Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\ksWeQPA.exe	N/A
N/A	N/A	C:\Windows\System\GlMaiHe.exe	N/A
N/A	N/A	C:\Windows\System\xLWdtQc.exe	N/A
N/A	N/A	C:\Windows\System\SstjXIM.exe	N/A
N/A	N/A	C:\Windows\System\BaeEOwe.exe	N/A
N/A	N/A	C:\Windows\System\EguowWa.exe	N/A
N/A	N/A	C:\Windows\System\doKGVMY.exe	N/A
N/A	N/A	C:\Windows\System\hShVOxi.exe	N/A
N/A	N/A	C:\Windows\System\DofsACL.exe	N/A
N/A	N/A	C:\Windows\System\JUwoHRn.exe	N/A
N/A	N/A	C:\Windows\System\bfUiCoa.exe	N/A
N/A	N/A	C:\Windows\System\WkzXSHw.exe	N/A
N/A	N/A	C:\Windows\System\YiQKUcm.exe	N/A
N/A	N/A	C:\Windows\System\KNEqpjN.exe	N/A
N/A	N/A	C:\Windows\System\dXdrDQk.exe	N/A
N/A	N/A	C:\Windows\System\XrFBeFp.exe	N/A
N/A	N/A	C:\Windows\System\dBgjllL.exe	N/A
N/A	N/A	C:\Windows\System\iZNUyNi.exe	N/A
N/A	N/A	C:\Windows\System\DUKtYQz.exe	N/A
N/A	N/A	C:\Windows\System\bDlegDA.exe	N/A
N/A	N/A	C:\Windows\System\JAaygSw.exe	N/A
N/A	N/A	C:\Windows\System\PFahWMq.exe	N/A
N/A	N/A	C:\Windows\System\wJRkMwN.exe	N/A
N/A	N/A	C:\Windows\System\XqhTAox.exe	N/A
N/A	N/A	C:\Windows\System\sRMvAyq.exe	N/A
N/A	N/A	C:\Windows\System\sNqxdqp.exe	N/A
N/A	N/A	C:\Windows\System\HayxfKy.exe	N/A
N/A	N/A	C:\Windows\System\dDVdEdb.exe	N/A
N/A	N/A	C:\Windows\System\KOuyRnK.exe	N/A
N/A	N/A	C:\Windows\System\HjAWYqe.exe	N/A
N/A	N/A	C:\Windows\System\JnOxzJa.exe	N/A
N/A	N/A	C:\Windows\System\laHuznO.exe	N/A
N/A	N/A	C:\Windows\System\cmqwqhz.exe	N/A
N/A	N/A	C:\Windows\System\vSGBRXF.exe	N/A
N/A	N/A	C:\Windows\System\olqdXJf.exe	N/A
N/A	N/A	C:\Windows\System\UPoBbte.exe	N/A
N/A	N/A	C:\Windows\System\OzzWWTt.exe	N/A
N/A	N/A	C:\Windows\System\AdIATpH.exe	N/A
N/A	N/A	C:\Windows\System\vOlKjyt.exe	N/A
N/A	N/A	C:\Windows\System\YtLUbIb.exe	N/A
N/A	N/A	C:\Windows\System\sXbAEKr.exe	N/A
N/A	N/A	C:\Windows\System\SKoiCMz.exe	N/A
N/A	N/A	C:\Windows\System\cfkpHyU.exe	N/A
N/A	N/A	C:\Windows\System\ASSKWoy.exe	N/A
N/A	N/A	C:\Windows\System\UwnrZhd.exe	N/A
N/A	N/A	C:\Windows\System\IKrlJTu.exe	N/A
N/A	N/A	C:\Windows\System\FkzgzXZ.exe	N/A
N/A	N/A	C:\Windows\System\VEHcOSZ.exe	N/A
N/A	N/A	C:\Windows\System\fJxFWag.exe	N/A
N/A	N/A	C:\Windows\System\SPfPQDh.exe	N/A
N/A	N/A	C:\Windows\System\KvPFgoF.exe	N/A
N/A	N/A	C:\Windows\System\UFzlIPf.exe	N/A
N/A	N/A	C:\Windows\System\jhTKJrB.exe	N/A
N/A	N/A	C:\Windows\System\tJHVDff.exe	N/A
N/A	N/A	C:\Windows\System\BnPxtdp.exe	N/A
N/A	N/A	C:\Windows\System\hjmVEhb.exe	N/A
N/A	N/A	C:\Windows\System\UxMqcqC.exe	N/A
N/A	N/A	C:\Windows\System\mtukJQg.exe	N/A
N/A	N/A	C:\Windows\System\TRtneyf.exe	N/A
N/A	N/A	C:\Windows\System\NojcXhe.exe	N/A
N/A	N/A	C:\Windows\System\yUNHIvO.exe	N/A
N/A	N/A	C:\Windows\System\IRtCgXI.exe	N/A
N/A	N/A	C:\Windows\System\ZCEYfaw.exe	N/A
N/A	N/A	C:\Windows\System\wVZJZNt.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\TTiFIAK.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QAhPJAT.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iVDVgme.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gGoOXyE.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TJPgRmO.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FygOTxw.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NTXGFZa.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\moDzdXG.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BaGpmfs.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xHdbciY.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oIXCBAs.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TaUnRpm.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MEGdxJN.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BryKmzI.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GMsDXsC.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BDRDHgc.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hEUTZdE.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dkxBlre.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\teNPyTc.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hdcIhvK.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dFRLUhj.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VJsLEcJ.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\onswfNL.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TbDvrmD.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZrtaUpo.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fqFmYuh.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JkgGNYH.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ddXEIxo.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LkCVhoE.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wotCGtd.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dVTsnQv.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BlxpmSM.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SoChHHM.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UeJimHC.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UKarVau.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cjsDQIF.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UtgeUTN.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DgtcfjN.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VwkiGbj.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ryuYocv.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZlpjOmk.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FIPjqPF.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KjzBqkX.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qpEwhtV.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FGiRsqQ.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vxYTcwR.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\htZenPM.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uZxoEpo.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nbLWypl.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VppYOnu.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WkYxeHl.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZHVKlma.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NNbcEDG.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qmZsDfJ.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GURcDZs.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BWEgmjp.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HmqmCiz.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hHYFszy.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aVwXjlD.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oCyoOpT.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EyAwcfD.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eMSQOSd.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JUwoHRn.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YiQKUcm.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2248 wrote to memory of 1420	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 1420	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 1420	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 2352	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\ksWeQPA.exe
PID 2248 wrote to memory of 2352	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\ksWeQPA.exe
PID 2248 wrote to memory of 2352	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\ksWeQPA.exe
PID 2248 wrote to memory of 1760	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\GlMaiHe.exe
PID 2248 wrote to memory of 1760	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\GlMaiHe.exe
PID 2248 wrote to memory of 1760	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\GlMaiHe.exe
PID 2248 wrote to memory of 2736	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\xLWdtQc.exe
PID 2248 wrote to memory of 2736	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\xLWdtQc.exe
PID 2248 wrote to memory of 2736	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\xLWdtQc.exe
PID 2248 wrote to memory of 2676	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\BaeEOwe.exe
PID 2248 wrote to memory of 2676	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\BaeEOwe.exe
PID 2248 wrote to memory of 2676	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\BaeEOwe.exe
PID 2248 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\SstjXIM.exe
PID 2248 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\SstjXIM.exe
PID 2248 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\SstjXIM.exe
PID 2248 wrote to memory of 2604	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\EguowWa.exe
PID 2248 wrote to memory of 2604	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\EguowWa.exe
PID 2248 wrote to memory of 2604	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\EguowWa.exe
PID 2248 wrote to memory of 2524	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\doKGVMY.exe
PID 2248 wrote to memory of 2524	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\doKGVMY.exe
PID 2248 wrote to memory of 2524	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\doKGVMY.exe
PID 2248 wrote to memory of 2224	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\hShVOxi.exe
PID 2248 wrote to memory of 2224	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\hShVOxi.exe
PID 2248 wrote to memory of 2224	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\hShVOxi.exe
PID 2248 wrote to memory of 1040	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\DofsACL.exe
PID 2248 wrote to memory of 1040	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\DofsACL.exe
PID 2248 wrote to memory of 1040	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\DofsACL.exe
PID 2248 wrote to memory of 3044	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\JUwoHRn.exe
PID 2248 wrote to memory of 3044	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\JUwoHRn.exe
PID 2248 wrote to memory of 3044	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\JUwoHRn.exe
PID 2248 wrote to memory of 1732	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\bfUiCoa.exe
PID 2248 wrote to memory of 1732	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\bfUiCoa.exe
PID 2248 wrote to memory of 1732	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\bfUiCoa.exe
PID 2248 wrote to memory of 584	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\KNEqpjN.exe
PID 2248 wrote to memory of 584	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\KNEqpjN.exe
PID 2248 wrote to memory of 584	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\KNEqpjN.exe
PID 2248 wrote to memory of 1148	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\WkzXSHw.exe
PID 2248 wrote to memory of 1148	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\WkzXSHw.exe
PID 2248 wrote to memory of 1148	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\WkzXSHw.exe
PID 2248 wrote to memory of 1428	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\dXdrDQk.exe
PID 2248 wrote to memory of 1428	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\dXdrDQk.exe
PID 2248 wrote to memory of 1428	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\dXdrDQk.exe
PID 2248 wrote to memory of 1528	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\YiQKUcm.exe
PID 2248 wrote to memory of 1528	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\YiQKUcm.exe
PID 2248 wrote to memory of 1528	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\YiQKUcm.exe
PID 2248 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\XrFBeFp.exe
PID 2248 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\XrFBeFp.exe
PID 2248 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\XrFBeFp.exe
PID 2248 wrote to memory of 2904	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\dBgjllL.exe
PID 2248 wrote to memory of 2904	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\dBgjllL.exe
PID 2248 wrote to memory of 2904	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\dBgjllL.exe
PID 2248 wrote to memory of 2532	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\iZNUyNi.exe
PID 2248 wrote to memory of 2532	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\iZNUyNi.exe
PID 2248 wrote to memory of 2532	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\iZNUyNi.exe
PID 2248 wrote to memory of 924	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\DUKtYQz.exe
PID 2248 wrote to memory of 924	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\DUKtYQz.exe
PID 2248 wrote to memory of 924	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\DUKtYQz.exe
PID 2248 wrote to memory of 1124	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\bDlegDA.exe
PID 2248 wrote to memory of 1124	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\bDlegDA.exe
PID 2248 wrote to memory of 1124	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\bDlegDA.exe
PID 2248 wrote to memory of 1992	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\JAaygSw.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\ksWeQPA.exe

