\IbstkDM.exe

C:\Windows\System\IbstkDM.exe

C:\Windows\System\ntgixZI.exe

C:\Windows\System\ntgixZI.exe

C:\Windows\System\RrTYKxH.exe

C:\Windows\System\RrTYKxH.exe

C:\Windows\System\mEItMWw.exe

C:\Windows\System\mEItMWw.exe

C:\Windows\System\QnDutaO.exe

C:\Windows\System\QnDutaO.exe

C:\Windows\System\dYBJskA.exe

C:\Windows\System\dYBJskA.exe

C:\Windows\System\GvlHyam.exe

C:\Windows\System\GvlHyam.exe

C:\Windows\System\zWUxqeZ.exe

C:\Windows\System\zWUxqeZ.exe

C:\Windows\System\BUsJzOq.exe

C:\Windows\System\BUsJzOq.exe

C:\Windows\System\CNUagbs.exe

C:\Windows\System\CNUagbs.exe

C:\Windows\System\ZYgChQx.exe

C:\Windows\System\ZYgChQx.exe

C:\Windows\System\RAbgCfj.exe

C:\Windows\System\RAbgCfj.exe

C:\Windows\System\BacNnSx.exe

C:\Windows\System\BacNnSx.exe

C:\Windows\System\LbhaDQT.exe

C:\Windows\System\LbhaDQT.exe

C:\Windows\System\sAOKKJL.exe

C:\Windows\System\sAOKKJL.exe

C:\Windows\System\GeJNGHe.exe

C:\Windows\System\GeJNGHe.exe

C:\Windows\System\JAeyWGb.exe

C:\Windows\System\JAeyWGb.exe

C:\Windows\System\uxdLYfa.exe

C:\Windows\System\uxdLYfa.exe

C:\Windows\System\hYjnhll.exe

C:\Windows\System\hYjnhll.exe

C:\Windows\System\SnAXHUt.exe

C:\Windows\System\SnAXHUt.exe

C:\Windows\System\jxrsJbq.exe

C:\Windows\System\jxrsJbq.exe

C:\Windows\System\xUojPvu.exe

C:\Windows\System\xUojPvu.exe

C:\Windows\System\TYTgykB.exe

C:\Windows\System\TYTgykB.exe

C:\Windows\System\gxjrxdM.exe

C:\Windows\System\gxjrxdM.exe

C:\Windows\System\FHDYYJA.exe

C:\Windows\System\FHDYYJA.exe

C:\Windows\System\rOtbnfP.exe

C:\Windows\System\rOtbnfP.exe

C:\Windows\System\dqtJeKy.exe

C:\Windows\System\dqtJeKy.exe

C:\Windows\System\lZrQqHL.exe

C:\Windows\System\lZrQqHL.exe

C:\Windows\System\LMNiLtB.exe

C:\Windows\System\LMNiLtB.exe

C:\Windows\System\nRIGpQo.exe

C:\Windows\System\nRIGpQo.exe

C:\Windows\System\gOCMQqq.exe

C:\Windows\System\gOCMQqq.exe

C:\Windows\System\JzvGGjW.exe

C:\Windows\System\JzvGGjW.exe

C:\Windows\System\MCpLvQc.exe

C:\Windows\System\MCpLvQc.exe

C:\Windows\System\VyjOOZY.exe

C:\Windows\System\VyjOOZY.exe

C:\Windows\System\zPxPywC.exe

C:\Windows\System\zPxPywC.exe

C:\Windows\System\dslOJXF.exe

C:\Windows\System\dslOJXF.exe

C:\Windows\System\DQphVEU.exe

C:\Windows\System\DQphVEU.exe

C:\Windows\System\ddigMuQ.exe

C:\Windows\System\ddigMuQ.exe

C:\Windows\System\mHSEuxW.exe

C:\Windows\System\mHSEuxW.exe

C:\Windows\System\jCLAwtK.exe

C:\Windows\System\jCLAwtK.exe

C:\Windows\System\YximktC.exe

C:\Windows\System\YximktC.exe

C:\Windows\System\fiSOgeQ.exe

C:\Windows\System\fiSOgeQ.exe

C:\Windows\System\JvsZxGn.exe

C:\Windows\System\JvsZxGn.exe

C:\Windows\System\bVglLRb.exe

C:\Windows\System\bVglLRb.exe

C:\Windows\System\GKqEewV.exe

C:\Windows\System\GKqEewV.exe

C:\Windows\System\owSuKil.exe

C:\Windows\System\owSuKil.exe

C:\Windows\System\CJwYpkj.exe

C:\Windows\System\CJwYpkj.exe

C:\Windows\System\ZWbNJqK.exe

C:\Windows\System\ZWbNJqK.exe

C:\Windows\System\BLkbfDv.exe

C:\Windows\System\BLkbfDv.exe

C:\Windows\System\LtxFdni.exe

C:\Windows\System\LtxFdni.exe

C:\Windows\System\FsDGctO.exe

C:\Windows\System\FsDGctO.exe

C:\Windows\System\LtZkosB.exe

C:\Windows\System\LtZkosB.exe

C:\Windows\System\EAihNtI.exe

C:\Windows\System\EAihNtI.exe

C:\Windows\System\MosYIJF.exe

C:\Windows\System\MosYIJF.exe

C:\Windows\System\WXuKLbj.exe

C:\Windows\System\WXuKLbj.exe

C:\Windows\System\SoXqakC.exe

C:\Windows\System\SoXqakC.exe

C:\Windows\System\lkSAskZ.exe

C:\Windows\System\lkSAskZ.exe

C:\Windows\System\LSxsQdU.exe

C:\Windows\System\LSxsQdU.exe

C:\Windows\System\jYUvaUS.exe

C:\Windows\System\jYUvaUS.exe

C:\Windows\System\KTVYPSH.exe

C:\Windows\System\KTVYPSH.exe

C:\Windows\System\mnKBdqn.exe

C:\Windows\System\mnKBdqn.exe

C:\Windows\System\aqhqMKj.exe

C:\Windows\System\aqhqMKj.exe

C:\Windows\System\EoSoaty.exe

C:\Windows\System\EoSoaty.exe

C:\Windows\System\QXxFaKm.exe

C:\Windows\System\QXxFaKm.exe

C:\Windows\System\Hwhexkz.exe

C:\Windows\System\Hwhexkz.exe

C:\Windows\System\ccnIiMT.exe

C:\Windows\System\ccnIiMT.exe

C:\Windows\System\jEEAeCK.exe

C:\Windows\System\jEEAeCK.exe

C:\Windows\System\ddylxoC.exe

C:\Windows\System\ddylxoC.exe

C:\Windows\System\mLLgofI.exe

C:\Windows\System\mLLgofI.exe

C:\Windows\System\DDvnEit.exe

C:\Windows\System\DDvnEit.exe

C:\Windows\System\CaADRga.exe

C:\Windows\System\CaADRga.exe

C:\Windows\System\DlVuVci.exe

C:\Windows\System\DlVuVci.exe

C:\Windows\System\ltZMeCA.exe

C:\Windows\System\ltZMeCA.exe

C:\Windows\System\bQjzOWu.exe

C:\Windows\System\bQjzOWu.exe

C:\Windows\System\rVzrGwW.exe

C:\Windows\System\rVzrGwW.exe

C:\Windows\System\bpsJAbv.exe

C:\Windows\System\bpsJAbv.exe

C:\Windows\System\NOPqyra.exe

C:\Windows\System\NOPqyra.exe

C:\Windows\System\JcQxoEV.exe

C:\Windows\System\JcQxoEV.exe

C:\Windows\System\xYafows.exe

C:\Windows\System\xYafows.exe

C:\Windows\System\RqPZIXb.exe

C:\Windows\System\RqPZIXb.exe

C:\Windows\System\umihTFb.exe

C:\Windows\System\umihTFb.exe

C:\Windows\System\HRwGDHr.exe

C:\Windows\System\HRwGDHr.exe

C:\Windows\System\ekHhpdp.exe

C:\Windows\System\ekHhpdp.exe

C:\Windows\System\GfEFpeu.exe

C:\Windows\System\GfEFpeu.exe

C:\Windows\System\LeiFtkm.exe

C:\Windows\System\LeiFtkm.exe

C:\Windows\System\frjAKee.exe

C:\Windows\System\frjAKee.exe

C:\Windows\System\NAtFWzH.exe

C:\Windows\System\NAtFWzH.exe

C:\Windows\System\OxuVLBd.exe

C:\Windows\System\OxuVLBd.exe

C:\Windows\System\WVqoTHt.exe

C:\Windows\System\WVqoTHt.exe

C:\Windows\System\aNXgKzi.exe

C:\Windows\System\aNXgKzi.exe

C:\Windows\System\rSgpyWh.exe

C:\Windows\System\rSgpyWh.exe

C:\Windows\System\GfPlxLM.exe

C:\Windows\System\GfPlxLM.exe

C:\Windows\System\twpmaih.exe

C:\Windows\System\twpmaih.exe

C:\Windows\System\btTenzw.exe

C:\Windows\System\btTenzw.exe

C:\Windows\System\ZMyqjvR.exe

C:\Windows\System\ZMyqjvR.exe

C:\Windows\System\meLHMJY.exe

C:\Windows\System\meLHMJY.exe

C:\Windows\System\hEFofDj.exe

C:\Windows\System\hEFofDj.exe

C:\Windows\System\zlLgJui.exe

C:\Windows\System\zlLgJui.exe

C:\Windows\System\pwqyGiC.exe

C:\Windows\System\pwqyGiC.exe

C:\Windows\System\VZopELp.exe

C:\Windows\System\VZopELp.exe

C:\Windows\System\ljdQtIH.exe

C:\Windows\System\ljdQtIH.exe

C:\Windows\System\eePnHXp.exe

C:\Windows\System\eePnHXp.exe

C:\Windows\System\wtxphKi.exe

C:\Windows\System\wtxphKi.exe

C:\Windows\System\IZsMYkx.exe

C:\Windows\System\IZsMYkx.exe

C:\Windows\System\YyrwVqm.exe

C:\Windows\System\YyrwVqm.exe

C:\Windows\System\bIQhzhj.exe

C:\Windows\System\bIQhzhj.exe

C:\Windows\System\ZdiDFBr.exe

C:\Windows\System\ZdiDFBr.exe

C:\Windows\System\JmWPdcg.exe

C:\Windows\System\JmWPdcg.exe

C:\Windows\System\vzrtbDQ.exe

C:\Windows\System\vzrtbDQ.exe

C:\Windows\System\mNvHwLk.exe

C:\Windows\System\mNvHwLk.exe

C:\Windows\System\UOetUgG.exe

C:\Windows\System\UOetUgG.exe

C:\Windows\System\icLqeJu.exe

C:\Windows\System\icLqeJu.exe

C:\Windows\System\MXamDsn.exe

C:\Windows\System\MXamDsn.exe

C:\Windows\System\NWhXixG.exe

C:\Windows\System\NWhXixG.exe

C:\Windows\System\KUTrexw.exe

C:\Windows\System\KUTrexw.exe

C:\Windows\System\QyOSrQV.exe

C:\Windows\System\QyOSrQV.exe

C:\Windows\System\QXQcZvQ.exe

C:\Windows\System\QXQcZvQ.exe

C:\Windows\System\phFnNKR.exe

C:\Windows\System\phFnNKR.exe

C:\Windows\System\UdoIjlR.exe

C:\Windows\System\UdoIjlR.exe

C:\Windows\System\gQCqFgp.exe

C:\Windows\System\gQCqFgp.exe

C:\Windows\System\nupCQrp.exe

C:\Windows\System\nupCQrp.exe

C:\Windows\System\GISXwNg.exe

C:\Windows\System\GISXwNg.exe

C:\Windows\System\rqOMdDV.exe

C:\Windows\System\rqOMdDV.exe

C:\Windows\System\ORBGmbg.exe

C:\Windows\System\ORBGmbg.exe

C:\Windows\System\lPdRqdS.exe

C:\Windows\System\lPdRqdS.exe

C:\Windows\System\SWQsPPB.exe

C:\Windows\System\SWQsPPB.exe

C:\Windows\System\OSTdvfH.exe

C:\Windows\System\OSTdvfH.exe

C:\Windows\System\ToIzErH.exe

C:\Windows\System\ToIzErH.exe

C:\Windows\System\KkQEPyZ.exe

C:\Windows\System\KkQEPyZ.exe

C:\Windows\System\nRIlfDT.exe

C:\Windows\System\nRIlfDT.exe

C:\Windows\System\hlihfUU.exe

C:\Windows\System\hlihfUU.exe

C:\Windows\System\mffjiOw.exe

C:\Windows\System\mffjiOw.exe

C:\Windows\System\LNikzPU.exe

C:\Windows\System\LNikzPU.exe

C:\Windows\System\pizniGa.exe

C:\Windows\System\pizniGa.exe

C:\Windows\System\sPjiYdb.exe

C:\Windows\System\sPjiYdb.exe

C:\Windows\System\ggAdNou.exe

C:\Windows\System\ggAdNou.exe

C:\Windows\System\uGfUQBF.exe

C:\Windows\System\uGfUQBF.exe

C:\Windows\System\WVAgVtu.exe

C:\Windows\System\WVAgVtu.exe

C:\Windows\System\Bdfltpm.exe

C:\Windows\System\Bdfltpm.exe

C:\Windows\System\MZxUWSY.exe

C:\Windows\System\MZxUWSY.exe

C:\Windows\System\wIRnZUb.exe

C:\Windows\System\wIRnZUb.exe

C:\Windows\System\elVsmam.exe

C:\Windows\System\elVsmam.exe

C:\Windows\System\klyfxyV.exe

C:\Windows\System\klyfxyV.exe

C:\Windows\System\EDNKYsa.exe

C:\Windows\System\EDNKYsa.exe

C:\Windows\System\zFLsPtW.exe

C:\Windows\System\zFLsPtW.exe

C:\Windows\System\NDBHOoW.exe

C:\Windows\System\NDBHOoW.exe

C:\Windows\System\bMQsgGB.exe

C:\Windows\System\bMQsgGB.exe

C:\Windows\System\RJzyOYJ.exe

C:\Windows\System\RJzyOYJ.exe

C:\Windows\System\mUIxZZz.exe

C:\Windows\System\mUIxZZz.exe

C:\Windows\System\dOezKqF.exe

