xmrig | 08c776b6fd90f612b24c4233bd4a13cf98eb0f5a615287f28039a291c4a7138e

Analysis

max time kernel
68s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
Size

2.3MB
MD5

43b493723f459bba6657abbfd39451f0
SHA1

90a4ed613ec89f54aa5dc8823acd0f30de573631
SHA256

08c776b6fd90f612b24c4233bd4a13cf98eb0f5a615287f28039a291c4a7138e
SHA512

da4c4f434c07ea6428526102dd9fb84843021c582d4b21812f23ab97cf14a41255fa5ff3c8967d979041089f87fc73d1c83d2436db0b3a06c99fd5e0e0546952
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxhOWenbffOldXeLA1cFrO:BemTLkNdfE0pZrQB

Score

10^/10

xmrig miner persistence upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/3068-0-0x00007FF655090000-0x00007FF6553E4000-memory.dmp	xmrig
C:\Windows\System\MNSgCyq.exe	xmrig
behavioral2/memory/2168-13-0x00007FF75F690000-0x00007FF75F9E4000-memory.dmp	xmrig
C:\Windows\System\kGUPAJy.exe	xmrig
C:\Windows\System\tsDFmTq.exe	xmrig
C:\Windows\System\BaGUkNp.exe	xmrig
C:\Windows\System\YmGAXDE.exe	xmrig
C:\Windows\System\EbwDTDV.exe	xmrig
C:\Windows\System\mXRNFlA.exe	xmrig
C:\Windows\System\BWylpAC.exe	xmrig
behavioral2/memory/3496-120-0x00007FF7E7A70000-0x00007FF7E7DC4000-memory.dmp	xmrig
behavioral2/memory/692-130-0x00007FF7E08F0000-0x00007FF7E0C44000-memory.dmp	xmrig
behavioral2/memory/4400-135-0x00007FF64BBF0000-0x00007FF64BF44000-memory.dmp	xmrig
behavioral2/memory/4856-140-0x00007FF6720E0000-0x00007FF672434000-memory.dmp	xmrig
behavioral2/memory/2284-139-0x00007FF63A820000-0x00007FF63AB74000-memory.dmp	xmrig
behavioral2/memory/4860-138-0x00007FF6731E0000-0x00007FF673534000-memory.dmp	xmrig
behavioral2/memory/4208-137-0x00007FF70A830000-0x00007FF70AB84000-memory.dmp	xmrig
behavioral2/memory/1948-136-0x00007FF622E60000-0x00007FF6231B4000-memory.dmp	xmrig
behavioral2/memory/3392-134-0x00007FF7CDD40000-0x00007FF7CE094000-memory.dmp	xmrig
behavioral2/memory/4016-133-0x00007FF632190000-0x00007FF6324E4000-memory.dmp	xmrig
behavioral2/memory/768-132-0x00007FF74E4F0000-0x00007FF74E844000-memory.dmp	xmrig
behavioral2/memory/2908-131-0x00007FF6E4B00000-0x00007FF6E4E54000-memory.dmp	xmrig
behavioral2/memory/2092-129-0x00007FF6CD8B0000-0x00007FF6CDC04000-memory.dmp	xmrig
C:\Windows\System\fsYwFFH.exe	xmrig
C:\Windows\System\bRQJTFC.exe	xmrig
C:\Windows\System\tjiKHnD.exe	xmrig
C:\Windows\System\iHktXde.exe	xmrig
C:\Windows\System\KWJmfdZ.exe	xmrig
behavioral2/memory/376-113-0x00007FF638B50000-0x00007FF638EA4000-memory.dmp	xmrig
behavioral2/memory/2728-112-0x00007FF6C4CB0000-0x00007FF6C5004000-memory.dmp	xmrig
C:\Windows\System\uGirpfO.exe	xmrig
C:\Windows\System\oYSkGZA.exe	xmrig
C:\Windows\System\PRlrJrM.exe	xmrig
behavioral2/memory/1852-99-0x00007FF794FE0000-0x00007FF795334000-memory.dmp	xmrig
C:\Windows\System\GBvdMkr.exe	xmrig
C:\Windows\System\gJdTeVW.exe	xmrig
C:\Windows\System\CdgQqGh.exe	xmrig
C:\Windows\System\pEPAZYM.exe	xmrig
behavioral2/memory/700-74-0x00007FF75E300000-0x00007FF75E654000-memory.dmp	xmrig
behavioral2/memory/1704-78-0x00007FF67C780000-0x00007FF67CAD4000-memory.dmp	xmrig
behavioral2/memory/3380-58-0x00007FF68F6D0000-0x00007FF68FA24000-memory.dmp	xmrig
behavioral2/memory/1360-54-0x00007FF720380000-0x00007FF7206D4000-memory.dmp	xmrig
C:\Windows\System\itLBoXF.exe	xmrig
C:\Windows\System\AXKrfOL.exe	xmrig
behavioral2/memory/4304-144-0x00007FF75A120000-0x00007FF75A474000-memory.dmp	xmrig
C:\Windows\System\ryQRuOp.exe	xmrig
behavioral2/memory/3128-34-0x00007FF7422F0000-0x00007FF742644000-memory.dmp	xmrig
C:\Windows\System\toBNQMA.exe	xmrig
C:\Windows\System\EJdfyqy.exe	xmrig
C:\Windows\System\lgAvCFz.exe	xmrig
C:\Windows\System\tRsGdBu.exe	xmrig
behavioral2/memory/2268-188-0x00007FF6BCDD0000-0x00007FF6BD124000-memory.dmp	xmrig
C:\Windows\System\iwaExVL.exe	xmrig
behavioral2/memory/4816-174-0x00007FF6FF490000-0x00007FF6FF7E4000-memory.dmp	xmrig
C:\Windows\System\dJAxydw.exe	xmrig
behavioral2/memory/3068-917-0x00007FF655090000-0x00007FF6553E4000-memory.dmp	xmrig
behavioral2/memory/2168-920-0x00007FF75F690000-0x00007FF75F9E4000-memory.dmp	xmrig
C:\Windows\System\oUuxUJV.exe	xmrig
behavioral2/memory/2960-168-0x00007FF719BE0000-0x00007FF719F34000-memory.dmp	xmrig
behavioral2/memory/4068-164-0x00007FF6C6D40000-0x00007FF6C7094000-memory.dmp	xmrig
C:\Windows\System\ZjKRbwi.exe	xmrig
behavioral2/memory/1772-156-0x00007FF656F50000-0x00007FF6572A4000-memory.dmp	xmrig
C:\Windows\System\glppxSl.exe	xmrig
behavioral2/memory/4596-20-0x00007FF705FE0000-0x00007FF706334000-memory.dmp	xmrig

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 64 IoCs

Processes:

kGUPAJy.exeJnQyBRW.exeMNSgCyq.exeryQRuOp.exeBaGUkNp.exetsDFmTq.exeitLBoXF.exeCdgQqGh.exeYmGAXDE.exepEPAZYM.exeGBvdMkr.exePRlrJrM.exeEbwDTDV.exeoYSkGZA.exeuGirpfO.exeKWJmfdZ.exeiHktXde.exemXRNFlA.exegJdTeVW.exetjiKHnD.exebRQJTFC.exeBWylpAC.exefsYwFFH.exeAXKrfOL.exeglppxSl.exeZjKRbwi.exeEJdfyqy.exetoBNQMA.exetRsGdBu.exeoUuxUJV.exedJAxydw.exeiwaExVL.exelgAvCFz.exeZMxdVOX.exejHhJzZF.exeKgbIJzo.exeLEmaSSF.exeVQOKKKt.exeMsbjWHd.exefEzqAJl.exesmtqISJ.exeXMYhTHN.exezExfAwF.exevSULVfe.exeJbAWNIs.exekTcHAyR.exeldyVoPU.exenSwGjdP.exelgBLUDs.exeHxsdAEa.exegCKMcZa.exepgpPjEt.exeMJMoWKQ.exeJhJKiZy.exeNcQHaFd.exeXyixSQK.exepzDXbbd.exeDknFmup.exeSGOpmSZ.exersDIaZO.exeUliFgxp.exenINaJZU.exekWpDTeQ.exeqqhFzCv.exe

pid	process
2168	kGUPAJy.exe
3128	JnQyBRW.exe
4596	MNSgCyq.exe
1948	ryQRuOp.exe
1360	BaGUkNp.exe
3380	tsDFmTq.exe
700	itLBoXF.exe
4208	CdgQqGh.exe
1704	YmGAXDE.exe
1852	pEPAZYM.exe
4860	GBvdMkr.exe
2728	PRlrJrM.exe
376	EbwDTDV.exe
3496	oYSkGZA.exe
2092	uGirpfO.exe
2284	KWJmfdZ.exe
692	iHktXde.exe
2908	mXRNFlA.exe
768	gJdTeVW.exe
4856	tjiKHnD.exe
4016	bRQJTFC.exe
3392	BWylpAC.exe
4400	fsYwFFH.exe
4304	AXKrfOL.exe
1772	glppxSl.exe
4068	ZjKRbwi.exe
2960	EJdfyqy.exe
2268	toBNQMA.exe
4816	tRsGdBu.exe
456	oUuxUJV.exe
1712	dJAxydw.exe
1356	iwaExVL.exe
640	lgAvCFz.exe
3824	ZMxdVOX.exe
1572	jHhJzZF.exe
3428	KgbIJzo.exe
5056	LEmaSSF.exe
3024	VQOKKKt.exe
4392	MsbjWHd.exe
1892	fEzqAJl.exe
1440	smtqISJ.exe
2776	XMYhTHN.exe
2636	zExfAwF.exe
2144	vSULVfe.exe
2028	JbAWNIs.exe
2516	kTcHAyR.exe
2012	ldyVoPU.exe
4764	nSwGjdP.exe
2856	lgBLUDs.exe
2572	HxsdAEa.exe
4844	gCKMcZa.exe
2128	pgpPjEt.exe
4520	MJMoWKQ.exe
3492	JhJKiZy.exe
3124	NcQHaFd.exe
1296	XyixSQK.exe
4336	pzDXbbd.exe
2040	DknFmup.exe
4936	SGOpmSZ.exe
3856	rsDIaZO.exe
5096	UliFgxp.exe
1556	nINaJZU.exe
4928	kWpDTeQ.exe
4712	qqhFzCv.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3068-0-0x00007FF655090000-0x00007FF6553E4000-memory.dmp	upx
C:\Windows\System\MNSgCyq.exe	upx
behavioral2/memory/2168-13-0x00007FF75F690000-0x00007FF75F9E4000-memory.dmp	upx
C:\Windows\System\kGUPAJy.exe	upx
C:\Windows\System\tsDFmTq.exe	upx
C:\Windows\System\BaGUkNp.exe	upx
C:\Windows\System\YmGAXDE.exe	upx
C:\Windows\System\EbwDTDV.exe	upx
C:\Windows\System\mXRNFlA.exe	upx
C:\Windows\System\BWylpAC.exe	upx
behavioral2/memory/3496-120-0x00007FF7E7A70000-0x00007FF7E7DC4000-memory.dmp	upx
behavioral2/memory/692-130-0x00007FF7E08F0000-0x00007FF7E0C44000-memory.dmp	upx
behavioral2/memory/4400-135-0x00007FF64BBF0000-0x00007FF64BF44000-memory.dmp	upx
behavioral2/memory/4856-140-0x00007FF6720E0000-0x00007FF672434000-memory.dmp	upx
behavioral2/memory/2284-139-0x00007FF63A820000-0x00007FF63AB74000-memory.dmp	upx
behavioral2/memory/4860-138-0x00007FF6731E0000-0x00007FF673534000-memory.dmp	upx
behavioral2/memory/4208-137-0x00007FF70A830000-0x00007FF70AB84000-memory.dmp	upx
behavioral2/memory/1948-136-0x00007FF622E60000-0x00007FF6231B4000-memory.dmp	upx
behavioral2/memory/3392-134-0x00007FF7CDD40000-0x00007FF7CE094000-memory.dmp	upx
behavioral2/memory/4016-133-0x00007FF632190000-0x00007FF6324E4000-memory.dmp	upx
behavioral2/memory/768-132-0x00007FF74E4F0000-0x00007FF74E844000-memory.dmp	upx
behavioral2/memory/2908-131-0x00007FF6E4B00000-0x00007FF6E4E54000-memory.dmp	upx
behavioral2/memory/2092-129-0x00007FF6CD8B0000-0x00007FF6CDC04000-memory.dmp	upx
C:\Windows\System\fsYwFFH.exe	upx
C:\Windows\System\bRQJTFC.exe	upx
C:\Windows\System\tjiKHnD.exe	upx
C:\Windows\System\iHktXde.exe	upx
C:\Windows\System\KWJmfdZ.exe	upx
behavioral2/memory/376-113-0x00007FF638B50000-0x00007FF638EA4000-memory.dmp	upx
behavioral2/memory/2728-112-0x00007FF6C4CB0000-0x00007FF6C5004000-memory.dmp	upx
C:\Windows\System\uGirpfO.exe	upx
C:\Windows\System\oYSkGZA.exe	upx
C:\Windows\System\PRlrJrM.exe	upx
behavioral2/memory/1852-99-0x00007FF794FE0000-0x00007FF795334000-memory.dmp	upx
C:\Windows\System\GBvdMkr.exe	upx
C:\Windows\System\gJdTeVW.exe	upx
C:\Windows\System\CdgQqGh.exe	upx
C:\Windows\System\pEPAZYM.exe	upx
behavioral2/memory/700-74-0x00007FF75E300000-0x00007FF75E654000-memory.dmp	upx
behavioral2/memory/1704-78-0x00007FF67C780000-0x00007FF67CAD4000-memory.dmp	upx
behavioral2/memory/3380-58-0x00007FF68F6D0000-0x00007FF68FA24000-memory.dmp	upx
behavioral2/memory/1360-54-0x00007FF720380000-0x00007FF7206D4000-memory.dmp	upx
C:\Windows\System\itLBoXF.exe	upx
C:\Windows\System\AXKrfOL.exe	upx
behavioral2/memory/4304-144-0x00007FF75A120000-0x00007FF75A474000-memory.dmp	upx
C:\Windows\System\ryQRuOp.exe	upx
behavioral2/memory/3128-34-0x00007FF7422F0000-0x00007FF742644000-memory.dmp	upx
C:\Windows\System\toBNQMA.exe	upx
C:\Windows\System\EJdfyqy.exe	upx
C:\Windows\System\lgAvCFz.exe	upx
C:\Windows\System\tRsGdBu.exe	upx
behavioral2/memory/2268-188-0x00007FF6BCDD0000-0x00007FF6BD124000-memory.dmp	upx
C:\Windows\System\iwaExVL.exe	upx
behavioral2/memory/4816-174-0x00007FF6FF490000-0x00007FF6FF7E4000-memory.dmp	upx
C:\Windows\System\dJAxydw.exe	upx
behavioral2/memory/3068-917-0x00007FF655090000-0x00007FF6553E4000-memory.dmp	upx
behavioral2/memory/2168-920-0x00007FF75F690000-0x00007FF75F9E4000-memory.dmp	upx
C:\Windows\System\oUuxUJV.exe	upx
behavioral2/memory/2960-168-0x00007FF719BE0000-0x00007FF719F34000-memory.dmp	upx
behavioral2/memory/4068-164-0x00007FF6C6D40000-0x00007FF6C7094000-memory.dmp	upx
C:\Windows\System\ZjKRbwi.exe	upx
behavioral2/memory/1772-156-0x00007FF656F50000-0x00007FF6572A4000-memory.dmp	upx
C:\Windows\System\glppxSl.exe	upx
behavioral2/memory/4596-20-0x00007FF705FE0000-0x00007FF706334000-memory.dmp	upx