C:\Windows\System\ksWeQPA.exe

C:\Windows\System\GlMaiHe.exe

C:\Windows\System\GlMaiHe.exe

C:\Windows\System\xLWdtQc.exe

C:\Windows\System\xLWdtQc.exe

C:\Windows\System\BaeEOwe.exe

C:\Windows\System\BaeEOwe.exe

C:\Windows\System\SstjXIM.exe

C:\Windows\System\SstjXIM.exe

C:\Windows\System\EguowWa.exe

C:\Windows\System\EguowWa.exe

C:\Windows\System\doKGVMY.exe

C:\Windows\System\doKGVMY.exe

C:\Windows\System\hShVOxi.exe

C:\Windows\System\hShVOxi.exe

C:\Windows\System\DofsACL.exe

C:\Windows\System\DofsACL.exe

C:\Windows\System\JUwoHRn.exe

C:\Windows\System\JUwoHRn.exe

C:\Windows\System\bfUiCoa.exe

C:\Windows\System\bfUiCoa.exe

C:\Windows\System\KNEqpjN.exe

C:\Windows\System\KNEqpjN.exe

C:\Windows\System\WkzXSHw.exe

C:\Windows\System\WkzXSHw.exe

C:\Windows\System\dXdrDQk.exe

C:\Windows\System\dXdrDQk.exe

C:\Windows\System\YiQKUcm.exe

C:\Windows\System\YiQKUcm.exe

C:\Windows\System\XrFBeFp.exe

C:\Windows\System\XrFBeFp.exe

C:\Windows\System\dBgjllL.exe

C:\Windows\System\dBgjllL.exe

C:\Windows\System\iZNUyNi.exe

C:\Windows\System\iZNUyNi.exe

C:\Windows\System\DUKtYQz.exe

C:\Windows\System\DUKtYQz.exe

C:\Windows\System\bDlegDA.exe

C:\Windows\System\bDlegDA.exe

C:\Windows\System\JAaygSw.exe

C:\Windows\System\JAaygSw.exe

C:\Windows\System\sXbAEKr.exe

C:\Windows\System\sXbAEKr.exe

C:\Windows\System\PFahWMq.exe

C:\Windows\System\PFahWMq.exe

C:\Windows\System\cfkpHyU.exe

C:\Windows\System\cfkpHyU.exe

C:\Windows\System\wJRkMwN.exe

C:\Windows\System\wJRkMwN.exe

C:\Windows\System\IKrlJTu.exe

C:\Windows\System\IKrlJTu.exe

C:\Windows\System\XqhTAox.exe

C:\Windows\System\XqhTAox.exe

C:\Windows\System\FkzgzXZ.exe

C:\Windows\System\FkzgzXZ.exe

C:\Windows\System\sRMvAyq.exe

C:\Windows\System\sRMvAyq.exe

C:\Windows\System\VEHcOSZ.exe

C:\Windows\System\VEHcOSZ.exe

C:\Windows\System\sNqxdqp.exe

C:\Windows\System\sNqxdqp.exe

C:\Windows\System\fJxFWag.exe

C:\Windows\System\fJxFWag.exe

C:\Windows\System\HayxfKy.exe

C:\Windows\System\HayxfKy.exe

C:\Windows\System\SPfPQDh.exe

C:\Windows\System\SPfPQDh.exe

C:\Windows\System\dDVdEdb.exe

C:\Windows\System\dDVdEdb.exe

C:\Windows\System\KvPFgoF.exe

C:\Windows\System\KvPFgoF.exe

C:\Windows\System\KOuyRnK.exe

C:\Windows\System\KOuyRnK.exe

C:\Windows\System\UFzlIPf.exe

C:\Windows\System\UFzlIPf.exe

C:\Windows\System\HjAWYqe.exe

C:\Windows\System\HjAWYqe.exe

C:\Windows\System\jhTKJrB.exe

C:\Windows\System\jhTKJrB.exe

C:\Windows\System\JnOxzJa.exe

C:\Windows\System\JnOxzJa.exe

C:\Windows\System\tJHVDff.exe

C:\Windows\System\tJHVDff.exe

C:\Windows\System\laHuznO.exe

C:\Windows\System\laHuznO.exe

C:\Windows\System\BnPxtdp.exe

C:\Windows\System\BnPxtdp.exe

C:\Windows\System\cmqwqhz.exe

C:\Windows\System\cmqwqhz.exe

C:\Windows\System\hjmVEhb.exe

C:\Windows\System\hjmVEhb.exe

C:\Windows\System\vSGBRXF.exe

C:\Windows\System\vSGBRXF.exe

C:\Windows\System\UxMqcqC.exe

C:\Windows\System\UxMqcqC.exe

C:\Windows\System\olqdXJf.exe

C:\Windows\System\olqdXJf.exe

C:\Windows\System\mtukJQg.exe

C:\Windows\System\mtukJQg.exe

C:\Windows\System\UPoBbte.exe

C:\Windows\System\UPoBbte.exe

C:\Windows\System\TRtneyf.exe

C:\Windows\System\TRtneyf.exe

C:\Windows\System\OzzWWTt.exe

C:\Windows\System\OzzWWTt.exe

C:\Windows\System\NojcXhe.exe

C:\Windows\System\NojcXhe.exe

C:\Windows\System\AdIATpH.exe

C:\Windows\System\AdIATpH.exe

C:\Windows\System\yUNHIvO.exe

C:\Windows\System\yUNHIvO.exe

C:\Windows\System\vOlKjyt.exe

C:\Windows\System\vOlKjyt.exe

C:\Windows\System\IRtCgXI.exe

C:\Windows\System\IRtCgXI.exe

C:\Windows\System\YtLUbIb.exe

C:\Windows\System\YtLUbIb.exe

C:\Windows\System\ZCEYfaw.exe

C:\Windows\System\ZCEYfaw.exe

C:\Windows\System\SKoiCMz.exe

C:\Windows\System\SKoiCMz.exe

C:\Windows\System\wVZJZNt.exe

C:\Windows\System\wVZJZNt.exe

C:\Windows\System\ASSKWoy.exe

C:\Windows\System\ASSKWoy.exe

C:\Windows\System\BVcTXuf.exe

C:\Windows\System\BVcTXuf.exe

C:\Windows\System\UwnrZhd.exe

C:\Windows\System\UwnrZhd.exe

C:\Windows\System\TmWuyFd.exe

C:\Windows\System\TmWuyFd.exe

C:\Windows\System\tIBnQCU.exe

C:\Windows\System\tIBnQCU.exe

C:\Windows\System\PSlFaQG.exe

C:\Windows\System\PSlFaQG.exe

C:\Windows\System\RHUVDDs.exe

C:\Windows\System\RHUVDDs.exe

C:\Windows\System\zIxtTid.exe

C:\Windows\System\zIxtTid.exe

C:\Windows\System\DQifGIv.exe

C:\Windows\System\DQifGIv.exe

C:\Windows\System\jDIZbPf.exe

C:\Windows\System\jDIZbPf.exe

C:\Windows\System\SQGFeFm.exe

C:\Windows\System\SQGFeFm.exe

C:\Windows\System\fZooJxR.exe

C:\Windows\System\fZooJxR.exe

C:\Windows\System\KReDCIO.exe

C:\Windows\System\KReDCIO.exe

C:\Windows\System\BbllXfR.exe

C:\Windows\System\BbllXfR.exe

C:\Windows\System\jKxfijL.exe

C:\Windows\System\jKxfijL.exe

C:\Windows\System\teNPyTc.exe

C:\Windows\System\teNPyTc.exe

C:\Windows\System\XXzssKw.exe

C:\Windows\System\XXzssKw.exe

C:\Windows\System\WiCyTzk.exe

C:\Windows\System\WiCyTzk.exe

C:\Windows\System\VFbnnJK.exe

C:\Windows\System\VFbnnJK.exe

C:\Windows\System\bMGLbQM.exe

C:\Windows\System\bMGLbQM.exe

C:\Windows\System\adBoDAw.exe

C:\Windows\System\adBoDAw.exe

C:\Windows\System\oQLZefZ.exe

C:\Windows\System\oQLZefZ.exe

C:\Windows\System\MEGdxJN.exe

C:\Windows\System\MEGdxJN.exe

C:\Windows\System\PnMVzzh.exe

C:\Windows\System\PnMVzzh.exe

C:\Windows\System\ONAjpYv.exe

C:\Windows\System\ONAjpYv.exe

C:\Windows\System\LOufuhs.exe

C:\Windows\System\LOufuhs.exe

C:\Windows\System\UxihARS.exe

C:\Windows\System\UxihARS.exe

C:\Windows\System\HrqAWZv.exe

C:\Windows\System\HrqAWZv.exe

C:\Windows\System\bmHrrdM.exe

C:\Windows\System\bmHrrdM.exe

C:\Windows\System\BjngPuU.exe

C:\Windows\System\BjngPuU.exe

C:\Windows\System\WRgVKrz.exe

C:\Windows\System\WRgVKrz.exe

C:\Windows\System\ScqgPEx.exe

C:\Windows\System\ScqgPEx.exe

C:\Windows\System\npnffvh.exe

C:\Windows\System\npnffvh.exe

C:\Windows\System\SNvOHQk.exe

C:\Windows\System\SNvOHQk.exe

C:\Windows\System\FgcjjpR.exe

C:\Windows\System\FgcjjpR.exe

C:\Windows\System\HCrfXMr.exe

C:\Windows\System\HCrfXMr.exe

C:\Windows\System\suieUea.exe

C:\Windows\System\suieUea.exe

C:\Windows\System\XXqTESU.exe

C:\Windows\System\XXqTESU.exe

C:\Windows\System\LYShwLb.exe

C:\Windows\System\LYShwLb.exe

C:\Windows\System\JaULCVF.exe

C:\Windows\System\JaULCVF.exe

C:\Windows\System\hiDpDqI.exe

C:\Windows\System\hiDpDqI.exe

C:\Windows\System\FzpQfZR.exe

C:\Windows\System\FzpQfZR.exe

C:\Windows\System\USbEenM.exe

C:\Windows\System\USbEenM.exe

C:\Windows\System\YbHZEMt.exe

C:\Windows\System\YbHZEMt.exe

C:\Windows\System\VDFYJQL.exe

C:\Windows\System\VDFYJQL.exe

C:\Windows\System\QJTUYOt.exe

C:\Windows\System\QJTUYOt.exe

C:\Windows\System\JqJCikF.exe

C:\Windows\System\JqJCikF.exe

C:\Windows\System\xZpUoUz.exe

C:\Windows\System\xZpUoUz.exe

C:\Windows\System\MtGkxMl.exe

C:\Windows\System\MtGkxMl.exe

C:\Windows\System\JshfHJV.exe

C:\Windows\System\JshfHJV.exe

C:\Windows\System\HKWPcXU.exe

C:\Windows\System\HKWPcXU.exe

C:\Windows\System\PmEWmFg.exe

C:\Windows\System\PmEWmFg.exe

C:\Windows\System\WjdeGll.exe

C:\Windows\System\WjdeGll.exe

C:\Windows\System\ivgrAQJ.exe

C:\Windows\System\ivgrAQJ.exe

C:\Windows\System\KKjuNnw.exe

C:\Windows\System\KKjuNnw.exe

C:\Windows\System\ZyUeqRK.exe

C:\Windows\System\ZyUeqRK.exe

C:\Windows\System\vgqdbss.exe

C:\Windows\System\vgqdbss.exe

C:\Windows\System\YNAQHqw.exe

C:\Windows\System\YNAQHqw.exe

C:\Windows\System\XalOIIH.exe

C:\Windows\System\XalOIIH.exe

C:\Windows\System\xijybiC.exe

C:\Windows\System\xijybiC.exe

C:\Windows\System\KpkcoLP.exe

C:\Windows\System\KpkcoLP.exe

C:\Windows\System\aQDIgNG.exe

C:\Windows\System\aQDIgNG.exe

C:\Windows\System\PbOaAbD.exe

C:\Windows\System\PbOaAbD.exe

C:\Windows\System\SoChHHM.exe

C:\Windows\System\SoChHHM.exe

C:\Windows\System\NjcivXQ.exe

C:\Windows\System\NjcivXQ.exe

C:\Windows\System\pFiyuZk.exe

C:\Windows\System\pFiyuZk.exe

C:\Windows\System\xuGKMvy.exe

C:\Windows\System\xuGKMvy.exe

C:\Windows\System\OvUwRCC.exe

C:\Windows\System\OvUwRCC.exe

C:\Windows\System\bhMvoSi.exe

C:\Windows\System\bhMvoSi.exe

C:\Windows\System\mAAEJdS.exe

C:\Windows\System\mAAEJdS.exe

C:\Windows\System\HZvkUJu.exe

C:\Windows\System\HZvkUJu.exe

C:\Windows\System\mLDtQRd.exe

C:\Windows\System\mLDtQRd.exe

C:\Windows\System\hNYGawY.exe

C:\Windows\System\hNYGawY.exe

C:\Windows\System\ELgjtUG.exe

C:\Windows\System\ELgjtUG.exe

C:\Windows\System\maqULwY.exe

C:\Windows\System\maqULwY.exe

C:\Windows\System\nXHRUPE.exe

C:\Windows\System\nXHRUPE.exe

C:\Windows\System\bKUBbGQ.exe

C:\Windows\System\bKUBbGQ.exe

C:\Windows\System\VsUkowJ.exe

C:\Windows\System\VsUkowJ.exe

C:\Windows\System\SfGLXJE.exe

C:\Windows\System\SfGLXJE.exe

C:\Windows\System\OLyRviA.exe

C:\Windows\System\OLyRviA.exe

C:\Windows\System\GystPhF.exe

C:\Windows\System\GystPhF.exe

C:\Windows\System\AlanYUV.exe

C:\Windows\System\AlanYUV.exe

C:\Windows\System\ubvXjhI.exe

C:\Windows\System\ubvXjhI.exe

C:\Windows\System\HnFzYpb.exe

C:\Windows\System\HnFzYpb.exe

C:\Windows\System\XbMnifK.exe

C:\Windows\System\XbMnifK.exe

C:\Windows\System\pDOyngt.exe

C:\Windows\System\pDOyngt.exe

C:\Windows\System\uXeKCKd.exe

C:\Windows\System\uXeKCKd.exe

C:\Windows\System\mhXlJNW.exe

C:\Windows\System\mhXlJNW.exe

C:\Windows\System\BnQrHjI.exe

C:\Windows\System\BnQrHjI.exe

C:\Windows\System\wNjqxul.exe

C:\Windows\System\wNjqxul.exe

C:\Windows\System\RwxVyLb.exe

C:\Windows\System\RwxVyLb.exe

C:\Windows\System\tQtkbdt.exe

C:\Windows\System\tQtkbdt.exe

C:\Windows\System\yCwwGsN.exe

C:\Windows\System\yCwwGsN.exe

C:\Windows\System\GVooKqG.exe

C:\Windows\System\GVooKqG.exe

C:\Windows\System\OpHLUJG.exe

C:\Windows\System\OpHLUJG.exe

C:\Windows\System\ouugGrA.exe

C:\Windows\System\ouugGrA.exe

C:\Windows\System\KAuUSEA.exe

C:\Windows\System\KAuUSEA.exe

C:\Windows\System\jBVpgsp.exe

C:\Windows\System\jBVpgsp.exe

C:\Windows\System\kXAgmCr.exe

C:\Windows\System\kXAgmCr.exe

C:\Windows\System\ZOunfLr.exe

C:\Windows\System\ZOunfLr.exe

C:\Windows\System\SifAduX.exe

C:\Windows\System\SifAduX.exe

C:\Windows\System\NurEtMe.exe

C:\Windows\System\NurEtMe.exe

C:\Windows\System\eTJUHOJ.exe

C:\Windows\System\eTJUHOJ.exe

C:\Windows\System\eCmVKye.exe

C:\Windows\System\eCmVKye.exe

C:\Windows\System\vCcQYiF.exe

C:\Windows\System\vCcQYiF.exe

C:\Windows\System\heSketK.exe

C:\Windows\System\heSketK.exe

C:\Windows\System\AzDHwWe.exe

C:\Windows\System\AzDHwWe.exe

C:\Windows\System\eZyLhjp.exe

C:\Windows\System\eZyLhjp.exe

C:\Windows\System\PJXqEKZ.exe

C:\Windows\System\PJXqEKZ.exe

C:\Windows\System\YRpybzo.exe

C:\Windows\System\YRpybzo.exe

C:\Windows\System\QOYKXWU.exe

C:\Windows\System\QOYKXWU.exe

C:\Windows\System\WJFKHrD.exe

C:\Windows\System\WJFKHrD.exe

C:\Windows\System\ZtUnDVk.exe

C:\Windows\System\ZtUnDVk.exe

C:\Windows\System\fPuNavu.exe

C:\Windows\System\fPuNavu.exe

C:\Windows\System\CZbMHxY.exe

C:\Windows\System\CZbMHxY.exe

C:\Windows\System\arqwTdi.exe

C:\Windows\System\arqwTdi.exe

C:\Windows\System\CqyYpeG.exe

C:\Windows\System\CqyYpeG.exe

C:\Windows\System\qwoeYSf.exe

C:\Windows\System\qwoeYSf.exe

C:\Windows\System\pObTYOo.exe

C:\Windows\System\pObTYOo.exe

C:\Windows\System\nxcQTMR.exe

C:\Windows\System\nxcQTMR.exe

C:\Windows\System\jdhVqQt.exe

C:\Windows\System\jdhVqQt.exe

C:\Windows\System\RCDCbOY.exe

C:\Windows\System\RCDCbOY.exe

C:\Windows\System\YTfKXeM.exe

C:\Windows\System\YTfKXeM.exe

C:\Windows\System\MbaSWaN.exe

C:\Windows\System\MbaSWaN.exe

C:\Windows\System\OmpyhXZ.exe

C:\Windows\System\OmpyhXZ.exe

C:\Windows\System\jdPDcdw.exe

C:\Windows\System\jdPDcdw.exe

C:\Windows\System\zZbEiZB.exe

C:\Windows\System\zZbEiZB.exe

C:\Windows\System\kVVYrKr.exe

C:\Windows\System\kVVYrKr.exe

C:\Windows\System\TLswSWB.exe

C:\Windows\System\TLswSWB.exe

C:\Windows\System\wlkFGKX.exe

C:\Windows\System\wlkFGKX.exe

C:\Windows\System\ODSZjpC.exe

C:\Windows\System\ODSZjpC.exe

C:\Windows\System\Ixefiok.exe

C:\Windows\System\Ixefiok.exe

C:\Windows\System\IDDzhpW.exe

C:\Windows\System\IDDzhpW.exe

C:\Windows\System\CoyrmlG.exe

C:\Windows\System\CoyrmlG.exe

C:\Windows\System\gceluZN.exe

C:\Windows\System\gceluZN.exe

C:\Windows\System\ZkZgodg.exe

C:\Windows\System\ZkZgodg.exe

C:\Windows\System\klDlBAK.exe

C:\Windows\System\klDlBAK.exe

C:\Windows\System\wUPxAfW.exe

C:\Windows\System\wUPxAfW.exe

C:\Windows\System\uHweGrq.exe

C:\Windows\System\uHweGrq.exe

C:\Windows\System\GBfXAkc.exe

C:\Windows\System\GBfXAkc.exe

C:\Windows\System\uICghlj.exe

C:\Windows\System\uICghlj.exe

C:\Windows\System\ZrtaUpo.exe

C:\Windows\System\ZrtaUpo.exe

C:\Windows\System\hpztgRu.exe

C:\Windows\System\hpztgRu.exe

C:\Windows\System\PXVrDGU.exe

C:\Windows\System\PXVrDGU.exe

C:\Windows\System\qcPpBdy.exe

C:\Windows\System\qcPpBdy.exe

C:\Windows\System\kMnmCqL.exe

C:\Windows\System\kMnmCqL.exe

C:\Windows\System\zfdZOZn.exe

C:\Windows\System\zfdZOZn.exe

C:\Windows\System\eqFdVbw.exe

C:\Windows\System\eqFdVbw.exe

C:\Windows\System\nojwSYO.exe

C:\Windows\System\nojwSYO.exe

C:\Windows\System\XtbvTgR.exe

C:\Windows\System\XtbvTgR.exe

C:\Windows\System\GjGzclS.exe

C:\Windows\System\GjGzclS.exe

C:\Windows\System\lRLAmSL.exe

C:\Windows\System\lRLAmSL.exe

C:\Windows\System\FHeSbyA.exe

C:\Windows\System\FHeSbyA.exe

C:\Windows\System\ZTUDxaM.exe

C:\Windows\System\ZTUDxaM.exe

C:\Windows\System\WdRxflQ.exe

C:\Windows\System\WdRxflQ.exe

C:\Windows\System\CqLVZbp.exe

C:\Windows\System\CqLVZbp.exe

C:\Windows\System\jDkmFiL.exe

C:\Windows\System\jDkmFiL.exe

C:\Windows\System\HQXLPmQ.exe

C:\Windows\System\HQXLPmQ.exe

C:\Windows\System\lBSbmWn.exe

C:\Windows\System\lBSbmWn.exe

C:\Windows\System\vxzeYZO.exe

C:\Windows\System\vxzeYZO.exe

C:\Windows\System\mZaYhtn.exe

C:\Windows\System\mZaYhtn.exe

C:\Windows\System\fReJuGF.exe

C:\Windows\System\fReJuGF.exe

C:\Windows\System\XdtpfmN.exe

C:\Windows\System\XdtpfmN.exe

C:\Windows\System\bRCVwcM.exe

C:\Windows\System\bRCVwcM.exe

C:\Windows\System\TpLfyPF.exe

C:\Windows\System\TpLfyPF.exe

C:\Windows\System\XfJRVPg.exe

C:\Windows\System\XfJRVPg.exe

C:\Windows\System\kZfdrmG.exe

C:\Windows\System\kZfdrmG.exe

C:\Windows\System\QgpCWAm.exe

C:\Windows\System\QgpCWAm.exe

C:\Windows\System\jVKrsbC.exe

C:\Windows\System\jVKrsbC.exe

C:\Windows\System\AhvtZji.exe

C:\Windows\System\AhvtZji.exe

C:\Windows\System\MujxEZg.exe

C:\Windows\System\MujxEZg.exe

C:\Windows\System\bAJdvAS.exe

C:\Windows\System\bAJdvAS.exe

C:\Windows\System\MLhmMnB.exe

C:\Windows\System\MLhmMnB.exe

C:\Windows\System\IHYkoTD.exe

C:\Windows\System\IHYkoTD.exe

C:\Windows\System\NqfWhNt.exe

C:\Windows\System\NqfWhNt.exe

C:\Windows\System\UIDAQWS.exe

C:\Windows\System\UIDAQWS.exe

C:\Windows\System\rLMhIXP.exe

C:\Windows\System\rLMhIXP.exe

C:\Windows\System\hWOsWCJ.exe

C:\Windows\System\hWOsWCJ.exe

C:\Windows\System\iGucewE.exe

C:\Windows\System\iGucewE.exe

C:\Windows\System\EZnktHy.exe

C:\Windows\System\EZnktHy.exe

C:\Windows\System\BJGkRCR.exe

C:\Windows\System\BJGkRCR.exe

C:\Windows\System\CeqgXVh.exe

C:\Windows\System\CeqgXVh.exe

C:\Windows\System\vqzpYSq.exe

C:\Windows\System\vqzpYSq.exe

C:\Windows\System\pGFsjwH.exe

C:\Windows\System\pGFsjwH.exe

C:\Windows\System\HBxwYLd.exe

C:\Windows\System\HBxwYLd.exe

C:\Windows\System\gyutTZC.exe

C:\Windows\System\gyutTZC.exe

C:\Windows\System\uPWtRgB.exe

C:\Windows\System\uPWtRgB.exe

C:\Windows\System\vsoEmRV.exe

C:\Windows\System\vsoEmRV.exe

C:\Windows\System\gWSBfNg.exe

C:\Windows\System\gWSBfNg.exe

C:\Windows\System\ALpKjla.exe

C:\Windows\System\ALpKjla.exe

C:\Windows\System\BDUelNY.exe

C:\Windows\System\BDUelNY.exe

C:\Windows\System\rgRaSsR.exe

C:\Windows\System\rgRaSsR.exe

C:\Windows\System\tppuIey.exe

C:\Windows\System\tppuIey.exe

C:\Windows\System\xtBZWBP.exe

C:\Windows\System\xtBZWBP.exe

C:\Windows\System\MaNvHHS.exe

C:\Windows\System\MaNvHHS.exe

C:\Windows\System\lGrHDkB.exe

C:\Windows\System\lGrHDkB.exe

C:\Windows\System\YwNtWZj.exe

C:\Windows\System\YwNtWZj.exe

C:\Windows\System\bCFpZWO.exe

C:\Windows\System\bCFpZWO.exe

C:\Windows\System\rvsuAKu.exe

C:\Windows\System\rvsuAKu.exe

C:\Windows\System\ZjyWrUy.exe

C:\Windows\System\ZjyWrUy.exe

C:\Windows\System\jHEimlP.exe

C:\Windows\System\jHEimlP.exe

C:\Windows\System\KZKUAcx.exe

C:\Windows\System\KZKUAcx.exe

C:\Windows\System\itMEkyA.exe

C:\Windows\System\itMEkyA.exe

C:\Windows\System\sIRyUmu.exe

C:\Windows\System\sIRyUmu.exe

C:\Windows\System\BtMgrbv.exe

C:\Windows\System\BtMgrbv.exe

C:\Windows\System\SkrzaGT.exe

C:\Windows\System\SkrzaGT.exe

C:\Windows\System\tPwQKsB.exe

C:\Windows\System\tPwQKsB.exe

C:\Windows\System\lUiwydL.exe

C:\Windows\System\lUiwydL.exe

C:\Windows\System\KjzBqkX.exe

C:\Windows\System\KjzBqkX.exe

C:\Windows\System\fzPdgTG.exe

C:\Windows\System\fzPdgTG.exe

C:\Windows\System\tlNzLdc.exe

C:\Windows\System\tlNzLdc.exe

C:\Windows\System\YqMHjQT.exe

C:\Windows\System\YqMHjQT.exe

C:\Windows\System\htZenPM.exe

C:\Windows\System\htZenPM.exe

C:\Windows\System\OYGbNlw.exe

C:\Windows\System\OYGbNlw.exe

C:\Windows\System\hXNiOfY.exe

C:\Windows\System\hXNiOfY.exe

C:\Windows\System\eMhqZwP.exe

C:\Windows\System\eMhqZwP.exe

C:\Windows\System\aqpFuqE.exe

C:\Windows\System\aqpFuqE.exe

C:\Windows\System\sCxUSTp.exe

C:\Windows\System\sCxUSTp.exe

C:\Windows\System\kTrPyfV.exe

C:\Windows\System\kTrPyfV.exe

C:\Windows\System\avAzfTm.exe

C:\Windows\System\avAzfTm.exe

C:\Windows\System\vIlimVo.exe

C:\Windows\System\vIlimVo.exe

C:\Windows\System\BacgDaS.exe

C:\Windows\System\BacgDaS.exe

C:\Windows\System\jtwFaFd.exe

C:\Windows\System\jtwFaFd.exe

C:\Windows\System\CADswjk.exe

C:\Windows\System\CADswjk.exe

C:\Windows\System\PDMvGLe.exe

C:\Windows\System\PDMvGLe.exe

C:\Windows\System\hBLWIia.exe

C:\Windows\System\hBLWIia.exe

C:\Windows\System\MVoQDaX.exe

C:\Windows\System\MVoQDaX.exe

C:\Windows\System\rYNjFcD.exe

C:\Windows\System\rYNjFcD.exe

C:\Windows\System\aMDkjzt.exe

C:\Windows\System\aMDkjzt.exe

C:\Windows\System\aqtocyp.exe

C:\Windows\System\aqtocyp.exe

C:\Windows\System\RMRvQBk.exe

C:\Windows\System\RMRvQBk.exe

C:\Windows\System\qsrxvuH.exe

C:\Windows\System\qsrxvuH.exe

C:\Windows\System\GGZwrLf.exe

C:\Windows\System\GGZwrLf.exe

C:\Windows\System\xUDPpDH.exe

C:\Windows\System\xUDPpDH.exe

C:\Windows\System\JDymoAG.exe

C:\Windows\System\JDymoAG.exe

C:\Windows\System\eOwpKMh.exe

C:\Windows\System\eOwpKMh.exe

C:\Windows\System\YkmalWW.exe

C:\Windows\System\YkmalWW.exe

C:\Windows\System\NXRtnoy.exe

C:\Windows\System\NXRtnoy.exe

C:\Windows\System\hyxnTqf.exe

C:\Windows\System\hyxnTqf.exe

C:\Windows\System\ugDUouq.exe

C:\Windows\System\ugDUouq.exe

C:\Windows\System\CzNGocm.exe

C:\Windows\System\CzNGocm.exe

C:\Windows\System\ZidVTAK.exe

C:\Windows\System\ZidVTAK.exe

C:\Windows\System\OtanGyY.exe

C:\Windows\System\OtanGyY.exe

C:\Windows\System\tqsVUPb.exe

C:\Windows\System\tqsVUPb.exe

C:\Windows\System\TtqAaoO.exe

C:\Windows\System\TtqAaoO.exe

C:\Windows\System\bvdWBsy.exe

C:\Windows\System\bvdWBsy.exe

C:\Windows\System\nNiBlsB.exe

C:\Windows\System\nNiBlsB.exe

C:\Windows\System\PGnAlDi.exe

C:\Windows\System\PGnAlDi.exe

C:\Windows\System\EynOIfZ.exe

C:\Windows\System\EynOIfZ.exe

C:\Windows\System\eDlVkFV.exe

C:\Windows\System\eDlVkFV.exe

C:\Windows\System\ExbTKWF.exe

C:\Windows\System\ExbTKWF.exe

C:\Windows\System\vNBPTKw.exe

C:\Windows\System\vNBPTKw.exe

C:\Windows\System\aPiBaKF.exe

C:\Windows\System\aPiBaKF.exe

C:\Windows\System\bAMDEdE.exe

C:\Windows\System\bAMDEdE.exe

C:\Windows\System\WVUSUWJ.exe

C:\Windows\System\WVUSUWJ.exe

C:\Windows\System\jNXgkfX.exe

C:\Windows\System\jNXgkfX.exe

C:\Windows\System\oNfLYdi.exe

C:\Windows\System\oNfLYdi.exe

C:\Windows\System\xZRnOSh.exe

C:\Windows\System\xZRnOSh.exe

C:\Windows\System\qnUEvSh.exe

C:\Windows\System\qnUEvSh.exe

C:\Windows\System\ooXRUXS.exe

C:\Windows\System\ooXRUXS.exe

C:\Windows\System\ieTQMgC.exe

C:\Windows\System\ieTQMgC.exe

C:\Windows\System\gOyObPV.exe

C:\Windows\System\gOyObPV.exe

C:\Windows\System\VlipzKZ.exe

C:\Windows\System\VlipzKZ.exe

C:\Windows\System\eIQEQAY.exe

C:\Windows\System\eIQEQAY.exe

C:\Windows\System\QbGXyef.exe

C:\Windows\System\QbGXyef.exe

C:\Windows\System\nmMtIAI.exe

C:\Windows\System\nmMtIAI.exe

C:\Windows\System\shBNohJ.exe

C:\Windows\System\shBNohJ.exe

C:\Windows\System\UKgqRTa.exe

C:\Windows\System\UKgqRTa.exe

C:\Windows\System\GvlByDi.exe

C:\Windows\System\GvlByDi.exe

C:\Windows\System\LojoLft.exe

C:\Windows\System\LojoLft.exe

C:\Windows\System\thQEBoq.exe

C:\Windows\System\thQEBoq.exe

C:\Windows\System\vgpMfkC.exe

C:\Windows\System\vgpMfkC.exe

C:\Windows\System\fIJjhTn.exe

C:\Windows\System\fIJjhTn.exe

C:\Windows\System\QeqmXOw.exe

C:\Windows\System\QeqmXOw.exe

C:\Windows\System\QuSkDiq.exe

C:\Windows\System\QuSkDiq.exe

C:\Windows\System\zGWDmgD.exe

C:\Windows\System\zGWDmgD.exe

C:\Windows\System\SHTVgoL.exe

C:\Windows\System\SHTVgoL.exe

C:\Windows\System\VWeKemn.exe

C:\Windows\System\VWeKemn.exe

C:\Windows\System\SqASpyo.exe

C:\Windows\System\SqASpyo.exe

C:\Windows\System\LhIrvqb.exe

C:\Windows\System\LhIrvqb.exe

C:\Windows\System\fiqSfBz.exe

C:\Windows\System\fiqSfBz.exe

C:\Windows\System\VFdrzPL.exe

C:\Windows\System\VFdrzPL.exe

C:\Windows\System\DcLMQlx.exe

C:\Windows\System\DcLMQlx.exe

C:\Windows\System\wkCHmpl.exe

C:\Windows\System\wkCHmpl.exe

C:\Windows\System\NUpqTLF.exe

C:\Windows\System\NUpqTLF.exe

C:\Windows\System\AqCddKP.exe

C:\Windows\System\AqCddKP.exe

C:\Windows\System\DZuXteU.exe

C:\Windows\System\DZuXteU.exe

C:\Windows\System\dYbNnym.exe

C:\Windows\System\dYbNnym.exe

C:\Windows\System\UsThmos.exe

C:\Windows\System\UsThmos.exe

C:\Windows\System\eiDokBd.exe

C:\Windows\System\eiDokBd.exe

C:\Windows\System\YLtfmmw.exe

C:\Windows\System\YLtfmmw.exe

C:\Windows\System\RMPzPav.exe

C:\Windows\System\RMPzPav.exe

C:\Windows\System\nUzpycv.exe

C:\Windows\System\nUzpycv.exe

C:\Windows\System\JMTjOpS.exe

C:\Windows\System\JMTjOpS.exe

C:\Windows\System\wHLeJiX.exe

C:\Windows\System\wHLeJiX.exe

C:\Windows\System\ZGFsYjH.exe

C:\Windows\System\ZGFsYjH.exe

C:\Windows\System\HhvUwAM.exe

C:\Windows\System\HhvUwAM.exe

C:\Windows\System\FnwSxdt.exe

C:\Windows\System\FnwSxdt.exe

C:\Windows\System\bvyvxHD.exe

C:\Windows\System\bvyvxHD.exe

C:\Windows\System\oAOaRKt.exe

C:\Windows\System\oAOaRKt.exe

C:\Windows\System\aaDAOPR.exe

C:\Windows\System\aaDAOPR.exe

C:\Windows\System\bBEwlNo.exe

C:\Windows\System\bBEwlNo.exe

C:\Windows\System\kGLGfGb.exe

C:\Windows\System\kGLGfGb.exe

C:\Windows\System\hnssLdk.exe

C:\Windows\System\hnssLdk.exe

C:\Windows\System\FygOTxw.exe

C:\Windows\System\FygOTxw.exe

C:\Windows\System\sFlakkU.exe

C:\Windows\System\sFlakkU.exe

C:\Windows\System\rXolCIf.exe

C:\Windows\System\rXolCIf.exe

