Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\esaTnsL.exe	N/A
N/A	N/A	C:\Windows\System\LmbJgIm.exe	N/A
N/A	N/A	C:\Windows\System\IXnPDkN.exe	N/A
N/A	N/A	C:\Windows\System\vDaPzQL.exe	N/A
N/A	N/A	C:\Windows\System\lHqxwdv.exe	N/A
N/A	N/A	C:\Windows\System\MAEOynE.exe	N/A
N/A	N/A	C:\Windows\System\OmmOHvQ.exe	N/A
N/A	N/A	C:\Windows\System\AQbrDrP.exe	N/A
N/A	N/A	C:\Windows\System\hiGQetu.exe	N/A
N/A	N/A	C:\Windows\System\fcGsCXh.exe	N/A
N/A	N/A	C:\Windows\System\xCCiJfX.exe	N/A
N/A	N/A	C:\Windows\System\lavAbFI.exe	N/A
N/A	N/A	C:\Windows\System\JGqdfvh.exe	N/A
N/A	N/A	C:\Windows\System\CSHEffd.exe	N/A
N/A	N/A	C:\Windows\System\kQSjFqi.exe	N/A
N/A	N/A	C:\Windows\System\KHxxlNV.exe	N/A
N/A	N/A	C:\Windows\System\UUKdfkE.exe	N/A
N/A	N/A	C:\Windows\System\SFZGCrz.exe	N/A
N/A	N/A	C:\Windows\System\tYUYWiF.exe	N/A
N/A	N/A	C:\Windows\System\ftllXxS.exe	N/A
N/A	N/A	C:\Windows\System\adlLIXq.exe	N/A
N/A	N/A	C:\Windows\System\MiIQqUR.exe	N/A
N/A	N/A	C:\Windows\System\IaLFKyr.exe	N/A
N/A	N/A	C:\Windows\System\xVUnWPK.exe	N/A
N/A	N/A	C:\Windows\System\gxbbrbt.exe	N/A
N/A	N/A	C:\Windows\System\HHithQF.exe	N/A
N/A	N/A	C:\Windows\System\hjJNane.exe	N/A
N/A	N/A	C:\Windows\System\OEqZslD.exe	N/A
N/A	N/A	C:\Windows\System\pZIYbNb.exe	N/A
N/A	N/A	C:\Windows\System\RryYpix.exe	N/A
N/A	N/A	C:\Windows\System\TGmsjSH.exe	N/A
N/A	N/A	C:\Windows\System\QQuvoYr.exe	N/A
N/A	N/A	C:\Windows\System\UgMbZLt.exe	N/A
N/A	N/A	C:\Windows\System\dKvoiMi.exe	N/A
N/A	N/A	C:\Windows\System\mwRPRNZ.exe	N/A
N/A	N/A	C:\Windows\System\FDpyefZ.exe	N/A
N/A	N/A	C:\Windows\System\mucfVhq.exe	N/A
N/A	N/A	C:\Windows\System\GbYoPco.exe	N/A
N/A	N/A	C:\Windows\System\bhRdoHV.exe	N/A
N/A	N/A	C:\Windows\System\FsMDilt.exe	N/A
N/A	N/A	C:\Windows\System\akJAcTl.exe	N/A
N/A	N/A	C:\Windows\System\gVkGyWl.exe	N/A
N/A	N/A	C:\Windows\System\QvuqrhD.exe	N/A
N/A	N/A	C:\Windows\System\ZgdCnpl.exe	N/A
N/A	N/A	C:\Windows\System\Weunqdu.exe	N/A
N/A	N/A	C:\Windows\System\YfGEYsb.exe	N/A
N/A	N/A	C:\Windows\System\HNRrzXl.exe	N/A
N/A	N/A	C:\Windows\System\uqRuHnY.exe	N/A
N/A	N/A	C:\Windows\System\WguoBIx.exe	N/A
N/A	N/A	C:\Windows\System\FiPsZHo.exe	N/A
N/A	N/A	C:\Windows\System\xdpeOmj.exe	N/A
N/A	N/A	C:\Windows\System\yeHzCgL.exe	N/A
N/A	N/A	C:\Windows\System\rJOjanc.exe	N/A
N/A	N/A	C:\Windows\System\KzISqkW.exe	N/A
N/A	N/A	C:\Windows\System\EUAIBtZ.exe	N/A
N/A	N/A	C:\Windows\System\ZDrUnxy.exe	N/A
N/A	N/A	C:\Windows\System\FJpMXiY.exe	N/A
N/A	N/A	C:\Windows\System\XPgKZhh.exe	N/A
N/A	N/A	C:\Windows\System\TBpMKsa.exe	N/A
N/A	N/A	C:\Windows\System\vtMmFcx.exe	N/A
N/A	N/A	C:\Windows\System\wPQaYmT.exe	N/A
N/A	N/A	C:\Windows\System\LMfvxcO.exe	N/A
N/A	N/A	C:\Windows\System\SKTXljH.exe	N/A
N/A	N/A	C:\Windows\System\JcdzqVl.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\xKNeIHC.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bfCMnXq.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ymlbDrj.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JAfwtqX.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vZzZYiY.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\fcGsCXh.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pfPpmIs.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UoCpBmM.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BQdQoCF.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eTmidxL.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pAynixI.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\UcZBwbm.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DEmygYi.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WUpczDs.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CsnRAev.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NmGceCk.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qMKLEUJ.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BzkMFBZ.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VzZSyuH.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QAaYulN.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FzvUQfW.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CofWgUx.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kLovxFR.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\decOFNf.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YaFCdoY.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KMOsZTW.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lWpGkyA.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nnLuQwb.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qdPbuuR.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\diIbjWh.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vwaNAIL.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bUHdIAx.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LtjPmnl.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XUgRHEs.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bfnVMVD.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WHTHlyZ.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VpInotG.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DQcriwf.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TXIXlYK.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\dXiXuha.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xRbUAPP.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BFGUMAH.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kCBGpNB.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lChcSKV.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\rVUncye.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bsxEFeC.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ctgEdTT.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\OykHnTM.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GGrJEMz.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\XCtBokT.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mhWwRIQ.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kjZYLCr.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\oOLsceF.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ROqFuYw.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\HiFBAAA.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ETcldrG.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jXuiJEr.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vFJRIVd.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BAqdnNO.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\VLsJoWQ.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\FNWNoaJ.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\khWYioR.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nUPmHgg.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AeatVAA.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1632 wrote to memory of 1512	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1632 wrote to memory of 1512	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1632 wrote to memory of 1512	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1632 wrote to memory of 1912	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\esaTnsL.exe
PID 1632 wrote to memory of 1912	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\esaTnsL.exe
PID 1632 wrote to memory of 1912	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\esaTnsL.exe
PID 1632 wrote to memory of 2516	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\LmbJgIm.exe
PID 1632 wrote to memory of 2516	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\LmbJgIm.exe
PID 1632 wrote to memory of 2516	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\LmbJgIm.exe
PID 1632 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\IXnPDkN.exe
PID 1632 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\IXnPDkN.exe
PID 1632 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\IXnPDkN.exe
PID 1632 wrote to memory of 2652	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\lHqxwdv.exe
PID 1632 wrote to memory of 2652	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\lHqxwdv.exe
PID 1632 wrote to memory of 2652	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\lHqxwdv.exe
PID 1632 wrote to memory of 2432	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\vDaPzQL.exe
PID 1632 wrote to memory of 2432	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\vDaPzQL.exe
PID 1632 wrote to memory of 2432	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\vDaPzQL.exe
PID 1632 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\MAEOynE.exe
PID 1632 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\MAEOynE.exe
PID 1632 wrote to memory of 2712	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\MAEOynE.exe
PID 1632 wrote to memory of 2560	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\OmmOHvQ.exe
PID 1632 wrote to memory of 2560	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\OmmOHvQ.exe
PID 1632 wrote to memory of 2560	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\OmmOHvQ.exe
PID 1632 wrote to memory of 2328	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\AQbrDrP.exe
PID 1632 wrote to memory of 2328	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\AQbrDrP.exe
PID 1632 wrote to memory of 2328	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\AQbrDrP.exe
PID 1632 wrote to memory of 2436	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\hiGQetu.exe
PID 1632 wrote to memory of 2436	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\hiGQetu.exe
PID 1632 wrote to memory of 2436	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\hiGQetu.exe
PID 1632 wrote to memory of 2500	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\fcGsCXh.exe
PID 1632 wrote to memory of 2500	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\fcGsCXh.exe
PID 1632 wrote to memory of 2500	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\fcGsCXh.exe
PID 1632 wrote to memory of 2900	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\xCCiJfX.exe
PID 1632 wrote to memory of 2900	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\xCCiJfX.exe
PID 1632 wrote to memory of 2900	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\xCCiJfX.exe
PID 1632 wrote to memory of 2912	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\lavAbFI.exe
PID 1632 wrote to memory of 2912	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\lavAbFI.exe
PID 1632 wrote to memory of 2912	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\lavAbFI.exe
PID 1632 wrote to memory of 1828	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\JGqdfvh.exe
PID 1632 wrote to memory of 1828	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\JGqdfvh.exe
PID 1632 wrote to memory of 1828	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\JGqdfvh.exe
PID 1632 wrote to memory of 2704	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\CSHEffd.exe
PID 1632 wrote to memory of 2704	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\CSHEffd.exe
PID 1632 wrote to memory of 2704	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\CSHEffd.exe
PID 1632 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\kQSjFqi.exe
PID 1632 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\kQSjFqi.exe
PID 1632 wrote to memory of 2720	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\kQSjFqi.exe
PID 1632 wrote to memory of 2600	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\KHxxlNV.exe
PID 1632 wrote to memory of 2600	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\KHxxlNV.exe
PID 1632 wrote to memory of 2600	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\KHxxlNV.exe
PID 1632 wrote to memory of 2316	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\UUKdfkE.exe
PID 1632 wrote to memory of 2316	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\UUKdfkE.exe
PID 1632 wrote to memory of 2316	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\UUKdfkE.exe
PID 1632 wrote to memory of 2024	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\SFZGCrz.exe
PID 1632 wrote to memory of 2024	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\SFZGCrz.exe
PID 1632 wrote to memory of 2024	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\SFZGCrz.exe
PID 1632 wrote to memory of 1628	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\tYUYWiF.exe
PID 1632 wrote to memory of 1628	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\tYUYWiF.exe
PID 1632 wrote to memory of 1628	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\tYUYWiF.exe
PID 1632 wrote to memory of 2880	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\ftllXxS.exe
PID 1632 wrote to memory of 2880	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\ftllXxS.exe
PID 1632 wrote to memory of 2880	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\ftllXxS.exe
PID 1632 wrote to memory of 2336	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\adlLIXq.exe