Enumerates connected drives 3 TTPs 16 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

description	ioc	process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe

Drops file in Windows directory 64 IoCs

Processes:

43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\System\nNLBWZo.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\FdTibtg.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\vUIcHAu.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\gCyeMXx.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\cmbenAC.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\QLcdCsl.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\Ryrtfnq.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\iAtIqTS.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\oUuxUJV.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\AcDyqWP.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\wKnQavb.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\XAYcYGh.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\SujMAty.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\OGkMjoW.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\bhjGLpO.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\GvxVvOK.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\RACuUtE.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\IoXpNtT.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\qzBvfZe.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\nqjZFNT.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\SgHYQJQ.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\mtVttou.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\gnNYpFU.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\EotmTnq.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\fuvcLtU.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\QFuWXKV.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\tsDFmTq.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\cEVfPZK.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\sKpVFMH.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\SYXaKni.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\WJIswEE.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\FngsJwm.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\gfzVXJL.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\AOrVRup.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\ZMxdVOX.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\uNrusqx.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\VybbVJt.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\tpXndPV.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\pUkEAme.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\hgWsxrW.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\VhOCUox.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\trfGWZO.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\whDUEOd.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\IBYdTDR.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\jDfbhnD.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\VJtDisw.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\bqpiZQF.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\MgSWwPk.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\ZGoXzXv.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\iQrSyII.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\wNfrVMC.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\EbUDOBM.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\MuaFZVf.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\CpfTBxu.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\jYjvMoi.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\fsxqCnq.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\hJPuNYh.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\jHhJzZF.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\pzDXbbd.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\XDyDUDH.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\xYXaUvt.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\tHoswgU.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\xJIebeM.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
File created	C:\Windows\System\RgbXxgk.exe	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

Processes:

SearchApp.exeSearchApp.exeSearchApp.exeSearchApp.exeSearchApp.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies registry class 64 IoCs

Processes:

SearchApp.exeSearchApp.exeexplorer.exeSearchApp.exeexplorer.exeexplorer.exeSearchApp.exeexplorer.exeexplorer.exeSearchApp.exeStartMenuExperienceHost.exeexplorer.exeexplorer.exesihost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4018855536-2201274732-320770143-1000\{73DF9AB0-D87A-470D-95AD-55D7C11F5343}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4018855536-2201274732-320770143-1000\{FCE21923-11F6-4777-9D95-4CA54CECCDC7}	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4018855536-2201274732-320770143-1000\{2789D290-3CB2-4BB6-A46B-8E755148EF49}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\WasEverActivated = "1"	sihost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\WasEverActivated = "1"	sihost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\MuiCache	SearchApp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

explorer.exeexplorer.exeexplorer.exe

description	pid	process
Token: SeShutdownPrivilege	4532	explorer.exe
Token: SeCreatePagefilePrivilege	4532	explorer.exe
Token: SeShutdownPrivilege	4532	explorer.exe
Token: SeCreatePagefilePrivilege	4532	explorer.exe
Token: SeShutdownPrivilege	4532	explorer.exe
Token: SeCreatePagefilePrivilege	4532	explorer.exe
Token: SeShutdownPrivilege	4532	explorer.exe
Token: SeCreatePagefilePrivilege	4532	explorer.exe
Token: SeShutdownPrivilege	4532	explorer.exe
Token: SeCreatePagefilePrivilege	4532	explorer.exe
Token: SeShutdownPrivilege	4532	explorer.exe
Token: SeCreatePagefilePrivilege	4532	explorer.exe
Token: SeShutdownPrivilege	4532	explorer.exe
Token: SeCreatePagefilePrivilege	4532	explorer.exe
Token: SeShutdownPrivilege	4532	explorer.exe
Token: SeCreatePagefilePrivilege	4532	explorer.exe
Token: SeShutdownPrivilege	4532	explorer.exe
Token: SeCreatePagefilePrivilege	4532	explorer.exe
Token: SeShutdownPrivilege	4532	explorer.exe
Token: SeCreatePagefilePrivilege	4532	explorer.exe
Token: SeShutdownPrivilege	2808	explorer.exe
Token: SeCreatePagefilePrivilege	2808	explorer.exe
Token: SeShutdownPrivilege	2808	explorer.exe
Token: SeCreatePagefilePrivilege	2808	explorer.exe
Token: SeShutdownPrivilege	2808	explorer.exe
Token: SeCreatePagefilePrivilege	2808	explorer.exe
Token: SeShutdownPrivilege	2808	explorer.exe
Token: SeCreatePagefilePrivilege	2808	explorer.exe
Token: SeShutdownPrivilege	2808	explorer.exe
Token: SeCreatePagefilePrivilege	2808	explorer.exe
Token: SeShutdownPrivilege	2808	explorer.exe
Token: SeCreatePagefilePrivilege	2808	explorer.exe
Token: SeShutdownPrivilege	2808	explorer.exe
Token: SeCreatePagefilePrivilege	2808	explorer.exe
Token: SeShutdownPrivilege	2808	explorer.exe
Token: SeCreatePagefilePrivilege	2808	explorer.exe
Token: SeShutdownPrivilege	2808	explorer.exe
Token: SeCreatePagefilePrivilege	2808	explorer.exe
Token: SeShutdownPrivilege	2808	explorer.exe
Token: SeCreatePagefilePrivilege	2808	explorer.exe
Token: SeShutdownPrivilege	2808	explorer.exe
Token: SeCreatePagefilePrivilege	2808	explorer.exe
Token: SeShutdownPrivilege	5300	explorer.exe
Token: SeCreatePagefilePrivilege	5300	explorer.exe
Token: SeShutdownPrivilege	5300	explorer.exe
Token: SeCreatePagefilePrivilege	5300	explorer.exe
Token: SeShutdownPrivilege	5300	explorer.exe
Token: SeCreatePagefilePrivilege	5300	explorer.exe
Token: SeShutdownPrivilege	5300	explorer.exe
Token: SeCreatePagefilePrivilege	5300	explorer.exe
Token: SeShutdownPrivilege	5300	explorer.exe
Token: SeCreatePagefilePrivilege	5300	explorer.exe
Token: SeShutdownPrivilege	5300	explorer.exe
Token: SeCreatePagefilePrivilege	5300	explorer.exe
Token: SeShutdownPrivilege	5300	explorer.exe
Token: SeCreatePagefilePrivilege	5300	explorer.exe
Token: SeShutdownPrivilege	5300	explorer.exe
Token: SeCreatePagefilePrivilege	5300	explorer.exe
Token: SeShutdownPrivilege	5300	explorer.exe
Token: SeCreatePagefilePrivilege	5300	explorer.exe
Token: SeShutdownPrivilege	5300	explorer.exe
Token: SeCreatePagefilePrivilege	5300	explorer.exe
Token: SeShutdownPrivilege	5300	explorer.exe
Token: SeCreatePagefilePrivilege	5300	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

sihost.exeexplorer.exeexplorer.exeexplorer.exe

pid	process
14752	sihost.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

explorer.exeexplorer.exeexplorer.exeexplorer.exe

pid	process
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
4532	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
2808	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
5300	explorer.exe
7796	explorer.exe
7796	explorer.exe
7796	explorer.exe
7796	explorer.exe
7796	explorer.exe
7796	explorer.exe
7796	explorer.exe
7796	explorer.exe
7796	explorer.exe
7796	explorer.exe
7796	explorer.exe
7796	explorer.exe
7796	explorer.exe
7796	explorer.exe
7796	explorer.exe
7796	explorer.exe

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

StartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeSearchApp.exeStartMenuExperienceHost.exeSearchApp.exeStartMenuExperienceHost.exeSearchApp.exeStartMenuExperienceHost.exeSearchApp.exeStartMenuExperienceHost.exeSearchApp.exeStartMenuExperienceHost.exe

pid	process
4148	StartMenuExperienceHost.exe
2036	StartMenuExperienceHost.exe
5376	StartMenuExperienceHost.exe
6028	SearchApp.exe
4372	StartMenuExperienceHost.exe
4208	SearchApp.exe
9872	StartMenuExperienceHost.exe
10124	SearchApp.exe
4932	StartMenuExperienceHost.exe
8184	SearchApp.exe
3492	StartMenuExperienceHost.exe
7820	SearchApp.exe
5600	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe

description	pid	process	target process
PID 3068 wrote to memory of 2168	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	kGUPAJy.exe
PID 3068 wrote to memory of 2168	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	kGUPAJy.exe
PID 3068 wrote to memory of 3128	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	JnQyBRW.exe
PID 3068 wrote to memory of 3128	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	JnQyBRW.exe
PID 3068 wrote to memory of 4596	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	MNSgCyq.exe
PID 3068 wrote to memory of 4596	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	MNSgCyq.exe
PID 3068 wrote to memory of 1948	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	ryQRuOp.exe
PID 3068 wrote to memory of 1948	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	ryQRuOp.exe
PID 3068 wrote to memory of 1360	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	BaGUkNp.exe
PID 3068 wrote to memory of 1360	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	BaGUkNp.exe
PID 3068 wrote to memory of 3380	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	tsDFmTq.exe
PID 3068 wrote to memory of 3380	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	tsDFmTq.exe
PID 3068 wrote to memory of 700	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	itLBoXF.exe
PID 3068 wrote to memory of 700	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	itLBoXF.exe
PID 3068 wrote to memory of 4208	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	CdgQqGh.exe
PID 3068 wrote to memory of 4208	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	CdgQqGh.exe
PID 3068 wrote to memory of 1704	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	YmGAXDE.exe
PID 3068 wrote to memory of 1704	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	YmGAXDE.exe
PID 3068 wrote to memory of 1852	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	pEPAZYM.exe
PID 3068 wrote to memory of 1852	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	pEPAZYM.exe
PID 3068 wrote to memory of 4860	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	GBvdMkr.exe
PID 3068 wrote to memory of 4860	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	GBvdMkr.exe
PID 3068 wrote to memory of 2728	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	PRlrJrM.exe
PID 3068 wrote to memory of 2728	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	PRlrJrM.exe
PID 3068 wrote to memory of 376	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	EbwDTDV.exe
PID 3068 wrote to memory of 376	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	EbwDTDV.exe
PID 3068 wrote to memory of 3496	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	oYSkGZA.exe
PID 3068 wrote to memory of 3496	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	oYSkGZA.exe
PID 3068 wrote to memory of 2092	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	uGirpfO.exe
PID 3068 wrote to memory of 2092	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	uGirpfO.exe
PID 3068 wrote to memory of 2284	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	KWJmfdZ.exe
PID 3068 wrote to memory of 2284	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	KWJmfdZ.exe
PID 3068 wrote to memory of 692	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	iHktXde.exe
PID 3068 wrote to memory of 692	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	iHktXde.exe
PID 3068 wrote to memory of 2908	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	mXRNFlA.exe
PID 3068 wrote to memory of 2908	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	mXRNFlA.exe
PID 3068 wrote to memory of 768	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	gJdTeVW.exe
PID 3068 wrote to memory of 768	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	gJdTeVW.exe
PID 3068 wrote to memory of 4856	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	tjiKHnD.exe
PID 3068 wrote to memory of 4856	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	tjiKHnD.exe
PID 3068 wrote to memory of 4016	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	bRQJTFC.exe
PID 3068 wrote to memory of 4016	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	bRQJTFC.exe
PID 3068 wrote to memory of 3392	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	BWylpAC.exe
PID 3068 wrote to memory of 3392	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	BWylpAC.exe
PID 3068 wrote to memory of 4400	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	fsYwFFH.exe
PID 3068 wrote to memory of 4400	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	fsYwFFH.exe
PID 3068 wrote to memory of 4304	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	AXKrfOL.exe
PID 3068 wrote to memory of 4304	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	AXKrfOL.exe
PID 3068 wrote to memory of 1772	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	glppxSl.exe
PID 3068 wrote to memory of 1772	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	glppxSl.exe
PID 3068 wrote to memory of 4068	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	ZjKRbwi.exe
PID 3068 wrote to memory of 4068	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	ZjKRbwi.exe
PID 3068 wrote to memory of 2960	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	EJdfyqy.exe
PID 3068 wrote to memory of 2960	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	EJdfyqy.exe
PID 3068 wrote to memory of 2268	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	toBNQMA.exe
PID 3068 wrote to memory of 2268	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	toBNQMA.exe
PID 3068 wrote to memory of 4816	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	tRsGdBu.exe
PID 3068 wrote to memory of 4816	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	tRsGdBu.exe
PID 3068 wrote to memory of 456	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	oUuxUJV.exe
PID 3068 wrote to memory of 456	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	oUuxUJV.exe
PID 3068 wrote to memory of 1712	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	dJAxydw.exe
PID 3068 wrote to memory of 1712	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	dJAxydw.exe
PID 3068 wrote to memory of 1356	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	iwaExVL.exe
PID 3068 wrote to memory of 1356	3068	43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe	iwaExVL.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\43b493723f459bba6657abbfd39451f0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\System\kGUPAJy.exe
C:\Windows\System\kGUPAJy.exe
2⤵
- Executes dropped EXE
PID:2168

C:\Windows\System\JnQyBRW.exe
C:\Windows\System\JnQyBRW.exe
2⤵
- Executes dropped EXE
PID:3128

C:\Windows\System\MNSgCyq.exe
C:\Windows\System\MNSgCyq.exe
2⤵
- Executes dropped EXE
PID:4596