C:\Windows\System\swgXTVO.exe

C:\Windows\System\swgXTVO.exe

C:\Windows\System\bMKCwEI.exe

C:\Windows\System\bMKCwEI.exe

C:\Windows\System\liOyVrP.exe

C:\Windows\System\liOyVrP.exe

C:\Windows\System\yxghKpC.exe

C:\Windows\System\yxghKpC.exe

C:\Windows\System\DwEjnzs.exe

C:\Windows\System\DwEjnzs.exe

C:\Windows\System\CqnnzGI.exe

C:\Windows\System\CqnnzGI.exe

C:\Windows\System\vlvSusS.exe

C:\Windows\System\vlvSusS.exe

C:\Windows\System\vxeQWkF.exe

C:\Windows\System\vxeQWkF.exe

C:\Windows\System\bzWfNKU.exe

C:\Windows\System\bzWfNKU.exe

C:\Windows\System\acyOhUI.exe

C:\Windows\System\acyOhUI.exe

C:\Windows\System\hLFUkdN.exe

C:\Windows\System\hLFUkdN.exe

C:\Windows\System\dbIXJKj.exe

C:\Windows\System\dbIXJKj.exe

C:\Windows\System\fcLMohl.exe

C:\Windows\System\fcLMohl.exe

C:\Windows\System\zTjSTIi.exe

C:\Windows\System\zTjSTIi.exe

C:\Windows\System\bSxOEBd.exe

C:\Windows\System\bSxOEBd.exe

C:\Windows\System\auaoVEw.exe

C:\Windows\System\auaoVEw.exe

C:\Windows\System\KxsHbge.exe

C:\Windows\System\KxsHbge.exe

C:\Windows\System\rPIgHEi.exe

C:\Windows\System\rPIgHEi.exe

C:\Windows\System\VcAeUYs.exe

C:\Windows\System\VcAeUYs.exe

C:\Windows\System\JgEkmcu.exe

C:\Windows\System\JgEkmcu.exe

C:\Windows\System\jbDgQoK.exe

C:\Windows\System\jbDgQoK.exe

C:\Windows\System\cxTzpSU.exe

C:\Windows\System\cxTzpSU.exe

C:\Windows\System\aLayQdW.exe

C:\Windows\System\aLayQdW.exe

C:\Windows\System\KksYbUu.exe

C:\Windows\System\KksYbUu.exe

C:\Windows\System\fJSPnZb.exe

C:\Windows\System\fJSPnZb.exe

C:\Windows\System\VVuDBqW.exe

C:\Windows\System\VVuDBqW.exe

C:\Windows\System\pNAjiAH.exe

C:\Windows\System\pNAjiAH.exe

C:\Windows\System\DMIRkTN.exe

C:\Windows\System\DMIRkTN.exe

C:\Windows\System\LKtzLQU.exe

C:\Windows\System\LKtzLQU.exe

C:\Windows\System\NYFNOPr.exe

C:\Windows\System\NYFNOPr.exe

C:\Windows\System\cqpIaPa.exe

C:\Windows\System\cqpIaPa.exe

C:\Windows\System\DINEyWf.exe

C:\Windows\System\DINEyWf.exe

C:\Windows\System\itBXCxh.exe

C:\Windows\System\itBXCxh.exe

C:\Windows\System\GJYqWbA.exe

C:\Windows\System\GJYqWbA.exe

C:\Windows\System\ZuAAZPa.exe

C:\Windows\System\ZuAAZPa.exe

C:\Windows\System\PSTzdkK.exe

C:\Windows\System\PSTzdkK.exe

C:\Windows\System\wMdLskn.exe

C:\Windows\System\wMdLskn.exe

C:\Windows\System\FdZnklD.exe

C:\Windows\System\FdZnklD.exe

C:\Windows\System\NxNXFtr.exe

C:\Windows\System\NxNXFtr.exe

C:\Windows\System\GfElhjV.exe

C:\Windows\System\GfElhjV.exe

C:\Windows\System\sezHmVq.exe

C:\Windows\System\sezHmVq.exe

C:\Windows\System\ihsoYPV.exe

C:\Windows\System\ihsoYPV.exe

C:\Windows\System\vziuKqg.exe

C:\Windows\System\vziuKqg.exe

C:\Windows\System\tdkauxC.exe

C:\Windows\System\tdkauxC.exe

C:\Windows\System\SuuVMlr.exe

C:\Windows\System\SuuVMlr.exe

C:\Windows\System\aYwCkeG.exe

C:\Windows\System\aYwCkeG.exe

C:\Windows\System\emjvPth.exe

C:\Windows\System\emjvPth.exe

C:\Windows\System\aHjZrDh.exe

C:\Windows\System\aHjZrDh.exe

C:\Windows\System\joJwKJa.exe

C:\Windows\System\joJwKJa.exe

C:\Windows\System\XoKABEO.exe

C:\Windows\System\XoKABEO.exe

C:\Windows\System\dHGxSMS.exe

C:\Windows\System\dHGxSMS.exe

C:\Windows\System\uOlSjts.exe

C:\Windows\System\uOlSjts.exe

C:\Windows\System\pzeDzdG.exe

C:\Windows\System\pzeDzdG.exe

C:\Windows\System\IqmQghM.exe

C:\Windows\System\IqmQghM.exe

C:\Windows\System\sibuKmG.exe

C:\Windows\System\sibuKmG.exe

C:\Windows\System\VwkiGbj.exe

C:\Windows\System\VwkiGbj.exe

C:\Windows\System\MDMrJZH.exe

C:\Windows\System\MDMrJZH.exe

C:\Windows\System\XEczIfm.exe

C:\Windows\System\XEczIfm.exe

C:\Windows\System\dGMXqHK.exe

C:\Windows\System\dGMXqHK.exe

C:\Windows\System\ZqVRCfZ.exe

C:\Windows\System\ZqVRCfZ.exe

C:\Windows\System\VEjnEpj.exe

C:\Windows\System\VEjnEpj.exe

C:\Windows\System\hHYFszy.exe

C:\Windows\System\hHYFszy.exe

C:\Windows\System\VsUBiKH.exe

C:\Windows\System\VsUBiKH.exe

C:\Windows\System\dygzMrS.exe

C:\Windows\System\dygzMrS.exe

C:\Windows\System\WmcPGeL.exe

C:\Windows\System\WmcPGeL.exe

C:\Windows\System\SAlZCPf.exe

C:\Windows\System\SAlZCPf.exe

C:\Windows\System\LzleAeT.exe

C:\Windows\System\LzleAeT.exe

C:\Windows\System\UlXCgrJ.exe

C:\Windows\System\UlXCgrJ.exe

C:\Windows\System\PUuFnHV.exe

C:\Windows\System\PUuFnHV.exe

C:\Windows\System\IPoXZer.exe

C:\Windows\System\IPoXZer.exe

C:\Windows\System\fOgtkFV.exe

C:\Windows\System\fOgtkFV.exe

C:\Windows\System\SHqgIyc.exe

C:\Windows\System\SHqgIyc.exe

C:\Windows\System\NsTgHrJ.exe

C:\Windows\System\NsTgHrJ.exe

C:\Windows\System\MZlIdZk.exe

C:\Windows\System\MZlIdZk.exe

C:\Windows\System\hMkjSpZ.exe

C:\Windows\System\hMkjSpZ.exe

C:\Windows\System\LyHtJtT.exe

C:\Windows\System\LyHtJtT.exe

C:\Windows\System\LyEAPwa.exe

C:\Windows\System\LyEAPwa.exe

C:\Windows\System\bXFFlcS.exe

C:\Windows\System\bXFFlcS.exe

C:\Windows\System\UeJimHC.exe

C:\Windows\System\UeJimHC.exe

C:\Windows\System\BPpQpXn.exe

C:\Windows\System\BPpQpXn.exe

C:\Windows\System\TnAzFzv.exe

C:\Windows\System\TnAzFzv.exe

C:\Windows\System\LBBZCHk.exe

C:\Windows\System\LBBZCHk.exe

C:\Windows\System\ItNeglW.exe

C:\Windows\System\ItNeglW.exe

C:\Windows\System\VXhBeZc.exe

C:\Windows\System\VXhBeZc.exe

C:\Windows\System\idxYKoU.exe

C:\Windows\System\idxYKoU.exe

C:\Windows\System\itwyuTs.exe

C:\Windows\System\itwyuTs.exe

C:\Windows\System\wdMdesJ.exe

C:\Windows\System\wdMdesJ.exe

C:\Windows\System\oQhjdjS.exe

C:\Windows\System\oQhjdjS.exe

C:\Windows\System\hLgGlOu.exe

C:\Windows\System\hLgGlOu.exe

C:\Windows\System\XzSbBCb.exe

C:\Windows\System\XzSbBCb.exe

C:\Windows\System\wArlsdd.exe

C:\Windows\System\wArlsdd.exe

C:\Windows\System\kOfXkrO.exe

C:\Windows\System\kOfXkrO.exe

C:\Windows\System\jWrOiUj.exe

C:\Windows\System\jWrOiUj.exe

C:\Windows\System\Pyiaeif.exe

C:\Windows\System\Pyiaeif.exe

C:\Windows\System\bpkzjif.exe

C:\Windows\System\bpkzjif.exe

C:\Windows\System\rFVnTTL.exe

C:\Windows\System\rFVnTTL.exe

C:\Windows\System\vdndWkI.exe

C:\Windows\System\vdndWkI.exe

C:\Windows\System\sCBDgIe.exe

C:\Windows\System\sCBDgIe.exe

C:\Windows\System\WMcBEoA.exe

C:\Windows\System\WMcBEoA.exe

C:\Windows\System\NyVdtPS.exe

C:\Windows\System\NyVdtPS.exe

C:\Windows\System\iUQXPKq.exe

C:\Windows\System\iUQXPKq.exe

C:\Windows\System\EthDThN.exe

C:\Windows\System\EthDThN.exe

C:\Windows\System\colEzdF.exe

C:\Windows\System\colEzdF.exe

C:\Windows\System\NVzJFCs.exe

C:\Windows\System\NVzJFCs.exe

C:\Windows\System\kTfJerV.exe

C:\Windows\System\kTfJerV.exe

C:\Windows\System\mvQnPQm.exe

C:\Windows\System\mvQnPQm.exe

C:\Windows\System\vEzhayJ.exe

C:\Windows\System\vEzhayJ.exe

C:\Windows\System\bxVTTWw.exe

C:\Windows\System\bxVTTWw.exe

C:\Windows\System\XreUpbR.exe

C:\Windows\System\XreUpbR.exe

C:\Windows\System\AJLPZLv.exe

C:\Windows\System\AJLPZLv.exe

C:\Windows\System\AzfwcXv.exe

C:\Windows\System\AzfwcXv.exe

C:\Windows\System\cVrJvce.exe

C:\Windows\System\cVrJvce.exe

C:\Windows\System\WkLiJrN.exe

C:\Windows\System\WkLiJrN.exe

C:\Windows\System\WUdXYiP.exe

C:\Windows\System\WUdXYiP.exe

C:\Windows\System\SNzydTP.exe

C:\Windows\System\SNzydTP.exe

C:\Windows\System\WdmwBmD.exe

C:\Windows\System\WdmwBmD.exe

C:\Windows\System\hdcIhvK.exe

C:\Windows\System\hdcIhvK.exe

C:\Windows\System\CCyTOif.exe

C:\Windows\System\CCyTOif.exe

C:\Windows\System\eCnPYwM.exe

C:\Windows\System\eCnPYwM.exe

C:\Windows\System\AMrEtyn.exe

C:\Windows\System\AMrEtyn.exe

C:\Windows\System\rtlKWnb.exe

C:\Windows\System\rtlKWnb.exe

C:\Windows\System\SKsLqQd.exe

C:\Windows\System\SKsLqQd.exe

C:\Windows\System\gYOlRAH.exe

C:\Windows\System\gYOlRAH.exe

C:\Windows\System\BryKmzI.exe

C:\Windows\System\BryKmzI.exe

C:\Windows\System\BzIhodk.exe

C:\Windows\System\BzIhodk.exe

C:\Windows\System\KeqPjRX.exe

C:\Windows\System\KeqPjRX.exe

C:\Windows\System\FYGMkGJ.exe

C:\Windows\System\FYGMkGJ.exe

C:\Windows\System\zsBEkmo.exe

C:\Windows\System\zsBEkmo.exe

C:\Windows\System\OEsDbgp.exe

C:\Windows\System\OEsDbgp.exe

C:\Windows\System\AQEtQXl.exe

C:\Windows\System\AQEtQXl.exe

C:\Windows\System\OKlEFpM.exe

C:\Windows\System\OKlEFpM.exe

C:\Windows\System\UCxtXkp.exe

C:\Windows\System\UCxtXkp.exe

C:\Windows\System\nGVGZnu.exe

C:\Windows\System\nGVGZnu.exe

C:\Windows\System\zfbHFOe.exe

C:\Windows\System\zfbHFOe.exe

C:\Windows\System\FzuYXUV.exe

C:\Windows\System\FzuYXUV.exe

C:\Windows\System\Dzknchb.exe

C:\Windows\System\Dzknchb.exe

C:\Windows\System\hWsuxGI.exe

C:\Windows\System\hWsuxGI.exe

C:\Windows\System\ZGsHxEG.exe

C:\Windows\System\ZGsHxEG.exe

C:\Windows\System\VDcKnem.exe

C:\Windows\System\VDcKnem.exe

C:\Windows\System\UcWkbFN.exe

C:\Windows\System\UcWkbFN.exe

C:\Windows\System\FRTGtvD.exe

C:\Windows\System\FRTGtvD.exe

C:\Windows\System\IJpLVMF.exe

C:\Windows\System\IJpLVMF.exe

C:\Windows\System\wjFyMCM.exe

C:\Windows\System\wjFyMCM.exe

C:\Windows\System\aemOlFB.exe

C:\Windows\System\aemOlFB.exe

C:\Windows\System\yBHvtvJ.exe

C:\Windows\System\yBHvtvJ.exe

C:\Windows\System\dHOzCAA.exe

C:\Windows\System\dHOzCAA.exe

C:\Windows\System\bzCUaew.exe

C:\Windows\System\bzCUaew.exe

C:\Windows\System\qTafDTv.exe

C:\Windows\System\qTafDTv.exe

C:\Windows\System\ocIPnIV.exe

C:\Windows\System\ocIPnIV.exe

C:\Windows\System\ggIpSID.exe

C:\Windows\System\ggIpSID.exe

C:\Windows\System\lqdFkKK.exe

C:\Windows\System\lqdFkKK.exe

C:\Windows\System\YvrNhPu.exe

C:\Windows\System\YvrNhPu.exe

C:\Windows\System\BqBZcVf.exe

C:\Windows\System\BqBZcVf.exe

C:\Windows\System\sdKbSAK.exe

C:\Windows\System\sdKbSAK.exe

C:\Windows\System\DycnNDK.exe

C:\Windows\System\DycnNDK.exe

C:\Windows\System\zAWedyw.exe

C:\Windows\System\zAWedyw.exe

C:\Windows\System\nQOnbwE.exe

C:\Windows\System\nQOnbwE.exe

C:\Windows\System\iuxRliq.exe

C:\Windows\System\iuxRliq.exe

C:\Windows\System\kJmQHjl.exe

C:\Windows\System\kJmQHjl.exe

C:\Windows\System\IgbJDzc.exe

C:\Windows\System\IgbJDzc.exe

C:\Windows\System\LhgAKux.exe

C:\Windows\System\LhgAKux.exe

C:\Windows\System\hsCKjwX.exe

C:\Windows\System\hsCKjwX.exe

C:\Windows\System\fYBRchu.exe

C:\Windows\System\fYBRchu.exe

C:\Windows\System\LfuIGRX.exe

C:\Windows\System\LfuIGRX.exe

C:\Windows\System\NYkVpYF.exe

C:\Windows\System\NYkVpYF.exe

C:\Windows\System\Dkjqopw.exe

C:\Windows\System\Dkjqopw.exe

C:\Windows\System\prcSijE.exe

C:\Windows\System\prcSijE.exe

C:\Windows\System\SsYMHML.exe

C:\Windows\System\SsYMHML.exe

C:\Windows\System\hNQwjIV.exe

C:\Windows\System\hNQwjIV.exe

C:\Windows\System\FwnKNIE.exe

C:\Windows\System\FwnKNIE.exe

C:\Windows\System\PSSbpTt.exe

C:\Windows\System\PSSbpTt.exe

C:\Windows\System\vSygNph.exe

C:\Windows\System\vSygNph.exe

C:\Windows\System\ltoWEGZ.exe

C:\Windows\System\ltoWEGZ.exe

C:\Windows\System\DwnbQBI.exe

C:\Windows\System\DwnbQBI.exe

C:\Windows\System\pPHRgsi.exe

C:\Windows\System\pPHRgsi.exe

C:\Windows\System\ruhNygW.exe

C:\Windows\System\ruhNygW.exe

C:\Windows\System\xgNuFzX.exe

C:\Windows\System\xgNuFzX.exe

C:\Windows\System\cssQMGe.exe

C:\Windows\System\cssQMGe.exe

C:\Windows\System\LkeSOai.exe

C:\Windows\System\LkeSOai.exe

C:\Windows\System\dMKmUaQ.exe

C:\Windows\System\dMKmUaQ.exe

C:\Windows\System\SCIMhGU.exe

C:\Windows\System\SCIMhGU.exe

C:\Windows\System\EnxUMnj.exe

C:\Windows\System\EnxUMnj.exe

C:\Windows\System\WRWWClj.exe

C:\Windows\System\WRWWClj.exe

C:\Windows\System\MSgGXGf.exe

C:\Windows\System\MSgGXGf.exe

C:\Windows\System\MMWSfjZ.exe

C:\Windows\System\MMWSfjZ.exe

C:\Windows\System\QpEEtXR.exe

C:\Windows\System\QpEEtXR.exe

C:\Windows\System\MRZODCc.exe

C:\Windows\System\MRZODCc.exe

C:\Windows\System\QjrwDVt.exe

C:\Windows\System\QjrwDVt.exe

C:\Windows\System\ygKKnNO.exe

C:\Windows\System\ygKKnNO.exe

C:\Windows\System\DKaJZLI.exe

C:\Windows\System\DKaJZLI.exe

C:\Windows\System\DQVtTUQ.exe

C:\Windows\System\DQVtTUQ.exe

C:\Windows\System\GMsDXsC.exe

C:\Windows\System\GMsDXsC.exe

C:\Windows\System\aizAkld.exe

C:\Windows\System\aizAkld.exe

C:\Windows\System\IomSoqg.exe

C:\Windows\System\IomSoqg.exe

C:\Windows\System\NzjiBUT.exe

C:\Windows\System\NzjiBUT.exe

C:\Windows\System\eeeRGnP.exe

C:\Windows\System\eeeRGnP.exe

C:\Windows\System\UOCmioH.exe

C:\Windows\System\UOCmioH.exe

C:\Windows\System\jFcRkmY.exe

C:\Windows\System\jFcRkmY.exe

C:\Windows\System\BxPBaFT.exe

C:\Windows\System\BxPBaFT.exe

C:\Windows\System\nmvCcba.exe

C:\Windows\System\nmvCcba.exe

C:\Windows\System\oYgyBMl.exe

C:\Windows\System\oYgyBMl.exe

C:\Windows\System\dTLkjVl.exe

C:\Windows\System\dTLkjVl.exe

C:\Windows\System\qwmITqK.exe

C:\Windows\System\qwmITqK.exe

C:\Windows\System\fjdQNvo.exe

C:\Windows\System\fjdQNvo.exe

C:\Windows\System\DvMQtyX.exe

C:\Windows\System\DvMQtyX.exe

C:\Windows\System\daaNIQs.exe

C:\Windows\System\daaNIQs.exe

C:\Windows\System\ewEVgAx.exe

C:\Windows\System\ewEVgAx.exe

C:\Windows\System\fIIAjUv.exe

C:\Windows\System\fIIAjUv.exe

C:\Windows\System\EnPptXK.exe

C:\Windows\System\EnPptXK.exe

C:\Windows\System\qtHWfrd.exe

C:\Windows\System\qtHWfrd.exe

C:\Windows\System\qoCuLri.exe

C:\Windows\System\qoCuLri.exe

C:\Windows\System\XKrqUzN.exe

C:\Windows\System\XKrqUzN.exe

C:\Windows\System\nCMcToB.exe

C:\Windows\System\nCMcToB.exe

C:\Windows\System\KUBmkxG.exe

C:\Windows\System\KUBmkxG.exe

C:\Windows\System\wIaiSuk.exe

C:\Windows\System\wIaiSuk.exe

C:\Windows\System\wQzrQia.exe

C:\Windows\System\wQzrQia.exe

C:\Windows\System\YBamraV.exe

C:\Windows\System\YBamraV.exe

C:\Windows\System\sMlZjpX.exe

C:\Windows\System\sMlZjpX.exe

C:\Windows\System\ryuYocv.exe

C:\Windows\System\ryuYocv.exe

C:\Windows\System\FTVbirf.exe

C:\Windows\System\FTVbirf.exe

C:\Windows\System\EgHwrce.exe

C:\Windows\System\EgHwrce.exe

C:\Windows\System\JUmoTGx.exe

C:\Windows\System\JUmoTGx.exe

C:\Windows\System\MFBxFOJ.exe

C:\Windows\System\MFBxFOJ.exe

C:\Windows\System\RVraeYY.exe

C:\Windows\System\RVraeYY.exe

C:\Windows\System\uZxoEpo.exe

C:\Windows\System\uZxoEpo.exe

C:\Windows\System\wWeVXBU.exe

C:\Windows\System\wWeVXBU.exe

C:\Windows\System\djbkQOX.exe

C:\Windows\System\djbkQOX.exe

C:\Windows\System\XPMILZR.exe

C:\Windows\System\XPMILZR.exe

C:\Windows\System\RdCbhuI.exe

C:\Windows\System\RdCbhuI.exe

C:\Windows\System\rtzUcNC.exe

C:\Windows\System\rtzUcNC.exe

C:\Windows\System\FLixSTA.exe

C:\Windows\System\FLixSTA.exe

C:\Windows\System\TpiBbbh.exe

C:\Windows\System\TpiBbbh.exe

C:\Windows\System\yjbAdDC.exe

C:\Windows\System\yjbAdDC.exe

C:\Windows\System\mRdztOE.exe

C:\Windows\System\mRdztOE.exe

C:\Windows\System\BSfRiYQ.exe

C:\Windows\System\BSfRiYQ.exe

C:\Windows\System\ByLTrrb.exe

C:\Windows\System\ByLTrrb.exe

C:\Windows\System\fmfMBBJ.exe

C:\Windows\System\fmfMBBJ.exe

C:\Windows\System\nqlJLbx.exe

C:\Windows\System\nqlJLbx.exe

C:\Windows\System\VMdoePc.exe

C:\Windows\System\VMdoePc.exe

C:\Windows\System\CQowPxG.exe

C:\Windows\System\CQowPxG.exe

C:\Windows\System\SoOKtZS.exe

C:\Windows\System\SoOKtZS.exe

C:\Windows\System\gweSxYG.exe

C:\Windows\System\gweSxYG.exe

C:\Windows\System\ZmiBCVm.exe

C:\Windows\System\ZmiBCVm.exe

C:\Windows\System\PEjSYvS.exe

C:\Windows\System\PEjSYvS.exe

C:\Windows\System\chBUkIr.exe

C:\Windows\System\chBUkIr.exe

C:\Windows\System\bPIdTUO.exe

C:\Windows\System\bPIdTUO.exe

C:\Windows\System\UJAtRAg.exe

C:\Windows\System\UJAtRAg.exe

C:\Windows\System\QmLjThP.exe

C:\Windows\System\QmLjThP.exe

C:\Windows\System\BTzgVSM.exe

C:\Windows\System\BTzgVSM.exe

C:\Windows\System\NTXGFZa.exe

C:\Windows\System\NTXGFZa.exe

C:\Windows\System\UkOjErp.exe

C:\Windows\System\UkOjErp.exe

C:\Windows\System\xAEPhdL.exe

C:\Windows\System\xAEPhdL.exe

C:\Windows\System\fzFCoRT.exe

C:\Windows\System\fzFCoRT.exe

C:\Windows\System\pCThOwl.exe

C:\Windows\System\pCThOwl.exe

C:\Windows\System\BYavvIs.exe

C:\Windows\System\BYavvIs.exe

C:\Windows\System\FKsahzA.exe

C:\Windows\System\FKsahzA.exe

C:\Windows\System\XomnZXG.exe

C:\Windows\System\XomnZXG.exe

C:\Windows\System\iQEMkCU.exe

C:\Windows\System\iQEMkCU.exe

C:\Windows\System\BqajUDv.exe

C:\Windows\System\BqajUDv.exe

C:\Windows\System\ISjWucS.exe

C:\Windows\System\ISjWucS.exe

C:\Windows\System\aktVuQL.exe

C:\Windows\System\aktVuQL.exe

C:\Windows\System\HtuLFSO.exe

C:\Windows\System\HtuLFSO.exe

C:\Windows\System\FKvvGJD.exe

C:\Windows\System\FKvvGJD.exe

C:\Windows\System\lqAnCGR.exe

C:\Windows\System\lqAnCGR.exe

C:\Windows\System\mWrypEc.exe

C:\Windows\System\mWrypEc.exe

C:\Windows\System\vJtJEQu.exe

C:\Windows\System\vJtJEQu.exe

C:\Windows\System\rbNppjB.exe

C:\Windows\System\rbNppjB.exe

C:\Windows\System\ptMpDIl.exe

C:\Windows\System\ptMpDIl.exe

C:\Windows\System\ZeiFgBf.exe

C:\Windows\System\ZeiFgBf.exe

C:\Windows\System\LAIJVwr.exe

C:\Windows\System\LAIJVwr.exe

C:\Windows\System\LZbAYwn.exe

C:\Windows\System\LZbAYwn.exe

C:\Windows\System\JHYgvHF.exe

C:\Windows\System\JHYgvHF.exe

C:\Windows\System\EGtYiUg.exe

C:\Windows\System\EGtYiUg.exe

C:\Windows\System\VbfrQgw.exe

C:\Windows\System\VbfrQgw.exe

C:\Windows\System\LrSfycf.exe

C:\Windows\System\LrSfycf.exe

C:\Windows\System\ipTKuOv.exe

C:\Windows\System\ipTKuOv.exe

C:\Windows\System\DGyWSdC.exe

C:\Windows\System\DGyWSdC.exe

C:\Windows\System\WjEOdmx.exe

C:\Windows\System\WjEOdmx.exe

C:\Windows\System\KRisywc.exe

C:\Windows\System\KRisywc.exe

C:\Windows\System\gvIHymx.exe

C:\Windows\System\gvIHymx.exe

C:\Windows\System\qEKADJt.exe

C:\Windows\System\qEKADJt.exe

C:\Windows\System\CqBQVEK.exe

C:\Windows\System\CqBQVEK.exe

C:\Windows\System\fQCUqST.exe

C:\Windows\System\fQCUqST.exe

C:\Windows\System\uGDMACR.exe

C:\Windows\System\uGDMACR.exe

C:\Windows\System\iydvtkT.exe

C:\Windows\System\iydvtkT.exe

C:\Windows\System\pYoLrWf.exe

C:\Windows\System\pYoLrWf.exe

C:\Windows\System\CVibjnW.exe

C:\Windows\System\CVibjnW.exe

C:\Windows\System\jgMvHRf.exe

C:\Windows\System\jgMvHRf.exe

C:\Windows\System\LSWVlLg.exe

C:\Windows\System\LSWVlLg.exe

C:\Windows\System\ipCaTho.exe

C:\Windows\System\ipCaTho.exe

C:\Windows\System\XjUfacN.exe

C:\Windows\System\XjUfacN.exe

C:\Windows\System\xcdaSzC.exe

C:\Windows\System\xcdaSzC.exe

C:\Windows\System\doaQYdS.exe

C:\Windows\System\doaQYdS.exe

C:\Windows\System\nMENrGP.exe

C:\Windows\System\nMENrGP.exe

C:\Windows\System\orBKiqn.exe

C:\Windows\System\orBKiqn.exe

C:\Windows\System\htuDiCU.exe

C:\Windows\System\htuDiCU.exe

C:\Windows\System\dljlfLx.exe

C:\Windows\System\dljlfLx.exe

C:\Windows\System\NbLKdfe.exe

C:\Windows\System\NbLKdfe.exe

C:\Windows\System\GURFlgc.exe

C:\Windows\System\GURFlgc.exe

C:\Windows\System\XLzfGWf.exe

C:\Windows\System\XLzfGWf.exe

C:\Windows\System\qpEwhtV.exe

C:\Windows\System\qpEwhtV.exe

C:\Windows\System\vhYbTFS.exe

C:\Windows\System\vhYbTFS.exe

C:\Windows\System\TdAoMcu.exe

C:\Windows\System\TdAoMcu.exe

C:\Windows\System\SVIHbix.exe

C:\Windows\System\SVIHbix.exe

C:\Windows\System\ysqDLiL.exe

C:\Windows\System\ysqDLiL.exe

C:\Windows\System\LcMJDIc.exe

C:\Windows\System\LcMJDIc.exe

C:\Windows\System\vawfJxh.exe

C:\Windows\System\vawfJxh.exe

C:\Windows\System\bbPDQvS.exe

C:\Windows\System\bbPDQvS.exe

C:\Windows\System\KpsmmCF.exe

C:\Windows\System\KpsmmCF.exe

C:\Windows\System\rsqpulM.exe

C:\Windows\System\rsqpulM.exe

C:\Windows\System\lBXicBz.exe

C:\Windows\System\lBXicBz.exe

C:\Windows\System\hEXTKtC.exe

C:\Windows\System\hEXTKtC.exe

C:\Windows\System\rawSvKo.exe

C:\Windows\System\rawSvKo.exe

C:\Windows\System\hpmihRi.exe

C:\Windows\System\hpmihRi.exe

C:\Windows\System\NpVenxV.exe

C:\Windows\System\NpVenxV.exe

C:\Windows\System\llUTfHY.exe

C:\Windows\System\llUTfHY.exe

C:\Windows\System\FJTpApk.exe

C:\Windows\System\FJTpApk.exe

C:\Windows\System\TXyhijN.exe

C:\Windows\System\TXyhijN.exe

C:\Windows\System\tskmELm.exe

C:\Windows\System\tskmELm.exe

C:\Windows\System\tWTISaB.exe

C:\Windows\System\tWTISaB.exe

C:\Windows\System\UKNfQgl.exe

C:\Windows\System\UKNfQgl.exe

C:\Windows\System\EAOnEJv.exe

C:\Windows\System\EAOnEJv.exe

C:\Windows\System\moDzdXG.exe

C:\Windows\System\moDzdXG.exe

C:\Windows\System\YnQUyPP.exe

C:\Windows\System\YnQUyPP.exe

C:\Windows\System\ARFDkwb.exe

C:\Windows\System\ARFDkwb.exe

C:\Windows\System\UvGwtHD.exe

C:\Windows\System\UvGwtHD.exe

C:\Windows\System\DkHiXqE.exe

C:\Windows\System\DkHiXqE.exe

C:\Windows\System\nJPUeFL.exe

C:\Windows\System\nJPUeFL.exe

C:\Windows\System\XcHwldU.exe

C:\Windows\System\XcHwldU.exe

C:\Windows\System\cuTcfah.exe

C:\Windows\System\cuTcfah.exe

C:\Windows\System\phGtOwg.exe

C:\Windows\System\phGtOwg.exe

C:\Windows\System\GMWUjaI.exe

C:\Windows\System\GMWUjaI.exe

C:\Windows\System\MMqxZsn.exe

C:\Windows\System\MMqxZsn.exe

C:\Windows\System\iVVAdEp.exe

C:\Windows\System\iVVAdEp.exe

C:\Windows\System\SKlYUeS.exe

C:\Windows\System\SKlYUeS.exe

C:\Windows\System\jhNAWSi.exe

C:\Windows\System\jhNAWSi.exe

C:\Windows\System\DIEkPLv.exe

C:\Windows\System\DIEkPLv.exe

C:\Windows\System\IWeMiHx.exe

C:\Windows\System\IWeMiHx.exe

C:\Windows\System\fkdSkSs.exe

C:\Windows\System\fkdSkSs.exe

C:\Windows\System\TlKjFqo.exe

C:\Windows\System\TlKjFqo.exe

C:\Windows\System\gomOuxa.exe

C:\Windows\System\gomOuxa.exe

C:\Windows\System\mvIKJkI.exe

C:\Windows\System\mvIKJkI.exe

C:\Windows\System\TjGXFYd.exe

C:\Windows\System\TjGXFYd.exe

C:\Windows\System\REzGCCI.exe

C:\Windows\System\REzGCCI.exe

C:\Windows\System\OjvTcre.exe

C:\Windows\System\OjvTcre.exe

C:\Windows\System\CRoQEAW.exe

C:\Windows\System\CRoQEAW.exe

C:\Windows\System\hsTvvMb.exe

C:\Windows\System\hsTvvMb.exe

C:\Windows\System\NJFbmLM.exe

C:\Windows\System\NJFbmLM.exe

C:\Windows\System\MTKiKMD.exe

C:\Windows\System\MTKiKMD.exe

C:\Windows\System\CKbMCuy.exe

C:\Windows\System\CKbMCuy.exe

C:\Windows\System\DNTnxnV.exe

C:\Windows\System\DNTnxnV.exe

C:\Windows\System\NpfSuGq.exe

C:\Windows\System\NpfSuGq.exe

C:\Windows\System\CSakALO.exe

C:\Windows\System\CSakALO.exe

C:\Windows\System\HbZQAnp.exe

C:\Windows\System\HbZQAnp.exe

C:\Windows\System\eFWwOhR.exe

C:\Windows\System\eFWwOhR.exe

C:\Windows\System\jMmUIDs.exe

C:\Windows\System\jMmUIDs.exe

C:\Windows\System\Ftvweno.exe

C:\Windows\System\Ftvweno.exe

C:\Windows\System\QmumoKV.exe

C:\Windows\System\QmumoKV.exe

C:\Windows\System\ZfPXfGH.exe

C:\Windows\System\ZfPXfGH.exe

C:\Windows\System\DvDXMsp.exe

C:\Windows\System\DvDXMsp.exe

C:\Windows\System\TfefKGK.exe

C:\Windows\System\TfefKGK.exe

C:\Windows\System\sAhdqBC.exe

C:\Windows\System\sAhdqBC.exe

C:\Windows\System\ZtJFbBf.exe

C:\Windows\System\ZtJFbBf.exe

C:\Windows\System\LYnUKwA.exe

C:\Windows\System\LYnUKwA.exe

C:\Windows\System\hyvAcgJ.exe

C:\Windows\System\hyvAcgJ.exe

C:\Windows\System\oHmwbnO.exe

C:\Windows\System\oHmwbnO.exe

C:\Windows\System\gSSZjjP.exe

C:\Windows\System\gSSZjjP.exe

C:\Windows\System\LfHwBbY.exe

C:\Windows\System\LfHwBbY.exe

C:\Windows\System\otvCsUl.exe