Processes

C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\esaTnsL.exe

C:\Windows\System\esaTnsL.exe

C:\Windows\System\LmbJgIm.exe

C:\Windows\System\LmbJgIm.exe

C:\Windows\System\IXnPDkN.exe

C:\Windows\System\IXnPDkN.exe

C:\Windows\System\lHqxwdv.exe

C:\Windows\System\lHqxwdv.exe

C:\Windows\System\vDaPzQL.exe

C:\Windows\System\vDaPzQL.exe

C:\Windows\System\MAEOynE.exe

C:\Windows\System\MAEOynE.exe

C:\Windows\System\OmmOHvQ.exe

C:\Windows\System\OmmOHvQ.exe

C:\Windows\System\AQbrDrP.exe

C:\Windows\System\AQbrDrP.exe

C:\Windows\System\hiGQetu.exe

C:\Windows\System\hiGQetu.exe

C:\Windows\System\fcGsCXh.exe

C:\Windows\System\fcGsCXh.exe

C:\Windows\System\xCCiJfX.exe

C:\Windows\System\xCCiJfX.exe

C:\Windows\System\lavAbFI.exe

C:\Windows\System\lavAbFI.exe

C:\Windows\System\JGqdfvh.exe

C:\Windows\System\JGqdfvh.exe

C:\Windows\System\CSHEffd.exe

C:\Windows\System\CSHEffd.exe

C:\Windows\System\kQSjFqi.exe

C:\Windows\System\kQSjFqi.exe

C:\Windows\System\KHxxlNV.exe

C:\Windows\System\KHxxlNV.exe

C:\Windows\System\UUKdfkE.exe

C:\Windows\System\UUKdfkE.exe

C:\Windows\System\SFZGCrz.exe

C:\Windows\System\SFZGCrz.exe

C:\Windows\System\tYUYWiF.exe

C:\Windows\System\tYUYWiF.exe

C:\Windows\System\ftllXxS.exe

C:\Windows\System\ftllXxS.exe

C:\Windows\System\adlLIXq.exe

C:\Windows\System\adlLIXq.exe

C:\Windows\System\xVUnWPK.exe

C:\Windows\System\xVUnWPK.exe

C:\Windows\System\MiIQqUR.exe

C:\Windows\System\MiIQqUR.exe

C:\Windows\System\OEqZslD.exe

C:\Windows\System\OEqZslD.exe

C:\Windows\System\IaLFKyr.exe

C:\Windows\System\IaLFKyr.exe

C:\Windows\System\pZIYbNb.exe

C:\Windows\System\pZIYbNb.exe

C:\Windows\System\gxbbrbt.exe

C:\Windows\System\gxbbrbt.exe

C:\Windows\System\QQuvoYr.exe

C:\Windows\System\QQuvoYr.exe

C:\Windows\System\HHithQF.exe

C:\Windows\System\HHithQF.exe

C:\Windows\System\dKvoiMi.exe

C:\Windows\System\dKvoiMi.exe

C:\Windows\System\hjJNane.exe

C:\Windows\System\hjJNane.exe

C:\Windows\System\mucfVhq.exe

C:\Windows\System\mucfVhq.exe

C:\Windows\System\RryYpix.exe

C:\Windows\System\RryYpix.exe

C:\Windows\System\GbYoPco.exe

C:\Windows\System\GbYoPco.exe

C:\Windows\System\TGmsjSH.exe

C:\Windows\System\TGmsjSH.exe

C:\Windows\System\bhRdoHV.exe

C:\Windows\System\bhRdoHV.exe

C:\Windows\System\UgMbZLt.exe

C:\Windows\System\UgMbZLt.exe

C:\Windows\System\FsMDilt.exe

C:\Windows\System\FsMDilt.exe

C:\Windows\System\mwRPRNZ.exe

C:\Windows\System\mwRPRNZ.exe

C:\Windows\System\akJAcTl.exe

C:\Windows\System\akJAcTl.exe

C:\Windows\System\FDpyefZ.exe

C:\Windows\System\FDpyefZ.exe

C:\Windows\System\gVkGyWl.exe

C:\Windows\System\gVkGyWl.exe

C:\Windows\System\QvuqrhD.exe

C:\Windows\System\QvuqrhD.exe

C:\Windows\System\hRSdmJA.exe

C:\Windows\System\hRSdmJA.exe

C:\Windows\System\ZgdCnpl.exe

C:\Windows\System\ZgdCnpl.exe

C:\Windows\System\NoJlGtK.exe

C:\Windows\System\NoJlGtK.exe

C:\Windows\System\Weunqdu.exe

C:\Windows\System\Weunqdu.exe

C:\Windows\System\YOGrVDZ.exe

C:\Windows\System\YOGrVDZ.exe

C:\Windows\System\YfGEYsb.exe

C:\Windows\System\YfGEYsb.exe

C:\Windows\System\IzbvCiX.exe

C:\Windows\System\IzbvCiX.exe

C:\Windows\System\HNRrzXl.exe

C:\Windows\System\HNRrzXl.exe

C:\Windows\System\SgbUvJq.exe

C:\Windows\System\SgbUvJq.exe

C:\Windows\System\uqRuHnY.exe

C:\Windows\System\uqRuHnY.exe

C:\Windows\System\bNxdoXV.exe

C:\Windows\System\bNxdoXV.exe

C:\Windows\System\WguoBIx.exe

C:\Windows\System\WguoBIx.exe

C:\Windows\System\ixBHJfa.exe

C:\Windows\System\ixBHJfa.exe

C:\Windows\System\FiPsZHo.exe

C:\Windows\System\FiPsZHo.exe

C:\Windows\System\tNohBwd.exe

C:\Windows\System\tNohBwd.exe

C:\Windows\System\xdpeOmj.exe

C:\Windows\System\xdpeOmj.exe

C:\Windows\System\KqqNDHE.exe

C:\Windows\System\KqqNDHE.exe

C:\Windows\System\yeHzCgL.exe

C:\Windows\System\yeHzCgL.exe

C:\Windows\System\SdMoeTL.exe

C:\Windows\System\SdMoeTL.exe

C:\Windows\System\rJOjanc.exe

C:\Windows\System\rJOjanc.exe

C:\Windows\System\HGntfdq.exe

C:\Windows\System\HGntfdq.exe

C:\Windows\System\KzISqkW.exe

C:\Windows\System\KzISqkW.exe

C:\Windows\System\ADEbtne.exe

C:\Windows\System\ADEbtne.exe

C:\Windows\System\EUAIBtZ.exe

C:\Windows\System\EUAIBtZ.exe

C:\Windows\System\zEgitnu.exe

C:\Windows\System\zEgitnu.exe

C:\Windows\System\ZDrUnxy.exe

C:\Windows\System\ZDrUnxy.exe

C:\Windows\System\XVngAiu.exe

C:\Windows\System\XVngAiu.exe

C:\Windows\System\FJpMXiY.exe

C:\Windows\System\FJpMXiY.exe

C:\Windows\System\nFcbEbo.exe

C:\Windows\System\nFcbEbo.exe

C:\Windows\System\XPgKZhh.exe

C:\Windows\System\XPgKZhh.exe

C:\Windows\System\AeXdpPG.exe

C:\Windows\System\AeXdpPG.exe

C:\Windows\System\TBpMKsa.exe

C:\Windows\System\TBpMKsa.exe

C:\Windows\System\WRXHSHt.exe

C:\Windows\System\WRXHSHt.exe

C:\Windows\System\vtMmFcx.exe

C:\Windows\System\vtMmFcx.exe

C:\Windows\System\SQtUwGa.exe

C:\Windows\System\SQtUwGa.exe

C:\Windows\System\wPQaYmT.exe

C:\Windows\System\wPQaYmT.exe

C:\Windows\System\Mdetcoy.exe

C:\Windows\System\Mdetcoy.exe

C:\Windows\System\LMfvxcO.exe

C:\Windows\System\LMfvxcO.exe

C:\Windows\System\hbJJiwf.exe

C:\Windows\System\hbJJiwf.exe

C:\Windows\System\SKTXljH.exe

C:\Windows\System\SKTXljH.exe

C:\Windows\System\RNZyqKD.exe

C:\Windows\System\RNZyqKD.exe

C:\Windows\System\JcdzqVl.exe

C:\Windows\System\JcdzqVl.exe

C:\Windows\System\TLerHDg.exe

C:\Windows\System\TLerHDg.exe

C:\Windows\System\PLftDoZ.exe

C:\Windows\System\PLftDoZ.exe

C:\Windows\System\kmrNYPY.exe

C:\Windows\System\kmrNYPY.exe

C:\Windows\System\uadaVLT.exe

C:\Windows\System\uadaVLT.exe

C:\Windows\System\icSdfAS.exe

C:\Windows\System\icSdfAS.exe

C:\Windows\System\FuLmsoV.exe

C:\Windows\System\FuLmsoV.exe

C:\Windows\System\tRmNjnd.exe

C:\Windows\System\tRmNjnd.exe

C:\Windows\System\gqxuXve.exe

C:\Windows\System\gqxuXve.exe

C:\Windows\System\QvCzvcN.exe

C:\Windows\System\QvCzvcN.exe

C:\Windows\System\nsqBPXg.exe

C:\Windows\System\nsqBPXg.exe

C:\Windows\System\ubAyCWD.exe

C:\Windows\System\ubAyCWD.exe

C:\Windows\System\cvgqXIK.exe

C:\Windows\System\cvgqXIK.exe

C:\Windows\System\uLyWhHT.exe

C:\Windows\System\uLyWhHT.exe

C:\Windows\System\GspTAKW.exe

C:\Windows\System\GspTAKW.exe

C:\Windows\System\jrsgdPS.exe

C:\Windows\System\jrsgdPS.exe

C:\Windows\System\eIRgLFZ.exe

C:\Windows\System\eIRgLFZ.exe

C:\Windows\System\baoHEvZ.exe

C:\Windows\System\baoHEvZ.exe

C:\Windows\System\JZjInEc.exe

C:\Windows\System\JZjInEc.exe

C:\Windows\System\QMMnxGx.exe

C:\Windows\System\QMMnxGx.exe

C:\Windows\System\PACEPDF.exe

C:\Windows\System\PACEPDF.exe

C:\Windows\System\ejFUwDX.exe

C:\Windows\System\ejFUwDX.exe

C:\Windows\System\XSKkygu.exe

C:\Windows\System\XSKkygu.exe

C:\Windows\System\ncJYHXE.exe

C:\Windows\System\ncJYHXE.exe

C:\Windows\System\iAGOGYZ.exe

C:\Windows\System\iAGOGYZ.exe

C:\Windows\System\OpasFbf.exe

C:\Windows\System\OpasFbf.exe

C:\Windows\System\UOVjoAO.exe

C:\Windows\System\UOVjoAO.exe

C:\Windows\System\ABfPevk.exe

C:\Windows\System\ABfPevk.exe

C:\Windows\System\ZUQItyP.exe

C:\Windows\System\ZUQItyP.exe

C:\Windows\System\CDJpPDa.exe

C:\Windows\System\CDJpPDa.exe

C:\Windows\System\vNekqjy.exe

C:\Windows\System\vNekqjy.exe

C:\Windows\System\vFPLonN.exe

C:\Windows\System\vFPLonN.exe

C:\Windows\System\iWVbTCr.exe

C:\Windows\System\iWVbTCr.exe

C:\Windows\System\rIATxlQ.exe

C:\Windows\System\rIATxlQ.exe

C:\Windows\System\ZItEPct.exe

C:\Windows\System\ZItEPct.exe

C:\Windows\System\TBoWWhK.exe

C:\Windows\System\TBoWWhK.exe

C:\Windows\System\yBMpBQw.exe

C:\Windows\System\yBMpBQw.exe

C:\Windows\System\TQqIjto.exe

C:\Windows\System\TQqIjto.exe

C:\Windows\System\QqaaiIX.exe

C:\Windows\System\QqaaiIX.exe

C:\Windows\System\yjazPaS.exe

C:\Windows\System\yjazPaS.exe

C:\Windows\System\WjTnQeT.exe

C:\Windows\System\WjTnQeT.exe

C:\Windows\System\GJyWhPB.exe

C:\Windows\System\GJyWhPB.exe

C:\Windows\System\nXwNGSj.exe

C:\Windows\System\nXwNGSj.exe

C:\Windows\System\VnndmuP.exe

C:\Windows\System\VnndmuP.exe

C:\Windows\System\zMLxzMw.exe

C:\Windows\System\zMLxzMw.exe

C:\Windows\System\XtgfDMb.exe

C:\Windows\System\XtgfDMb.exe

C:\Windows\System\WwpZasO.exe

C:\Windows\System\WwpZasO.exe

C:\Windows\System\VTjfSSl.exe

C:\Windows\System\VTjfSSl.exe

C:\Windows\System\lUciYEf.exe

C:\Windows\System\lUciYEf.exe

C:\Windows\System\rsPWlDf.exe

C:\Windows\System\rsPWlDf.exe

C:\Windows\System\KlPNLwK.exe

C:\Windows\System\KlPNLwK.exe

C:\Windows\System\tjJIqJL.exe

C:\Windows\System\tjJIqJL.exe

C:\Windows\System\uXLkDgE.exe

C:\Windows\System\uXLkDgE.exe

C:\Windows\System\PgzPCuA.exe

C:\Windows\System\PgzPCuA.exe

C:\Windows\System\vBgnIoa.exe

C:\Windows\System\vBgnIoa.exe

C:\Windows\System\MWNBQEK.exe

C:\Windows\System\MWNBQEK.exe

C:\Windows\System\DHSBBGg.exe

C:\Windows\System\DHSBBGg.exe

C:\Windows\System\rAajQlX.exe

C:\Windows\System\rAajQlX.exe

C:\Windows\System\TkPEtGh.exe

C:\Windows\System\TkPEtGh.exe

C:\Windows\System\GYHZzRa.exe

C:\Windows\System\GYHZzRa.exe

C:\Windows\System\CLxvpgh.exe

C:\Windows\System\CLxvpgh.exe

C:\Windows\System\DJxZMcN.exe

C:\Windows\System\DJxZMcN.exe

C:\Windows\System\VVmXQrP.exe

C:\Windows\System\VVmXQrP.exe

C:\Windows\System\AgGerWo.exe

C:\Windows\System\AgGerWo.exe

C:\Windows\System\yEskEau.exe

C:\Windows\System\yEskEau.exe

C:\Windows\System\xHSynLN.exe

C:\Windows\System\xHSynLN.exe

C:\Windows\System\SCpRKDI.exe

C:\Windows\System\SCpRKDI.exe

C:\Windows\System\BXPDpUb.exe

C:\Windows\System\BXPDpUb.exe

C:\Windows\System\gcNDmAD.exe

C:\Windows\System\gcNDmAD.exe

C:\Windows\System\pyYQcOh.exe

C:\Windows\System\pyYQcOh.exe

C:\Windows\System\FfoGmji.exe

C:\Windows\System\FfoGmji.exe

C:\Windows\System\SdcHNpW.exe

C:\Windows\System\SdcHNpW.exe

C:\Windows\System\nBfpVwt.exe

C:\Windows\System\nBfpVwt.exe

C:\Windows\System\wObJvsT.exe

C:\Windows\System\wObJvsT.exe

C:\Windows\System\tyJZbLq.exe

C:\Windows\System\tyJZbLq.exe

C:\Windows\System\xlUOUwW.exe

C:\Windows\System\xlUOUwW.exe

C:\Windows\System\zZIGUrW.exe

C:\Windows\System\zZIGUrW.exe

C:\Windows\System\RnEMzzb.exe

C:\Windows\System\RnEMzzb.exe

C:\Windows\System\kzofvsS.exe

C:\Windows\System\kzofvsS.exe

C:\Windows\System\VoZmcTz.exe

C:\Windows\System\VoZmcTz.exe

C:\Windows\System\Idpratf.exe

C:\Windows\System\Idpratf.exe

C:\Windows\System\RmdiRlY.exe

C:\Windows\System\RmdiRlY.exe

C:\Windows\System\uljFHDv.exe

C:\Windows\System\uljFHDv.exe

C:\Windows\System\VrbjfzX.exe

C:\Windows\System\VrbjfzX.exe

C:\Windows\System\DzcVleg.exe

C:\Windows\System\DzcVleg.exe

C:\Windows\System\nwauTTO.exe

C:\Windows\System\nwauTTO.exe

C:\Windows\System\wSFsmoX.exe

C:\Windows\System\wSFsmoX.exe

C:\Windows\System\uIGmqEF.exe

C:\Windows\System\uIGmqEF.exe

C:\Windows\System\yFVHBWS.exe

C:\Windows\System\yFVHBWS.exe

C:\Windows\System\XJJbmSs.exe

C:\Windows\System\XJJbmSs.exe

C:\Windows\System\eAuflWh.exe

C:\Windows\System\eAuflWh.exe

C:\Windows\System\DcYQcNw.exe

C:\Windows\System\DcYQcNw.exe

C:\Windows\System\SUzCcoj.exe

C:\Windows\System\SUzCcoj.exe

C:\Windows\System\rjevcOe.exe

C:\Windows\System\rjevcOe.exe

C:\Windows\System\aezSFWd.exe

C:\Windows\System\aezSFWd.exe

C:\Windows\System\oldNluz.exe

C:\Windows\System\oldNluz.exe

C:\Windows\System\JOwlQYh.exe

C:\Windows\System\JOwlQYh.exe

C:\Windows\System\bdNYMDD.exe

C:\Windows\System\bdNYMDD.exe

C:\Windows\System\tOtfDDI.exe

C:\Windows\System\tOtfDDI.exe

C:\Windows\System\TpOGLtc.exe

C:\Windows\System\TpOGLtc.exe

C:\Windows\System\dHXswNU.exe

C:\Windows\System\dHXswNU.exe

C:\Windows\System\bDXHKcB.exe

C:\Windows\System\bDXHKcB.exe

C:\Windows\System\hTZbugO.exe

C:\Windows\System\hTZbugO.exe

C:\Windows\System\UJSUiBb.exe

C:\Windows\System\UJSUiBb.exe

C:\Windows\System\UMfUaah.exe

C:\Windows\System\UMfUaah.exe

C:\Windows\System\vzlnOfb.exe

C:\Windows\System\vzlnOfb.exe

C:\Windows\System\HqYqCwz.exe

C:\Windows\System\HqYqCwz.exe

C:\Windows\System\uxyduCz.exe

C:\Windows\System\uxyduCz.exe

C:\Windows\System\RPgcDcy.exe

C:\Windows\System\RPgcDcy.exe

C:\Windows\System\tjjcScK.exe

C:\Windows\System\tjjcScK.exe

C:\Windows\System\YxCsNxh.exe

C:\Windows\System\YxCsNxh.exe

C:\Windows\System\BNNuZkP.exe

C:\Windows\System\BNNuZkP.exe

C:\Windows\System\DYZthOW.exe

C:\Windows\System\DYZthOW.exe

C:\Windows\System\QdWedfg.exe

C:\Windows\System\QdWedfg.exe

C:\Windows\System\SUpJJfh.exe

C:\Windows\System\SUpJJfh.exe

C:\Windows\System\mZhvEpE.exe

C:\Windows\System\mZhvEpE.exe

C:\Windows\System\lgRtfUv.exe

C:\Windows\System\lgRtfUv.exe

C:\Windows\System\ttoJLiI.exe

C:\Windows\System\ttoJLiI.exe

C:\Windows\System\SpfnGqD.exe

C:\Windows\System\SpfnGqD.exe

C:\Windows\System\bZgHxaO.exe

C:\Windows\System\bZgHxaO.exe

C:\Windows\System\SukEpPo.exe

C:\Windows\System\SukEpPo.exe

C:\Windows\System\tHzxDUk.exe

C:\Windows\System\tHzxDUk.exe

C:\Windows\System\wbAUlbO.exe

C:\Windows\System\wbAUlbO.exe

C:\Windows\System\eXQbfQO.exe

C:\Windows\System\eXQbfQO.exe

C:\Windows\System\mQNfDMi.exe

C:\Windows\System\mQNfDMi.exe

C:\Windows\System\bbVbhil.exe

C:\Windows\System\bbVbhil.exe

C:\Windows\System\nfxYHwg.exe

C:\Windows\System\nfxYHwg.exe

C:\Windows\System\ANZqOqk.exe

C:\Windows\System\ANZqOqk.exe

C:\Windows\System\zzUmMtE.exe

C:\Windows\System\zzUmMtE.exe

C:\Windows\System\sSIIxXG.exe

C:\Windows\System\sSIIxXG.exe

C:\Windows\System\GvUUDPU.exe

C:\Windows\System\GvUUDPU.exe

C:\Windows\System\YtMdbrA.exe

C:\Windows\System\YtMdbrA.exe

C:\Windows\System\GdfaCFv.exe

C:\Windows\System\GdfaCFv.exe

C:\Windows\System\GllQBmn.exe

C:\Windows\System\GllQBmn.exe

C:\Windows\System\oMrchgB.exe

C:\Windows\System\oMrchgB.exe

C:\Windows\System\YTcrdMY.exe

C:\Windows\System\YTcrdMY.exe

C:\Windows\System\FQYdsHG.exe

C:\Windows\System\FQYdsHG.exe

C:\Windows\System\RvtuCAU.exe

C:\Windows\System\RvtuCAU.exe

C:\Windows\System\TbKAKQe.exe

C:\Windows\System\TbKAKQe.exe

C:\Windows\System\XzHjqUi.exe

C:\Windows\System\XzHjqUi.exe

C:\Windows\System\UqKKoBq.exe

C:\Windows\System\UqKKoBq.exe

C:\Windows\System\avFQaSN.exe

C:\Windows\System\avFQaSN.exe

C:\Windows\System\VOukdgY.exe

C:\Windows\System\VOukdgY.exe

C:\Windows\System\amzrzcz.exe

C:\Windows\System\amzrzcz.exe

C:\Windows\System\USuSZLb.exe

C:\Windows\System\USuSZLb.exe

C:\Windows\System\cwdEYXb.exe

C:\Windows\System\cwdEYXb.exe

C:\Windows\System\Hmhpqdt.exe

C:\Windows\System\Hmhpqdt.exe

C:\Windows\System\xbVICvu.exe

C:\Windows\System\xbVICvu.exe

C:\Windows\System\aAYCTOe.exe

C:\Windows\System\aAYCTOe.exe

C:\Windows\System\aCWJaQb.exe

C:\Windows\System\aCWJaQb.exe

C:\Windows\System\kSLgfba.exe

C:\Windows\System\kSLgfba.exe

C:\Windows\System\hqcIQCF.exe

C:\Windows\System\hqcIQCF.exe

C:\Windows\System\laRtquV.exe

C:\Windows\System\laRtquV.exe

C:\Windows\System\hiBlnlY.exe

C:\Windows\System\hiBlnlY.exe

C:\Windows\System\VgcloJc.exe

C:\Windows\System\VgcloJc.exe

C:\Windows\System\ELgeWhh.exe

C:\Windows\System\ELgeWhh.exe

C:\Windows\System\NyATiaf.exe

C:\Windows\System\NyATiaf.exe

C:\Windows\System\brsbXXI.exe

C:\Windows\System\brsbXXI.exe

C:\Windows\System\DWHCZbF.exe

C:\Windows\System\DWHCZbF.exe

C:\Windows\System\qPdZYQd.exe

C:\Windows\System\qPdZYQd.exe

C:\Windows\System\vxvYiYM.exe

C:\Windows\System\vxvYiYM.exe

C:\Windows\System\BRwMaZS.exe

C:\Windows\System\BRwMaZS.exe

C:\Windows\System\dKfumHf.exe

C:\Windows\System\dKfumHf.exe

C:\Windows\System\aIAMhLU.exe

C:\Windows\System\aIAMhLU.exe

C:\Windows\System\kqIkRir.exe

C:\Windows\System\kqIkRir.exe

C:\Windows\System\emYgBlv.exe

C:\Windows\System\emYgBlv.exe

C:\Windows\System\FcJRnmN.exe

C:\Windows\System\FcJRnmN.exe

C:\Windows\System\miFgbrI.exe

C:\Windows\System\miFgbrI.exe

C:\Windows\System\RJWfCEE.exe

C:\Windows\System\RJWfCEE.exe

C:\Windows\System\cjKYGPk.exe

C:\Windows\System\cjKYGPk.exe

C:\Windows\System\gguqAjl.exe

C:\Windows\System\gguqAjl.exe

C:\Windows\System\hXOrTjg.exe

C:\Windows\System\hXOrTjg.exe

C:\Windows\System\DpSxeYk.exe

C:\Windows\System\DpSxeYk.exe

C:\Windows\System\NJKiBJH.exe

C:\Windows\System\NJKiBJH.exe

C:\Windows\System\kdOQIYS.exe

C:\Windows\System\kdOQIYS.exe

C:\Windows\System\hEEFefF.exe

C:\Windows\System\hEEFefF.exe

C:\Windows\System\EFhuCRS.exe

C:\Windows\System\EFhuCRS.exe

C:\Windows\System\WYaaMLI.exe

C:\Windows\System\WYaaMLI.exe

C:\Windows\System\jUuAtmr.exe

C:\Windows\System\jUuAtmr.exe

C:\Windows\System\FSpaPwp.exe

C:\Windows\System\FSpaPwp.exe

C:\Windows\System\KAHxmEB.exe

C:\Windows\System\KAHxmEB.exe

C:\Windows\System\VLrRYBu.exe

C:\Windows\System\VLrRYBu.exe

C:\Windows\System\HxOAZle.exe

C:\Windows\System\HxOAZle.exe

C:\Windows\System\GfNUocC.exe

C:\Windows\System\GfNUocC.exe

C:\Windows\System\ktxlNqW.exe

C:\Windows\System\ktxlNqW.exe

C:\Windows\System\nMLapDk.exe

C:\Windows\System\nMLapDk.exe

C:\Windows\System\ZIXEYjj.exe

C:\Windows\System\ZIXEYjj.exe

C:\Windows\System\VeEyYhx.exe

C:\Windows\System\VeEyYhx.exe

C:\Windows\System\uWvKRNE.exe

C:\Windows\System\uWvKRNE.exe

C:\Windows\System\OhEFUGq.exe

C:\Windows\System\OhEFUGq.exe

C:\Windows\System\PybSrsQ.exe

C:\Windows\System\PybSrsQ.exe

C:\Windows\System\swhEJDj.exe

C:\Windows\System\swhEJDj.exe

C:\Windows\System\JzTejqk.exe

C:\Windows\System\JzTejqk.exe

C:\Windows\System\AfXCmUv.exe

C:\Windows\System\AfXCmUv.exe

C:\Windows\System\KzpenrH.exe

C:\Windows\System\KzpenrH.exe

C:\Windows\System\SfwRNYb.exe

C:\Windows\System\SfwRNYb.exe

C:\Windows\System\qrWZYuO.exe

C:\Windows\System\qrWZYuO.exe

C:\Windows\System\msGqHsm.exe

C:\Windows\System\msGqHsm.exe

C:\Windows\System\hNTKcfi.exe

C:\Windows\System\hNTKcfi.exe

C:\Windows\System\nbZbIXZ.exe

C:\Windows\System\nbZbIXZ.exe

C:\Windows\System\NfByclY.exe

C:\Windows\System\NfByclY.exe

C:\Windows\System\TGZGHkl.exe

C:\Windows\System\TGZGHkl.exe

C:\Windows\System\OKgFThj.exe

C:\Windows\System\OKgFThj.exe

C:\Windows\System\AtSNFrQ.exe

C:\Windows\System\AtSNFrQ.exe

C:\Windows\System\kAVRKDN.exe

C:\Windows\System\kAVRKDN.exe

C:\Windows\System\afWUSCo.exe

C:\Windows\System\afWUSCo.exe

C:\Windows\System\cwQLxGE.exe

C:\Windows\System\cwQLxGE.exe

C:\Windows\System\ZjrjslO.exe

C:\Windows\System\ZjrjslO.exe

C:\Windows\System\aKaTdkg.exe

C:\Windows\System\aKaTdkg.exe

C:\Windows\System\Uctlhid.exe

C:\Windows\System\Uctlhid.exe

C:\Windows\System\ICMckEP.exe

C:\Windows\System\ICMckEP.exe

C:\Windows\System\IPDiZgH.exe

C:\Windows\System\IPDiZgH.exe

C:\Windows\System\HrSBrbo.exe

C:\Windows\System\HrSBrbo.exe

C:\Windows\System\MctKeMx.exe

C:\Windows\System\MctKeMx.exe

C:\Windows\System\fGSaMAS.exe

C:\Windows\System\fGSaMAS.exe

C:\Windows\System\wXfgFsR.exe

C:\Windows\System\wXfgFsR.exe

C:\Windows\System\ezkgzsK.exe

C:\Windows\System\ezkgzsK.exe

C:\Windows\System\fOMKVsk.exe

C:\Windows\System\fOMKVsk.exe

C:\Windows\System\QuzumXa.exe

C:\Windows\System\QuzumXa.exe

C:\Windows\System\MCIuFzp.exe

C:\Windows\System\MCIuFzp.exe

C:\Windows\System\veXorAu.exe

C:\Windows\System\veXorAu.exe

C:\Windows\System\GchwdmI.exe

C:\Windows\System\GchwdmI.exe

C:\Windows\System\fvLveNz.exe

C:\Windows\System\fvLveNz.exe

C:\Windows\System\tzCZhvL.exe

C:\Windows\System\tzCZhvL.exe

C:\Windows\System\bNqcgKI.exe

C:\Windows\System\bNqcgKI.exe

C:\Windows\System\uDkTijs.exe

C:\Windows\System\uDkTijs.exe

C:\Windows\System\iBXgfzO.exe

C:\Windows\System\iBXgfzO.exe

C:\Windows\System\rgGuXPl.exe

C:\Windows\System\rgGuXPl.exe

C:\Windows\System\IbqmlnC.exe

C:\Windows\System\IbqmlnC.exe

C:\Windows\System\HddiREX.exe

C:\Windows\System\HddiREX.exe

C:\Windows\System\UhsAQnD.exe

C:\Windows\System\UhsAQnD.exe

C:\Windows\System\NuxrYmp.exe

C:\Windows\System\NuxrYmp.exe

C:\Windows\System\puJiilN.exe

C:\Windows\System\puJiilN.exe

C:\Windows\System\CBZAlfJ.exe

C:\Windows\System\CBZAlfJ.exe

C:\Windows\System\eMlJMhw.exe

C:\Windows\System\eMlJMhw.exe

C:\Windows\System\Hmxekbm.exe

C:\Windows\System\Hmxekbm.exe

C:\Windows\System\KMGNThN.exe

C:\Windows\System\KMGNThN.exe

C:\Windows\System\obtBpJp.exe

C:\Windows\System\obtBpJp.exe

C:\Windows\System\KyOtYuE.exe

C:\Windows\System\KyOtYuE.exe

C:\Windows\System\tqQSnVq.exe

C:\Windows\System\tqQSnVq.exe

C:\Windows\System\ImYPlzQ.exe

C:\Windows\System\ImYPlzQ.exe

C:\Windows\System\oBDJZDJ.exe

C:\Windows\System\oBDJZDJ.exe

C:\Windows\System\tbcLMhc.exe

C:\Windows\System\tbcLMhc.exe

C:\Windows\System\jQhrTVx.exe

C:\Windows\System\jQhrTVx.exe

C:\Windows\System\yysATxv.exe

C:\Windows\System\yysATxv.exe

C:\Windows\System\BpDSzal.exe

C:\Windows\System\BpDSzal.exe

C:\Windows\System\QdEOlfb.exe

C:\Windows\System\QdEOlfb.exe

C:\Windows\System\KHTMeey.exe

C:\Windows\System\KHTMeey.exe

C:\Windows\System\tlGXSHR.exe

C:\Windows\System\tlGXSHR.exe

C:\Windows\System\WusHZig.exe

C:\Windows\System\WusHZig.exe

C:\Windows\System\vbQvRgT.exe

C:\Windows\System\vbQvRgT.exe

C:\Windows\System\GKYauUl.exe

C:\Windows\System\GKYauUl.exe

C:\Windows\System\AzzFdxR.exe

C:\Windows\System\AzzFdxR.exe

C:\Windows\System\EnyJDdI.exe

C:\Windows\System\EnyJDdI.exe

C:\Windows\System\PNZZIKM.exe

C:\Windows\System\PNZZIKM.exe

C:\Windows\System\lpnSCsf.exe

C:\Windows\System\lpnSCsf.exe

C:\Windows\System\zXJnoRl.exe

C:\Windows\System\zXJnoRl.exe

C:\Windows\System\EikaqIP.exe

C:\Windows\System\EikaqIP.exe

C:\Windows\System\HwTvGPN.exe

C:\Windows\System\HwTvGPN.exe

C:\Windows\System\aFzKIjX.exe

C:\Windows\System\aFzKIjX.exe

C:\Windows\System\aHHXZzx.exe

C:\Windows\System\aHHXZzx.exe

C:\Windows\System\NLCsxFC.exe

C:\Windows\System\NLCsxFC.exe

C:\Windows\System\tGSCPpo.exe

C:\Windows\System\tGSCPpo.exe

C:\Windows\System\iFMBmmx.exe

C:\Windows\System\iFMBmmx.exe

C:\Windows\System\BGCIEUk.exe

C:\Windows\System\BGCIEUk.exe

C:\Windows\System\pYWBfsW.exe

C:\Windows\System\pYWBfsW.exe

C:\Windows\System\iCEqDtL.exe

C:\Windows\System\iCEqDtL.exe

C:\Windows\System\nUVAVfn.exe

C:\Windows\System\nUVAVfn.exe

C:\Windows\System\GBCzeCc.exe

C:\Windows\System\GBCzeCc.exe

C:\Windows\System\EDfSaFh.exe

C:\Windows\System\EDfSaFh.exe

C:\Windows\System\WjyKFHF.exe

C:\Windows\System\WjyKFHF.exe

C:\Windows\System\vlAmztZ.exe

C:\Windows\System\vlAmztZ.exe

C:\Windows\System\XbZpaGH.exe

C:\Windows\System\XbZpaGH.exe

C:\Windows\System\AXAxyUj.exe

C:\Windows\System\AXAxyUj.exe

C:\Windows\System\WsJGxvA.exe

C:\Windows\System\WsJGxvA.exe

C:\Windows\System\xPYFdYZ.exe

C:\Windows\System\xPYFdYZ.exe

C:\Windows\System\kIVYaLC.exe

C:\Windows\System\kIVYaLC.exe

C:\Windows\System\QudDruV.exe

C:\Windows\System\QudDruV.exe

C:\Windows\System\NKYhibn.exe

C:\Windows\System\NKYhibn.exe

C:\Windows\System\AKJPIOw.exe

C:\Windows\System\AKJPIOw.exe

C:\Windows\System\FBjQIUM.exe

C:\Windows\System\FBjQIUM.exe

C:\Windows\System\nUPmHgg.exe

C:\Windows\System\nUPmHgg.exe

C:\Windows\System\cXtHPSw.exe

C:\Windows\System\cXtHPSw.exe

C:\Windows\System\DVQKRLd.exe

C:\Windows\System\DVQKRLd.exe

C:\Windows\System\HIDUOTx.exe

C:\Windows\System\HIDUOTx.exe

C:\Windows\System\fElGNnu.exe

C:\Windows\System\fElGNnu.exe

C:\Windows\System\eArEzyj.exe

C:\Windows\System\eArEzyj.exe

C:\Windows\System\wKRxJGw.exe

C:\Windows\System\wKRxJGw.exe

C:\Windows\System\eRMxHaW.exe

C:\Windows\System\eRMxHaW.exe

C:\Windows\System\NDqtVOy.exe

C:\Windows\System\NDqtVOy.exe

C:\Windows\System\HtQUEvE.exe

C:\Windows\System\HtQUEvE.exe

C:\Windows\System\zYjhCVs.exe

C:\Windows\System\zYjhCVs.exe

C:\Windows\System\kjNXTNp.exe

C:\Windows\System\kjNXTNp.exe

C:\Windows\System\IktJOSw.exe

C:\Windows\System\IktJOSw.exe