C:\Windows\System\ryQRuOp.exe
C:\Windows\System\ryQRuOp.exe
2⤵
- Executes dropped EXE
PID:1948

C:\Windows\System\BaGUkNp.exe
C:\Windows\System\BaGUkNp.exe
2⤵
- Executes dropped EXE
PID:1360

C:\Windows\System\tsDFmTq.exe
C:\Windows\System\tsDFmTq.exe
2⤵
- Executes dropped EXE
PID:3380

C:\Windows\System\itLBoXF.exe
C:\Windows\System\itLBoXF.exe
2⤵
- Executes dropped EXE
PID:700

C:\Windows\System\CdgQqGh.exe
C:\Windows\System\CdgQqGh.exe
2⤵
- Executes dropped EXE
PID:4208

C:\Windows\System\YmGAXDE.exe
C:\Windows\System\YmGAXDE.exe
2⤵
- Executes dropped EXE
PID:1704

C:\Windows\System\pEPAZYM.exe
C:\Windows\System\pEPAZYM.exe
2⤵
- Executes dropped EXE
PID:1852

C:\Windows\System\GBvdMkr.exe
C:\Windows\System\GBvdMkr.exe
2⤵
- Executes dropped EXE
PID:4860

C:\Windows\System\PRlrJrM.exe
C:\Windows\System\PRlrJrM.exe
2⤵
- Executes dropped EXE
PID:2728

C:\Windows\System\EbwDTDV.exe
C:\Windows\System\EbwDTDV.exe
2⤵
- Executes dropped EXE
PID:376

C:\Windows\System\oYSkGZA.exe
C:\Windows\System\oYSkGZA.exe
2⤵
- Executes dropped EXE
PID:3496

C:\Windows\System\uGirpfO.exe
C:\Windows\System\uGirpfO.exe
2⤵
- Executes dropped EXE
PID:2092

C:\Windows\System\KWJmfdZ.exe
C:\Windows\System\KWJmfdZ.exe
2⤵
- Executes dropped EXE
PID:2284

C:\Windows\System\iHktXde.exe
C:\Windows\System\iHktXde.exe
2⤵
- Executes dropped EXE
PID:692

C:\Windows\System\mXRNFlA.exe
C:\Windows\System\mXRNFlA.exe
2⤵
- Executes dropped EXE
PID:2908

C:\Windows\System\gJdTeVW.exe
C:\Windows\System\gJdTeVW.exe
2⤵
- Executes dropped EXE
PID:768

C:\Windows\System\tjiKHnD.exe
C:\Windows\System\tjiKHnD.exe
2⤵
- Executes dropped EXE
PID:4856

C:\Windows\System\bRQJTFC.exe
C:\Windows\System\bRQJTFC.exe
2⤵
- Executes dropped EXE
PID:4016

C:\Windows\System\BWylpAC.exe
C:\Windows\System\BWylpAC.exe
2⤵
- Executes dropped EXE
PID:3392

C:\Windows\System\fsYwFFH.exe
C:\Windows\System\fsYwFFH.exe
2⤵
- Executes dropped EXE
PID:4400

C:\Windows\System\AXKrfOL.exe
C:\Windows\System\AXKrfOL.exe
2⤵
- Executes dropped EXE
PID:4304

C:\Windows\System\glppxSl.exe
C:\Windows\System\glppxSl.exe
2⤵
- Executes dropped EXE
PID:1772

C:\Windows\System\ZjKRbwi.exe
C:\Windows\System\ZjKRbwi.exe
2⤵
- Executes dropped EXE
PID:4068

C:\Windows\System\EJdfyqy.exe
C:\Windows\System\EJdfyqy.exe
2⤵
- Executes dropped EXE
PID:2960

C:\Windows\System\toBNQMA.exe
C:\Windows\System\toBNQMA.exe
2⤵
- Executes dropped EXE
PID:2268

C:\Windows\System\tRsGdBu.exe
C:\Windows\System\tRsGdBu.exe
2⤵
- Executes dropped EXE
PID:4816

C:\Windows\System\oUuxUJV.exe
C:\Windows\System\oUuxUJV.exe
2⤵
- Executes dropped EXE
PID:456

C:\Windows\System\dJAxydw.exe
C:\Windows\System\dJAxydw.exe
2⤵
- Executes dropped EXE
PID:1712

C:\Windows\System\iwaExVL.exe
C:\Windows\System\iwaExVL.exe
2⤵
- Executes dropped EXE
PID:1356

C:\Windows\System\lgAvCFz.exe
C:\Windows\System\lgAvCFz.exe
2⤵
- Executes dropped EXE
PID:640

C:\Windows\System\jHhJzZF.exe
C:\Windows\System\jHhJzZF.exe
2⤵
- Executes dropped EXE
PID:1572

C:\Windows\System\ZMxdVOX.exe
C:\Windows\System\ZMxdVOX.exe
2⤵
- Executes dropped EXE
PID:3824

C:\Windows\System\LEmaSSF.exe
C:\Windows\System\LEmaSSF.exe
2⤵
- Executes dropped EXE
PID:5056

C:\Windows\System\VQOKKKt.exe
C:\Windows\System\VQOKKKt.exe
2⤵
- Executes dropped EXE
PID:3024

C:\Windows\System\KgbIJzo.exe
C:\Windows\System\KgbIJzo.exe
2⤵
- Executes dropped EXE
PID:3428

C:\Windows\System\MsbjWHd.exe
C:\Windows\System\MsbjWHd.exe
2⤵
- Executes dropped EXE
PID:4392

C:\Windows\System\fEzqAJl.exe
C:\Windows\System\fEzqAJl.exe
2⤵
- Executes dropped EXE
PID:1892

C:\Windows\System\smtqISJ.exe
C:\Windows\System\smtqISJ.exe
2⤵
- Executes dropped EXE
PID:1440

C:\Windows\System\XMYhTHN.exe
C:\Windows\System\XMYhTHN.exe
2⤵
- Executes dropped EXE
PID:2776

C:\Windows\System\zExfAwF.exe
C:\Windows\System\zExfAwF.exe
2⤵
- Executes dropped EXE
PID:2636

C:\Windows\System\vSULVfe.exe
C:\Windows\System\vSULVfe.exe
2⤵
- Executes dropped EXE
PID:2144

C:\Windows\System\JbAWNIs.exe
C:\Windows\System\JbAWNIs.exe
2⤵
- Executes dropped EXE
PID:2028

C:\Windows\System\kTcHAyR.exe
C:\Windows\System\kTcHAyR.exe
2⤵
- Executes dropped EXE
PID:2516

C:\Windows\System\ldyVoPU.exe
C:\Windows\System\ldyVoPU.exe
2⤵
- Executes dropped EXE
PID:2012

C:\Windows\System\nSwGjdP.exe
C:\Windows\System\nSwGjdP.exe
2⤵
- Executes dropped EXE
PID:4764

C:\Windows\System\lgBLUDs.exe
C:\Windows\System\lgBLUDs.exe
2⤵
- Executes dropped EXE
PID:2856

C:\Windows\System\HxsdAEa.exe
C:\Windows\System\HxsdAEa.exe
2⤵
- Executes dropped EXE
PID:2572

C:\Windows\System\gCKMcZa.exe
C:\Windows\System\gCKMcZa.exe
2⤵
- Executes dropped EXE
PID:4844

C:\Windows\System\pgpPjEt.exe
C:\Windows\System\pgpPjEt.exe
2⤵
- Executes dropped EXE
PID:2128

C:\Windows\System\MJMoWKQ.exe
C:\Windows\System\MJMoWKQ.exe
2⤵
- Executes dropped EXE
PID:4520

C:\Windows\System\JhJKiZy.exe
C:\Windows\System\JhJKiZy.exe
2⤵
- Executes dropped EXE
PID:3492

C:\Windows\System\NcQHaFd.exe
C:\Windows\System\NcQHaFd.exe
2⤵
- Executes dropped EXE
PID:3124

C:\Windows\System\XyixSQK.exe
C:\Windows\System\XyixSQK.exe
2⤵
- Executes dropped EXE
PID:1296

C:\Windows\System\pzDXbbd.exe
C:\Windows\System\pzDXbbd.exe
2⤵
- Executes dropped EXE
PID:4336

C:\Windows\System\DknFmup.exe
C:\Windows\System\DknFmup.exe
2⤵
- Executes dropped EXE
PID:2040

C:\Windows\System\SGOpmSZ.exe
C:\Windows\System\SGOpmSZ.exe
2⤵
- Executes dropped EXE
PID:4936

C:\Windows\System\rsDIaZO.exe
C:\Windows\System\rsDIaZO.exe
2⤵
- Executes dropped EXE
PID:3856

C:\Windows\System\UliFgxp.exe
C:\Windows\System\UliFgxp.exe
2⤵
- Executes dropped EXE
PID:5096

C:\Windows\System\nINaJZU.exe
C:\Windows\System\nINaJZU.exe
2⤵
- Executes dropped EXE
PID:1556

C:\Windows\System\kWpDTeQ.exe
C:\Windows\System\kWpDTeQ.exe
2⤵
- Executes dropped EXE
PID:4928

C:\Windows\System\qqhFzCv.exe
C:\Windows\System\qqhFzCv.exe
2⤵
- Executes dropped EXE
PID:4712