C:\Windows\System\otvCsUl.exe

C:\Windows\System\sUJhBGL.exe

C:\Windows\System\sUJhBGL.exe

C:\Windows\System\XofdqsU.exe

C:\Windows\System\XofdqsU.exe

C:\Windows\System\mbCxdxr.exe

C:\Windows\System\mbCxdxr.exe

C:\Windows\System\xkpIGlz.exe

C:\Windows\System\xkpIGlz.exe

C:\Windows\System\nMFAbHH.exe

C:\Windows\System\nMFAbHH.exe

C:\Windows\System\tIZEBkz.exe

C:\Windows\System\tIZEBkz.exe

C:\Windows\System\KMdqbtt.exe

C:\Windows\System\KMdqbtt.exe

C:\Windows\System\FpUiiML.exe

C:\Windows\System\FpUiiML.exe

C:\Windows\System\KMJiqLu.exe

C:\Windows\System\KMJiqLu.exe

C:\Windows\System\mYJVFzt.exe

C:\Windows\System\mYJVFzt.exe

C:\Windows\System\QWgYajx.exe

C:\Windows\System\QWgYajx.exe

C:\Windows\System\koeLKKM.exe

C:\Windows\System\koeLKKM.exe

C:\Windows\System\CSrcYJV.exe

C:\Windows\System\CSrcYJV.exe

C:\Windows\System\vUJSVju.exe

C:\Windows\System\vUJSVju.exe

C:\Windows\System\SsCFhSW.exe

C:\Windows\System\SsCFhSW.exe

C:\Windows\System\DtXwHfa.exe

C:\Windows\System\DtXwHfa.exe

C:\Windows\System\gdUcpim.exe

C:\Windows\System\gdUcpim.exe

C:\Windows\System\PQKyxvU.exe

C:\Windows\System\PQKyxvU.exe

C:\Windows\System\WYtDTEu.exe

C:\Windows\System\WYtDTEu.exe

C:\Windows\System\vPTxVlH.exe

C:\Windows\System\vPTxVlH.exe

C:\Windows\System\JwIEsDI.exe

C:\Windows\System\JwIEsDI.exe

C:\Windows\System\bCjKIqr.exe

C:\Windows\System\bCjKIqr.exe

C:\Windows\System\lyngBEg.exe

C:\Windows\System\lyngBEg.exe

C:\Windows\System\qKtLyFN.exe

C:\Windows\System\qKtLyFN.exe

C:\Windows\System\YUREOdB.exe

C:\Windows\System\YUREOdB.exe

C:\Windows\System\oEFhtFD.exe

C:\Windows\System\oEFhtFD.exe

C:\Windows\System\FPDbzLg.exe

C:\Windows\System\FPDbzLg.exe

C:\Windows\System\UMDgRsL.exe

C:\Windows\System\UMDgRsL.exe

C:\Windows\System\twTbEcT.exe

C:\Windows\System\twTbEcT.exe

C:\Windows\System\gvHuFCA.exe

C:\Windows\System\gvHuFCA.exe

C:\Windows\System\WolPUVn.exe

C:\Windows\System\WolPUVn.exe

C:\Windows\System\pyCpBJg.exe

C:\Windows\System\pyCpBJg.exe

C:\Windows\System\QIxPwZr.exe

C:\Windows\System\QIxPwZr.exe

C:\Windows\System\NrVVNIk.exe

C:\Windows\System\NrVVNIk.exe

C:\Windows\System\gZmqUVq.exe

C:\Windows\System\gZmqUVq.exe

C:\Windows\System\dAHJCql.exe

C:\Windows\System\dAHJCql.exe

C:\Windows\System\iSylzdS.exe

C:\Windows\System\iSylzdS.exe

C:\Windows\System\qRGnyKF.exe

C:\Windows\System\qRGnyKF.exe

C:\Windows\System\zwIxdar.exe

C:\Windows\System\zwIxdar.exe

C:\Windows\System\FymXNqp.exe

C:\Windows\System\FymXNqp.exe

C:\Windows\System\ZLKtfvn.exe

C:\Windows\System\ZLKtfvn.exe

C:\Windows\System\CmGdKSb.exe

C:\Windows\System\CmGdKSb.exe

C:\Windows\System\rAjvpjo.exe

C:\Windows\System\rAjvpjo.exe

C:\Windows\System\LtIcGFg.exe

C:\Windows\System\LtIcGFg.exe

C:\Windows\System\MKZYHiX.exe

C:\Windows\System\MKZYHiX.exe

C:\Windows\System\XZEEdEa.exe

C:\Windows\System\XZEEdEa.exe

C:\Windows\System\QMItRMJ.exe

C:\Windows\System\QMItRMJ.exe

C:\Windows\System\daWfPRO.exe

C:\Windows\System\daWfPRO.exe

C:\Windows\System\yNJTRzn.exe

C:\Windows\System\yNJTRzn.exe

C:\Windows\System\titlePC.exe

C:\Windows\System\titlePC.exe

C:\Windows\System\DdaIYib.exe

C:\Windows\System\DdaIYib.exe

C:\Windows\System\jBGjeuh.exe

C:\Windows\System\jBGjeuh.exe

C:\Windows\System\eZrdUCC.exe

C:\Windows\System\eZrdUCC.exe

C:\Windows\System\RzQudtw.exe

C:\Windows\System\RzQudtw.exe

C:\Windows\System\mCGuVzn.exe

C:\Windows\System\mCGuVzn.exe

C:\Windows\System\PlZmOLp.exe

C:\Windows\System\PlZmOLp.exe

C:\Windows\System\JqqpXVz.exe

C:\Windows\System\JqqpXVz.exe

C:\Windows\System\vojoQmN.exe

C:\Windows\System\vojoQmN.exe

C:\Windows\System\hhzWSwj.exe

C:\Windows\System\hhzWSwj.exe

C:\Windows\System\hNvCxrs.exe

C:\Windows\System\hNvCxrs.exe

C:\Windows\System\dDAwVaJ.exe

C:\Windows\System\dDAwVaJ.exe

C:\Windows\System\nUYHLQN.exe

C:\Windows\System\nUYHLQN.exe

C:\Windows\System\cYbNuFv.exe

C:\Windows\System\cYbNuFv.exe

C:\Windows\System\ZFWKvZx.exe

C:\Windows\System\ZFWKvZx.exe

C:\Windows\System\wZuyzXo.exe

C:\Windows\System\wZuyzXo.exe

C:\Windows\System\WkARuAK.exe

C:\Windows\System\WkARuAK.exe

C:\Windows\System\ELlQnoW.exe

C:\Windows\System\ELlQnoW.exe

C:\Windows\System\QmjFZgE.exe

C:\Windows\System\QmjFZgE.exe

C:\Windows\System\YmCfycY.exe

C:\Windows\System\YmCfycY.exe

C:\Windows\System\kgGaNpB.exe

C:\Windows\System\kgGaNpB.exe

C:\Windows\System\InsYzxf.exe

C:\Windows\System\InsYzxf.exe

C:\Windows\System\ldnqONK.exe

C:\Windows\System\ldnqONK.exe

C:\Windows\System\PPDUnjR.exe

C:\Windows\System\PPDUnjR.exe

C:\Windows\System\phzSGBR.exe

C:\Windows\System\phzSGBR.exe

C:\Windows\System\hnvbFeN.exe

C:\Windows\System\hnvbFeN.exe

C:\Windows\System\TifBTOd.exe

C:\Windows\System\TifBTOd.exe

C:\Windows\System\avRZtbA.exe

C:\Windows\System\avRZtbA.exe

C:\Windows\System\AAacOuA.exe

C:\Windows\System\AAacOuA.exe

C:\Windows\System\vJAGDVL.exe

C:\Windows\System\vJAGDVL.exe

C:\Windows\System\UXtiCwl.exe

C:\Windows\System\UXtiCwl.exe

C:\Windows\System\zxdlbNo.exe

C:\Windows\System\zxdlbNo.exe

C:\Windows\System\RRTJcuy.exe

C:\Windows\System\RRTJcuy.exe

C:\Windows\System\EsJLFAn.exe

C:\Windows\System\EsJLFAn.exe

C:\Windows\System\rgvdVqG.exe

C:\Windows\System\rgvdVqG.exe

C:\Windows\System\LGLfFUR.exe

C:\Windows\System\LGLfFUR.exe

C:\Windows\System\KAjLSEz.exe

C:\Windows\System\KAjLSEz.exe

C:\Windows\System\oFFebPm.exe

C:\Windows\System\oFFebPm.exe

C:\Windows\System\gNkXcjR.exe

C:\Windows\System\gNkXcjR.exe

C:\Windows\System\yqOJJqn.exe

C:\Windows\System\yqOJJqn.exe

C:\Windows\System\bSpToqq.exe

C:\Windows\System\bSpToqq.exe

C:\Windows\System\zihgziG.exe

C:\Windows\System\zihgziG.exe

C:\Windows\System\ZTWuULt.exe

C:\Windows\System\ZTWuULt.exe

C:\Windows\System\NJqRBwY.exe

C:\Windows\System\NJqRBwY.exe

C:\Windows\System\JgNgjgO.exe

C:\Windows\System\JgNgjgO.exe

C:\Windows\System\pStBURT.exe

C:\Windows\System\pStBURT.exe

C:\Windows\System\RxYnYAv.exe

C:\Windows\System\RxYnYAv.exe

C:\Windows\System\MqYzXAH.exe

C:\Windows\System\MqYzXAH.exe

C:\Windows\System\rQDPYNR.exe

C:\Windows\System\rQDPYNR.exe

C:\Windows\System\vZxJESq.exe

C:\Windows\System\vZxJESq.exe

C:\Windows\System\HmHrsDY.exe

C:\Windows\System\HmHrsDY.exe

C:\Windows\System\bvtjMHH.exe

C:\Windows\System\bvtjMHH.exe

C:\Windows\System\sXZVnyt.exe

C:\Windows\System\sXZVnyt.exe

C:\Windows\System\NxuLmiZ.exe

C:\Windows\System\NxuLmiZ.exe

C:\Windows\System\qVCMbAy.exe

C:\Windows\System\qVCMbAy.exe

C:\Windows\System\jGcDLkf.exe

C:\Windows\System\jGcDLkf.exe

C:\Windows\System\tSHOAQS.exe

C:\Windows\System\tSHOAQS.exe

C:\Windows\System\XLUsxsL.exe

C:\Windows\System\XLUsxsL.exe

C:\Windows\System\DOXFklX.exe

C:\Windows\System\DOXFklX.exe

C:\Windows\System\CJEAvrN.exe

C:\Windows\System\CJEAvrN.exe

C:\Windows\System\WpVuRMM.exe

C:\Windows\System\WpVuRMM.exe

C:\Windows\System\MmqzCJX.exe

C:\Windows\System\MmqzCJX.exe

C:\Windows\System\OfKkHNL.exe

C:\Windows\System\OfKkHNL.exe

C:\Windows\System\QMjXDVo.exe

C:\Windows\System\QMjXDVo.exe

C:\Windows\System\WxSlIdu.exe

C:\Windows\System\WxSlIdu.exe

C:\Windows\System\FGiRsqQ.exe

C:\Windows\System\FGiRsqQ.exe

C:\Windows\System\FXGRJJu.exe

C:\Windows\System\FXGRJJu.exe

C:\Windows\System\kLRAjfe.exe

C:\Windows\System\kLRAjfe.exe

C:\Windows\System\vnemXun.exe

C:\Windows\System\vnemXun.exe

C:\Windows\System\RkvdQDw.exe

C:\Windows\System\RkvdQDw.exe

C:\Windows\System\ycTPCex.exe

C:\Windows\System\ycTPCex.exe

C:\Windows\System\MUjPpQe.exe

C:\Windows\System\MUjPpQe.exe

C:\Windows\System\nsKCcDc.exe

C:\Windows\System\nsKCcDc.exe

C:\Windows\System\WqChnmk.exe

C:\Windows\System\WqChnmk.exe

C:\Windows\System\qChghPX.exe

C:\Windows\System\qChghPX.exe

C:\Windows\System\LlVkmMk.exe

C:\Windows\System\LlVkmMk.exe

C:\Windows\System\RNKmjvU.exe

C:\Windows\System\RNKmjvU.exe

C:\Windows\System\WXEsGql.exe

C:\Windows\System\WXEsGql.exe

C:\Windows\System\FCWrGXW.exe

C:\Windows\System\FCWrGXW.exe

C:\Windows\System\jFPpPqX.exe

C:\Windows\System\jFPpPqX.exe

C:\Windows\System\nfGNhcc.exe

C:\Windows\System\nfGNhcc.exe

C:\Windows\System\YDMoNum.exe

C:\Windows\System\YDMoNum.exe

C:\Windows\System\ghLhTnl.exe

C:\Windows\System\ghLhTnl.exe

C:\Windows\System\lmccByy.exe

C:\Windows\System\lmccByy.exe

C:\Windows\System\tlvXjEF.exe

C:\Windows\System\tlvXjEF.exe

C:\Windows\System\XfRhSBt.exe

C:\Windows\System\XfRhSBt.exe

C:\Windows\System\MEKUGXc.exe

C:\Windows\System\MEKUGXc.exe

C:\Windows\System\aCZXStF.exe

C:\Windows\System\aCZXStF.exe

C:\Windows\System\vADblbA.exe

C:\Windows\System\vADblbA.exe

C:\Windows\System\ZISatCq.exe

C:\Windows\System\ZISatCq.exe

C:\Windows\System\DRlBrLQ.exe

C:\Windows\System\DRlBrLQ.exe

C:\Windows\System\qrlbUVU.exe

C:\Windows\System\qrlbUVU.exe

C:\Windows\System\UJqGYjn.exe

C:\Windows\System\UJqGYjn.exe

C:\Windows\System\ljjxfIf.exe

C:\Windows\System\ljjxfIf.exe

C:\Windows\System\BaGpmfs.exe

C:\Windows\System\BaGpmfs.exe

C:\Windows\System\EiVsqKX.exe

C:\Windows\System\EiVsqKX.exe

C:\Windows\System\clJaZaQ.exe

C:\Windows\System\clJaZaQ.exe

C:\Windows\System\DRMVnpV.exe

C:\Windows\System\DRMVnpV.exe

C:\Windows\System\PKAxbvd.exe

C:\Windows\System\PKAxbvd.exe

C:\Windows\System\ybwBZUt.exe

C:\Windows\System\ybwBZUt.exe

C:\Windows\System\QCmJhDd.exe

C:\Windows\System\QCmJhDd.exe

C:\Windows\System\IOgAjum.exe

C:\Windows\System\IOgAjum.exe

C:\Windows\System\YzqgPYG.exe

C:\Windows\System\YzqgPYG.exe

C:\Windows\System\XwbDein.exe

C:\Windows\System\XwbDein.exe

C:\Windows\System\vqvtEXM.exe

C:\Windows\System\vqvtEXM.exe

C:\Windows\System\DViaMTh.exe

C:\Windows\System\DViaMTh.exe

C:\Windows\System\OvHQJXM.exe

C:\Windows\System\OvHQJXM.exe

C:\Windows\System\psoydFV.exe

C:\Windows\System\psoydFV.exe

C:\Windows\System\cmWIdFL.exe

C:\Windows\System\cmWIdFL.exe

C:\Windows\System\BCsKjAY.exe

C:\Windows\System\BCsKjAY.exe

C:\Windows\System\IEZLbmz.exe

C:\Windows\System\IEZLbmz.exe

C:\Windows\System\KFbUKWp.exe

C:\Windows\System\KFbUKWp.exe

C:\Windows\System\CYSFqPg.exe

C:\Windows\System\CYSFqPg.exe

C:\Windows\System\IxzCJFb.exe

C:\Windows\System\IxzCJFb.exe

C:\Windows\System\tePNBgv.exe

C:\Windows\System\tePNBgv.exe

C:\Windows\System\tmOngNk.exe

C:\Windows\System\tmOngNk.exe

C:\Windows\System\oBEDVYI.exe

C:\Windows\System\oBEDVYI.exe

C:\Windows\System\sZqDTqX.exe

C:\Windows\System\sZqDTqX.exe

C:\Windows\System\ChZyCkI.exe

C:\Windows\System\ChZyCkI.exe

C:\Windows\System\ENmTjYk.exe

C:\Windows\System\ENmTjYk.exe

C:\Windows\System\skWWMip.exe

C:\Windows\System\skWWMip.exe

C:\Windows\System\KGBmtEn.exe

C:\Windows\System\KGBmtEn.exe

C:\Windows\System\PdUJNGD.exe

C:\Windows\System\PdUJNGD.exe

C:\Windows\System\YSYCSzu.exe

C:\Windows\System\YSYCSzu.exe

C:\Windows\System\vmlRhCo.exe

C:\Windows\System\vmlRhCo.exe

C:\Windows\System\YdmUGnR.exe

C:\Windows\System\YdmUGnR.exe

C:\Windows\System\tcJJfHS.exe

C:\Windows\System\tcJJfHS.exe

C:\Windows\System\RHGceVi.exe

C:\Windows\System\RHGceVi.exe

C:\Windows\System\vCdokrO.exe

C:\Windows\System\vCdokrO.exe

C:\Windows\System\CDVfsRf.exe

C:\Windows\System\CDVfsRf.exe

C:\Windows\System\nDQGqoP.exe

C:\Windows\System\nDQGqoP.exe

C:\Windows\System\nGgeAAW.exe

C:\Windows\System\nGgeAAW.exe

C:\Windows\System\wTjyGts.exe

C:\Windows\System\wTjyGts.exe

C:\Windows\System\lIFyuud.exe

C:\Windows\System\lIFyuud.exe

C:\Windows\System\kKlEHgT.exe

C:\Windows\System\kKlEHgT.exe

C:\Windows\System\uSEpcJC.exe

C:\Windows\System\uSEpcJC.exe

C:\Windows\System\nPDTKgq.exe

C:\Windows\System\nPDTKgq.exe

C:\Windows\System\SoQVgSO.exe

C:\Windows\System\SoQVgSO.exe

C:\Windows\System\LVhFcHt.exe

C:\Windows\System\LVhFcHt.exe

C:\Windows\System\GZzyxnX.exe

C:\Windows\System\GZzyxnX.exe

C:\Windows\System\mezSPFK.exe

C:\Windows\System\mezSPFK.exe

C:\Windows\System\kQgDAUX.exe

C:\Windows\System\kQgDAUX.exe

C:\Windows\System\HLhhVAq.exe

C:\Windows\System\HLhhVAq.exe

C:\Windows\System\AmbEmuL.exe

C:\Windows\System\AmbEmuL.exe

C:\Windows\System\UPTXesO.exe

C:\Windows\System\UPTXesO.exe

C:\Windows\System\bLHRcOt.exe

C:\Windows\System\bLHRcOt.exe

C:\Windows\System\VeoAnSK.exe

C:\Windows\System\VeoAnSK.exe

C:\Windows\System\LIQlCMj.exe

C:\Windows\System\LIQlCMj.exe

C:\Windows\System\lxIwVCi.exe

C:\Windows\System\lxIwVCi.exe

C:\Windows\System\iWUZAxX.exe

C:\Windows\System\iWUZAxX.exe

C:\Windows\System\VghXzMn.exe

C:\Windows\System\VghXzMn.exe

C:\Windows\System\slPHkxz.exe

C:\Windows\System\slPHkxz.exe

C:\Windows\System\ruczaVj.exe

C:\Windows\System\ruczaVj.exe

C:\Windows\System\jplLKJx.exe

C:\Windows\System\jplLKJx.exe

C:\Windows\System\fHhFFbo.exe

C:\Windows\System\fHhFFbo.exe

C:\Windows\System\btKTCUS.exe

C:\Windows\System\btKTCUS.exe

C:\Windows\System\KZemzKQ.exe

C:\Windows\System\KZemzKQ.exe

C:\Windows\System\gEwEWkL.exe

C:\Windows\System\gEwEWkL.exe

C:\Windows\System\sRvJHNK.exe

C:\Windows\System\sRvJHNK.exe

C:\Windows\System\IXpkRtA.exe

C:\Windows\System\IXpkRtA.exe

C:\Windows\System\XTIbVmG.exe

C:\Windows\System\XTIbVmG.exe

C:\Windows\System\aycTGVk.exe

C:\Windows\System\aycTGVk.exe

C:\Windows\System\MbXMsUw.exe

C:\Windows\System\MbXMsUw.exe

C:\Windows\System\xNKCoNF.exe

C:\Windows\System\xNKCoNF.exe

C:\Windows\System\YRQZcdB.exe

C:\Windows\System\YRQZcdB.exe

C:\Windows\System\ZxpefOP.exe

C:\Windows\System\ZxpefOP.exe

C:\Windows\System\jCcyCuE.exe

C:\Windows\System\jCcyCuE.exe

C:\Windows\System\uSHCvYc.exe

C:\Windows\System\uSHCvYc.exe

C:\Windows\System\ggjlIYl.exe

C:\Windows\System\ggjlIYl.exe

C:\Windows\System\uZqcyOy.exe

C:\Windows\System\uZqcyOy.exe

C:\Windows\System\zNtchbe.exe

C:\Windows\System\zNtchbe.exe

C:\Windows\System\WRKFgFi.exe

C:\Windows\System\WRKFgFi.exe

C:\Windows\System\SfLBont.exe

C:\Windows\System\SfLBont.exe

C:\Windows\System\yZgCZgf.exe

C:\Windows\System\yZgCZgf.exe

C:\Windows\System\CjSvzKt.exe

C:\Windows\System\CjSvzKt.exe

C:\Windows\System\CklOLmQ.exe

C:\Windows\System\CklOLmQ.exe

C:\Windows\System\ZJvtuVc.exe

C:\Windows\System\ZJvtuVc.exe

C:\Windows\System\sFasuyS.exe

C:\Windows\System\sFasuyS.exe

C:\Windows\System\kNFCJBJ.exe

C:\Windows\System\kNFCJBJ.exe

C:\Windows\System\UkNYazh.exe

C:\Windows\System\UkNYazh.exe

C:\Windows\System\rnbjDNQ.exe

C:\Windows\System\rnbjDNQ.exe

C:\Windows\System\EunrVbI.exe

C:\Windows\System\EunrVbI.exe

C:\Windows\System\BAcmZpU.exe

C:\Windows\System\BAcmZpU.exe

C:\Windows\System\rIrXwtO.exe

C:\Windows\System\rIrXwtO.exe

C:\Windows\System\EtmirQY.exe

C:\Windows\System\EtmirQY.exe

C:\Windows\System\sBptGRE.exe

C:\Windows\System\sBptGRE.exe

C:\Windows\System\EprNVTu.exe

C:\Windows\System\EprNVTu.exe

C:\Windows\System\fgbYvgi.exe

C:\Windows\System\fgbYvgi.exe

C:\Windows\System\CqdZOKV.exe

C:\Windows\System\CqdZOKV.exe

C:\Windows\System\BLQgEYT.exe

C:\Windows\System\BLQgEYT.exe

C:\Windows\System\Ddwwwoy.exe

C:\Windows\System\Ddwwwoy.exe

C:\Windows\System\sqwSWjJ.exe

C:\Windows\System\sqwSWjJ.exe

C:\Windows\System\ANKuDdZ.exe

C:\Windows\System\ANKuDdZ.exe

C:\Windows\System\iUoKexU.exe

C:\Windows\System\iUoKexU.exe

C:\Windows\System\SAUfDrf.exe

C:\Windows\System\SAUfDrf.exe

C:\Windows\System\XcROcpq.exe

C:\Windows\System\XcROcpq.exe

C:\Windows\System\ozjEWKD.exe

C:\Windows\System\ozjEWKD.exe

C:\Windows\System\STRrKxp.exe

C:\Windows\System\STRrKxp.exe

C:\Windows\System\EhLDQzq.exe

C:\Windows\System\EhLDQzq.exe

C:\Windows\System\rwoZbgU.exe

C:\Windows\System\rwoZbgU.exe

C:\Windows\System\AcFvSGr.exe

C:\Windows\System\AcFvSGr.exe

C:\Windows\System\IFjLWwW.exe

C:\Windows\System\IFjLWwW.exe

C:\Windows\System\mLGRFuz.exe

C:\Windows\System\mLGRFuz.exe

C:\Windows\System\eoHMPte.exe

C:\Windows\System\eoHMPte.exe

C:\Windows\System\NsXjlAl.exe

C:\Windows\System\NsXjlAl.exe

C:\Windows\System\LbxhBph.exe

C:\Windows\System\LbxhBph.exe

C:\Windows\System\IcYsVXe.exe

C:\Windows\System\IcYsVXe.exe

C:\Windows\System\AXLVbRR.exe

C:\Windows\System\AXLVbRR.exe

C:\Windows\System\xOJxWUD.exe

C:\Windows\System\xOJxWUD.exe

C:\Windows\System\UrNffVY.exe

C:\Windows\System\UrNffVY.exe

C:\Windows\System\byLeCtq.exe

C:\Windows\System\byLeCtq.exe

C:\Windows\System\eQGARys.exe

C:\Windows\System\eQGARys.exe

C:\Windows\System\TRoGfFJ.exe

C:\Windows\System\TRoGfFJ.exe

C:\Windows\System\iSYRwik.exe

C:\Windows\System\iSYRwik.exe

C:\Windows\System\BTwXZXY.exe

C:\Windows\System\BTwXZXY.exe

C:\Windows\System\hAckUry.exe

C:\Windows\System\hAckUry.exe

C:\Windows\System\rxHaDjR.exe

C:\Windows\System\rxHaDjR.exe

C:\Windows\System\QGbQHJl.exe

C:\Windows\System\QGbQHJl.exe

C:\Windows\System\hbaAqIO.exe

C:\Windows\System\hbaAqIO.exe

C:\Windows\System\FhlqKDh.exe

C:\Windows\System\FhlqKDh.exe

C:\Windows\System\nOmCLzW.exe

C:\Windows\System\nOmCLzW.exe

C:\Windows\System\TTiFIAK.exe

C:\Windows\System\TTiFIAK.exe

C:\Windows\System\JcMmQYN.exe

C:\Windows\System\JcMmQYN.exe

C:\Windows\System\yTRVJPm.exe

C:\Windows\System\yTRVJPm.exe

C:\Windows\System\LrOqTiX.exe

C:\Windows\System\LrOqTiX.exe

C:\Windows\System\TsHLmXR.exe

C:\Windows\System\TsHLmXR.exe

C:\Windows\System\eebaLVy.exe

C:\Windows\System\eebaLVy.exe

C:\Windows\System\RGazJCJ.exe

C:\Windows\System\RGazJCJ.exe

C:\Windows\System\TXHNYly.exe

C:\Windows\System\TXHNYly.exe

C:\Windows\System\eysqYFb.exe

C:\Windows\System\eysqYFb.exe

C:\Windows\System\cQxdhuI.exe

C:\Windows\System\cQxdhuI.exe

C:\Windows\System\lgPyMMf.exe

C:\Windows\System\lgPyMMf.exe

C:\Windows\System\FAkFKxf.exe

C:\Windows\System\FAkFKxf.exe

C:\Windows\System\sQGQRQJ.exe

C:\Windows\System\sQGQRQJ.exe

C:\Windows\System\WKtoQaM.exe

C:\Windows\System\WKtoQaM.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp

Files

memory/2248-0-0x00000000000F0000-0x0000000000100000-memory.dmp

memory/2248-1-0x000000013FC50000-0x0000000140042000-memory.dmp

\Windows\system\ksWeQPA.exe

MD5	ff8b0dc7566c7f34b7d471603af0718e
SHA1	dcbc6b947ef1443cb15769c2179e8fbcc1ffcfc6
SHA256	a3a7edfd84ac7d352c465af70005df384b2f04ed35d940feaca69550e166dc6b
SHA512	151dcfa556b2caa80a0261e0f3d09b18b0349ab579d52d9da5235e410c0456e05e75df5d149e72e443f5f035b55511cfb96623f350a9eb53459fbc8a43a19468

memory/2248-7-0x000000013F710000-0x000000013FB02000-memory.dmp

memory/2352-9-0x000000013F710000-0x000000013FB02000-memory.dmp

memory/1420-14-0x000007FEF643E000-0x000007FEF643F000-memory.dmp

\Windows\system\GlMaiHe.exe

MD5	5f31bad27096efef7effb20752782070
SHA1	be2cc52707af3e6f882ab3d5201c0006acc690f0
SHA256	8f454c8f120ba91c1bb9e41761c5c39d5fd88fd2b03811c6edc03d7cf58fe4e8
SHA512	e90b05783d79afdf68dc7781745dee80fcbda37572b393642e7adc9b4855f42063ac46846742ef4f83e86abc07b9a5c2caa7a23947a7c7e91c65a56e2bdabf5e

C:\Windows\system\xLWdtQc.exe

MD5	49581f67129891ef29d1ea4e7f695483
SHA1	db9d4295d071984c012b08e4b6da986c93194b38
SHA256	05cc6023d100df74cfaa85b7de91508cd366ca374618ff8a4eff1f788f4f07a6
SHA512	0a0d6d3f739ce943284b7fb9eb067ca9b2257742dcf8aa207d13cb166c729046fd26df0c10ebdd479921cede797932fcf31c485972595115e1d272e7810de47d

C:\Windows\system\SstjXIM.exe

MD5	44e19f5c6b832d16fefdb8eddcd2d7be
SHA1	80be86270b049d32d66c53b371d0ecc7e8462368
SHA256	d443add1a68c1c787e21c7c7e3cf031c5e181cb7ea50c961a922fdbc447409e2
SHA512	90568cc4450794ea5198b59d7f3a5c9cdaf110fe6e41644210d5e6b783e3b24329f81e4e9db831eb39f637c2f2b365b72adaab479ec1d85321ee30187eeb6256

\Windows\system\BaeEOwe.exe

MD5	f3464a9eb39733fa78eacbe1ad6116f3
SHA1	08abca8df4622580a0f898bdee888ad339a750bb
SHA256	b0b4d66c1b4cceb40365072edca3f46fd483269a97de3ec744fbe9ab4f5fb904
SHA512	012bababb80936adea0faa88da20b73eaaabf1e93d0accc9ee7699826e81e689048d2f6149f61323e9596361bdfe91fc0243c5ee2884980d4400fae03389e08b

C:\Windows\system\EguowWa.exe

MD5	97e4b355d09a3981acbd160e3be194c7
SHA1	2f4a0cd02ecf1a8570abe0e39e64395bc538fa8b
SHA256	e3a3bab3fda2023c67f615098bb0f9ab35d940506288ce04cccaf2de13a0bdca
SHA512	2bec55c505fa1c31dae7f9046f475f15b817ea733ebd880def19193dadb200d2d186e3c713ee9aee9aa765b4d027fb61defad9247f3689f4cc28e6694f3bfc39

\Windows\system\doKGVMY.exe

MD5	d2b19c58186c113b35291aec8e6dc4e6
SHA1	9265d95d2fb52884f05c73d8fabe5caf8196cb56
SHA256	633d55786f9efaddecd1d1719d605bf30ebe25bc4567015ea2a8aa68c4f91c26
SHA512	9d42df530f56626f063421a9375c46f49ed3a9b46db7b3ae8396e2ad91780ce1b632fdda6d25e29c91d536eda2f5c5700e2c281ce91306c20da8cc505b85bf29

\Windows\system\bfUiCoa.exe

MD5	62520b95c5b19833f415027fdd2b5d02
SHA1	9532c33234ecaa2beac8459327caa3a53dc5bf60
SHA256	695253d67b5029c3494206138a51ad782bebe1041f9fb72ae668c556f0e5f6dc
SHA512	44e2bd8f6e22638a6b9b632123aad3ff1248e4c39b3e98796cd67286aa59ba567d5425ec4a68b2b595dd67bb42b3c039deb66cffa1085c1f71d68fb846284f43

C:\Windows\system\WkzXSHw.exe

MD5	b635511626c264b5aa9ced835fef1267
SHA1	61c67a30e49f2e265be4dcf5c48ddeb067c9353d
SHA256	e05ba84b139c74d5f4bcce4ca161f98b81c01e4f2b15f68af279b76196ae4c71
SHA512	e41ed68bcf925bc4bc13326bd7eb76e40faa7d0d7ba9a6fe5b88708eff32a8f4e13dfdb8d09b32da1d5fc69366f97459daf545f3909fb11fd5a5825e35077b7a

C:\Windows\system\YiQKUcm.exe

MD5	3bc9c2a6a1809581ca6f52d1610599ca
SHA1	cb9aa1b03783f7d585ceaa7f63597df403f8533c
SHA256	33871dbfe5f7e846ea3e329a28b1a6bbfc202ee145fd22153e8dd32898faccef
SHA512	665f7f857e116cc7b713db4fca7fc4cacbab77abe8f25f74d0b44cbb6a0aaa4c47e4090e9a7c99a4c01cf2cfb4babb69823cc4752edd33231df8300bc5a1a83b

C:\Windows\system\dXdrDQk.exe

MD5	87d8b723307f2c2e2ff6d1abf5c5ae1b
SHA1	d001202cb0c86450c039abde8c2463b9a7235233
SHA256	2e412951b4a35eed1ff5e0e430583895c1d3191280456d0b443f2965f2cd8bee
SHA512	8a5842e68dc6eead5a8876775848cd5c1ae046993c37baef0b00288c9d7d6c9f3dc04d004dcd1cb5da96950cd78d854046cacb4f5409430bd290f2c8910b2a5f

C:\Windows\system\dBgjllL.exe

MD5	bf0fec0c34a8fb4f535f4fef05a16d9c
SHA1	85f9c704399835d3e4e8aabfb4f4a6fd0b6bea47
SHA256	52f0ebbb88097a25f973b897dde6be6ba57c86c1bb03b05563b84b731fc58bfb
SHA512	1123c88061cd26bb98488190afbaf33fd24699581a053e0ff85a917b3facef0b093442056cb2bd2d88bfb22a6129fa05f98e508ce3139b05f1b6809dd2aea378

C:\Windows\system\XrFBeFp.exe

MD5	c79b2f1eb7176b56c907553b05f4a091
SHA1	8691cf2dd470542d990a2f1c4a3d86c95fb043e7
SHA256	36e9ec235879909b0de2958ff6eb25fd5ed83c21340d20e2a927347bab86fb0b
SHA512	cab4db046960aa0d7a5169d946859271a2416276926d98cebe124cf12b9254ee6e45d92b539f2a0f610ef29ddf11a07b0501de51f382d5df14c318b95cb14e1a

C:\Windows\system\iZNUyNi.exe

MD5	ccc595b442c8a1a6c26c40dc6456416c
SHA1	61e2549fc96a66fc9b4fea184aab5cce8bae257f
SHA256	d5c2ec440338c1f78a5f5d3b05a6a41d210a2f544abadac86a1b223e0b25c6b7
SHA512	ca0a26abca178b60c64a04447ea54e824bd7a52febcbd633f8dbc5917351d8e1afef4988221865facfbac4dc16ccd32e1f1d627494398e5bc58e87f1b4b4b8e4

C:\Windows\system\DUKtYQz.exe

MD5	cb4156d9e1f0739ab39906dc8afd1d56
SHA1	605c9ab8576456395aa7cb11217f862c95fcff7a
SHA256	9526c529460b09288c1dc18bb1a347eb09091186e64211dfb4261b00c5adb58b
SHA512	b3c055b78e89a3d983d506e5c9c63b37ff61752dff57e19268fbab820e8d08157659fead8e6b458706bcac4f4ab7a04b2020c07ddff17945195c6d52507a208c