C:\Windows\System\JuvkSBS.exe

C:\Windows\System\JuvkSBS.exe

C:\Windows\System\YjrBell.exe

C:\Windows\System\YjrBell.exe

C:\Windows\System\sPwrqwA.exe

C:\Windows\System\sPwrqwA.exe

C:\Windows\System\oahaizq.exe

C:\Windows\System\oahaizq.exe

C:\Windows\System\YOpAcoe.exe

C:\Windows\System\YOpAcoe.exe

C:\Windows\System\LMfNihL.exe

C:\Windows\System\LMfNihL.exe

C:\Windows\System\aqkBPlu.exe

C:\Windows\System\aqkBPlu.exe

C:\Windows\System\ySrOxjV.exe

C:\Windows\System\ySrOxjV.exe

C:\Windows\System\DTNjElo.exe

C:\Windows\System\DTNjElo.exe

C:\Windows\System\bxSvKQj.exe

C:\Windows\System\bxSvKQj.exe

C:\Windows\System\vzwiIeA.exe

C:\Windows\System\vzwiIeA.exe

C:\Windows\System\CZKfkAs.exe

C:\Windows\System\CZKfkAs.exe

C:\Windows\System\UoXcSAm.exe

C:\Windows\System\UoXcSAm.exe

C:\Windows\System\HSgRXne.exe

C:\Windows\System\HSgRXne.exe

C:\Windows\System\waGifxV.exe

C:\Windows\System\waGifxV.exe

C:\Windows\System\CnmVuxq.exe

C:\Windows\System\CnmVuxq.exe

C:\Windows\System\GKdyBHW.exe

C:\Windows\System\GKdyBHW.exe

C:\Windows\System\DkgPjQJ.exe

C:\Windows\System\DkgPjQJ.exe

C:\Windows\System\UAztAeX.exe

C:\Windows\System\UAztAeX.exe

C:\Windows\System\tXmCoBg.exe

C:\Windows\System\tXmCoBg.exe

C:\Windows\System\hhGWRJn.exe

C:\Windows\System\hhGWRJn.exe

C:\Windows\System\GtDrUZj.exe

C:\Windows\System\GtDrUZj.exe

C:\Windows\System\Vvginme.exe

C:\Windows\System\Vvginme.exe

C:\Windows\System\tOZRHlR.exe

C:\Windows\System\tOZRHlR.exe

C:\Windows\System\wUKJWWP.exe

C:\Windows\System\wUKJWWP.exe

C:\Windows\System\uRzChdS.exe

C:\Windows\System\uRzChdS.exe

C:\Windows\System\XfsMdeA.exe

C:\Windows\System\XfsMdeA.exe

C:\Windows\System\BTDyQRa.exe

C:\Windows\System\BTDyQRa.exe

C:\Windows\System\NbUzYrX.exe

C:\Windows\System\NbUzYrX.exe

C:\Windows\System\RbaofII.exe

C:\Windows\System\RbaofII.exe

C:\Windows\System\uKBkBYD.exe

C:\Windows\System\uKBkBYD.exe

C:\Windows\System\XiCwcbZ.exe

C:\Windows\System\XiCwcbZ.exe

C:\Windows\System\zLMuooc.exe

C:\Windows\System\zLMuooc.exe

C:\Windows\System\hWRjmhZ.exe

C:\Windows\System\hWRjmhZ.exe

C:\Windows\System\exXfZal.exe

C:\Windows\System\exXfZal.exe

C:\Windows\System\fzxcFon.exe

C:\Windows\System\fzxcFon.exe

C:\Windows\System\LdRWSeD.exe

C:\Windows\System\LdRWSeD.exe

C:\Windows\System\MWzlNqI.exe

C:\Windows\System\MWzlNqI.exe

C:\Windows\System\bbsYKwT.exe

C:\Windows\System\bbsYKwT.exe

C:\Windows\System\JIrtjqw.exe

C:\Windows\System\JIrtjqw.exe

C:\Windows\System\mijHFRr.exe

C:\Windows\System\mijHFRr.exe

C:\Windows\System\nyPpmiQ.exe

C:\Windows\System\nyPpmiQ.exe

C:\Windows\System\blswXfv.exe

C:\Windows\System\blswXfv.exe

C:\Windows\System\JrMBVzp.exe

C:\Windows\System\JrMBVzp.exe

C:\Windows\System\dwPXQOV.exe

C:\Windows\System\dwPXQOV.exe

C:\Windows\System\BDVpqKl.exe

C:\Windows\System\BDVpqKl.exe

C:\Windows\System\OXyxnnL.exe

C:\Windows\System\OXyxnnL.exe

C:\Windows\System\jdHiASb.exe

C:\Windows\System\jdHiASb.exe

C:\Windows\System\hPhVksW.exe

C:\Windows\System\hPhVksW.exe

C:\Windows\System\dHoqmcQ.exe

C:\Windows\System\dHoqmcQ.exe

C:\Windows\System\QKJyquA.exe

C:\Windows\System\QKJyquA.exe

C:\Windows\System\awhdnHX.exe

C:\Windows\System\awhdnHX.exe

C:\Windows\System\xFgvuBS.exe

C:\Windows\System\xFgvuBS.exe

C:\Windows\System\YdDkmGU.exe

C:\Windows\System\YdDkmGU.exe

C:\Windows\System\PsVTUOb.exe

C:\Windows\System\PsVTUOb.exe

C:\Windows\System\iMpJxfN.exe

C:\Windows\System\iMpJxfN.exe

C:\Windows\System\rlabtlU.exe

C:\Windows\System\rlabtlU.exe

C:\Windows\System\nKZLwZd.exe

C:\Windows\System\nKZLwZd.exe

C:\Windows\System\LpXIKMS.exe

C:\Windows\System\LpXIKMS.exe

C:\Windows\System\UBRKTVU.exe

C:\Windows\System\UBRKTVU.exe

C:\Windows\System\pXnkGnS.exe

C:\Windows\System\pXnkGnS.exe

C:\Windows\System\xAoqyJk.exe

C:\Windows\System\xAoqyJk.exe

C:\Windows\System\dVnIsCv.exe

C:\Windows\System\dVnIsCv.exe

C:\Windows\System\uzxBbhv.exe

C:\Windows\System\uzxBbhv.exe

C:\Windows\System\AURNpOe.exe

C:\Windows\System\AURNpOe.exe

C:\Windows\System\wiWLUVx.exe

C:\Windows\System\wiWLUVx.exe

C:\Windows\System\hReNwgg.exe

C:\Windows\System\hReNwgg.exe

C:\Windows\System\nYDwJge.exe

C:\Windows\System\nYDwJge.exe

C:\Windows\System\jCUxxDL.exe

C:\Windows\System\jCUxxDL.exe

C:\Windows\System\GetOddR.exe

C:\Windows\System\GetOddR.exe

C:\Windows\System\eBTPOCC.exe

C:\Windows\System\eBTPOCC.exe

C:\Windows\System\iUarDPO.exe

C:\Windows\System\iUarDPO.exe

C:\Windows\System\DkkSxLa.exe

C:\Windows\System\DkkSxLa.exe

C:\Windows\System\hbyPXjA.exe

C:\Windows\System\hbyPXjA.exe

C:\Windows\System\AkvNPcV.exe

C:\Windows\System\AkvNPcV.exe

C:\Windows\System\WuPUDxA.exe

C:\Windows\System\WuPUDxA.exe

C:\Windows\System\DrRdivq.exe

C:\Windows\System\DrRdivq.exe

C:\Windows\System\GBbjwEt.exe

C:\Windows\System\GBbjwEt.exe

C:\Windows\System\SdCzWRe.exe

C:\Windows\System\SdCzWRe.exe

C:\Windows\System\PKtktaM.exe

C:\Windows\System\PKtktaM.exe

C:\Windows\System\gqDOBRW.exe

C:\Windows\System\gqDOBRW.exe

C:\Windows\System\ochlGyo.exe

C:\Windows\System\ochlGyo.exe

C:\Windows\System\hvHNuHF.exe

C:\Windows\System\hvHNuHF.exe

C:\Windows\System\CGPhJdj.exe

C:\Windows\System\CGPhJdj.exe

C:\Windows\System\MsGzrGu.exe

C:\Windows\System\MsGzrGu.exe

C:\Windows\System\loOBSdq.exe

C:\Windows\System\loOBSdq.exe

C:\Windows\System\kUaqlea.exe

C:\Windows\System\kUaqlea.exe

C:\Windows\System\MQfffsf.exe

C:\Windows\System\MQfffsf.exe

C:\Windows\System\tfjXogD.exe

C:\Windows\System\tfjXogD.exe

C:\Windows\System\QKUiPmM.exe

C:\Windows\System\QKUiPmM.exe

C:\Windows\System\mAhHrFR.exe

C:\Windows\System\mAhHrFR.exe

C:\Windows\System\SGrpBpy.exe

C:\Windows\System\SGrpBpy.exe

C:\Windows\System\nFdXgzV.exe

C:\Windows\System\nFdXgzV.exe

C:\Windows\System\PRBDrIz.exe

C:\Windows\System\PRBDrIz.exe

C:\Windows\System\oDykXiB.exe

C:\Windows\System\oDykXiB.exe

C:\Windows\System\nxukkcl.exe

C:\Windows\System\nxukkcl.exe

C:\Windows\System\MxmQZil.exe

C:\Windows\System\MxmQZil.exe

C:\Windows\System\qcLApIh.exe

C:\Windows\System\qcLApIh.exe

C:\Windows\System\TlnzrCM.exe

C:\Windows\System\TlnzrCM.exe

C:\Windows\System\zByleJX.exe

C:\Windows\System\zByleJX.exe

C:\Windows\System\snVtnbn.exe

C:\Windows\System\snVtnbn.exe

C:\Windows\System\VlFKmzr.exe

C:\Windows\System\VlFKmzr.exe

C:\Windows\System\CIdgsrN.exe

C:\Windows\System\CIdgsrN.exe

C:\Windows\System\NsrVsNs.exe

C:\Windows\System\NsrVsNs.exe

C:\Windows\System\aKUdfyw.exe

C:\Windows\System\aKUdfyw.exe

C:\Windows\System\TNgGGnz.exe

C:\Windows\System\TNgGGnz.exe

C:\Windows\System\NyvEFap.exe

C:\Windows\System\NyvEFap.exe

C:\Windows\System\vadgWGq.exe

C:\Windows\System\vadgWGq.exe

C:\Windows\System\BWzLaGa.exe

C:\Windows\System\BWzLaGa.exe

C:\Windows\System\LPyjfqv.exe

C:\Windows\System\LPyjfqv.exe

C:\Windows\System\UElWPYo.exe

C:\Windows\System\UElWPYo.exe

C:\Windows\System\dfuCKIG.exe

C:\Windows\System\dfuCKIG.exe

C:\Windows\System\fTWmwDH.exe

C:\Windows\System\fTWmwDH.exe

C:\Windows\System\vpcYmGi.exe

C:\Windows\System\vpcYmGi.exe

C:\Windows\System\ZkHQZWi.exe

C:\Windows\System\ZkHQZWi.exe

C:\Windows\System\HuwTSDG.exe

C:\Windows\System\HuwTSDG.exe

C:\Windows\System\mGkGMAc.exe

C:\Windows\System\mGkGMAc.exe

C:\Windows\System\gAevzOc.exe

C:\Windows\System\gAevzOc.exe

C:\Windows\System\MeQtlQG.exe

C:\Windows\System\MeQtlQG.exe

C:\Windows\System\lVRmhgy.exe

C:\Windows\System\lVRmhgy.exe

C:\Windows\System\valHbfP.exe

C:\Windows\System\valHbfP.exe

C:\Windows\System\QwvsmIt.exe

C:\Windows\System\QwvsmIt.exe

C:\Windows\System\nawjCMc.exe

C:\Windows\System\nawjCMc.exe

C:\Windows\System\MBaPDvB.exe

C:\Windows\System\MBaPDvB.exe

C:\Windows\System\PkTXkgs.exe

C:\Windows\System\PkTXkgs.exe

C:\Windows\System\qNFgawK.exe

C:\Windows\System\qNFgawK.exe

C:\Windows\System\OpuHUcR.exe

C:\Windows\System\OpuHUcR.exe

C:\Windows\System\Aawexfc.exe

C:\Windows\System\Aawexfc.exe

C:\Windows\System\XxDEExB.exe

C:\Windows\System\XxDEExB.exe

C:\Windows\System\pMXngIB.exe

C:\Windows\System\pMXngIB.exe

C:\Windows\System\ImQzCTm.exe

C:\Windows\System\ImQzCTm.exe

C:\Windows\System\LJKpgsi.exe

C:\Windows\System\LJKpgsi.exe

C:\Windows\System\SwAuqul.exe

C:\Windows\System\SwAuqul.exe

C:\Windows\System\YpHZwTc.exe

C:\Windows\System\YpHZwTc.exe

C:\Windows\System\zvkJnzu.exe

C:\Windows\System\zvkJnzu.exe

C:\Windows\System\dvzqoxK.exe

C:\Windows\System\dvzqoxK.exe

C:\Windows\System\Gqjabal.exe

C:\Windows\System\Gqjabal.exe

C:\Windows\System\DLguTSw.exe

C:\Windows\System\DLguTSw.exe

C:\Windows\System\sZVaYEk.exe

C:\Windows\System\sZVaYEk.exe

C:\Windows\System\OeGYvRT.exe

C:\Windows\System\OeGYvRT.exe

C:\Windows\System\DZchOyX.exe

C:\Windows\System\DZchOyX.exe

C:\Windows\System\ozlDuny.exe

C:\Windows\System\ozlDuny.exe

C:\Windows\System\BFDfjiC.exe

C:\Windows\System\BFDfjiC.exe

C:\Windows\System\yIfsxFJ.exe

C:\Windows\System\yIfsxFJ.exe

C:\Windows\System\wmgkDKX.exe

C:\Windows\System\wmgkDKX.exe

C:\Windows\System\WyBiXEi.exe

C:\Windows\System\WyBiXEi.exe

C:\Windows\System\OnyvNPu.exe

C:\Windows\System\OnyvNPu.exe

C:\Windows\System\eItfJki.exe

C:\Windows\System\eItfJki.exe

C:\Windows\System\IWzvUfK.exe

C:\Windows\System\IWzvUfK.exe

C:\Windows\System\CMBFyKP.exe

C:\Windows\System\CMBFyKP.exe

C:\Windows\System\bvfqZnm.exe

C:\Windows\System\bvfqZnm.exe

C:\Windows\System\pLESwYK.exe

C:\Windows\System\pLESwYK.exe

C:\Windows\System\AfsZbZE.exe

C:\Windows\System\AfsZbZE.exe

C:\Windows\System\DtXZMXy.exe

C:\Windows\System\DtXZMXy.exe

C:\Windows\System\bUTfluX.exe

C:\Windows\System\bUTfluX.exe

C:\Windows\System\NblPwmB.exe

C:\Windows\System\NblPwmB.exe

C:\Windows\System\iRIhmcT.exe

C:\Windows\System\iRIhmcT.exe

C:\Windows\System\bLDTktw.exe

C:\Windows\System\bLDTktw.exe

C:\Windows\System\tyXXQXn.exe

C:\Windows\System\tyXXQXn.exe

C:\Windows\System\ZVdGIyq.exe

C:\Windows\System\ZVdGIyq.exe

C:\Windows\System\QyALGyQ.exe

C:\Windows\System\QyALGyQ.exe

C:\Windows\System\TZTkiMY.exe

C:\Windows\System\TZTkiMY.exe

C:\Windows\System\iQqptQx.exe

C:\Windows\System\iQqptQx.exe

C:\Windows\System\fNUqWGW.exe

C:\Windows\System\fNUqWGW.exe

C:\Windows\System\yiBDDkG.exe

C:\Windows\System\yiBDDkG.exe

C:\Windows\System\UHTpzub.exe

C:\Windows\System\UHTpzub.exe

C:\Windows\System\BnifUOj.exe

C:\Windows\System\BnifUOj.exe

C:\Windows\System\vZCOXSu.exe

C:\Windows\System\vZCOXSu.exe

C:\Windows\System\TBZjJZS.exe

C:\Windows\System\TBZjJZS.exe

C:\Windows\System\gCiDGYF.exe

C:\Windows\System\gCiDGYF.exe

C:\Windows\System\fTVWTLV.exe

C:\Windows\System\fTVWTLV.exe

C:\Windows\System\hXBtuAT.exe

C:\Windows\System\hXBtuAT.exe

C:\Windows\System\NupqOlS.exe

C:\Windows\System\NupqOlS.exe

C:\Windows\System\AcSNdgO.exe

C:\Windows\System\AcSNdgO.exe

C:\Windows\System\LctamsR.exe

C:\Windows\System\LctamsR.exe

C:\Windows\System\ddgTsAT.exe

C:\Windows\System\ddgTsAT.exe

C:\Windows\System\JwfYrlO.exe

C:\Windows\System\JwfYrlO.exe

C:\Windows\System\JzjEBNJ.exe

C:\Windows\System\JzjEBNJ.exe

C:\Windows\System\kpxMENd.exe

C:\Windows\System\kpxMENd.exe

C:\Windows\System\wzVYnqF.exe

C:\Windows\System\wzVYnqF.exe

C:\Windows\System\QxWAgTt.exe

C:\Windows\System\QxWAgTt.exe

C:\Windows\System\LsYHIRS.exe

C:\Windows\System\LsYHIRS.exe

C:\Windows\System\pDxmkvn.exe

C:\Windows\System\pDxmkvn.exe

C:\Windows\System\dGcnjco.exe

C:\Windows\System\dGcnjco.exe

C:\Windows\System\xYrgGeX.exe

C:\Windows\System\xYrgGeX.exe

C:\Windows\System\xNXFebZ.exe

C:\Windows\System\xNXFebZ.exe

C:\Windows\System\OmVAfTL.exe

C:\Windows\System\OmVAfTL.exe

C:\Windows\System\YDFaqeW.exe

C:\Windows\System\YDFaqeW.exe

C:\Windows\System\HDNJYEt.exe

C:\Windows\System\HDNJYEt.exe

C:\Windows\System\SJpnrhC.exe

C:\Windows\System\SJpnrhC.exe

C:\Windows\System\JHiOqRr.exe

C:\Windows\System\JHiOqRr.exe

C:\Windows\System\wmvgUGK.exe

C:\Windows\System\wmvgUGK.exe

C:\Windows\System\kfxPkaF.exe

C:\Windows\System\kfxPkaF.exe

C:\Windows\System\qzijbfU.exe

C:\Windows\System\qzijbfU.exe

C:\Windows\System\bQqnYoO.exe

C:\Windows\System\bQqnYoO.exe

C:\Windows\System\rwHatRd.exe

C:\Windows\System\rwHatRd.exe

C:\Windows\System\OIlGBJW.exe

C:\Windows\System\OIlGBJW.exe

C:\Windows\System\EANEszp.exe

C:\Windows\System\EANEszp.exe

C:\Windows\System\VbvWXsq.exe

C:\Windows\System\VbvWXsq.exe

C:\Windows\System\vmcFrBG.exe

C:\Windows\System\vmcFrBG.exe

C:\Windows\System\zbZAdYq.exe

C:\Windows\System\zbZAdYq.exe

C:\Windows\System\aubpeNU.exe

C:\Windows\System\aubpeNU.exe

C:\Windows\System\CvIMIOh.exe

C:\Windows\System\CvIMIOh.exe

C:\Windows\System\eMmLPCW.exe

C:\Windows\System\eMmLPCW.exe

C:\Windows\System\nsQoHCn.exe

C:\Windows\System\nsQoHCn.exe

C:\Windows\System\gpotgAY.exe

C:\Windows\System\gpotgAY.exe

C:\Windows\System\AwKrzjj.exe

C:\Windows\System\AwKrzjj.exe

C:\Windows\System\rLJKqiS.exe

C:\Windows\System\rLJKqiS.exe

C:\Windows\System\WfULtoi.exe

C:\Windows\System\WfULtoi.exe

C:\Windows\System\sKCOUXl.exe

C:\Windows\System\sKCOUXl.exe

C:\Windows\System\FjCtBkM.exe

C:\Windows\System\FjCtBkM.exe

C:\Windows\System\sTkUHwU.exe

C:\Windows\System\sTkUHwU.exe

C:\Windows\System\YSqbEgc.exe

C:\Windows\System\YSqbEgc.exe

C:\Windows\System\aUXZKCl.exe

C:\Windows\System\aUXZKCl.exe

C:\Windows\System\KlRUHEW.exe

C:\Windows\System\KlRUHEW.exe

C:\Windows\System\tmxuyfH.exe

C:\Windows\System\tmxuyfH.exe

C:\Windows\System\yaUxijA.exe

C:\Windows\System\yaUxijA.exe

C:\Windows\System\qnPjzMo.exe

C:\Windows\System\qnPjzMo.exe

C:\Windows\System\nAwVoKn.exe

C:\Windows\System\nAwVoKn.exe

C:\Windows\System\TWtgzrf.exe

C:\Windows\System\TWtgzrf.exe

C:\Windows\System\CXpHEgk.exe

C:\Windows\System\CXpHEgk.exe

C:\Windows\System\OaFVBVn.exe

C:\Windows\System\OaFVBVn.exe

C:\Windows\System\QbHpglk.exe

C:\Windows\System\QbHpglk.exe

C:\Windows\System\HkEhlrJ.exe

C:\Windows\System\HkEhlrJ.exe

C:\Windows\System\GwWfEMp.exe

C:\Windows\System\GwWfEMp.exe

C:\Windows\System\IHAPCjH.exe

C:\Windows\System\IHAPCjH.exe

C:\Windows\System\PMyLoAz.exe

C:\Windows\System\PMyLoAz.exe

C:\Windows\System\fnsxUCS.exe

C:\Windows\System\fnsxUCS.exe

C:\Windows\System\AvElhyN.exe

C:\Windows\System\AvElhyN.exe

C:\Windows\System\BycBtnZ.exe

C:\Windows\System\BycBtnZ.exe

C:\Windows\System\ZYqGfBw.exe

C:\Windows\System\ZYqGfBw.exe

C:\Windows\System\YOBsFim.exe

C:\Windows\System\YOBsFim.exe

C:\Windows\System\wUlHXCt.exe

C:\Windows\System\wUlHXCt.exe

C:\Windows\System\hJinUST.exe

C:\Windows\System\hJinUST.exe

C:\Windows\System\ylfMXai.exe

C:\Windows\System\ylfMXai.exe

C:\Windows\System\wtNOFzD.exe

C:\Windows\System\wtNOFzD.exe

C:\Windows\System\GNpttZa.exe

C:\Windows\System\GNpttZa.exe

C:\Windows\System\sQeZjor.exe

C:\Windows\System\sQeZjor.exe

C:\Windows\System\flvRTpN.exe

C:\Windows\System\flvRTpN.exe

C:\Windows\System\gAypnSq.exe

C:\Windows\System\gAypnSq.exe

C:\Windows\System\tsTgkgW.exe

C:\Windows\System\tsTgkgW.exe

C:\Windows\System\QSSAXDq.exe

C:\Windows\System\QSSAXDq.exe

C:\Windows\System\fTmBMFa.exe

C:\Windows\System\fTmBMFa.exe

C:\Windows\System\iFHtvWX.exe

C:\Windows\System\iFHtvWX.exe

C:\Windows\System\neqFHXF.exe

C:\Windows\System\neqFHXF.exe

C:\Windows\System\QAaYulN.exe

C:\Windows\System\QAaYulN.exe

C:\Windows\System\ftoyqSl.exe

C:\Windows\System\ftoyqSl.exe

C:\Windows\System\RCnqBiE.exe

C:\Windows\System\RCnqBiE.exe

C:\Windows\System\KpJTiUd.exe

C:\Windows\System\KpJTiUd.exe

C:\Windows\System\SEwAVWN.exe

C:\Windows\System\SEwAVWN.exe

C:\Windows\System\bLKaAkn.exe

C:\Windows\System\bLKaAkn.exe

C:\Windows\System\JItFrlK.exe

C:\Windows\System\JItFrlK.exe

C:\Windows\System\rUJnSBm.exe

C:\Windows\System\rUJnSBm.exe

C:\Windows\System\kyBORXD.exe

C:\Windows\System\kyBORXD.exe

C:\Windows\System\LDZkPrM.exe

C:\Windows\System\LDZkPrM.exe

C:\Windows\System\iRuYTgm.exe

C:\Windows\System\iRuYTgm.exe

C:\Windows\System\rhmEEtm.exe

C:\Windows\System\rhmEEtm.exe

C:\Windows\System\gJKJYHL.exe

C:\Windows\System\gJKJYHL.exe

C:\Windows\System\zabgnvf.exe

C:\Windows\System\zabgnvf.exe

C:\Windows\System\UdiJESA.exe

C:\Windows\System\UdiJESA.exe

C:\Windows\System\fvoVnNm.exe

C:\Windows\System\fvoVnNm.exe

C:\Windows\System\LSCwgZY.exe

C:\Windows\System\LSCwgZY.exe

C:\Windows\System\rVXydlW.exe

C:\Windows\System\rVXydlW.exe

C:\Windows\System\DtBueUB.exe

C:\Windows\System\DtBueUB.exe

C:\Windows\System\GRnCUIg.exe

C:\Windows\System\GRnCUIg.exe

C:\Windows\System\OmESjVQ.exe

C:\Windows\System\OmESjVQ.exe

C:\Windows\System\nMVjSKP.exe

C:\Windows\System\nMVjSKP.exe

C:\Windows\System\PwnSNHw.exe

C:\Windows\System\PwnSNHw.exe

C:\Windows\System\IZCWUZL.exe

C:\Windows\System\IZCWUZL.exe

C:\Windows\System\XcZDioP.exe

C:\Windows\System\XcZDioP.exe

C:\Windows\System\sUTOywr.exe

C:\Windows\System\sUTOywr.exe

C:\Windows\System\cRDNjdq.exe

C:\Windows\System\cRDNjdq.exe

C:\Windows\System\AQInYtr.exe

C:\Windows\System\AQInYtr.exe

C:\Windows\System\nFBeDeW.exe

C:\Windows\System\nFBeDeW.exe

C:\Windows\System\SqZIJUP.exe

C:\Windows\System\SqZIJUP.exe

C:\Windows\System\igBgFYG.exe

C:\Windows\System\igBgFYG.exe

C:\Windows\System\ZQbWOyf.exe

C:\Windows\System\ZQbWOyf.exe

C:\Windows\System\VEVDOMl.exe

C:\Windows\System\VEVDOMl.exe

C:\Windows\System\boMScRV.exe

C:\Windows\System\boMScRV.exe

C:\Windows\System\owajkcq.exe

C:\Windows\System\owajkcq.exe

C:\Windows\System\KqEyKcs.exe

C:\Windows\System\KqEyKcs.exe

C:\Windows\System\OHBUWVq.exe

C:\Windows\System\OHBUWVq.exe

C:\Windows\System\mhlTgso.exe

C:\Windows\System\mhlTgso.exe

C:\Windows\System\nkykjIi.exe

C:\Windows\System\nkykjIi.exe

C:\Windows\System\mnUwEFo.exe

C:\Windows\System\mnUwEFo.exe

C:\Windows\System\ItXPvjj.exe

C:\Windows\System\ItXPvjj.exe

C:\Windows\System\fGsnqbN.exe

C:\Windows\System\fGsnqbN.exe

C:\Windows\System\rwONqeO.exe

C:\Windows\System\rwONqeO.exe

C:\Windows\System\LOHIfor.exe

C:\Windows\System\LOHIfor.exe

C:\Windows\System\TEDJhXi.exe

C:\Windows\System\TEDJhXi.exe

C:\Windows\System\TwpffGz.exe

C:\Windows\System\TwpffGz.exe

C:\Windows\System\UHFAljx.exe

C:\Windows\System\UHFAljx.exe

C:\Windows\System\bbchyvr.exe

C:\Windows\System\bbchyvr.exe

C:\Windows\System\VxtSQLF.exe

C:\Windows\System\VxtSQLF.exe

C:\Windows\System\ejHzFgO.exe

C:\Windows\System\ejHzFgO.exe

C:\Windows\System\UzUExPT.exe

C:\Windows\System\UzUExPT.exe

C:\Windows\System\rsRZuln.exe

C:\Windows\System\rsRZuln.exe

C:\Windows\System\wzcCpbY.exe

C:\Windows\System\wzcCpbY.exe

C:\Windows\System\ECBEGXp.exe

C:\Windows\System\ECBEGXp.exe

C:\Windows\System\MmImnDM.exe

C:\Windows\System\MmImnDM.exe

C:\Windows\System\DpJbvQC.exe

C:\Windows\System\DpJbvQC.exe

C:\Windows\System\GtimKHl.exe

C:\Windows\System\GtimKHl.exe

C:\Windows\System\XpicPSZ.exe

C:\Windows\System\XpicPSZ.exe

C:\Windows\System\KLnUTbe.exe

C:\Windows\System\KLnUTbe.exe

C:\Windows\System\bVbgBGj.exe

C:\Windows\System\bVbgBGj.exe

C:\Windows\System\bLcvXSc.exe

C:\Windows\System\bLcvXSc.exe

C:\Windows\System\PdLLRog.exe

C:\Windows\System\PdLLRog.exe

C:\Windows\System\QdTpJqR.exe

C:\Windows\System\QdTpJqR.exe

C:\Windows\System\WVrVxuC.exe

C:\Windows\System\WVrVxuC.exe

C:\Windows\System\EUMCJgi.exe

C:\Windows\System\EUMCJgi.exe

C:\Windows\System\WeBFyJG.exe

C:\Windows\System\WeBFyJG.exe

C:\Windows\System\LjCRLWi.exe

C:\Windows\System\LjCRLWi.exe

C:\Windows\System\SvrGqfV.exe

C:\Windows\System\SvrGqfV.exe

C:\Windows\System\sxPjGFE.exe

C:\Windows\System\sxPjGFE.exe

C:\Windows\System\bvvIiCC.exe

C:\Windows\System\bvvIiCC.exe

C:\Windows\System\nSnLHAe.exe

C:\Windows\System\nSnLHAe.exe

C:\Windows\System\bXezope.exe

C:\Windows\System\bXezope.exe

C:\Windows\System\FycEPUW.exe

C:\Windows\System\FycEPUW.exe

C:\Windows\System\bVwxeBw.exe

C:\Windows\System\bVwxeBw.exe

C:\Windows\System\UBYYPgE.exe

C:\Windows\System\UBYYPgE.exe

C:\Windows\System\FHraNWx.exe

C:\Windows\System\FHraNWx.exe

C:\Windows\System\npgjgft.exe

C:\Windows\System\npgjgft.exe

C:\Windows\System\ffMzHcl.exe

C:\Windows\System\ffMzHcl.exe

C:\Windows\System\dQuHCHT.exe

C:\Windows\System\dQuHCHT.exe

C:\Windows\System\EjFjfYC.exe

C:\Windows\System\EjFjfYC.exe

C:\Windows\System\xVGqxZM.exe

C:\Windows\System\xVGqxZM.exe

C:\Windows\System\VqlVWWA.exe

C:\Windows\System\VqlVWWA.exe

C:\Windows\System\OYKsOAV.exe

C:\Windows\System\OYKsOAV.exe

C:\Windows\System\tiRyfTV.exe

C:\Windows\System\tiRyfTV.exe

C:\Windows\System\WYWKnET.exe

C:\Windows\System\WYWKnET.exe

C:\Windows\System\TuHjggC.exe

C:\Windows\System\TuHjggC.exe

C:\Windows\System\NOHjSNC.exe

C:\Windows\System\NOHjSNC.exe

C:\Windows\System\ShqLihq.exe

C:\Windows\System\ShqLihq.exe

C:\Windows\System\lnLmOxB.exe

C:\Windows\System\lnLmOxB.exe

C:\Windows\System\NHRDzAH.exe

C:\Windows\System\NHRDzAH.exe

C:\Windows\System\jsAhFjr.exe

C:\Windows\System\jsAhFjr.exe

C:\Windows\System\HNwMPza.exe

C:\Windows\System\HNwMPza.exe

C:\Windows\System\vdJNEwY.exe

C:\Windows\System\vdJNEwY.exe

C:\Windows\System\yuodyCA.exe

C:\Windows\System\yuodyCA.exe

C:\Windows\System\IAgDFMk.exe

C:\Windows\System\IAgDFMk.exe

C:\Windows\System\GUJzfLN.exe

C:\Windows\System\GUJzfLN.exe

C:\Windows\System\KAbGkLz.exe

C:\Windows\System\KAbGkLz.exe

C:\Windows\System\MClXATY.exe

C:\Windows\System\MClXATY.exe

C:\Windows\System\qTfpjDn.exe

C:\Windows\System\qTfpjDn.exe

C:\Windows\System\JFPoziz.exe

C:\Windows\System\JFPoziz.exe

C:\Windows\System\CxVQajT.exe

C:\Windows\System\CxVQajT.exe

C:\Windows\System\XClqkvc.exe

C:\Windows\System\XClqkvc.exe

C:\Windows\System\XnUojCM.exe

C:\Windows\System\XnUojCM.exe

C:\Windows\System\bFMISek.exe

C:\Windows\System\bFMISek.exe

C:\Windows\System\YrQXanN.exe

C:\Windows\System\YrQXanN.exe

C:\Windows\System\nnOHjVi.exe

C:\Windows\System\nnOHjVi.exe

C:\Windows\System\dMICgPg.exe

C:\Windows\System\dMICgPg.exe

C:\Windows\System\TnErvCn.exe

C:\Windows\System\TnErvCn.exe

C:\Windows\System\FvknOuE.exe

C:\Windows\System\FvknOuE.exe

C:\Windows\System\asLsXKl.exe

C:\Windows\System\asLsXKl.exe

C:\Windows\System\qxRmsMT.exe

C:\Windows\System\qxRmsMT.exe

C:\Windows\System\bAdBGsp.exe

C:\Windows\System\bAdBGsp.exe

C:\Windows\System\kABsoIK.exe

C:\Windows\System\kABsoIK.exe

C:\Windows\System\vcJwGTe.exe

C:\Windows\System\vcJwGTe.exe

C:\Windows\System\aYCMRXu.exe

C:\Windows\System\aYCMRXu.exe

C:\Windows\System\QUYLaeW.exe

C:\Windows\System\QUYLaeW.exe

C:\Windows\System\KizEgFt.exe

C:\Windows\System\KizEgFt.exe

C:\Windows\System\BAaFjqS.exe

C:\Windows\System\BAaFjqS.exe

C:\Windows\System\wKMZrWH.exe

C:\Windows\System\wKMZrWH.exe

C:\Windows\System\hMEzPkB.exe

C:\Windows\System\hMEzPkB.exe

C:\Windows\System\vOJgCjV.exe

C:\Windows\System\vOJgCjV.exe

C:\Windows\System\srbNtTg.exe

C:\Windows\System\srbNtTg.exe

C:\Windows\System\CZIhrlg.exe

C:\Windows\System\CZIhrlg.exe

C:\Windows\System\UGrGehL.exe

C:\Windows\System\UGrGehL.exe

C:\Windows\System\TzLiaFx.exe

C:\Windows\System\TzLiaFx.exe

C:\Windows\System\LLXGmBg.exe

C:\Windows\System\LLXGmBg.exe

C:\Windows\System\jEAzKma.exe

C:\Windows\System\jEAzKma.exe

C:\Windows\System\iKaVxxV.exe

C:\Windows\System\iKaVxxV.exe

C:\Windows\System\ToShFZx.exe

C:\Windows\System\ToShFZx.exe

C:\Windows\System\RhfsVNj.exe

C:\Windows\System\RhfsVNj.exe

C:\Windows\System\YpUiOgV.exe

C:\Windows\System\YpUiOgV.exe

C:\Windows\System\YFgvfBq.exe

C:\Windows\System\YFgvfBq.exe

C:\Windows\System\fYAlGFn.exe

C:\Windows\System\fYAlGFn.exe

C:\Windows\System\qUXEpTK.exe

C:\Windows\System\qUXEpTK.exe