C:\Windows\System\IIuJmIk.exe
C:\Windows\System\IIuJmIk.exe
2⤵
PID:3956

C:\Windows\System\fzzBtFa.exe
C:\Windows\System\fzzBtFa.exe
2⤵
PID:4556

C:\Windows\System\cVESwRm.exe
C:\Windows\System\cVESwRm.exe
2⤵
PID:2820

C:\Windows\System\CHyXVgK.exe
C:\Windows\System\CHyXVgK.exe
2⤵
PID:2772

C:\Windows\System\cEVfPZK.exe
C:\Windows\System\cEVfPZK.exe
2⤵
PID:1748

C:\Windows\System\GColWDS.exe
C:\Windows\System\GColWDS.exe
2⤵
PID:1968

C:\Windows\System\RACuUtE.exe
C:\Windows\System\RACuUtE.exe
2⤵
PID:1124

C:\Windows\System\MHUKoiu.exe
C:\Windows\System\MHUKoiu.exe
2⤵
PID:2644

C:\Windows\System\IoXpNtT.exe
C:\Windows\System\IoXpNtT.exe
2⤵
PID:2140

C:\Windows\System\SHrvcVy.exe
C:\Windows\System\SHrvcVy.exe
2⤵
PID:1612

C:\Windows\System\UdpcMls.exe
C:\Windows\System\UdpcMls.exe
2⤵
PID:1096

C:\Windows\System\JkNNmYT.exe
C:\Windows\System\JkNNmYT.exe
2⤵
PID:3440

C:\Windows\System\sMVyUEW.exe
C:\Windows\System\sMVyUEW.exe
2⤵
PID:468

C:\Windows\System\ARoStLP.exe
C:\Windows\System\ARoStLP.exe
2⤵
PID:2500

C:\Windows\System\CkiFbFw.exe
C:\Windows\System\CkiFbFw.exe
2⤵
PID:1776

C:\Windows\System\cpnuNVo.exe
C:\Windows\System\cpnuNVo.exe
2⤵
PID:548

C:\Windows\System\CwlLUFx.exe
C:\Windows\System\CwlLUFx.exe
2⤵
PID:3504

C:\Windows\System\DLKKulA.exe
C:\Windows\System\DLKKulA.exe
2⤵
PID:3792

C:\Windows\System\kDyMoWD.exe
C:\Windows\System\kDyMoWD.exe
2⤵
PID:2680

C:\Windows\System\mlIaPqa.exe
C:\Windows\System\mlIaPqa.exe
2⤵
PID:1568

C:\Windows\System\oNCPrbe.exe
C:\Windows\System\oNCPrbe.exe
2⤵
PID:4028

C:\Windows\System\vAlVwwj.exe
C:\Windows\System\vAlVwwj.exe
2⤵
PID:3204

C:\Windows\System\zAbjVsc.exe
C:\Windows\System\zAbjVsc.exe
2⤵
PID:5152

C:\Windows\System\AcDyqWP.exe
C:\Windows\System\AcDyqWP.exe
2⤵
PID:5188

C:\Windows\System\RjKLCFl.exe
C:\Windows\System\RjKLCFl.exe
2⤵
PID:5212

C:\Windows\System\Cnvdoed.exe
C:\Windows\System\Cnvdoed.exe
2⤵
PID:5244

C:\Windows\System\CLdkoRw.exe
C:\Windows\System\CLdkoRw.exe
2⤵
PID:5272

C:\Windows\System\pLYYueC.exe
C:\Windows\System\pLYYueC.exe
2⤵
PID:5312

C:\Windows\System\kqLuWCv.exe
C:\Windows\System\kqLuWCv.exe
2⤵
PID:5332

C:\Windows\System\husQnHZ.exe
C:\Windows\System\husQnHZ.exe
2⤵
PID:5368

C:\Windows\System\iOfEGLD.exe
C:\Windows\System\iOfEGLD.exe
2⤵
PID:5388

C:\Windows\System\qKPtvIF.exe
C:\Windows\System\qKPtvIF.exe
2⤵
PID:5428

C:\Windows\System\jrSTUCV.exe
C:\Windows\System\jrSTUCV.exe
2⤵
PID:5448

C:\Windows\System\oFZRoLG.exe
C:\Windows\System\oFZRoLG.exe
2⤵
PID:5476

C:\Windows\System\UVcbsss.exe
C:\Windows\System\UVcbsss.exe
2⤵
PID:5512

C:\Windows\System\wNfrVMC.exe
C:\Windows\System\wNfrVMC.exe
2⤵
PID:5532

C:\Windows\System\NpvGEaV.exe
C:\Windows\System\NpvGEaV.exe
2⤵
PID:5556

C:\Windows\System\evmmRlL.exe
C:\Windows\System\evmmRlL.exe
2⤵
PID:5580

C:\Windows\System\PivVLIr.exe
C:\Windows\System\PivVLIr.exe
2⤵
PID:5612

C:\Windows\System\wKnQavb.exe
C:\Windows\System\wKnQavb.exe
2⤵
PID:5656

C:\Windows\System\VeUEHMN.exe
C:\Windows\System\VeUEHMN.exe
2⤵
PID:5680

C:\Windows\System\FmaSFjG.exe
C:\Windows\System\FmaSFjG.exe
2⤵
PID:5708

C:\Windows\System\WoNMHVs.exe
C:\Windows\System\WoNMHVs.exe
2⤵
PID:5736

C:\Windows\System\ZLBqgrE.exe
C:\Windows\System\ZLBqgrE.exe
2⤵
PID:5768

C:\Windows\System\NFqZDsX.exe
C:\Windows\System\NFqZDsX.exe
2⤵
PID:5792

C:\Windows\System\QvfNhzm.exe
C:\Windows\System\QvfNhzm.exe
2⤵
PID:5828

C:\Windows\System\oDBClTW.exe
C:\Windows\System\oDBClTW.exe
2⤵
PID:5848

C:\Windows\System\XAYcYGh.exe
C:\Windows\System\XAYcYGh.exe
2⤵
PID:5884

C:\Windows\System\YNZpRXr.exe
C:\Windows\System\YNZpRXr.exe
2⤵
PID:5904

C:\Windows\System\nKZtDfD.exe
C:\Windows\System\nKZtDfD.exe
2⤵
PID:5940

C:\Windows\System\DRoZHMg.exe
C:\Windows\System\DRoZHMg.exe
2⤵
PID:5960

C:\Windows\System\YymqyUw.exe
C:\Windows\System\YymqyUw.exe
2⤵
PID:5988

C:\Windows\System\WlBgZJD.exe
C:\Windows\System\WlBgZJD.exe
2⤵
PID:6020

C:\Windows\System\pzAxNeq.exe
C:\Windows\System\pzAxNeq.exe
2⤵
PID:6048

C:\Windows\System\VicnkOh.exe
C:\Windows\System\VicnkOh.exe
2⤵
PID:6072

C:\Windows\System\TgnzCqn.exe
C:\Windows\System\TgnzCqn.exe
2⤵
PID:6100

C:\Windows\System\XQOOepM.exe
C:\Windows\System\XQOOepM.exe
2⤵
PID:6128

C:\Windows\System\dzvISke.exe
C:\Windows\System\dzvISke.exe
2⤵
PID:5136

C:\Windows\System\FbRcAIR.exe
C:\Windows\System\FbRcAIR.exe
2⤵
PID:5208

C:\Windows\System\HxYMEuy.exe
C:\Windows\System\HxYMEuy.exe
2⤵
PID:5304

C:\Windows\System\zfJIndD.exe
C:\Windows\System\zfJIndD.exe
2⤵
PID:5352

C:\Windows\System\ZhsqNnK.exe
C:\Windows\System\ZhsqNnK.exe
2⤵
PID:5436

C:\Windows\System\PfnQjKv.exe
C:\Windows\System\PfnQjKv.exe
2⤵
PID:5496

C:\Windows\System\brNDrdA.exe
C:\Windows\System\brNDrdA.exe
2⤵
PID:5568

C:\Windows\System\SHfJHCL.exe
C:\Windows\System\SHfJHCL.exe
2⤵
PID:5636

C:\Windows\System\YpGAbFZ.exe
C:\Windows\System\YpGAbFZ.exe
2⤵
PID:5692

C:\Windows\System\SgHYQJQ.exe
C:\Windows\System\SgHYQJQ.exe
2⤵
PID:5784

C:\Windows\System\yclOGbO.exe
C:\Windows\System\yclOGbO.exe
2⤵
PID:5844

C:\Windows\System\OlsFgFl.exe
C:\Windows\System\OlsFgFl.exe
2⤵
PID:5896

C:\Windows\System\EFzGCRR.exe
C:\Windows\System\EFzGCRR.exe
2⤵
PID:6008

C:\Windows\System\UwvtPZY.exe
C:\Windows\System\UwvtPZY.exe
2⤵
PID:6112

C:\Windows\System\MGscTes.exe
C:\Windows\System\MGscTes.exe
2⤵
PID:5264

C:\Windows\System\JnLrBqp.exe
C:\Windows\System\JnLrBqp.exe
2⤵
PID:5460

C:\Windows\System\LciuoGu.exe
C:\Windows\System\LciuoGu.exe
2⤵
PID:5664

C:\Windows\System\pFQyJfW.exe
C:\Windows\System\pFQyJfW.exe
2⤵
PID:5812

C:\Windows\System\wzTZTQT.exe
C:\Windows\System\wzTZTQT.exe
2⤵
PID:6092

C:\Windows\System\kEeAxqC.exe
C:\Windows\System\kEeAxqC.exe
2⤵
PID:5816

C:\Windows\System\ZURNfDm.exe
C:\Windows\System\ZURNfDm.exe
2⤵
PID:5600

C:\Windows\System\oiYhHiu.exe
C:\Windows\System\oiYhHiu.exe
2⤵
PID:6184

C:\Windows\System\xTVvIGe.exe
C:\Windows\System\xTVvIGe.exe
2⤵
PID:6232

C:\Windows\System\YeBrpmw.exe
C:\Windows\System\YeBrpmw.exe
2⤵
PID:6268

C:\Windows\System\TRyeRhK.exe
C:\Windows\System\TRyeRhK.exe
2⤵
PID:6288

C:\Windows\System\vUIcHAu.exe
C:\Windows\System\vUIcHAu.exe
2⤵
PID:6312

C:\Windows\System\EQAIFLR.exe
C:\Windows\System\EQAIFLR.exe
2⤵
PID:6336

C:\Windows\System\Eodqcbs.exe
C:\Windows\System\Eodqcbs.exe
2⤵
PID:6376

C:\Windows\System\xWaHmif.exe
C:\Windows\System\xWaHmif.exe
2⤵
PID:6416

C:\Windows\System\ncjLRFW.exe
C:\Windows\System\ncjLRFW.exe
2⤵
PID:6444

C:\Windows\System\ggAMCmV.exe
C:\Windows\System\ggAMCmV.exe
2⤵
PID:6472

C:\Windows\System\oySDGKG.exe
C:\Windows\System\oySDGKG.exe
2⤵
PID:6508

C:\Windows\System\iFdufsa.exe
C:\Windows\System\iFdufsa.exe
2⤵
PID:6536

C:\Windows\System\rfWgccv.exe
C:\Windows\System\rfWgccv.exe
2⤵
PID:6568

C:\Windows\System\hiupaqc.exe
C:\Windows\System\hiupaqc.exe
2⤵
PID:6592

C:\Windows\System\mtVttou.exe
C:\Windows\System\mtVttou.exe
2⤵
PID:6632

C:\Windows\System\bwwlYQe.exe
C:\Windows\System\bwwlYQe.exe
2⤵
PID:6668

C:\Windows\System\HLYQhzW.exe
C:\Windows\System\HLYQhzW.exe
2⤵
PID:6696

C:\Windows\System\dbVdKgV.exe
C:\Windows\System\dbVdKgV.exe
2⤵
PID:6712

C:\Windows\System\DpOelRQ.exe
C:\Windows\System\DpOelRQ.exe
2⤵
PID:6760

C:\Windows\System\ZNgwuKG.exe
C:\Windows\System\ZNgwuKG.exe
2⤵
PID:6788

C:\Windows\System\SujMAty.exe
C:\Windows\System\SujMAty.exe
2⤵
PID:6816

C:\Windows\System\XaBJyJC.exe
C:\Windows\System\XaBJyJC.exe
2⤵
PID:6844

C:\Windows\System\MpbfXrz.exe
C:\Windows\System\MpbfXrz.exe
2⤵
PID:6880

C:\Windows\System\WiUOZVv.exe
C:\Windows\System\WiUOZVv.exe
2⤵
PID:6908

C:\Windows\System\UQJpMgc.exe
C:\Windows\System\UQJpMgc.exe
2⤵
PID:6928

C:\Windows\System\IvrZqOG.exe
C:\Windows\System\IvrZqOG.exe
2⤵
PID:6956

C:\Windows\System\fzdrKMe.exe
C:\Windows\System\fzdrKMe.exe
2⤵
PID:6984

C:\Windows\System\PywawZB.exe
C:\Windows\System\PywawZB.exe
2⤵
PID:7012

C:\Windows\System\VLqkHge.exe
C:\Windows\System\VLqkHge.exe
2⤵
PID:7040

C:\Windows\System\hsgeyjy.exe
C:\Windows\System\hsgeyjy.exe
2⤵
PID:7068

C:\Windows\System\FCPnxQz.exe
C:\Windows\System\FCPnxQz.exe
2⤵
PID:7096

C:\Windows\System\CztOQan.exe
C:\Windows\System\CztOQan.exe
2⤵
PID:7124

C:\Windows\System\MtfJJxA.exe
C:\Windows\System\MtfJJxA.exe
2⤵
PID:7152

C:\Windows\System\KVbaRzC.exe
C:\Windows\System\KVbaRzC.exe
2⤵
PID:6228

C:\Windows\System\AvkPsWG.exe
C:\Windows\System\AvkPsWG.exe
2⤵
PID:6308

C:\Windows\System\eShpaVS.exe
C:\Windows\System\eShpaVS.exe
2⤵
PID:6400

C:\Windows\System\eLeJiEo.exe
C:\Windows\System\eLeJiEo.exe
2⤵
PID:6432

C:\Windows\System\RdFHYDI.exe
C:\Windows\System\RdFHYDI.exe
2⤵
PID:6484

C:\Windows\System\UQGxERw.exe
C:\Windows\System\UQGxERw.exe
2⤵
PID:6560

C:\Windows\System\OhACDSj.exe
C:\Windows\System\OhACDSj.exe
2⤵
PID:6624

C:\Windows\System\eoRQgjs.exe
C:\Windows\System\eoRQgjs.exe
2⤵
PID:6708

C:\Windows\System\KNApfNa.exe
C:\Windows\System\KNApfNa.exe
2⤵
PID:6784

C:\Windows\System\yBGTQdi.exe
C:\Windows\System\yBGTQdi.exe
2⤵
PID:6836

C:\Windows\System\rsvWfPi.exe
C:\Windows\System\rsvWfPi.exe
2⤵
PID:6896

C:\Windows\System\bqUyWMQ.exe
C:\Windows\System\bqUyWMQ.exe
2⤵
PID:6980

C:\Windows\System\EvCGuuW.exe
C:\Windows\System\EvCGuuW.exe
2⤵
PID:7036

C:\Windows\System\RIjDipv.exe
C:\Windows\System\RIjDipv.exe
2⤵
PID:7108

C:\Windows\System\wthToTp.exe
C:\Windows\System\wthToTp.exe
2⤵
PID:7164

C:\Windows\System\vVKbmjB.exe
C:\Windows\System\vVKbmjB.exe
2⤵
PID:6344

C:\Windows\System\gfJBtFL.exe
C:\Windows\System\gfJBtFL.exe
2⤵
PID:6468

C:\Windows\System\gCyeMXx.exe
C:\Windows\System\gCyeMXx.exe
2⤵
PID:6664

C:\Windows\System\sXyTiWu.exe
C:\Windows\System\sXyTiWu.exe
2⤵
PID:6828

C:\Windows\System\MuaFZVf.exe
C:\Windows\System\MuaFZVf.exe
2⤵
PID:6968

C:\Windows\System\nevLvqC.exe
C:\Windows\System\nevLvqC.exe
2⤵
PID:7148

C:\Windows\System\jkezSmL.exe
C:\Windows\System\jkezSmL.exe
2⤵
PID:6388

C:\Windows\System\YFfBVTh.exe
C:\Windows\System\YFfBVTh.exe
2⤵
PID:6952

C:\Windows\System\hBHyGcc.exe
C:\Windows\System\hBHyGcc.exe
2⤵
PID:6304

C:\Windows\System\IBYdTDR.exe
C:\Windows\System\IBYdTDR.exe
2⤵
PID:7092

C:\Windows\System\UPxwlxQ.exe
C:\Windows\System\UPxwlxQ.exe
2⤵
PID:7184

C:\Windows\System\KoWcxEw.exe
C:\Windows\System\KoWcxEw.exe
2⤵
PID:7212

C:\Windows\System\eSnUwiH.exe
C:\Windows\System\eSnUwiH.exe
2⤵
PID:7240