C:\Windows\System\dOezKqF.exe

C:\Windows\System\CFmvaZt.exe

C:\Windows\System\CFmvaZt.exe

C:\Windows\System\oBZcXit.exe

C:\Windows\System\oBZcXit.exe

C:\Windows\System\IzJngLi.exe

C:\Windows\System\IzJngLi.exe

C:\Windows\System\nWjkNTv.exe

C:\Windows\System\nWjkNTv.exe

C:\Windows\System\ZShiTAo.exe

C:\Windows\System\ZShiTAo.exe

C:\Windows\System\ZffbgcT.exe

C:\Windows\System\ZffbgcT.exe

C:\Windows\System\iVJuhDn.exe

C:\Windows\System\iVJuhDn.exe

C:\Windows\System\cFrEPVn.exe

C:\Windows\System\cFrEPVn.exe

C:\Windows\System\zXyqqnJ.exe

C:\Windows\System\zXyqqnJ.exe

C:\Windows\System\jQomVdA.exe

C:\Windows\System\jQomVdA.exe

C:\Windows\System\TDDmBkh.exe

C:\Windows\System\TDDmBkh.exe

C:\Windows\System\rfmwYSk.exe

C:\Windows\System\rfmwYSk.exe

C:\Windows\System\jIAhVpy.exe

C:\Windows\System\jIAhVpy.exe

C:\Windows\System\TorvwHC.exe

C:\Windows\System\TorvwHC.exe

C:\Windows\System\EUsSoEj.exe

C:\Windows\System\EUsSoEj.exe

C:\Windows\System\OfVecSy.exe

C:\Windows\System\OfVecSy.exe

C:\Windows\System\ttDygXQ.exe

C:\Windows\System\ttDygXQ.exe

C:\Windows\System\dELthdG.exe

C:\Windows\System\dELthdG.exe

C:\Windows\System\BjWKHqt.exe

C:\Windows\System\BjWKHqt.exe

C:\Windows\System\tnlXpPb.exe

C:\Windows\System\tnlXpPb.exe

C:\Windows\System\pHQVbNu.exe

C:\Windows\System\pHQVbNu.exe

C:\Windows\System\FsWkPAB.exe

C:\Windows\System\FsWkPAB.exe

C:\Windows\System\reapUac.exe

C:\Windows\System\reapUac.exe

C:\Windows\System\TqkkfGj.exe

C:\Windows\System\TqkkfGj.exe

C:\Windows\System\IloUnZW.exe

C:\Windows\System\IloUnZW.exe

C:\Windows\System\vKxjqZu.exe

C:\Windows\System\vKxjqZu.exe

C:\Windows\System\oDWVase.exe

C:\Windows\System\oDWVase.exe

C:\Windows\System\wFYAjbj.exe

C:\Windows\System\wFYAjbj.exe

C:\Windows\System\ngJVKoF.exe

C:\Windows\System\ngJVKoF.exe

C:\Windows\System\YYzmKYW.exe

C:\Windows\System\YYzmKYW.exe

C:\Windows\System\ywmNmEO.exe

C:\Windows\System\ywmNmEO.exe

C:\Windows\System\VhzpZRU.exe

C:\Windows\System\VhzpZRU.exe

C:\Windows\System\bFNcPTg.exe

C:\Windows\System\bFNcPTg.exe

C:\Windows\System\KkGDKSS.exe

C:\Windows\System\KkGDKSS.exe

C:\Windows\System\VTdgSfj.exe

C:\Windows\System\VTdgSfj.exe

C:\Windows\System\eIChvoW.exe

C:\Windows\System\eIChvoW.exe

C:\Windows\System\IsZZBUH.exe

C:\Windows\System\IsZZBUH.exe

C:\Windows\System\sXwWNDD.exe

C:\Windows\System\sXwWNDD.exe

C:\Windows\System\DWCUDcL.exe

C:\Windows\System\DWCUDcL.exe

C:\Windows\System\rypEcpZ.exe

C:\Windows\System\rypEcpZ.exe

C:\Windows\System\hawZNRS.exe

C:\Windows\System\hawZNRS.exe

C:\Windows\System\CAwOnSr.exe

C:\Windows\System\CAwOnSr.exe

C:\Windows\System\OwgnkBz.exe

C:\Windows\System\OwgnkBz.exe

C:\Windows\System\kvNwcZI.exe

C:\Windows\System\kvNwcZI.exe

C:\Windows\System\bulrHMJ.exe

C:\Windows\System\bulrHMJ.exe

C:\Windows\System\ZrkQQvP.exe

C:\Windows\System\ZrkQQvP.exe

C:\Windows\System\JEdzDfl.exe

C:\Windows\System\JEdzDfl.exe

C:\Windows\System\ckTaWfx.exe

C:\Windows\System\ckTaWfx.exe

C:\Windows\System\UpAgklp.exe

C:\Windows\System\UpAgklp.exe

C:\Windows\System\prnowqR.exe

C:\Windows\System\prnowqR.exe

C:\Windows\System\SizIrNh.exe

C:\Windows\System\SizIrNh.exe

C:\Windows\System\jPVnnza.exe

C:\Windows\System\jPVnnza.exe

C:\Windows\System\IERvCUQ.exe

C:\Windows\System\IERvCUQ.exe

C:\Windows\System\HqhKARj.exe

C:\Windows\System\HqhKARj.exe

C:\Windows\System\RUqiAxG.exe

C:\Windows\System\RUqiAxG.exe

C:\Windows\System\UqfPLGX.exe

C:\Windows\System\UqfPLGX.exe

C:\Windows\System\JYwFPAs.exe

C:\Windows\System\JYwFPAs.exe

C:\Windows\System\PXJsirl.exe

C:\Windows\System\PXJsirl.exe

C:\Windows\System\dHqbMbN.exe

C:\Windows\System\dHqbMbN.exe

C:\Windows\System\aHJApkB.exe

C:\Windows\System\aHJApkB.exe

C:\Windows\System\AnmkyOA.exe

C:\Windows\System\AnmkyOA.exe

C:\Windows\System\qUdRjpA.exe

C:\Windows\System\qUdRjpA.exe

C:\Windows\System\zsmYKGV.exe

C:\Windows\System\zsmYKGV.exe

C:\Windows\System\YwrKhYE.exe

C:\Windows\System\YwrKhYE.exe

C:\Windows\System\UDbhCCB.exe

C:\Windows\System\UDbhCCB.exe

C:\Windows\System\SEWPxps.exe

C:\Windows\System\SEWPxps.exe

C:\Windows\System\xYOYHMW.exe

C:\Windows\System\xYOYHMW.exe

C:\Windows\System\TBHHZKF.exe

C:\Windows\System\TBHHZKF.exe

C:\Windows\System\veeUzUB.exe

C:\Windows\System\veeUzUB.exe

C:\Windows\System\XFqxjEy.exe

C:\Windows\System\XFqxjEy.exe

C:\Windows\System\sloXQYu.exe

C:\Windows\System\sloXQYu.exe

C:\Windows\System\wBtBVcp.exe

C:\Windows\System\wBtBVcp.exe

C:\Windows\System\kLMFCLu.exe

C:\Windows\System\kLMFCLu.exe

C:\Windows\System\xumVvyk.exe

C:\Windows\System\xumVvyk.exe

C:\Windows\System\cRBxNma.exe

C:\Windows\System\cRBxNma.exe

C:\Windows\System\RqxvjCg.exe

C:\Windows\System\RqxvjCg.exe

C:\Windows\System\BtoNRVp.exe

C:\Windows\System\BtoNRVp.exe

C:\Windows\System\MElfbSs.exe

C:\Windows\System\MElfbSs.exe

C:\Windows\System\paqWIMQ.exe

C:\Windows\System\paqWIMQ.exe

C:\Windows\System\ybcLTiZ.exe

C:\Windows\System\ybcLTiZ.exe

C:\Windows\System\ROklDEP.exe

C:\Windows\System\ROklDEP.exe

C:\Windows\System\amvyVHL.exe

C:\Windows\System\amvyVHL.exe

C:\Windows\System\ibCsITW.exe

C:\Windows\System\ibCsITW.exe

C:\Windows\System\tAdTDVg.exe

C:\Windows\System\tAdTDVg.exe

C:\Windows\System\dhwIPTc.exe

C:\Windows\System\dhwIPTc.exe

C:\Windows\System\eUhvhzs.exe

C:\Windows\System\eUhvhzs.exe

C:\Windows\System\lPVvZtZ.exe

C:\Windows\System\lPVvZtZ.exe

C:\Windows\System\tevOZTd.exe

C:\Windows\System\tevOZTd.exe

C:\Windows\System\SBkJncT.exe

C:\Windows\System\SBkJncT.exe

C:\Windows\System\sArBnmA.exe

C:\Windows\System\sArBnmA.exe

C:\Windows\System\fXnhqoo.exe

C:\Windows\System\fXnhqoo.exe

C:\Windows\System\SVqLYZN.exe

C:\Windows\System\SVqLYZN.exe

C:\Windows\System\MfAXUAx.exe

C:\Windows\System\MfAXUAx.exe

C:\Windows\System\mkygWvA.exe

C:\Windows\System\mkygWvA.exe

C:\Windows\System\WDfdyVU.exe

C:\Windows\System\WDfdyVU.exe

C:\Windows\System\BRaUuhy.exe

C:\Windows\System\BRaUuhy.exe

C:\Windows\System\RztTrcU.exe

C:\Windows\System\RztTrcU.exe

C:\Windows\System\ELQkRSv.exe

C:\Windows\System\ELQkRSv.exe

C:\Windows\System\KkPzqiB.exe

C:\Windows\System\KkPzqiB.exe

C:\Windows\System\RRtNrHo.exe

C:\Windows\System\RRtNrHo.exe

C:\Windows\System\cpFPQas.exe

C:\Windows\System\cpFPQas.exe

C:\Windows\System\RErocTv.exe

C:\Windows\System\RErocTv.exe

C:\Windows\System\CKflgWA.exe

C:\Windows\System\CKflgWA.exe

C:\Windows\System\AZzkrlJ.exe

C:\Windows\System\AZzkrlJ.exe

C:\Windows\System\XDIPybx.exe

C:\Windows\System\XDIPybx.exe

C:\Windows\System\qXAxtWy.exe

C:\Windows\System\qXAxtWy.exe

C:\Windows\System\tglWzHM.exe

C:\Windows\System\tglWzHM.exe

C:\Windows\System\PLFWRqD.exe

C:\Windows\System\PLFWRqD.exe

C:\Windows\System\xiZhcxF.exe

C:\Windows\System\xiZhcxF.exe

C:\Windows\System\PUnnpsI.exe

C:\Windows\System\PUnnpsI.exe

C:\Windows\System\BFLdbHa.exe

C:\Windows\System\BFLdbHa.exe

C:\Windows\System\eOJjcGU.exe

C:\Windows\System\eOJjcGU.exe

C:\Windows\System\ChlcDCl.exe

C:\Windows\System\ChlcDCl.exe

C:\Windows\System\KxcjNxw.exe

C:\Windows\System\KxcjNxw.exe

C:\Windows\System\zCvhJXo.exe

C:\Windows\System\zCvhJXo.exe

C:\Windows\System\WrdkeJg.exe

C:\Windows\System\WrdkeJg.exe

C:\Windows\System\agfmFxG.exe

C:\Windows\System\agfmFxG.exe

C:\Windows\System\YdwyicG.exe

C:\Windows\System\YdwyicG.exe

C:\Windows\System\AtqUfVh.exe

C:\Windows\System\AtqUfVh.exe

C:\Windows\System\iCqQlEy.exe

C:\Windows\System\iCqQlEy.exe

C:\Windows\System\hNeCoxw.exe

C:\Windows\System\hNeCoxw.exe

C:\Windows\System\qKavbvj.exe

C:\Windows\System\qKavbvj.exe

C:\Windows\System\HNZoQru.exe

C:\Windows\System\HNZoQru.exe

C:\Windows\System\YEdSFLO.exe

C:\Windows\System\YEdSFLO.exe

C:\Windows\System\VGeMpyO.exe

C:\Windows\System\VGeMpyO.exe

C:\Windows\System\QxWPZCB.exe

C:\Windows\System\QxWPZCB.exe

C:\Windows\System\etSFjzQ.exe

C:\Windows\System\etSFjzQ.exe

C:\Windows\System\SihpZbR.exe

C:\Windows\System\SihpZbR.exe

C:\Windows\System\VIeNDoC.exe

C:\Windows\System\VIeNDoC.exe

C:\Windows\System\QAAmxRe.exe

C:\Windows\System\QAAmxRe.exe

C:\Windows\System\DpcZsbR.exe

C:\Windows\System\DpcZsbR.exe

C:\Windows\System\tpRpoJs.exe

C:\Windows\System\tpRpoJs.exe

C:\Windows\System\uFNiNxK.exe

C:\Windows\System\uFNiNxK.exe

C:\Windows\System\yEvlbHn.exe

C:\Windows\System\yEvlbHn.exe

C:\Windows\System\pxmoYMS.exe

C:\Windows\System\pxmoYMS.exe

C:\Windows\System\loroxJq.exe

C:\Windows\System\loroxJq.exe

C:\Windows\System\rGSrWKc.exe

C:\Windows\System\rGSrWKc.exe

C:\Windows\System\iTSYwtL.exe

C:\Windows\System\iTSYwtL.exe

C:\Windows\System\aaxZPzv.exe

C:\Windows\System\aaxZPzv.exe

C:\Windows\System\NzOcyCl.exe

C:\Windows\System\NzOcyCl.exe

C:\Windows\System\LtFyQUO.exe

C:\Windows\System\LtFyQUO.exe

C:\Windows\System\OiCxHtL.exe

C:\Windows\System\OiCxHtL.exe

C:\Windows\System\JWntfkb.exe

C:\Windows\System\JWntfkb.exe

C:\Windows\System\zfIvsYj.exe

C:\Windows\System\zfIvsYj.exe

C:\Windows\System\aYkjvUv.exe

C:\Windows\System\aYkjvUv.exe

C:\Windows\System\PwZYjTL.exe

C:\Windows\System\PwZYjTL.exe

C:\Windows\System\rvbUSpb.exe

C:\Windows\System\rvbUSpb.exe

C:\Windows\System\HbtmmDu.exe

C:\Windows\System\HbtmmDu.exe

C:\Windows\System\GyZvxrK.exe