C:\Windows\System\pHCHqkK.exe

C:\Windows\System\pHCHqkK.exe

C:\Windows\System\YANjICW.exe

C:\Windows\System\YANjICW.exe

C:\Windows\System\RLfmKzD.exe

C:\Windows\System\RLfmKzD.exe

C:\Windows\System\zpKtgPl.exe

C:\Windows\System\zpKtgPl.exe

C:\Windows\System\MpiWbWD.exe

C:\Windows\System\MpiWbWD.exe

C:\Windows\System\WAsIbBi.exe

C:\Windows\System\WAsIbBi.exe

C:\Windows\System\uDrUOSX.exe

C:\Windows\System\uDrUOSX.exe

C:\Windows\System\VGQWLQa.exe

C:\Windows\System\VGQWLQa.exe

C:\Windows\System\jRgJPwJ.exe

C:\Windows\System\jRgJPwJ.exe

C:\Windows\System\GegYWoO.exe

C:\Windows\System\GegYWoO.exe

C:\Windows\System\FQzELgG.exe

C:\Windows\System\FQzELgG.exe

C:\Windows\System\VwUTKnr.exe

C:\Windows\System\VwUTKnr.exe

C:\Windows\System\nfmvybn.exe

C:\Windows\System\nfmvybn.exe

C:\Windows\System\hwGvDXq.exe

C:\Windows\System\hwGvDXq.exe

C:\Windows\System\fBOeSQO.exe

C:\Windows\System\fBOeSQO.exe

C:\Windows\System\ZsMsjRg.exe

C:\Windows\System\ZsMsjRg.exe

C:\Windows\System\UqIARKE.exe

C:\Windows\System\UqIARKE.exe

C:\Windows\System\QPbTgpd.exe

C:\Windows\System\QPbTgpd.exe

C:\Windows\System\xSAneRQ.exe

C:\Windows\System\xSAneRQ.exe

C:\Windows\System\icxUPKm.exe

C:\Windows\System\icxUPKm.exe

C:\Windows\System\cbBpgyN.exe

C:\Windows\System\cbBpgyN.exe

C:\Windows\System\OOQSTAW.exe

C:\Windows\System\OOQSTAW.exe

C:\Windows\System\nQPGUfN.exe

C:\Windows\System\nQPGUfN.exe

C:\Windows\System\xeSvQKf.exe

C:\Windows\System\xeSvQKf.exe

C:\Windows\System\gikNPUJ.exe

C:\Windows\System\gikNPUJ.exe

C:\Windows\System\MClgfFH.exe

C:\Windows\System\MClgfFH.exe

C:\Windows\System\GIkCdBv.exe

C:\Windows\System\GIkCdBv.exe

C:\Windows\System\BSMriYu.exe

C:\Windows\System\BSMriYu.exe

C:\Windows\System\qDbQmEl.exe

C:\Windows\System\qDbQmEl.exe

C:\Windows\System\CxiPUrX.exe

C:\Windows\System\CxiPUrX.exe

C:\Windows\System\XRXYCAU.exe

C:\Windows\System\XRXYCAU.exe

C:\Windows\System\riFPdhg.exe

C:\Windows\System\riFPdhg.exe

C:\Windows\System\XptKRPp.exe

C:\Windows\System\XptKRPp.exe

C:\Windows\System\wlqnEqM.exe

C:\Windows\System\wlqnEqM.exe

C:\Windows\System\fOpkpFA.exe

C:\Windows\System\fOpkpFA.exe

C:\Windows\System\DbDTXjC.exe

C:\Windows\System\DbDTXjC.exe

C:\Windows\System\CwygfCU.exe

C:\Windows\System\CwygfCU.exe

C:\Windows\System\RGMunyx.exe

C:\Windows\System\RGMunyx.exe

C:\Windows\System\ZImDmiC.exe

C:\Windows\System\ZImDmiC.exe

C:\Windows\System\kIZyQps.exe

C:\Windows\System\kIZyQps.exe

C:\Windows\System\plFDnRF.exe

C:\Windows\System\plFDnRF.exe

C:\Windows\System\LAtYMaS.exe

C:\Windows\System\LAtYMaS.exe

C:\Windows\System\mfubEwN.exe

C:\Windows\System\mfubEwN.exe

C:\Windows\System\cQdQJbD.exe

C:\Windows\System\cQdQJbD.exe

C:\Windows\System\GlQCZkG.exe

C:\Windows\System\GlQCZkG.exe

C:\Windows\System\gzbymJW.exe

C:\Windows\System\gzbymJW.exe

C:\Windows\System\BcjdiCe.exe

C:\Windows\System\BcjdiCe.exe

C:\Windows\System\NCLiMMY.exe

C:\Windows\System\NCLiMMY.exe

C:\Windows\System\BfCMedz.exe

C:\Windows\System\BfCMedz.exe

C:\Windows\System\PZUTaIU.exe

C:\Windows\System\PZUTaIU.exe

C:\Windows\System\bXELKqz.exe

C:\Windows\System\bXELKqz.exe

C:\Windows\System\CTyZroL.exe

C:\Windows\System\CTyZroL.exe

C:\Windows\System\RwlSgKD.exe

C:\Windows\System\RwlSgKD.exe

C:\Windows\System\srmhoPM.exe

C:\Windows\System\srmhoPM.exe

C:\Windows\System\sognAwm.exe

C:\Windows\System\sognAwm.exe

C:\Windows\System\xlDqwIG.exe

C:\Windows\System\xlDqwIG.exe

C:\Windows\System\WlsRSuz.exe

C:\Windows\System\WlsRSuz.exe

C:\Windows\System\ypjbIFd.exe

C:\Windows\System\ypjbIFd.exe

C:\Windows\System\MojOVAp.exe

C:\Windows\System\MojOVAp.exe

C:\Windows\System\BOaVrgP.exe

C:\Windows\System\BOaVrgP.exe

C:\Windows\System\zGWAWgq.exe

C:\Windows\System\zGWAWgq.exe

C:\Windows\System\xaZUdtF.exe

C:\Windows\System\xaZUdtF.exe

C:\Windows\System\rBmKFRx.exe

C:\Windows\System\rBmKFRx.exe

C:\Windows\System\PJTFUCz.exe

C:\Windows\System\PJTFUCz.exe

C:\Windows\System\kKLrjvh.exe

C:\Windows\System\kKLrjvh.exe

C:\Windows\System\qDKlCnG.exe

C:\Windows\System\qDKlCnG.exe

C:\Windows\System\rwmpVEt.exe

C:\Windows\System\rwmpVEt.exe

C:\Windows\System\AopIhRd.exe

C:\Windows\System\AopIhRd.exe

C:\Windows\System\mNwxATY.exe

C:\Windows\System\mNwxATY.exe

C:\Windows\System\ezIMlac.exe

C:\Windows\System\ezIMlac.exe

C:\Windows\System\mjJUEOx.exe

C:\Windows\System\mjJUEOx.exe

C:\Windows\System\SAITcZc.exe

C:\Windows\System\SAITcZc.exe

C:\Windows\System\OEsafdj.exe

C:\Windows\System\OEsafdj.exe

C:\Windows\System\hLogcna.exe

C:\Windows\System\hLogcna.exe

C:\Windows\System\LQGcdYm.exe

C:\Windows\System\LQGcdYm.exe

C:\Windows\System\lUZJxlx.exe

C:\Windows\System\lUZJxlx.exe

C:\Windows\System\PKOTvje.exe

C:\Windows\System\PKOTvje.exe

C:\Windows\System\habFENa.exe

C:\Windows\System\habFENa.exe

C:\Windows\System\hvjpPEg.exe

C:\Windows\System\hvjpPEg.exe

C:\Windows\System\eSFvWvX.exe

C:\Windows\System\eSFvWvX.exe

C:\Windows\System\DwGwDTJ.exe

C:\Windows\System\DwGwDTJ.exe

C:\Windows\System\bWqPoJY.exe

C:\Windows\System\bWqPoJY.exe

C:\Windows\System\EVYseSI.exe

C:\Windows\System\EVYseSI.exe

C:\Windows\System\UfeUJXt.exe

C:\Windows\System\UfeUJXt.exe

C:\Windows\System\YOBQzMO.exe

C:\Windows\System\YOBQzMO.exe

C:\Windows\System\njrhbvA.exe

C:\Windows\System\njrhbvA.exe

C:\Windows\System\UEanLmJ.exe

C:\Windows\System\UEanLmJ.exe

C:\Windows\System\rnYpSMo.exe

C:\Windows\System\rnYpSMo.exe

C:\Windows\System\IemvIgy.exe

C:\Windows\System\IemvIgy.exe

C:\Windows\System\fqeJNjk.exe

C:\Windows\System\fqeJNjk.exe

C:\Windows\System\wEJHIio.exe

C:\Windows\System\wEJHIio.exe

C:\Windows\System\fYZOfRc.exe

C:\Windows\System\fYZOfRc.exe

C:\Windows\System\pyiFOPc.exe

C:\Windows\System\pyiFOPc.exe

C:\Windows\System\HdNbOmN.exe

C:\Windows\System\HdNbOmN.exe

C:\Windows\System\tvqaviY.exe

C:\Windows\System\tvqaviY.exe

C:\Windows\System\aPJMyFb.exe

C:\Windows\System\aPJMyFb.exe

C:\Windows\System\chnsyAy.exe

C:\Windows\System\chnsyAy.exe

C:\Windows\System\WDVhrDY.exe

C:\Windows\System\WDVhrDY.exe

C:\Windows\System\ZVeGkZN.exe

C:\Windows\System\ZVeGkZN.exe

C:\Windows\System\IUZGZBW.exe

C:\Windows\System\IUZGZBW.exe

C:\Windows\System\OYjInca.exe

C:\Windows\System\OYjInca.exe

C:\Windows\System\BsULbxc.exe

C:\Windows\System\BsULbxc.exe

C:\Windows\System\tHyTwGM.exe

C:\Windows\System\tHyTwGM.exe

C:\Windows\System\AsXBlVp.exe

C:\Windows\System\AsXBlVp.exe

C:\Windows\System\InoUbyX.exe

C:\Windows\System\InoUbyX.exe

C:\Windows\System\YaFCdoY.exe

C:\Windows\System\YaFCdoY.exe

C:\Windows\System\mitPQNl.exe

C:\Windows\System\mitPQNl.exe

C:\Windows\System\nhnTWaL.exe

C:\Windows\System\nhnTWaL.exe

C:\Windows\System\yuOMKIR.exe

C:\Windows\System\yuOMKIR.exe

C:\Windows\System\zfKfPTg.exe

C:\Windows\System\zfKfPTg.exe

C:\Windows\System\xjOByQO.exe

C:\Windows\System\xjOByQO.exe

C:\Windows\System\fgEhhXQ.exe

C:\Windows\System\fgEhhXQ.exe

C:\Windows\System\muhpzhC.exe

C:\Windows\System\muhpzhC.exe

C:\Windows\System\zAuaHou.exe

C:\Windows\System\zAuaHou.exe

C:\Windows\System\ZgWrDKb.exe

C:\Windows\System\ZgWrDKb.exe

C:\Windows\System\sJOVWFS.exe

C:\Windows\System\sJOVWFS.exe

C:\Windows\System\SnlFmpk.exe

C:\Windows\System\SnlFmpk.exe

C:\Windows\System\PJJMDXO.exe

C:\Windows\System\PJJMDXO.exe

C:\Windows\System\FcqvIbG.exe

C:\Windows\System\FcqvIbG.exe

C:\Windows\System\qvXYepl.exe

C:\Windows\System\qvXYepl.exe

C:\Windows\System\DoYipiM.exe

C:\Windows\System\DoYipiM.exe

C:\Windows\System\bulBCJM.exe

C:\Windows\System\bulBCJM.exe

C:\Windows\System\QArTGZj.exe

C:\Windows\System\QArTGZj.exe

C:\Windows\System\hZfSTIf.exe

C:\Windows\System\hZfSTIf.exe

C:\Windows\System\lTHXaGw.exe

C:\Windows\System\lTHXaGw.exe

C:\Windows\System\sEGLDbq.exe

C:\Windows\System\sEGLDbq.exe

C:\Windows\System\XweWSQD.exe

C:\Windows\System\XweWSQD.exe

C:\Windows\System\riKAIrD.exe

C:\Windows\System\riKAIrD.exe

C:\Windows\System\gDmDbrc.exe

C:\Windows\System\gDmDbrc.exe

C:\Windows\System\IdsDXQi.exe

C:\Windows\System\IdsDXQi.exe

C:\Windows\System\sZgWeDF.exe

C:\Windows\System\sZgWeDF.exe

C:\Windows\System\lgavZLA.exe

C:\Windows\System\lgavZLA.exe

C:\Windows\System\vBhVGJr.exe

C:\Windows\System\vBhVGJr.exe

C:\Windows\System\QtoGsSU.exe

C:\Windows\System\QtoGsSU.exe

C:\Windows\System\udHoDGu.exe

C:\Windows\System\udHoDGu.exe

C:\Windows\System\FWgwSlg.exe

C:\Windows\System\FWgwSlg.exe

C:\Windows\System\ZStRRCx.exe

C:\Windows\System\ZStRRCx.exe

C:\Windows\System\kOaQgrp.exe

C:\Windows\System\kOaQgrp.exe

C:\Windows\System\xDydIbj.exe

C:\Windows\System\xDydIbj.exe

C:\Windows\System\tXQNWej.exe

C:\Windows\System\tXQNWej.exe

C:\Windows\System\ixJpAmD.exe

C:\Windows\System\ixJpAmD.exe

C:\Windows\System\jMHQhqO.exe

C:\Windows\System\jMHQhqO.exe

C:\Windows\System\DgPfvve.exe

C:\Windows\System\DgPfvve.exe

C:\Windows\System\tElWisr.exe

C:\Windows\System\tElWisr.exe

C:\Windows\System\uNabkNS.exe

C:\Windows\System\uNabkNS.exe

C:\Windows\System\yAnxndK.exe

C:\Windows\System\yAnxndK.exe

C:\Windows\System\dcRfUqC.exe

C:\Windows\System\dcRfUqC.exe

C:\Windows\System\akBnqAX.exe

C:\Windows\System\akBnqAX.exe

C:\Windows\System\nhVLXMD.exe

C:\Windows\System\nhVLXMD.exe

C:\Windows\System\jopugYb.exe

C:\Windows\System\jopugYb.exe

C:\Windows\System\iHTbFdK.exe

C:\Windows\System\iHTbFdK.exe

C:\Windows\System\Tfphpka.exe

C:\Windows\System\Tfphpka.exe

C:\Windows\System\ckaIkkO.exe

C:\Windows\System\ckaIkkO.exe

C:\Windows\System\mFVMGkN.exe

C:\Windows\System\mFVMGkN.exe

C:\Windows\System\pAZZDEe.exe

C:\Windows\System\pAZZDEe.exe

C:\Windows\System\qEjpDHa.exe

C:\Windows\System\qEjpDHa.exe

C:\Windows\System\eluqrVe.exe

C:\Windows\System\eluqrVe.exe

C:\Windows\System\WFUIAvA.exe

C:\Windows\System\WFUIAvA.exe

C:\Windows\System\UjyAUog.exe

C:\Windows\System\UjyAUog.exe

C:\Windows\System\PwIvkLf.exe

C:\Windows\System\PwIvkLf.exe

C:\Windows\System\WvGQhiT.exe

C:\Windows\System\WvGQhiT.exe

C:\Windows\System\dIaTStr.exe

C:\Windows\System\dIaTStr.exe

C:\Windows\System\NYqdBTo.exe

C:\Windows\System\NYqdBTo.exe

C:\Windows\System\OQwgpot.exe

C:\Windows\System\OQwgpot.exe

C:\Windows\System\xEMcLnN.exe

C:\Windows\System\xEMcLnN.exe

C:\Windows\System\FODddRh.exe

C:\Windows\System\FODddRh.exe

C:\Windows\System\aNsOpWB.exe

C:\Windows\System\aNsOpWB.exe

C:\Windows\System\TFNVfYs.exe

C:\Windows\System\TFNVfYs.exe

C:\Windows\System\jMITzMN.exe

C:\Windows\System\jMITzMN.exe

C:\Windows\System\JCkHgOl.exe

C:\Windows\System\JCkHgOl.exe

C:\Windows\System\RKhJFJk.exe

C:\Windows\System\RKhJFJk.exe

C:\Windows\System\KZPZvyy.exe

C:\Windows\System\KZPZvyy.exe

C:\Windows\System\soXYcak.exe

C:\Windows\System\soXYcak.exe

C:\Windows\System\JPcYRmM.exe

C:\Windows\System\JPcYRmM.exe

C:\Windows\System\qFCBqWe.exe

C:\Windows\System\qFCBqWe.exe

C:\Windows\System\QKsNIZp.exe

C:\Windows\System\QKsNIZp.exe

C:\Windows\System\oUeizss.exe

C:\Windows\System\oUeizss.exe

C:\Windows\System\qZKUTIQ.exe

C:\Windows\System\qZKUTIQ.exe

C:\Windows\System\KVEclNs.exe

C:\Windows\System\KVEclNs.exe

C:\Windows\System\ehccBrg.exe

C:\Windows\System\ehccBrg.exe

C:\Windows\System\PTFRASL.exe

C:\Windows\System\PTFRASL.exe

C:\Windows\System\gesOjxX.exe

C:\Windows\System\gesOjxX.exe

C:\Windows\System\nWyTzKD.exe

C:\Windows\System\nWyTzKD.exe

C:\Windows\System\JKOyFEi.exe

C:\Windows\System\JKOyFEi.exe

C:\Windows\System\wNjHmjx.exe

C:\Windows\System\wNjHmjx.exe

C:\Windows\System\NGRNWVX.exe

C:\Windows\System\NGRNWVX.exe

C:\Windows\System\OonafRK.exe

C:\Windows\System\OonafRK.exe

C:\Windows\System\KiamSfG.exe

C:\Windows\System\KiamSfG.exe

C:\Windows\System\ONBzfHZ.exe

C:\Windows\System\ONBzfHZ.exe

C:\Windows\System\GDGbarw.exe

C:\Windows\System\GDGbarw.exe

C:\Windows\System\QVzJSUt.exe

C:\Windows\System\QVzJSUt.exe

C:\Windows\System\NTNfIqD.exe

C:\Windows\System\NTNfIqD.exe

C:\Windows\System\oKfRuaL.exe

C:\Windows\System\oKfRuaL.exe

C:\Windows\System\jMUsXhV.exe

C:\Windows\System\jMUsXhV.exe

C:\Windows\System\XOWHGZm.exe

C:\Windows\System\XOWHGZm.exe

C:\Windows\System\PnggHik.exe

C:\Windows\System\PnggHik.exe

C:\Windows\System\HhGugNP.exe

C:\Windows\System\HhGugNP.exe

C:\Windows\System\FzvUQfW.exe

C:\Windows\System\FzvUQfW.exe

C:\Windows\System\PWAOqfT.exe

C:\Windows\System\PWAOqfT.exe

C:\Windows\System\LEzbcHN.exe

C:\Windows\System\LEzbcHN.exe

C:\Windows\System\VBsApHC.exe

C:\Windows\System\VBsApHC.exe

C:\Windows\System\ozNyrLn.exe

C:\Windows\System\ozNyrLn.exe

C:\Windows\System\tqRHwoS.exe

C:\Windows\System\tqRHwoS.exe

C:\Windows\System\vkwZZwV.exe

C:\Windows\System\vkwZZwV.exe

C:\Windows\System\fdoTuTV.exe

C:\Windows\System\fdoTuTV.exe

C:\Windows\System\EWEUXsZ.exe

C:\Windows\System\EWEUXsZ.exe

C:\Windows\System\Sjngirc.exe

C:\Windows\System\Sjngirc.exe

C:\Windows\System\XyNjDfu.exe

C:\Windows\System\XyNjDfu.exe

C:\Windows\System\HfYhfHO.exe

C:\Windows\System\HfYhfHO.exe

C:\Windows\System\rgpTgFI.exe

C:\Windows\System\rgpTgFI.exe

C:\Windows\System\OrUXekK.exe

C:\Windows\System\OrUXekK.exe

C:\Windows\System\djGSyuh.exe

C:\Windows\System\djGSyuh.exe

C:\Windows\System\dYFjwSz.exe

C:\Windows\System\dYFjwSz.exe

C:\Windows\System\xagDSfU.exe

C:\Windows\System\xagDSfU.exe

C:\Windows\System\EMqqJod.exe

C:\Windows\System\EMqqJod.exe

C:\Windows\System\djuuUix.exe

C:\Windows\System\djuuUix.exe

C:\Windows\System\pYXPKNn.exe

C:\Windows\System\pYXPKNn.exe

C:\Windows\System\OKqGmCy.exe

C:\Windows\System\OKqGmCy.exe

C:\Windows\System\dZpwfkf.exe

C:\Windows\System\dZpwfkf.exe

C:\Windows\System\eTmidxL.exe

C:\Windows\System\eTmidxL.exe

C:\Windows\System\udcdgcJ.exe

C:\Windows\System\udcdgcJ.exe

C:\Windows\System\ftyzral.exe

C:\Windows\System\ftyzral.exe

C:\Windows\System\HGcRPyL.exe

C:\Windows\System\HGcRPyL.exe

C:\Windows\System\OCHPzEM.exe

C:\Windows\System\OCHPzEM.exe

C:\Windows\System\dDLobMH.exe

C:\Windows\System\dDLobMH.exe

C:\Windows\System\QSpnDSG.exe

C:\Windows\System\QSpnDSG.exe

C:\Windows\System\YAqpOwQ.exe

C:\Windows\System\YAqpOwQ.exe

C:\Windows\System\oqRFlqk.exe

C:\Windows\System\oqRFlqk.exe

C:\Windows\System\WIRurIO.exe

C:\Windows\System\WIRurIO.exe

C:\Windows\System\zkvknYD.exe

C:\Windows\System\zkvknYD.exe

C:\Windows\System\bIDsRrC.exe

C:\Windows\System\bIDsRrC.exe

C:\Windows\System\odKmGBI.exe

C:\Windows\System\odKmGBI.exe

C:\Windows\System\waNuFBa.exe

C:\Windows\System\waNuFBa.exe

C:\Windows\System\DkQXbcJ.exe

C:\Windows\System\DkQXbcJ.exe

C:\Windows\System\KpUnXHj.exe

C:\Windows\System\KpUnXHj.exe

C:\Windows\System\BTwmhBi.exe

C:\Windows\System\BTwmhBi.exe

C:\Windows\System\ZVwNzGS.exe

C:\Windows\System\ZVwNzGS.exe

C:\Windows\System\NQWbboF.exe

C:\Windows\System\NQWbboF.exe

C:\Windows\System\LdLLzQp.exe

C:\Windows\System\LdLLzQp.exe

C:\Windows\System\HwEDbxs.exe

C:\Windows\System\HwEDbxs.exe

C:\Windows\System\DfpdFAf.exe

C:\Windows\System\DfpdFAf.exe

C:\Windows\System\vQnaqAO.exe

C:\Windows\System\vQnaqAO.exe

C:\Windows\System\pWuDHaG.exe

C:\Windows\System\pWuDHaG.exe

C:\Windows\System\ebkliQu.exe

C:\Windows\System\ebkliQu.exe

C:\Windows\System\FCBSXZD.exe

C:\Windows\System\FCBSXZD.exe

C:\Windows\System\vHicniE.exe

C:\Windows\System\vHicniE.exe

C:\Windows\System\JCYSoZC.exe

C:\Windows\System\JCYSoZC.exe

C:\Windows\System\HoduFJY.exe

C:\Windows\System\HoduFJY.exe

C:\Windows\System\ZMnaBvN.exe

C:\Windows\System\ZMnaBvN.exe

C:\Windows\System\HwnVZVZ.exe

C:\Windows\System\HwnVZVZ.exe

C:\Windows\System\jVTOpaH.exe

C:\Windows\System\jVTOpaH.exe

C:\Windows\System\YRrpcjG.exe

C:\Windows\System\YRrpcjG.exe

C:\Windows\System\VCdYxxS.exe

C:\Windows\System\VCdYxxS.exe

C:\Windows\System\bZCIFVs.exe

C:\Windows\System\bZCIFVs.exe

C:\Windows\System\FRGfsEL.exe

C:\Windows\System\FRGfsEL.exe

C:\Windows\System\aMAMBoe.exe

C:\Windows\System\aMAMBoe.exe

C:\Windows\System\JfxiLex.exe

C:\Windows\System\JfxiLex.exe

C:\Windows\System\jOqgBnD.exe

C:\Windows\System\jOqgBnD.exe

C:\Windows\System\pMEyYcp.exe

C:\Windows\System\pMEyYcp.exe

C:\Windows\System\RIkVDED.exe

C:\Windows\System\RIkVDED.exe

C:\Windows\System\xSekXAc.exe

C:\Windows\System\xSekXAc.exe

C:\Windows\System\UGeTETN.exe

C:\Windows\System\UGeTETN.exe

C:\Windows\System\tcKjrHk.exe

C:\Windows\System\tcKjrHk.exe

C:\Windows\System\YzCrjms.exe

C:\Windows\System\YzCrjms.exe

C:\Windows\System\KHYaVRv.exe

C:\Windows\System\KHYaVRv.exe

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp
DE	3.120.98.217:8080		tcp

Files

memory/1632-0-0x000000013F340000-0x000000013F732000-memory.dmp

memory/1632-1-0x00000000000F0000-0x0000000000100000-memory.dmp

C:\Windows\system\esaTnsL.exe

MD5	90a836969662cf3441d7b36b1fdafd37
SHA1	c23e37400c35214ec6f82d81ddd34c7afaf824d6
SHA256	5886f8a58dc4a2ba717a7e6ad905a8293a7558b12d4aa2da40e7da3d7f5bbf12
SHA512	0a31b1970f417f39feba05d44c98ccf2344bc5fd906daa2534a913db4e33345ee7def4adf82dcc9f6b21e43ecd6e75bd307748572bc14c9bb977f8e1f54b9323

C:\Windows\system\IXnPDkN.exe

MD5	d6f6879d60acbf9a885f44429530de76
SHA1	bdf2687b5cda40cfd60d14a64db9cb6f1a3c9b51
SHA256	b5824fbe7f17e6d2ba3c9f5b69e63ccd1b88f5d6ce7a9446f5fadeac4fe2ef4f
SHA512	66028f13f5bb2f5ab27e699b396f9477d92af51f5766e9c28ea85f4278a62501e9ff12c9716872566d619dc0d20f622f2e27b4d7ae98002f60c01a363780d926

\Windows\system\LmbJgIm.exe

MD5	76cd1665bead8737cc28366b22cc1cf7
SHA1	94c324ccd794e04c5166a1aba845bb2cae791a99
SHA256	60c1b79a2435d800d274f9c7b218b34140000631c22fd6b54fbb311136ce53b8
SHA512	90166e15207bed4bade66dab7d708a1281eeb194d9386634d8474d92c3606a8ecbe99b79eae06a0d6efe1ff40ed0f89c2d6370891a9f6c7ee3af60aa7c284fca

memory/1512-33-0x000007FEF5B7E000-0x000007FEF5B7F000-memory.dmp

\Windows\system\lHqxwdv.exe

MD5	1d586eebfd7089e06394456678bc67fd
SHA1	db0bcb461a8f19f394eda6d6ffd01be13237a175
SHA256	5602eba643682632877a03e4fda17a1a646bd3c2d50278d4bafc71e941aadae0
SHA512	09b745fd258f40950e4ad3376e11c87c3f1e6af3945c3e56fe5d3ab46f2de78122f012340472d4cbd1e99678f488c9b17dfe461e8ced615380124c632572d83d

C:\Windows\system\hiGQetu.exe

MD5	a1e8d9794487d8cf3a0ed12f62a47e2b
SHA1	45b235ca7046f80e23624713f660dffb74b2e09e
SHA256	a0b31c5d6ca90c036817af59545293dd01b5526c9db8ef932d6574fe89f64e8f
SHA512	3f3ca3290c5ab251a40f99bff640f699f8df21d14d975dd3070c63af526fe9ad41d0797a9d210a6acaac1e0e34865b714e315e445a45e2cc294c2412fb77436c

\Windows\system\JGqdfvh.exe

MD5	16e9aab39fef9e5cde363779eefaf9f2
SHA1	faa54a892524493f7b0d50cc849d34eb2032f66d
SHA256	b87f015c9ba0262285eb478e5c9397432a34b6f0a4af9f18a1d3eb327f89d1db
SHA512	a63828e4456f66f63abe296b91e4432c7a6c7e809f34657709ee3d6322fc11a9bffe911e899d7e64541b473c5e50cbc4236de698d982c7cc239e1bf443f57294

\Windows\system\kQSjFqi.exe

MD5	732b0da8b6e2983e2988b9bb3d83bbd9
SHA1	6897dac9e893cbe4fb97e066c069b1bb526b767c
SHA256	d7f1776dae2ba7c78ca0f6f5582ff943bd36611d1363f3038b4b7213a344b7e8
SHA512	e75749be4471d3b01b72cc8f73f2498feea192ee2ca53ae10bb3e43064443b8fae4f29f2fdaff2c1dfc1c0ba3270e9048ae03b0ae50597227e3e0dbd78801a9a

\Windows\system\UUKdfkE.exe

MD5	a0d8336b7110a51b0f114012a572f9e0
SHA1	75b1836d971fb5398e60fddae444ce3d9fc2f59f
SHA256	9f169e7e65dd480efba3195e8773ea7c2d6a4534e6dbd6ee2388455d5f6abe36
SHA512	177c90922cadac2f206896b24be6d507491bcdad48c4aadfd73b8be72fb62f7cb532633423e9a6bad593309aa58725eed82610253463f7472c078fc5f4f0b145

C:\Windows\system\MiIQqUR.exe

MD5	794c1ae6bec52556c97ca828ac657c3b
SHA1	fc0c87ce19ff4f671443f939ccb58dc8873f58e8
SHA256	d5fd461b12ac31eede6ac5d7b6d75e6eb1403265b4357f40d043e8d4b240f4dc
SHA512	ce2363c4d70668857571ce679146b0ad11338bf66749546af63ff21f78d27ec4700c7452578b7c72b5688ded481acdd045a9b6e683afd876252e4d94e773935e

C:\Windows\system\OEqZslD.exe

MD5	1b717b843084406b775a36946f11baf1
SHA1	c557e31ea2558da0c0694c9ecd7430f75302d926
SHA256	8c5a9d261c5940b8f5ad4b399a6d516ab9441adf8b6a50e0105875c7f5c29694
SHA512	1f7398848b8c306339632583e322c94477ba1e1ed5a37e6bd084ba9403eb399c9d65e8b64d3bea480d5b65074c562d9bda6ec55ac44d6e633a444b9779427913

C:\Windows\system\RryYpix.exe

MD5	e4171ab2d670fce7e9d6134641d819ed
SHA1	89027c15b968fe5563b9267c1b1943a90bcb493e
SHA256	632bd3476295029e9d2a055d077ad0b6ddec516fac3f43ed2e34fd55af96c3c4
SHA512	eda1d5bfa1bf3aee4865ae68a54c20b1d7bd18e5d4e08295f0fffbd64ae52a7a063837f1ad6030126b29aef9c66cff67ca668f9dbebb30fe36fda5520b21f8d9

\Windows\system\GbYoPco.exe

MD5	f3aae2c407f8fc02594531c50ef9d2c4
SHA1	50627277674ba0fab1707fb6e477807b3c7f557a
SHA256	d9c8864a8ff1a6924a765a3529e7c894d653e79fe44823246cd0dccf1379889c
SHA512	bb4c757e009c055a6bee21a09d62cf1d5ce979d94adefec116de7a0cb2b899c22b96837539507707700e85af523ebd249272b750477636033077df2f06f0afb7

\Windows\system\dKvoiMi.exe

MD5	607b34344c79f07239abe352e0ca914c
SHA1	39203c5ce170e539b9c5201c7345e0672183a347
SHA256	4a89e9740e621e3af20ea7a36d7adac8894d64db9217b7c9bd5f74071ee605d5
SHA512	919a2fd4c7a087e5f4152a81c8e92e32ffa9e21b9c9ff6939541554894da57b5f42068b5d2f813cc143f5f9e08359b18c87c659b6596d8823f45f47f26eaaf81

\Windows\system\QQuvoYr.exe

MD5	611b783e01b0e100c8bbfab5497d2921
SHA1	4c4c28eb0ed239d41b2b680a6933a63ec4edd606
SHA256	36f9b812dde5fe4b2b1bca7cf024dd8d5b4b2d28ff04fd2d07ad7478b25c9ac9
SHA512	b36283bc210a09f305c797af30ebcd5c000153ab9c4956656975b88599fef95f5a0187d85558b048cae6c33cd65659352ef1c89c803a60ef5d62545b1c539deb

C:\Windows\system\xVUnWPK.exe

MD5	03f54b754bec8033734f65701cf32684
SHA1	8d62645110b538d2c473af6590ce53654b7f8551
SHA256	f1d84b44cabeae870098a2d292926e724b1a1778299ef342c45ce88b40b4d2b8
SHA512	fa3841ac5c1cec8d6348baf6c298c87494e2249bd0339d15ff04b2a416e69a8037df079ba1c8b58ca88ace743567820776b090490c7bd7e2b52132c152702639

\Windows\system\pZIYbNb.exe

MD5	3d46dcf5f9bba472f6ae44c699e95f45
SHA1	1e5aa9212c31c2a9d5a14f6af4324cbb5d5edebb
SHA256	054947a8565b55e2e405920a40d7d17bdf17d9652ea72671deac14159f87b3c4
SHA512	03c6a72c1d9b052c5e031706e3b1490e36acbb0da627b19da2d35117529169944d9c134c2da0f23fce1db36204eccfbb27f96eac770869d29fafc867e0a2b168

\Windows\system\mucfVhq.exe

MD5	da2289e8afb753c12a508c151801d136
SHA1	bdd1e6f3b8664461c06b576be8f3e85710d8283a
SHA256	35281794dfff3335c7e3dd4cf63dee0f5f86e0cef33937eb2759a18ba3f13fae
SHA512	e8501935945cd6fb2cb9ced70168d8241cf87fb895d7b66633df61b201081dc48267a16ccebea5518f88e22418be13cb97ee612105511ca7e6e9969f1e250f36

C:\Windows\system\ftllXxS.exe

MD5	870b73fb0467bbf67ae10bd553bcaa5a
SHA1	80453123f003ee09cc4f71a56dc44cb2af2ebd9d
SHA256	addacb45badc8375686be641b6e5ce72a27324a839dfc648e4b75c89b5ddb925
SHA512	b772ca3ae5b37bf0e3cc8986fc1f397b665860ad25dc91aa72195dd9015d81c6bb3a97ff703a6de3bed0a9d42244820c5d2375a05fae96ec7746808f680832c2

C:\Windows\system\hjJNane.exe

MD5	8edab0fd22e6bafcf712244ae8e44278
SHA1	c714a8acba33ec9a5d59417da9b0b0840ed04a26
SHA256	39b8f190489a9377b5bd6e96786006cdafcbebf8ade7c53e5df8b7e449b17fed
SHA512	c0d1035ddf278a1d0c4bfeb96d1bd434d9bc94e296785db5b5b1cdf610fa9cfe00a63aaa04f87be4e2fba9732504971d1a8970908890145be345402bf4aa0e3e

C:\Windows\system\SFZGCrz.exe

MD5	95a38c59b89b61dd30098e7873fb84c9
SHA1	5088110ddc9eabee1a5a760c3b72f00912b3eedd
SHA256	ada2fece9e11ceb10a3b478346cc90501ff743e100483653d64728e05815740a
SHA512	0f21dc871aad39885135614651a0299125d8818424998e8c98b83eb5f8ca841cb051befbc9234caa1bfd3c851c1a0fa2516ca91d029e4909f1008a99c8acd2e4

C:\Windows\system\HHithQF.exe

MD5	02735fd9e2a686064ea29dedefd39963
SHA1	8a0e8c50b6381dc7e8ce348087a8a9bcc851f9bf
SHA256	2534032013bfabd22c381f9eea243c52c9582815e2dc297d6b82cdbd196a5de8
SHA512	a336f17cd858fe985d5836511582ca1ff135afd80dabd0e324595833b8fc48f3d0209f088925fb259df982ea0a271d52fc9f9536e4e6014dbfb70b1c95f0e69b