C:\Windows\System\drjqKfQ.exe
C:\Windows\System\drjqKfQ.exe
2⤵
PID:7272

C:\Windows\System\fmQikgz.exe
C:\Windows\System\fmQikgz.exe
2⤵
PID:7300

C:\Windows\System\biUSgqB.exe
C:\Windows\System\biUSgqB.exe
2⤵
PID:7324

C:\Windows\System\GhRTrZA.exe
C:\Windows\System\GhRTrZA.exe
2⤵
PID:7356

C:\Windows\System\xYXaUvt.exe
C:\Windows\System\xYXaUvt.exe
2⤵
PID:7388

C:\Windows\System\iYGhcDD.exe
C:\Windows\System\iYGhcDD.exe
2⤵
PID:7408

C:\Windows\System\ySLuSyq.exe
C:\Windows\System\ySLuSyq.exe
2⤵
PID:7436

C:\Windows\System\pETgzaf.exe
C:\Windows\System\pETgzaf.exe
2⤵
PID:7472

C:\Windows\System\UfyDPDE.exe
C:\Windows\System\UfyDPDE.exe
2⤵
PID:7492

C:\Windows\System\SmAUKfU.exe
C:\Windows\System\SmAUKfU.exe
2⤵
PID:7520

C:\Windows\System\hxZyMDo.exe
C:\Windows\System\hxZyMDo.exe
2⤵
PID:7548

C:\Windows\System\pQyeXME.exe
C:\Windows\System\pQyeXME.exe
2⤵
PID:7584

C:\Windows\System\mKJmAjF.exe
C:\Windows\System\mKJmAjF.exe
2⤵
PID:7604

C:\Windows\System\bubdeia.exe
C:\Windows\System\bubdeia.exe
2⤵
PID:7632

C:\Windows\System\thvSqLU.exe
C:\Windows\System\thvSqLU.exe
2⤵
PID:7664

C:\Windows\System\jFfEZoY.exe
C:\Windows\System\jFfEZoY.exe
2⤵
PID:7688

C:\Windows\System\TipwNOm.exe
C:\Windows\System\TipwNOm.exe
2⤵
PID:7716

C:\Windows\System\IrkcNDT.exe
C:\Windows\System\IrkcNDT.exe
2⤵
PID:7744

C:\Windows\System\jDfbhnD.exe
C:\Windows\System\jDfbhnD.exe
2⤵
PID:7776

C:\Windows\System\uNrusqx.exe
C:\Windows\System\uNrusqx.exe
2⤵
PID:7804

C:\Windows\System\nWzxbpb.exe
C:\Windows\System\nWzxbpb.exe
2⤵
PID:7832

C:\Windows\System\MtgGhjW.exe
C:\Windows\System\MtgGhjW.exe
2⤵
PID:7856

C:\Windows\System\EbUDOBM.exe
C:\Windows\System\EbUDOBM.exe
2⤵
PID:7892

C:\Windows\System\HleBhIT.exe
C:\Windows\System\HleBhIT.exe
2⤵
PID:7916

C:\Windows\System\mxewbJe.exe
C:\Windows\System\mxewbJe.exe
2⤵
PID:7936

C:\Windows\System\DIMTQUw.exe
C:\Windows\System\DIMTQUw.exe
2⤵
PID:7960

C:\Windows\System\gaMwrrX.exe
C:\Windows\System\gaMwrrX.exe
2⤵
PID:7992

C:\Windows\System\RSNigqS.exe
C:\Windows\System\RSNigqS.exe
2⤵
PID:8028

C:\Windows\System\bXcefNU.exe
C:\Windows\System\bXcefNU.exe
2⤵
PID:8060

C:\Windows\System\thMgvXO.exe
C:\Windows\System\thMgvXO.exe
2⤵
PID:8084

C:\Windows\System\XGiOHvz.exe
C:\Windows\System\XGiOHvz.exe
2⤵
PID:8116

C:\Windows\System\nIDfcmm.exe
C:\Windows\System\nIDfcmm.exe
2⤵
PID:8140

C:\Windows\System\HGyQfMI.exe
C:\Windows\System\HGyQfMI.exe
2⤵
PID:8168

C:\Windows\System\fSBJYga.exe
C:\Windows\System\fSBJYga.exe
2⤵
PID:7176

C:\Windows\System\VJtDisw.exe
C:\Windows\System\VJtDisw.exe
2⤵
PID:7260

C:\Windows\System\RQuGBmm.exe
C:\Windows\System\RQuGBmm.exe
2⤵
PID:7320

C:\Windows\System\oVTAYAI.exe
C:\Windows\System\oVTAYAI.exe
2⤵
PID:7396

C:\Windows\System\OGkMjoW.exe
C:\Windows\System\OGkMjoW.exe
2⤵
PID:7460

C:\Windows\System\hsaMfdD.exe
C:\Windows\System\hsaMfdD.exe
2⤵
PID:7516

C:\Windows\System\UcxVndz.exe
C:\Windows\System\UcxVndz.exe
2⤵
PID:7592

C:\Windows\System\HNetGcb.exe
C:\Windows\System\HNetGcb.exe
2⤵
PID:7652

C:\Windows\System\EhXYNpX.exe
C:\Windows\System\EhXYNpX.exe
2⤵
PID:7708

C:\Windows\System\EwKgYoU.exe
C:\Windows\System\EwKgYoU.exe
2⤵
PID:7784

C:\Windows\System\lbJHcSw.exe
C:\Windows\System\lbJHcSw.exe
2⤵
PID:7840

C:\Windows\System\QROzVFv.exe
C:\Windows\System\QROzVFv.exe
2⤵
PID:7932

C:\Windows\System\vvlVFVR.exe
C:\Windows\System\vvlVFVR.exe
2⤵
PID:7976

C:\Windows\System\HoywtmA.exe
C:\Windows\System\HoywtmA.exe
2⤵
PID:8040

C:\Windows\System\RgbXxgk.exe
C:\Windows\System\RgbXxgk.exe
2⤵
PID:8104

C:\Windows\System\bhjGLpO.exe
C:\Windows\System\bhjGLpO.exe
2⤵
PID:8188

C:\Windows\System\mXWGXuZ.exe
C:\Windows\System\mXWGXuZ.exe
2⤵
PID:7288

C:\Windows\System\IvJeiiw.exe
C:\Windows\System\IvJeiiw.exe
2⤵
PID:7484

C:\Windows\System\tHoswgU.exe
C:\Windows\System\tHoswgU.exe
2⤵
PID:7572

C:\Windows\System\sSZHgeo.exe
C:\Windows\System\sSZHgeo.exe
2⤵
PID:6808

C:\Windows\System\MCMBcyX.exe
C:\Windows\System\MCMBcyX.exe
2⤵
PID:7944

C:\Windows\System\ffuqqUB.exe
C:\Windows\System\ffuqqUB.exe
2⤵
PID:8068

C:\Windows\System\wLiuWiZ.exe
C:\Windows\System\wLiuWiZ.exe
2⤵
PID:7236

C:\Windows\System\dpeRILf.exe
C:\Windows\System\dpeRILf.exe
2⤵
PID:7180

C:\Windows\System\sKpVFMH.exe
C:\Windows\System\sKpVFMH.exe
2⤵
PID:7948

C:\Windows\System\UtqSrCp.exe
C:\Windows\System\UtqSrCp.exe
2⤵
PID:7824

C:\Windows\System\POwsImn.exe
C:\Windows\System\POwsImn.exe
2⤵
PID:8200

C:\Windows\System\zyNxAxL.exe
C:\Windows\System\zyNxAxL.exe
2⤵
PID:8220

C:\Windows\System\PfOiMjG.exe
C:\Windows\System\PfOiMjG.exe
2⤵
PID:8248

C:\Windows\System\MPmFvWh.exe
C:\Windows\System\MPmFvWh.exe
2⤵
PID:8276

C:\Windows\System\Bjmqkta.exe
C:\Windows\System\Bjmqkta.exe
2⤵
PID:8304

C:\Windows\System\XrtJVYQ.exe
C:\Windows\System\XrtJVYQ.exe
2⤵
PID:8332

C:\Windows\System\prWAcjf.exe
C:\Windows\System\prWAcjf.exe
2⤵
PID:8360

C:\Windows\System\vCxtsrU.exe
C:\Windows\System\vCxtsrU.exe
2⤵
PID:8392

C:\Windows\System\SYXaKni.exe
C:\Windows\System\SYXaKni.exe
2⤵
PID:8420

C:\Windows\System\lrROlVD.exe
C:\Windows\System\lrROlVD.exe
2⤵
PID:8444

C:\Windows\System\ePiEWub.exe
C:\Windows\System\ePiEWub.exe
2⤵
PID:8472

C:\Windows\System\UqHpnkl.exe
C:\Windows\System\UqHpnkl.exe
2⤵
PID:8496

C:\Windows\System\XuxQItj.exe
C:\Windows\System\XuxQItj.exe
2⤵
PID:8512

C:\Windows\System\UfyUcWk.exe
C:\Windows\System\UfyUcWk.exe
2⤵
PID:8536

C:\Windows\System\sTjmNku.exe
C:\Windows\System\sTjmNku.exe
2⤵
PID:8556

C:\Windows\System\VsTzseR.exe
C:\Windows\System\VsTzseR.exe
2⤵
PID:8576

C:\Windows\System\UNfRQXm.exe
C:\Windows\System\UNfRQXm.exe
2⤵
PID:8608

C:\Windows\System\EKGUWdT.exe
C:\Windows\System\EKGUWdT.exe
2⤵
PID:8648

C:\Windows\System\MWHsoRv.exe
C:\Windows\System\MWHsoRv.exe
2⤵
PID:8692

C:\Windows\System\vYhJrrp.exe
C:\Windows\System\vYhJrrp.exe
2⤵
PID:8740

C:\Windows\System\eqocbQQ.exe
C:\Windows\System\eqocbQQ.exe
2⤵
PID:8776

C:\Windows\System\mDbEQbE.exe
C:\Windows\System\mDbEQbE.exe
2⤵
PID:8808

C:\Windows\System\ccWCKSf.exe
C:\Windows\System\ccWCKSf.exe
2⤵
PID:8836

C:\Windows\System\LLPPhBN.exe
C:\Windows\System\LLPPhBN.exe
2⤵
PID:8880

C:\Windows\System\mvrmRsE.exe
C:\Windows\System\mvrmRsE.exe
2⤵
PID:8904

C:\Windows\System\lMZckSb.exe
C:\Windows\System\lMZckSb.exe
2⤵
PID:8944

C:\Windows\System\WJIswEE.exe
C:\Windows\System\WJIswEE.exe
2⤵
PID:8968

C:\Windows\System\nNLBWZo.exe
C:\Windows\System\nNLBWZo.exe
2⤵
PID:8992

C:\Windows\System\TjpOMPe.exe
C:\Windows\System\TjpOMPe.exe
2⤵
PID:9024

C:\Windows\System\PjkGiTD.exe
C:\Windows\System\PjkGiTD.exe
2⤵
PID:9060

C:\Windows\System\htFLJyL.exe
C:\Windows\System\htFLJyL.exe
2⤵
PID:9080

C:\Windows\System\fqGrEwz.exe
C:\Windows\System\fqGrEwz.exe
2⤵
PID:9112

C:\Windows\System\nmIlQXw.exe
C:\Windows\System\nmIlQXw.exe
2⤵
PID:9152

C:\Windows\System\iVAXwFQ.exe
C:\Windows\System\iVAXwFQ.exe
2⤵
PID:9176

C:\Windows\System\tPhrTsH.exe
C:\Windows\System\tPhrTsH.exe
2⤵
PID:9208

C:\Windows\System\XgoGYue.exe
C:\Windows\System\XgoGYue.exe
2⤵
PID:8232

C:\Windows\System\coozXmU.exe
C:\Windows\System\coozXmU.exe
2⤵
PID:8296

C:\Windows\System\ltRscVC.exe
C:\Windows\System\ltRscVC.exe
2⤵
PID:8372

C:\Windows\System\IUyqcpD.exe
C:\Windows\System\IUyqcpD.exe
2⤵
PID:8428

C:\Windows\System\NmjvoFt.exe
C:\Windows\System\NmjvoFt.exe
2⤵
PID:8464

C:\Windows\System\wgbkfZw.exe
C:\Windows\System\wgbkfZw.exe
2⤵
PID:8572

C:\Windows\System\twTZXDl.exe
C:\Windows\System\twTZXDl.exe
2⤵
PID:8636

C:\Windows\System\ABbCpcZ.exe
C:\Windows\System\ABbCpcZ.exe
2⤵
PID:8704

C:\Windows\System\qRrENBD.exe
C:\Windows\System\qRrENBD.exe
2⤵
PID:8796

C:\Windows\System\VQHRser.exe
C:\Windows\System\VQHRser.exe
2⤵
PID:8856

C:\Windows\System\KhFsKsX.exe
C:\Windows\System\KhFsKsX.exe
2⤵
PID:8928

C:\Windows\System\YhEAfGI.exe
C:\Windows\System\YhEAfGI.exe
2⤵
PID:8988

C:\Windows\System\ssrrQFd.exe
C:\Windows\System\ssrrQFd.exe
2⤵
PID:9068

C:\Windows\System\gXvErjE.exe
C:\Windows\System\gXvErjE.exe
2⤵
PID:9132

C:\Windows\System\tvvNYBC.exe
C:\Windows\System\tvvNYBC.exe
2⤵
PID:7504

C:\Windows\System\oaeRJnQ.exe
C:\Windows\System\oaeRJnQ.exe
2⤵
PID:8344

C:\Windows\System\LrjBUOk.exe
C:\Windows\System\LrjBUOk.exe
2⤵
PID:8488

C:\Windows\System\eIGdCMf.exe
C:\Windows\System\eIGdCMf.exe
2⤵
PID:8676

C:\Windows\System\GwyLjST.exe
C:\Windows\System\GwyLjST.exe
2⤵
PID:8820

C:\Windows\System\OZZMwPd.exe
C:\Windows\System\OZZMwPd.exe
2⤵
PID:8912

C:\Windows\System\pFCHozw.exe
C:\Windows\System\pFCHozw.exe
2⤵
PID:9120

C:\Windows\System\zSYXNXg.exe
C:\Windows\System\zSYXNXg.exe
2⤵
PID:8408

C:\Windows\System\CDVssPn.exe
C:\Windows\System\CDVssPn.exe
2⤵
PID:8792

C:\Windows\System\cmbenAC.exe
C:\Windows\System\cmbenAC.exe
2⤵
PID:9048

C:\Windows\System\dhtozea.exe
C:\Windows\System\dhtozea.exe
2⤵
PID:9160

C:\Windows\System\QGJSFjG.exe
C:\Windows\System\QGJSFjG.exe
2⤵
PID:8888

C:\Windows\System\VQoZbeP.exe
C:\Windows\System\VQoZbeP.exe
2⤵
PID:9248

C:\Windows\System\TeQTdGh.exe
C:\Windows\System\TeQTdGh.exe
2⤵
PID:9272

C:\Windows\System\KSXIUFV.exe
C:\Windows\System\KSXIUFV.exe
2⤵
PID:9300

C:\Windows\System\unEMgGL.exe
C:\Windows\System\unEMgGL.exe
2⤵
PID:9320

C:\Windows\System\YCJWnPA.exe
C:\Windows\System\YCJWnPA.exe
2⤵
PID:9348

C:\Windows\System\QLcdCsl.exe
C:\Windows\System\QLcdCsl.exe
2⤵
PID:9388

C:\Windows\System\FEGDDJb.exe
C:\Windows\System\FEGDDJb.exe
2⤵
PID:9416

C:\Windows\System\HaRPFNL.exe
C:\Windows\System\HaRPFNL.exe
2⤵
PID:9444

C:\Windows\System\VEVajTQ.exe
C:\Windows\System\VEVajTQ.exe
2⤵
PID:9472

C:\Windows\System\GbPFpzR.exe
C:\Windows\System\GbPFpzR.exe
2⤵
PID:9500

C:\Windows\System\jOktTnP.exe
C:\Windows\System\jOktTnP.exe
2⤵
PID:9536

C:\Windows\System\PozHQko.exe
C:\Windows\System\PozHQko.exe
2⤵
PID:9556

C:\Windows\System\XdvVLEr.exe
C:\Windows\System\XdvVLEr.exe
2⤵
PID:9576

C:\Windows\System\bbIJoja.exe
C:\Windows\System\bbIJoja.exe
2⤵
PID:9604

C:\Windows\System\VwwIpiJ.exe
C:\Windows\System\VwwIpiJ.exe
2⤵
PID:9640

C:\Windows\System\XmDnXZk.exe
C:\Windows\System\XmDnXZk.exe
2⤵
PID:9668

C:\Windows\System\eDYaUjU.exe
C:\Windows\System\eDYaUjU.exe
2⤵
PID:9696

C:\Windows\System\RWOzqhC.exe
C:\Windows\System\RWOzqhC.exe
2⤵
PID:9724

C:\Windows\System\TwKdUwq.exe
C:\Windows\System\TwKdUwq.exe
2⤵
PID:9752

C:\Windows\System\RLCbRvP.exe