C:\Windows\System\GyZvxrK.exe

C:\Windows\System\aGERMZU.exe

C:\Windows\System\aGERMZU.exe

C:\Windows\System\Fxbcrvr.exe

C:\Windows\System\Fxbcrvr.exe

C:\Windows\System\vmWYMpm.exe

C:\Windows\System\vmWYMpm.exe

C:\Windows\System\uGvmHsu.exe

C:\Windows\System\uGvmHsu.exe

C:\Windows\System\FhzYSCS.exe

C:\Windows\System\FhzYSCS.exe

C:\Windows\System\bnJSlTF.exe

C:\Windows\System\bnJSlTF.exe

C:\Windows\System\mYXROvI.exe

C:\Windows\System\mYXROvI.exe

C:\Windows\System\qOoxAFd.exe

C:\Windows\System\qOoxAFd.exe

C:\Windows\System\mqZWBiX.exe

C:\Windows\System\mqZWBiX.exe

C:\Windows\System\wXTsfJM.exe

C:\Windows\System\wXTsfJM.exe

C:\Windows\System\eFXwOUv.exe

C:\Windows\System\eFXwOUv.exe

C:\Windows\System\lSsgQJB.exe

C:\Windows\System\lSsgQJB.exe

C:\Windows\System\WOWuizO.exe

C:\Windows\System\WOWuizO.exe

C:\Windows\System\ApVSAWt.exe

C:\Windows\System\ApVSAWt.exe

C:\Windows\System\KMDrimM.exe

C:\Windows\System\KMDrimM.exe

C:\Windows\System\wmWtZeo.exe

C:\Windows\System\wmWtZeo.exe

C:\Windows\System\PKMibSV.exe

C:\Windows\System\PKMibSV.exe

C:\Windows\System\cbGcCIL.exe

C:\Windows\System\cbGcCIL.exe

C:\Windows\System\hUehArw.exe

C:\Windows\System\hUehArw.exe

C:\Windows\System\rOUAYUK.exe

C:\Windows\System\rOUAYUK.exe

C:\Windows\System\diedtwV.exe

C:\Windows\System\diedtwV.exe

C:\Windows\System\VjQCJGM.exe

C:\Windows\System\VjQCJGM.exe

C:\Windows\System\UdYXeUu.exe

C:\Windows\System\UdYXeUu.exe

C:\Windows\System\vGeQUcA.exe

C:\Windows\System\vGeQUcA.exe

C:\Windows\System\GXKlHFx.exe

C:\Windows\System\GXKlHFx.exe

C:\Windows\System\sMTNqeR.exe

C:\Windows\System\sMTNqeR.exe

C:\Windows\System\xYMckOW.exe

C:\Windows\System\xYMckOW.exe

C:\Windows\System\rHhvXix.exe

C:\Windows\System\rHhvXix.exe

C:\Windows\System\XbmPcFV.exe

C:\Windows\System\XbmPcFV.exe

C:\Windows\System\UKFLwaj.exe

C:\Windows\System\UKFLwaj.exe

C:\Windows\System\QcgFQDv.exe

C:\Windows\System\QcgFQDv.exe

C:\Windows\System\MvrSKcH.exe

C:\Windows\System\MvrSKcH.exe

C:\Windows\System\jKWhduC.exe

C:\Windows\System\jKWhduC.exe

C:\Windows\System\tcOUflG.exe

C:\Windows\System\tcOUflG.exe

C:\Windows\System\IqHcabV.exe

C:\Windows\System\IqHcabV.exe

C:\Windows\System\iUDVyfF.exe

C:\Windows\System\iUDVyfF.exe

C:\Windows\System\ahMiFdQ.exe

C:\Windows\System\ahMiFdQ.exe

C:\Windows\System\cKmRCcj.exe

C:\Windows\System\cKmRCcj.exe

C:\Windows\System\xbAMcTn.exe

C:\Windows\System\xbAMcTn.exe

C:\Windows\System\ipuOqtX.exe

C:\Windows\System\ipuOqtX.exe

C:\Windows\System\KXuAaSP.exe

C:\Windows\System\KXuAaSP.exe

C:\Windows\System\TwSZrzo.exe

C:\Windows\System\TwSZrzo.exe

C:\Windows\System\tzQuYYa.exe

C:\Windows\System\tzQuYYa.exe

C:\Windows\System\oeJvnMb.exe

C:\Windows\System\oeJvnMb.exe

C:\Windows\System\yrvjkzj.exe

C:\Windows\System\yrvjkzj.exe

C:\Windows\System\hFHzPoU.exe

C:\Windows\System\hFHzPoU.exe

C:\Windows\System\JTbokbg.exe

C:\Windows\System\JTbokbg.exe

C:\Windows\System\IgJBYwO.exe

C:\Windows\System\IgJBYwO.exe

C:\Windows\System\IdgkCXB.exe

C:\Windows\System\IdgkCXB.exe

C:\Windows\System\jADDLgH.exe

C:\Windows\System\jADDLgH.exe

C:\Windows\System\eyuboDu.exe

C:\Windows\System\eyuboDu.exe

C:\Windows\System\gBuDhlL.exe

C:\Windows\System\gBuDhlL.exe

C:\Windows\System\bYSQTyp.exe

C:\Windows\System\bYSQTyp.exe

C:\Windows\System\YkylYoS.exe

C:\Windows\System\YkylYoS.exe

C:\Windows\System\kNOAWFj.exe

C:\Windows\System\kNOAWFj.exe

C:\Windows\System\ZYePtrP.exe

C:\Windows\System\ZYePtrP.exe

C:\Windows\System\DWOiiLn.exe

C:\Windows\System\DWOiiLn.exe

C:\Windows\System\LvnmXbu.exe

C:\Windows\System\LvnmXbu.exe

C:\Windows\System\YKpVgHx.exe

C:\Windows\System\YKpVgHx.exe

C:\Windows\System\BNofKUo.exe

C:\Windows\System\BNofKUo.exe

C:\Windows\System\IWrWHYS.exe

C:\Windows\System\IWrWHYS.exe

C:\Windows\System\AyNffBn.exe

C:\Windows\System\AyNffBn.exe

C:\Windows\System\wPQYpdi.exe

C:\Windows\System\wPQYpdi.exe

C:\Windows\System\CTYvVoW.exe

C:\Windows\System\CTYvVoW.exe

C:\Windows\System\MZapKTp.exe

C:\Windows\System\MZapKTp.exe

C:\Windows\System\YlAgQcX.exe

C:\Windows\System\YlAgQcX.exe

C:\Windows\System\RJXoiBG.exe

C:\Windows\System\RJXoiBG.exe

C:\Windows\System\wKChOXF.exe

C:\Windows\System\wKChOXF.exe

C:\Windows\System\DerHIDa.exe

C:\Windows\System\DerHIDa.exe

C:\Windows\System\fCoHuLd.exe

C:\Windows\System\fCoHuLd.exe

C:\Windows\System\ATPenUs.exe

C:\Windows\System\ATPenUs.exe

C:\Windows\System\vItRvtw.exe

C:\Windows\System\vItRvtw.exe

C:\Windows\System\YxbuJYY.exe

C:\Windows\System\YxbuJYY.exe

C:\Windows\System\wdKlMVh.exe

C:\Windows\System\wdKlMVh.exe

C:\Windows\System\TUZhcDX.exe

C:\Windows\System\TUZhcDX.exe

C:\Windows\System\HvegBeE.exe

C:\Windows\System\HvegBeE.exe

C:\Windows\System\ttCBGmd.exe

C:\Windows\System\ttCBGmd.exe

C:\Windows\System\ymYycLV.exe

C:\Windows\System\ymYycLV.exe

C:\Windows\System\VplAigQ.exe

C:\Windows\System\VplAigQ.exe

C:\Windows\System\FTVRoMD.exe

C:\Windows\System\FTVRoMD.exe

C:\Windows\System\oapOjpn.exe

C:\Windows\System\oapOjpn.exe

C:\Windows\System\PTJPUGO.exe

C:\Windows\System\PTJPUGO.exe

C:\Windows\System\aTKmYSi.exe

C:\Windows\System\aTKmYSi.exe

C:\Windows\System\BneISRs.exe

C:\Windows\System\BneISRs.exe

C:\Windows\System\dZtqrvm.exe

C:\Windows\System\dZtqrvm.exe

C:\Windows\System\Jjzycui.exe

C:\Windows\System\Jjzycui.exe

C:\Windows\System\wgWTsVj.exe

C:\Windows\System\wgWTsVj.exe

C:\Windows\System\txNreRP.exe

C:\Windows\System\txNreRP.exe

C:\Windows\System\UArClBQ.exe

C:\Windows\System\UArClBQ.exe

C:\Windows\System\xcPkGNR.exe

C:\Windows\System\xcPkGNR.exe

C:\Windows\System\wNoKvVL.exe

C:\Windows\System\wNoKvVL.exe

C:\Windows\System\RSQxexn.exe

C:\Windows\System\RSQxexn.exe

C:\Windows\System\xJNQlga.exe

C:\Windows\System\xJNQlga.exe

C:\Windows\System\RpYxurU.exe

C:\Windows\System\RpYxurU.exe

C:\Windows\System\PLGkbwf.exe

C:\Windows\System\PLGkbwf.exe

C:\Windows\System\zRAqaAH.exe

C:\Windows\System\zRAqaAH.exe

C:\Windows\System\gAvXjYk.exe

C:\Windows\System\gAvXjYk.exe

C:\Windows\System\cZsvzAU.exe

C:\Windows\System\cZsvzAU.exe

C:\Windows\System\axIyhDm.exe

C:\Windows\System\axIyhDm.exe

C:\Windows\System\hAbwkXr.exe

C:\Windows\System\hAbwkXr.exe

C:\Windows\System\pMgxGtw.exe

C:\Windows\System\pMgxGtw.exe

C:\Windows\System\qTDqmHf.exe

C:\Windows\System\qTDqmHf.exe

C:\Windows\System\wQKcXKa.exe

C:\Windows\System\wQKcXKa.exe

C:\Windows\System\IDkvCBn.exe

C:\Windows\System\IDkvCBn.exe

C:\Windows\System\xPKLIDu.exe

C:\Windows\System\xPKLIDu.exe

C:\Windows\System\XhYvALe.exe

C:\Windows\System\XhYvALe.exe

C:\Windows\System\YcwaNKG.exe

C:\Windows\System\YcwaNKG.exe

C:\Windows\System\pRTVIRi.exe

C:\Windows\System\pRTVIRi.exe

C:\Windows\System\FxDsIjc.exe

C:\Windows\System\FxDsIjc.exe

C:\Windows\System\HKHpgzR.exe

C:\Windows\System\HKHpgzR.exe

C:\Windows\System\brofsdB.exe

C:\Windows\System\brofsdB.exe

C:\Windows\System\jjqwaRV.exe

C:\Windows\System\jjqwaRV.exe

C:\Windows\System\DLkZyxD.exe

C:\Windows\System\DLkZyxD.exe

C:\Windows\System\QcbgPbZ.exe

C:\Windows\System\QcbgPbZ.exe

C:\Windows\System\TdHLMPS.exe

C:\Windows\System\TdHLMPS.exe

C:\Windows\System\zPOWhoz.exe

C:\Windows\System\zPOWhoz.exe

C:\Windows\System\RpwpYkK.exe

C:\Windows\System\RpwpYkK.exe

C:\Windows\System\ZswBCQF.exe

C:\Windows\System\ZswBCQF.exe

C:\Windows\System\otyDtUS.exe

C:\Windows\System\otyDtUS.exe

C:\Windows\System\onFRwVH.exe

C:\Windows\System\onFRwVH.exe

C:\Windows\System\pYhSGVc.exe

C:\Windows\System\pYhSGVc.exe

C:\Windows\System\bCDKbpj.exe

C:\Windows\System\bCDKbpj.exe

C:\Windows\System\dRonVsd.exe

C:\Windows\System\dRonVsd.exe

C:\Windows\System\HfWeWHC.exe

C:\Windows\System\HfWeWHC.exe

C:\Windows\System\RLeJRLM.exe

C:\Windows\System\RLeJRLM.exe

C:\Windows\System\FFtkmLy.exe

C:\Windows\System\FFtkmLy.exe

C:\Windows\System\atdYsCS.exe

C:\Windows\System\atdYsCS.exe

C:\Windows\System\TvrUwXa.exe

C:\Windows\System\TvrUwXa.exe

C:\Windows\System\FazExRb.exe

C:\Windows\System\FazExRb.exe

C:\Windows\System\EGoieOv.exe

C:\Windows\System\EGoieOv.exe

C:\Windows\System\jBVjyyx.exe

C:\Windows\System\jBVjyyx.exe

C:\Windows\System\NDYGypq.exe

C:\Windows\System\NDYGypq.exe

C:\Windows\System\NLlDjVa.exe

C:\Windows\System\NLlDjVa.exe

C:\Windows\System\DtIpRts.exe

C:\Windows\System\DtIpRts.exe

C:\Windows\System\MJHxdgi.exe

C:\Windows\System\MJHxdgi.exe

C:\Windows\System\UynZfKa.exe

C:\Windows\System\UynZfKa.exe

C:\Windows\System\QqMEJCF.exe

C:\Windows\System\QqMEJCF.exe

C:\Windows\System\WAAVlED.exe

C:\Windows\System\WAAVlED.exe

C:\Windows\System\IbDyItX.exe

C:\Windows\System\IbDyItX.exe

C:\Windows\System\blrWhWn.exe

C:\Windows\System\blrWhWn.exe

C:\Windows\System\PTnMQbL.exe

C:\Windows\System\PTnMQbL.exe

C:\Windows\System\VGdnjag.exe

C:\Windows\System\VGdnjag.exe

C:\Windows\System\iXBUaiW.exe

C:\Windows\System\iXBUaiW.exe

C:\Windows\System\qrswNTq.exe

C:\Windows\System\qrswNTq.exe

C:\Windows\System\GHwZagi.exe

C:\Windows\System\GHwZagi.exe

C:\Windows\System\xXfcpDP.exe

C:\Windows\System\xXfcpDP.exe

C:\Windows\System\LlTkBjv.exe

C:\Windows\System\LlTkBjv.exe

C:\Windows\System\JZfCkaz.exe

C:\Windows\System\JZfCkaz.exe

C:\Windows\System\YQxbHUP.exe

C:\Windows\System\YQxbHUP.exe