C:\Windows\system\gxbbrbt.exe

MD5	1d561745055f3aef622344eaf4cbc631
SHA1	fb0fad2e33cfd41d7ba88a66be10143666e0fe55
SHA256	f70e0c8f53e66922dba11905cc5f2d49adca59706c553644687f66cc16b3cf75
SHA512	adcff6ba32d339dd0986105456c189a3c2431f37f2de9d0abb6281f12d5301b5e6d3f12d0ed0ebc9dea4c8a5bb4b2a3ba33679715a4468588035427106233482

C:\Windows\system\IaLFKyr.exe

MD5	494c941e17ca2c0bde6585aac0170974
SHA1	4e61d5d9b9235a06ca33249418c7381dc2d321da
SHA256	898dec4926f6bcab70a55137fa08d462a1374bac3c9ce525f4abe9767445b9d0
SHA512	75102d7be6b9475f4693448283784b1a371fbcd882dda2a190b28947e3eff7752140c5afa3c2a3895040bd1b611f99ca8e53ba904c05afaccb91d058a0408ef6

C:\Windows\system\adlLIXq.exe

MD5	2d6a28c4d0c5524068f5c3540b173bdc
SHA1	79024935510182fe3684691bdbec9282fad74ff9
SHA256	ef7756ff393c5a921218e858b37f7a7ebb0483f634941ab7e1bdcef66fd05157
SHA512	30548d4364444c42bd3ec0b135d0ca1af5464237e61598e630f4fb366873cba0c3531318cb2dc5c4334a442e19c0796349f70be72782bb75abf5e17a92e13803

C:\Windows\system\tYUYWiF.exe

MD5	27f7db1159015a1c5be675d433c20de6
SHA1	5dad575aca597028f0d53a412ece823f796e7a89
SHA256	7e8543af002bb610af64b12b9cf82a620debd234da73e7fe023daa3b7ebce9e0
SHA512	28f3b5970d037244b4df21976f3b86cba5417c6952150ab994e4c1221e256e90a32e9d7ca4670d2edad70cc601fd0f21337eb8c713746057769a25adc5e84a59

C:\Windows\system\KHxxlNV.exe

MD5	035815b8c175be6e8e42d98ac392b8b5
SHA1	4650d5b6e835fbfe8f188615b6c78c65cb4dbcfe
SHA256	cee614df6f248232c469e8f86f95bf02d5fa6740d06d41388260eb1613cb9637
SHA512	10872d5a03822703dd39b0a350e5ad56a1ec5038f769419f9dcc3699fb41c0d7a7adeaed8ff5582c1cef35ffe9f695112cde5e4a7a3b43095b96b4a2e7a62449

C:\Windows\system\CSHEffd.exe

MD5	8ea199a44fcc60c33cc50bf946f1325d
SHA1	b05a2ad8a416aaf68eb81b09a0259bbdd7151d05
SHA256	5fc3091fc17ca47f89aca530c89fc2bc1dd26144f2475b9867b9f4e3993fa2b6
SHA512	e3c9258c9141f813b519e07979f187ab5a18e8181c252652767b9e05e01cba9bda7107c80706f2f4769ec947a06fd1a13840c43a917ed640c1b5c638147273c0

memory/1512-194-0x000007FEF58C0000-0x000007FEF625D000-memory.dmp

memory/2432-197-0x000000013FD20000-0x0000000140112000-memory.dmp

memory/2436-210-0x000000013FB20000-0x000000013FF12000-memory.dmp

memory/1632-219-0x0000000003610000-0x0000000003A02000-memory.dmp

memory/1632-218-0x000000013F750000-0x000000013FB42000-memory.dmp

memory/2912-216-0x000000013FC70000-0x0000000140062000-memory.dmp

memory/1632-215-0x000000013FC70000-0x0000000140062000-memory.dmp

memory/2900-214-0x000000013F850000-0x000000013FC42000-memory.dmp

memory/1632-213-0x000000013F850000-0x000000013FC42000-memory.dmp

memory/2500-212-0x000000013F590000-0x000000013F982000-memory.dmp

memory/1632-211-0x0000000003610000-0x0000000003A02000-memory.dmp

memory/1632-209-0x000000013FB20000-0x000000013FF12000-memory.dmp

memory/2328-208-0x000000013FE90000-0x0000000140282000-memory.dmp

memory/2560-207-0x000000013FA40000-0x000000013FE32000-memory.dmp

memory/1632-206-0x000000013FE90000-0x0000000140282000-memory.dmp

memory/1512-205-0x0000000001EA0000-0x0000000001EA8000-memory.dmp

memory/1632-204-0x000000013FA40000-0x000000013FE32000-memory.dmp

memory/1512-203-0x000000001B8C0000-0x000000001BBA2000-memory.dmp

memory/2712-202-0x000000013F510000-0x000000013F902000-memory.dmp

memory/2652-200-0x000000013FC50000-0x0000000140042000-memory.dmp

memory/1632-196-0x000000013FD20000-0x0000000140112000-memory.dmp

memory/1632-195-0x000000013FC50000-0x0000000140042000-memory.dmp

C:\Windows\system\lavAbFI.exe

MD5	a265b78ad8a084bfdf67c0c010b81f03
SHA1	664b76ace842aded937d60403f7fd84de20ce869
SHA256	f608b07f5ed13ced2e3c0c035fa248184e07448ffd3808018fb7ffadff618e9a
SHA512	f6d33b2cde720a76290d8c95a30aec17b133e7ebf1610fc9066dd4392437aa43ac297c593ca56b9d36be0447ca9788733469a61462a80f2678bf3a5733ba6bb2

C:\Windows\system\fcGsCXh.exe

MD5	cda53b021297be28e385ca0a16ac2ff5
SHA1	bf1c02728c8304cd073f1bd1d7301a333c37b66d
SHA256	ab88808e25d3b18c9d2968f15f548dfd73c2ee1e1aef3e2658cbb580d2f28274
SHA512	c81088b5766ffee497d45a613db741b036540b358bba6c57af4d4953d78b6af8303efdd5b2b342358d174db2af53c6a447f67f995d7a9f1ddaf5e9f9cfc2d3b8

C:\Windows\system\AQbrDrP.exe

MD5	2b64442d292ac21aea5e2705edfd9c89
SHA1	08d608597ebc9b3305df875c0e801f0ceaeefdfa
SHA256	8af0d93ceccfe61bfedc884a501250d00a38ad3e8a1f1dcfb0871bc7cb9f0b78
SHA512	7943ba3907564b0858257f7fa7af2de299f4a2e5933e66d9331ff1d431186d2e2818002ab95cfbd84fd78b4bc001e27f426e679e0f85d62d0ce46e003b0d50f3

C:\Windows\system\OmmOHvQ.exe

MD5	67bde1a187d01f8c2a9eab29f5b8be8d
SHA1	b3532b84b7176d9cb6988b797b9a5dc90d12a66d
SHA256	79eb7e6d3a799370982d680ea4afa2505710ff4d9006156de7d5509737c13716
SHA512	39b6bbb699dd6964b46fa2087e535c7ca987046451f15a8ca7df73ec5aefbdd3b4b935bc268ced1593d64a70205b76ac4169de74713eb711baf676939266c516

C:\Windows\system\xCCiJfX.exe

MD5	5b0e13169c70e62f66dd229e9014859c
SHA1	26e58e0f757cf90614f37594f68b7377b736387b
SHA256	d3204d98cbb1dbf4bd8799df19f1287fc4cff7a777038ae30a7da07343edf6a6
SHA512	3f3fe025d8777d9feddbbf9bbaf869bfc8317b75725e66a7869004430a2ce41f9aaf17d8588d2a3c3eca709dc49d789a911bec913ec4a1ff2f896119b249d6d6

C:\Windows\system\MAEOynE.exe

MD5	b7d970cd13b8faae1f5eed6d21e52d52
SHA1	54497c64343ab112b8e215d86c46faf38de15152
SHA256	bbe624223599316df1e175756baea8cebe05f7c0487b7a5803f27853013ef054
SHA512	d8b71f4f0eb11d88eca61bfd6bb9e5f7425321d060bb8024250aa6208bf6252fc951c6cd5569c1e4c5a0997c94de26f46096801d132d3831a410655455346378

memory/2628-32-0x000000013F360000-0x000000013F752000-memory.dmp

memory/1632-31-0x0000000003050000-0x0000000003442000-memory.dmp

memory/2516-30-0x000000013F750000-0x000000013FB42000-memory.dmp

memory/1912-28-0x000000013F510000-0x000000013F902000-memory.dmp

C:\Windows\system\vDaPzQL.exe

MD5	22f84dbae22f95dd1a47ffe439cd559d
SHA1	84fcfa0ad0a062ce08e8cafe6aa26777cfda8848
SHA256	6e187ff26984100c562406b136b99644cdccecd44dc25904245c795ca6038512
SHA512	c6e7690d24aa499ae4b9450140b935e0453081a8913152caed5d89fe6332ba9274df2ea3b183a79d3b8755bbebd08f4b68a571ea9c1f2fb8bd5a913e7a2a9ebc

memory/1512-1251-0x000007FEF58C0000-0x000007FEF625D000-memory.dmp

memory/1632-2259-0x000000013F340000-0x000000013F732000-memory.dmp

memory/2432-3561-0x000000013FD20000-0x0000000140112000-memory.dmp

memory/2628-4842-0x000000013F360000-0x000000013F752000-memory.dmp

memory/2912-4932-0x000000013FC70000-0x0000000140062000-memory.dmp

memory/2500-4931-0x000000013F590000-0x000000013F982000-memory.dmp

memory/2516-4936-0x000000013F750000-0x000000013FB42000-memory.dmp

memory/2560-5144-0x000000013FA40000-0x000000013FE32000-memory.dmp

memory/2712-4927-0x000000013F510000-0x000000013F902000-memory.dmp

memory/2900-5319-0x000000013F850000-0x000000013FC42000-memory.dmp

memory/1912-5325-0x000000013F510000-0x000000013F902000-memory.dmp

memory/2652-5364-0x000000013FC50000-0x0000000140042000-memory.dmp

memory/2328-5360-0x000000013FE90000-0x0000000140282000-memory.dmp

memory/1632-7289-0x0000000003050000-0x0000000003442000-memory.dmp

memory/1632-8082-0x000000013FC50000-0x0000000140042000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 14:13

Reported

2024-06-13 14:16

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

97s

Command Line

"C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System\GopTlmv.exe	N/A
N/A	N/A	C:\Windows\System\mSEBlcY.exe	N/A
N/A	N/A	C:\Windows\System\GLwpNus.exe	N/A
N/A	N/A	C:\Windows\System\XjEmRCI.exe	N/A
N/A	N/A	C:\Windows\System\oBwrEce.exe	N/A
N/A	N/A	C:\Windows\System\TUzBDqi.exe	N/A
N/A	N/A	C:\Windows\System\wyZdzOH.exe	N/A
N/A	N/A	C:\Windows\System\SzUEudP.exe	N/A
N/A	N/A	C:\Windows\System\nIdVSCV.exe	N/A
N/A	N/A	C:\Windows\System\ndlPHQC.exe	N/A
N/A	N/A	C:\Windows\System\vSQBQXs.exe	N/A
N/A	N/A	C:\Windows\System\rGLYGSn.exe	N/A
N/A	N/A	C:\Windows\System\uOWPETo.exe	N/A
N/A	N/A	C:\Windows\System\ZasOFcc.exe	N/A
N/A	N/A	C:\Windows\System\IPhmgnk.exe	N/A
N/A	N/A	C:\Windows\System\FMvwhxx.exe	N/A
N/A	N/A	C:\Windows\System\OWVysFT.exe	N/A
N/A	N/A	C:\Windows\System\iGzHQWD.exe	N/A
N/A	N/A	C:\Windows\System\ydAQCTX.exe	N/A
N/A	N/A	C:\Windows\System\YPYXpYw.exe	N/A
N/A	N/A	C:\Windows\System\NbGYUtv.exe	N/A
N/A	N/A	C:\Windows\System\YMXXogq.exe	N/A
N/A	N/A	C:\Windows\System\gMwLfiI.exe	N/A
N/A	N/A	C:\Windows\System\SehujBM.exe	N/A
N/A	N/A	C:\Windows\System\uqXoeQq.exe	N/A
N/A	N/A	C:\Windows\System\AnvnKaY.exe	N/A
N/A	N/A	C:\Windows\System\JtNdJZr.exe	N/A
N/A	N/A	C:\Windows\System\pQtLNhA.exe	N/A
N/A	N/A	C:\Windows\System\ktkqxRP.exe	N/A
N/A	N/A	C:\Windows\System\IxhZQCw.exe	N/A
N/A	N/A	C:\Windows\System\mXHONnu.exe	N/A
N/A	N/A	C:\Windows\System\tdKFxtX.exe	N/A
N/A	N/A	C:\Windows\System\pnbwFIA.exe	N/A
N/A	N/A	C:\Windows\System\TdvlpmN.exe	N/A
N/A	N/A	C:\Windows\System\GGtUmMM.exe	N/A
N/A	N/A	C:\Windows\System\DYZWafw.exe	N/A
N/A	N/A	C:\Windows\System\CnTXdhr.exe	N/A
N/A	N/A	C:\Windows\System\uNZfysO.exe	N/A
N/A	N/A	C:\Windows\System\NnpsDSy.exe	N/A
N/A	N/A	C:\Windows\System\kUZjstF.exe	N/A
N/A	N/A	C:\Windows\System\URBMcqJ.exe	N/A
N/A	N/A	C:\Windows\System\oEyAceX.exe	N/A
N/A	N/A	C:\Windows\System\yFiphFf.exe	N/A
N/A	N/A	C:\Windows\System\SCCjdME.exe	N/A
N/A	N/A	C:\Windows\System\DOPyppK.exe	N/A
N/A	N/A	C:\Windows\System\qMIlkwP.exe	N/A
N/A	N/A	C:\Windows\System\QtgLklt.exe	N/A
N/A	N/A	C:\Windows\System\lZAmegQ.exe	N/A
N/A	N/A	C:\Windows\System\rCKNheS.exe	N/A
N/A	N/A	C:\Windows\System\ysDiwWC.exe	N/A
N/A	N/A	C:\Windows\System\SYOFjhB.exe	N/A
N/A	N/A	C:\Windows\System\LoSauLY.exe	N/A
N/A	N/A	C:\Windows\System\JMfwNlq.exe	N/A
N/A	N/A	C:\Windows\System\uYZSqQM.exe	N/A
N/A	N/A	C:\Windows\System\ZsScsrC.exe	N/A
N/A	N/A	C:\Windows\System\AQCeeQl.exe	N/A
N/A	N/A	C:\Windows\System\PlgNuyB.exe	N/A
N/A	N/A	C:\Windows\System\TcBegLc.exe	N/A
N/A	N/A	C:\Windows\System\xZTdJBv.exe	N/A
N/A	N/A	C:\Windows\System\qFqoHzv.exe	N/A
N/A	N/A	C:\Windows\System\vMLIROD.exe	N/A
N/A	N/A	C:\Windows\System\seJxvoN.exe	N/A
N/A	N/A	C:\Windows\System\nrVZroc.exe	N/A
N/A	N/A	C:\Windows\System\EFgqztf.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	raw.githubusercontent.com	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\System\nRJjLyS.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CtIMeBp.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iJLbZna.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gFBrIRa.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gugcCBJ.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JHBhdHH.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\gXuSzvq.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\eVeKYcc.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\uHdjfib.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\SkIZkla.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\kGZuGzm.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\psyNRGF.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pBDAnPz.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\lHwwWFw.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xUBZAwo.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\pLWPLJq.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jpmRCPv.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\TdvlpmN.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nrVZroc.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\wEKOZmJ.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\tJJsorp.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YpuAvwJ.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\Yvmrxuq.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\icYQPww.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KuoyaKF.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\nnCUqbF.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\sVYEiKO.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zsXghie.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ivUowHt.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xEFuqcQ.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\imjDIAL.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\LHRatmx.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\CpMNMoO.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\IOngfJj.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\mTuPytc.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\owpweWP.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\GJPmsKV.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\hoaXHel.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ECLMXVF.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\QJngLKB.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\qvWIcMu.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\WfZxuRX.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\AIvRasv.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\MirhAcN.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ovvLIMs.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\zapMOEg.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\jRHmFox.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ZPlXeZi.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BWHhrBU.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\vvRvOKC.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\YPYXpYw.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\bcNMTkd.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\drzGJbT.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\xLnoBoC.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\KaYviob.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\ClRKphc.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\raJDyfz.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\aDQEMYT.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\BNEGrRS.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\iKYGYzN.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\NUzGdiU.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\JqIovhg.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\DMOBwJr.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
File created	C:\Windows\System\piBYBRx.exe	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A

Checks SCSI registry key(s)

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	C:\Windows\system32\dwm.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	C:\Windows\system32\dwm.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	C:\Windows\system32\dwm.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	C:\Windows\system32\dwm.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	C:\Windows\system32\dwm.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	C:\Windows\system32\dwm.exe	N/A

Enumerates system info in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Windows\system32\dwm.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	C:\Windows\system32\dwm.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	C:\Windows\system32\dwm.exe	N/A
Key created	\REGISTRY\USER\.DEFAULT\Software	C:\Windows\system32\dwm.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious behavior: LoadsDriver

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	N/A
Token: SeCreateGlobalPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A
Token: SeChangeNotifyPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A
Token: 33	N/A	C:\Windows\system32\dwm.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A
Token: SeCreateGlobalPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A
Token: SeChangeNotifyPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A
Token: 33	N/A	C:\Windows\system32\dwm.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\system32\dwm.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2920 wrote to memory of 3412	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2920 wrote to memory of 3412	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2920 wrote to memory of 3248	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\GopTlmv.exe
PID 2920 wrote to memory of 3248	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\GopTlmv.exe
PID 2920 wrote to memory of 220	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\mSEBlcY.exe
PID 2920 wrote to memory of 220	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\mSEBlcY.exe
PID 2920 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\GLwpNus.exe
PID 2920 wrote to memory of 2124	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\GLwpNus.exe
PID 2920 wrote to memory of 4160	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\XjEmRCI.exe
PID 2920 wrote to memory of 4160	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\XjEmRCI.exe
PID 2920 wrote to memory of 1248	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\oBwrEce.exe
PID 2920 wrote to memory of 1248	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\oBwrEce.exe
PID 2920 wrote to memory of 436	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\TUzBDqi.exe
PID 2920 wrote to memory of 436	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\TUzBDqi.exe
PID 2920 wrote to memory of 2092	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\wyZdzOH.exe
PID 2920 wrote to memory of 2092	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\wyZdzOH.exe
PID 2920 wrote to memory of 1260	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\SzUEudP.exe
PID 2920 wrote to memory of 1260	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\SzUEudP.exe
PID 2920 wrote to memory of 1432	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\nIdVSCV.exe
PID 2920 wrote to memory of 1432	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\nIdVSCV.exe
PID 2920 wrote to memory of 368	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\ndlPHQC.exe
PID 2920 wrote to memory of 368	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\ndlPHQC.exe
PID 2920 wrote to memory of 4088	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\vSQBQXs.exe
PID 2920 wrote to memory of 4088	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\vSQBQXs.exe
PID 2920 wrote to memory of 3844	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\rGLYGSn.exe
PID 2920 wrote to memory of 3844	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\rGLYGSn.exe
PID 2920 wrote to memory of 3480	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\FMvwhxx.exe
PID 2920 wrote to memory of 3480	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\FMvwhxx.exe
PID 2920 wrote to memory of 1580	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\uOWPETo.exe
PID 2920 wrote to memory of 1580	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\uOWPETo.exe
PID 2920 wrote to memory of 4860	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\ZasOFcc.exe
PID 2920 wrote to memory of 4860	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\ZasOFcc.exe
PID 2920 wrote to memory of 1312	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\IPhmgnk.exe
PID 2920 wrote to memory of 1312	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\IPhmgnk.exe
PID 2920 wrote to memory of 2428	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\OWVysFT.exe
PID 2920 wrote to memory of 2428	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\OWVysFT.exe
PID 2920 wrote to memory of 3296	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\iGzHQWD.exe
PID 2920 wrote to memory of 3296	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\iGzHQWD.exe
PID 2920 wrote to memory of 4500	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\ydAQCTX.exe
PID 2920 wrote to memory of 4500	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\ydAQCTX.exe
PID 2920 wrote to memory of 5068	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\YPYXpYw.exe
PID 2920 wrote to memory of 5068	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\YPYXpYw.exe
PID 2920 wrote to memory of 4248	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\NbGYUtv.exe
PID 2920 wrote to memory of 4248	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\NbGYUtv.exe
PID 2920 wrote to memory of 2328	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\YMXXogq.exe
PID 2920 wrote to memory of 2328	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\YMXXogq.exe
PID 2920 wrote to memory of 1792	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\gMwLfiI.exe
PID 2920 wrote to memory of 1792	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\gMwLfiI.exe
PID 2920 wrote to memory of 1912	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\SehujBM.exe
PID 2920 wrote to memory of 1912	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\SehujBM.exe
PID 2920 wrote to memory of 456	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\uqXoeQq.exe
PID 2920 wrote to memory of 456	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\uqXoeQq.exe
PID 2920 wrote to memory of 1044	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\AnvnKaY.exe
PID 2920 wrote to memory of 1044	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\AnvnKaY.exe
PID 2920 wrote to memory of 3364	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\JtNdJZr.exe
PID 2920 wrote to memory of 3364	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\JtNdJZr.exe
PID 2920 wrote to memory of 4048	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\pQtLNhA.exe
PID 2920 wrote to memory of 4048	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\pQtLNhA.exe
PID 2920 wrote to memory of 2416	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\tdKFxtX.exe
PID 2920 wrote to memory of 2416	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\tdKFxtX.exe
PID 2920 wrote to memory of 4948	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\ktkqxRP.exe
PID 2920 wrote to memory of 4948	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\ktkqxRP.exe
PID 2920 wrote to memory of 4724	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\IxhZQCw.exe
PID 2920 wrote to memory of 4724	N/A	C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe	C:\Windows\System\IxhZQCw.exe

Processes

C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\82e428a98c0965bddce7743097911240_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\GopTlmv.exe