C:\Windows\System\RLCbRvP.exe
2⤵
PID:9780

C:\Windows\System\VaMtmfo.exe
C:\Windows\System\VaMtmfo.exe
2⤵
PID:9808

C:\Windows\System\aTJRiqg.exe
C:\Windows\System\aTJRiqg.exe
2⤵
PID:9836

C:\Windows\System\EKfAFjc.exe
C:\Windows\System\EKfAFjc.exe
2⤵
PID:9864

C:\Windows\System\ciBTKtV.exe
C:\Windows\System\ciBTKtV.exe
2⤵
PID:9892

C:\Windows\System\CIzmyca.exe
C:\Windows\System\CIzmyca.exe
2⤵
PID:9920

C:\Windows\System\gnNYpFU.exe
C:\Windows\System\gnNYpFU.exe
2⤵
PID:9948

C:\Windows\System\BfOdAKG.exe
C:\Windows\System\BfOdAKG.exe
2⤵
PID:9976

C:\Windows\System\zOLDKdv.exe
C:\Windows\System\zOLDKdv.exe
2⤵
PID:10004

C:\Windows\System\pwDvrTh.exe
C:\Windows\System\pwDvrTh.exe
2⤵
PID:10032

C:\Windows\System\mqPjLrv.exe
C:\Windows\System\mqPjLrv.exe
2⤵
PID:10060

C:\Windows\System\dkTngua.exe
C:\Windows\System\dkTngua.exe
2⤵
PID:10088

C:\Windows\System\nLZqnDL.exe
C:\Windows\System\nLZqnDL.exe
2⤵
PID:10116

C:\Windows\System\hvpstUY.exe
C:\Windows\System\hvpstUY.exe
2⤵
PID:10144

C:\Windows\System\atCagcs.exe
C:\Windows\System\atCagcs.exe
2⤵
PID:10172

C:\Windows\System\jfWApIv.exe
C:\Windows\System\jfWApIv.exe
2⤵
PID:10200

C:\Windows\System\XqUaira.exe
C:\Windows\System\XqUaira.exe
2⤵
PID:10228

C:\Windows\System\niMvjmF.exe
C:\Windows\System\niMvjmF.exe
2⤵
PID:9264

C:\Windows\System\LPhfLQA.exe
C:\Windows\System\LPhfLQA.exe
2⤵
PID:9312

C:\Windows\System\agaBqhg.exe
C:\Windows\System\agaBqhg.exe
2⤵
PID:9380

C:\Windows\System\caBGGiQ.exe
C:\Windows\System\caBGGiQ.exe
2⤵
PID:9440

C:\Windows\System\sVilXox.exe
C:\Windows\System\sVilXox.exe
2⤵
PID:9484

C:\Windows\System\NNULOTR.exe
C:\Windows\System\NNULOTR.exe
2⤵
PID:9572

C:\Windows\System\CpfTBxu.exe
C:\Windows\System\CpfTBxu.exe
2⤵
PID:9624

C:\Windows\System\jYjvMoi.exe
C:\Windows\System\jYjvMoi.exe
2⤵
PID:9708

C:\Windows\System\xFYeQdw.exe
C:\Windows\System\xFYeQdw.exe
2⤵
PID:9748

C:\Windows\System\cxwyXHt.exe
C:\Windows\System\cxwyXHt.exe
2⤵
PID:9828

C:\Windows\System\vwsDQpo.exe
C:\Windows\System\vwsDQpo.exe
2⤵
PID:9904

C:\Windows\System\ZClUbMy.exe
C:\Windows\System\ZClUbMy.exe
2⤵
PID:9944

C:\Windows\System\HSDKSnP.exe
C:\Windows\System\HSDKSnP.exe
2⤵
PID:9188

C:\Windows\System\afxDGEg.exe
C:\Windows\System\afxDGEg.exe
2⤵
PID:10084

C:\Windows\System\EUidQJa.exe
C:\Windows\System\EUidQJa.exe
2⤵
PID:10128

C:\Windows\System\JTveZXg.exe
C:\Windows\System\JTveZXg.exe
2⤵
PID:10196

C:\Windows\System\GDYysNT.exe
C:\Windows\System\GDYysNT.exe
2⤵
PID:9328

C:\Windows\System\GhJXgTX.exe
C:\Windows\System\GhJXgTX.exe
2⤵
PID:9464

C:\Windows\System\OgHOJqS.exe
C:\Windows\System\OgHOJqS.exe
2⤵
PID:9548

C:\Windows\System\lDtKMST.exe
C:\Windows\System\lDtKMST.exe
2⤵
PID:9656

C:\Windows\System\HffifhX.exe
C:\Windows\System\HffifhX.exe
2⤵
PID:9800

C:\Windows\System\ONoKvtY.exe
C:\Windows\System\ONoKvtY.exe
2⤵
PID:10028

C:\Windows\System\LHmNwbH.exe
C:\Windows\System\LHmNwbH.exe
2⤵
PID:10168

C:\Windows\System\vBizBNP.exe
C:\Windows\System\vBizBNP.exe
2⤵
PID:9544

C:\Windows\System\QXBFhxN.exe
C:\Windows\System\QXBFhxN.exe
2⤵
PID:9972

C:\Windows\System\KDwIUFM.exe
C:\Windows\System\KDwIUFM.exe
2⤵
PID:9240

C:\Windows\System\bqpiZQF.exe
C:\Windows\System\bqpiZQF.exe
2⤵
PID:9996

C:\Windows\System\DPYyyyo.exe
C:\Windows\System\DPYyyyo.exe
2⤵
PID:9628

C:\Windows\System\FYETVRw.exe
C:\Windows\System\FYETVRw.exe
2⤵
PID:10268

C:\Windows\System\JZHQKtN.exe
C:\Windows\System\JZHQKtN.exe
2⤵
PID:10288

C:\Windows\System\gDPcsGZ.exe
C:\Windows\System\gDPcsGZ.exe
2⤵
PID:10324

C:\Windows\System\eitiwNH.exe
C:\Windows\System\eitiwNH.exe
2⤵
PID:10352

C:\Windows\System\aQOOqef.exe
C:\Windows\System\aQOOqef.exe
2⤵
PID:10380

C:\Windows\System\GJECDnQ.exe
C:\Windows\System\GJECDnQ.exe
2⤵
PID:10400

C:\Windows\System\qgyIrZo.exe
C:\Windows\System\qgyIrZo.exe
2⤵
PID:10424

C:\Windows\System\JAYIHhD.exe
C:\Windows\System\JAYIHhD.exe
2⤵
PID:10440

C:\Windows\System\BWcoAqJ.exe
C:\Windows\System\BWcoAqJ.exe
2⤵
PID:10460

C:\Windows\System\aRRpDvh.exe
C:\Windows\System\aRRpDvh.exe
2⤵
PID:10476

C:\Windows\System\NDtrtGn.exe
C:\Windows\System\NDtrtGn.exe
2⤵
PID:10524

C:\Windows\System\VxqJVIS.exe
C:\Windows\System\VxqJVIS.exe
2⤵
PID:10552

C:\Windows\System\JRZwLPl.exe
C:\Windows\System\JRZwLPl.exe
2⤵
PID:10592

C:\Windows\System\FngsJwm.exe
C:\Windows\System\FngsJwm.exe
2⤵
PID:10624

C:\Windows\System\JFlLVtk.exe
C:\Windows\System\JFlLVtk.exe
2⤵
PID:10652

C:\Windows\System\TyeKGNg.exe
C:\Windows\System\TyeKGNg.exe
2⤵
PID:10692

C:\Windows\System\FEVSLrf.exe
C:\Windows\System\FEVSLrf.exe
2⤵
PID:10736

C:\Windows\System\uEpEHPx.exe
C:\Windows\System\uEpEHPx.exe
2⤵
PID:10764

C:\Windows\System\uIISLNX.exe
C:\Windows\System\uIISLNX.exe
2⤵
PID:10796

C:\Windows\System\iqfygTi.exe
C:\Windows\System\iqfygTi.exe
2⤵
PID:10820

C:\Windows\System\EotmTnq.exe
C:\Windows\System\EotmTnq.exe
2⤵
PID:10836

C:\Windows\System\RgdLnCR.exe
C:\Windows\System\RgdLnCR.exe
2⤵
PID:10876

C:\Windows\System\MPFDgoq.exe
C:\Windows\System\MPFDgoq.exe
2⤵
PID:10908

C:\Windows\System\aFadTOV.exe
C:\Windows\System\aFadTOV.exe
2⤵
PID:10956

C:\Windows\System\DWZuqTR.exe
C:\Windows\System\DWZuqTR.exe
2⤵
PID:10996

C:\Windows\System\zxUKQmc.exe
C:\Windows\System\zxUKQmc.exe
2⤵
PID:11020

C:\Windows\System\skncKin.exe
C:\Windows\System\skncKin.exe
2⤵
PID:11048

C:\Windows\System\muAiGwr.exe
C:\Windows\System\muAiGwr.exe
2⤵
PID:11080

C:\Windows\System\QDWCvKa.exe
C:\Windows\System\QDWCvKa.exe
2⤵
PID:11132

C:\Windows\System\CbfUotm.exe
C:\Windows\System\CbfUotm.exe
2⤵
PID:11156

C:\Windows\System\yLDoPTi.exe
C:\Windows\System\yLDoPTi.exe
2⤵
PID:11188

C:\Windows\System\RGgmQnv.exe
C:\Windows\System\RGgmQnv.exe
2⤵
PID:11208

C:\Windows\System\ovIVfQs.exe
C:\Windows\System\ovIVfQs.exe
2⤵
PID:11240

C:\Windows\System\WXjFrMj.exe
C:\Windows\System\WXjFrMj.exe
2⤵
PID:10252

C:\Windows\System\xFhflfr.exe
C:\Windows\System\xFhflfr.exe
2⤵
PID:10336

C:\Windows\System\fuvcLtU.exe
C:\Windows\System\fuvcLtU.exe
2⤵
PID:10456

C:\Windows\System\IuxfIPh.exe
C:\Windows\System\IuxfIPh.exe
2⤵
PID:10540

C:\Windows\System\BqqxlGh.exe
C:\Windows\System\BqqxlGh.exe
2⤵
PID:10672

C:\Windows\System\VPsQSFY.exe
C:\Windows\System\VPsQSFY.exe
2⤵
PID:10756

C:\Windows\System\XTSUPPT.exe
C:\Windows\System\XTSUPPT.exe
2⤵
PID:10788

C:\Windows\System\thScKVL.exe
C:\Windows\System\thScKVL.exe
2⤵
PID:10936

C:\Windows\System\EwiMVWW.exe
C:\Windows\System\EwiMVWW.exe
2⤵
PID:10864

C:\Windows\System\MgSWwPk.exe
C:\Windows\System\MgSWwPk.exe
2⤵
PID:10976

C:\Windows\System\UFlhdsB.exe
C:\Windows\System\UFlhdsB.exe
2⤵
PID:10968

C:\Windows\System\khkaStR.exe
C:\Windows\System\khkaStR.exe
2⤵
PID:11076

C:\Windows\System\YpfnzdB.exe
C:\Windows\System\YpfnzdB.exe
2⤵
PID:11116

C:\Windows\System\njxVIXs.exe
C:\Windows\System\njxVIXs.exe
2⤵
PID:11204

C:\Windows\System\ZGoXzXv.exe
C:\Windows\System\ZGoXzXv.exe
2⤵
PID:10472

C:\Windows\System\MfCYtYG.exe
C:\Windows\System\MfCYtYG.exe
2⤵
PID:10536

C:\Windows\System\sUiaOyJ.exe
C:\Windows\System\sUiaOyJ.exe
2⤵
PID:10412

C:\Windows\System\KNaoCnv.exe
C:\Windows\System\KNaoCnv.exe
2⤵
PID:10856

C:\Windows\System\bjySSmc.exe
C:\Windows\System\bjySSmc.exe
2⤵
PID:11056

C:\Windows\System\lzSOOHT.exe
C:\Windows\System\lzSOOHT.exe
2⤵
PID:10668

C:\Windows\System\uhKWbCy.exe
C:\Windows\System\uhKWbCy.exe
2⤵
PID:10784

C:\Windows\System\gXrfKHb.exe
C:\Windows\System\gXrfKHb.exe
2⤵
PID:10432

C:\Windows\System\YxwCfce.exe
C:\Windows\System\YxwCfce.exe
2⤵
PID:11268

C:\Windows\System\VMuCxUw.exe
C:\Windows\System\VMuCxUw.exe
2⤵
PID:11300

C:\Windows\System\YdDkvAA.exe
C:\Windows\System\YdDkvAA.exe
2⤵
PID:11316

C:\Windows\System\PqgJYKa.exe
C:\Windows\System\PqgJYKa.exe
2⤵
PID:11340

C:\Windows\System\sVzZkRq.exe
C:\Windows\System\sVzZkRq.exe
2⤵
PID:11368

C:\Windows\System\BdVxngA.exe
C:\Windows\System\BdVxngA.exe
2⤵
PID:11396

C:\Windows\System\VdQEmED.exe
C:\Windows\System\VdQEmED.exe
2⤵
PID:11416

C:\Windows\System\nSdnNwK.exe
C:\Windows\System\nSdnNwK.exe
2⤵
PID:11444

C:\Windows\System\xQEOzEM.exe
C:\Windows\System\xQEOzEM.exe
2⤵
PID:11468

C:\Windows\System\TBauLtt.exe
C:\Windows\System\TBauLtt.exe
2⤵
PID:11492

C:\Windows\System\PvjJEgH.exe
C:\Windows\System\PvjJEgH.exe
2⤵
PID:11528

C:\Windows\System\whoNval.exe
C:\Windows\System\whoNval.exe
2⤵
PID:11564

C:\Windows\System\rklRvCU.exe
C:\Windows\System\rklRvCU.exe
2⤵
PID:11592

C:\Windows\System\qZKNvhQ.exe
C:\Windows\System\qZKNvhQ.exe
2⤵
PID:11616

C:\Windows\System\gfzVXJL.exe
C:\Windows\System\gfzVXJL.exe
2⤵
PID:11644

C:\Windows\System\eeXkdtr.exe
C:\Windows\System\eeXkdtr.exe
2⤵
PID:11676

C:\Windows\System\mIQsaug.exe
C:\Windows\System\mIQsaug.exe
2⤵
PID:11704

C:\Windows\System\ScUcozh.exe
C:\Windows\System\ScUcozh.exe
2⤵
PID:11732

C:\Windows\System\hCvOSwT.exe
C:\Windows\System\hCvOSwT.exe
2⤵
PID:11764

C:\Windows\System\fsxqCnq.exe
C:\Windows\System\fsxqCnq.exe
2⤵
PID:11832

C:\Windows\System\AOrVRup.exe
C:\Windows\System\AOrVRup.exe
2⤵
PID:11872

C:\Windows\System\ikoOXzp.exe
C:\Windows\System\ikoOXzp.exe
2⤵
PID:11892

C:\Windows\System\hgWsxrW.exe
C:\Windows\System\hgWsxrW.exe
2⤵
PID:11916

C:\Windows\System\cdOpVtB.exe
C:\Windows\System\cdOpVtB.exe
2⤵
PID:11944

C:\Windows\System\mIUpDyy.exe
C:\Windows\System\mIUpDyy.exe
2⤵
PID:11972

C:\Windows\System\NmfMGCP.exe
C:\Windows\System\NmfMGCP.exe
2⤵
PID:12004

C:\Windows\System\pcopKeN.exe
C:\Windows\System\pcopKeN.exe
2⤵
PID:12024

C:\Windows\System\iSELtpN.exe
C:\Windows\System\iSELtpN.exe
2⤵
PID:12048

C:\Windows\System\FdTibtg.exe
C:\Windows\System\FdTibtg.exe
2⤵
PID:12072

C:\Windows\System\fwXXdGv.exe
C:\Windows\System\fwXXdGv.exe
2⤵
PID:12100

C:\Windows\System\BWXkbwS.exe
C:\Windows\System\BWXkbwS.exe
2⤵
PID:12144

C:\Windows\System\gSYiwxB.exe
C:\Windows\System\gSYiwxB.exe
2⤵
PID:12172

C:\Windows\System\CmcUYdD.exe
C:\Windows\System\CmcUYdD.exe
2⤵
PID:12196

C:\Windows\System\yMpveAQ.exe
C:\Windows\System\yMpveAQ.exe
2⤵
PID:12220

C:\Windows\System\tpXndPV.exe
C:\Windows\System\tpXndPV.exe
2⤵
PID:12252

C:\Windows\System\YmmZjsp.exe
C:\Windows\System\YmmZjsp.exe
2⤵
PID:12280

C:\Windows\System\tSjOhNG.exe
C:\Windows\System\tSjOhNG.exe
2⤵
PID:11064

C:\Windows\System\LFccbZA.exe
C:\Windows\System\LFccbZA.exe
2⤵
PID:11356