C:\Windows\system\JAaygSw.exe

MD5	3debb92037f9ea3b0a78d3c83505d993
SHA1	1e75b279328ba9da448d1626303afccfb0124a6c
SHA256	adf4493d54b3b8550214000ddaf30aede4de23b1520da6f34a9148996fad332d
SHA512	1e1bcd0f90cb96b8d6eb4440590300d007edacbd9f3c29b27b25fd6d56891bf1b42ba5a8e6a78f7d0784f96fb5900bec88657f2a6e60a5a8e4bc5af64a655b21

C:\Windows\system\wJRkMwN.exe

MD5	ae2e35c083f22bc714e5d25d147b93b0
SHA1	230f11d2ed03599e91b043b8f9e79e5de143e671
SHA256	ad80b679fe9c6c479d7f6cd230c0b44f32ed4c41ec6b4588cefda92bb1d5644d
SHA512	ef2fe17a923dd1162df16fde0b148ef0f54ce4ee1a2c6da310e0e90e8c85c6e11fc6443bd5ae33a29bbff05d9d41e21f6119dc24cc66545c27cf4477d8341f7c

memory/2224-143-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

memory/2524-134-0x000000013FEC0000-0x00000001402B2000-memory.dmp

C:\Windows\system\PFahWMq.exe

MD5	665aa6b2755e83cbaf2b8125fa5dacb5
SHA1	d4d9875196fda7ae7a89ece53ce7bd68d53a18f7
SHA256	ae32c08612ccfb62c72dbb609eeaa0e8f4edfa1856a445fbac3219ddf601d79d
SHA512	afe4111a5c86d8c10dbb0337aa7329f2e8211cbf7ff1eab86a7339b08ae26aa4c61bd0fc0f6c98211cb1915b2006d20fc4bec1d6f7bbf23bae3dcff622959fdf

memory/2248-132-0x0000000002A80000-0x0000000002E72000-memory.dmp

\Windows\system\sNqxdqp.exe

MD5	da77e7553e91e3714d320c29f4b15efa
SHA1	6e3b9f377fe0225d51d83038da1bac3094042824
SHA256	1ae5732acd472d05959eea288b21d693d5cc46786ab5964f0fbec78d434fcd7c
SHA512	710a938ba9e2adc62da0dccbcf9d29be5c1971125d01cb483e3efd7adcb2a47e74f99ca0d8dcfe14648639152d2ce6175ff1952afcc0aef08c3e1bbfa8aca355

C:\Windows\system\bDlegDA.exe

MD5	e5610e3b12fa15ba9cdcd3b422884c5d
SHA1	18c14323f39921f6ca622abc0ae2c2f6d1b751b3
SHA256	a886671adf1c2a8a8406cc29b7f8786354d712260f65edc3c1282c6279bb7bb3
SHA512	27f4bd43721453824eaf3c53a79b10aa569155a2a34f61818052cfa608a36ccb147179521c30c4a6385c5ace98981b05903b20ee81beef1b3d2a05ac47abfaa7

memory/2248-112-0x0000000002A80000-0x0000000002E72000-memory.dmp

memory/2248-119-0x0000000002A80000-0x0000000002E72000-memory.dmp

\Windows\system\KvPFgoF.exe

MD5	11696ca912429dbb581fbde803bf0bf4
SHA1	e3045f5a396d02eca972a124a2cbf8b95de6c568
SHA256	9cedd256ea1bd4ba3a2f31cd7eb6be290c32b28f7abe90419bb5583e4cc4fcda
SHA512	04179398b61919bba4fde5505928707893ecac7a0c187a3ff07773e918c6ed1fe2916682614a1819ae0afcd88c0aff32ad8f23b4aa98d1aafbe627da1e642673

\Windows\system\SPfPQDh.exe

MD5	b37128a59f4d6463b9d80514bf495980
SHA1	e6a631cd2ff2c34c69ca9d468a25adcf8822ed80
SHA256	7d88c70d65bab91ad585cae1f315c0813933a3dfd1b2b7d2ffb67c87aea30cfc
SHA512	5783a56ca60ce33a9c70697d569d3b88f4f6a9df10cf86e6325f5e9d92e3586130a3caeb9ac3d40a5ea09f6e8b4e3938fd37ec977408ae1a76d79ea602170191

\Windows\system\fJxFWag.exe

MD5	194eeb686e1136425b5408015b0cc28f
SHA1	6cc1222c87dd99fdf679fbe114dc8e69448f5fdf
SHA256	268c308ae31d6286d7d00f3fcdfbd6c570947c50783760b082c1ba1410acb8fe
SHA512	2995fde2c4364ec7d18c85f11e73eeac8c484ec2cf3b3a80f6186beff4e124d193c4ecaa56f488c7956d2f0d399d29ffe32e10e349b335f07785b7c16eefd1f0

C:\Windows\system\sRMvAyq.exe

MD5	cf29a54a006ac95901c09074076529fb
SHA1	ad04ef124cdcc90ab8c5fc65eb565407c87836a3
SHA256	b8a7311e50365ccb885002005e6ea7c747ee0db89b94531bf6c0624bd1b345ee
SHA512	b71145322d177f3f365fc68fd6c1d5846fb0d9c4f0c348ac9fbf0d069ba488e2c65491c3613aa69d4c6a4cdda83492f80f83b8b9c4c98d00aa95b582c777ff75

\Windows\system\VEHcOSZ.exe

MD5	f639fe7a1f479e78d499846d487cd9f0
SHA1	04d3609b5eb414e9a91dd315bcc684ea92269dce
SHA256	db31ec37165d28a620e5302dad018ad00d8aacf509607cba15a8b1d06d5bb4d2
SHA512	24045f4745c082f7b209dac2cd761d41fdc70bd2651a554f24dc4adb00031de6ea96c153b771c6b86d30243eb3538b7dc727cd351259367c03e83e5f8ac2c8af

C:\Windows\system\XqhTAox.exe

MD5	0c9aae147a7061e28f1a47a1f6e4ee69
SHA1	81e80a2acdf1c694eeec7c23af0329feedad4c22
SHA256	b8ad4da5ed7978f49759bdb0339e02ded6a3235eb31182a9d48344863daa9abe
SHA512	7d6ef82beeb9ad4077cf317059e49a4a9004c73fadf9e691d68d2094de08a77374fc99f955f809bfa0b8784510a748339c9f9942c912572ced4c4198e3ca5a6f

\Windows\system\FkzgzXZ.exe

MD5	65581a98951670b36a4e3ab4889a676b
SHA1	d29b23eb245fa1f3207d82b7f222fc84a66ba812
SHA256	f442684db6d793174726eba1eb3bc661f9700100f68e6bddafc91086e8625f9d
SHA512	e047b22061aebc886eafca3960a35faa4fc0a13cbba87beb4e5cc4d7241b17afe81599cc6449853a7d6f60b65c828d920f280541bec534255fab9d715ed3e5a9

memory/2248-152-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

memory/1732-151-0x000000013FDC0000-0x00000001401B2000-memory.dmp

memory/2248-150-0x0000000002A80000-0x0000000002E72000-memory.dmp

memory/1420-337-0x000000001B430000-0x000000001B712000-memory.dmp

memory/1420-344-0x0000000002460000-0x0000000002468000-memory.dmp

memory/2248-149-0x0000000002A80000-0x0000000002E72000-memory.dmp

memory/3044-148-0x000000013FB70000-0x000000013FF62000-memory.dmp

memory/2248-147-0x0000000002A80000-0x0000000002E72000-memory.dmp

memory/1040-146-0x000000013FA30000-0x000000013FE22000-memory.dmp

memory/2248-145-0x0000000002A80000-0x0000000002E72000-memory.dmp

\Windows\system\IKrlJTu.exe

MD5	d68e2622fe1cd969920315d5fe96c910
SHA1	9a779215b168298d56d383d405c1afd7d948d27c
SHA256	ad916a91eeff7c5f81486935a0c2ee5e6d5cf71589014cc331ff90d2c1a0b981
SHA512	e629cf7ae828f2d8b80c95dfc44cabd88e9be9731e7aa59f74c9e6666af04e50a7d6a52146e399a199661f7d071466cc41342b4af2e21ac6e6bdab56ae4c14b9

memory/2248-138-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

memory/1420-393-0x000007FEF6180000-0x000007FEF6B1D000-memory.dmp

\Windows\system\cfkpHyU.exe

MD5	ffb97af75c69e1a1aee7dcf0bcefd5cb
SHA1	c7cb8cadc172aeb9fbc671e0271755c81f983014
SHA256	7e6853e2da6266ed8e0cd195532267f7b82ae7e018a2766a208c1ca9f154c15c
SHA512	697cc418c8d675b82ad2b681b408183604fea0f40628c6c60f64c28701f17fe2cc0abdc70aea41169e9fbb91bb3da51c5f5be45fa5f8634dc525639e1d6846f0

\Windows\system\sXbAEKr.exe

MD5	18e7bf3a2534c1ce408f6711e7005926
SHA1	de2c3fcaa0b64049c5ec00d6f32966eede2fb61a
SHA256	0a50c432908b71799f7173f8f66e90a7c95f1836c04b1d37f5f70bcd1ceeedb1
SHA512	cb76b648cb92318b4fae6535e901db28bced2a8e15fb782f0feb1951131556b23320212371cb4eacff07c9e71a3da0ebf4d02294f3c5cec4b1020541c056e289

memory/2628-118-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

memory/2248-117-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

memory/2248-116-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

memory/2736-115-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

memory/2248-114-0x0000000002A80000-0x0000000002E72000-memory.dmp

memory/1760-113-0x000000013F930000-0x000000013FD22000-memory.dmp

memory/1420-111-0x000007FEF6180000-0x000007FEF6B1D000-memory.dmp

memory/1420-110-0x000007FEF6180000-0x000007FEF6B1D000-memory.dmp

C:\Windows\system\dDVdEdb.exe

MD5	dad44c2420277da763434bd9da8d6bb4
SHA1	536f8517c466bfc12b79c288aff924ec713cdbb2
SHA256	db2f76cc7ef4128b4e3489bc49826c061b192240a1435c5c57c86d588f099d55
SHA512	1ebd4461fca828df99251a1f3b1c242dde85052b01ae7594991ee4f3bab302015c2379be6d8698ea7a091011d632e28ef99a8b5fe6e3fa7815a94c84735433f3

C:\Windows\system\HayxfKy.exe

MD5	4d5fdd83b5b72f99d39a8e992ad14697
SHA1	2dc98ef2bd7a4a049cefcd64f5d6d559cb3e1f9c
SHA256	2721e57c8c712a226fed27b8864be9846665940280eb817a2f548b4013d800a5
SHA512	b3be179e4c3bbc92b2c3df831e5afcfbc7e887b2e1b495bdba438c6aa61ce2ac966712eaf268b27d40ae9b0d13c0dfe79483361d172679a55dd6c58934f6d24c

memory/2604-125-0x000000013FC60000-0x0000000140052000-memory.dmp

memory/2676-122-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

\Windows\system\KNEqpjN.exe

MD5	3dcdf61a62ea1989f92c2f73197fa1a2
SHA1	1cc4da126a342777a26e301958c605e76b976bc2
SHA256	b1c2288466a6e92f57ae03c2fe481125a88205d9e7e3ebdaff240196fd04ec1e
SHA512	1d92d41f3b4647927ccbccb11cf70615a4b68fb9b9c6e0a4ea91d6440b5628e1d6049701e2872b4d4a31b238a7f1df9370137a5dda4eda59d6124eae5a73df7d

C:\Windows\system\JUwoHRn.exe

MD5	012833fe781fc5f40df0557c91060287
SHA1	5b6a575b2977992ef0595ef75abac2fd2bf71eb0
SHA256	d93c6a84d4e9bf721de471b74af9d65847d699fb343dd0d800a49016b7532ebe
SHA512	089453f5de90de26d14d9eb353f99422d6937bdf83297650aa7bbb8d352a7f3d4f35258bc41f89fafad34253d67f6598ff32ecead198ad1e86a326036af158cd

C:\Windows\system\DofsACL.exe

MD5	af1db1948781a033a81d7fc579777714
SHA1	66c80048d0cfd4e4815771604545c86237fdae48
SHA256	707aacc1f69c637e75c27f6cd9d47ecbcc95fe372e7f1f56c6c4f7a21cf2f1e3
SHA512	f3239712b15a7e8c1930f75b2dd913d51353344d80c3b65e7635b91da4515b908c5aa5c438b60438c7121274fa672d035fa1466d99743dbb068883ae5d41d29f

C:\Windows\system\hShVOxi.exe

MD5	1b1d6782807e305c93a265d47af7dd23
SHA1	f4447b631fc2652b2a770c1dcd2be5fc9f82b990
SHA256	93adb6cbc548c43daecf2aadd30bde47e3aaa8331cf05c4ac878eef56c5a2259
SHA512	9d40ab63144a1b344033202870b77086ad161b9b26784d2ca0656538f9027106580fb0432c5dd1fb72dba8ab52a3f3f9dfb43e17425d1ee33e1ee1a8a9905029

memory/2352-2313-0x000000013F710000-0x000000013FB02000-memory.dmp

memory/2628-2312-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

memory/2736-2314-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

memory/2676-2364-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

memory/3044-2356-0x000000013FB70000-0x000000013FF62000-memory.dmp

memory/2224-2351-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

memory/2524-2330-0x000000013FEC0000-0x00000001402B2000-memory.dmp

memory/1040-2328-0x000000013FA30000-0x000000013FE22000-memory.dmp

memory/2604-2333-0x000000013FC60000-0x0000000140052000-memory.dmp

memory/1760-2367-0x000000013F930000-0x000000013FD22000-memory.dmp

memory/1732-2329-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 13:17

Reported

2024-06-13 13:20

Platform

win10v2004-20240508-en

Max time kernel

63s

Max time network

66s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\IvzeSVQ.exe	N/A
N/A	N/A	C:\Windows\System\fNkZUnr.exe	N/A
N/A	N/A	C:\Windows\System\OxPXtXR.exe	N/A
N/A	N/A	C:\Windows\System\ZCXPSps.exe	N/A
N/A	N/A	C:\Windows\System\zXMDrGx.exe	N/A
N/A	N/A	C:\Windows\System\FUzBjbv.exe	N/A
N/A	N/A	C:\Windows\System\wlXrcti.exe	N/A
N/A	N/A	C:\Windows\System\OjoRWKq.exe	N/A
N/A	N/A	C:\Windows\System\pOIgMtk.exe	N/A
N/A	N/A	C:\Windows\System\eXGXDxG.exe	N/A
N/A	N/A	C:\Windows\System\EgoJCWj.exe	N/A
N/A	N/A	C:\Windows\System\amuEQFo.exe	N/A
N/A	N/A	C:\Windows\System\lTNndcZ.exe	N/A
N/A	N/A	C:\Windows\System\ATQRBgT.exe	N/A
N/A	N/A	C:\Windows\System\jYqgUxr.exe	N/A
N/A	N/A	C:\Windows\System\ZjUMbgi.exe	N/A
N/A	N/A	C:\Windows\System\bzUOYQw.exe	N/A
N/A	N/A	C:\Windows\System\SYoTkif.exe	N/A
N/A	N/A	C:\Windows\System\zIetsmh.exe	N/A
N/A	N/A	C:\Windows\System\igrtNdX.exe	N/A
N/A	N/A	C:\Windows\System\VCFsMEr.exe	N/A
N/A	N/A	C:\Windows\System\SfZPmtT.exe	N/A
N/A	N/A	C:\Windows\System\CTlnhzr.exe	N/A
N/A	N/A	C:\Windows\System\gGlTQpT.exe	N/A
N/A	N/A	C:\Windows\System\LtFCleF.exe	N/A
N/A	N/A	C:\Windows\System\uunIiiz.exe	N/A
N/A	N/A	C:\Windows\System\Hwljkdg.exe	N/A
N/A	N/A	C:\Windows\System\OdSaAFt.exe	N/A
N/A	N/A	C:\Windows\System\nYSWfUc.exe	N/A
N/A	N/A	C:\Windows\System\qfcZHkn.exe	N/A
N/A	N/A	C:\Windows\System\GNPbqtA.exe	N/A
N/A	N/A	C:\Windows\System\zxZYHqv.exe	N/A
N/A	N/A	C:\Windows\System\nOoOiqP.exe	N/A
N/A	N/A	C:\Windows\System\TWhDQKO.exe	N/A
N/A	N/A	C:\Windows\System\XSsRFMq.exe	N/A
N/A	N/A	C:\Windows\System\ySsGqLo.exe	N/A
N/A	N/A	C:\Windows\System\DdnaiAg.exe	N/A
N/A	N/A	C:\Windows\System\xwFVSGx.exe	N/A
N/A	N/A	C:\Windows\System\dXWDlnu.exe	N/A
N/A	N/A	C:\Windows\System\FOrPZLH.exe	N/A
N/A	N/A	C:\Windows\System\NRwcOqu.exe	N/A
N/A	N/A	C:\Windows\System\QDfrKSl.exe	N/A
N/A	N/A	C:\Windows\System\qEEswha.exe	N/A
N/A	N/A	C:\Windows\System\hsJYjOQ.exe	N/A
N/A	N/A	C:\Windows\System\DKudamd.exe	N/A
N/A	N/A	C:\Windows\System\BDNdPQG.exe	N/A
N/A	N/A	C:\Windows\System\HvSvTNL.exe	N/A
N/A	N/A	C:\Windows\System\AKYrwQb.exe	N/A
N/A	N/A	C:\Windows\System\CyTbXck.exe	N/A
N/A	N/A	C:\Windows\System\SrSdnbX.exe	N/A
N/A	N/A	C:\Windows\System\ebDJeuN.exe	N/A
N/A	N/A	C:\Windows\System\UZyCpaV.exe	N/A
N/A	N/A	C:\Windows\System\pBGrbvB.exe	N/A
N/A	N/A	C:\Windows\System\epAJyLJ.exe	N/A
N/A	N/A	C:\Windows\System\lldeehk.exe	N/A
N/A	N/A	C:\Windows\System\IZHYeiw.exe	N/A
N/A	N/A	C:\Windows\System\nCBWeVs.exe	N/A
N/A	N/A	C:\Windows\System\DuzUJjj.exe	N/A
N/A	N/A	C:\Windows\System\eScJYYF.exe	N/A
N/A	N/A	C:\Windows\System\ajOlxsX.exe	N/A
N/A	N/A	C:\Windows\System\zxYwBwV.exe	N/A
N/A	N/A	C:\Windows\System\OjmoLjt.exe	N/A
N/A	N/A	C:\Windows\System\rbbuSCm.exe	N/A
N/A	N/A	C:\Windows\System\tlXNPEX.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\xcethUG.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LeRHUjV.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WhjIxHd.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QBwDSRh.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WwXPzbd.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YUmFxMR.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vSASpNF.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MdQfduH.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vVIdKVZ.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mWPAUuk.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zEDrnkS.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ptsbWaG.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IwvoWSF.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mRtoMhh.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YUAayVg.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TcNYETr.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\twZMmVz.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NXNxXJX.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tLThNBW.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YfGOkKt.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RAjnwmw.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SrSdnbX.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LKQcigM.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nfvKhoT.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZMqDaEh.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GcCMCEC.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\laEreqb.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mtNbnSN.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kmHMgkE.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ILsnMjy.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iTVkpDy.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rbDoKLU.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KmjDorj.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nWSdUJI.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\krKTmgL.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UtunDkT.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bpUKIvH.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VMhPxwR.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EueveBk.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SxamDjY.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KgpkDgq.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mzUfarz.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MCbJfER.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZNWVBIE.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tmybTtD.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ObqKzGy.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kYyuAaO.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zTJlyNu.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KDfSlSO.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FeMHPKP.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cfgpChb.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RVNvVvR.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jRHfUiX.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HtyvEXB.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IleVdYS.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\awQPizu.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GroLEWw.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UyrMXJb.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sUBPnse.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TWnuDTk.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\cjbowXc.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jeJkaeh.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UfvXItG.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hDrFNuh.exe	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3760 wrote to memory of 2372	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3760 wrote to memory of 2372	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3760 wrote to memory of 1468	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\IvzeSVQ.exe
PID 3760 wrote to memory of 1468	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\IvzeSVQ.exe
PID 3760 wrote to memory of 2204	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\fNkZUnr.exe
PID 3760 wrote to memory of 2204	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\fNkZUnr.exe
PID 3760 wrote to memory of 1628	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\zXMDrGx.exe
PID 3760 wrote to memory of 1628	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\zXMDrGx.exe
PID 3760 wrote to memory of 1084	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\OxPXtXR.exe
PID 3760 wrote to memory of 1084	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\OxPXtXR.exe
PID 3760 wrote to memory of 2060	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\ZCXPSps.exe
PID 3760 wrote to memory of 2060	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\ZCXPSps.exe
PID 3760 wrote to memory of 3372	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\FUzBjbv.exe
PID 3760 wrote to memory of 3372	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\FUzBjbv.exe
PID 3760 wrote to memory of 2748	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\wlXrcti.exe
PID 3760 wrote to memory of 2748	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\wlXrcti.exe
PID 3760 wrote to memory of 2524	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\OjoRWKq.exe
PID 3760 wrote to memory of 2524	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\OjoRWKq.exe
PID 3760 wrote to memory of 688	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\pOIgMtk.exe
PID 3760 wrote to memory of 688	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\pOIgMtk.exe
PID 3760 wrote to memory of 4700	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\ATQRBgT.exe
PID 3760 wrote to memory of 4700	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\ATQRBgT.exe
PID 3760 wrote to memory of 1240	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\eXGXDxG.exe
PID 3760 wrote to memory of 1240	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\eXGXDxG.exe
PID 3760 wrote to memory of 380	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\EgoJCWj.exe
PID 3760 wrote to memory of 380	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\EgoJCWj.exe
PID 3760 wrote to memory of 4284	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\amuEQFo.exe
PID 3760 wrote to memory of 4284	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\amuEQFo.exe
PID 3760 wrote to memory of 1676	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\lTNndcZ.exe
PID 3760 wrote to memory of 1676	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\lTNndcZ.exe
PID 3760 wrote to memory of 1320	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\jYqgUxr.exe
PID 3760 wrote to memory of 1320	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\jYqgUxr.exe
PID 3760 wrote to memory of 4784	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\ZjUMbgi.exe
PID 3760 wrote to memory of 4784	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\ZjUMbgi.exe
PID 3760 wrote to memory of 2428	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\bzUOYQw.exe
PID 3760 wrote to memory of 2428	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\bzUOYQw.exe
PID 3760 wrote to memory of 3720	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\SYoTkif.exe
PID 3760 wrote to memory of 3720	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\SYoTkif.exe
PID 3760 wrote to memory of 1608	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\zIetsmh.exe
PID 3760 wrote to memory of 1608	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\zIetsmh.exe
PID 3760 wrote to memory of 4364	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\igrtNdX.exe
PID 3760 wrote to memory of 4364	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\igrtNdX.exe
PID 3760 wrote to memory of 1944	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\VCFsMEr.exe
PID 3760 wrote to memory of 1944	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\VCFsMEr.exe
PID 3760 wrote to memory of 3356	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\SfZPmtT.exe
PID 3760 wrote to memory of 3356	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\SfZPmtT.exe
PID 3760 wrote to memory of 4540	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\CTlnhzr.exe
PID 3760 wrote to memory of 4540	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\CTlnhzr.exe
PID 3760 wrote to memory of 2356	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\gGlTQpT.exe
PID 3760 wrote to memory of 2356	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\gGlTQpT.exe
PID 3760 wrote to memory of 3916	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\LtFCleF.exe
PID 3760 wrote to memory of 3916	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\LtFCleF.exe
PID 3760 wrote to memory of 3132	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\xwFVSGx.exe
PID 3760 wrote to memory of 3132	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\xwFVSGx.exe
PID 3760 wrote to memory of 1884	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\uunIiiz.exe
PID 3760 wrote to memory of 1884	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\uunIiiz.exe
PID 3760 wrote to memory of 1612	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\hsJYjOQ.exe
PID 3760 wrote to memory of 1612	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\hsJYjOQ.exe
PID 3760 wrote to memory of 4400	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\Hwljkdg.exe
PID 3760 wrote to memory of 4400	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\Hwljkdg.exe
PID 3760 wrote to memory of 4624	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\OdSaAFt.exe
PID 3760 wrote to memory of 4624	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\OdSaAFt.exe
PID 3760 wrote to memory of 3264	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\SrSdnbX.exe
PID 3760 wrote to memory of 3264	N/A	C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe	C:\Windows\System\SrSdnbX.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\IvzeSVQ.exe