C:\Windows\System\hRcXtIJ.exe

C:\Windows\System\hRcXtIJ.exe

C:\Windows\System\NhXAeZE.exe

C:\Windows\System\NhXAeZE.exe

C:\Windows\System\cIYDSDw.exe

C:\Windows\System\cIYDSDw.exe

C:\Windows\System\juAFPZY.exe

C:\Windows\System\juAFPZY.exe

C:\Windows\System\AyKOazj.exe

C:\Windows\System\AyKOazj.exe

C:\Windows\System\TaRcjAD.exe

C:\Windows\System\TaRcjAD.exe

C:\Windows\System\WTetSJa.exe

C:\Windows\System\WTetSJa.exe

C:\Windows\System\KyxeUMt.exe

C:\Windows\System\KyxeUMt.exe

C:\Windows\System\mYIoyul.exe

C:\Windows\System\mYIoyul.exe

C:\Windows\System\BkglCRE.exe

C:\Windows\System\BkglCRE.exe

C:\Windows\System\mQRDHay.exe

C:\Windows\System\mQRDHay.exe

C:\Windows\System\bHgjqmD.exe

C:\Windows\System\bHgjqmD.exe

C:\Windows\System\mzWdqML.exe

C:\Windows\System\mzWdqML.exe

C:\Windows\System\YwqAKpv.exe

C:\Windows\System\YwqAKpv.exe

C:\Windows\System\nijIuEe.exe

C:\Windows\System\nijIuEe.exe

C:\Windows\System\ZGUOUHw.exe

C:\Windows\System\ZGUOUHw.exe

C:\Windows\System\kvusTMd.exe

C:\Windows\System\kvusTMd.exe

C:\Windows\System\RGzCvYG.exe

C:\Windows\System\RGzCvYG.exe

C:\Windows\System\xRnlrTb.exe

C:\Windows\System\xRnlrTb.exe

C:\Windows\System\qNkpCWy.exe

C:\Windows\System\qNkpCWy.exe

C:\Windows\System\UzilBWU.exe

C:\Windows\System\UzilBWU.exe

C:\Windows\System\fpakkqR.exe

C:\Windows\System\fpakkqR.exe

C:\Windows\System\IWDhRNn.exe

C:\Windows\System\IWDhRNn.exe

C:\Windows\System\nzMBLpj.exe

C:\Windows\System\nzMBLpj.exe

C:\Windows\System\KtYwsbq.exe

C:\Windows\System\KtYwsbq.exe

C:\Windows\System\LkIAgPT.exe

C:\Windows\System\LkIAgPT.exe

C:\Windows\System\ulcVTzP.exe

C:\Windows\System\ulcVTzP.exe

C:\Windows\System\VowhxUH.exe

C:\Windows\System\VowhxUH.exe

C:\Windows\System\jWDMnCJ.exe

C:\Windows\System\jWDMnCJ.exe

C:\Windows\System\QvlzvlM.exe

C:\Windows\System\QvlzvlM.exe

C:\Windows\System\ImNoxOZ.exe

C:\Windows\System\ImNoxOZ.exe

C:\Windows\System\jteOoQO.exe

C:\Windows\System\jteOoQO.exe

C:\Windows\System\PVfDGpe.exe

C:\Windows\System\PVfDGpe.exe

C:\Windows\System\nfBgVOW.exe

C:\Windows\System\nfBgVOW.exe

C:\Windows\System\GaFLdkS.exe

C:\Windows\System\GaFLdkS.exe

C:\Windows\System\ijkVCrq.exe

C:\Windows\System\ijkVCrq.exe

C:\Windows\System\tXZRvHd.exe

C:\Windows\System\tXZRvHd.exe

C:\Windows\System\GQPVluZ.exe

C:\Windows\System\GQPVluZ.exe

C:\Windows\System\GCMfiWC.exe

C:\Windows\System\GCMfiWC.exe

C:\Windows\System\joXplst.exe

C:\Windows\System\joXplst.exe

C:\Windows\System\asZhDPd.exe

C:\Windows\System\asZhDPd.exe

C:\Windows\System\rICPWWQ.exe

C:\Windows\System\rICPWWQ.exe

C:\Windows\System\MfDhEEN.exe

C:\Windows\System\MfDhEEN.exe

C:\Windows\System\DgDJDLj.exe

C:\Windows\System\DgDJDLj.exe

C:\Windows\System\KtvnQLl.exe

C:\Windows\System\KtvnQLl.exe

C:\Windows\System\hYQYFdk.exe

C:\Windows\System\hYQYFdk.exe

C:\Windows\System\MhguXvA.exe

C:\Windows\System\MhguXvA.exe

C:\Windows\System\SbkMFxd.exe

C:\Windows\System\SbkMFxd.exe

C:\Windows\System\nHtgion.exe

C:\Windows\System\nHtgion.exe

C:\Windows\System\CwdPbBk.exe

C:\Windows\System\CwdPbBk.exe

C:\Windows\System\OQqVigO.exe

C:\Windows\System\OQqVigO.exe

C:\Windows\System\CcMZFkk.exe

C:\Windows\System\CcMZFkk.exe

C:\Windows\System\bhSLmny.exe

C:\Windows\System\bhSLmny.exe

C:\Windows\System\NefguEh.exe

C:\Windows\System\NefguEh.exe

C:\Windows\System\lFbQaSI.exe

C:\Windows\System\lFbQaSI.exe

C:\Windows\System\xZBonZE.exe

C:\Windows\System\xZBonZE.exe

C:\Windows\System\bBrYvzm.exe

C:\Windows\System\bBrYvzm.exe

C:\Windows\System\BfFvOkh.exe

C:\Windows\System\BfFvOkh.exe

C:\Windows\System\bPlVkkj.exe

C:\Windows\System\bPlVkkj.exe

C:\Windows\System\PanaWWP.exe

C:\Windows\System\PanaWWP.exe

C:\Windows\System\JOUrHER.exe

C:\Windows\System\JOUrHER.exe

C:\Windows\System\MudXxZP.exe

C:\Windows\System\MudXxZP.exe

C:\Windows\System\nBQPamT.exe

C:\Windows\System\nBQPamT.exe

C:\Windows\System\QyroiHu.exe

C:\Windows\System\QyroiHu.exe

C:\Windows\System\lnRFVcC.exe

C:\Windows\System\lnRFVcC.exe

C:\Windows\System\JDXlHyj.exe

C:\Windows\System\JDXlHyj.exe

C:\Windows\System\DvRwojd.exe

C:\Windows\System\DvRwojd.exe

C:\Windows\System\RGgfBsF.exe

C:\Windows\System\RGgfBsF.exe

C:\Windows\System\FxMeCZN.exe

C:\Windows\System\FxMeCZN.exe

C:\Windows\System\GqTnWSj.exe

C:\Windows\System\GqTnWSj.exe

C:\Windows\System\kRbkKHG.exe

C:\Windows\System\kRbkKHG.exe

C:\Windows\System\wLaINhA.exe

C:\Windows\System\wLaINhA.exe

C:\Windows\System\YWJPACh.exe

C:\Windows\System\YWJPACh.exe

C:\Windows\System\lqgBFRm.exe

C:\Windows\System\lqgBFRm.exe

C:\Windows\System\RxAxjZx.exe

C:\Windows\System\RxAxjZx.exe

C:\Windows\System\AxDWlPH.exe

C:\Windows\System\AxDWlPH.exe

C:\Windows\System\RHHNeaj.exe

C:\Windows\System\RHHNeaj.exe

C:\Windows\System\aLeLpFf.exe

C:\Windows\System\aLeLpFf.exe

C:\Windows\System\DpZgUoj.exe

C:\Windows\System\DpZgUoj.exe

C:\Windows\System\ZgeGVGS.exe

C:\Windows\System\ZgeGVGS.exe

C:\Windows\System\GEqvEqb.exe

C:\Windows\System\GEqvEqb.exe

C:\Windows\System\BmvHvCP.exe

C:\Windows\System\BmvHvCP.exe

C:\Windows\System\bzuYnmZ.exe

C:\Windows\System\bzuYnmZ.exe

C:\Windows\System\FwGZACT.exe

C:\Windows\System\FwGZACT.exe

C:\Windows\System\MXfsrVw.exe

C:\Windows\System\MXfsrVw.exe

C:\Windows\System\mxwyCIj.exe

C:\Windows\System\mxwyCIj.exe

C:\Windows\System\JhTHyhw.exe

C:\Windows\System\JhTHyhw.exe

C:\Windows\System\qJHbgEW.exe

C:\Windows\System\qJHbgEW.exe

C:\Windows\System\ApGEdMp.exe

C:\Windows\System\ApGEdMp.exe

C:\Windows\System\hyfUIEj.exe

C:\Windows\System\hyfUIEj.exe

C:\Windows\System\NKbxtrE.exe

C:\Windows\System\NKbxtrE.exe

C:\Windows\System\BJafhOQ.exe

C:\Windows\System\BJafhOQ.exe

C:\Windows\System\YJBDvxB.exe

C:\Windows\System\YJBDvxB.exe

C:\Windows\System\GsEUIQe.exe

C:\Windows\System\GsEUIQe.exe

C:\Windows\System\fPPgKkY.exe

C:\Windows\System\fPPgKkY.exe

C:\Windows\System\ptOBFNV.exe

C:\Windows\System\ptOBFNV.exe

C:\Windows\System\CtXtFLr.exe

C:\Windows\System\CtXtFLr.exe

C:\Windows\System\gmjUlcg.exe

C:\Windows\System\gmjUlcg.exe

C:\Windows\System\ZdGikNF.exe

C:\Windows\System\ZdGikNF.exe

C:\Windows\System\ZbNOSsO.exe

C:\Windows\System\ZbNOSsO.exe

C:\Windows\System\hBvrwRT.exe

C:\Windows\System\hBvrwRT.exe

C:\Windows\System\reMVHnk.exe

C:\Windows\System\reMVHnk.exe

C:\Windows\System\okUbmxu.exe

C:\Windows\System\okUbmxu.exe

C:\Windows\System\QFhOobq.exe

C:\Windows\System\QFhOobq.exe

C:\Windows\System\DWbrawO.exe

C:\Windows\System\DWbrawO.exe

C:\Windows\System\uKGwCij.exe

C:\Windows\System\uKGwCij.exe

C:\Windows\System\ZfdTHSD.exe

C:\Windows\System\ZfdTHSD.exe

C:\Windows\System\TsOeucn.exe

C:\Windows\System\TsOeucn.exe

C:\Windows\System\vapWuzL.exe

C:\Windows\System\vapWuzL.exe

C:\Windows\System\XiQNpqV.exe

C:\Windows\System\XiQNpqV.exe

C:\Windows\System\YdghrBH.exe

C:\Windows\System\YdghrBH.exe

C:\Windows\System\svcZJrX.exe

C:\Windows\System\svcZJrX.exe

C:\Windows\System\zVYDxBU.exe

C:\Windows\System\zVYDxBU.exe

C:\Windows\System\aEDMoRA.exe

C:\Windows\System\aEDMoRA.exe

C:\Windows\System\MZvrXIP.exe

C:\Windows\System\MZvrXIP.exe

C:\Windows\System\jkXBtFU.exe

C:\Windows\System\jkXBtFU.exe

C:\Windows\System\yEmEvOW.exe

C:\Windows\System\yEmEvOW.exe

C:\Windows\System\qYUyDYn.exe

C:\Windows\System\qYUyDYn.exe

C:\Windows\System\ZfnfryS.exe

C:\Windows\System\ZfnfryS.exe

C:\Windows\System\sGEIBlc.exe

C:\Windows\System\sGEIBlc.exe

C:\Windows\System\dgWuqGD.exe

C:\Windows\System\dgWuqGD.exe

C:\Windows\System\uhcMahR.exe

C:\Windows\System\uhcMahR.exe

C:\Windows\System\cjTytfY.exe

C:\Windows\System\cjTytfY.exe

C:\Windows\System\OOhuucE.exe

C:\Windows\System\OOhuucE.exe

C:\Windows\System\TWIZRxc.exe

C:\Windows\System\TWIZRxc.exe

C:\Windows\System\tsByfFC.exe

C:\Windows\System\tsByfFC.exe

C:\Windows\System\vHMGkGQ.exe

C:\Windows\System\vHMGkGQ.exe

C:\Windows\System\UDBHKjZ.exe

C:\Windows\System\UDBHKjZ.exe

C:\Windows\System\RdYzbVi.exe

C:\Windows\System\RdYzbVi.exe

C:\Windows\System\vffEdSz.exe

C:\Windows\System\vffEdSz.exe

C:\Windows\System\FxqmpdB.exe

C:\Windows\System\FxqmpdB.exe

C:\Windows\System\VDXXfbv.exe

C:\Windows\System\VDXXfbv.exe

C:\Windows\System\sOWsnPQ.exe

C:\Windows\System\sOWsnPQ.exe

C:\Windows\System\BGeajNZ.exe

C:\Windows\System\BGeajNZ.exe

C:\Windows\System\dxcWaCj.exe

C:\Windows\System\dxcWaCj.exe

C:\Windows\System\lrsuBYC.exe

C:\Windows\System\lrsuBYC.exe

C:\Windows\System\JIfYtgU.exe

C:\Windows\System\JIfYtgU.exe

C:\Windows\System\yacgUxh.exe

C:\Windows\System\yacgUxh.exe

C:\Windows\System\wngHxem.exe

C:\Windows\System\wngHxem.exe

C:\Windows\System\MUWAEos.exe

C:\Windows\System\MUWAEos.exe

C:\Windows\System\PxvIOBl.exe

C:\Windows\System\PxvIOBl.exe

C:\Windows\System\MfScdnx.exe

C:\Windows\System\MfScdnx.exe

C:\Windows\System\OmaDmWJ.exe

C:\Windows\System\OmaDmWJ.exe

C:\Windows\System\xQYFsBl.exe

C:\Windows\System\xQYFsBl.exe

C:\Windows\System\bUYiAob.exe

C:\Windows\System\bUYiAob.exe

C:\Windows\System\qFZalJE.exe

C:\Windows\System\qFZalJE.exe

C:\Windows\System\xIuGtyk.exe

C:\Windows\System\xIuGtyk.exe

C:\Windows\System\BeONEqr.exe

C:\Windows\System\BeONEqr.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\System\ThwARFn.exe