C:\Windows\System\GopTlmv.exe

C:\Windows\System\mSEBlcY.exe

C:\Windows\System\mSEBlcY.exe

C:\Windows\System\GLwpNus.exe

C:\Windows\System\GLwpNus.exe

C:\Windows\System\XjEmRCI.exe

C:\Windows\System\XjEmRCI.exe

C:\Windows\System\oBwrEce.exe

C:\Windows\System\oBwrEce.exe

C:\Windows\System\TUzBDqi.exe

C:\Windows\System\TUzBDqi.exe

C:\Windows\System\wyZdzOH.exe

C:\Windows\System\wyZdzOH.exe

C:\Windows\System\SzUEudP.exe

C:\Windows\System\SzUEudP.exe

C:\Windows\System\nIdVSCV.exe

C:\Windows\System\nIdVSCV.exe

C:\Windows\System\ndlPHQC.exe

C:\Windows\System\ndlPHQC.exe

C:\Windows\System\vSQBQXs.exe

C:\Windows\System\vSQBQXs.exe

C:\Windows\System\rGLYGSn.exe

C:\Windows\System\rGLYGSn.exe

C:\Windows\System\FMvwhxx.exe

C:\Windows\System\FMvwhxx.exe

C:\Windows\System\uOWPETo.exe

C:\Windows\System\uOWPETo.exe

C:\Windows\System\ZasOFcc.exe

C:\Windows\System\ZasOFcc.exe

C:\Windows\System\IPhmgnk.exe

C:\Windows\System\IPhmgnk.exe

C:\Windows\System\OWVysFT.exe

C:\Windows\System\OWVysFT.exe

C:\Windows\System\iGzHQWD.exe

C:\Windows\System\iGzHQWD.exe

C:\Windows\System\ydAQCTX.exe

C:\Windows\System\ydAQCTX.exe

C:\Windows\System\YPYXpYw.exe

C:\Windows\System\YPYXpYw.exe

C:\Windows\System\NbGYUtv.exe

C:\Windows\System\NbGYUtv.exe

C:\Windows\System\YMXXogq.exe

C:\Windows\System\YMXXogq.exe

C:\Windows\System\gMwLfiI.exe

C:\Windows\System\gMwLfiI.exe

C:\Windows\System\SehujBM.exe

C:\Windows\System\SehujBM.exe

C:\Windows\System\uqXoeQq.exe

C:\Windows\System\uqXoeQq.exe

C:\Windows\System\AnvnKaY.exe

C:\Windows\System\AnvnKaY.exe

C:\Windows\System\JtNdJZr.exe

C:\Windows\System\JtNdJZr.exe

C:\Windows\System\pQtLNhA.exe

C:\Windows\System\pQtLNhA.exe

C:\Windows\System\tdKFxtX.exe

C:\Windows\System\tdKFxtX.exe

C:\Windows\System\ktkqxRP.exe

C:\Windows\System\ktkqxRP.exe

C:\Windows\System\IxhZQCw.exe

C:\Windows\System\IxhZQCw.exe

C:\Windows\System\mXHONnu.exe

C:\Windows\System\mXHONnu.exe

C:\Windows\System\pnbwFIA.exe

C:\Windows\System\pnbwFIA.exe

C:\Windows\System\TdvlpmN.exe

C:\Windows\System\TdvlpmN.exe

C:\Windows\System\yFiphFf.exe

C:\Windows\System\yFiphFf.exe

C:\Windows\System\GGtUmMM.exe

C:\Windows\System\GGtUmMM.exe

C:\Windows\System\DYZWafw.exe

C:\Windows\System\DYZWafw.exe

C:\Windows\System\CnTXdhr.exe

C:\Windows\System\CnTXdhr.exe

C:\Windows\System\uNZfysO.exe

C:\Windows\System\uNZfysO.exe

C:\Windows\System\NnpsDSy.exe

C:\Windows\System\NnpsDSy.exe

C:\Windows\System\kUZjstF.exe

C:\Windows\System\kUZjstF.exe

C:\Windows\System\URBMcqJ.exe

C:\Windows\System\URBMcqJ.exe

C:\Windows\System\oEyAceX.exe

C:\Windows\System\oEyAceX.exe

C:\Windows\System\SCCjdME.exe

C:\Windows\System\SCCjdME.exe

C:\Windows\System\DOPyppK.exe

C:\Windows\System\DOPyppK.exe

C:\Windows\System\qMIlkwP.exe

C:\Windows\System\qMIlkwP.exe

C:\Windows\System\QtgLklt.exe

C:\Windows\System\QtgLklt.exe

C:\Windows\System\lZAmegQ.exe

C:\Windows\System\lZAmegQ.exe

C:\Windows\System\EFgqztf.exe

C:\Windows\System\EFgqztf.exe

C:\Windows\System\rCKNheS.exe

C:\Windows\System\rCKNheS.exe

C:\Windows\System\ysDiwWC.exe

C:\Windows\System\ysDiwWC.exe

C:\Windows\System\SYOFjhB.exe

C:\Windows\System\SYOFjhB.exe

C:\Windows\System\LoSauLY.exe

C:\Windows\System\LoSauLY.exe

C:\Windows\System\JMfwNlq.exe

C:\Windows\System\JMfwNlq.exe

C:\Windows\System\uYZSqQM.exe

C:\Windows\System\uYZSqQM.exe

C:\Windows\System\ZsScsrC.exe

C:\Windows\System\ZsScsrC.exe

C:\Windows\System\AQCeeQl.exe

C:\Windows\System\AQCeeQl.exe

C:\Windows\System\PlgNuyB.exe

C:\Windows\System\PlgNuyB.exe

C:\Windows\System\TcBegLc.exe

C:\Windows\System\TcBegLc.exe

C:\Windows\System\xZTdJBv.exe

C:\Windows\System\xZTdJBv.exe

C:\Windows\System\qFqoHzv.exe

C:\Windows\System\qFqoHzv.exe

C:\Windows\System\vMLIROD.exe

C:\Windows\System\vMLIROD.exe

C:\Windows\System\seJxvoN.exe

C:\Windows\System\seJxvoN.exe

C:\Windows\System\nrVZroc.exe

C:\Windows\System\nrVZroc.exe

C:\Windows\System\vUTXwHN.exe

C:\Windows\System\vUTXwHN.exe

C:\Windows\System\ZEDIjoc.exe

C:\Windows\System\ZEDIjoc.exe

C:\Windows\System\FmwFHRi.exe

C:\Windows\System\FmwFHRi.exe

C:\Windows\System\OoYysOx.exe

C:\Windows\System\OoYysOx.exe

C:\Windows\System\MNGTtqw.exe

C:\Windows\System\MNGTtqw.exe

C:\Windows\System\PBdzDcf.exe

C:\Windows\System\PBdzDcf.exe

C:\Windows\System\FTBicRO.exe

C:\Windows\System\FTBicRO.exe

C:\Windows\System\DqxxIEG.exe

C:\Windows\System\DqxxIEG.exe

C:\Windows\System\tkYyvgX.exe

C:\Windows\System\tkYyvgX.exe

C:\Windows\System\RhhRsNd.exe

C:\Windows\System\RhhRsNd.exe

C:\Windows\System\foPlVJM.exe

C:\Windows\System\foPlVJM.exe

C:\Windows\System\GQurDds.exe

C:\Windows\System\GQurDds.exe

C:\Windows\System\xdYHsFK.exe

C:\Windows\System\xdYHsFK.exe

C:\Windows\System\KThSRBI.exe

C:\Windows\System\KThSRBI.exe

C:\Windows\System\GaPZizt.exe

C:\Windows\System\GaPZizt.exe

C:\Windows\System\IXYOnvo.exe

C:\Windows\System\IXYOnvo.exe

C:\Windows\System\iaCHwzu.exe

C:\Windows\System\iaCHwzu.exe

C:\Windows\System\epAzqwK.exe

C:\Windows\System\epAzqwK.exe

C:\Windows\System\jazWGay.exe

C:\Windows\System\jazWGay.exe

C:\Windows\System\zewEPbg.exe

C:\Windows\System\zewEPbg.exe

C:\Windows\System\ResTsbV.exe

C:\Windows\System\ResTsbV.exe

C:\Windows\System\GecGgTt.exe

C:\Windows\System\GecGgTt.exe

C:\Windows\System\GjwIaTl.exe

C:\Windows\System\GjwIaTl.exe

C:\Windows\System\cWoQgyC.exe

C:\Windows\System\cWoQgyC.exe

C:\Windows\System\jMqJhkb.exe

C:\Windows\System\jMqJhkb.exe

C:\Windows\System\INxOoyI.exe

C:\Windows\System\INxOoyI.exe

C:\Windows\System\TErSDSs.exe

C:\Windows\System\TErSDSs.exe

C:\Windows\System\woAifWD.exe

C:\Windows\System\woAifWD.exe

C:\Windows\System\inEAErs.exe

C:\Windows\System\inEAErs.exe

C:\Windows\System\bkTpMey.exe

C:\Windows\System\bkTpMey.exe

C:\Windows\System\zmvEqBH.exe

C:\Windows\System\zmvEqBH.exe

C:\Windows\System\TnPqKos.exe

C:\Windows\System\TnPqKos.exe

C:\Windows\System\hdRmQla.exe

C:\Windows\System\hdRmQla.exe

C:\Windows\System\LoPDIrW.exe

C:\Windows\System\LoPDIrW.exe

C:\Windows\System\UfqbMSu.exe

C:\Windows\System\UfqbMSu.exe

C:\Windows\System\AZYmplK.exe

C:\Windows\System\AZYmplK.exe

C:\Windows\System\glyaSsG.exe

C:\Windows\System\glyaSsG.exe

C:\Windows\System\lPdDlTc.exe

C:\Windows\System\lPdDlTc.exe

C:\Windows\System\pDTndpw.exe

C:\Windows\System\pDTndpw.exe

C:\Windows\System\ybTgGWW.exe

C:\Windows\System\ybTgGWW.exe

C:\Windows\System\cFikMNe.exe

C:\Windows\System\cFikMNe.exe

C:\Windows\System\kqTDcmQ.exe

C:\Windows\System\kqTDcmQ.exe

C:\Windows\System\aDQEMYT.exe

C:\Windows\System\aDQEMYT.exe

C:\Windows\System\HJLMjFQ.exe

C:\Windows\System\HJLMjFQ.exe

C:\Windows\System\znVzyts.exe

C:\Windows\System\znVzyts.exe

C:\Windows\System\DHgCbwK.exe

C:\Windows\System\DHgCbwK.exe

C:\Windows\System\IwjYWzL.exe

C:\Windows\System\IwjYWzL.exe

C:\Windows\System\cyKfcXv.exe

C:\Windows\System\cyKfcXv.exe

C:\Windows\System\vQcELDn.exe

C:\Windows\System\vQcELDn.exe

C:\Windows\System\kyLmzgj.exe

C:\Windows\System\kyLmzgj.exe

C:\Windows\System\nmOKdtr.exe

C:\Windows\System\nmOKdtr.exe

C:\Windows\System\xVGoFce.exe

C:\Windows\System\xVGoFce.exe

C:\Windows\System\ZBLpZop.exe

C:\Windows\System\ZBLpZop.exe

C:\Windows\System\Tlcgekl.exe

C:\Windows\System\Tlcgekl.exe

C:\Windows\System\UrPbbrM.exe

C:\Windows\System\UrPbbrM.exe

C:\Windows\System\bcNMTkd.exe

C:\Windows\System\bcNMTkd.exe

C:\Windows\System\DKOnUuU.exe

C:\Windows\System\DKOnUuU.exe

C:\Windows\System\dMZJXVd.exe

C:\Windows\System\dMZJXVd.exe

C:\Windows\System\YlWjRfV.exe

C:\Windows\System\YlWjRfV.exe

C:\Windows\System\aScXiUx.exe

C:\Windows\System\aScXiUx.exe

C:\Windows\System\EzNJvRN.exe

C:\Windows\System\EzNJvRN.exe

C:\Windows\System\sfvHegM.exe

C:\Windows\System\sfvHegM.exe

C:\Windows\System\HBXWyfk.exe

C:\Windows\System\HBXWyfk.exe

C:\Windows\System\pFXsvry.exe

C:\Windows\System\pFXsvry.exe

C:\Windows\System\SpADHnw.exe

C:\Windows\System\SpADHnw.exe

C:\Windows\System\hvIQXWX.exe

C:\Windows\System\hvIQXWX.exe

C:\Windows\System\kgMBIXu.exe

C:\Windows\System\kgMBIXu.exe

C:\Windows\System\EFGxHDf.exe

C:\Windows\System\EFGxHDf.exe

C:\Windows\System\YAefpdG.exe

C:\Windows\System\YAefpdG.exe

C:\Windows\System\NFftzyu.exe

C:\Windows\System\NFftzyu.exe

C:\Windows\System\ZixOpUa.exe

C:\Windows\System\ZixOpUa.exe

C:\Windows\System\QNskxhv.exe

C:\Windows\System\QNskxhv.exe

C:\Windows\System\pyPFley.exe

C:\Windows\System\pyPFley.exe

C:\Windows\System\LBOEUgX.exe

C:\Windows\System\LBOEUgX.exe

C:\Windows\System\kloVdyA.exe

C:\Windows\System\kloVdyA.exe

C:\Windows\System\MApHTAC.exe

C:\Windows\System\MApHTAC.exe

C:\Windows\System\mOHaKGW.exe

C:\Windows\System\mOHaKGW.exe

C:\Windows\System\gXuSzvq.exe

C:\Windows\System\gXuSzvq.exe

C:\Windows\System\tQqUrJg.exe

C:\Windows\System\tQqUrJg.exe

C:\Windows\System\xnVflMK.exe

C:\Windows\System\xnVflMK.exe

C:\Windows\System\vnWldRO.exe

C:\Windows\System\vnWldRO.exe

C:\Windows\System\nMhHtLd.exe

C:\Windows\System\nMhHtLd.exe

C:\Windows\System\JcLcgzI.exe

C:\Windows\System\JcLcgzI.exe

C:\Windows\System\ZePxyPO.exe

C:\Windows\System\ZePxyPO.exe

C:\Windows\System\RZcqybJ.exe

C:\Windows\System\RZcqybJ.exe

C:\Windows\System\nasmBSE.exe

C:\Windows\System\nasmBSE.exe

C:\Windows\System\tcchloD.exe

C:\Windows\System\tcchloD.exe

C:\Windows\System\imjDIAL.exe

C:\Windows\System\imjDIAL.exe

C:\Windows\System\bbImljA.exe

C:\Windows\System\bbImljA.exe

C:\Windows\System\oiMWoTT.exe

C:\Windows\System\oiMWoTT.exe

C:\Windows\System\BoeErpF.exe

C:\Windows\System\BoeErpF.exe

C:\Windows\System\ZZHDyDg.exe

C:\Windows\System\ZZHDyDg.exe

C:\Windows\System\cEkchOw.exe

C:\Windows\System\cEkchOw.exe

C:\Windows\System\BNEGrRS.exe

C:\Windows\System\BNEGrRS.exe

C:\Windows\System\IEdedcu.exe

C:\Windows\System\IEdedcu.exe

C:\Windows\System\HvvxWSh.exe

C:\Windows\System\HvvxWSh.exe

C:\Windows\System\EJyanVS.exe

C:\Windows\System\EJyanVS.exe

C:\Windows\System\zqxddZS.exe

C:\Windows\System\zqxddZS.exe

C:\Windows\System\HafdicJ.exe

C:\Windows\System\HafdicJ.exe

C:\Windows\System\pJuGRNl.exe

C:\Windows\System\pJuGRNl.exe

C:\Windows\System\yGkbtik.exe

C:\Windows\System\yGkbtik.exe

C:\Windows\System\apSVdwD.exe

C:\Windows\System\apSVdwD.exe

C:\Windows\System\yjEqZuf.exe

C:\Windows\System\yjEqZuf.exe

C:\Windows\System\nKqFrzF.exe

C:\Windows\System\nKqFrzF.exe

C:\Windows\System\JEKbLIk.exe

C:\Windows\System\JEKbLIk.exe

C:\Windows\System\IADyrEm.exe

C:\Windows\System\IADyrEm.exe

C:\Windows\System\YyTonXr.exe

C:\Windows\System\YyTonXr.exe

C:\Windows\System\KKIcWCh.exe

C:\Windows\System\KKIcWCh.exe

C:\Windows\System\wQIFsoq.exe

C:\Windows\System\wQIFsoq.exe

C:\Windows\System\GTbWHXi.exe

C:\Windows\System\GTbWHXi.exe

C:\Windows\System\yhRUrde.exe

C:\Windows\System\yhRUrde.exe

C:\Windows\System\XwVElbN.exe

C:\Windows\System\XwVElbN.exe

C:\Windows\System\fQIEEUb.exe

C:\Windows\System\fQIEEUb.exe

C:\Windows\System\wBOpQcv.exe

C:\Windows\System\wBOpQcv.exe

C:\Windows\System\NnXPoHn.exe

C:\Windows\System\NnXPoHn.exe

C:\Windows\System\tQwaoHE.exe

C:\Windows\System\tQwaoHE.exe

C:\Windows\System\KmeAPzN.exe

C:\Windows\System\KmeAPzN.exe

C:\Windows\System\yggeHOd.exe

C:\Windows\System\yggeHOd.exe

C:\Windows\System\VQQatWI.exe

C:\Windows\System\VQQatWI.exe

C:\Windows\System\ZMqhkTQ.exe

C:\Windows\System\ZMqhkTQ.exe

C:\Windows\System\jyCGZTc.exe

C:\Windows\System\jyCGZTc.exe

C:\Windows\System\zzLpGJc.exe

C:\Windows\System\zzLpGJc.exe

C:\Windows\System\kCrtMsZ.exe

C:\Windows\System\kCrtMsZ.exe

C:\Windows\System\oBsozPI.exe

C:\Windows\System\oBsozPI.exe

C:\Windows\System\qExrxBb.exe

C:\Windows\System\qExrxBb.exe

C:\Windows\System\vlePHSG.exe

C:\Windows\System\vlePHSG.exe

C:\Windows\System\jKMNUlp.exe

C:\Windows\System\jKMNUlp.exe

C:\Windows\System\svOlqwm.exe

C:\Windows\System\svOlqwm.exe

C:\Windows\System\rwFoLEs.exe

C:\Windows\System\rwFoLEs.exe

C:\Windows\System\ZlOdNVt.exe

C:\Windows\System\ZlOdNVt.exe

C:\Windows\System\qXiJeua.exe

C:\Windows\System\qXiJeua.exe

C:\Windows\System\vhTyqvf.exe

C:\Windows\System\vhTyqvf.exe

C:\Windows\System\EeWMeWD.exe

C:\Windows\System\EeWMeWD.exe

C:\Windows\System\RSTAzHZ.exe

C:\Windows\System\RSTAzHZ.exe

C:\Windows\System\DXMobLr.exe

C:\Windows\System\DXMobLr.exe

C:\Windows\System\xsDjHwP.exe

C:\Windows\System\xsDjHwP.exe

C:\Windows\System\XasLfTu.exe

C:\Windows\System\XasLfTu.exe

C:\Windows\System\xYYrCZl.exe

C:\Windows\System\xYYrCZl.exe

C:\Windows\System\EWSOuvz.exe

C:\Windows\System\EWSOuvz.exe

C:\Windows\System\UCbzEzu.exe

C:\Windows\System\UCbzEzu.exe

C:\Windows\System\eCqbeNh.exe

C:\Windows\System\eCqbeNh.exe

C:\Windows\System\MEjSsBk.exe

C:\Windows\System\MEjSsBk.exe

C:\Windows\System\yoENZuX.exe

C:\Windows\System\yoENZuX.exe

C:\Windows\System\RuicIYj.exe

C:\Windows\System\RuicIYj.exe

C:\Windows\System\zWlHJOv.exe

C:\Windows\System\zWlHJOv.exe

C:\Windows\System\gTwvPXX.exe

C:\Windows\System\gTwvPXX.exe

C:\Windows\System\fxhfIpC.exe

C:\Windows\System\fxhfIpC.exe

C:\Windows\System\JotIwZt.exe

C:\Windows\System\JotIwZt.exe

C:\Windows\System\lIJvfsV.exe

C:\Windows\System\lIJvfsV.exe

C:\Windows\System\FnjGCgZ.exe

C:\Windows\System\FnjGCgZ.exe

C:\Windows\System\XCqgpQL.exe

C:\Windows\System\XCqgpQL.exe

C:\Windows\System\MBwiODb.exe

C:\Windows\System\MBwiODb.exe

C:\Windows\System\poNdpqD.exe

C:\Windows\System\poNdpqD.exe

C:\Windows\System\QDsiaqK.exe

C:\Windows\System\QDsiaqK.exe

C:\Windows\System\kWiuRhR.exe

C:\Windows\System\kWiuRhR.exe

C:\Windows\System\ZthgpoS.exe

C:\Windows\System\ZthgpoS.exe

C:\Windows\System\JOdgZSX.exe

C:\Windows\System\JOdgZSX.exe

C:\Windows\System\NXwGPRv.exe

C:\Windows\System\NXwGPRv.exe

C:\Windows\System\QklHIvH.exe

C:\Windows\System\QklHIvH.exe

C:\Windows\System\UexiAWR.exe

C:\Windows\System\UexiAWR.exe

C:\Windows\System\IKmNDRW.exe

C:\Windows\System\IKmNDRW.exe

C:\Windows\System\DDjswBy.exe

C:\Windows\System\DDjswBy.exe

C:\Windows\System\CEmctEm.exe

C:\Windows\System\CEmctEm.exe

C:\Windows\System\fASFMZd.exe

C:\Windows\System\fASFMZd.exe

C:\Windows\System\YyzoSqM.exe

C:\Windows\System\YyzoSqM.exe

C:\Windows\System\RpWSROr.exe

C:\Windows\System\RpWSROr.exe

C:\Windows\System\VdoAcqC.exe

C:\Windows\System\VdoAcqC.exe

C:\Windows\System\YoGmvOe.exe

C:\Windows\System\YoGmvOe.exe

C:\Windows\System\cYNsbvH.exe

C:\Windows\System\cYNsbvH.exe

C:\Windows\System\gRPZoTD.exe

C:\Windows\System\gRPZoTD.exe

C:\Windows\System\nNgSHrV.exe

C:\Windows\System\nNgSHrV.exe

C:\Windows\System\TNPHBnj.exe

C:\Windows\System\TNPHBnj.exe

C:\Windows\System\BwcQZwr.exe

C:\Windows\System\BwcQZwr.exe

C:\Windows\System\IVRdSHM.exe

C:\Windows\System\IVRdSHM.exe

C:\Windows\System\SnqmluG.exe

C:\Windows\System\SnqmluG.exe

C:\Windows\System\JhZpXmm.exe

C:\Windows\System\JhZpXmm.exe

C:\Windows\System\iCSmgRR.exe

C:\Windows\System\iCSmgRR.exe

C:\Windows\System\xQxkSBn.exe

C:\Windows\System\xQxkSBn.exe

C:\Windows\System\TcNAhGi.exe

C:\Windows\System\TcNAhGi.exe

C:\Windows\System\ghyqOac.exe

C:\Windows\System\ghyqOac.exe

C:\Windows\System\omNdyHM.exe

C:\Windows\System\omNdyHM.exe

C:\Windows\System\IoLLocb.exe

C:\Windows\System\IoLLocb.exe

C:\Windows\System\DrIVSwe.exe

C:\Windows\System\DrIVSwe.exe

C:\Windows\System\XfLqXAa.exe

C:\Windows\System\XfLqXAa.exe

C:\Windows\System\CQplPIJ.exe

C:\Windows\System\CQplPIJ.exe

C:\Windows\System\JOlavzZ.exe

C:\Windows\System\JOlavzZ.exe

C:\Windows\System\FfqTVPY.exe

C:\Windows\System\FfqTVPY.exe

C:\Windows\System\chcrkxA.exe

C:\Windows\System\chcrkxA.exe

C:\Windows\System\bVyulmv.exe

C:\Windows\System\bVyulmv.exe

C:\Windows\System\fQoLpvO.exe

C:\Windows\System\fQoLpvO.exe

C:\Windows\System\qBwnXIe.exe

C:\Windows\System\qBwnXIe.exe

C:\Windows\System\zsXmfHi.exe

C:\Windows\System\zsXmfHi.exe

C:\Windows\System\OMUtLXF.exe

C:\Windows\System\OMUtLXF.exe

C:\Windows\System\pakaaWO.exe

C:\Windows\System\pakaaWO.exe

C:\Windows\System\dgxDfOJ.exe

C:\Windows\System\dgxDfOJ.exe

C:\Windows\System\pykqdKU.exe

C:\Windows\System\pykqdKU.exe

C:\Windows\System\wNQamtf.exe

C:\Windows\System\wNQamtf.exe

C:\Windows\System\HoTPnQB.exe

C:\Windows\System\HoTPnQB.exe

C:\Windows\System\nRSVMNl.exe

C:\Windows\System\nRSVMNl.exe

C:\Windows\System\yKIDLUD.exe

C:\Windows\System\yKIDLUD.exe

C:\Windows\System\kngQZkk.exe

C:\Windows\System\kngQZkk.exe

C:\Windows\System\sbXLVHt.exe

C:\Windows\System\sbXLVHt.exe

C:\Windows\System\JntAerd.exe

C:\Windows\System\JntAerd.exe

C:\Windows\System\CSIBFBD.exe

C:\Windows\System\CSIBFBD.exe

C:\Windows\System\buWAnKv.exe

C:\Windows\System\buWAnKv.exe

C:\Windows\System\imLMZuw.exe

C:\Windows\System\imLMZuw.exe

C:\Windows\System\JttAjoU.exe

C:\Windows\System\JttAjoU.exe

C:\Windows\System\atUqSxI.exe

C:\Windows\System\atUqSxI.exe

C:\Windows\System\lPnrSia.exe

C:\Windows\System\lPnrSia.exe

C:\Windows\System\xmEpzWf.exe

C:\Windows\System\xmEpzWf.exe

C:\Windows\System\xyTyyBz.exe

C:\Windows\System\xyTyyBz.exe

C:\Windows\System\LHXymQV.exe

C:\Windows\System\LHXymQV.exe

C:\Windows\System\FaLHdkA.exe

C:\Windows\System\FaLHdkA.exe

C:\Windows\System\uayMAin.exe

C:\Windows\System\uayMAin.exe

C:\Windows\System\uNUuwon.exe

C:\Windows\System\uNUuwon.exe

C:\Windows\System\qtGuKdz.exe

C:\Windows\System\qtGuKdz.exe

C:\Windows\System\NndyEJn.exe

C:\Windows\System\NndyEJn.exe

C:\Windows\System\dQWYmPv.exe

C:\Windows\System\dQWYmPv.exe

C:\Windows\System\bxXRJbb.exe

C:\Windows\System\bxXRJbb.exe

C:\Windows\System\yplWsgp.exe

C:\Windows\System\yplWsgp.exe

C:\Windows\System\zzXxWIF.exe

C:\Windows\System\zzXxWIF.exe

C:\Windows\System\jnoBCcV.exe

C:\Windows\System\jnoBCcV.exe

C:\Windows\System\dedCeFl.exe

C:\Windows\System\dedCeFl.exe

C:\Windows\System\xxcbsbF.exe

C:\Windows\System\xxcbsbF.exe

C:\Windows\System\uphPGps.exe

C:\Windows\System\uphPGps.exe

C:\Windows\System\PBezGbI.exe

C:\Windows\System\PBezGbI.exe

C:\Windows\System\lxVEjFO.exe

C:\Windows\System\lxVEjFO.exe

C:\Windows\System\kLXqrMm.exe

C:\Windows\System\kLXqrMm.exe

C:\Windows\System\SGMWNMc.exe

C:\Windows\System\SGMWNMc.exe

C:\Windows\System\TrSaJuI.exe

C:\Windows\System\TrSaJuI.exe

C:\Windows\System\OIUYYqP.exe

C:\Windows\System\OIUYYqP.exe

C:\Windows\System\FmfIkrY.exe

C:\Windows\System\FmfIkrY.exe

C:\Windows\System\OSrUzuv.exe

C:\Windows\System\OSrUzuv.exe

C:\Windows\System\UdJJKUX.exe

C:\Windows\System\UdJJKUX.exe

C:\Windows\System\CPlUOCP.exe

C:\Windows\System\CPlUOCP.exe

C:\Windows\System\WRetwfu.exe

C:\Windows\System\WRetwfu.exe

C:\Windows\System\yEZzkxG.exe

C:\Windows\System\yEZzkxG.exe

C:\Windows\System\LUfWOuW.exe

C:\Windows\System\LUfWOuW.exe

C:\Windows\System\EDbfnfk.exe

C:\Windows\System\EDbfnfk.exe

C:\Windows\System\AauEQtq.exe

C:\Windows\System\AauEQtq.exe

C:\Windows\System\XGEolSc.exe

C:\Windows\System\XGEolSc.exe

C:\Windows\System\myyvLMh.exe

C:\Windows\System\myyvLMh.exe

C:\Windows\System\ZFoOUfg.exe

C:\Windows\System\ZFoOUfg.exe

C:\Windows\System\tffBYUo.exe

C:\Windows\System\tffBYUo.exe

C:\Windows\System\XahukdL.exe

C:\Windows\System\XahukdL.exe

C:\Windows\System\Yehilql.exe

C:\Windows\System\Yehilql.exe

C:\Windows\System\MYLqgmm.exe

C:\Windows\System\MYLqgmm.exe

C:\Windows\System\FqJVMCX.exe

C:\Windows\System\FqJVMCX.exe

C:\Windows\System\DYGVNBk.exe

C:\Windows\System\DYGVNBk.exe

C:\Windows\System\nRJjLyS.exe

C:\Windows\System\nRJjLyS.exe

C:\Windows\System\inOiUsH.exe

C:\Windows\System\inOiUsH.exe

C:\Windows\System\DmqpVjG.exe

C:\Windows\System\DmqpVjG.exe

C:\Windows\System\RqZJQJn.exe

C:\Windows\System\RqZJQJn.exe

C:\Windows\System\KBRhGMj.exe

C:\Windows\System\KBRhGMj.exe

C:\Windows\System\KGEzuux.exe

C:\Windows\System\KGEzuux.exe

C:\Windows\System\GRUzuHF.exe

C:\Windows\System\GRUzuHF.exe

C:\Windows\System\oOrjSPf.exe

C:\Windows\System\oOrjSPf.exe

C:\Windows\System\pnQDsMO.exe

C:\Windows\System\pnQDsMO.exe

C:\Windows\System\YeqxOQn.exe

C:\Windows\System\YeqxOQn.exe

C:\Windows\System\IMTldWO.exe

C:\Windows\System\IMTldWO.exe

C:\Windows\System\oLTAUOK.exe

C:\Windows\System\oLTAUOK.exe

C:\Windows\System\cIioLlP.exe

C:\Windows\System\cIioLlP.exe

C:\Windows\System\JZDVSyo.exe

C:\Windows\System\JZDVSyo.exe

C:\Windows\System\LoprahR.exe

C:\Windows\System\LoprahR.exe

C:\Windows\System\qmIMfhX.exe

C:\Windows\System\qmIMfhX.exe

C:\Windows\System\apckXjd.exe

C:\Windows\System\apckXjd.exe

C:\Windows\System\anJOkcS.exe

C:\Windows\System\anJOkcS.exe

C:\Windows\System\WbBWrvw.exe

C:\Windows\System\WbBWrvw.exe

C:\Windows\System\MlotTpE.exe

C:\Windows\System\MlotTpE.exe

C:\Windows\System\nWusbTF.exe

C:\Windows\System\nWusbTF.exe

C:\Windows\System\iQZSBNe.exe

C:\Windows\System\iQZSBNe.exe

C:\Windows\System\XskRprI.exe

C:\Windows\System\XskRprI.exe

C:\Windows\System\lKdFazx.exe

C:\Windows\System\lKdFazx.exe

C:\Windows\System\GomvYFj.exe

C:\Windows\System\GomvYFj.exe

C:\Windows\System\zuXGPLm.exe

C:\Windows\System\zuXGPLm.exe

C:\Windows\System\TwrWVGe.exe

C:\Windows\System\TwrWVGe.exe

C:\Windows\System\REKVupy.exe