C:\Windows\System\ARirxOA.exe
C:\Windows\System\ARirxOA.exe
2⤵
PID:11408

C:\Windows\System\GgPCfMZ.exe
C:\Windows\System\GgPCfMZ.exe
2⤵
PID:11432

C:\Windows\System\nkQuSsU.exe
C:\Windows\System\nkQuSsU.exe
2⤵
PID:11460

C:\Windows\System\VwtLsSN.exe
C:\Windows\System\VwtLsSN.exe
2⤵
PID:11576

C:\Windows\System\ZYprULc.exe
C:\Windows\System\ZYprULc.exe
2⤵
PID:11692

C:\Windows\System\nPJzHEL.exe
C:\Windows\System\nPJzHEL.exe
2⤵
PID:11760

C:\Windows\System\pUkEAme.exe
C:\Windows\System\pUkEAme.exe
2⤵
PID:11840

C:\Windows\System\DkqWBRQ.exe
C:\Windows\System\DkqWBRQ.exe
2⤵
PID:11912

C:\Windows\System\YWuFTTm.exe
C:\Windows\System\YWuFTTm.exe
2⤵
PID:12036

C:\Windows\System\yRqSKti.exe
C:\Windows\System\yRqSKti.exe
2⤵
PID:12056

C:\Windows\System\xjoPIUT.exe
C:\Windows\System\xjoPIUT.exe
2⤵
PID:12136

C:\Windows\System\KhPhPWC.exe
C:\Windows\System\KhPhPWC.exe
2⤵
PID:12212

C:\Windows\System\rGIAsFO.exe
C:\Windows\System\rGIAsFO.exe
2⤵
PID:10484

C:\Windows\System\vAOirzJ.exe
C:\Windows\System\vAOirzJ.exe
2⤵
PID:11308

C:\Windows\System\RDNjRAH.exe
C:\Windows\System\RDNjRAH.exe
2⤵
PID:11376

C:\Windows\System\GfkiNpQ.exe
C:\Windows\System\GfkiNpQ.exe
2⤵
PID:11608

C:\Windows\System\GTICqFQ.exe
C:\Windows\System\GTICqFQ.exe
2⤵
PID:11752

C:\Windows\System\ezyvdwa.exe
C:\Windows\System\ezyvdwa.exe
2⤵
PID:11884

C:\Windows\System\zOXFUGC.exe
C:\Windows\System\zOXFUGC.exe
2⤵
PID:12044

C:\Windows\System\TxYdmMi.exe
C:\Windows\System\TxYdmMi.exe
2⤵
PID:11544

C:\Windows\System\JEzhXJF.exe
C:\Windows\System\JEzhXJF.exe
2⤵
PID:11524

C:\Windows\System\AXxRQjk.exe
C:\Windows\System\AXxRQjk.exe
2⤵
PID:11888

C:\Windows\System\eVCLLAE.exe
C:\Windows\System\eVCLLAE.exe
2⤵
PID:11488

C:\Windows\System\gRgrYpR.exe
C:\Windows\System\gRgrYpR.exe
2⤵
PID:11280

C:\Windows\System\XhpLgQd.exe
C:\Windows\System\XhpLgQd.exe
2⤵
PID:12328

C:\Windows\System\VybbVJt.exe
C:\Windows\System\VybbVJt.exe
2⤵
PID:12360

C:\Windows\System\CWoenWD.exe
C:\Windows\System\CWoenWD.exe
2⤵
PID:12384

C:\Windows\System\jMLUvNE.exe
C:\Windows\System\jMLUvNE.exe
2⤵
PID:12404

C:\Windows\System\uyOlUXj.exe
C:\Windows\System\uyOlUXj.exe
2⤵
PID:12436

C:\Windows\System\HywzHzi.exe
C:\Windows\System\HywzHzi.exe
2⤵
PID:12472

C:\Windows\System\CadgLoO.exe
C:\Windows\System\CadgLoO.exe
2⤵
PID:12504

C:\Windows\System\xuCNzfi.exe
C:\Windows\System\xuCNzfi.exe
2⤵
PID:12544

C:\Windows\System\pnmtyWW.exe
C:\Windows\System\pnmtyWW.exe
2⤵
PID:12568

C:\Windows\System\zJyQJca.exe
C:\Windows\System\zJyQJca.exe
2⤵
PID:12600

C:\Windows\System\GTsdVwv.exe
C:\Windows\System\GTsdVwv.exe
2⤵
PID:12628

C:\Windows\System\CCSTsle.exe
C:\Windows\System\CCSTsle.exe
2⤵
PID:12664

C:\Windows\System\QjmRkoj.exe
C:\Windows\System\QjmRkoj.exe
2⤵
PID:12684

C:\Windows\System\ZYwEVAm.exe
C:\Windows\System\ZYwEVAm.exe
2⤵
PID:12712

C:\Windows\System\NYjqleg.exe
C:\Windows\System\NYjqleg.exe
2⤵
PID:12740

C:\Windows\System\xNrZNlP.exe
C:\Windows\System\xNrZNlP.exe
2⤵
PID:12768

C:\Windows\System\MFUhqtK.exe
C:\Windows\System\MFUhqtK.exe
2⤵
PID:12788

C:\Windows\System\JHzRYag.exe
C:\Windows\System\JHzRYag.exe
2⤵
PID:12820

C:\Windows\System\xHjUikz.exe
C:\Windows\System\xHjUikz.exe
2⤵
PID:12848

C:\Windows\System\xvDdjWO.exe
C:\Windows\System\xvDdjWO.exe
2⤵
PID:12872

C:\Windows\System\zFVqXtz.exe
C:\Windows\System\zFVqXtz.exe
2⤵
PID:12904

C:\Windows\System\nCWHTLW.exe
C:\Windows\System\nCWHTLW.exe
2⤵
PID:12928

C:\Windows\System\AsiPEmz.exe
C:\Windows\System\AsiPEmz.exe
2⤵
PID:12944

C:\Windows\System\eGeENXX.exe
C:\Windows\System\eGeENXX.exe
2⤵
PID:12972

C:\Windows\System\VhOCUox.exe
C:\Windows\System\VhOCUox.exe
2⤵
PID:13016

C:\Windows\System\XvbzjRU.exe
C:\Windows\System\XvbzjRU.exe
2⤵
PID:13048

C:\Windows\System\kgfXITe.exe
C:\Windows\System\kgfXITe.exe
2⤵
PID:13084

C:\Windows\System\SAsjXLv.exe
C:\Windows\System\SAsjXLv.exe
2⤵
PID:13112

C:\Windows\System\AvfhpZg.exe
C:\Windows\System\AvfhpZg.exe
2⤵
PID:13128

C:\Windows\System\AHKzKru.exe
C:\Windows\System\AHKzKru.exe
2⤵
PID:13164

C:\Windows\System\IEMQxqy.exe
C:\Windows\System\IEMQxqy.exe
2⤵
PID:13196

C:\Windows\System\BYtfYWd.exe
C:\Windows\System\BYtfYWd.exe
2⤵
PID:13224

C:\Windows\System\upPduSv.exe
C:\Windows\System\upPduSv.exe
2⤵
PID:13252

C:\Windows\System\ijuApnO.exe
C:\Windows\System\ijuApnO.exe
2⤵
PID:13280

C:\Windows\System\CJlijEX.exe
C:\Windows\System\CJlijEX.exe
2⤵
PID:13300

C:\Windows\System\trfGWZO.exe
C:\Windows\System\trfGWZO.exe
2⤵
PID:12320

C:\Windows\System\mcKQiEF.exe
C:\Windows\System\mcKQiEF.exe
2⤵
PID:12344

C:\Windows\System\VsvPDAa.exe
C:\Windows\System\VsvPDAa.exe
2⤵
PID:12396

C:\Windows\System\GvxVvOK.exe
C:\Windows\System\GvxVvOK.exe
2⤵
PID:12524

C:\Windows\System\hJPuNYh.exe
C:\Windows\System\hJPuNYh.exe
2⤵
PID:12532

C:\Windows\System\aofDtdP.exe
C:\Windows\System\aofDtdP.exe
2⤵
PID:12620

C:\Windows\System\VEwuojx.exe
C:\Windows\System\VEwuojx.exe
2⤵
PID:12640

C:\Windows\System\rUQlBaM.exe
C:\Windows\System\rUQlBaM.exe
2⤵
PID:12708

C:\Windows\System\CRxXxTW.exe
C:\Windows\System\CRxXxTW.exe
2⤵
PID:12776

C:\Windows\System\PIyZCMH.exe
C:\Windows\System\PIyZCMH.exe
2⤵
PID:12816

C:\Windows\System\yyQBZTY.exe
C:\Windows\System\yyQBZTY.exe
2⤵
PID:12960

C:\Windows\System\AVXaQRR.exe
C:\Windows\System\AVXaQRR.exe
2⤵
PID:13040

C:\Windows\System\CNiZXvA.exe
C:\Windows\System\CNiZXvA.exe
2⤵
PID:13068

C:\Windows\System\dzIagHX.exe
C:\Windows\System\dzIagHX.exe
2⤵
PID:13104

C:\Windows\System\utJoPna.exe
C:\Windows\System\utJoPna.exe
2⤵
PID:13188

C:\Windows\System\TFdBDWh.exe
C:\Windows\System\TFdBDWh.exe
2⤵
PID:13208

C:\Windows\System\tqvTAZZ.exe
C:\Windows\System\tqvTAZZ.exe
2⤵
PID:13272

C:\Windows\System\VfzIxFD.exe
C:\Windows\System\VfzIxFD.exe
2⤵
PID:11932

C:\Windows\System\PwdUBTj.exe
C:\Windows\System\PwdUBTj.exe
2⤵
PID:12340

C:\Windows\System\ExXYwaO.exe
C:\Windows\System\ExXYwaO.exe
2⤵
PID:12488

C:\Windows\System\YYdKKyh.exe
C:\Windows\System\YYdKKyh.exe
2⤵
PID:12432

C:\Windows\System\RYALtEo.exe
C:\Windows\System\RYALtEo.exe
2⤵
PID:12560

C:\Windows\System\QXDZrby.exe
C:\Windows\System\QXDZrby.exe
2⤵
PID:12836

C:\Windows\System\RUdXfmT.exe
C:\Windows\System\RUdXfmT.exe
2⤵
PID:13172

C:\Windows\System\qLQrPCK.exe
C:\Windows\System\qLQrPCK.exe
2⤵
PID:13008

C:\Windows\System\FONnFxP.exe
C:\Windows\System\FONnFxP.exe
2⤵
PID:13060

C:\Windows\System\sBufJPS.exe
C:\Windows\System\sBufJPS.exe
2⤵
PID:12452

C:\Windows\System\GHduGQl.exe
C:\Windows\System\GHduGQl.exe
2⤵
PID:13328

C:\Windows\System\RBSLIHU.exe
C:\Windows\System\RBSLIHU.exe
2⤵
PID:13344

C:\Windows\System\kCKOtBs.exe
C:\Windows\System\kCKOtBs.exe
2⤵
PID:13360

C:\Windows\System\dXQjMbd.exe
C:\Windows\System\dXQjMbd.exe
2⤵
PID:13396

C:\Windows\System\whPKMhe.exe
C:\Windows\System\whPKMhe.exe
2⤵
PID:13416

C:\Windows\System\byCEXcR.exe
C:\Windows\System\byCEXcR.exe
2⤵
PID:13448

C:\Windows\System\OTBFfvI.exe
C:\Windows\System\OTBFfvI.exe
2⤵
PID:13480

C:\Windows\System\FDimAjy.exe
C:\Windows\System\FDimAjy.exe
2⤵
PID:13508

C:\Windows\System\BvyhMGF.exe
C:\Windows\System\BvyhMGF.exe
2⤵
PID:13532

C:\Windows\System\Ryrtfnq.exe
C:\Windows\System\Ryrtfnq.exe
2⤵
PID:13568

C:\Windows\System\qqdgRvR.exe
C:\Windows\System\qqdgRvR.exe
2⤵
PID:13600

C:\Windows\System\OCSBHtz.exe
C:\Windows\System\OCSBHtz.exe
2⤵
PID:13640

C:\Windows\System\PswolEH.exe
C:\Windows\System\PswolEH.exe
2⤵
PID:13672

C:\Windows\System\SLJSbnX.exe
C:\Windows\System\SLJSbnX.exe
2⤵
PID:13696

C:\Windows\System\MOmRwVd.exe
C:\Windows\System\MOmRwVd.exe
2⤵
PID:13732

C:\Windows\System\XjZZbVy.exe
C:\Windows\System\XjZZbVy.exe
2⤵
PID:13752

C:\Windows\System\FcnIzZo.exe
C:\Windows\System\FcnIzZo.exe
2⤵
PID:13788

C:\Windows\System\DLczcWt.exe
C:\Windows\System\DLczcWt.exe
2⤵
PID:13828

C:\Windows\System\lpKrJMV.exe
C:\Windows\System\lpKrJMV.exe
2⤵
PID:13860

C:\Windows\System\njEsYfL.exe
C:\Windows\System\njEsYfL.exe
2⤵
PID:13904

C:\Windows\System\whDUEOd.exe
C:\Windows\System\whDUEOd.exe
2⤵
PID:13956

C:\Windows\System\cPUAytj.exe
C:\Windows\System\cPUAytj.exe
2⤵
PID:13984

C:\Windows\System\FDYScXt.exe
C:\Windows\System\FDYScXt.exe
2⤵
PID:14024

C:\Windows\System\QFuWXKV.exe
C:\Windows\System\QFuWXKV.exe
2⤵
PID:14048

C:\Windows\System\piHWHSO.exe
C:\Windows\System\piHWHSO.exe
2⤵
PID:14080

C:\Windows\System\lChdEMX.exe
C:\Windows\System\lChdEMX.exe
2⤵
PID:14100

C:\Windows\System\ebdhSYN.exe
C:\Windows\System\ebdhSYN.exe
2⤵
PID:14132

C:\Windows\System\QLJZiah.exe
C:\Windows\System\QLJZiah.exe
2⤵
PID:14172

C:\Windows\System\VbOBDNg.exe
C:\Windows\System\VbOBDNg.exe
2⤵
PID:14204

C:\Windows\System\wvzoAzD.exe
C:\Windows\System\wvzoAzD.exe
2⤵
PID:14228

C:\Windows\System\ZJHBCtd.exe
C:\Windows\System\ZJHBCtd.exe
2⤵
PID:14256

C:\Windows\System\Cuiwjzn.exe
C:\Windows\System\Cuiwjzn.exe
2⤵
PID:14292

C:\Windows\System\RRUgyFA.exe
C:\Windows\System\RRUgyFA.exe
2⤵
PID:14320

C:\Windows\System\jlTHIXe.exe
C:\Windows\System\jlTHIXe.exe
2⤵
PID:12756

C:\Windows\System\plyxoFA.exe
C:\Windows\System\plyxoFA.exe
2⤵
PID:13144

C:\Windows\System\UYpiTuy.exe
C:\Windows\System\UYpiTuy.exe
2⤵
PID:13320

C:\Windows\System\cgHXiLN.exe
C:\Windows\System\cgHXiLN.exe
2⤵
PID:13520

C:\Windows\System\yvkyIDt.exe
C:\Windows\System\yvkyIDt.exe
2⤵
PID:13464

C:\Windows\System\qaGJVzL.exe
C:\Windows\System\qaGJVzL.exe
2⤵
PID:13500

C:\Windows\System\DzavvnA.exe
C:\Windows\System\DzavvnA.exe
2⤵
PID:13760

C:\Windows\System\PtAgsxV.exe
C:\Windows\System\PtAgsxV.exe
2⤵
PID:13636

C:\Windows\System\SABXkZI.exe
C:\Windows\System\SABXkZI.exe
2⤵
PID:13628

C:\Windows\System\KPStbfv.exe
C:\Windows\System\KPStbfv.exe
2⤵
PID:13804

C:\Windows\System\YWkzeSU.exe
C:\Windows\System\YWkzeSU.exe
2⤵
PID:13868

C:\Windows\System\zLYEVkN.exe
C:\Windows\System\zLYEVkN.exe
2⤵
PID:14016

C:\Windows\System\FbOIkaE.exe
C:\Windows\System\FbOIkaE.exe
2⤵
PID:3544

C:\Windows\System\pyUbKxd.exe
C:\Windows\System\pyUbKxd.exe
2⤵
PID:14072

C:\Windows\System\PyoMySY.exe
C:\Windows\System\PyoMySY.exe
2⤵
PID:14144

C:\Windows\System\cwMlubT.exe
C:\Windows\System\cwMlubT.exe
2⤵
PID:14248

C:\Windows\System\QFvQzCG.exe
C:\Windows\System\QFvQzCG.exe
2⤵
PID:14220

C:\Windows\System\OZIJQxR.exe
C:\Windows\System\OZIJQxR.exe
2⤵
PID:13340

C:\Windows\System\iQrSyII.exe