C:\Windows\System\ThwARFn.exe

C:\Windows\System\hsuBJbM.exe

C:\Windows\System\hsuBJbM.exe

C:\Windows\System\hqiclrE.exe

C:\Windows\System\hqiclrE.exe

C:\Windows\System\kMwJXFh.exe

C:\Windows\System\kMwJXFh.exe

C:\Windows\System\klvvHiD.exe

C:\Windows\System\klvvHiD.exe

C:\Windows\System\QqGYzLt.exe

C:\Windows\System\QqGYzLt.exe

C:\Windows\System\dXjrXad.exe

C:\Windows\System\dXjrXad.exe

C:\Windows\System\llXgynB.exe

C:\Windows\System\llXgynB.exe

C:\Windows\System\UmDVjdc.exe

C:\Windows\System\UmDVjdc.exe

C:\Windows\System\XRGaQcN.exe

C:\Windows\System\XRGaQcN.exe

C:\Windows\System\uFYHsfX.exe

C:\Windows\System\uFYHsfX.exe

C:\Windows\System\knSTTBg.exe

C:\Windows\System\knSTTBg.exe

C:\Windows\System\nJDngrl.exe

C:\Windows\System\nJDngrl.exe

C:\Windows\System\xcDhZBl.exe

C:\Windows\System\xcDhZBl.exe

C:\Windows\System\GBRSmyf.exe

C:\Windows\System\GBRSmyf.exe

C:\Windows\System\xbhmpFI.exe

C:\Windows\System\xbhmpFI.exe

C:\Windows\System\EnMLHLE.exe

C:\Windows\System\EnMLHLE.exe

C:\Windows\System\sBATMYl.exe

C:\Windows\System\sBATMYl.exe

C:\Windows\System\yNOFyVd.exe

C:\Windows\System\yNOFyVd.exe

C:\Windows\System\kAuEjhR.exe

C:\Windows\System\kAuEjhR.exe

C:\Windows\System\ETedGOf.exe

C:\Windows\System\ETedGOf.exe

C:\Windows\System\SarJiNP.exe

C:\Windows\System\SarJiNP.exe

C:\Windows\System\UaEKuvM.exe

C:\Windows\System\UaEKuvM.exe

C:\Windows\System\JdRkvBb.exe

C:\Windows\System\JdRkvBb.exe

C:\Windows\System\djoABAj.exe

C:\Windows\System\djoABAj.exe

C:\Windows\System\cAVYrzr.exe

C:\Windows\System\cAVYrzr.exe

C:\Windows\System\UuJTWgG.exe

C:\Windows\System\UuJTWgG.exe

C:\Windows\System\WJYoMVm.exe

C:\Windows\System\WJYoMVm.exe

C:\Windows\System\noQEOsa.exe

C:\Windows\System\noQEOsa.exe

C:\Windows\System\sEviiTN.exe

C:\Windows\System\sEviiTN.exe

C:\Windows\System\MsSkUid.exe

C:\Windows\System\MsSkUid.exe

C:\Windows\System\VDXPyCa.exe

C:\Windows\System\VDXPyCa.exe

C:\Windows\System\xqvFPRv.exe

C:\Windows\System\xqvFPRv.exe

C:\Windows\System\rNowwMU.exe

C:\Windows\System\rNowwMU.exe

C:\Windows\System\ZCDcQrg.exe

C:\Windows\System\ZCDcQrg.exe

C:\Windows\System\vKXKXtY.exe

C:\Windows\System\vKXKXtY.exe

C:\Windows\System\YmGvAnR.exe

C:\Windows\System\YmGvAnR.exe

C:\Windows\System\oASejVN.exe

C:\Windows\System\oASejVN.exe

C:\Windows\System\sOIxZuE.exe

C:\Windows\System\sOIxZuE.exe

C:\Windows\System\OsebPYT.exe

C:\Windows\System\OsebPYT.exe

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 604 -p 11536 -ip 11536

C:\Windows\System\kAgUDXh.exe

C:\Windows\System\kAgUDXh.exe

C:\Windows\System\YWpckSs.exe

C:\Windows\System\YWpckSs.exe

C:\Windows\System\lHIFBVf.exe

C:\Windows\System\lHIFBVf.exe

C:\Windows\System\ctcUiwu.exe

C:\Windows\System\ctcUiwu.exe

C:\Windows\System\otjhHcY.exe

C:\Windows\System\otjhHcY.exe

C:\Windows\System\krMOVpP.exe

C:\Windows\System\krMOVpP.exe

C:\Windows\System\SCXtUsa.exe

C:\Windows\System\SCXtUsa.exe

C:\Windows\System\nZwVDMz.exe

C:\Windows\System\nZwVDMz.exe

C:\Windows\System\EaIbIuk.exe

C:\Windows\System\EaIbIuk.exe

C:\Windows\System\ubwuDLM.exe

C:\Windows\System\ubwuDLM.exe

C:\Windows\System\PHrIbrT.exe

C:\Windows\System\PHrIbrT.exe

C:\Windows\System\AEPODdO.exe

C:\Windows\System\AEPODdO.exe

C:\Windows\System\gybJQPf.exe

C:\Windows\System\gybJQPf.exe

C:\Windows\System\qmLEpLt.exe

C:\Windows\System\qmLEpLt.exe

C:\Windows\System\KkNJOdg.exe

C:\Windows\System\KkNJOdg.exe

C:\Windows\System\VjckVWd.exe

C:\Windows\System\VjckVWd.exe

C:\Windows\System\pYgypGZ.exe

C:\Windows\System\pYgypGZ.exe

C:\Windows\System\LIHUmQB.exe

C:\Windows\System\LIHUmQB.exe

C:\Windows\System\xtIgBWC.exe

C:\Windows\System\xtIgBWC.exe

C:\Windows\System\Btniyoe.exe

C:\Windows\System\Btniyoe.exe

C:\Windows\System\VsttyrA.exe

C:\Windows\System\VsttyrA.exe

C:\Windows\System\OPszjXX.exe

C:\Windows\System\OPszjXX.exe

C:\Windows\System\ZkczEvO.exe

C:\Windows\System\ZkczEvO.exe

C:\Windows\System\FkGgVfD.exe

C:\Windows\System\FkGgVfD.exe

C:\Windows\System\rIlejgX.exe

C:\Windows\System\rIlejgX.exe

C:\Windows\System\mbDCPyl.exe

C:\Windows\System\mbDCPyl.exe

C:\Windows\System\qdFGoiU.exe

C:\Windows\System\qdFGoiU.exe

C:\Windows\System\UZNOHKj.exe

C:\Windows\System\UZNOHKj.exe

C:\Windows\System\xOOUibF.exe

C:\Windows\System\xOOUibF.exe

C:\Windows\System\pdwPaQa.exe

C:\Windows\System\pdwPaQa.exe

C:\Windows\System\NocztAq.exe

C:\Windows\System\NocztAq.exe

C:\Windows\System\SgqJles.exe

C:\Windows\System\SgqJles.exe

C:\Windows\System\gTOoGtR.exe

C:\Windows\System\gTOoGtR.exe

C:\Windows\System\FVXfgNO.exe

C:\Windows\System\FVXfgNO.exe

C:\Windows\System\eaGoJGq.exe

C:\Windows\System\eaGoJGq.exe

C:\Windows\System\nFGyivu.exe

C:\Windows\System\nFGyivu.exe

C:\Windows\System\CIIAyWs.exe

C:\Windows\System\CIIAyWs.exe

C:\Windows\System\BfmAhDe.exe

C:\Windows\System\BfmAhDe.exe

C:\Windows\System\lvkXRsz.exe

C:\Windows\System\lvkXRsz.exe

C:\Windows\System\VEiIloi.exe

C:\Windows\System\VEiIloi.exe

C:\Windows\System\XMBMgvC.exe

C:\Windows\System\XMBMgvC.exe

C:\Windows\System\ipnOrcM.exe

C:\Windows\System\ipnOrcM.exe

C:\Windows\System\NNZTxFx.exe

C:\Windows\System\NNZTxFx.exe

C:\Windows\System\datJTnl.exe

C:\Windows\System\datJTnl.exe

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\System\ZLOKVWA.exe

C:\Windows\System\ZLOKVWA.exe

C:\Windows\System\sNdGzOD.exe

C:\Windows\System\sNdGzOD.exe

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\System\kWUNFmU.exe

C:\Windows\System\kWUNFmU.exe

C:\Windows\System\SUcoilM.exe

C:\Windows\System\SUcoilM.exe

C:\Windows\System\CljLfXg.exe

C:\Windows\System\CljLfXg.exe

C:\Windows\System\NtOcTaG.exe

C:\Windows\System\NtOcTaG.exe

C:\Windows\System\EzPyyBp.exe

C:\Windows\System\EzPyyBp.exe

C:\Windows\System\KnbzhLg.exe

C:\Windows\System\KnbzhLg.exe

C:\Windows\System\HKWhjfR.exe

C:\Windows\System\HKWhjfR.exe

C:\Windows\System\NtFJRaj.exe

C:\Windows\System\NtFJRaj.exe

C:\Windows\System\xvoPoSd.exe

C:\Windows\System\xvoPoSd.exe

C:\Windows\System\TMSkAcZ.exe

C:\Windows\System\TMSkAcZ.exe

C:\Windows\System\acaorCW.exe

C:\Windows\System\acaorCW.exe

C:\Windows\System\OyILSNg.exe

C:\Windows\System\OyILSNg.exe

C:\Windows\System\VbemEdt.exe

C:\Windows\System\VbemEdt.exe

C:\Windows\System\zgZedxn.exe

C:\Windows\System\zgZedxn.exe

C:\Windows\System\gorAyYo.exe

C:\Windows\System\gorAyYo.exe

C:\Windows\System\peNIgWh.exe

C:\Windows\System\peNIgWh.exe

C:\Windows\System\mvdcnbA.exe

C:\Windows\System\mvdcnbA.exe

C:\Windows\System\oNFqzcT.exe

C:\Windows\System\oNFqzcT.exe

C:\Windows\System\NmKYirk.exe

C:\Windows\System\NmKYirk.exe

C:\Windows\System\OHDHauL.exe

C:\Windows\System\OHDHauL.exe

C:\Windows\System\OnqsCcQ.exe

C:\Windows\System\OnqsCcQ.exe

C:\Windows\System\wFCpqyB.exe

C:\Windows\System\wFCpqyB.exe

C:\Windows\System\LPXloOj.exe

C:\Windows\System\LPXloOj.exe

C:\Windows\System\BjIjMeN.exe

C:\Windows\System\BjIjMeN.exe

C:\Windows\System\HmbqgxG.exe

C:\Windows\System\HmbqgxG.exe

C:\Windows\System\mRMwrTu.exe

C:\Windows\System\mRMwrTu.exe

C:\Windows\System\NfCXtor.exe

C:\Windows\System\NfCXtor.exe

C:\Windows\System\tTxmzOO.exe

C:\Windows\System\tTxmzOO.exe

C:\Windows\System\HKamGPI.exe

C:\Windows\System\HKamGPI.exe

C:\Windows\System\fwVDaEz.exe

C:\Windows\System\fwVDaEz.exe

C:\Windows\System\tKDYDli.exe

C:\Windows\System\tKDYDli.exe

C:\Windows\System\QGDrgvE.exe

C:\Windows\System\QGDrgvE.exe

C:\Windows\System\MfZUnoj.exe

C:\Windows\System\MfZUnoj.exe

C:\Windows\System\UVvbYRQ.exe

C:\Windows\System\UVvbYRQ.exe

C:\Windows\System\KWirtOx.exe

C:\Windows\System\KWirtOx.exe

C:\Windows\System\sAmUwSA.exe

C:\Windows\System\sAmUwSA.exe

C:\Windows\System\LYyjgfo.exe

C:\Windows\System\LYyjgfo.exe

C:\Windows\System\XkYROYb.exe

C:\Windows\System\XkYROYb.exe

C:\Windows\System\rhdqXnj.exe

C:\Windows\System\rhdqXnj.exe

C:\Windows\System\oDIwkUC.exe

C:\Windows\System\oDIwkUC.exe

C:\Windows\System\hYxTYtz.exe

C:\Windows\System\hYxTYtz.exe

C:\Windows\System\hOouoND.exe

C:\Windows\System\hOouoND.exe

C:\Windows\System\KXbFXbe.exe

C:\Windows\System\KXbFXbe.exe

C:\Windows\System\WEWXjxT.exe

C:\Windows\System\WEWXjxT.exe

C:\Windows\System\ifAaotC.exe

C:\Windows\System\ifAaotC.exe

C:\Windows\System\vOCSMzX.exe

C:\Windows\System\vOCSMzX.exe

C:\Windows\System\RghSgJT.exe

C:\Windows\System\RghSgJT.exe

C:\Windows\System\PUonKqY.exe

C:\Windows\System\PUonKqY.exe

C:\Windows\System\tSOvaZL.exe

C:\Windows\System\tSOvaZL.exe

C:\Windows\System\PQfkjFi.exe

C:\Windows\System\PQfkjFi.exe

C:\Windows\System\GpfdPRI.exe

C:\Windows\System\GpfdPRI.exe

C:\Windows\System\lRahzUu.exe

C:\Windows\System\lRahzUu.exe

C:\Windows\System\AxgfoFY.exe

C:\Windows\System\AxgfoFY.exe

C:\Windows\System\SrgpeHO.exe

C:\Windows\System\SrgpeHO.exe

C:\Windows\System\nkHTwRz.exe

C:\Windows\System\nkHTwRz.exe

C:\Windows\System\VgsuvYM.exe

C:\Windows\System\VgsuvYM.exe

C:\Windows\System\oLQhtEZ.exe

C:\Windows\System\oLQhtEZ.exe

C:\Windows\System\DjcysXs.exe

C:\Windows\System\DjcysXs.exe

C:\Windows\System\OseeoUk.exe

C:\Windows\System\OseeoUk.exe

C:\Windows\System\daJLcuy.exe

C:\Windows\System\daJLcuy.exe

C:\Windows\System\hFJccKm.exe

C:\Windows\System\hFJccKm.exe

C:\Windows\System\nrWLuTm.exe

C:\Windows\System\nrWLuTm.exe

C:\Windows\System\dWMhLpZ.exe

C:\Windows\System\dWMhLpZ.exe

C:\Windows\System\oXcpTTX.exe

C:\Windows\System\oXcpTTX.exe

C:\Windows\System\nSQixwq.exe

C:\Windows\System\nSQixwq.exe

C:\Windows\System\tpWiaJI.exe

C:\Windows\System\tpWiaJI.exe

C:\Windows\System\OkxqpmZ.exe

C:\Windows\System\OkxqpmZ.exe

C:\Windows\System\NXtAijz.exe

C:\Windows\System\NXtAijz.exe

C:\Windows\System\pIgVZFF.exe

C:\Windows\System\pIgVZFF.exe

C:\Windows\System\BmZIZUM.exe

C:\Windows\System\BmZIZUM.exe

C:\Windows\System\EhTxAzU.exe

C:\Windows\System\EhTxAzU.exe

C:\Windows\System\DEGEpXQ.exe

C:\Windows\System\DEGEpXQ.exe

C:\Windows\System\pflywNJ.exe

C:\Windows\System\pflywNJ.exe

C:\Windows\System\hZjSDFp.exe

C:\Windows\System\hZjSDFp.exe

C:\Windows\System\BoDHrNU.exe

C:\Windows\System\BoDHrNU.exe

C:\Windows\System\yEQOgdS.exe

C:\Windows\System\yEQOgdS.exe

C:\Windows\System\dkcvGFn.exe

C:\Windows\System\dkcvGFn.exe

C:\Windows\System\NYwRNAT.exe

C:\Windows\System\NYwRNAT.exe

C:\Windows\System\TataeRq.exe

C:\Windows\System\TataeRq.exe

C:\Windows\System\JDwaMLa.exe

C:\Windows\System\JDwaMLa.exe

C:\Windows\System\wcPGKTN.exe

C:\Windows\System\wcPGKTN.exe

C:\Windows\System\TbpLeZi.exe

C:\Windows\System\TbpLeZi.exe

C:\Windows\System\uLeWaXX.exe

C:\Windows\System\uLeWaXX.exe

C:\Windows\System\daCIjyW.exe

C:\Windows\System\daCIjyW.exe

C:\Windows\System\MvBHHTO.exe

C:\Windows\System\MvBHHTO.exe

C:\Windows\System\LHnlPVj.exe

C:\Windows\System\LHnlPVj.exe

C:\Windows\System\vcNvfoR.exe

C:\Windows\System\vcNvfoR.exe

C:\Windows\System\sJQJbGh.exe