C:\Windows\System\REKVupy.exe

C:\Windows\System\RDftlwh.exe

C:\Windows\System\RDftlwh.exe

C:\Windows\System\cqFWoYZ.exe

C:\Windows\System\cqFWoYZ.exe

C:\Windows\System\YjRCYQB.exe

C:\Windows\System\YjRCYQB.exe

C:\Windows\System\HzdmYMU.exe

C:\Windows\System\HzdmYMU.exe

C:\Windows\System\VswFdVo.exe

C:\Windows\System\VswFdVo.exe

C:\Windows\System\hjeUPzd.exe

C:\Windows\System\hjeUPzd.exe

C:\Windows\System\yoRIQgR.exe

C:\Windows\System\yoRIQgR.exe

C:\Windows\System\JTtLugi.exe

C:\Windows\System\JTtLugi.exe

C:\Windows\System\zNXaeTo.exe

C:\Windows\System\zNXaeTo.exe

C:\Windows\System\RVQQNPY.exe

C:\Windows\System\RVQQNPY.exe

C:\Windows\System\iPQxWCj.exe

C:\Windows\System\iPQxWCj.exe

C:\Windows\System\LSDDOgT.exe

C:\Windows\System\LSDDOgT.exe

C:\Windows\System\zuzXxGa.exe

C:\Windows\System\zuzXxGa.exe

C:\Windows\System\gOGYHcC.exe

C:\Windows\System\gOGYHcC.exe

C:\Windows\System\SVCeDnl.exe

C:\Windows\System\SVCeDnl.exe

C:\Windows\System\lKtcuHD.exe

C:\Windows\System\lKtcuHD.exe

C:\Windows\System\GqcMpXW.exe

C:\Windows\System\GqcMpXW.exe

C:\Windows\System\hoaXHel.exe

C:\Windows\System\hoaXHel.exe

C:\Windows\System\KsyXoSA.exe

C:\Windows\System\KsyXoSA.exe

C:\Windows\System\Niofrlc.exe

C:\Windows\System\Niofrlc.exe

C:\Windows\System\NusOHbP.exe

C:\Windows\System\NusOHbP.exe

C:\Windows\System\JVwirKr.exe

C:\Windows\System\JVwirKr.exe

C:\Windows\System\LTYJEvu.exe

C:\Windows\System\LTYJEvu.exe

C:\Windows\System\fbjvlEJ.exe

C:\Windows\System\fbjvlEJ.exe

C:\Windows\System\xZrWZJm.exe

C:\Windows\System\xZrWZJm.exe

C:\Windows\System\sRfPBQC.exe

C:\Windows\System\sRfPBQC.exe

C:\Windows\System\jCQWSHV.exe

C:\Windows\System\jCQWSHV.exe

C:\Windows\System\qDFbOyc.exe

C:\Windows\System\qDFbOyc.exe

C:\Windows\System\wwsPmlS.exe

C:\Windows\System\wwsPmlS.exe

C:\Windows\System\XtQsWZp.exe

C:\Windows\System\XtQsWZp.exe

C:\Windows\System\pXDPPqi.exe

C:\Windows\System\pXDPPqi.exe

C:\Windows\System\VqfPrRU.exe

C:\Windows\System\VqfPrRU.exe

C:\Windows\System\yxmQPbo.exe

C:\Windows\System\yxmQPbo.exe

C:\Windows\System\jGBpFDu.exe

C:\Windows\System\jGBpFDu.exe

C:\Windows\System\TRRLDmK.exe

C:\Windows\System\TRRLDmK.exe

C:\Windows\System\etLlnFD.exe

C:\Windows\System\etLlnFD.exe

C:\Windows\System\WPzdgbX.exe

C:\Windows\System\WPzdgbX.exe

C:\Windows\System\iHraaTo.exe

C:\Windows\System\iHraaTo.exe

C:\Windows\System\weoubZg.exe

C:\Windows\System\weoubZg.exe

C:\Windows\System\nWMxAqx.exe

C:\Windows\System\nWMxAqx.exe

C:\Windows\System\HfVpswR.exe

C:\Windows\System\HfVpswR.exe

C:\Windows\System\NUizdLQ.exe

C:\Windows\System\NUizdLQ.exe

C:\Windows\System\BBCpXhb.exe

C:\Windows\System\BBCpXhb.exe

C:\Windows\System\wWIxWmz.exe

C:\Windows\System\wWIxWmz.exe

C:\Windows\System\tQJugwN.exe

C:\Windows\System\tQJugwN.exe

C:\Windows\System\bffXjQc.exe

C:\Windows\System\bffXjQc.exe

C:\Windows\System\eVeKYcc.exe

C:\Windows\System\eVeKYcc.exe

C:\Windows\System\IYCnlsd.exe

C:\Windows\System\IYCnlsd.exe

C:\Windows\System\magYAxa.exe

C:\Windows\System\magYAxa.exe

C:\Windows\System\SSnTQkF.exe

C:\Windows\System\SSnTQkF.exe

C:\Windows\System\MiMMXpn.exe

C:\Windows\System\MiMMXpn.exe

C:\Windows\System\rznetpf.exe

C:\Windows\System\rznetpf.exe

C:\Windows\System\cjtVjxE.exe

C:\Windows\System\cjtVjxE.exe

C:\Windows\System\LyexArb.exe

C:\Windows\System\LyexArb.exe

C:\Windows\System\UWsZIpf.exe

C:\Windows\System\UWsZIpf.exe

C:\Windows\System\VRnnCpx.exe

C:\Windows\System\VRnnCpx.exe

C:\Windows\System\tIUcVrv.exe

C:\Windows\System\tIUcVrv.exe

C:\Windows\System\iwIDLxx.exe

C:\Windows\System\iwIDLxx.exe

C:\Windows\System\kmVEXwf.exe

C:\Windows\System\kmVEXwf.exe

C:\Windows\System\TqhKfrq.exe

C:\Windows\System\TqhKfrq.exe

C:\Windows\System\bukVQzq.exe

C:\Windows\System\bukVQzq.exe

C:\Windows\System\panzxyR.exe

C:\Windows\System\panzxyR.exe

C:\Windows\System\inSFHcE.exe

C:\Windows\System\inSFHcE.exe

C:\Windows\System\WteHELn.exe

C:\Windows\System\WteHELn.exe

C:\Windows\System\CtIMeBp.exe

C:\Windows\System\CtIMeBp.exe

C:\Windows\System\MhQtIjQ.exe

C:\Windows\System\MhQtIjQ.exe

C:\Windows\System\POlbRZL.exe

C:\Windows\System\POlbRZL.exe

C:\Windows\System\ftjpVyu.exe

C:\Windows\System\ftjpVyu.exe

C:\Windows\System\VcQoZBH.exe

C:\Windows\System\VcQoZBH.exe

C:\Windows\System\kQRggIu.exe

C:\Windows\System\kQRggIu.exe

C:\Windows\System\MIdInXK.exe

C:\Windows\System\MIdInXK.exe

C:\Windows\System\rnSRkOS.exe

C:\Windows\System\rnSRkOS.exe

C:\Windows\System\NMViFZl.exe

C:\Windows\System\NMViFZl.exe

C:\Windows\System\TumEgQc.exe

C:\Windows\System\TumEgQc.exe

C:\Windows\System\LVxPqPx.exe

C:\Windows\System\LVxPqPx.exe

C:\Windows\System\ipIiWvP.exe

C:\Windows\System\ipIiWvP.exe

C:\Windows\System\vaksuXb.exe

C:\Windows\System\vaksuXb.exe

C:\Windows\System\zbslhNZ.exe

C:\Windows\System\zbslhNZ.exe

C:\Windows\System\bgkBeiY.exe

C:\Windows\System\bgkBeiY.exe

C:\Windows\System\fNrnNMc.exe

C:\Windows\System\fNrnNMc.exe

C:\Windows\System\kGZuGzm.exe

C:\Windows\System\kGZuGzm.exe

C:\Windows\System\HnchfJE.exe

C:\Windows\System\HnchfJE.exe

C:\Windows\System\YZZqSOf.exe

C:\Windows\System\YZZqSOf.exe

C:\Windows\System\bMxFvrW.exe

C:\Windows\System\bMxFvrW.exe

C:\Windows\System\FBAsKTZ.exe

C:\Windows\System\FBAsKTZ.exe

C:\Windows\System\YjcpGbj.exe

C:\Windows\System\YjcpGbj.exe

C:\Windows\System\uHdjfib.exe

C:\Windows\System\uHdjfib.exe

C:\Windows\System\gSnTNJD.exe

C:\Windows\System\gSnTNJD.exe

C:\Windows\System\QkvddXm.exe

C:\Windows\System\QkvddXm.exe

C:\Windows\System\nIJJHIx.exe

C:\Windows\System\nIJJHIx.exe

C:\Windows\System\qHnyjOc.exe

C:\Windows\System\qHnyjOc.exe

C:\Windows\System\sGtKzOO.exe

C:\Windows\System\sGtKzOO.exe

C:\Windows\System\pBDAnPz.exe

C:\Windows\System\pBDAnPz.exe

C:\Windows\System\dFlbtxS.exe

C:\Windows\System\dFlbtxS.exe

C:\Windows\System\eYWrpgd.exe

C:\Windows\System\eYWrpgd.exe

C:\Windows\System\fVCKFiF.exe

C:\Windows\System\fVCKFiF.exe

C:\Windows\System\iOWJgIh.exe

C:\Windows\System\iOWJgIh.exe

C:\Windows\System\AFesTQL.exe

C:\Windows\System\AFesTQL.exe

C:\Windows\System\SnSbVQq.exe

C:\Windows\System\SnSbVQq.exe

C:\Windows\System\MccHppU.exe

C:\Windows\System\MccHppU.exe

C:\Windows\System\cFZUgaO.exe

C:\Windows\System\cFZUgaO.exe

C:\Windows\System\LHRatmx.exe

C:\Windows\System\LHRatmx.exe

C:\Windows\System\DPQJIms.exe

C:\Windows\System\DPQJIms.exe

C:\Windows\System\tKNiPMb.exe

C:\Windows\System\tKNiPMb.exe

C:\Windows\System\OThAKJI.exe

C:\Windows\System\OThAKJI.exe

C:\Windows\System\GHIgslt.exe

C:\Windows\System\GHIgslt.exe

C:\Windows\System\YpuAvwJ.exe

C:\Windows\System\YpuAvwJ.exe

C:\Windows\System\hjtFqgj.exe

C:\Windows\System\hjtFqgj.exe

C:\Windows\System\lhwNPOH.exe

C:\Windows\System\lhwNPOH.exe

C:\Windows\System\voxOShA.exe

C:\Windows\System\voxOShA.exe

C:\Windows\System\iKYGYzN.exe

C:\Windows\System\iKYGYzN.exe

C:\Windows\System\dBwqrnq.exe

C:\Windows\System\dBwqrnq.exe

C:\Windows\System\TqFGYFS.exe

C:\Windows\System\TqFGYFS.exe

C:\Windows\System\YFikxdL.exe

C:\Windows\System\YFikxdL.exe

C:\Windows\System\mLAtKJI.exe

C:\Windows\System\mLAtKJI.exe

C:\Windows\System\uNpPbtP.exe

C:\Windows\System\uNpPbtP.exe

C:\Windows\System\bJsTZsq.exe

C:\Windows\System\bJsTZsq.exe

C:\Windows\System\wKkMKvO.exe

C:\Windows\System\wKkMKvO.exe

C:\Windows\System\BOqPZaf.exe

C:\Windows\System\BOqPZaf.exe

C:\Windows\System\nETaCqI.exe

C:\Windows\System\nETaCqI.exe

C:\Windows\System\iMBySrv.exe

C:\Windows\System\iMBySrv.exe

C:\Windows\System\LqWjZBd.exe

C:\Windows\System\LqWjZBd.exe

C:\Windows\System\FQPEjhd.exe

C:\Windows\System\FQPEjhd.exe

C:\Windows\System\PndCEmA.exe

C:\Windows\System\PndCEmA.exe

C:\Windows\System\JLTIruM.exe

C:\Windows\System\JLTIruM.exe

C:\Windows\System\fipIGzX.exe

C:\Windows\System\fipIGzX.exe

C:\Windows\System\aXtPytg.exe

C:\Windows\System\aXtPytg.exe

C:\Windows\System\iCfplbT.exe

C:\Windows\System\iCfplbT.exe

C:\Windows\System\BpYOwFX.exe

C:\Windows\System\BpYOwFX.exe

C:\Windows\System\CSTmPWE.exe

C:\Windows\System\CSTmPWE.exe

C:\Windows\System\ZUKdrbH.exe

C:\Windows\System\ZUKdrbH.exe

C:\Windows\System\BBxrdQN.exe

C:\Windows\System\BBxrdQN.exe

C:\Windows\System\WsZeMfC.exe

C:\Windows\System\WsZeMfC.exe

C:\Windows\System\nyGNyXP.exe

C:\Windows\System\nyGNyXP.exe

C:\Windows\System\ISPbCCY.exe

C:\Windows\System\ISPbCCY.exe

C:\Windows\System\KTvQvFp.exe

C:\Windows\System\KTvQvFp.exe

C:\Windows\System\FJWBdPu.exe

C:\Windows\System\FJWBdPu.exe

C:\Windows\System\rUbnrBC.exe

C:\Windows\System\rUbnrBC.exe

C:\Windows\System\YbnCRli.exe

C:\Windows\System\YbnCRli.exe

C:\Windows\System\yxAfOGc.exe

C:\Windows\System\yxAfOGc.exe

C:\Windows\System\Azzhmir.exe

C:\Windows\System\Azzhmir.exe

C:\Windows\System\SUrztzH.exe

C:\Windows\System\SUrztzH.exe

C:\Windows\System\KBtSCoJ.exe

C:\Windows\System\KBtSCoJ.exe

C:\Windows\System\ykHLSat.exe

C:\Windows\System\ykHLSat.exe

C:\Windows\System\MtGhmHK.exe

C:\Windows\System\MtGhmHK.exe

C:\Windows\System\mDZxjcc.exe

C:\Windows\System\mDZxjcc.exe

C:\Windows\System\NCWWivN.exe

C:\Windows\System\NCWWivN.exe

C:\Windows\System\rnAFQYy.exe

C:\Windows\System\rnAFQYy.exe

C:\Windows\System\iddyIBL.exe

C:\Windows\System\iddyIBL.exe

C:\Windows\System\bUdFvuy.exe

C:\Windows\System\bUdFvuy.exe

C:\Windows\System\AQtJXFG.exe

C:\Windows\System\AQtJXFG.exe

C:\Windows\System\VFDwiEw.exe

C:\Windows\System\VFDwiEw.exe

C:\Windows\System\mAWetJE.exe

C:\Windows\System\mAWetJE.exe

C:\Windows\System\TtvGxgy.exe

C:\Windows\System\TtvGxgy.exe

C:\Windows\System\KuoyaKF.exe

C:\Windows\System\KuoyaKF.exe

C:\Windows\System\LmIbINo.exe

C:\Windows\System\LmIbINo.exe

C:\Windows\System\uenueDD.exe

C:\Windows\System\uenueDD.exe

C:\Windows\System\XEDfLnS.exe

C:\Windows\System\XEDfLnS.exe

C:\Windows\System\eEYWoNB.exe

C:\Windows\System\eEYWoNB.exe

C:\Windows\System\ysihBFV.exe

C:\Windows\System\ysihBFV.exe

C:\Windows\System\cZaAyBj.exe

C:\Windows\System\cZaAyBj.exe

C:\Windows\System\LTDlRVi.exe

C:\Windows\System\LTDlRVi.exe

C:\Windows\System\EZjDUPA.exe

C:\Windows\System\EZjDUPA.exe

C:\Windows\System\jsDMgJK.exe

C:\Windows\System\jsDMgJK.exe

C:\Windows\System\PmkDVHM.exe

C:\Windows\System\PmkDVHM.exe

C:\Windows\System\dCAzXsc.exe

C:\Windows\System\dCAzXsc.exe

C:\Windows\System\odETWDp.exe

C:\Windows\System\odETWDp.exe

C:\Windows\System\QKHHgcU.exe

C:\Windows\System\QKHHgcU.exe

C:\Windows\System\khvaocE.exe

C:\Windows\System\khvaocE.exe

C:\Windows\System\pAIhjCj.exe

C:\Windows\System\pAIhjCj.exe

C:\Windows\System\DwTrkpB.exe

C:\Windows\System\DwTrkpB.exe

C:\Windows\System\NSdYiTJ.exe

C:\Windows\System\NSdYiTJ.exe

C:\Windows\System\ixLooJd.exe

C:\Windows\System\ixLooJd.exe

C:\Windows\System\SEluPQk.exe

C:\Windows\System\SEluPQk.exe

C:\Windows\System\gqlxgJC.exe

C:\Windows\System\gqlxgJC.exe

C:\Windows\System\RaeGftj.exe

C:\Windows\System\RaeGftj.exe

C:\Windows\System\WLxPtob.exe

C:\Windows\System\WLxPtob.exe

C:\Windows\System\Jmwkrlp.exe

C:\Windows\System\Jmwkrlp.exe

C:\Windows\System\DItfvkI.exe

C:\Windows\System\DItfvkI.exe

C:\Windows\System\KVqelEJ.exe

C:\Windows\System\KVqelEJ.exe

C:\Windows\System\qandRFb.exe

C:\Windows\System\qandRFb.exe

C:\Windows\System\NposGVs.exe

C:\Windows\System\NposGVs.exe

C:\Windows\System\zUUozrk.exe

C:\Windows\System\zUUozrk.exe

C:\Windows\System\gakJkqL.exe

C:\Windows\System\gakJkqL.exe

C:\Windows\System\NBNWYfT.exe

C:\Windows\System\NBNWYfT.exe

C:\Windows\System\bqIxfhy.exe

C:\Windows\System\bqIxfhy.exe

C:\Windows\System\LNKNFVa.exe

C:\Windows\System\LNKNFVa.exe

C:\Windows\System\mLrhtpP.exe

C:\Windows\System\mLrhtpP.exe

C:\Windows\System\KscAXze.exe

C:\Windows\System\KscAXze.exe

C:\Windows\System\WFUOMdk.exe

C:\Windows\System\WFUOMdk.exe

C:\Windows\System\ZdbHZiM.exe

C:\Windows\System\ZdbHZiM.exe

C:\Windows\System\XDegAVy.exe

C:\Windows\System\XDegAVy.exe

C:\Windows\System\jjjLCSF.exe

C:\Windows\System\jjjLCSF.exe

C:\Windows\System\WUliAsh.exe

C:\Windows\System\WUliAsh.exe

C:\Windows\System\kWxHTTv.exe

C:\Windows\System\kWxHTTv.exe

C:\Windows\System\NOSTdty.exe

C:\Windows\System\NOSTdty.exe

C:\Windows\System\nrXewag.exe

C:\Windows\System\nrXewag.exe

C:\Windows\System\bHsqLzG.exe

C:\Windows\System\bHsqLzG.exe

C:\Windows\System\iZIMilL.exe

C:\Windows\System\iZIMilL.exe

C:\Windows\System\sWlzxFw.exe

C:\Windows\System\sWlzxFw.exe

C:\Windows\System\bLeSVBp.exe

C:\Windows\System\bLeSVBp.exe

C:\Windows\System\VQrZfqs.exe

C:\Windows\System\VQrZfqs.exe

C:\Windows\System\iJWuNxK.exe

C:\Windows\System\iJWuNxK.exe

C:\Windows\System\laQfmMO.exe

C:\Windows\System\laQfmMO.exe

C:\Windows\System\oHXHcKO.exe

C:\Windows\System\oHXHcKO.exe

C:\Windows\System\WIzVrHc.exe

C:\Windows\System\WIzVrHc.exe

C:\Windows\System\rPqyyqb.exe

C:\Windows\System\rPqyyqb.exe

C:\Windows\System\UDkHCeq.exe

C:\Windows\System\UDkHCeq.exe

C:\Windows\System\ehqbTik.exe

C:\Windows\System\ehqbTik.exe

C:\Windows\System\skQwHCa.exe

C:\Windows\System\skQwHCa.exe

C:\Windows\System\zjvyQjD.exe

C:\Windows\System\zjvyQjD.exe

C:\Windows\System\BrTrUuS.exe

C:\Windows\System\BrTrUuS.exe

C:\Windows\System\XErdjpz.exe

C:\Windows\System\XErdjpz.exe

C:\Windows\System\OJDuGDU.exe

C:\Windows\System\OJDuGDU.exe

C:\Windows\System\rGsZOIi.exe

C:\Windows\System\rGsZOIi.exe

C:\Windows\System\TfFSBEk.exe

C:\Windows\System\TfFSBEk.exe

C:\Windows\System\GGsaBaX.exe

C:\Windows\System\GGsaBaX.exe

C:\Windows\System\WEsBzkY.exe

C:\Windows\System\WEsBzkY.exe

C:\Windows\System\xGRzfZy.exe

C:\Windows\System\xGRzfZy.exe

C:\Windows\System\swGHhEs.exe

C:\Windows\System\swGHhEs.exe

C:\Windows\System\YfIoABd.exe

C:\Windows\System\YfIoABd.exe

C:\Windows\System\uLzruCM.exe

C:\Windows\System\uLzruCM.exe

C:\Windows\System\bgNwHCW.exe

C:\Windows\System\bgNwHCW.exe

C:\Windows\System\xzvYrqH.exe

C:\Windows\System\xzvYrqH.exe

C:\Windows\System\VRgioxl.exe

C:\Windows\System\VRgioxl.exe

C:\Windows\System\ECLMXVF.exe

C:\Windows\System\ECLMXVF.exe

C:\Windows\System\LCmbmzh.exe

C:\Windows\System\LCmbmzh.exe

C:\Windows\System\EOpHuUl.exe

C:\Windows\System\EOpHuUl.exe

C:\Windows\System\GzRTxNS.exe

C:\Windows\System\GzRTxNS.exe

C:\Windows\System\SwINPrD.exe

C:\Windows\System\SwINPrD.exe

C:\Windows\System\HpzYXQP.exe

C:\Windows\System\HpzYXQP.exe

C:\Windows\System\OxepzNw.exe

C:\Windows\System\OxepzNw.exe

C:\Windows\System\HshHWEh.exe

C:\Windows\System\HshHWEh.exe

C:\Windows\System\jHwYKCy.exe

C:\Windows\System\jHwYKCy.exe

C:\Windows\System\zMpvIAA.exe

C:\Windows\System\zMpvIAA.exe

C:\Windows\System\TakNKVw.exe

C:\Windows\System\TakNKVw.exe

C:\Windows\System\GkXZXyt.exe

C:\Windows\System\GkXZXyt.exe

C:\Windows\System\yYOqqdK.exe

C:\Windows\System\yYOqqdK.exe

C:\Windows\System\ofJGoPE.exe

C:\Windows\System\ofJGoPE.exe

C:\Windows\System\abNjuMy.exe

C:\Windows\System\abNjuMy.exe

C:\Windows\System\XewXiXh.exe

C:\Windows\System\XewXiXh.exe

C:\Windows\System\fEeOVBJ.exe

C:\Windows\System\fEeOVBJ.exe

C:\Windows\System\RocyOgz.exe

C:\Windows\System\RocyOgz.exe

C:\Windows\System\FOaIkUV.exe

C:\Windows\System\FOaIkUV.exe

C:\Windows\System\VrEAcPr.exe

C:\Windows\System\VrEAcPr.exe

C:\Windows\System\eDllwdy.exe

C:\Windows\System\eDllwdy.exe

C:\Windows\System\EDdnBLq.exe

C:\Windows\System\EDdnBLq.exe

C:\Windows\System\NoelRmZ.exe

C:\Windows\System\NoelRmZ.exe

C:\Windows\System\cuNMnrN.exe

C:\Windows\System\cuNMnrN.exe

C:\Windows\System\RgmvORa.exe

C:\Windows\System\RgmvORa.exe

C:\Windows\System\tFJvNjJ.exe

C:\Windows\System\tFJvNjJ.exe

C:\Windows\System\TfSsaRX.exe

C:\Windows\System\TfSsaRX.exe

C:\Windows\System\leUbWgW.exe

C:\Windows\System\leUbWgW.exe

C:\Windows\System\PiMyhZe.exe

C:\Windows\System\PiMyhZe.exe

C:\Windows\System\faasBqs.exe

C:\Windows\System\faasBqs.exe

C:\Windows\System\sXRloRU.exe

C:\Windows\System\sXRloRU.exe

C:\Windows\System\ZPmmTfY.exe

C:\Windows\System\ZPmmTfY.exe

C:\Windows\System\gwOIrSP.exe

C:\Windows\System\gwOIrSP.exe

C:\Windows\System\wsGkcWB.exe

C:\Windows\System\wsGkcWB.exe

C:\Windows\System\izuJvOI.exe

C:\Windows\System\izuJvOI.exe

C:\Windows\System\mOWeSyp.exe

C:\Windows\System\mOWeSyp.exe

C:\Windows\System\DJxhwGm.exe

C:\Windows\System\DJxhwGm.exe

C:\Windows\System\CnebRTH.exe

C:\Windows\System\CnebRTH.exe

C:\Windows\System\fJjABQC.exe

C:\Windows\System\fJjABQC.exe

C:\Windows\System\WwLCsCp.exe

C:\Windows\System\WwLCsCp.exe

C:\Windows\System\PpBBCPd.exe

C:\Windows\System\PpBBCPd.exe

C:\Windows\System\eZGLqBR.exe

C:\Windows\System\eZGLqBR.exe

C:\Windows\System\yfjLGeR.exe

C:\Windows\System\yfjLGeR.exe

C:\Windows\System\lcdXcoa.exe

C:\Windows\System\lcdXcoa.exe

C:\Windows\System\ldoQAjV.exe

C:\Windows\System\ldoQAjV.exe

C:\Windows\System\qWkMXGr.exe

C:\Windows\System\qWkMXGr.exe

C:\Windows\System\KACCvoy.exe

C:\Windows\System\KACCvoy.exe

C:\Windows\System\GjrCSep.exe

C:\Windows\System\GjrCSep.exe

C:\Windows\System\hssPIIT.exe

C:\Windows\System\hssPIIT.exe

C:\Windows\System\cBFGBsL.exe

C:\Windows\System\cBFGBsL.exe

C:\Windows\System\rdzhwto.exe

C:\Windows\System\rdzhwto.exe

C:\Windows\System\bbOyEvq.exe

C:\Windows\System\bbOyEvq.exe

C:\Windows\System\nnCUqbF.exe

C:\Windows\System\nnCUqbF.exe

C:\Windows\System\jnzhyPR.exe

C:\Windows\System\jnzhyPR.exe

C:\Windows\System\OjSfHBf.exe

C:\Windows\System\OjSfHBf.exe

C:\Windows\System\SzkndWO.exe

C:\Windows\System\SzkndWO.exe

C:\Windows\System\aOCFFEZ.exe

C:\Windows\System\aOCFFEZ.exe

C:\Windows\System\JsLNVHR.exe

C:\Windows\System\JsLNVHR.exe

C:\Windows\System\jZfmXZd.exe

C:\Windows\System\jZfmXZd.exe

C:\Windows\System\luppyXo.exe

C:\Windows\System\luppyXo.exe

C:\Windows\System\HvJOXyq.exe

C:\Windows\System\HvJOXyq.exe

C:\Windows\System\afVlhic.exe

C:\Windows\System\afVlhic.exe

C:\Windows\System\BMInVgZ.exe

C:\Windows\System\BMInVgZ.exe

C:\Windows\System\vQYHVsU.exe

C:\Windows\System\vQYHVsU.exe

C:\Windows\System\LSTaRPI.exe

C:\Windows\System\LSTaRPI.exe

C:\Windows\System\CFoFvWt.exe

C:\Windows\System\CFoFvWt.exe

C:\Windows\System\MfNXUFt.exe

C:\Windows\System\MfNXUFt.exe

C:\Windows\System\RsoYPIk.exe

C:\Windows\System\RsoYPIk.exe

C:\Windows\System\WaJjwyj.exe

C:\Windows\System\WaJjwyj.exe

C:\Windows\System\pwfejwv.exe

C:\Windows\System\pwfejwv.exe

C:\Windows\System\ikuhZBT.exe

C:\Windows\System\ikuhZBT.exe

C:\Windows\System\oDbiatV.exe

C:\Windows\System\oDbiatV.exe

C:\Windows\System\ggIJYBg.exe

C:\Windows\System\ggIJYBg.exe

C:\Windows\System\ZkcCdrh.exe

C:\Windows\System\ZkcCdrh.exe

C:\Windows\System\WfZxuRX.exe

C:\Windows\System\WfZxuRX.exe

C:\Windows\System\JvhAnwi.exe

C:\Windows\System\JvhAnwi.exe

C:\Windows\System\tOWFvmx.exe

C:\Windows\System\tOWFvmx.exe

C:\Windows\System\VLWAVGI.exe

C:\Windows\System\VLWAVGI.exe

C:\Windows\System\WtCeLcb.exe

C:\Windows\System\WtCeLcb.exe

C:\Windows\System\tetBKgX.exe

C:\Windows\System\tetBKgX.exe

C:\Windows\System\cfmBpCI.exe

C:\Windows\System\cfmBpCI.exe

C:\Windows\System\ezjENjA.exe

C:\Windows\System\ezjENjA.exe

C:\Windows\System\nbEBoXv.exe

C:\Windows\System\nbEBoXv.exe

C:\Windows\System\PhtcoCD.exe

C:\Windows\System\PhtcoCD.exe

C:\Windows\System\xWvPANM.exe

C:\Windows\System\xWvPANM.exe

C:\Windows\System\aQZNinU.exe

C:\Windows\System\aQZNinU.exe

C:\Windows\System\CbvaLlv.exe

C:\Windows\System\CbvaLlv.exe

C:\Windows\System\JfLamep.exe

C:\Windows\System\JfLamep.exe

C:\Windows\System\nUDWnPW.exe

C:\Windows\System\nUDWnPW.exe

C:\Windows\System\OBADgDS.exe

C:\Windows\System\OBADgDS.exe

C:\Windows\System\iqgmIYn.exe

C:\Windows\System\iqgmIYn.exe

C:\Windows\System\sVavcuP.exe

C:\Windows\System\sVavcuP.exe

C:\Windows\System\DooXblz.exe

C:\Windows\System\DooXblz.exe

C:\Windows\System\VrgtApi.exe

C:\Windows\System\VrgtApi.exe

C:\Windows\System\VJEliVK.exe

C:\Windows\System\VJEliVK.exe

C:\Windows\System\CHbVSwV.exe

C:\Windows\System\CHbVSwV.exe

C:\Windows\System\GhRHmqg.exe

C:\Windows\System\GhRHmqg.exe

C:\Windows\System\fuKjuRZ.exe

C:\Windows\System\fuKjuRZ.exe

C:\Windows\System\jfMdfll.exe

C:\Windows\System\jfMdfll.exe

C:\Windows\System\XTvjywV.exe

C:\Windows\System\XTvjywV.exe

C:\Windows\System\QdKptul.exe

C:\Windows\System\QdKptul.exe

C:\Windows\System\lkAavMj.exe

C:\Windows\System\lkAavMj.exe

C:\Windows\System\bvOTfUd.exe

C:\Windows\System\bvOTfUd.exe

C:\Windows\System\XnSjQdb.exe

C:\Windows\System\XnSjQdb.exe

C:\Windows\System\rpMTkRc.exe

C:\Windows\System\rpMTkRc.exe

C:\Windows\System\XciXCFl.exe

C:\Windows\System\XciXCFl.exe

C:\Windows\System\RCLCIMN.exe

C:\Windows\System\RCLCIMN.exe

C:\Windows\System\CDnxpGC.exe

C:\Windows\System\CDnxpGC.exe

C:\Windows\System\kvUMaJx.exe

C:\Windows\System\kvUMaJx.exe

C:\Windows\System\GjHFLRl.exe

C:\Windows\System\GjHFLRl.exe

C:\Windows\System\PEUlUZq.exe

C:\Windows\System\PEUlUZq.exe

C:\Windows\System\qVQpvnM.exe

C:\Windows\System\qVQpvnM.exe

C:\Windows\System\RZkcPvo.exe

C:\Windows\System\RZkcPvo.exe

C:\Windows\System\CDKSjyb.exe

C:\Windows\System\CDKSjyb.exe

C:\Windows\System\YiFQvPr.exe

C:\Windows\System\YiFQvPr.exe