C:\Windows\System\IvzeSVQ.exe

C:\Windows\System\fNkZUnr.exe

C:\Windows\System\fNkZUnr.exe

C:\Windows\System\zXMDrGx.exe

C:\Windows\System\zXMDrGx.exe

C:\Windows\System\OxPXtXR.exe

C:\Windows\System\OxPXtXR.exe

C:\Windows\System\ZCXPSps.exe

C:\Windows\System\ZCXPSps.exe

C:\Windows\System\FUzBjbv.exe

C:\Windows\System\FUzBjbv.exe

C:\Windows\System\wlXrcti.exe

C:\Windows\System\wlXrcti.exe

C:\Windows\System\OjoRWKq.exe

C:\Windows\System\OjoRWKq.exe

C:\Windows\System\pOIgMtk.exe

C:\Windows\System\pOIgMtk.exe

C:\Windows\System\ATQRBgT.exe

C:\Windows\System\ATQRBgT.exe

C:\Windows\System\eXGXDxG.exe

C:\Windows\System\eXGXDxG.exe

C:\Windows\System\EgoJCWj.exe

C:\Windows\System\EgoJCWj.exe

C:\Windows\System\amuEQFo.exe

C:\Windows\System\amuEQFo.exe

C:\Windows\System\lTNndcZ.exe

C:\Windows\System\lTNndcZ.exe

C:\Windows\System\jYqgUxr.exe

C:\Windows\System\jYqgUxr.exe

C:\Windows\System\ZjUMbgi.exe

C:\Windows\System\ZjUMbgi.exe

C:\Windows\System\bzUOYQw.exe

C:\Windows\System\bzUOYQw.exe

C:\Windows\System\SYoTkif.exe

C:\Windows\System\SYoTkif.exe

C:\Windows\System\zIetsmh.exe

C:\Windows\System\zIetsmh.exe

C:\Windows\System\igrtNdX.exe

C:\Windows\System\igrtNdX.exe

C:\Windows\System\VCFsMEr.exe

C:\Windows\System\VCFsMEr.exe

C:\Windows\System\SfZPmtT.exe

C:\Windows\System\SfZPmtT.exe

C:\Windows\System\CTlnhzr.exe

C:\Windows\System\CTlnhzr.exe

C:\Windows\System\gGlTQpT.exe

C:\Windows\System\gGlTQpT.exe

C:\Windows\System\LtFCleF.exe

C:\Windows\System\LtFCleF.exe

C:\Windows\System\xwFVSGx.exe

C:\Windows\System\xwFVSGx.exe

C:\Windows\System\uunIiiz.exe

C:\Windows\System\uunIiiz.exe

C:\Windows\System\hsJYjOQ.exe

C:\Windows\System\hsJYjOQ.exe

C:\Windows\System\Hwljkdg.exe

C:\Windows\System\Hwljkdg.exe

C:\Windows\System\OdSaAFt.exe

C:\Windows\System\OdSaAFt.exe

C:\Windows\System\SrSdnbX.exe

C:\Windows\System\SrSdnbX.exe

C:\Windows\System\nYSWfUc.exe

C:\Windows\System\nYSWfUc.exe

C:\Windows\System\qfcZHkn.exe

C:\Windows\System\qfcZHkn.exe

C:\Windows\System\GNPbqtA.exe

C:\Windows\System\GNPbqtA.exe

C:\Windows\System\zxZYHqv.exe

C:\Windows\System\zxZYHqv.exe

C:\Windows\System\nOoOiqP.exe

C:\Windows\System\nOoOiqP.exe

C:\Windows\System\TWhDQKO.exe

C:\Windows\System\TWhDQKO.exe

C:\Windows\System\XSsRFMq.exe

C:\Windows\System\XSsRFMq.exe

C:\Windows\System\ySsGqLo.exe

C:\Windows\System\ySsGqLo.exe

C:\Windows\System\DdnaiAg.exe

C:\Windows\System\DdnaiAg.exe

C:\Windows\System\dXWDlnu.exe

C:\Windows\System\dXWDlnu.exe

C:\Windows\System\FOrPZLH.exe

C:\Windows\System\FOrPZLH.exe

C:\Windows\System\NRwcOqu.exe

C:\Windows\System\NRwcOqu.exe

C:\Windows\System\QDfrKSl.exe

C:\Windows\System\QDfrKSl.exe

C:\Windows\System\qEEswha.exe

C:\Windows\System\qEEswha.exe

C:\Windows\System\DKudamd.exe

C:\Windows\System\DKudamd.exe

C:\Windows\System\BDNdPQG.exe

C:\Windows\System\BDNdPQG.exe

C:\Windows\System\HvSvTNL.exe

C:\Windows\System\HvSvTNL.exe

C:\Windows\System\AKYrwQb.exe

C:\Windows\System\AKYrwQb.exe

C:\Windows\System\CyTbXck.exe

C:\Windows\System\CyTbXck.exe

C:\Windows\System\ebDJeuN.exe

C:\Windows\System\ebDJeuN.exe

C:\Windows\System\UZyCpaV.exe

C:\Windows\System\UZyCpaV.exe

C:\Windows\System\pBGrbvB.exe

C:\Windows\System\pBGrbvB.exe

C:\Windows\System\epAJyLJ.exe

C:\Windows\System\epAJyLJ.exe

C:\Windows\System\lldeehk.exe

C:\Windows\System\lldeehk.exe

C:\Windows\System\HSvehjl.exe

C:\Windows\System\HSvehjl.exe

C:\Windows\System\IZHYeiw.exe

C:\Windows\System\IZHYeiw.exe

C:\Windows\System\nCBWeVs.exe

C:\Windows\System\nCBWeVs.exe

C:\Windows\System\DuzUJjj.exe

C:\Windows\System\DuzUJjj.exe

C:\Windows\System\eScJYYF.exe

C:\Windows\System\eScJYYF.exe

C:\Windows\System\ajOlxsX.exe

C:\Windows\System\ajOlxsX.exe

C:\Windows\System\TmZpnat.exe

C:\Windows\System\TmZpnat.exe

C:\Windows\System\zxYwBwV.exe

C:\Windows\System\zxYwBwV.exe

C:\Windows\System\OjmoLjt.exe

C:\Windows\System\OjmoLjt.exe

C:\Windows\System\rbbuSCm.exe

C:\Windows\System\rbbuSCm.exe

C:\Windows\System\tlXNPEX.exe

C:\Windows\System\tlXNPEX.exe

C:\Windows\System\AqFqKeL.exe

C:\Windows\System\AqFqKeL.exe

C:\Windows\System\zaBhUpE.exe

C:\Windows\System\zaBhUpE.exe

C:\Windows\System\exFWFLt.exe

C:\Windows\System\exFWFLt.exe

C:\Windows\System\PcHZYos.exe

C:\Windows\System\PcHZYos.exe

C:\Windows\System\LFWABYF.exe

C:\Windows\System\LFWABYF.exe

C:\Windows\System\LSnDfeO.exe

C:\Windows\System\LSnDfeO.exe

C:\Windows\System\wvNRANw.exe

C:\Windows\System\wvNRANw.exe

C:\Windows\System\NWdAGzC.exe

C:\Windows\System\NWdAGzC.exe

C:\Windows\System\xewezzc.exe

C:\Windows\System\xewezzc.exe

C:\Windows\System\RcOCnJK.exe

C:\Windows\System\RcOCnJK.exe

C:\Windows\System\oZtSvyr.exe

C:\Windows\System\oZtSvyr.exe

C:\Windows\System\BiaRdYu.exe

C:\Windows\System\BiaRdYu.exe

C:\Windows\System\UMzsqyW.exe

C:\Windows\System\UMzsqyW.exe

C:\Windows\System\aoIcHtv.exe

C:\Windows\System\aoIcHtv.exe

C:\Windows\System\yjLUnmn.exe

C:\Windows\System\yjLUnmn.exe

C:\Windows\System\mxPWTRp.exe

C:\Windows\System\mxPWTRp.exe

C:\Windows\System\IVVphJF.exe

C:\Windows\System\IVVphJF.exe

C:\Windows\System\GroLEWw.exe

C:\Windows\System\GroLEWw.exe

C:\Windows\System\DCzRmDe.exe

C:\Windows\System\DCzRmDe.exe

C:\Windows\System\bcPGSjU.exe

C:\Windows\System\bcPGSjU.exe

C:\Windows\System\XxkTRsr.exe

C:\Windows\System\XxkTRsr.exe

C:\Windows\System\beFbmzG.exe

C:\Windows\System\beFbmzG.exe

C:\Windows\System\fUVyvtS.exe

C:\Windows\System\fUVyvtS.exe

C:\Windows\System\hOMHNcM.exe

C:\Windows\System\hOMHNcM.exe

C:\Windows\System\NbjToHx.exe

C:\Windows\System\NbjToHx.exe

C:\Windows\System\yNZMTLu.exe

C:\Windows\System\yNZMTLu.exe

C:\Windows\System\UcQPcDm.exe

C:\Windows\System\UcQPcDm.exe

C:\Windows\System\HmZzyLM.exe

C:\Windows\System\HmZzyLM.exe

C:\Windows\System\bnicDRG.exe

C:\Windows\System\bnicDRG.exe

C:\Windows\System\uKoPHGv.exe

C:\Windows\System\uKoPHGv.exe

C:\Windows\System\zyznrNA.exe

C:\Windows\System\zyznrNA.exe

C:\Windows\System\qZZywUn.exe

C:\Windows\System\qZZywUn.exe

C:\Windows\System\ePheRWC.exe

C:\Windows\System\ePheRWC.exe

C:\Windows\System\GyLVrwc.exe

C:\Windows\System\GyLVrwc.exe

C:\Windows\System\BDkvpYC.exe

C:\Windows\System\BDkvpYC.exe

C:\Windows\System\ylfPVxB.exe

C:\Windows\System\ylfPVxB.exe

C:\Windows\System\BDMLEFo.exe

C:\Windows\System\BDMLEFo.exe

C:\Windows\System\PkpXeSk.exe

C:\Windows\System\PkpXeSk.exe

C:\Windows\System\zNvZhdn.exe

C:\Windows\System\zNvZhdn.exe

C:\Windows\System\TUtqQds.exe

C:\Windows\System\TUtqQds.exe

C:\Windows\System\STzEngu.exe

C:\Windows\System\STzEngu.exe

C:\Windows\System\EbRgwXi.exe

C:\Windows\System\EbRgwXi.exe

C:\Windows\System\rLuRqHl.exe

C:\Windows\System\rLuRqHl.exe

C:\Windows\System\zHbSSzU.exe

C:\Windows\System\zHbSSzU.exe

C:\Windows\System\QCtvQNv.exe

C:\Windows\System\QCtvQNv.exe

C:\Windows\System\pvCPIiS.exe

C:\Windows\System\pvCPIiS.exe

C:\Windows\System\lOJTJSw.exe

C:\Windows\System\lOJTJSw.exe

C:\Windows\System\hrBgCcO.exe

C:\Windows\System\hrBgCcO.exe

C:\Windows\System\eJBEbSB.exe

C:\Windows\System\eJBEbSB.exe

C:\Windows\System\hfpObbs.exe

C:\Windows\System\hfpObbs.exe

C:\Windows\System\UfthHty.exe

C:\Windows\System\UfthHty.exe

C:\Windows\System\FUBSRap.exe

C:\Windows\System\FUBSRap.exe

C:\Windows\System\AFMGPdh.exe

C:\Windows\System\AFMGPdh.exe

C:\Windows\System\QmaaCmd.exe

C:\Windows\System\QmaaCmd.exe

C:\Windows\System\bJkYhej.exe

C:\Windows\System\bJkYhej.exe

C:\Windows\System\fmBwmGN.exe

C:\Windows\System\fmBwmGN.exe

C:\Windows\System\CugTEoS.exe

C:\Windows\System\CugTEoS.exe

C:\Windows\System\zgIkNTb.exe

C:\Windows\System\zgIkNTb.exe

C:\Windows\System\hTMEVwR.exe

C:\Windows\System\hTMEVwR.exe

C:\Windows\System\gJFxKqB.exe

C:\Windows\System\gJFxKqB.exe

C:\Windows\System\tFCZDKH.exe

C:\Windows\System\tFCZDKH.exe

C:\Windows\System\VnyilcK.exe

C:\Windows\System\VnyilcK.exe

C:\Windows\System\mRQFEUy.exe

C:\Windows\System\mRQFEUy.exe

C:\Windows\System\MukLxsy.exe

C:\Windows\System\MukLxsy.exe

C:\Windows\System\GxxLHvC.exe

C:\Windows\System\GxxLHvC.exe

C:\Windows\System\MNmmTsY.exe

C:\Windows\System\MNmmTsY.exe

C:\Windows\System\UtunDkT.exe

C:\Windows\System\UtunDkT.exe

C:\Windows\System\QqnODWW.exe

C:\Windows\System\QqnODWW.exe

C:\Windows\System\JQxNvYJ.exe

C:\Windows\System\JQxNvYJ.exe

C:\Windows\System\hpFznEW.exe

C:\Windows\System\hpFznEW.exe

C:\Windows\System\rznHcye.exe

C:\Windows\System\rznHcye.exe

C:\Windows\System\rCljKdp.exe

C:\Windows\System\rCljKdp.exe

C:\Windows\System\maVKGEp.exe

C:\Windows\System\maVKGEp.exe

C:\Windows\System\VOsedAQ.exe

C:\Windows\System\VOsedAQ.exe

C:\Windows\System\sZSlOJO.exe

C:\Windows\System\sZSlOJO.exe

C:\Windows\System\ZpeiVYi.exe

C:\Windows\System\ZpeiVYi.exe

C:\Windows\System\gSRdZnG.exe

C:\Windows\System\gSRdZnG.exe

C:\Windows\System\JWVhmYs.exe

C:\Windows\System\JWVhmYs.exe

C:\Windows\System\AyWhnwb.exe

C:\Windows\System\AyWhnwb.exe

C:\Windows\System\XjVSqGE.exe

C:\Windows\System\XjVSqGE.exe

C:\Windows\System\rcviSXR.exe

C:\Windows\System\rcviSXR.exe

C:\Windows\System\YxFogfb.exe

C:\Windows\System\YxFogfb.exe

C:\Windows\System\juvvIJN.exe

C:\Windows\System\juvvIJN.exe

C:\Windows\System\wPxwvGf.exe

C:\Windows\System\wPxwvGf.exe

C:\Windows\System\iOebXGN.exe

C:\Windows\System\iOebXGN.exe

C:\Windows\System\PyPqePC.exe

C:\Windows\System\PyPqePC.exe

C:\Windows\System\WxCeHjm.exe

C:\Windows\System\WxCeHjm.exe

C:\Windows\System\mgEeXQz.exe

C:\Windows\System\mgEeXQz.exe

C:\Windows\System\BlxqJmq.exe

C:\Windows\System\BlxqJmq.exe

C:\Windows\System\HZCrZcx.exe

C:\Windows\System\HZCrZcx.exe

C:\Windows\System\alCZPAM.exe

C:\Windows\System\alCZPAM.exe

C:\Windows\System\bnQjKRB.exe

C:\Windows\System\bnQjKRB.exe

C:\Windows\System\vCSPJoD.exe

C:\Windows\System\vCSPJoD.exe

C:\Windows\System\ZstFeWW.exe

C:\Windows\System\ZstFeWW.exe

C:\Windows\System\goKMTXE.exe

C:\Windows\System\goKMTXE.exe

C:\Windows\System\zSuWKdz.exe

C:\Windows\System\zSuWKdz.exe

C:\Windows\System\nHnCyJo.exe

C:\Windows\System\nHnCyJo.exe

C:\Windows\System\tZWkFTr.exe

C:\Windows\System\tZWkFTr.exe

C:\Windows\System\niWswYx.exe

C:\Windows\System\niWswYx.exe

C:\Windows\System\Vzxhqny.exe

C:\Windows\System\Vzxhqny.exe

C:\Windows\System\rwHfPrd.exe

C:\Windows\System\rwHfPrd.exe

C:\Windows\System\PMuORtU.exe

C:\Windows\System\PMuORtU.exe

C:\Windows\System\BuVCOsa.exe

C:\Windows\System\BuVCOsa.exe

C:\Windows\System\JWdPByR.exe

C:\Windows\System\JWdPByR.exe

C:\Windows\System\vdRlMkF.exe

C:\Windows\System\vdRlMkF.exe

C:\Windows\System\QXnIvIN.exe

C:\Windows\System\QXnIvIN.exe

C:\Windows\System\KDmLgwo.exe

C:\Windows\System\KDmLgwo.exe

C:\Windows\System\eznPvmM.exe

C:\Windows\System\eznPvmM.exe

C:\Windows\System\FMxpxXn.exe

C:\Windows\System\FMxpxXn.exe

C:\Windows\System\MvwaRgd.exe

C:\Windows\System\MvwaRgd.exe

C:\Windows\System\pVSSgRg.exe

C:\Windows\System\pVSSgRg.exe

C:\Windows\System\NiyLoPR.exe

C:\Windows\System\NiyLoPR.exe

C:\Windows\System\PoakHBx.exe

C:\Windows\System\PoakHBx.exe

C:\Windows\System\lRdZdNa.exe

C:\Windows\System\lRdZdNa.exe

C:\Windows\System\oqCEanI.exe

C:\Windows\System\oqCEanI.exe

C:\Windows\System\QvRKgtj.exe

C:\Windows\System\QvRKgtj.exe

C:\Windows\System\zbKZBxk.exe

C:\Windows\System\zbKZBxk.exe

C:\Windows\System\LecbCws.exe

C:\Windows\System\LecbCws.exe

C:\Windows\System\KkAwtQM.exe

C:\Windows\System\KkAwtQM.exe

C:\Windows\System\pmnkamm.exe

C:\Windows\System\pmnkamm.exe

C:\Windows\System\LCXgPLO.exe

C:\Windows\System\LCXgPLO.exe

C:\Windows\System\PlxkLGP.exe

C:\Windows\System\PlxkLGP.exe

C:\Windows\System\eZRhMyH.exe

C:\Windows\System\eZRhMyH.exe

C:\Windows\System\kbkEyXD.exe

C:\Windows\System\kbkEyXD.exe

C:\Windows\System\zrEZzhL.exe

C:\Windows\System\zrEZzhL.exe

C:\Windows\System\yocxCPj.exe

C:\Windows\System\yocxCPj.exe

C:\Windows\System\oWtVbOA.exe

C:\Windows\System\oWtVbOA.exe

C:\Windows\System\cvHnmvC.exe

C:\Windows\System\cvHnmvC.exe

C:\Windows\System\ydWqQAd.exe

C:\Windows\System\ydWqQAd.exe

C:\Windows\System\ILsnMjy.exe

C:\Windows\System\ILsnMjy.exe

C:\Windows\System\fWpSwIY.exe

C:\Windows\System\fWpSwIY.exe

C:\Windows\System\QDcKTIm.exe

C:\Windows\System\QDcKTIm.exe

C:\Windows\System\zahFbdA.exe

C:\Windows\System\zahFbdA.exe

C:\Windows\System\lttJyZL.exe

C:\Windows\System\lttJyZL.exe

C:\Windows\System\INVLGsz.exe

C:\Windows\System\INVLGsz.exe

C:\Windows\System\CXCpRts.exe

C:\Windows\System\CXCpRts.exe

C:\Windows\System\IjYEBof.exe

C:\Windows\System\IjYEBof.exe

C:\Windows\System\gOpiEQA.exe

C:\Windows\System\gOpiEQA.exe

C:\Windows\System\ViBWrbt.exe

C:\Windows\System\ViBWrbt.exe

C:\Windows\System\waeOXZL.exe

C:\Windows\System\waeOXZL.exe

C:\Windows\System\nPMpNJh.exe

C:\Windows\System\nPMpNJh.exe

C:\Windows\System\xpckhiq.exe

C:\Windows\System\xpckhiq.exe

C:\Windows\System\mYFyIYa.exe

C:\Windows\System\mYFyIYa.exe

C:\Windows\System\aGdIgmS.exe

C:\Windows\System\aGdIgmS.exe

C:\Windows\System\vOzhJft.exe

C:\Windows\System\vOzhJft.exe

C:\Windows\System\OKzdtxA.exe

C:\Windows\System\OKzdtxA.exe

C:\Windows\System\TaZrJmB.exe

C:\Windows\System\TaZrJmB.exe

C:\Windows\System\YwkChKA.exe

C:\Windows\System\YwkChKA.exe

C:\Windows\System\wBIOxxJ.exe

C:\Windows\System\wBIOxxJ.exe

C:\Windows\System\dLcGKNd.exe

C:\Windows\System\dLcGKNd.exe

C:\Windows\System\gRrmszQ.exe

C:\Windows\System\gRrmszQ.exe

C:\Windows\System\sPDvAXK.exe

C:\Windows\System\sPDvAXK.exe

C:\Windows\System\nAmUVhw.exe

C:\Windows\System\nAmUVhw.exe

C:\Windows\System\HzTWDCW.exe

C:\Windows\System\HzTWDCW.exe

C:\Windows\System\ZvNYGDW.exe

C:\Windows\System\ZvNYGDW.exe

C:\Windows\System\rdwSLIw.exe

C:\Windows\System\rdwSLIw.exe

C:\Windows\System\qXyZbXC.exe

C:\Windows\System\qXyZbXC.exe

C:\Windows\System\ifoCcFW.exe

C:\Windows\System\ifoCcFW.exe

C:\Windows\System\jISmYVh.exe

C:\Windows\System\jISmYVh.exe

C:\Windows\System\yQYtatb.exe

C:\Windows\System\yQYtatb.exe

C:\Windows\System\mzUfarz.exe

C:\Windows\System\mzUfarz.exe

C:\Windows\System\aSqDIKJ.exe

C:\Windows\System\aSqDIKJ.exe

C:\Windows\System\ftaAyHc.exe

C:\Windows\System\ftaAyHc.exe

C:\Windows\System\anwnUCW.exe

C:\Windows\System\anwnUCW.exe

C:\Windows\System\UnufHOt.exe

C:\Windows\System\UnufHOt.exe

C:\Windows\System\RUJOgXp.exe

C:\Windows\System\RUJOgXp.exe

C:\Windows\System\KVvHwsE.exe

C:\Windows\System\KVvHwsE.exe

C:\Windows\System\VlHNaGq.exe

C:\Windows\System\VlHNaGq.exe

C:\Windows\System\KQNskXF.exe

C:\Windows\System\KQNskXF.exe

C:\Windows\System\WlkkKji.exe

C:\Windows\System\WlkkKji.exe

C:\Windows\System\xUUzyTY.exe

C:\Windows\System\xUUzyTY.exe

C:\Windows\System\tdnQlBn.exe

C:\Windows\System\tdnQlBn.exe

C:\Windows\System\uEFfMlt.exe

C:\Windows\System\uEFfMlt.exe

C:\Windows\System\cAVhVyF.exe

C:\Windows\System\cAVhVyF.exe

C:\Windows\System\MCbJfER.exe

C:\Windows\System\MCbJfER.exe

C:\Windows\System\aAhcxdU.exe

C:\Windows\System\aAhcxdU.exe

C:\Windows\System\mvBmKXp.exe

C:\Windows\System\mvBmKXp.exe

C:\Windows\System\MNcPpUi.exe

C:\Windows\System\MNcPpUi.exe

C:\Windows\System\BBhsAqp.exe

C:\Windows\System\BBhsAqp.exe

C:\Windows\System\hcqtVBr.exe

C:\Windows\System\hcqtVBr.exe

C:\Windows\System\hUUNsWe.exe

C:\Windows\System\hUUNsWe.exe

C:\Windows\System\jkbGlrE.exe

C:\Windows\System\jkbGlrE.exe

C:\Windows\System\UxhkTyi.exe

C:\Windows\System\UxhkTyi.exe

C:\Windows\System\YPjKAEr.exe

C:\Windows\System\YPjKAEr.exe

C:\Windows\System\pTlywkW.exe

C:\Windows\System\pTlywkW.exe

C:\Windows\System\KVSyafi.exe

C:\Windows\System\KVSyafi.exe

C:\Windows\System\zjrPunh.exe

C:\Windows\System\zjrPunh.exe

C:\Windows\System\oznocMn.exe

C:\Windows\System\oznocMn.exe

C:\Windows\System\jbexcEF.exe

C:\Windows\System\jbexcEF.exe

C:\Windows\System\fZAfSdN.exe

C:\Windows\System\fZAfSdN.exe

C:\Windows\System\BCLzbIx.exe

C:\Windows\System\BCLzbIx.exe

C:\Windows\System\BpZQWYu.exe

C:\Windows\System\BpZQWYu.exe

C:\Windows\System\ntdGAbk.exe

C:\Windows\System\ntdGAbk.exe

C:\Windows\System\bIhMiqz.exe

C:\Windows\System\bIhMiqz.exe

C:\Windows\System\AnROQia.exe

C:\Windows\System\AnROQia.exe

C:\Windows\System\fbEpPPF.exe

C:\Windows\System\fbEpPPF.exe

C:\Windows\System\gKgNTSV.exe

C:\Windows\System\gKgNTSV.exe

C:\Windows\System\RhzsEFj.exe

C:\Windows\System\RhzsEFj.exe

C:\Windows\System\ROnkFSR.exe

C:\Windows\System\ROnkFSR.exe

C:\Windows\System\WslEXgv.exe

C:\Windows\System\WslEXgv.exe

C:\Windows\System\zwhoeOp.exe

C:\Windows\System\zwhoeOp.exe

C:\Windows\System\WxDSJgS.exe

C:\Windows\System\WxDSJgS.exe

C:\Windows\System\KHWJsXk.exe

C:\Windows\System\KHWJsXk.exe

C:\Windows\System\quaDVuz.exe

C:\Windows\System\quaDVuz.exe

C:\Windows\System\aymFWgm.exe

C:\Windows\System\aymFWgm.exe

C:\Windows\System\ZkytvDv.exe

C:\Windows\System\ZkytvDv.exe

C:\Windows\System\DtUTKPH.exe

C:\Windows\System\DtUTKPH.exe

C:\Windows\System\plDPxBd.exe

C:\Windows\System\plDPxBd.exe

C:\Windows\System\AuZGoGd.exe

C:\Windows\System\AuZGoGd.exe

C:\Windows\System\vNRpkYT.exe

C:\Windows\System\vNRpkYT.exe

C:\Windows\System\twVEUlI.exe

C:\Windows\System\twVEUlI.exe

C:\Windows\System\jRHfUiX.exe

C:\Windows\System\jRHfUiX.exe

C:\Windows\System\yjDpttf.exe

C:\Windows\System\yjDpttf.exe

C:\Windows\System\LpnrcOR.exe

C:\Windows\System\LpnrcOR.exe

C:\Windows\System\NXsiKPw.exe

C:\Windows\System\NXsiKPw.exe

C:\Windows\System\jXkSAwl.exe

C:\Windows\System\jXkSAwl.exe

C:\Windows\System\BQobEZm.exe

C:\Windows\System\BQobEZm.exe

C:\Windows\System\qEQlTJu.exe

C:\Windows\System\qEQlTJu.exe

C:\Windows\System\FRbFnho.exe

C:\Windows\System\FRbFnho.exe

C:\Windows\System\mTnxBrJ.exe

C:\Windows\System\mTnxBrJ.exe

C:\Windows\System\AjPqvec.exe

C:\Windows\System\AjPqvec.exe

C:\Windows\System\kyCIeyl.exe

C:\Windows\System\kyCIeyl.exe

C:\Windows\System\BYlSHgs.exe

C:\Windows\System\BYlSHgs.exe

C:\Windows\System\CDxFaDj.exe

C:\Windows\System\CDxFaDj.exe

C:\Windows\System\RLyqpAb.exe

C:\Windows\System\RLyqpAb.exe

C:\Windows\System\POOZVWR.exe

C:\Windows\System\POOZVWR.exe

C:\Windows\System\gYftgho.exe

C:\Windows\System\gYftgho.exe

C:\Windows\System\reSQUpU.exe

C:\Windows\System\reSQUpU.exe

C:\Windows\System\JBSzEZn.exe

C:\Windows\System\JBSzEZn.exe

C:\Windows\System\Ixbolsq.exe

C:\Windows\System\Ixbolsq.exe

C:\Windows\System\CbZTopz.exe

C:\Windows\System\CbZTopz.exe

C:\Windows\System\VNgheEz.exe

C:\Windows\System\VNgheEz.exe

C:\Windows\System\JbThjUR.exe

C:\Windows\System\JbThjUR.exe

C:\Windows\System\olSgnJV.exe

C:\Windows\System\olSgnJV.exe

C:\Windows\System\VlAUilb.exe

C:\Windows\System\VlAUilb.exe

C:\Windows\System\OakAwsw.exe

C:\Windows\System\OakAwsw.exe

C:\Windows\System\WqmVoUc.exe

C:\Windows\System\WqmVoUc.exe

C:\Windows\System\dKkLJGA.exe

C:\Windows\System\dKkLJGA.exe

C:\Windows\System\mRtoMhh.exe

C:\Windows\System\mRtoMhh.exe

C:\Windows\System\MUaeepD.exe

C:\Windows\System\MUaeepD.exe

C:\Windows\System\hbOhsfh.exe

C:\Windows\System\hbOhsfh.exe

C:\Windows\System\aHIuCbV.exe

C:\Windows\System\aHIuCbV.exe

C:\Windows\System\rAijhZH.exe

C:\Windows\System\rAijhZH.exe

C:\Windows\System\mfqdixp.exe

C:\Windows\System\mfqdixp.exe

C:\Windows\System\ibrDIsB.exe

C:\Windows\System\ibrDIsB.exe

C:\Windows\System\RChuvKk.exe

C:\Windows\System\RChuvKk.exe

C:\Windows\System\BBKjaIX.exe

C:\Windows\System\BBKjaIX.exe

C:\Windows\System\QhVNaRA.exe

C:\Windows\System\QhVNaRA.exe

C:\Windows\System\UJMSVEB.exe

C:\Windows\System\UJMSVEB.exe

C:\Windows\System\lHTFGof.exe

C:\Windows\System\lHTFGof.exe

C:\Windows\System\uZMrnGr.exe

C:\Windows\System\uZMrnGr.exe

C:\Windows\System\SNXzOqF.exe

C:\Windows\System\SNXzOqF.exe

C:\Windows\System\zLMcrQi.exe

C:\Windows\System\zLMcrQi.exe

C:\Windows\System\GuCSNmG.exe

C:\Windows\System\GuCSNmG.exe

C:\Windows\System\NdkqwkP.exe

C:\Windows\System\NdkqwkP.exe

C:\Windows\System\gcAHRcu.exe

C:\Windows\System\gcAHRcu.exe

C:\Windows\System\UyrMXJb.exe

C:\Windows\System\UyrMXJb.exe

C:\Windows\System\ZzvwtPy.exe

C:\Windows\System\ZzvwtPy.exe

C:\Windows\System\xNwEPnX.exe

C:\Windows\System\xNwEPnX.exe

C:\Windows\System\yBdYdTK.exe

C:\Windows\System\yBdYdTK.exe

C:\Windows\System\rVYFtMT.exe

C:\Windows\System\rVYFtMT.exe

C:\Windows\System\SOEkBno.exe

C:\Windows\System\SOEkBno.exe

C:\Windows\System\AldAdxh.exe

C:\Windows\System\AldAdxh.exe

C:\Windows\System\vKHZtBa.exe

C:\Windows\System\vKHZtBa.exe

C:\Windows\System\wmgBHHr.exe

C:\Windows\System\wmgBHHr.exe

C:\Windows\System\zTJlyNu.exe

C:\Windows\System\zTJlyNu.exe

C:\Windows\System\hgqhAyE.exe

C:\Windows\System\hgqhAyE.exe

C:\Windows\System\fMnjdId.exe

C:\Windows\System\fMnjdId.exe

C:\Windows\System\rUAUxnd.exe

C:\Windows\System\rUAUxnd.exe