C:\Windows\System\sJQJbGh.exe

C:\Windows\System\lPCIKuy.exe

C:\Windows\System\lPCIKuy.exe

C:\Windows\System\TfKbsed.exe

C:\Windows\System\TfKbsed.exe

C:\Windows\System\jFDzBgs.exe

C:\Windows\System\jFDzBgs.exe

C:\Windows\System\jCmhBjR.exe

C:\Windows\System\jCmhBjR.exe

C:\Windows\System\zzeUkVt.exe

C:\Windows\System\zzeUkVt.exe

C:\Windows\System\GwDrREX.exe

C:\Windows\System\GwDrREX.exe

C:\Windows\System\OvhwDFy.exe

C:\Windows\System\OvhwDFy.exe

C:\Windows\System\zobRxxx.exe

C:\Windows\System\zobRxxx.exe

C:\Windows\System\EnHqKHD.exe

C:\Windows\System\EnHqKHD.exe

C:\Windows\System\FKJkBNQ.exe

C:\Windows\System\FKJkBNQ.exe

C:\Windows\System\vIMoAQR.exe

C:\Windows\System\vIMoAQR.exe

C:\Windows\System\qUpEaAv.exe

C:\Windows\System\qUpEaAv.exe

C:\Windows\System\prvWceX.exe

C:\Windows\System\prvWceX.exe

C:\Windows\System\MpVyHqE.exe

C:\Windows\System\MpVyHqE.exe

C:\Windows\System\ESiyCac.exe

C:\Windows\System\ESiyCac.exe

C:\Windows\System\HGODWJD.exe

C:\Windows\System\HGODWJD.exe

C:\Windows\System\wuPsxxE.exe

C:\Windows\System\wuPsxxE.exe

C:\Windows\System\RJyghph.exe

C:\Windows\System\RJyghph.exe

C:\Windows\System\ZfPdWNp.exe

C:\Windows\System\ZfPdWNp.exe

C:\Windows\System\nccRMpG.exe

C:\Windows\System\nccRMpG.exe

C:\Windows\System\mDlPdOD.exe

C:\Windows\System\mDlPdOD.exe

C:\Windows\System\vQvBDJA.exe

C:\Windows\System\vQvBDJA.exe

C:\Windows\System\AqDJpbS.exe

C:\Windows\System\AqDJpbS.exe

C:\Windows\System\CIXUvzv.exe

C:\Windows\System\CIXUvzv.exe

C:\Windows\System\puVbrJb.exe

C:\Windows\System\puVbrJb.exe

C:\Windows\System\elgLUFT.exe

C:\Windows\System\elgLUFT.exe

C:\Windows\System\FepFLye.exe

C:\Windows\System\FepFLye.exe

C:\Windows\System\rEkdnlV.exe

C:\Windows\System\rEkdnlV.exe

C:\Windows\System\lmysVar.exe

C:\Windows\System\lmysVar.exe

C:\Windows\System\wkrjBDU.exe

C:\Windows\System\wkrjBDU.exe

C:\Windows\System\TfSiwKH.exe

C:\Windows\System\TfSiwKH.exe

C:\Windows\System\yeKFdsD.exe

C:\Windows\System\yeKFdsD.exe

C:\Windows\System\RBnHzAO.exe

C:\Windows\System\RBnHzAO.exe

C:\Windows\System\bVJwhXm.exe

C:\Windows\System\bVJwhXm.exe

C:\Windows\System\HsjiIqq.exe

C:\Windows\System\HsjiIqq.exe

C:\Windows\System\YCnLsXi.exe

C:\Windows\System\YCnLsXi.exe

C:\Windows\System\mlOzcch.exe

C:\Windows\System\mlOzcch.exe

C:\Windows\System\KFUTZtf.exe

C:\Windows\System\KFUTZtf.exe

C:\Windows\System\MzCNuWh.exe

C:\Windows\System\MzCNuWh.exe

C:\Windows\System\tugLxst.exe

C:\Windows\System\tugLxst.exe

C:\Windows\System\cRcySgx.exe

C:\Windows\System\cRcySgx.exe

C:\Windows\System\XQcokIW.exe

C:\Windows\System\XQcokIW.exe

C:\Windows\System\NOGJOYr.exe

C:\Windows\System\NOGJOYr.exe

C:\Windows\System\iArXTOS.exe

C:\Windows\System\iArXTOS.exe

C:\Windows\System\pNoWRhZ.exe

C:\Windows\System\pNoWRhZ.exe

C:\Windows\System\ISJXFbg.exe

C:\Windows\System\ISJXFbg.exe

C:\Windows\System\ZAShgOu.exe

C:\Windows\System\ZAShgOu.exe

C:\Windows\System\UmCGeUD.exe

C:\Windows\System\UmCGeUD.exe

C:\Windows\System\nuvXJvo.exe

C:\Windows\System\nuvXJvo.exe

C:\Windows\System\bUBTIij.exe

C:\Windows\System\bUBTIij.exe

C:\Windows\System\yZrqGxk.exe

C:\Windows\System\yZrqGxk.exe

C:\Windows\System\pvXRKBD.exe

C:\Windows\System\pvXRKBD.exe

C:\Windows\System\ZynZIlG.exe

C:\Windows\System\ZynZIlG.exe

C:\Windows\System\tgVccIe.exe

C:\Windows\System\tgVccIe.exe

C:\Windows\System\kUTotcW.exe

C:\Windows\System\kUTotcW.exe

C:\Windows\System\gMHqhVm.exe

C:\Windows\System\gMHqhVm.exe

C:\Windows\System\BMMstLR.exe

C:\Windows\System\BMMstLR.exe

C:\Windows\System\iGTrAhp.exe

C:\Windows\System\iGTrAhp.exe

C:\Windows\System\rsitYwk.exe

C:\Windows\System\rsitYwk.exe

C:\Windows\System\uanHrFK.exe

C:\Windows\System\uanHrFK.exe

C:\Windows\System\PJWjPlJ.exe

C:\Windows\System\PJWjPlJ.exe

C:\Windows\System\WARSFRU.exe

C:\Windows\System\WARSFRU.exe

C:\Windows\System\rhxmlwP.exe

C:\Windows\System\rhxmlwP.exe

C:\Windows\System\TWRWrSA.exe

C:\Windows\System\TWRWrSA.exe

C:\Windows\System\nqIWRJA.exe

C:\Windows\System\nqIWRJA.exe

C:\Windows\System\qKSwgfs.exe

C:\Windows\System\qKSwgfs.exe

C:\Windows\System\XLEnJxs.exe

C:\Windows\System\XLEnJxs.exe

C:\Windows\System\fUdengH.exe

C:\Windows\System\fUdengH.exe

C:\Windows\System\QJYnSaG.exe

C:\Windows\System\QJYnSaG.exe

C:\Windows\System\sgBKaxJ.exe

C:\Windows\System\sgBKaxJ.exe

C:\Windows\System\DYBmZYq.exe

C:\Windows\System\DYBmZYq.exe

C:\Windows\System\kpfjXkx.exe

C:\Windows\System\kpfjXkx.exe

C:\Windows\System\GpYoRml.exe

C:\Windows\System\GpYoRml.exe

C:\Windows\System\oHNSMYv.exe

C:\Windows\System\oHNSMYv.exe

C:\Windows\System\YZekgyj.exe

C:\Windows\System\YZekgyj.exe

C:\Windows\System\ZdzVaMZ.exe

C:\Windows\System\ZdzVaMZ.exe

C:\Windows\System\dsuKrzK.exe

C:\Windows\System\dsuKrzK.exe

C:\Windows\System\FsTuFlX.exe

C:\Windows\System\FsTuFlX.exe

C:\Windows\System\JYNWMbM.exe

C:\Windows\System\JYNWMbM.exe

C:\Windows\System\GQouBqC.exe

C:\Windows\System\GQouBqC.exe

C:\Windows\System\ejVNjlk.exe

C:\Windows\System\ejVNjlk.exe

C:\Windows\System\uQnXaUP.exe

C:\Windows\System\uQnXaUP.exe

C:\Windows\System\eazzyMS.exe

C:\Windows\System\eazzyMS.exe

C:\Windows\System\ultBzEh.exe

C:\Windows\System\ultBzEh.exe

C:\Windows\System\vzRSUGV.exe

C:\Windows\System\vzRSUGV.exe

C:\Windows\System\ClAsTsE.exe

C:\Windows\System\ClAsTsE.exe

C:\Windows\System\QkMtMPt.exe

C:\Windows\System\QkMtMPt.exe

C:\Windows\System\EneFYoA.exe

C:\Windows\System\EneFYoA.exe

C:\Windows\System\PZRKNpy.exe

C:\Windows\System\PZRKNpy.exe

C:\Windows\System\SPcrDdQ.exe

C:\Windows\System\SPcrDdQ.exe

C:\Windows\System\YJDVbfy.exe

C:\Windows\System\YJDVbfy.exe

C:\Windows\System\ecoWmSE.exe

C:\Windows\System\ecoWmSE.exe

C:\Windows\System\SvqHZld.exe

C:\Windows\System\SvqHZld.exe

C:\Windows\System\EcLyOvc.exe

C:\Windows\System\EcLyOvc.exe

C:\Windows\System\vveKwKs.exe

C:\Windows\System\vveKwKs.exe

C:\Windows\System\bXQEbZY.exe

C:\Windows\System\bXQEbZY.exe

C:\Windows\System\yOSFrIV.exe

C:\Windows\System\yOSFrIV.exe

C:\Windows\System\YMAEYeZ.exe

C:\Windows\System\YMAEYeZ.exe

C:\Windows\System\XGnuJhi.exe

C:\Windows\System\XGnuJhi.exe

C:\Windows\System\csDgTGT.exe

C:\Windows\System\csDgTGT.exe

C:\Windows\System\QNxEXkp.exe

C:\Windows\System\QNxEXkp.exe

C:\Windows\System\nReOuwO.exe

C:\Windows\System\nReOuwO.exe

C:\Windows\System\kBRBoGd.exe

C:\Windows\System\kBRBoGd.exe

C:\Windows\System\eBABINh.exe

C:\Windows\System\eBABINh.exe

C:\Windows\System\hnsJsfS.exe

C:\Windows\System\hnsJsfS.exe

C:\Windows\System\nkZjdKn.exe

C:\Windows\System\nkZjdKn.exe

C:\Windows\System\nmKexOI.exe

C:\Windows\System\nmKexOI.exe

C:\Windows\System\DxkKHYo.exe

C:\Windows\System\DxkKHYo.exe

C:\Windows\System\bdaGDsQ.exe

C:\Windows\System\bdaGDsQ.exe

C:\Windows\System\DEARRiG.exe

C:\Windows\System\DEARRiG.exe

C:\Windows\System\QweHIWJ.exe

C:\Windows\System\QweHIWJ.exe

C:\Windows\System\kXaqXOR.exe

C:\Windows\System\kXaqXOR.exe

C:\Windows\System\IdlssBB.exe

C:\Windows\System\IdlssBB.exe

C:\Windows\System\moQVofg.exe

C:\Windows\System\moQVofg.exe

C:\Windows\System\Lqndfii.exe

C:\Windows\System\Lqndfii.exe

C:\Windows\System\EehGrXP.exe

C:\Windows\System\EehGrXP.exe

C:\Windows\System\zFYNVUS.exe

C:\Windows\System\zFYNVUS.exe

C:\Windows\System\nCOigRr.exe

C:\Windows\System\nCOigRr.exe

C:\Windows\System\jPrzYNx.exe

C:\Windows\System\jPrzYNx.exe

C:\Windows\System\uYWnTBQ.exe

C:\Windows\System\uYWnTBQ.exe

C:\Windows\System\JqelGYn.exe

C:\Windows\System\JqelGYn.exe

C:\Windows\System\vmDbBIB.exe

C:\Windows\System\vmDbBIB.exe

C:\Windows\System\rWavzeM.exe

C:\Windows\System\rWavzeM.exe

C:\Windows\System\syqvJXF.exe

C:\Windows\System\syqvJXF.exe

C:\Windows\System\DHZMauP.exe

C:\Windows\System\DHZMauP.exe

C:\Windows\System\Vnjughr.exe

C:\Windows\System\Vnjughr.exe

C:\Windows\System\YAuLqka.exe

C:\Windows\System\YAuLqka.exe

C:\Windows\System\puNXNTY.exe

C:\Windows\System\puNXNTY.exe

C:\Windows\System\vEXMlrk.exe

C:\Windows\System\vEXMlrk.exe

C:\Windows\System\Vtwfjbe.exe

C:\Windows\System\Vtwfjbe.exe

C:\Windows\System\nPhvPyV.exe

C:\Windows\System\nPhvPyV.exe

C:\Windows\System\XAeQYzK.exe

C:\Windows\System\XAeQYzK.exe

C:\Windows\System\nMFUnCk.exe

C:\Windows\System\nMFUnCk.exe

C:\Windows\System\VFnSTqd.exe

C:\Windows\System\VFnSTqd.exe

C:\Windows\System\qiUmDRi.exe

C:\Windows\System\qiUmDRi.exe

C:\Windows\System\pVTMyvC.exe

C:\Windows\System\pVTMyvC.exe

C:\Windows\System\MmWhuSR.exe

C:\Windows\System\MmWhuSR.exe

C:\Windows\System\otezrlf.exe

C:\Windows\System\otezrlf.exe

C:\Windows\System\XlwMtNX.exe

C:\Windows\System\XlwMtNX.exe

C:\Windows\System\hiSLmTH.exe

C:\Windows\System\hiSLmTH.exe

C:\Windows\System\thEsFgW.exe

C:\Windows\System\thEsFgW.exe

C:\Windows\System\putuZJA.exe

C:\Windows\System\putuZJA.exe

C:\Windows\System\USvJAPd.exe

C:\Windows\System\USvJAPd.exe

C:\Windows\System\jkfRAEK.exe

C:\Windows\System\jkfRAEK.exe

C:\Windows\System\zHzlXKi.exe

C:\Windows\System\zHzlXKi.exe

C:\Windows\System\HJKRWCc.exe

C:\Windows\System\HJKRWCc.exe

C:\Windows\System\Ccbmvvs.exe

C:\Windows\System\Ccbmvvs.exe

C:\Windows\System\Grvnqir.exe

C:\Windows\System\Grvnqir.exe

C:\Windows\System\FojrzYG.exe

C:\Windows\System\FojrzYG.exe

C:\Windows\System\QYBGPDy.exe

C:\Windows\System\QYBGPDy.exe

C:\Windows\System\FAzrCGg.exe

C:\Windows\System\FAzrCGg.exe

C:\Windows\System\xgBRrNO.exe

C:\Windows\System\xgBRrNO.exe

C:\Windows\System\pHhxcHn.exe

C:\Windows\System\pHhxcHn.exe

C:\Windows\System\vBVwePq.exe

C:\Windows\System\vBVwePq.exe

C:\Windows\System\trOxcdx.exe

C:\Windows\System\trOxcdx.exe

C:\Windows\System\jEyRsow.exe

C:\Windows\System\jEyRsow.exe

C:\Windows\System\BGfPsrE.exe

C:\Windows\System\BGfPsrE.exe

C:\Windows\System\YiHLHfJ.exe

C:\Windows\System\YiHLHfJ.exe

C:\Windows\System\ZoFQqFE.exe

C:\Windows\System\ZoFQqFE.exe

C:\Windows\System\iyKGUqr.exe

C:\Windows\System\iyKGUqr.exe

C:\Windows\System\iVdLzFq.exe

C:\Windows\System\iVdLzFq.exe

C:\Windows\System\OMueTjk.exe

C:\Windows\System\OMueTjk.exe

C:\Windows\System\STxxrAs.exe

C:\Windows\System\STxxrAs.exe

C:\Windows\System\ZhxDBsk.exe

C:\Windows\System\ZhxDBsk.exe

C:\Windows\System\byDyerE.exe

C:\Windows\System\byDyerE.exe

C:\Windows\System\gYApMvv.exe

C:\Windows\System\gYApMvv.exe

C:\Windows\System\JjaYlZm.exe

C:\Windows\System\JjaYlZm.exe

C:\Windows\System\TeoSUrb.exe

C:\Windows\System\TeoSUrb.exe

C:\Windows\System\MfnUQEW.exe

C:\Windows\System\MfnUQEW.exe

C:\Windows\System\HIAQSvV.exe

C:\Windows\System\HIAQSvV.exe

C:\Windows\System\IhmQZRz.exe

C:\Windows\System\IhmQZRz.exe

C:\Windows\System\mWOcyQn.exe

C:\Windows\System\mWOcyQn.exe

C:\Windows\System\qzHrdeE.exe

C:\Windows\System\qzHrdeE.exe

C:\Windows\System\MasbTab.exe

C:\Windows\System\MasbTab.exe

C:\Windows\System\TNwCiyf.exe

C:\Windows\System\TNwCiyf.exe

C:\Windows\System\MnazVNB.exe