C:\Windows\System\kMUgSwN.exe

C:\Windows\System\kMUgSwN.exe

C:\Windows\System\EVnPSaG.exe

C:\Windows\System\EVnPSaG.exe

C:\Windows\System\vsgNVtK.exe

C:\Windows\System\vsgNVtK.exe

C:\Windows\System\jttcOuK.exe

C:\Windows\System\jttcOuK.exe

C:\Windows\System\zXwdXLS.exe

C:\Windows\System\zXwdXLS.exe

C:\Windows\System\qxlHLGC.exe

C:\Windows\System\qxlHLGC.exe

C:\Windows\System\lNweIMC.exe

C:\Windows\System\lNweIMC.exe

C:\Windows\System\aGSCtRu.exe

C:\Windows\System\aGSCtRu.exe

C:\Windows\System\DNlCYCQ.exe

C:\Windows\System\DNlCYCQ.exe

C:\Windows\System\aRaNaCU.exe

C:\Windows\System\aRaNaCU.exe

C:\Windows\System\AncJcNw.exe

C:\Windows\System\AncJcNw.exe

C:\Windows\System\Qvotbuc.exe

C:\Windows\System\Qvotbuc.exe

C:\Windows\System\jsXxzWC.exe

C:\Windows\System\jsXxzWC.exe

C:\Windows\System\ElKVtYa.exe

C:\Windows\System\ElKVtYa.exe

C:\Windows\System\mhvkEsh.exe

C:\Windows\System\mhvkEsh.exe

C:\Windows\System\PUmVKCD.exe

C:\Windows\System\PUmVKCD.exe

C:\Windows\System\gPJRiyR.exe

C:\Windows\System\gPJRiyR.exe

C:\Windows\System\weYvENr.exe

C:\Windows\System\weYvENr.exe

C:\Windows\System\WJsTzeR.exe

C:\Windows\System\WJsTzeR.exe

C:\Windows\System\LnddDnP.exe

C:\Windows\System\LnddDnP.exe

C:\Windows\System\fBnMdMz.exe

C:\Windows\System\fBnMdMz.exe

C:\Windows\System\SIMjuyv.exe

C:\Windows\System\SIMjuyv.exe

C:\Windows\System\ENfDNcF.exe

C:\Windows\System\ENfDNcF.exe

C:\Windows\System\WoUadQF.exe

C:\Windows\System\WoUadQF.exe

C:\Windows\System\VPzVNXG.exe

C:\Windows\System\VPzVNXG.exe

C:\Windows\System\vplSCkK.exe

C:\Windows\System\vplSCkK.exe

C:\Windows\System\yPFezhu.exe

C:\Windows\System\yPFezhu.exe

C:\Windows\System\TOUfDvp.exe

C:\Windows\System\TOUfDvp.exe

C:\Windows\System\qsrSiMT.exe

C:\Windows\System\qsrSiMT.exe

C:\Windows\System\siNAXmN.exe

C:\Windows\System\siNAXmN.exe

C:\Windows\System\TJIotzp.exe

C:\Windows\System\TJIotzp.exe

C:\Windows\System\eiybfzZ.exe

C:\Windows\System\eiybfzZ.exe

C:\Windows\System\DzPZwmV.exe

C:\Windows\System\DzPZwmV.exe

C:\Windows\System\LNqpUPd.exe

C:\Windows\System\LNqpUPd.exe

C:\Windows\System\XQyDKyP.exe

C:\Windows\System\XQyDKyP.exe

C:\Windows\System\yjaYTWm.exe

C:\Windows\System\yjaYTWm.exe

C:\Windows\System\JWYPIiJ.exe

C:\Windows\System\JWYPIiJ.exe

C:\Windows\System\pHMZlZw.exe

C:\Windows\System\pHMZlZw.exe

C:\Windows\System\wqfAzds.exe

C:\Windows\System\wqfAzds.exe

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\System\iYIZxpx.exe

C:\Windows\System\iYIZxpx.exe

C:\Windows\System\sURiuBE.exe

C:\Windows\System\sURiuBE.exe

C:\Windows\System\bABOXBC.exe

C:\Windows\System\bABOXBC.exe

C:\Windows\System\jJWxWPW.exe

C:\Windows\System\jJWxWPW.exe

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\System\gqOxgwI.exe

C:\Windows\System\gqOxgwI.exe

C:\Windows\System\OGveacr.exe

C:\Windows\System\OGveacr.exe

C:\Windows\System\dOIPzoJ.exe

C:\Windows\System\dOIPzoJ.exe

C:\Windows\System\OhiCjDG.exe

C:\Windows\System\OhiCjDG.exe

C:\Windows\System\igmcmVY.exe

C:\Windows\System\igmcmVY.exe

C:\Windows\System\eVtRkfJ.exe

C:\Windows\System\eVtRkfJ.exe

C:\Windows\System\EoEQerG.exe

C:\Windows\System\EoEQerG.exe

C:\Windows\System\iIMXDCX.exe

C:\Windows\System\iIMXDCX.exe

C:\Windows\System\UbrhLHu.exe

C:\Windows\System\UbrhLHu.exe

C:\Windows\System\UJKNLMW.exe

C:\Windows\System\UJKNLMW.exe

C:\Windows\System\xrKyqZI.exe

C:\Windows\System\xrKyqZI.exe

C:\Windows\System\rMqQUWM.exe

C:\Windows\System\rMqQUWM.exe

C:\Windows\System\nLlzLAz.exe

C:\Windows\System\nLlzLAz.exe

C:\Windows\System\AkSSurX.exe

C:\Windows\System\AkSSurX.exe

C:\Windows\System\YCrZBfl.exe

C:\Windows\System\YCrZBfl.exe

C:\Windows\System\CPDhQta.exe

C:\Windows\System\CPDhQta.exe

C:\Windows\System\NLJIBRM.exe

C:\Windows\System\NLJIBRM.exe

C:\Windows\System\dRSHkhk.exe

C:\Windows\System\dRSHkhk.exe

C:\Windows\System\HPJFHOS.exe

C:\Windows\System\HPJFHOS.exe

C:\Windows\System\VzxwKYE.exe

C:\Windows\System\VzxwKYE.exe

C:\Windows\System\jiRnQng.exe

C:\Windows\System\jiRnQng.exe

C:\Windows\System\IXwoYix.exe

C:\Windows\System\IXwoYix.exe

C:\Windows\System\zapMOEg.exe

C:\Windows\System\zapMOEg.exe

C:\Windows\System\MgeotAh.exe

C:\Windows\System\MgeotAh.exe

C:\Windows\System\FKDooRG.exe

C:\Windows\System\FKDooRG.exe

C:\Windows\System\ISsUgxX.exe

C:\Windows\System\ISsUgxX.exe

C:\Windows\System\DxYNiDt.exe

C:\Windows\System\DxYNiDt.exe

C:\Windows\System\EQOJrlE.exe

C:\Windows\System\EQOJrlE.exe

C:\Windows\System\eWqNurJ.exe

C:\Windows\System\eWqNurJ.exe

C:\Windows\System\VPQImmP.exe

C:\Windows\System\VPQImmP.exe

C:\Windows\System\CRHekoP.exe

C:\Windows\System\CRHekoP.exe

C:\Windows\System\sFEIrcJ.exe

C:\Windows\System\sFEIrcJ.exe

C:\Windows\System\NVLduSO.exe

C:\Windows\System\NVLduSO.exe

C:\Windows\System\eGsozNq.exe

C:\Windows\System\eGsozNq.exe

C:\Windows\System\aNkNfEt.exe

C:\Windows\System\aNkNfEt.exe

C:\Windows\System\plvlBbc.exe

C:\Windows\System\plvlBbc.exe

C:\Windows\System\MZhFGxV.exe

C:\Windows\System\MZhFGxV.exe

C:\Windows\System\qCBLXpl.exe

C:\Windows\System\qCBLXpl.exe

C:\Windows\System\VieuvZN.exe

C:\Windows\System\VieuvZN.exe

C:\Windows\System\uedbznJ.exe

C:\Windows\System\uedbznJ.exe

C:\Windows\System\ItVQrgK.exe

C:\Windows\System\ItVQrgK.exe

C:\Windows\System\JwpEwKT.exe

C:\Windows\System\JwpEwKT.exe

C:\Windows\System\dUXRhlL.exe

C:\Windows\System\dUXRhlL.exe

C:\Windows\System\NJXgxBB.exe

C:\Windows\System\NJXgxBB.exe

C:\Windows\System\KcLJSpF.exe

C:\Windows\System\KcLJSpF.exe

C:\Windows\System\qjCNtmU.exe

C:\Windows\System\qjCNtmU.exe

C:\Windows\System\ZUbFJRx.exe

C:\Windows\System\ZUbFJRx.exe

C:\Windows\System\YtfUuAp.exe

C:\Windows\System\YtfUuAp.exe

C:\Windows\System\ndfItku.exe

C:\Windows\System\ndfItku.exe

C:\Windows\System\HnOQHhq.exe

C:\Windows\System\HnOQHhq.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

Network

Country	Destination	Domain	Proto
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	raw.githubusercontent.com	udp
DE	3.120.98.217:8080		tcp
US	8.8.8.8:53	30.243.111.52.in-addr.arpa	udp

Files

memory/2920-0-0x00007FF6AA590000-0x00007FF6AA982000-memory.dmp

memory/2920-1-0x000001C439F00000-0x000001C439F10000-memory.dmp

C:\Windows\System\GopTlmv.exe

MD5	6417b59132e7b304539d691aff8f5d2f
SHA1	b2dfdee1f8e82de0054484f08245e4a1e2ff7faa
SHA256	31308b12620977c5d2f1674693dd0df8d472ff81f4e778f9a9c74b3caa282cdd
SHA512	ee3a7103798e599722d7d89c51bff46d15fae7de728293f73eff00bf6c0a0a2d6cf66959a853601c4361a27a292fb3eb05392a6f79a38f00ae0d9b6905b6b93e

C:\Windows\System\TUzBDqi.exe

MD5	52decde59fbf4df22c29b652c1130f9f
SHA1	d0a6a62c38095c1f1422805dee7e2b2370824b14
SHA256	4afaa47839194482487b2cd0f082264555b3a217df091be8c58d658fea15c835
SHA512	f68a3756ca2c422962ef5ab12b63861085f2517f798402a774005f1ad0053196deed05222e2de5276f4ff5091da2491f46624a1e1d885f795a730a05854a7604

C:\Windows\System\wyZdzOH.exe

MD5	1db0111e5ea757e21e232826ebfa19c4
SHA1	9bb03981ffe875701c80d96ae0f102ad7e4ff0a3
SHA256	e535e3ee02d5986279481ee066d2b7209afef914c6cf454be63941a84ae2ca0d
SHA512	e799d1f1aa4dbf98f690d191056abb3cc759ab95a015a34e263baab321c81cad9c9650bfb8c5e45163220d64790676af9ee5bee85edbca3a4d88e653ef0beabc

C:\Windows\System\SzUEudP.exe

MD5	c2f6ba4bd2cda5145830c0968963989a
SHA1	8bc1cc3193e050bfd5e572452f79edcc85bba4b3
SHA256	8257f494655933f03e32d40c2a948a3d05419f3fdf338d929b488b3e7ec88edb
SHA512	3cb2059310281829b7f39ba27f76dc040d5730c1e9ee8dc1ec62e1d43b8da5b49709959491bb4f4608a79d2db8e3cfbed530472875ffe6bfae8cc9d4db349b3f

C:\Windows\System\mSEBlcY.exe

MD5	fabc41e1e083b8d16bb2a1191093504e
SHA1	aad088ade875e9a44da992f5bcb842c2a5e36fe1
SHA256	69bd9bd1bccde012bb812c6801b13ebc4ba806656598d7a0f77ee9ebfbe9d752
SHA512	1cd907e34acd77288c26cd66c5e8aed74964b53c6c966e84453406c2b2722e15428a7320534c08c1c18a3e4890b729a04dbf04e51580e789a06e385281c86c1b

C:\Windows\System\uqXoeQq.exe

MD5	5eac298c53405eefab3308103e5bf7ea
SHA1	fbd5c56d022dd7babd0fd473545bea68f77022d2
SHA256	41248b791515ce4c0620624e2dcda1539fe465fa8c1314572f9ce67c4822e566
SHA512	373fe01d927002cd11f881aab984196afb9ebf4adf9d216931e1f2a39aed16d14aa6690f2754f6fdab4c5512cffdf652426debc9a3da3e269f5ce0c07d1837a3

C:\Windows\System\FMvwhxx.exe

MD5	c08c6bc64fd2b68df2f181b271f4e73d
SHA1	fee4112abe0d896f86e40dfdcb38a4c4d79e0e94
SHA256	ffdcd4c8ad60de6fbcafe3791df5b53f9149a23073b3f34aa158601c478718f6
SHA512	de288e67675914d8aa9b9d6c9cb1a6d4891f77f3e19164d953cdd167617b1f80ba51911d7296a56020e08fd48768b4dc2b35bae4c3b95a9ec52dbeeee5e3eed2

memory/1580-274-0x00007FF71F120000-0x00007FF71F512000-memory.dmp

memory/2428-333-0x00007FF7C8DF0000-0x00007FF7C91E2000-memory.dmp

memory/4248-344-0x00007FF769410000-0x00007FF769802000-memory.dmp

memory/4160-405-0x00007FF78E010000-0x00007FF78E402000-memory.dmp

memory/3412-404-0x00007FF9EF3F3000-0x00007FF9EF3F5000-memory.dmp

memory/3412-546-0x00007FF9EF3F0000-0x00007FF9EFEB1000-memory.dmp

C:\Windows\System\gZPiPEY.exe

MD5	aff52c0f818e2e7d78869cd893112149
SHA1	37e1f34ef38df6def152ab338bba156c657bfe04
SHA256	8258ff58ac5ddce1bfb196ef13d031572b9ba47c90976db72a8bb91524b26d53
SHA512	6a2c877e90f1051ead03104ffa46fb3a7b8feb060208e09c59de42fce31ddaff0c1a37e1ce6431b1ec91bda6a5ae3767f409cd972f6fa747d83271efa5b2d7bd

memory/4500-548-0x00007FF7DB530000-0x00007FF7DB922000-memory.dmp

memory/4860-547-0x00007FF656760000-0x00007FF656B52000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_my2vqger.uth.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1912-403-0x00007FF7EBCE0000-0x00007FF7EC0D2000-memory.dmp

memory/1792-387-0x00007FF6E4110000-0x00007FF6E4502000-memory.dmp

memory/2328-386-0x00007FF67EA00000-0x00007FF67EDF2000-memory.dmp

memory/5068-338-0x00007FF7956B0000-0x00007FF795AA2000-memory.dmp

memory/3296-337-0x00007FF6521D0000-0x00007FF6525C2000-memory.dmp

memory/3480-332-0x00007FF60B8A0000-0x00007FF60BC92000-memory.dmp

memory/1312-331-0x00007FF752270000-0x00007FF752662000-memory.dmp

memory/3412-309-0x000002BD6F1C0000-0x000002BD6F1E2000-memory.dmp

memory/4088-223-0x00007FF7F1DF0000-0x00007FF7F21E2000-memory.dmp

memory/3844-251-0x00007FF64D280000-0x00007FF64D672000-memory.dmp

C:\Windows\System\CnTXdhr.exe

MD5	b7a058edab7ef0d01b943bd30dbb0160
SHA1	1f398b8ab9c0f4689cb6586746241020f8e2beb8
SHA256	c758ff9d21bb6b2989431dc77ca4ada313c0718a111a92db549f4c626b34e5e0
SHA512	20bf3ea6136831b707ae28d21afbb308eea7354685b7419eadb357f200468fd841f14c1c91e633c35d3f0030660b2d38e8e034f7e448c2f04216fc6b0e7325e4

C:\Windows\System\AnvnKaY.exe

MD5	d20bc5f7fb934ebe797c48d574aaefae
SHA1	b98c68f2bb64fe48af34ecb286eefddd25f90db0
SHA256	7af838a879d7a7008e4cd4d4c1bd9b7f5a10b11e02eaa3610f714479befe3ff6
SHA512	ba98046d4e451c7651fecccceaac19fef1eb1eaf12c11cded20a1e2269f27100dd73545991402f53403c6233ffcfcd3bf8a9b0f1f6b02d8e75ef13e777331de5

C:\Windows\System\SehujBM.exe

MD5	1549e0e3d29aa32ba11360a3b16aa713
SHA1	cd4826b0c64576127e492f97e61ce9730f0d82e2
SHA256	16fe5c01a6179c3d7b55baac405ea20c9e97b98e7f382ed705b6c5776c464a23
SHA512	7142c8687cd5160c0d823af72ed99a8b625e4a4c1266c41fcb1a27bcd0e95dec64fb2f8b5d4c8d50c27587beaecb6db2efa1f05417e980b22d1683dad92436bb

C:\Windows\System\YMXXogq.exe

MD5	acc0d6e76f9363ee67a86c448ac80256
SHA1	9ee8e3e9107e2763f9687a133c72656a8a01a0ee
SHA256	0479bb3ce8a88a60f9964303dab28a36cee49d2e90060995148946bdf96dd74c
SHA512	794649d7c391c49b3f39f73180b5eaab4159076aae00cbc6bbbf5ebb4b230765b9320d202cac6141cee7c2fad8d06c2e71274006b139b6d20d8890424f2de75e

C:\Windows\System\NbGYUtv.exe

MD5	55861862300d5a7c0ec6656cabf7719a
SHA1	119109048037031fffc0c0c967c8dbd347a4d25f
SHA256	731d60a2385adb8b2ff5c4db9182ad04c6e7daa877d86603c6b6f8c4d1ed61ee
SHA512	df37372c6b704782b4b6c060e27357e93531a5ecd2e0f3bc61caf6685a5a05acaffd37a376595907c199ca1eeb96c540704f1b29fdfecd627741c69a11f7a63a

C:\Windows\System\ydAQCTX.exe

MD5	ad771a295d9431e3b860cfb821363607
SHA1	3e454bb3f442fe8a656cec0a5f1fad5dc6a3e5c1
SHA256	841fd6d4b72f7a7db9bb103a9af21f05db6493fd6a09d0627e5ec5e02a2b6f05
SHA512	a65e67f1c95e15c9cabbe852d1c93c34b1383496ed4dbf6f227cbefc3741f6b08abbd664bfa94856d425d9666d728bb8907faf3b5d3b78ab30b1353cccab470a

C:\Windows\System\YPYXpYw.exe

MD5	b750ef95cdd23872eb22bc2a239a6ae6
SHA1	8faa556fd19cee37e7ada080c1187dd9cb6bda90
SHA256	7fdcc358ca8465606be981ab049926007d823bdbcdb57dd5b7782486ea8893c0
SHA512	9ba62ff6471fae9832362b1e1f57753ff327ed2590ec7bfb23d2c0137d20d6c7b526f489bb6f82f56418fb737b277b01df1dcfff4962dbc7498c4edb4c664d06

memory/368-169-0x00007FF65AF50000-0x00007FF65B342000-memory.dmp

C:\Windows\System\GGtUmMM.exe

MD5	61e4c2d98b2773dd48c82a8e35343c05
SHA1	40c647bcad333b0ef9045e15b1ba7c53f52b5aeb
SHA256	c0ac2c27f4565aeb3368799ccf7cfb1b0a0ebc4d0e34b8a33fabc2d0cc84d69a
SHA512	2f28face401bf5bbf35a41e103610a1fe8a837fca1e913b3bbb44a6ecb77c696603463814dd495537d0f0a5bc08790622a375b23ab91e2b4f7431d8248c8a578

C:\Windows\System\TdvlpmN.exe

MD5	f5504e641451b43506f441b9880e7bba
SHA1	3cfea69c52414983e39cc9f30c441ea70d944a27
SHA256	71bc8859b7f76f3a7795d8aaf4cfa57fae5199313e492bd96f3f3954fe7f00f5
SHA512	94721ae4740547d1992e2485d9136b67a14be879c1043a7c5fc5dc654c5c95fad28504a34663f7bfba6416fbf6713e78257b47901073839b57988080991f45be

C:\Windows\System\pnbwFIA.exe

MD5	f97987b9d0be15bcfe3b61000b46e562
SHA1	5aa76aeafedddcb6c95a96929a0ae3a5a797396b
SHA256	340664582bdaa95c282b8acc23c5b10f1c879c2afc2458a577397d195fb42698
SHA512	7d1f1db1df6f6cd26e9f2e0acb30a86882ac43da7280b56044f8d0618ee938e69105044b90edec8321ae090625d2825bb91879e402ddefee06df687de9ee4941

C:\Windows\System\tdKFxtX.exe

MD5	e4b70463a4c8d6e88fbc341102da25cd
SHA1	2d9f24a250ee52ba7f9fd080140fa09268612b40
SHA256	4ee8fb19cb2be4eab0fe3328ab92448fed8b765596cf7ba1628a4407cb3f6a95
SHA512	431f1c24ba0be53e20d958f62e77a125d5c0ebff03038269492863c015ea1ef17bbc1ebc954626661c91cd5e6e28ea802665e608c4e3c306ae3329565ceebdd3

C:\Windows\System\ZasOFcc.exe

MD5	89207eb0d2fabf94cf49e5782450fe30
SHA1	45e90f4eeaa7ca61922a4b7d7a0641a8069f116c
SHA256	75a048f9ca15cdf8aa1f1c6c856375dbac2516838a2d48b64d44d303673a48bc
SHA512	5daeb40be4d2b351eb340675b383075e68fce7e24b9636a6c1341eaf78ad62b42a43e81c41ad5b3f59563c7389a2fdafadbbff2c86674e8089ed87cd211d73c5

C:\Windows\System\gMwLfiI.exe

MD5	98f5cede25d36ea42c1bfe098055f9f3
SHA1	751bf9aaf44bdc2a9b87cccbc07b40d037c800b5
SHA256	84c32beb2c491fb09cf2c9653ded3102cf96327e2e134fa4bb9381f39b1a2f2e
SHA512	acc8fc0773e80fc6fcc04217db4c1525956e79b428b5958aaa0d3b5f100908b083ea1338d9823e732c20d753c177574006fa91a05c1cd831c620ed83da09478d

C:\Windows\System\DYZWafw.exe

MD5	713832270345bcaf1f5a8245d47092b7
SHA1	da46d909a75c642f30a64dfa35dbbd33cc6ddbb8
SHA256	2ec4a5046d86fc310ab933598beb978ac970726e9849981ab8d06df286f06b6c
SHA512	f54838941bacf9c3d84f2ac548989d2009a91fedc4e81c74aec711d5839766ad8dd4308aacce780b1e8ff42a42df51afb449baceb7db27dcddd30dae4d07b70c

memory/1432-166-0x00007FF726DA0000-0x00007FF727192000-memory.dmp

memory/1260-140-0x00007FF6E3EC0000-0x00007FF6E42B2000-memory.dmp

C:\Windows\System\mXHONnu.exe

MD5	e4276e9e0876310aed75561e184dc112
SHA1	4fda2c0c710a13938893e91494beb582def0ad8d
SHA256	de2528a793087e61414ecc11856d5216a897942465ef9cb0756e13a4a18ee8dc
SHA512	5b7e352e3626b8ffd8aa674f4865cfbf4ab88de941287397a2866f3e502ebfce5fc219659120dadf22019efa72dcd35fa9de98ad181391cabbca7b97f0c2b047

C:\Windows\System\IxhZQCw.exe

MD5	be95d63099d4d7bdfe60ac94545ec159
SHA1	63690cc5c349aff9418947809e99d15ddde81a9d
SHA256	8a95caea1c852787bb98c7701e1537d6d3ca4cc52c8e3bf44f303f08f1dd0ec4
SHA512	2cc57d1c407e0cd03a8dd928e91e35b210b7e13955ab7c496d4300f14a1cb8377ebc6389c67207d7ebbe717c6e3c9d0d6e3f110c0d0af1d58c0d11e43dd27f8f

C:\Windows\System\iGzHQWD.exe

MD5	e2aeb2a028ea89ba8b905ee24a325677
SHA1	badafbaf90c2ae47a0c574b310b54b28449ce8b3
SHA256	5834e88c111cc35c4110eb75a67f3d60f4ff7cafc2648903a4eeff4c65883215
SHA512	be300d4b708252546168d87a988c58710da9c5276c39e995ffaed133f710bb1aceb350804965440ef8db3d954665fcece3ce3aff962b6b594ceeaa648a21a390

C:\Windows\System\ktkqxRP.exe

MD5	c23d430845a69ca406054f4707a37771
SHA1	d62e75c6d56f557bc712aa0947a170482add79f2
SHA256	9817c4606ff360d5fc6e17696a62c83b1346ad5dc49555531754a19099b3fedd
SHA512	50339d7174de6dd72177080ea05e934e7d82fd3f3e9fbcf85c1eee10acfafa0b078c4a07f800e13532e12cc08f810aaa1f29b87babb88d8c614045f94bced16b

C:\Windows\System\pQtLNhA.exe

MD5	7310cc8cec303f496aa0dd329c845713
SHA1	eec428a1f91f29caf55ce9475df3d57f3e36d442
SHA256	6a84bdb269bcca4c07ac80655cdb3eb99e66802173867532c2da9e4af6363f3e
SHA512	533dd933aa176a14b26a5ea312f275f84a97c24057850e2002d51dbccf045c1ec75e860bcca7f507c622d2cec36992d03cb98c0c04cada88ea722309a13f5318

C:\Windows\System\uOWPETo.exe

MD5	e81fb047b28065203e5ce0b603fd3eac
SHA1	d828a7cfe46646c38f647f7ac2288ae60eaedeec
SHA256	2fc149e4d90673e54d2ed75448842360506ddf34300d2b5ffc487d72a546e322
SHA512	6e0ae5071c26772d5fa1135c30d7889a3ca4094eb0a8739d3e16faa4436e5b4334fceccb1ced910263132982f2061b5d4a940aa2d352139c964489fd49b8c449

C:\Windows\System\OWVysFT.exe

MD5	e4f3a6d7c0eac513cfd62bd7984e7734
SHA1	620bb4f7013c70a0fb90960eecfbab00b263f93a
SHA256	d22cb32043ac3c93dcc8b4044537e755c98bb817f6976318dd8bb94b6cc374ed
SHA512	a7d0c76e28a26ef9b6039191ca1565dfa9f29fb48c96f1046fda3d2b4e109789b756e17023da12d6af2f6eaf14780e1ec5747511b5b654a62ff49f9d563639d0

C:\Windows\System\JtNdJZr.exe

MD5	f01b976883624492478e59b559fba178
SHA1	771602545bd61980d71e3e6ed102e8d3321e6200
SHA256	1aec3aea1ddec667bf44d6a723003cd4357a60b809ed7c6f78ba68bc30bfa65d
SHA512	1f771c4a0e21880b8750bb2ebfab1f9a3781f5da3a2a197cb627357da85d8a5b7bd9574cf938cd33c4584bfd14b99efa4f82e8f56e707e7257134268d7356866

C:\Windows\System\IPhmgnk.exe

MD5	4d066e47206922d9ff0b0e8248f6a553
SHA1	7a4f5a4ffafa3ae8fcf2980b384ae65b569e1b6c
SHA256	d501b30f0e50a1cc394e049ffb6d8bbe5220b6280746af9e974d326b1b260813
SHA512	cab3df08e7285983b50d615940d037926a0ea5fd9e01ad875260a7cd8397395a382aa105259a45aaff589153dc228b483e4747be9782983664dcb1ab85f7ec41

memory/2092-111-0x00007FF782C10000-0x00007FF783002000-memory.dmp

C:\Windows\System\vSQBQXs.exe

MD5	d04073d4e07b9076dd25556c04ac6c8d
SHA1	3a9ad5ff657bfecdb0bb3330c4b18bfaf9ddf07a
SHA256	ad958727258c3f332837e9424672d867e1955ef751847e2e0d35229a2e7fe98d
SHA512	df38dd6e71800304cbb21e66f14f1cda660470bad06bdedf2c391b4f3e72e8beddd71a1dd02c02ba231f1646450b46b892bc89e68bfa37b6aff5c630e74f09ea

C:\Windows\System\oBwrEce.exe

MD5	b5f0331bfc394d907ab564be670fba66
SHA1	c1746de8dec06bd37528c30d72e4571749eaa281
SHA256	271ffa6e65ed3fdb90caa4187ec684dcb2f55e53803c57b417709e227e8f0def
SHA512	3643a5d020cdfca3ee4340aca14e3fa650adc8bfa77bb04631faaf2e5ddddaab49a0b0bb2fb2555d96a3fc8324b06cbd23f598a7423ce169601e545016b64bfe

C:\Windows\System\rGLYGSn.exe

MD5	5619dc4e999372311c5aec79b1691933
SHA1	34f12bd1beaaa8d619d84a7b965f68bceccdb5cd
SHA256	ca89ec0442b451eed47c6c669ad49c34ff224c7d460a289bf5c1f8f59f6a453a
SHA512	3cc08956d386990a54a8d3609c2b1201ee305e2312b2f9f8ae031bca7b0afd45a335853c6adf68c66ec48a8896fa53b6edc242a12b340f87634dd5de8ba4a684

C:\Windows\System\nIdVSCV.exe

MD5	0b96b2521b84169cb3d9a44b37eec05c
SHA1	34da2fb464df6e20ec56bdcae7745557b756db6c
SHA256	8f400fb4848d6a000239559505899f206788509950fbc4de3aa74cc878181167
SHA512	75e3ae0c3870cab927c315fd569d2db66e6976c9b74a77bd57d2920ba1c55123c955d4bec37100ca06217ba11cc14ca2a422dd7d42a47b6e2454aab8e3ce1609

C:\Windows\System\ndlPHQC.exe

MD5	be1dc0e3e1e29be3e5b71ea9b6a1398f
SHA1	7579275773f444cf18ee95f8957b6883d7d92a9a
SHA256	7559a076cf68b26da31a200c2e78e07343c649d7c70820b36a3455bef17b4d06
SHA512	eacddcf1c90dc8c3e514da801d0c637d7be7d2b8ddf55679e1ff87301f429e10215f8616b426e21d8e828d25018a28b6856d937e32a645393fe75c9a573f32a2

memory/436-64-0x00007FF72A0E0000-0x00007FF72A4D2000-memory.dmp

C:\Windows\System\XjEmRCI.exe

MD5	374ff57f27e94ae6cc211e4696081a35
SHA1	4861bbf1cab065c91bf1670648efa99af5816cb1
SHA256	d8a94fe35f7c1062399ca2f540e77ec27c1499025debda2bc54cc5583c58b8b4
SHA512	c987bd51faacb3955593a5de4b89ad3fa8c650e3f7cf37445c5a835d0bfd827ca959fa98cde8d97584bb3288ee3ba639f6279357790827bac43bfc2643c5f869

memory/1248-50-0x00007FF6184D0000-0x00007FF6188C2000-memory.dmp

memory/2124-44-0x00007FF6DB140000-0x00007FF6DB532000-memory.dmp

C:\Windows\System\GLwpNus.exe

MD5	82c127cddf6c02728b432ade64e159c8
SHA1	d4b38333912805f91948d989e5f0690950efeb74
SHA256	449c226e9af2133e6922ced1a53fc09d41b3b4ccd0b5a15f80485bfc55cc875e
SHA512	c44c52b5bc6a003db730a471509b7cd5c0fca038744f3e4f8eb59f9e6ea56b2725a11d2fee0e48feb3515a655711b936f4d4cdd1123e6a3e1c09c7c920320af5

memory/220-29-0x00007FF6D8540000-0x00007FF6D8932000-memory.dmp

memory/3412-23-0x000002BD6CE80000-0x000002BD6CE90000-memory.dmp

memory/3248-10-0x00007FF757140000-0x00007FF757532000-memory.dmp

memory/436-3853-0x00007FF72A0E0000-0x00007FF72A4D2000-memory.dmp

memory/2920-3878-0x00007FF6AA590000-0x00007FF6AA982000-memory.dmp

memory/1248-4314-0x00007FF6184D0000-0x00007FF6188C2000-memory.dmp

memory/3844-3876-0x00007FF64D280000-0x00007FF64D672000-memory.dmp

memory/368-3873-0x00007FF65AF50000-0x00007FF65B342000-memory.dmp

Sample ID	240613-rjxklswfpl
Target	82e428a98c0965bddce7743097911240_NeikiAnalytics.exe
SHA256	d5302e703183d03e2f6d3d256a7375c24b8f9d8bcddb285594d529ce78c29a4a
Tags	upx miner xmrig execution

Malware Analysis Report

2024-07-28 17:28

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files