C:\Windows\System\HwevbiR.exe

C:\Windows\System\HwevbiR.exe

C:\Windows\System\mkwbGgC.exe

C:\Windows\System\mkwbGgC.exe

C:\Windows\System\yFrQZLc.exe

C:\Windows\System\yFrQZLc.exe

C:\Windows\System\iaVwZnl.exe

C:\Windows\System\iaVwZnl.exe

C:\Windows\System\eHiNLfo.exe

C:\Windows\System\eHiNLfo.exe

C:\Windows\System\IKscbic.exe

C:\Windows\System\IKscbic.exe

C:\Windows\System\FDNhICI.exe

C:\Windows\System\FDNhICI.exe

C:\Windows\System\KoFAqtv.exe

C:\Windows\System\KoFAqtv.exe

C:\Windows\System\XTTzqih.exe

C:\Windows\System\XTTzqih.exe

C:\Windows\System\OkpxZQa.exe

C:\Windows\System\OkpxZQa.exe

C:\Windows\System\ovHuzYA.exe

C:\Windows\System\ovHuzYA.exe

C:\Windows\System\hrdQTBQ.exe

C:\Windows\System\hrdQTBQ.exe

C:\Windows\System\kHFXAYE.exe

C:\Windows\System\kHFXAYE.exe

C:\Windows\System\uMvUEaW.exe

C:\Windows\System\uMvUEaW.exe

C:\Windows\System\cjbowXc.exe

C:\Windows\System\cjbowXc.exe

C:\Windows\System\laPzkTf.exe

C:\Windows\System\laPzkTf.exe

C:\Windows\System\jeJkaeh.exe

C:\Windows\System\jeJkaeh.exe

C:\Windows\System\TlsbuIO.exe

C:\Windows\System\TlsbuIO.exe

C:\Windows\System\XVDutZD.exe

C:\Windows\System\XVDutZD.exe

C:\Windows\System\dprbwPy.exe

C:\Windows\System\dprbwPy.exe

C:\Windows\System\mcKrLDG.exe

C:\Windows\System\mcKrLDG.exe

C:\Windows\System\qYrrhhj.exe

C:\Windows\System\qYrrhhj.exe

C:\Windows\System\TnllghU.exe

C:\Windows\System\TnllghU.exe

C:\Windows\System\wlmDmST.exe

C:\Windows\System\wlmDmST.exe

C:\Windows\System\sCWAekT.exe

C:\Windows\System\sCWAekT.exe

C:\Windows\System\GUXnoak.exe

C:\Windows\System\GUXnoak.exe

C:\Windows\System\rtrPAUA.exe

C:\Windows\System\rtrPAUA.exe

C:\Windows\System\eXfzNhN.exe

C:\Windows\System\eXfzNhN.exe

C:\Windows\System\RsoDphq.exe

C:\Windows\System\RsoDphq.exe

C:\Windows\System\LfLbBNm.exe

C:\Windows\System\LfLbBNm.exe

C:\Windows\System\XiQHtIe.exe

C:\Windows\System\XiQHtIe.exe

C:\Windows\System\pEuGhAy.exe

C:\Windows\System\pEuGhAy.exe

C:\Windows\System\MQsGjoU.exe

C:\Windows\System\MQsGjoU.exe

C:\Windows\System\PcmeCdz.exe

C:\Windows\System\PcmeCdz.exe

C:\Windows\System\jwhOtYy.exe

C:\Windows\System\jwhOtYy.exe

C:\Windows\System\iTdOReB.exe

C:\Windows\System\iTdOReB.exe

C:\Windows\System\sVcXQGl.exe

C:\Windows\System\sVcXQGl.exe

C:\Windows\System\zZOPixw.exe

C:\Windows\System\zZOPixw.exe

C:\Windows\System\aJHDtmJ.exe

C:\Windows\System\aJHDtmJ.exe

C:\Windows\System\alCSyqS.exe

C:\Windows\System\alCSyqS.exe

C:\Windows\System\jANotbI.exe

C:\Windows\System\jANotbI.exe

C:\Windows\System\tngCBry.exe

C:\Windows\System\tngCBry.exe

C:\Windows\System\FURKmAB.exe

C:\Windows\System\FURKmAB.exe

C:\Windows\System\AXCYZDm.exe

C:\Windows\System\AXCYZDm.exe

C:\Windows\System\KYAbnhS.exe

C:\Windows\System\KYAbnhS.exe

C:\Windows\System\iMrQzYm.exe

C:\Windows\System\iMrQzYm.exe

C:\Windows\System\LXWpekK.exe

C:\Windows\System\LXWpekK.exe

C:\Windows\System\SNrbSlw.exe

C:\Windows\System\SNrbSlw.exe

C:\Windows\System\ldSuPBM.exe

C:\Windows\System\ldSuPBM.exe

C:\Windows\System\wWBsOMs.exe

C:\Windows\System\wWBsOMs.exe

C:\Windows\System\PzabsKm.exe

C:\Windows\System\PzabsKm.exe

C:\Windows\System\TEqrdZm.exe

C:\Windows\System\TEqrdZm.exe

C:\Windows\System\SFhIFLz.exe

C:\Windows\System\SFhIFLz.exe

C:\Windows\System\ozxnJHR.exe

C:\Windows\System\ozxnJHR.exe

C:\Windows\System\HaifBrV.exe

C:\Windows\System\HaifBrV.exe

C:\Windows\System\eTDIriA.exe

C:\Windows\System\eTDIriA.exe

C:\Windows\System\VwuDJcN.exe

C:\Windows\System\VwuDJcN.exe

C:\Windows\System\PELcOks.exe

C:\Windows\System\PELcOks.exe

C:\Windows\System\FVLHxZF.exe

C:\Windows\System\FVLHxZF.exe

C:\Windows\System\ZgtEKGZ.exe

C:\Windows\System\ZgtEKGZ.exe

C:\Windows\System\YUwYJTd.exe

C:\Windows\System\YUwYJTd.exe

C:\Windows\System\BnTXjIn.exe

C:\Windows\System\BnTXjIn.exe

C:\Windows\System\LRMaeaF.exe

C:\Windows\System\LRMaeaF.exe

C:\Windows\System\EJvfcbi.exe

C:\Windows\System\EJvfcbi.exe

C:\Windows\System\yxgnXsm.exe

C:\Windows\System\yxgnXsm.exe

C:\Windows\System\FNTbGJT.exe

C:\Windows\System\FNTbGJT.exe

C:\Windows\System\rNxTsjH.exe

C:\Windows\System\rNxTsjH.exe

C:\Windows\System\FLDAurx.exe

C:\Windows\System\FLDAurx.exe

C:\Windows\System\lYgxzPn.exe

C:\Windows\System\lYgxzPn.exe

C:\Windows\System\QFgwBuY.exe

C:\Windows\System\QFgwBuY.exe

C:\Windows\System\DlYpVAY.exe

C:\Windows\System\DlYpVAY.exe

C:\Windows\System\GPcuABK.exe

C:\Windows\System\GPcuABK.exe

C:\Windows\System\QKCjbdp.exe

C:\Windows\System\QKCjbdp.exe

C:\Windows\System\VEWfWKe.exe

C:\Windows\System\VEWfWKe.exe

C:\Windows\System\tkdPpvA.exe

C:\Windows\System\tkdPpvA.exe

C:\Windows\System\xUnKgvu.exe

C:\Windows\System\xUnKgvu.exe

C:\Windows\System\ZNWVBIE.exe

C:\Windows\System\ZNWVBIE.exe

C:\Windows\System\ofpojJV.exe

C:\Windows\System\ofpojJV.exe

C:\Windows\System\lpeOUAC.exe

C:\Windows\System\lpeOUAC.exe

C:\Windows\System\ZPcUVkh.exe

C:\Windows\System\ZPcUVkh.exe

C:\Windows\System\YnmRmUs.exe

C:\Windows\System\YnmRmUs.exe

C:\Windows\System\UuUGfEl.exe

C:\Windows\System\UuUGfEl.exe

C:\Windows\System\xVQxycn.exe

C:\Windows\System\xVQxycn.exe

C:\Windows\System\DvKNZAh.exe

C:\Windows\System\DvKNZAh.exe

C:\Windows\System\pitlZUK.exe

C:\Windows\System\pitlZUK.exe

C:\Windows\System\ylmTtML.exe

C:\Windows\System\ylmTtML.exe

C:\Windows\System\WkQSGdB.exe

C:\Windows\System\WkQSGdB.exe

C:\Windows\System\nARORml.exe

C:\Windows\System\nARORml.exe

C:\Windows\System\dMXBaiM.exe

C:\Windows\System\dMXBaiM.exe

C:\Windows\System\IIdbyPY.exe

C:\Windows\System\IIdbyPY.exe

C:\Windows\System\qeTizQJ.exe

C:\Windows\System\qeTizQJ.exe

C:\Windows\System\gkhmmDh.exe

C:\Windows\System\gkhmmDh.exe

C:\Windows\System\NGXmpBy.exe

C:\Windows\System\NGXmpBy.exe

C:\Windows\System\JarwgIW.exe

C:\Windows\System\JarwgIW.exe

C:\Windows\System\fIVnOZT.exe

C:\Windows\System\fIVnOZT.exe

C:\Windows\System\zEDrnkS.exe

C:\Windows\System\zEDrnkS.exe

C:\Windows\System\DPbfkCA.exe

C:\Windows\System\DPbfkCA.exe

C:\Windows\System\IlIAhrn.exe

C:\Windows\System\IlIAhrn.exe

C:\Windows\System\PFXYItR.exe

C:\Windows\System\PFXYItR.exe

C:\Windows\System\ghShtDa.exe

C:\Windows\System\ghShtDa.exe

C:\Windows\System\UkwFHXL.exe

C:\Windows\System\UkwFHXL.exe

C:\Windows\System\zOrAmVW.exe

C:\Windows\System\zOrAmVW.exe

C:\Windows\System\BOwGZUI.exe

C:\Windows\System\BOwGZUI.exe

C:\Windows\System\ypxIEty.exe

C:\Windows\System\ypxIEty.exe

C:\Windows\System\CTvINHQ.exe

C:\Windows\System\CTvINHQ.exe

C:\Windows\System\csBhCLv.exe

C:\Windows\System\csBhCLv.exe

C:\Windows\System\fnrFuqj.exe

C:\Windows\System\fnrFuqj.exe

C:\Windows\System\BmmvYtS.exe

C:\Windows\System\BmmvYtS.exe

C:\Windows\System\TfydePe.exe

C:\Windows\System\TfydePe.exe

C:\Windows\System\GwhXiNQ.exe

C:\Windows\System\GwhXiNQ.exe

C:\Windows\System\sDSvPTE.exe

C:\Windows\System\sDSvPTE.exe

C:\Windows\System\EJRWqmt.exe

C:\Windows\System\EJRWqmt.exe

C:\Windows\System\CUJwMnK.exe

C:\Windows\System\CUJwMnK.exe

C:\Windows\System\yhHaNsG.exe

C:\Windows\System\yhHaNsG.exe

C:\Windows\System\Xbmdtru.exe

C:\Windows\System\Xbmdtru.exe

C:\Windows\System\UGwVikK.exe

C:\Windows\System\UGwVikK.exe

C:\Windows\System\HKnffVS.exe

C:\Windows\System\HKnffVS.exe

C:\Windows\System\AGgYDVz.exe

C:\Windows\System\AGgYDVz.exe

C:\Windows\System\kZHepgC.exe

C:\Windows\System\kZHepgC.exe

C:\Windows\System\NnnjfmY.exe

C:\Windows\System\NnnjfmY.exe

C:\Windows\System\RauTQnu.exe

C:\Windows\System\RauTQnu.exe

C:\Windows\System\NouTYAh.exe

C:\Windows\System\NouTYAh.exe

C:\Windows\System\VMhPxwR.exe

C:\Windows\System\VMhPxwR.exe

C:\Windows\System\PfkdlYj.exe

C:\Windows\System\PfkdlYj.exe

C:\Windows\System\jPiHZCt.exe

C:\Windows\System\jPiHZCt.exe

C:\Windows\System\fGTTdQL.exe

C:\Windows\System\fGTTdQL.exe

C:\Windows\System\KYExYFX.exe

C:\Windows\System\KYExYFX.exe

C:\Windows\System\IARqpnF.exe

C:\Windows\System\IARqpnF.exe

C:\Windows\System\GWkxSVs.exe

C:\Windows\System\GWkxSVs.exe

C:\Windows\System\DuTbALm.exe

C:\Windows\System\DuTbALm.exe

C:\Windows\System\yiyISia.exe

C:\Windows\System\yiyISia.exe

C:\Windows\System\GADRWqK.exe

C:\Windows\System\GADRWqK.exe

C:\Windows\System\UzCcdgh.exe

C:\Windows\System\UzCcdgh.exe

C:\Windows\System\ZwPDHtQ.exe

C:\Windows\System\ZwPDHtQ.exe

C:\Windows\System\zljyUmR.exe

C:\Windows\System\zljyUmR.exe

C:\Windows\System\phrojLf.exe

C:\Windows\System\phrojLf.exe

C:\Windows\System\SlTerKx.exe

C:\Windows\System\SlTerKx.exe

C:\Windows\System\IXIKrUg.exe

C:\Windows\System\IXIKrUg.exe

C:\Windows\System\sZAPCwD.exe

C:\Windows\System\sZAPCwD.exe

C:\Windows\System\LtwypUQ.exe

C:\Windows\System\LtwypUQ.exe

C:\Windows\System\dODGEMS.exe

C:\Windows\System\dODGEMS.exe

C:\Windows\System\sPNCObc.exe

C:\Windows\System\sPNCObc.exe

C:\Windows\System\RqOwiVt.exe

C:\Windows\System\RqOwiVt.exe

C:\Windows\System\BbwVUlg.exe

C:\Windows\System\BbwVUlg.exe

C:\Windows\System\pAyEFmE.exe

C:\Windows\System\pAyEFmE.exe

C:\Windows\System\gpTCRNP.exe

C:\Windows\System\gpTCRNP.exe

C:\Windows\System\kVDWPXH.exe

C:\Windows\System\kVDWPXH.exe

C:\Windows\System\VJGBKpF.exe

C:\Windows\System\VJGBKpF.exe

C:\Windows\System\jZemhSE.exe

C:\Windows\System\jZemhSE.exe

C:\Windows\System\mzSpomz.exe

C:\Windows\System\mzSpomz.exe

C:\Windows\System\RSzORuq.exe

C:\Windows\System\RSzORuq.exe

C:\Windows\System\QVZgFMd.exe

C:\Windows\System\QVZgFMd.exe

C:\Windows\System\bHPcVrt.exe

C:\Windows\System\bHPcVrt.exe

C:\Windows\System\mecWBxm.exe

C:\Windows\System\mecWBxm.exe

C:\Windows\System\mDKPQuP.exe

C:\Windows\System\mDKPQuP.exe

C:\Windows\System\fKmsrhm.exe

C:\Windows\System\fKmsrhm.exe

C:\Windows\System\UyxshBj.exe

C:\Windows\System\UyxshBj.exe

C:\Windows\System\FVCedSu.exe

C:\Windows\System\FVCedSu.exe

C:\Windows\System\WliWNXm.exe

C:\Windows\System\WliWNXm.exe

C:\Windows\System\difPqlJ.exe

C:\Windows\System\difPqlJ.exe

C:\Windows\System\kmwJBKf.exe

C:\Windows\System\kmwJBKf.exe

C:\Windows\System\AkJNNhG.exe

C:\Windows\System\AkJNNhG.exe

C:\Windows\System\EueveBk.exe

C:\Windows\System\EueveBk.exe

C:\Windows\System\fmeNhPi.exe

C:\Windows\System\fmeNhPi.exe

C:\Windows\System\AvIiDkE.exe

C:\Windows\System\AvIiDkE.exe

C:\Windows\System\JjTEgrw.exe

C:\Windows\System\JjTEgrw.exe

C:\Windows\System\XiNceiV.exe

C:\Windows\System\XiNceiV.exe

C:\Windows\System\MFAtYRo.exe

C:\Windows\System\MFAtYRo.exe

C:\Windows\System\rfPBlCg.exe

C:\Windows\System\rfPBlCg.exe

C:\Windows\System\iwabQAb.exe

C:\Windows\System\iwabQAb.exe

C:\Windows\System\SKEdhXg.exe

C:\Windows\System\SKEdhXg.exe

C:\Windows\System\TCvMeJe.exe

C:\Windows\System\TCvMeJe.exe

C:\Windows\System\XlDexiy.exe

C:\Windows\System\XlDexiy.exe

C:\Windows\System\NwgUwwf.exe

C:\Windows\System\NwgUwwf.exe

C:\Windows\System\XtidlDh.exe

C:\Windows\System\XtidlDh.exe

C:\Windows\System\lFgYcEH.exe

C:\Windows\System\lFgYcEH.exe

C:\Windows\System\QbtgYow.exe

C:\Windows\System\QbtgYow.exe

C:\Windows\System\UHtzymn.exe

C:\Windows\System\UHtzymn.exe

C:\Windows\System\tAEpujq.exe

C:\Windows\System\tAEpujq.exe

C:\Windows\System\ZtUnOCB.exe

C:\Windows\System\ZtUnOCB.exe

C:\Windows\System\yVxSNnj.exe

C:\Windows\System\yVxSNnj.exe

C:\Windows\System\RSKzvWx.exe

C:\Windows\System\RSKzvWx.exe

C:\Windows\System\gnQYqlF.exe

C:\Windows\System\gnQYqlF.exe

C:\Windows\System\aSvmoVl.exe

C:\Windows\System\aSvmoVl.exe

C:\Windows\System\ehVdrNz.exe

C:\Windows\System\ehVdrNz.exe

C:\Windows\System\GgEHnsn.exe

C:\Windows\System\GgEHnsn.exe

C:\Windows\System\JYkhHVM.exe

C:\Windows\System\JYkhHVM.exe

C:\Windows\System\bbCTPpx.exe

C:\Windows\System\bbCTPpx.exe

C:\Windows\System\acIhlQI.exe

C:\Windows\System\acIhlQI.exe

C:\Windows\System\ZNdIOXe.exe

C:\Windows\System\ZNdIOXe.exe

C:\Windows\System\FPBEUBT.exe

C:\Windows\System\FPBEUBT.exe

C:\Windows\System\PaoYjgC.exe

C:\Windows\System\PaoYjgC.exe

C:\Windows\System\kQeIAYi.exe

C:\Windows\System\kQeIAYi.exe

C:\Windows\System\xRHSixz.exe

C:\Windows\System\xRHSixz.exe

C:\Windows\System\iAASjTW.exe

C:\Windows\System\iAASjTW.exe

C:\Windows\System\LSaVxry.exe

C:\Windows\System\LSaVxry.exe

C:\Windows\System\JpFrQVg.exe

C:\Windows\System\JpFrQVg.exe

C:\Windows\System\PwcHzrw.exe

C:\Windows\System\PwcHzrw.exe

C:\Windows\System\zQvaskB.exe

C:\Windows\System\zQvaskB.exe

C:\Windows\System\PZGpbYh.exe

C:\Windows\System\PZGpbYh.exe

C:\Windows\System\hpiezKF.exe

C:\Windows\System\hpiezKF.exe

C:\Windows\System\ycdImiA.exe

C:\Windows\System\ycdImiA.exe

C:\Windows\System\UrOYDgf.exe

C:\Windows\System\UrOYDgf.exe

C:\Windows\System\mnvgJzP.exe

C:\Windows\System\mnvgJzP.exe

C:\Windows\System\ARdrptG.exe

C:\Windows\System\ARdrptG.exe

C:\Windows\System\kMMeIAa.exe

C:\Windows\System\kMMeIAa.exe

C:\Windows\System\gumuELH.exe

C:\Windows\System\gumuELH.exe

C:\Windows\System\fOxFowO.exe

C:\Windows\System\fOxFowO.exe

C:\Windows\System\kODMSqA.exe

C:\Windows\System\kODMSqA.exe

C:\Windows\System\HGzFgar.exe

C:\Windows\System\HGzFgar.exe

C:\Windows\System\EysBAAD.exe

C:\Windows\System\EysBAAD.exe

C:\Windows\System\RkRfeQU.exe

C:\Windows\System\RkRfeQU.exe

C:\Windows\System\AQWXOIN.exe

C:\Windows\System\AQWXOIN.exe

C:\Windows\System\ndwBmGn.exe

C:\Windows\System\ndwBmGn.exe

C:\Windows\System\WsSWJYM.exe

C:\Windows\System\WsSWJYM.exe

C:\Windows\System\ZFNPLWb.exe

C:\Windows\System\ZFNPLWb.exe

C:\Windows\System\XKtlHqu.exe

C:\Windows\System\XKtlHqu.exe

C:\Windows\System\WuGpoEW.exe

C:\Windows\System\WuGpoEW.exe

C:\Windows\System\LmTRwut.exe

C:\Windows\System\LmTRwut.exe

C:\Windows\System\LcYreFS.exe

C:\Windows\System\LcYreFS.exe

C:\Windows\System\eBQuqPD.exe

C:\Windows\System\eBQuqPD.exe

C:\Windows\System\atrqOed.exe

C:\Windows\System\atrqOed.exe

C:\Windows\System\oZfIZdE.exe

C:\Windows\System\oZfIZdE.exe

C:\Windows\System\FEEHGmd.exe

C:\Windows\System\FEEHGmd.exe

C:\Windows\System\SCctwEb.exe

C:\Windows\System\SCctwEb.exe

C:\Windows\System\uTjqbky.exe

C:\Windows\System\uTjqbky.exe

C:\Windows\System\fIUAbMo.exe

C:\Windows\System\fIUAbMo.exe

C:\Windows\System\TJfHzSj.exe

C:\Windows\System\TJfHzSj.exe

C:\Windows\System\bgArYlW.exe

C:\Windows\System\bgArYlW.exe

C:\Windows\System\wRFtuQS.exe

C:\Windows\System\wRFtuQS.exe

C:\Windows\System\YITekNr.exe

C:\Windows\System\YITekNr.exe

C:\Windows\System\mGfXdVM.exe

C:\Windows\System\mGfXdVM.exe

C:\Windows\System\JERMono.exe

C:\Windows\System\JERMono.exe

C:\Windows\System\jewJQZg.exe

C:\Windows\System\jewJQZg.exe

C:\Windows\System\WLKLXGW.exe

C:\Windows\System\WLKLXGW.exe

C:\Windows\System\vCzmMDm.exe

C:\Windows\System\vCzmMDm.exe

C:\Windows\System\aGcTOGP.exe

C:\Windows\System\aGcTOGP.exe

C:\Windows\System\kCpWeeG.exe

C:\Windows\System\kCpWeeG.exe

C:\Windows\System\mGmjQDU.exe

C:\Windows\System\mGmjQDU.exe

C:\Windows\System\RbPuyXQ.exe

C:\Windows\System\RbPuyXQ.exe

C:\Windows\System\bkcdIzm.exe

C:\Windows\System\bkcdIzm.exe

C:\Windows\System\gIbInzq.exe

C:\Windows\System\gIbInzq.exe

C:\Windows\System\spUWNZX.exe

C:\Windows\System\spUWNZX.exe

C:\Windows\System\rwSoJmJ.exe

C:\Windows\System\rwSoJmJ.exe

C:\Windows\System\VKbdBiy.exe

C:\Windows\System\VKbdBiy.exe

C:\Windows\System\HedTjCv.exe

C:\Windows\System\HedTjCv.exe

C:\Windows\System\vkuJBTq.exe

C:\Windows\System\vkuJBTq.exe

C:\Windows\System\SzfMWyk.exe

C:\Windows\System\SzfMWyk.exe

C:\Windows\System\LJmckOJ.exe

C:\Windows\System\LJmckOJ.exe

C:\Windows\System\qybhgGo.exe

C:\Windows\System\qybhgGo.exe

C:\Windows\System\vUfExtw.exe

C:\Windows\System\vUfExtw.exe

C:\Windows\System\knVrYAI.exe

C:\Windows\System\knVrYAI.exe

C:\Windows\System\gFTrHwp.exe

C:\Windows\System\gFTrHwp.exe

C:\Windows\System\oNBiSxS.exe

C:\Windows\System\oNBiSxS.exe

C:\Windows\System\CXqGwGJ.exe

C:\Windows\System\CXqGwGJ.exe

C:\Windows\System\lvDSCyR.exe

C:\Windows\System\lvDSCyR.exe

C:\Windows\System\aKCdpWM.exe

C:\Windows\System\aKCdpWM.exe

C:\Windows\System\KDYmNoX.exe

C:\Windows\System\KDYmNoX.exe

C:\Windows\System\qvdBGEA.exe

C:\Windows\System\qvdBGEA.exe

C:\Windows\System\VjVXjoI.exe

C:\Windows\System\VjVXjoI.exe

C:\Windows\System\uhHSUMP.exe

C:\Windows\System\uhHSUMP.exe

C:\Windows\System\PZSBTpA.exe

C:\Windows\System\PZSBTpA.exe

C:\Windows\System\WOerFXD.exe

C:\Windows\System\WOerFXD.exe

C:\Windows\System\XsfFAGx.exe

C:\Windows\System\XsfFAGx.exe

C:\Windows\System\zQLEffD.exe

C:\Windows\System\zQLEffD.exe

C:\Windows\System\BGHvITa.exe

C:\Windows\System\BGHvITa.exe

C:\Windows\System\oPIpAaD.exe

C:\Windows\System\oPIpAaD.exe

C:\Windows\System\VViYIiU.exe

C:\Windows\System\VViYIiU.exe

C:\Windows\System\GCesORy.exe

C:\Windows\System\GCesORy.exe

C:\Windows\System\QUsvkAW.exe

C:\Windows\System\QUsvkAW.exe

C:\Windows\System\eiOUUKu.exe

C:\Windows\System\eiOUUKu.exe

C:\Windows\System\QUfLppV.exe

C:\Windows\System\QUfLppV.exe

C:\Windows\System\rmHvrXA.exe

C:\Windows\System\rmHvrXA.exe

C:\Windows\System\BvTJPRw.exe

C:\Windows\System\BvTJPRw.exe

C:\Windows\System\qFkUHAe.exe

C:\Windows\System\qFkUHAe.exe

C:\Windows\System\EsKXnAH.exe

C:\Windows\System\EsKXnAH.exe

C:\Windows\System\ZvQOdkv.exe

C:\Windows\System\ZvQOdkv.exe

C:\Windows\System\LaxoPYo.exe

C:\Windows\System\LaxoPYo.exe

C:\Windows\System\SzjQvFy.exe

C:\Windows\System\SzjQvFy.exe

C:\Windows\System\JeADMSh.exe

C:\Windows\System\JeADMSh.exe

C:\Windows\System\RfWylhz.exe

C:\Windows\System\RfWylhz.exe

C:\Windows\System\sqhLaNQ.exe

C:\Windows\System\sqhLaNQ.exe

C:\Windows\System\ajEwNqM.exe

C:\Windows\System\ajEwNqM.exe

C:\Windows\System\xyBPpbi.exe

C:\Windows\System\xyBPpbi.exe

C:\Windows\System\RHXJdsK.exe

C:\Windows\System\RHXJdsK.exe

C:\Windows\System\dwmVbAI.exe

C:\Windows\System\dwmVbAI.exe

C:\Windows\System\hBUVNhI.exe

C:\Windows\System\hBUVNhI.exe

C:\Windows\System\dSEquUv.exe

C:\Windows\System\dSEquUv.exe

C:\Windows\System\GpoyuQR.exe

C:\Windows\System\GpoyuQR.exe

C:\Windows\System\IwvoWSF.exe

C:\Windows\System\IwvoWSF.exe

C:\Windows\System\roywTtx.exe

C:\Windows\System\roywTtx.exe

C:\Windows\System\GUEKDuV.exe

C:\Windows\System\GUEKDuV.exe

C:\Windows\System\RZfUwzx.exe

C:\Windows\System\RZfUwzx.exe

C:\Windows\System\ZMqDaEh.exe

C:\Windows\System\ZMqDaEh.exe

C:\Windows\System\GOVfyCj.exe

C:\Windows\System\GOVfyCj.exe

C:\Windows\System\VuEVVPp.exe

C:\Windows\System\VuEVVPp.exe

C:\Windows\System\vUiJPTg.exe

C:\Windows\System\vUiJPTg.exe

C:\Windows\System\mFUzxDj.exe

C:\Windows\System\mFUzxDj.exe

C:\Windows\System\YaahGMG.exe

C:\Windows\System\YaahGMG.exe

C:\Windows\System\lpQcNLS.exe

C:\Windows\System\lpQcNLS.exe

C:\Windows\System\WJKMQKX.exe

C:\Windows\System\WJKMQKX.exe

C:\Windows\System\TIZiVyO.exe

C:\Windows\System\TIZiVyO.exe

C:\Windows\System\bUdsARQ.exe

C:\Windows\System\bUdsARQ.exe

C:\Windows\System\oCqjYqF.exe

C:\Windows\System\oCqjYqF.exe

C:\Windows\System\RJloyMy.exe

C:\Windows\System\RJloyMy.exe

C:\Windows\System\ITPtGyo.exe

C:\Windows\System\ITPtGyo.exe

C:\Windows\System\jEomqxp.exe

C:\Windows\System\jEomqxp.exe

C:\Windows\System\rKUxpFO.exe

C:\Windows\System\rKUxpFO.exe

C:\Windows\System\PWgobou.exe

C:\Windows\System\PWgobou.exe

C:\Windows\System\okuJJyF.exe

C:\Windows\System\okuJJyF.exe

C:\Windows\System\NiyBVzV.exe

C:\Windows\System\NiyBVzV.exe

C:\Windows\System\lvUuqzF.exe

C:\Windows\System\lvUuqzF.exe

C:\Windows\System\ZwveBvO.exe

C:\Windows\System\ZwveBvO.exe

C:\Windows\System\GcCMCEC.exe

C:\Windows\System\GcCMCEC.exe

C:\Windows\System\fZEAHyd.exe

C:\Windows\System\fZEAHyd.exe

C:\Windows\System\LeRHUjV.exe

C:\Windows\System\LeRHUjV.exe

C:\Windows\System\BNOebya.exe

C:\Windows\System\BNOebya.exe

C:\Windows\System\UfvXItG.exe

C:\Windows\System\UfvXItG.exe

C:\Windows\System\vQMshxb.exe

C:\Windows\System\vQMshxb.exe

C:\Windows\System\huMMGyy.exe

C:\Windows\System\huMMGyy.exe

C:\Windows\System\bbIuhzu.exe

C:\Windows\System\bbIuhzu.exe

C:\Windows\System\bHRRkOC.exe

C:\Windows\System\bHRRkOC.exe

C:\Windows\System\ckPCqKR.exe

C:\Windows\System\ckPCqKR.exe

C:\Windows\System\TIetEru.exe

C:\Windows\System\TIetEru.exe

C:\Windows\System\cfaboiA.exe

C:\Windows\System\cfaboiA.exe

C:\Windows\System\nxjfQgI.exe

C:\Windows\System\nxjfQgI.exe

C:\Windows\System\BanYRbN.exe

C:\Windows\System\BanYRbN.exe

C:\Windows\System\KLHLxvK.exe

C:\Windows\System\KLHLxvK.exe

C:\Windows\System\uWHSgqD.exe

C:\Windows\System\uWHSgqD.exe

C:\Windows\System\oxvbFXC.exe

C:\Windows\System\oxvbFXC.exe

C:\Windows\System\xDamqyz.exe

C:\Windows\System\xDamqyz.exe

C:\Windows\System\ouVvjWQ.exe

C:\Windows\System\ouVvjWQ.exe

C:\Windows\System\pAMSoWR.exe

C:\Windows\System\pAMSoWR.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
DE	3.120.98.217:8080		tcp