C:\Windows\System\MnazVNB.exe

C:\Windows\System\dpTYgEr.exe

C:\Windows\System\dpTYgEr.exe

C:\Windows\System\qpWxPiC.exe

C:\Windows\System\qpWxPiC.exe

C:\Windows\System\HMHHQDi.exe

C:\Windows\System\HMHHQDi.exe

C:\Windows\System\BaoYHUY.exe

C:\Windows\System\BaoYHUY.exe

C:\Windows\System\ZcnzKCZ.exe

C:\Windows\System\ZcnzKCZ.exe

C:\Windows\System\hvfAlHl.exe

C:\Windows\System\hvfAlHl.exe

C:\Windows\System\yCIomuM.exe

C:\Windows\System\yCIomuM.exe

C:\Windows\System\HDBbnJc.exe

C:\Windows\System\HDBbnJc.exe

C:\Windows\System\cTceLdP.exe

C:\Windows\System\cTceLdP.exe

C:\Windows\System\UWZKBdk.exe

C:\Windows\System\UWZKBdk.exe

C:\Windows\System\CwWQbsR.exe

C:\Windows\System\CwWQbsR.exe

C:\Windows\System\vPfpLOt.exe

C:\Windows\System\vPfpLOt.exe

C:\Windows\System\MNGcJNW.exe

C:\Windows\System\MNGcJNW.exe

C:\Windows\System\apQGUec.exe

C:\Windows\System\apQGUec.exe

C:\Windows\System\rbCGias.exe

C:\Windows\System\rbCGias.exe

C:\Windows\System\yZBjHVy.exe

C:\Windows\System\yZBjHVy.exe

C:\Windows\System\CMvRKDX.exe

C:\Windows\System\CMvRKDX.exe

C:\Windows\System\yUtDpGN.exe

C:\Windows\System\yUtDpGN.exe

C:\Windows\System\dRyWOLY.exe

C:\Windows\System\dRyWOLY.exe

C:\Windows\System\xktwsAF.exe

C:\Windows\System\xktwsAF.exe

C:\Windows\System\PHjXHQJ.exe

C:\Windows\System\PHjXHQJ.exe

C:\Windows\System\xSppCHU.exe

C:\Windows\System\xSppCHU.exe

C:\Windows\System\OZkfoFH.exe

C:\Windows\System\OZkfoFH.exe

C:\Windows\System\kMDFjHZ.exe

C:\Windows\System\kMDFjHZ.exe

C:\Windows\System\JCAqAjQ.exe

C:\Windows\System\JCAqAjQ.exe

C:\Windows\System\xUawltS.exe

C:\Windows\System\xUawltS.exe

C:\Windows\System\SfXLgQs.exe

C:\Windows\System\SfXLgQs.exe

C:\Windows\System\GsoIsdO.exe

C:\Windows\System\GsoIsdO.exe

C:\Windows\System\buvQCbq.exe

C:\Windows\System\buvQCbq.exe

C:\Windows\System\grDCFlD.exe

C:\Windows\System\grDCFlD.exe

C:\Windows\System\YhexAiN.exe

C:\Windows\System\YhexAiN.exe

C:\Windows\System\ozJHdzt.exe

C:\Windows\System\ozJHdzt.exe

C:\Windows\System\jJhhHAa.exe

C:\Windows\System\jJhhHAa.exe

C:\Windows\System\mVKPlXG.exe

C:\Windows\System\mVKPlXG.exe

C:\Windows\System\WgvENnh.exe

C:\Windows\System\WgvENnh.exe

C:\Windows\System\PJcicCG.exe

C:\Windows\System\PJcicCG.exe

C:\Windows\System\IhDhFNX.exe

C:\Windows\System\IhDhFNX.exe

C:\Windows\System\dCuIBbe.exe

C:\Windows\System\dCuIBbe.exe

C:\Windows\System\XDYTMAg.exe

C:\Windows\System\XDYTMAg.exe

C:\Windows\System\qYAFDvz.exe

C:\Windows\System\qYAFDvz.exe

C:\Windows\System\qjQYIAS.exe

C:\Windows\System\qjQYIAS.exe

C:\Windows\System\evsMrbI.exe

C:\Windows\System\evsMrbI.exe

C:\Windows\System\WUIkvoB.exe

C:\Windows\System\WUIkvoB.exe

C:\Windows\System\kdTGGpj.exe

C:\Windows\System\kdTGGpj.exe

C:\Windows\System\JQYOeQK.exe

C:\Windows\System\JQYOeQK.exe

C:\Windows\System\TsfdCAB.exe

C:\Windows\System\TsfdCAB.exe

C:\Windows\System\VtyYgCV.exe

C:\Windows\System\VtyYgCV.exe

C:\Windows\System\BTxEhgV.exe

C:\Windows\System\BTxEhgV.exe

C:\Windows\System\kzcIdfa.exe

C:\Windows\System\kzcIdfa.exe

C:\Windows\System\hUhVFYv.exe

C:\Windows\System\hUhVFYv.exe

C:\Windows\System\sXqUrsN.exe

C:\Windows\System\sXqUrsN.exe

C:\Windows\System\LwOszlV.exe

C:\Windows\System\LwOszlV.exe

C:\Windows\System\vEKNndP.exe

C:\Windows\System\vEKNndP.exe

C:\Windows\System\MWeIjjP.exe

C:\Windows\System\MWeIjjP.exe

C:\Windows\System\saKgSKe.exe

C:\Windows\System\saKgSKe.exe

C:\Windows\System\yekTddU.exe

C:\Windows\System\yekTddU.exe

C:\Windows\System\TqvzAFD.exe

C:\Windows\System\TqvzAFD.exe

C:\Windows\System\NBxnRaf.exe

C:\Windows\System\NBxnRaf.exe

C:\Windows\System\tqCNCxM.exe

C:\Windows\System\tqCNCxM.exe

C:\Windows\System\NZXXkvl.exe

C:\Windows\System\NZXXkvl.exe

C:\Windows\System\TRGVaas.exe

C:\Windows\System\TRGVaas.exe

C:\Windows\System\NNYkSKh.exe

C:\Windows\System\NNYkSKh.exe

C:\Windows\System\naxvYDu.exe

C:\Windows\System\naxvYDu.exe

C:\Windows\System\qpzLhsX.exe

C:\Windows\System\qpzLhsX.exe

C:\Windows\System\pVRMxYM.exe

C:\Windows\System\pVRMxYM.exe

C:\Windows\System\oqKPqIQ.exe

C:\Windows\System\oqKPqIQ.exe

C:\Windows\System\GKjxnBI.exe

C:\Windows\System\GKjxnBI.exe

C:\Windows\System\yTqAfMF.exe

C:\Windows\System\yTqAfMF.exe

C:\Windows\System\BYImBWN.exe

C:\Windows\System\BYImBWN.exe

C:\Windows\System\RykGoRy.exe

C:\Windows\System\RykGoRy.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp

Files

memory/3196-0-0x00007FF6B7540000-0x00007FF6B7932000-memory.dmp

memory/3196-1-0x000001999B290000-0x000001999B2A0000-memory.dmp

C:\Windows\System\ZzTCIKe.exe

MD5	3f0403641127f8394af10bce78075d4f
SHA1	5a99efb011dd3e78014b79c90c2ac0b4e719fb9f
SHA256	4d50172c6a6100db4cbc9e2a2fdefb22bf634f349ea9ec8a3ee830ce0f6f4134
SHA512	1a0abe95945edc65c407dd659a61b0bc4f586a19c67b25ae31dea39d2050a8a1f1536aa153710a50771e4c26c40d85566ca29eb800e9cce36e32d445932a006c

memory/3936-6-0x00007FF96DF73000-0x00007FF96DF75000-memory.dmp

C:\Windows\System\IbstkDM.exe

MD5	3f6d92230e61e8290681a42d946c8f62
SHA1	5ae4a1f3e6da7add2364ec5af16686ac565c4e60
SHA256	5c004cb23b6b6033b2aa4e71bc3b5504d63cfc9e8729c28f04264888766bb34e
SHA512	7213f8373c78f20973a9448cd34ac14c307301ccaf94be87c5788c6479d0941d76b62b36ce22999945ab0f4b1c02518b27e7fb7608c95a8a2197a5782582e36b

C:\Windows\System\dTMYTPA.exe

MD5	723e521b5a221ad127a540b518d7b8cf
SHA1	71e5d330ffd198512aaa1ff9c3503d618714dc39
SHA256	10a828a3b2ebc63fa966e7c79e79a33fef8513ebc562849917177c57669ac8b1
SHA512	5c199dda1b7bb41db6992c5101fbc674beb7d5c8d0d113d0a5b09c5f6ba153033c5c63423fd31498faa84d756dc8bb55174b7f2365e44477cfa4732c39072618

C:\Windows\System\ZYgChQx.exe

MD5	b1fe350819f53913b0233ea4d5d0352d
SHA1	d0d846b667ca5442603655b49b2a78bfc2d5fd69
SHA256	6a70b94c71ac0d69a189ec6e7f4a2656a959ebafcd62148acaaba1206a01a3c7
SHA512	5fe25a0d6a2353380c6ac8ff5550a532d4b430614afdf359e2323dffbf76c151e8e7d7987952fb3fbfe681ed94e6ec93991414b4a1be8b03b4a050f954ce3fee

C:\Windows\System\GvlHyam.exe

MD5	7b0eb3a0469cff25558bc841e2c9a335
SHA1	5002363d3b37a9cec4e75d0aac89a8730ee6b79d
SHA256	386caae6aaf807066c0d914818676b2ef1847db3b54bf61252c9f910cd5ed7e8
SHA512	3827be2e7fcf85d24bb14e9526f434877666828c28b5c242bebdb42278db3be66ee8b0d5aafc051c460014f9bf08a7254821e6a066aaaeff1eb260be0e033afd

C:\Windows\System\nRIGpQo.exe

MD5	7bbd520e7bf893404dac6c0187650e9d
SHA1	6ae43eb78d8d887b936849888446b1006d85a69f
SHA256	87fcfc96a266970f1fa1249a436ddfc8b57fe5d4c7c666c8d09e521b6d26908d
SHA512	208d13eb55ace50052001e085e599351851900be2923070a0fd0259a25701ba7649bb4a0ab1418be657f73f240837aa24b1c05412ddc3eddf78f4bf0dae87903

memory/4152-516-0x00007FF6D69E0000-0x00007FF6D6DD2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_euyx0ork.mxf.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3224-958-0x00007FF629190000-0x00007FF629582000-memory.dmp

memory/3936-2446-0x00007FF96DF70000-0x00007FF96EA31000-memory.dmp

memory/3148-1313-0x00007FF62DA60000-0x00007FF62DE52000-memory.dmp

memory/2396-1310-0x00007FF768B80000-0x00007FF768F72000-memory.dmp

memory/3144-1307-0x00007FF78CE80000-0x00007FF78D272000-memory.dmp

memory/3404-1141-0x00007FF637020000-0x00007FF637412000-memory.dmp

memory/1580-1138-0x00007FF61C340000-0x00007FF61C732000-memory.dmp

memory/1572-1133-0x00007FF78FA90000-0x00007FF78FE82000-memory.dmp

memory/1792-1031-0x00007FF6CFDD0000-0x00007FF6D01C2000-memory.dmp

memory/1084-1026-0x00007FF636930000-0x00007FF636D22000-memory.dmp

memory/3936-739-0x0000028320850000-0x0000028320872000-memory.dmp

memory/3984-660-0x00007FF71E770000-0x00007FF71EB62000-memory.dmp

memory/376-521-0x00007FF6618A0000-0x00007FF661C92000-memory.dmp

memory/3936-360-0x00007FF96DF70000-0x00007FF96EA31000-memory.dmp

C:\Windows\System\hYjnhll.exe

MD5	20bb26bcb62d06aee03ba16869dd0686
SHA1	e49bcaafc295d166929a26a1d5bb25aa7b55e4aa
SHA256	a1e32a05118d993b8368e69aa5941bffd1225c3b9570afbbb4850c2f2a4e7173
SHA512	99a36aef62f71b45e58e4161c6297940f662003f5197ffbe10ffa13e5b04e99e788429aeb90f1520ef7227de09f713925683a8d1d9491a16f6ddbce17b795abb

C:\Windows\System\jCLAwtK.exe

MD5	2a32d39ae51fe16390eef68aef02bdd8
SHA1	9964d7c65bd7f2bec81cfaaf0c6ef685cdb49949
SHA256	c23019365389a1c6680a47d74295beecb23dcf5190f103d1ffb4f5883ddd116f
SHA512	f6c17bccad841fa84cf45ff450c21e3b3a2f1bd4c864ea59b66546ba52287829068859749ac355b8c872cf1606bf722ed1cc5932110374d5c58eb284d66da300

C:\Windows\System\lZrQqHL.exe

MD5	110f863450d995b9962ae202d88249cf
SHA1	fd8168ea93b9ee13363a5ffed4b290b0293f7512
SHA256	d2ca76f5e20e6390612b3ffd1c0a9200303e667f6a73be01d959ac621837fda2
SHA512	a9a0be00f6d1e0a0750821d8f7abf5f0ab4b9a2b426be80d2dbb12dac423bbabb7fe1d88b567cab2c2128067e30d3ded5cba7aa0b6071d15841fce83d017361a

C:\Windows\System\mHSEuxW.exe

MD5	b57885542e534b7abde20fd56edf1a52
SHA1	494361b3d50304cb78d97ae5b7b22bdee2f4ab5a
SHA256	847966498890bccfaa33b931d7d4b204820758cf385da5fb067a297b65929455
SHA512	2dfe606c4e816af554f1258c22cccaf08cf4daa904662733cf3dfd31c2d70826b240cbd4c0c33f0ad97a9da49bffb5283144b53f185aac08b507085ad4f89b66

C:\Windows\System\ddigMuQ.exe

MD5	7d44a4efdb8a0c55b2ffb8ea4711f8f7
SHA1	740630afca2e72b989b9ed6bc8325ff6917a3cfc
SHA256	e5bf3ab353304f0954faea28ba368ea4edbdf9954c9e3000b3c85f5771815521
SHA512	c33663985abb10d7258a52441d92f214f14d17203cdbb22e7b26ffaa01932f40fe9c29fc6febd2fd0019e90f81dfbd91262cd5b907f0319babe97f91ff7f145c

C:\Windows\System\DQphVEU.exe

MD5	da18d933ae010427d416d1dd669cb759
SHA1	edf66e0ca00674bfd7b814585e4763a929437ea9
SHA256	4f539ceb52e570b1fbf1da12eda205b7184b5037c52e9f1cd6d0fbaae8e428f5
SHA512	044be5f725657b98805151bb607afaaf78fe7170e8a3fff382124a4c1164bbc0813fd2b1e2a128f42ea4cb5eca70a6c4cfb4b33de4d5f59fb1a842ae649028bf

C:\Windows\System\zPxPywC.exe

MD5	c791834d85d826688bc17a0b3098397d
SHA1	1456b7d17fd0e9064fe32c156b986beebabedd8d
SHA256	7eb6b8e32401e7aeff6e8f9013e1b23e5dd72763a51482e6b346127cfac61d32
SHA512	20501f3365fde938f95ac656c563279197821f09cd2c44721a086ffd51627e80add103b61d46d156b5ddc58f4c80792f75777f24a5dd1c1aac9823f5cd9e53df

C:\Windows\System\FHDYYJA.exe

MD5	15f6a18c75a853b640eb564e0caf6e0c
SHA1	38aaadc196eb7db9c981f973df4122eb2c07376d
SHA256	baca34ae95568bf52449a838ec7b1a4d02c8f52d5a55743816c83b6b9d94fe49
SHA512	3d49eff84d705e45e93624f1378b7b9e31bff8e7281a0db22b7708abef12875cfcedd0d8ba008ff5b327d1e9c71a15ab2a795bd3915bd91e3f33ac444689d768

C:\Windows\System\RAbgCfj.exe

MD5	9357ce6ede8b7eb13b05d9787d5d9bbb
SHA1	956c27dadae4c086eb62f997ce7d03a7f4aa4d75
SHA256	542140ce78881222346babc10b532f6e01307479cee00ae473831b286610cefa
SHA512	8e5e7b8dc7c61ab32467d9a8be89dc5ef9e3866416c5801d7f571647426011d06bc8c410da7cbe9889e3b758e027aafe7617f30d09051874f7b1d4a96a446a74

C:\Windows\System\MCpLvQc.exe

MD5	92fb47a047419d92675d155fe5875c2e
SHA1	09a6889326fed6665ca9139d570573381a76f6ae
SHA256	4feacfd6b8e9e0aa8dc13b67944628b072a5cf379a34a4bfd6378725fd4e5c65
SHA512	ec31aeb6b0dc9403d9ed512eff051bd5eb6b1eaa144af1524a55fa031bbef4a64eb169525ef912ab97a5942487f8a58baeeebd1d1225f0f17a4c4c38e105f9d1