Files

memory/3760-0-0x00007FF706450000-0x00007FF706842000-memory.dmp

memory/3760-1-0x0000020E74CC0000-0x0000020E74CD0000-memory.dmp

C:\Windows\System\IvzeSVQ.exe

MD5	2d98d6688765f9569b7d4c58ee918f87
SHA1	d03c00b313ceff4495983378a69119abaefa3cd0
SHA256	081276968d89a6c731bb1898c8e6ffa2db1e8a25f0cd8af1e628fadc9ff1d626
SHA512	81395b7464960b2cb90e97520a6cc72623085d6cc9e45eebe2a1707b7b019fa19b458261ad25b270d0127a582a13e4c3f2258beb9efdfc2c058d4543a5dc5c08

C:\Windows\System\OjoRWKq.exe

MD5	b2e06e88f22a3959b2b2e590ba85bf0c
SHA1	d626c6dc2e923a8470469051c594666dc3577a6f
SHA256	2fcb40a2d3d70a75063443e10bef0dbcca965401d9d738bc9c52ec666ec340a4
SHA512	171eab24e8c91af901dc5841fd53ed9df2ab24019662ea28faa45fddffb3e6a3988c4f311a22bfabdb2d7db5c4bdddbf637bceccad1bd3446002b439c5ac5c52

C:\Windows\System\Hwljkdg.exe

MD5	cc82d49e203766ec5efee70ef31b7062
SHA1	bf99f06754708e7166efa4a7ea9ac0c096a1c594
SHA256	3a4496362e6e2c56c669e1ad81ace2fdc51514ff23e66a9cec18ec375beced90
SHA512	c1c5a12f069f07abb0d4a3a633da8a619e1a9946cbaa12246caab277eaba0665a2a592bf8c4d5c950395509292c5b09208c18b6ba7e88d12fc5318d65bde79ee

memory/2524-299-0x00007FF77D6D0000-0x00007FF77DAC2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s5jyplqq.vvh.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2372-307-0x000001EBF94E0000-0x000001EBF9502000-memory.dmp

memory/2372-237-0x000001EBF8C20000-0x000001EBF8C30000-memory.dmp

memory/2748-236-0x00007FF623EB0000-0x00007FF6242A2000-memory.dmp

C:\Windows\System\QDfrKSl.exe

MD5	0a14561420ec5718f1ef1025f25bdaec
SHA1	ce2141c621d6ade52341dfbc5f301957ef0a3a08
SHA256	7e19c0c0bd970285c0ca25eebd038acdc32b067f04c028a3d82b2eefaf898a17
SHA512	3040bc631bbda4535da73f26f77d0b5f7ecbe00c156c91a1f8a9a4a4b9498998f8b4335ec46dbc75366edff0dde056a633a81aed166b9e6f0c37bb4747fd0864

C:\Windows\System\NRwcOqu.exe

MD5	c463b78f6b44cbedc761593b1bedbc0e
SHA1	a5aa15a41d2dfcc3ee6eec4a8f9b303a8a3a0fd6
SHA256	41c3e0a7d569a7ebc59bfabe4c53e4baa5e1ecb53c8f9668af03db3df05a1ac3
SHA512	06e0bce16b2268efd8a7f2c634ea5ea3b8b88860b4fa623c132b58547372ca21777d06154e3a3595d9dd32eb3e72ceeb2cc6637da3140797397c0820fc7461e8

C:\Windows\System\FOrPZLH.exe

MD5	5f7debf3af21e47e1053bc5387f7bacb
SHA1	8f73102e462063f6b7b743b82b1471a5a1978017
SHA256	7f24961982d7eebacb1054cb42f937dacb2fc449ceabb92ad8ef69650f574b0b
SHA512	e340b34de349e383f4bc7a118679745405de7028b0bf5119687a0834dd280b70009051a57ec44b5c0d33b5edc049fc3517fdb22f6195edca8b0a5511089684ce

C:\Windows\System\zIetsmh.exe

MD5	10ceb76c1f508b8746981dc7856e02f7
SHA1	3b63204a8011d63a500c4a8e3add56643467d293
SHA256	4428408e854000654c3bf61231899147c70dccaeb7ef123f2cb7b202ed18e424
SHA512	1f5206e1a8e097a20364bd5ae2ac9f64f25ee7fd03346bfcd62b2c3ee7c9ca6792cc6e8bbc51a30345b3e53ce0fa1c543ec79ffae3131e66104fdab71a9f6a5f

C:\Windows\System\dXWDlnu.exe

MD5	41eeeecdfa0f8f4c91f2b7f35712528d
SHA1	ad74fa68e04018b12ad5b3952030ff1d7077a5f9
SHA256	f364156ffb66d8f93fd30d99de9b99d7a7dff118f946ef89dc732d12435a3c50
SHA512	a0c9022136cd7686a01c59e00bdee1a7adfe1acaef069e9f1141dcd958ebbd3efd4b981d7691707ed1d72fe90c6945bd3c972b37ef2d3efcc7a53e10ee784c37

C:\Windows\System\xwFVSGx.exe

MD5	04c7661b457639cca5a3ed8b2a0f0dc8
SHA1	ba1544421e1bf02d044fe694d628f14186ccd72c
SHA256	4b0bb4ce103cf07d5df8b01cdb16a3a555cae61e9dbe2bf506ec15e139123e2a
SHA512	5404c72b15fdd4d737a57c5e729376db360defb4d5626c795452fd6e101b17de80cdc87550327d231ad9a6afb866c875554d69acdab0fda1ca4d48c77b82f8bd

C:\Windows\System\DdnaiAg.exe

MD5	a73b5b335dce3d630bea220fbf4f02b3
SHA1	6c51a5459c42a923167600597d61ed59666af22c
SHA256	555196b878636d4e49500cbd91c6d91b169a0993b830faca39bf27db3183a584
SHA512	16b2e9b168bb279215a867a4be8eb5a5ab7dc7aac914ced4843e2c2c225341c18f88235e259570d614b3e4aa927cde836fdeae957ce596a83b2fea11b029833e

C:\Windows\System\ySsGqLo.exe

MD5	de306a4e32117da138da2449758593c8
SHA1	a1726559aeddb188fd588e8a833f46abdd6e941a
SHA256	302f166b188ba02b3b929e5e1c16b01e93f61c808de9f7f950bcb85e0e59b1c9
SHA512	70886e388dbe7c38ad9ee7b92c419d819adf54a4a7366fcef8530e914cb803ef83d8eefc00dca4b66c6240f2a4985502ad9d9587a163c47ce4c912d0978948fb

C:\Windows\System\nOoOiqP.exe

MD5	ddcff8b727b6059c070af2f693910fe0
SHA1	6f1df475eb2f7dfa83bd4a533ba4360e3b212e37
SHA256	03aaffaafee333c4b8326d93a103cbc778ea1ed1cc1450452219d6be0134fae3
SHA512	ebfc4f154310f4f2f87865a9496f2e40eea65573dc2f0626abe2d04c13f7b5e62c26a820c02ee2274cffcea643537ff5e7fd8a0522629ffc707127613e69cb51

C:\Windows\System\zxZYHqv.exe

MD5	7f1e724a59c0dc1cb7c640e90e8e571b
SHA1	26c57b4dd39f54d4d2145697721afa2e1712dcf0
SHA256	7587f44b9eafd6d1acbfff595b39ec7e4dd814a03b0c8f188b5be164f07d5129
SHA512	5f6e08afb31c8d4f88493909a822704b04ea41affb423cc5a5b662326758299f0808e12bb48db65e64c986d4d9f5cdd82ad45b115fb07d21fc6457a0b3cba4bd

C:\Windows\System\XSsRFMq.exe

MD5	d8c086d93ef54999e59cc3bfd42167c2
SHA1	64e4baa838578885a308c30632688ced9fc3c2a2
SHA256	df7a1016aad5d78114b87d2ff3d4afe1e81c690b82a97d919636e2b308e139bc
SHA512	03d2bdc77d8edd9b092db5f1fba5e7d5e1d86b7f25725306c1513a6792fa3d3fef3db04ab4a7160ad2f74eb96dee113d704485af0d6b1acbe4d789af7f858b9a

C:\Windows\System\TWhDQKO.exe

MD5	0168de75f042f44c7a5489a93f4a6f70
SHA1	28e450d3ee63cd2a889d185382b84e05131a9dd7
SHA256	c2645c2863f28e5f0048a88220e701b8562249b4b58f1fba039cce5008f64829
SHA512	39171ccd90195d1a00b41adbbf397704ea492a721bef3b9e061949f2bc1e66b5ebed340a7093822c3883d59916af0aa2c299b9d3e5159f2c9b0f69705738ceb5

C:\Windows\System\GNPbqtA.exe

MD5	6fb4136f903a4cf39c005204d01d9944
SHA1	33ccb92ff53cb898d65a7cc7a1ef16f4da32a79a
SHA256	1390aaa18fdfe5869e48ca3fa99c4d95dd01482a5217d9bc80f9816e5df12bf8
SHA512	a6a48231fa7c8e67d4aa59ac3389031043eea245bee29b8a0c2b0e9fea842f5d2f438821549b06837a63fb88796eb159de338e5dda39d431feb2a94ee1713818

C:\Windows\System\bzUOYQw.exe

MD5	692ee430bccdfcae98bf55b4e88efae4
SHA1	e62d2a7aaadb56c4be5fed23d9bf7cd3d60d316c
SHA256	0281259715ff5b13674bb31a7b0c9c3cb136ee81e255b0f5574d2acb68e5d9a1
SHA512	a80e7b76f81d04a881e105c2e4026c8d9381e4df54eb0047ebf5c7c5b3e7276f9b84af0cf4cf0a09410abf70c7fabbdd4c5ce65ebbc5768425708f79f7809b6c

C:\Windows\System\qfcZHkn.exe

MD5	18e611816bb642b258b6b610b0b7fb04
SHA1	9fccbcac015239daf676f077bd7babdf6ad71d0d
SHA256	e0babbcf30d5fe100e16c8842fa33b097238dd310c209362bad17661b651b141
SHA512	1b45ea5491b9f995ac50b2e2c577d560227b80ff9c0a3aaf800029d38344d50aa294ede8c7db59473ae66710af0ec44546cc908e7afe5dda8a71b9f1fdee192e

C:\Windows\System\ZjUMbgi.exe

MD5	e2fe1d1230be2f2b3a6eb81280c4004b
SHA1	19ee7eb0ee8df01de50c4b1574b76325cdde95c7
SHA256	14f90d93e3965707a8020cc8bee45c3299a5a71bf723d7ac1b028510bb9687f3
SHA512	fda4c70b2352b151f7c4c107966dd7488197a001a7e7531cdf5e90e37044f8e37ad4da7957bce920a93022b8ab991fd691b5ad653f1d8b751daf6d3337f33e09

memory/688-399-0x00007FF74A690000-0x00007FF74AA82000-memory.dmp

memory/4284-494-0x00007FF795830000-0x00007FF795C22000-memory.dmp

memory/1676-614-0x00007FF6142B0000-0x00007FF6146A2000-memory.dmp

memory/1320-636-0x00007FF7FF3D0000-0x00007FF7FF7C2000-memory.dmp

memory/3720-639-0x00007FF6C18F0000-0x00007FF6C1CE2000-memory.dmp

memory/1608-649-0x00007FF66B450000-0x00007FF66B842000-memory.dmp

memory/1240-647-0x00007FF7827D0000-0x00007FF782BC2000-memory.dmp

memory/1628-646-0x00007FF73DB80000-0x00007FF73DF72000-memory.dmp

memory/2372-645-0x00007FFD06B13000-0x00007FFD06B15000-memory.dmp

memory/2356-644-0x00007FF626100000-0x00007FF6264F2000-memory.dmp

memory/4540-643-0x00007FF6FD920000-0x00007FF6FDD12000-memory.dmp

memory/3356-642-0x00007FF7D7470000-0x00007FF7D7862000-memory.dmp

memory/1944-641-0x00007FF6B1580000-0x00007FF6B1972000-memory.dmp

memory/4364-640-0x00007FF7E2E50000-0x00007FF7E3242000-memory.dmp

memory/2428-638-0x00007FF61C770000-0x00007FF61CB62000-memory.dmp

memory/4784-637-0x00007FF6D8310000-0x00007FF6D8702000-memory.dmp

memory/4700-635-0x00007FF6D4790000-0x00007FF6D4B82000-memory.dmp

memory/380-493-0x00007FF7CB7B0000-0x00007FF7CBBA2000-memory.dmp

C:\Windows\System\OdSaAFt.exe

MD5	21f4c2cc28b3df3b3fc71140032975bb
SHA1	8c00cbc4740f16ba6394222679c893de9457d4a5
SHA256	07f36c7c69bda422b5db26d590c27314cbed3868374322d456556e6820d5cdd2
SHA512	e44d17d1dd59cddf8abf3ad011354198094d0431db309a24d8f37c9788a107f45046dfc14a327e0a8309f60c184ee78b0124ebd39518b79e15a29e567297ab1b

C:\Windows\System\pOIgMtk.exe

MD5	f4a654784c4ab720ca37eac28a6bee76
SHA1	9b5b4e7c501dc46c004d62e0c9282f6e5ae04b93
SHA256	98a27cf388ae4d85a2c81229c41c393db44e53c2019f76898c6141ad308359b2
SHA512	99c051c3c6cfc01b6f55859a2951ded1402f1925044ef96ee1fbcbbf3aa5ec746007534d8d08f743a3048c355a465b6f7e9e9965ed138f2bc9efcac9faff5663

C:\Windows\System\jYqgUxr.exe

MD5	59c11bbbec2a4135a04328179eb1f278
SHA1	b9bc914a49ed2485c8a33a44bee8919639bcce9c
SHA256	df7f62d46c6806580e0068f0a0ed4f1dc2494a6f742013dff30f994c8981142a
SHA512	f94a80da9ddcb9fe00bc312ac487c01fdf9e7a56994326111002611d1474411a06f08a992f2e2e7f83fefc9d545c42ec6a5a865297217033a7fbf26be7f2966e

C:\Windows\System\lTNndcZ.exe

MD5	33717d8896245724278cef4bac068a3d
SHA1	273c264baecc21e59305035eecb05cc285c3ed24
SHA256	af75584662fc63f9b0edf8a189c1efd72fd3fa3a631b35d10b2b3229a1f9b76a
SHA512	7b8dc133d6db02ae16c542cc6625add156bb5d8d51ad7a4226869fd02230d7153b033c3a09376105fbb2c3eeb2cb26a1c6f8efce28b24a03cc41d3c9b4f7e875

memory/3372-139-0x00007FF7DAFF0000-0x00007FF7DB3E2000-memory.dmp

C:\Windows\System\amuEQFo.exe

MD5	7d810f92879129afabf6554ed1659fe3
SHA1	005b054b84e1734d9e586180e482127901e60c76
SHA256	d06ddd896c0d616936c8018d0819ce2519bf0973944d1dae3ea06d15465a1ac1
SHA512	c27034cc87d6a599fabc48ac59591a20a59ad269f00940f3190e5ee2bca66c885674da5a6d9d7b4d9a6b8768d26be88768e25d302ddc6a323557bc93ebec5cf3

C:\Windows\System\uunIiiz.exe

MD5	943ac1836fb2133c1b73bb98c3a2dd1a
SHA1	f225440e60329cf45b24c430f4abc9afa2d3c63f
SHA256	cf5987a1ddf7ecdbbfb7095ff09fbb123340b878d7bc7851b058c4f0e9a9d144
SHA512	892369e83921679192c1f6720ed55d9538300c6e96a18b78abfcefc960acd4c0fc111aad516ec3ea419952e61e30bcc604c27feae9df1e25e2b6d6b0d2958a3b

C:\Windows\System\EgoJCWj.exe

MD5	d631db044be8ff71046c7bdb3ef9087b
SHA1	c0d81ac5ea1e264921fb3335625a524aa0dee288
SHA256	d028af4f3597a5f51a7be2f26c25335dd8d2d894a7d1c4e881b2c0da50e5970e
SHA512	5e7539ec30b5ed28e61c435f0046a1dfb0a0f042c90193174d072161159c1c53e75baf2f79f0bdc980ab18fb1019f40514e2e78772a047c71adcc6e7af804d5e

memory/2060-129-0x00007FF620620000-0x00007FF620A12000-memory.dmp

C:\Windows\System\gGlTQpT.exe

MD5	d1b200d0469fa7e1a43fd2675686338f
SHA1	c1e5892a3cda3b0ef164d58fc4ff7853a8e85c4e
SHA256	4cc0c4a937aabaec9999d3f2f5d890ee9ab52706774c45744b8c7e6b1bc3bc0e
SHA512	4e15598fa283d01e28dbf6fcbf2ae0319324cfaf9e455de087fa8c4f40689e0363358a28d140758888fc75abddcf335b51047b768f80a8933a49241387d30cdb

C:\Windows\System\CTlnhzr.exe

MD5	9cb3cbabb486c3bb262a44e649ad06c9
SHA1	93df2f539bfc7cef233e10d40f953dde0f2a715c
SHA256	6f58995610d824d405230faf3c85339b0947a052cce4c22b7fe88b5eab09c18d
SHA512	b7c828d728b4408194a1dc30ef3a4767099ac0fd051722259913c1ae9f3d232364ad68a03275355a5bfa264e5adea5a649e2f2663cb458b4c225a6931346785b

C:\Windows\System\ZCXPSps.exe

MD5	bb7e66beb2adc6b58e9a11aeb5438696
SHA1	c240772022f5ece318396d960ee73b3c2afefbb4
SHA256	9626ad6d7982ab5e9e5ee1fa3e52594af2a6be2f01111aeff6cd7ad4ac4d1c2d
SHA512	bb2a1e7130d71cc30d0e0d2663bc46d5701c42ef55c64cccffd1c6485e8df1b959dbe6b74f3980deb3de737e9faeaf3b474913664f2aa25a2da43d8f397c30a0

C:\Windows\System\eXGXDxG.exe

MD5	ae046536ca402b0bf64809fd02bdc7b0
SHA1	0dcd8323b29c78d370ea315f0c69c9bcdce250dc
SHA256	aa8fd263e00c30b46e5f1a69d1ec167c68181bf28b5339c8f530cd40959789ce
SHA512	8cd459cb692f3ca1a260ecd4703c46d785619d7ab68af8e3410bb4970cf1d22c7afeac8fb3a8fe9fdfb898fb678b71d5ff1774c46949fee99ca6c8c3a9b97f43

C:\Windows\System\SYoTkif.exe

MD5	88a65c0877cc6b9341660db6ade470d2
SHA1	ccf6d485cbcbbd63ac29fd09b269bb203728d938
SHA256	511efc70763c0ef5c187af8c5636f365063f703658146ab787e603f706434cc8
SHA512	b6310908a7a7e9bd5f33b07639b8e4e4e596d21df031e445e7fc8fb2da259a3a2fa28cccb6f48f9ee99dec466817e93a91b2daf38d1f1b68ebfcb7db6d3c0490

C:\Windows\System\nYSWfUc.exe

MD5	be4bc4c94b7b65d80dcd31b52deef18a
SHA1	efba5ae3a8203598e003780fc059b13e1cd8b2df
SHA256	67fbe56a8dbdfbf28e8223f7cc797d03c67639806c7be6cd1bfce6839b4b1ac7
SHA512	60fd4c9cd1266f6e5aa7a80cedcc1906f70568832ee22c6156d56c16df20ebfdacd2564cbb9882790720f17473362834e2d0f55ca9c16b6fa50fedaceb1d9889

C:\Windows\System\ATQRBgT.exe

MD5	0f468c55dfc0ff1da522cacbf59e6090
SHA1	8a22f065196043088b999c64f2c48241dbed3f01
SHA256	edfc2e57f4901618f303ab7d2df959d6977241e87f61fd84e5c26470051dcb2f
SHA512	70301bd69f679dfc8b6ebb7fdd2291a6c8644d9725e488b3267d68293957e08da161087425265d158c70ba3d23af378d57f8c3996962914002d7409e5c6f6037

C:\Windows\System\LtFCleF.exe

MD5	22ab81632979ba7fe2ef1285e65a2c6c
SHA1	36feeb728e3d5191aaff361858a7a8fa943c1b42
SHA256	d8e94be3859f90168becea3b6f2625d8487b2551bd26540bfdcb7d1ae7e32831
SHA512	a46078b21b3cb25989fa57db7876312c7e0db36665356c36867ff1d8e8edbd8b612813b65e5805a3b6db94bda5d0d6474971dc9f00e5a360525d2b540977f217

C:\Windows\System\SfZPmtT.exe

MD5	44c0f85b7a58b16bb82507705cef85cc
SHA1	8793d514becc7d9db3e344238228e7124527a5d5
SHA256	4cf2449dea276b7c7005040849a8da5bb6d816afc23d0401ece92631b61de26b
SHA512	7418a7c8d2726ebae6eca9e88d6ee4db700c7c713ce34556e595e7db2c8eb3b5889e88f44548960dd26d59755ef359ea7151ce5f3b792101960610c58630c7ed

C:\Windows\System\wlXrcti.exe

MD5	9ad3bebf1f07e415ca128fe94b12eb06
SHA1	6319ad1b695bca5d21dbd5c3d4326639767eec76
SHA256	1bdb1a23fcd68f8a217152bff4aaa7b6efa2743250c9b204bbae69e4e2bdcb0b
SHA512	b4debb5f9ddd2931cccf922a317da7eb49cdf6a15a1e44e0954d3d476ce79a2b21cc449be0a443e17a7ddb7756dd9aa4640349319d61ceef8498d78267c2f512

C:\Windows\System\VCFsMEr.exe

MD5	40dd31fd1cacab26d48c1b8713158593
SHA1	70494772d0ef021ad86842af958cdf48900ddbd4
SHA256	b60f4103d55b0cb855fd3de23f6931d41fce42135551089f5872b0c1e65336d0
SHA512	24b24acc5ab615d237cede1ce6976148217af4b0fb23e97ea94d9a87736c794d62f5de7559db27224e741c552e2505df9b17472dd35ed49bddeff24d318e0fdf

memory/1084-74-0x00007FF7D5C00000-0x00007FF7D5FF2000-memory.dmp

C:\Windows\System\igrtNdX.exe

MD5	eb3a510f500d4695094234145e9af543
SHA1	583940254dc24807cce043ba323eccf3ad0398d8
SHA256	dbdeb99d6ba057d9403c578662d2b4879e07c6aba2ffd62152ce0e47bf512037
SHA512	ffb53b776fdf9072ec0c229d84b25a172d61ac70faf92d5879ff881576fa80334c6e894fcde79671919b4ffee716ae70da36193af256696138170ae8ed38c835

C:\Windows\System\FUzBjbv.exe

MD5	c652c1a4bce715245763ea56b278fe86
SHA1	6bf4d8b92c003323eb74f44243984ddf0aa9b2d4
SHA256	2f3908fd55cf598305c085e09ef474cb9708ec70415c87b1165d237c9bdcd310
SHA512	5061663da73a9a0a9b473f42a6ab47b02052abdeae7515ecfc0b0bcf42ed30ef626bb3bb03814bdfd976b8ef925ff8cceb8da11197ea628e9ce1df9a34172d1a

C:\Windows\System\zXMDrGx.exe

MD5	7609983ecc52f4e9ac9d07362e56e20e
SHA1	b9cc668f575f307c6303a31e81a9392f8e70055d
SHA256	fb5febb537eefb382c394b7fbeba6fb66badf91dd5979341b95b92420e80d315
SHA512	7fdea976b0e420ebb1ec3d522fb11513487db0d36303d9458f2e5cd84382f6ea301be39847d375c7f4af151c126efaae8bb746b2d8302773cb20e6f1d0447b1e

C:\Windows\System\OxPXtXR.exe

MD5	559b53d2173016676116ece6b7a761e3
SHA1	97f5b8f61614da978edcd5faefc04d241ac62fe5
SHA256	db536e4d602ad4851827013918d6418649ab9dca2cec680115431ace1b00e294
SHA512	5039498f6a66a73e4d3b8fda81c445c130c301c0aa49883132778ef1b906a2ce8ef3c686eaf45701d5fb0cf27d33a91ca02155bf4447187c48de4d003e4803bb

memory/2204-51-0x00007FF785360000-0x00007FF785752000-memory.dmp

C:\Windows\System\fNkZUnr.exe

MD5	ac32dbf843d90a546c89dfe9bd106d58
SHA1	2fb6cc47773300e4d23d2cc4130001fc984f42ba
SHA256	7d209a6b523bfbfba57b6f4a5329ebc1d63967747bbd2e455f0fda114f44f5eb
SHA512	d93d0ef4f2060c44d618cef2840c5648a135c6756f48a2a2f12bbfe9136e70b04e2c231141a042f9bece90f1f4748c2665a78f16d5fabc77b3a62a623c538cce

memory/2372-22-0x000001EBF8C20000-0x000001EBF8C30000-memory.dmp

memory/1468-21-0x00007FF716210000-0x00007FF716602000-memory.dmp

C:\Windows\System\xNPxDVp.exe

MD5	e71397695bfc95ac5fe1d82687725659
SHA1	45272317203fb987b8952f41b0170bd5a78944b0
SHA256	593106c260dc81c57565b84dcf164e3aba348716b31b67ed996f84e8eb33a8f2
SHA512	b0a8d0ea3899c2bbb7c006edeeb2ecf2f4894f56db8d8ff247c4e6fc5083c186ab234b2494615de540e99bc5dda8055b1dfec22d34c5a32a9febff889f810e0e

memory/2204-3354-0x00007FF785360000-0x00007FF785752000-memory.dmp

memory/1084-3355-0x00007FF7D5C00000-0x00007FF7D5FF2000-memory.dmp

memory/1468-3357-0x00007FF716210000-0x00007FF716602000-memory.dmp

memory/2060-3358-0x00007FF620620000-0x00007FF620A12000-memory.dmp

memory/1628-3362-0x00007FF73DB80000-0x00007FF73DF72000-memory.dmp

memory/2204-3365-0x00007FF785360000-0x00007FF785752000-memory.dmp

memory/1084-3364-0x00007FF7D5C00000-0x00007FF7D5FF2000-memory.dmp

memory/3372-3367-0x00007FF7DAFF0000-0x00007FF7DB3E2000-memory.dmp

memory/2428-3388-0x00007FF61C770000-0x00007FF61CB62000-memory.dmp

memory/4364-3399-0x00007FF7E2E50000-0x00007FF7E3242000-memory.dmp

memory/688-3398-0x00007FF74A690000-0x00007FF74AA82000-memory.dmp

memory/1944-3403-0x00007FF6B1580000-0x00007FF6B1972000-memory.dmp

memory/4784-3395-0x00007FF6D8310000-0x00007FF6D8702000-memory.dmp

memory/1676-3389-0x00007FF6142B0000-0x00007FF6146A2000-memory.dmp

memory/1608-3387-0x00007FF66B450000-0x00007FF66B842000-memory.dmp

memory/3720-3393-0x00007FF6C18F0000-0x00007FF6C1CE2000-memory.dmp

memory/2524-3383-0x00007FF77D6D0000-0x00007FF77DAC2000-memory.dmp

memory/4284-3379-0x00007FF795830000-0x00007FF795C22000-memory.dmp

memory/2748-3375-0x00007FF623EB0000-0x00007FF6242A2000-memory.dmp

memory/1240-3374-0x00007FF7827D0000-0x00007FF782BC2000-memory.dmp

memory/2060-3371-0x00007FF620620000-0x00007FF620A12000-memory.dmp

memory/1320-3385-0x00007FF7FF3D0000-0x00007FF7FF7C2000-memory.dmp

memory/4700-3381-0x00007FF6D4790000-0x00007FF6D4B82000-memory.dmp

memory/380-3370-0x00007FF7CB7B0000-0x00007FF7CBBA2000-memory.dmp

memory/3356-3416-0x00007FF7D7470000-0x00007FF7D7862000-memory.dmp

memory/2356-3418-0x00007FF626100000-0x00007FF6264F2000-memory.dmp

memory/4540-3458-0x00007FF6FD920000-0x00007FF6FDD12000-memory.dmp

Sample ID	240613-qjn3ssvbkj
Target	7f317da7e1a7fccb27d3d0e769a5c3a0_NeikiAnalytics.exe
SHA256	f719988ef8b9986d7af643c7574c98ee40a219e6dca111a3acca568fe15fb97e
Tags	upx miner xmrig execution

Malware Analysis Report

2024-07-28 19:54

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files