C:\Windows\System\JzvGGjW.exe

MD5	345d89e6e7173ab3cb6fc609ef202915
SHA1	7dd760c60ec91d3163061d459f093f62aa65a29d
SHA256	45ba990253b356de56ad992bd36363f7e5b727453a1e1d65e33b853c5e55e7b7
SHA512	9e4732dcf9626a5f4eb0619aeb59b93b858c55c11603f72712901fc1c105aedd2b34c4988fc62619d92d9d224daa8c3677a617d93735b91e1701c3bedbbd5f79

C:\Windows\System\TYTgykB.exe

MD5	a0c3e0837337c62b2cdb32f84c0563cf
SHA1	fdfe64c440e3d256e4e5be59ccab1e356261a1df
SHA256	abf515d114930ef5ef64b9e1d308457764b74b93eb54301a2188a0fa9c897363
SHA512	afb03e2d3750f44536b2fcb34e56d47639be2470e8464607fb451e7d5ca9fb3fdac7f329ca58a5d089bbe73646bbae5090c46a06f026817d643ebdf0180cce08

C:\Windows\System\GeJNGHe.exe

MD5	2366b735424bf01c902b8f09bf580123
SHA1	8c4d5265a740a2822522eb785364b54b36a82f9d
SHA256	8b0bd8c8f9640ac053a1037b7fc9521e65d95f4cca5f069403934ff0b31afb74
SHA512	87646fcec68b454632b9e1b0863d1353ba53f3e417136ae2fc0076ee64fba831035396347107e1e9d268ef6d1acacc49e4108fb454c56eba09543b8e874db57e

C:\Windows\System\xUojPvu.exe

MD5	411d55b938b2f91ec4df90e33143963e
SHA1	bfde02408042ed1a55eaf987550e627869cd3bbb
SHA256	f63f188cfa286699d9211ce2d50d8e8fbc4a3cb48101119cc5ad16d35677713b
SHA512	30a5fcf2378b8e5540cb689a87ab63d627da9e1ed94ae4c8b18d876c7ddecf07b303889ed0cfe0c951816e3f378dbcedec14dff7d7ab0d2067391227fd2512d6

C:\Windows\System\sAOKKJL.exe

MD5	bbf9dd95cc624c1266055fa63bd1c754
SHA1	d3397ecb4a2d0b538db30a4cd0f4468587d59439
SHA256	b9306a75fec9e822490e8dea15c88b72ded8d4a83507a1463ed3d5cede67c6b4
SHA512	1b2aad2e268216b38382a81c4048c1eb200fb6399c977b512ce0a334448c9dad63e907da5eed8bcafddb630fc4a13a5e5b2669db15612a4546110d121afc85b7

C:\Windows\System\gOCMQqq.exe

MD5	e5a8852ada45bdb7513bbda1d6c9b238
SHA1	ac44a0e9bbcf30a5eba6587bb739a310d080f993
SHA256	17e798f9ea2732d6031056848a138cee6fa673e4b813ed1faa20cbf17f633982
SHA512	e90a529816e7cb69d578f3823e8ff2a040515065492c706d667ad4915911e250eced86e78aa0c7496d7d5b73a4b262bf5ec5d7a6f57d87a5d22daa9c34760e2b

C:\Windows\System\uxdLYfa.exe

MD5	6232a969990a3601dc74b9da4988040a
SHA1	3d4aab200b21ecbf2bf439d8844d4718058e3c65
SHA256	66bb435f9f5b1a4038851c8e91c8ffdc936f3c27430238b0d6d1115540a12fb2
SHA512	82ced0d7c17976cb59abc293b5c12505128b3164ab4db19a9a51a7d146e36b968224ef1296a6f5c98dc5eee9e0d00408205864b44c5eefe2c8eb0d6d1bcb04ad

C:\Windows\System\dqtJeKy.exe

MD5	57e0b4d30182f0e7a537fbbfa61386d6
SHA1	0ef3551e23c609adff7426fb6063a7b53e4b53f3
SHA256	b5a00c6453d1a8e8efd53fb2cd75439dde8d56171d60d4417674c3fe3bc04946
SHA512	6ec6131d152bc5ea3db8ac271ebf8fd17958bb95c2dc9d6398ae11b762b9e43072e65d6d84d32cd8d924b494594aa1f6139a43f9118ffe5dbc76486ebd92c839

C:\Windows\System\dslOJXF.exe

MD5	3d5b70f204198f5900367349a155a33d
SHA1	72a03b5b8fa5b8f61aaf7f46335723300ab79dc4
SHA256	40df5c1db21f8cd34f47fb52ae9af0411099c25a047e7f1f4f053120b720ae68
SHA512	1bd65001b17d5596e807ceb3f1333ff588658c6dec1e0f8bcf691517d10ffc0b2a80a98d6f283c6f5c2bacc1c5b12e289eeb657fda7d0b4d0baa16272eb5377d

memory/1132-131-0x00007FF6DF840000-0x00007FF6DFC32000-memory.dmp

C:\Windows\System\VyjOOZY.exe

MD5	934390beeb8ec8c15e6bb6c72e1a8e15
SHA1	5b2a68b8c473985eb25429cf85a6480231798242
SHA256	68b6c245389ee2b3a3d1992f1b920d1ceeeddfef1d7a6c1b3e792cdfb82ca530
SHA512	64c5fe317be928e19b02949e3ccdccdbdaa77aa30faa051ca39304c47fdd9e391bc619806623f49a437212f7d80c07dc4c9f1a5a9906d065291638d61fe94ab4

C:\Windows\System\gxjrxdM.exe

MD5	499848c92b714a8a6685f4cb27af0be0
SHA1	301e37a3d224b0d23143a2d6afeb14fbacf62db6
SHA256	c187b2a3c3f9f65f13d45da09b6f299f2e6c605852752f02663fcbccf4828344
SHA512	4713fd06cdc98924cdc726d9a7cdf50e7b3b7821218e22a5fc29ba2311ed0b6fb96a0c31eaa6b94b7ffda4ef8a3be17354989b8ac355dd60c6f9777fa4cac9bd

C:\Windows\System\LbhaDQT.exe

MD5	940048232f39946f9b173c40fc6f7746
SHA1	2b4717c89a8129c029358a3260d675a4a13d964b
SHA256	ef0254fef2f4aa0d24bebce485fd294f5f7161e55d34b0915e164a3dd1efed71
SHA512	162f5688bfb265292de0df08a8a2e9bee121cb917b916c9c2da3bc7d139eff8abe0adcfdfdf7c88a1c129f12ee923e2332ec063962c3e9989569235a83ca61f7

C:\Windows\System\SnAXHUt.exe

MD5	94317e01828619b74ddabd855c5e552c
SHA1	c72b006fb3cbf291eee4c540d3c7f373930db1f2
SHA256	f221dd890e942af3847968595beefed1d21e2b2487903ee9d3942918e6f2bf04
SHA512	bf1fcce9e893ad63182cfbdaa3bdc4f4458372f14e4261e487c88d7484d9945ab791374a098ff835b48244b29b20d58deec84ccae665dddee8af141e7d712b7e

C:\Windows\System\rOtbnfP.exe

MD5	3edbae3a2a14345d76df715243d70ebb
SHA1	cefda84f27127b4ddd538067432730f6536f4a6a
SHA256	a8b60ec1ab8a15ee8f320565a242dbfa16f5b5218beb15454115ad27ab8dcbf2
SHA512	c656f7132e85185b8ef23045b663451eecc66a6e20a07202184119939e1cd58446aebaa9de4746e3bf9e8094c6cf10ac8d5cf3cc52ba6b74f3b979d859cb95a7

C:\Windows\System\BacNnSx.exe

MD5	8a6bdb72452475edcbad5da8c2e6bc37
SHA1	6da623a9acce23d6b0b7c16df2c6c02810d7720f
SHA256	81be96cc785d2275a4d562d5897c7b8bc2964016477548d3b5b343582ae2f74e
SHA512	a4c330dd4536300b696f1cef04a617d3b9ef1c147b843bb2898c3c8cbe0dce1e46bd0f1cf941a4dfb863951ceec083e45d26b7814aa3630f5f7f97439b63989e

C:\Windows\System\BUsJzOq.exe

MD5	12325c4016c9ed8950aadd55d1ea8b59
SHA1	0305b28faf9c025d89bee95f733b3bd1c6bf1503
SHA256	d3a133029aa25172b11b74c5ef5e165d5a0888f633819a57b616c0ccbc548d26
SHA512	07b0ef917883fa396325ebe3dbe03ff4da7136036cb6f9bb4c1b7df6c61fb98ae128edc075a0078a94526182b9af7256d543343932b27662ee1ce529c34fdfc8

C:\Windows\System\zWUxqeZ.exe

MD5	58f2ced25f4fa59af1be01e4efeaa6f8
SHA1	02d4232ad9b406aae4a96ff46cb8df68b0b1633b
SHA256	72c2c9673d540c1747857d2e0eb998db11239e66fc05744a395d653d1f8164ce
SHA512	ce12bbe5eb9e7dd0f0ed406d0ec38c660fd46538cdf2bf8af175c72a3b2edff87f377982c8df9d8c2310cca4bd02a4c3c0e83bc2f79b375be897b7a27b6b0738

C:\Windows\System\JAeyWGb.exe

MD5	87fd113697c978269d4a8629b507712c
SHA1	a42f3f069f9e1790a3e063c156cae289adcbb5db
SHA256	238fb2bb88f2030103b7c6155bda58e0b1908cea3d0d59a60eac9d6da1095fe2
SHA512	675cdd25bc5d63ed3164088a57f2f0be8f236abc437a1692de471819515a221a7f66240939f3777d8192e1dbb879dd57ed1e239970852229c2d138c23adb603c

memory/3852-89-0x00007FF658640000-0x00007FF658A32000-memory.dmp

C:\Windows\System\jxrsJbq.exe

MD5	54a93b19df05a17b0ca0d3443fce8bf1
SHA1	08f131d0ad31c745a1dc4f385f4b3d8637843743
SHA256	032619549e7e2a88d9c3a694a188367626b2773de4e58d5e07fc3d21c8566b31
SHA512	394f3182f2ebfe0c3f2777863bf6383a06e89598d1129270a56bd57fb3f602fbad43a212ec05f7475f61b5820f12263f1c13787ad7634b241aa8d4380d5a935a

C:\Windows\System\dYBJskA.exe

MD5	8d167945cf49c10346158679686e911b
SHA1	ea731523eeaabaa280598e7b1e3c7ba411084c7b
SHA256	1731fba942eba49cf6e95cb1d1d03318870489423e276a2f787ca2654b6e04eb
SHA512	64d434128774da7112e975afff2995a707429d297dc71e63bd2d71dafa474a18acca1c7e6ac38d5b9f70aaf83e8e12011a27b136baa5e8656abf3ec1547a0677

C:\Windows\System\CNUagbs.exe

MD5	8ba0ffef89645ac4813643150781f8c2
SHA1	ff66e2af0c3d9b6eda7f0c2f69e20a1dc366b435
SHA256	6d284706ef5aab0006f8f17e0d58d10a8d4afd57947a5a135197582593e57f36
SHA512	beda6e7693e76cc6681d59beccf29cab68f8b6ad75ff195f4d6cef952ad536e9fccfa3567ba4e7ac6294760ed95b41a6c7bf08b39bcc1aa1adf15a3915c0ba47

C:\Windows\System\RrTYKxH.exe

MD5	d11121a1df14f8ca9f4b980bc903f6ca
SHA1	25cff13dcbe97b3337457ed225289da536d95b17
SHA256	6b372d7858d6f2b1a41873aef6d4c57a8f24b93ac49d022095738d8031fe645f
SHA512	a1e0c93a098ff079ee8e79a4af3c452f6d2f1d972a5aaf4451bc5e73eea6acbef761bbf1420930a8d58fae78b3240e6a6707f4ff577e2d094a7e7010437ed65b

C:\Windows\System\mEItMWw.exe

MD5	de283ff7362652caef32bddbbbac2b3e
SHA1	6acf5df21906727c1d4d922f8d82c8b0fbb69505
SHA256	d89140aae06ec94490ea5523e9a42b2d4ef6a791c04981c668fb8c52cf0c4657
SHA512	80a2e02380979e16ed911e4c001edefdb0c05b56fd137634b0fe1074d93c05d04bf117fa17323c209d1c375583922ec88e13bcc26db38afbccc2ad07bfa007c8

memory/3552-46-0x00007FF7A5920000-0x00007FF7A5D12000-memory.dmp

memory/4384-45-0x00007FF7872C0000-0x00007FF7876B2000-memory.dmp

C:\Windows\System\QnDutaO.exe

MD5	cf355ea86154d618bc2118a2c4a0ab59
SHA1	21a27e06019d224db49004e90de13421ebe3fc6a
SHA256	0878c1e1423889b5b703365b4e25ea4b126c8ad8c770f2ad9ec0ebdc707da605
SHA512	3520490ae9201081d2db2277533eac40f140deb5703df3ac579ac35a4aa8e8df22f87fed758871576f4b3cb78664e362ff7792469538b83d21f09e581713afef

C:\Windows\System\ntgixZI.exe

MD5	c00364473fd4613869f1bffb6c405e46
SHA1	3d6e3e6b467a58156d6725e330234acaa6c01bdc
SHA256	a0655d5fc1707014d1bed5cfebee9da269ba88c7454eb5a8c78c19dfbc7bca3f
SHA512	20408e08f4aabf75fe537731c5b4718919e3cbef26edaabfd31d360d110fdb4d00866bcc8dcaa3f16aa403ab3a569a7b5d96df3f795c765b2c99ff51fd4b6013

memory/2584-20-0x00007FF75E140000-0x00007FF75E532000-memory.dmp

memory/4384-5276-0x00007FF7872C0000-0x00007FF7876B2000-memory.dmp

memory/3852-5277-0x00007FF658640000-0x00007FF658A32000-memory.dmp

memory/4384-6092-0x00007FF7872C0000-0x00007FF7876B2000-memory.dmp

memory/1792-6300-0x00007FF6CFDD0000-0x00007FF6D01C2000-memory.dmp

memory/3552-6284-0x00007FF7A5920000-0x00007FF7A5D12000-memory.dmp

memory/3984-6302-0x00007FF71E770000-0x00007FF71EB62000-memory.dmp

memory/3552-6219-0x00007FF7A5920000-0x00007FF7A5D12000-memory.dmp

memory/2396-6340-0x00007FF768B80000-0x00007FF768F72000-memory.dmp

memory/3224-6358-0x00007FF629190000-0x00007FF629582000-memory.dmp

memory/376-6348-0x00007FF6618A0000-0x00007FF661C92000-memory.dmp

memory/1572-6365-0x00007FF78FA90000-0x00007FF78FE82000-memory.dmp

memory/1580-6336-0x00007FF61C340000-0x00007FF61C732000-memory.dmp

memory/3404-6338-0x00007FF637020000-0x00007FF637412000-memory.dmp

memory/1084-6415-0x00007FF636930000-0x00007FF636D22000-memory.dmp

memory/3144-6449-0x00007FF78CE80000-0x00007FF78D272000-memory.dmp

Sample ID	240613-qha5jsvanp
Target	7f0dfac8f6306e3c641d43807b8d4320_NeikiAnalytics.exe
SHA256	9e7d612e6b8e49549f3c423699cbdac31ee287b2c68f2e47351527fc178bfc57
Tags	upx miner xmrig execution

Malware Analysis Report

2024-07-28 19:55

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files