C:\Windows\System\iQrSyII.exe
2⤵
PID:13492

C:\Windows\System\zSLOztq.exe
C:\Windows\System\zSLOztq.exe
2⤵
PID:13388

C:\Windows\System\BIZjAeM.exe
C:\Windows\System\BIZjAeM.exe
2⤵
PID:13456

C:\Windows\System\qzBvfZe.exe
C:\Windows\System\qzBvfZe.exe
2⤵
PID:1720

C:\Windows\System\VBRTXwt.exe
C:\Windows\System\VBRTXwt.exe
2⤵
PID:13772

C:\Windows\System\kYzSuOo.exe
C:\Windows\System\kYzSuOo.exe
2⤵
PID:12088

C:\Windows\System\AEWGjrd.exe
C:\Windows\System\AEWGjrd.exe
2⤵
PID:13928

C:\Windows\System\dzdRTlZ.exe
C:\Windows\System\dzdRTlZ.exe
2⤵
PID:14060

C:\Windows\System\xJIebeM.exe
C:\Windows\System\xJIebeM.exe
2⤵
PID:14276

C:\Windows\System\BsEFqKS.exe
C:\Windows\System\BsEFqKS.exe
2⤵
PID:12920

C:\Windows\System\XDyDUDH.exe
C:\Windows\System\XDyDUDH.exe
2⤵
PID:13656

C:\Windows\System\srmwRdj.exe
C:\Windows\System\srmwRdj.exe
2⤵
PID:13632

C:\Windows\System\hHSPIxj.exe
C:\Windows\System\hHSPIxj.exe
2⤵
PID:12112

C:\Windows\System\suNvRiV.exe
C:\Windows\System\suNvRiV.exe
2⤵
PID:14164

C:\Windows\System\iUYaZGu.exe
C:\Windows\System\iUYaZGu.exe
2⤵
PID:13000

C:\Windows\System\nwWWlQT.exe
C:\Windows\System\nwWWlQT.exe
2⤵
PID:13796

C:\Windows\System\sutXdiM.exe
C:\Windows\System\sutXdiM.exe
2⤵
PID:12168

C:\Windows\System\ECnCeZg.exe
C:\Windows\System\ECnCeZg.exe
2⤵
PID:14344

C:\Windows\System\loIlHui.exe
C:\Windows\System\loIlHui.exe
2⤵
PID:14380

C:\Windows\System\KiYiqvX.exe
C:\Windows\System\KiYiqvX.exe
2⤵
PID:14404

C:\Windows\System\MYqLZqa.exe
C:\Windows\System\MYqLZqa.exe
2⤵
PID:14428

C:\Windows\System\FhwTZOB.exe
C:\Windows\System\FhwTZOB.exe
2⤵
PID:14452

C:\Windows\System\XITEdYw.exe
C:\Windows\System\XITEdYw.exe
2⤵
PID:14488

C:\Windows\System\NKfZgOk.exe
C:\Windows\System\NKfZgOk.exe
2⤵
PID:14524

C:\Windows\System\oBWxZCH.exe
C:\Windows\System\oBWxZCH.exe
2⤵
PID:14544

C:\Windows\System\SsMvBMG.exe
C:\Windows\System\SsMvBMG.exe
2⤵
PID:14568

C:\Windows\System\jWNuKMI.exe
C:\Windows\System\jWNuKMI.exe
2⤵
PID:14608

C:\Windows\System\iAtIqTS.exe
C:\Windows\System\iAtIqTS.exe
2⤵
PID:14636

C:\Windows\System\qjNDARz.exe
C:\Windows\System\qjNDARz.exe
2⤵
PID:14652

C:\Windows\System\thxQXyJ.exe
C:\Windows\System\thxQXyJ.exe
2⤵
PID:14680

C:\Windows\System\dklycnI.exe
C:\Windows\System\dklycnI.exe
2⤵
PID:14708

C:\Windows\System\AIHviOR.exe
C:\Windows\System\AIHviOR.exe
2⤵
PID:14724

C:\Windows\System\cJMwllY.exe
C:\Windows\System\cJMwllY.exe
2⤵
PID:14756

C:\Windows\System\mZaLyRR.exe
C:\Windows\System\mZaLyRR.exe
2⤵
PID:14792

C:\Windows\System\cXXdzlw.exe
C:\Windows\System\cXXdzlw.exe
2⤵
PID:14832

C:\Windows\System\NsWxPGK.exe
C:\Windows\System\NsWxPGK.exe
2⤵
PID:14852

C:\Windows\System\KwXqRnR.exe
C:\Windows\System\KwXqRnR.exe
2⤵
PID:14884

C:\Windows\System\MxKPUDJ.exe
C:\Windows\System\MxKPUDJ.exe
2⤵
PID:14916

C:\Windows\System\ftQroWC.exe
C:\Windows\System\ftQroWC.exe
2⤵
PID:14932

C:\Windows\System\BWZerDm.exe
C:\Windows\System\BWZerDm.exe
2⤵
PID:14960

C:\Windows\System\lPeeqDo.exe
C:\Windows\System\lPeeqDo.exe
2⤵
PID:15000

C:\Windows\System\NBVPXwc.exe
C:\Windows\System\NBVPXwc.exe
2⤵
PID:15028

C:\Windows\System\HuQrjBg.exe
C:\Windows\System\HuQrjBg.exe
2⤵
PID:15056

C:\Windows\System\KtHUIhc.exe
C:\Windows\System\KtHUIhc.exe
2⤵
PID:15084

C:\Windows\System\BFhjCfB.exe
C:\Windows\System\BFhjCfB.exe
2⤵
PID:15112

C:\Windows\System\LmJGyHX.exe
C:\Windows\System\LmJGyHX.exe
2⤵
PID:15128

C:\Windows\System\PyleZhR.exe
C:\Windows\System\PyleZhR.exe
2⤵
PID:15168

C:\Windows\System\UpuWacm.exe
C:\Windows\System\UpuWacm.exe
2⤵
PID:15184

C:\Windows\System\BrbjDtg.exe
C:\Windows\System\BrbjDtg.exe
2⤵
PID:15204

C:\Windows\System\SQIJLbZ.exe
C:\Windows\System\SQIJLbZ.exe
2⤵
PID:15236

C:\Windows\System\MnesZlw.exe
C:\Windows\System\MnesZlw.exe
2⤵
PID:15268

C:\Windows\System\yihFJlj.exe
C:\Windows\System\yihFJlj.exe
2⤵
PID:15300

C:\Windows\System\fyjFllC.exe
C:\Windows\System\fyjFllC.exe
2⤵
PID:15328

C:\Windows\System\mfSOwqF.exe
C:\Windows\System\mfSOwqF.exe
2⤵
PID:15352

C:\Windows\System\CCYgVht.exe
C:\Windows\System\CCYgVht.exe
2⤵
PID:14360

C:\Windows\System\LjDcxbC.exe
C:\Windows\System\LjDcxbC.exe
2⤵
PID:14440

C:\Windows\System\NTUbBFM.exe
C:\Windows\System\NTUbBFM.exe
2⤵
PID:14556

C:\Windows\System\qQYGOfR.exe
C:\Windows\System\qQYGOfR.exe
2⤵
PID:14600

C:\Windows\System\wqmPGEh.exe
C:\Windows\System\wqmPGEh.exe
2⤵
PID:14644

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:14752

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
2⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4532

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4148

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2808

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2036

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5300

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5376

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6028

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:7796

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4372

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4208

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:1860

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:9872

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:10124

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:3556

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4932

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8184

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:3960

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3492

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7820

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:13976

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5600

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:8672

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:6940

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:7876

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:7744

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:8632

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:8296

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:9068

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:10128

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:15264

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:10696

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:9684

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:60

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:8564

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:12872

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3192

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3684

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5228

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:13616

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:13900

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:14384

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5640

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4180

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4176

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:6516

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:6328

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:14824

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:14500

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4352

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4960

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:15252

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:8392

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:6892

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:8708

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:8996

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:9468

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:11696

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2088

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:11856

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:12368

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:12792

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:12108

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:7740

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:12228

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:13524

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:13752

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:15128

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:14328

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:6236

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:14652

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:9016

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:7308

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml

Filesize
97B

MD5
7f3bec2ea3dd9544194bf0f38222acbf

SHA1
a02fd5379f0f96d29272716f6b91e4cdd06f5fd7

SHA256
fe71b3f76715a00a50e647221b24d0591ffed9b384f078c7dddbadcbaf8a1ce9

SHA512
eac9b0d373aeabc3c8b554d82ee123d90ef61fa4186291f1c41412237bdb725da79d1fc2adda0547e0c1936f535cdd458a166e134ce535e9450060ce7c5b36eb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133602848813305049.txt

Filesize
75KB

MD5
e7494073aeaffe7245802f28cd30054f

SHA1
092227bbf58c514ba5829345ec903b622cd2c636

SHA256
0792b6ce23ecab01dcc88e8fe286355f09b4fcc4708797a42574181a44ce1356

SHA512
4edeb6dae45dd79893541beb8343b469d7dfe876d2463ec1141dfd475831923443b45828b032ccc6faa36b9c735e4484ccce62f30b725ffee650e417dc3c39f7

Download Submit
C:\Windows\System\AXKrfOL.exe

Filesize
2.3MB

MD5
45f8122b3a15417ce8c61a8ed9f26a15

SHA1
5deb1b313b926472314d09d23943ffd1a7cc647f

SHA256
add43a5dfd575a3ced141dfab5d316ca72a557a75f1f16944e37a3901f86123c

SHA512
46c80066a32081fa4eac089f073c6dad18dcb2c838d5365aa0898fbf76b29336ffa5a08df76d424f3ac4eeadc584d90bfde496562a720ac74ab439c111233ffe

Download Submit
C:\Windows\System\BWylpAC.exe

Filesize
2.3MB

MD5
799ee7960ed73f865d953711d869c7ce

SHA1
fa7ba44659a1f36df441836ea0902813c472747b

SHA256
a2162bb3a743402ed9c9c43534bbdb786f3f6e91b565e16019c9e4445e788492

SHA512
ff44370ea6cd8a9bc5f3e953745c62a00fe1771ba806e9d37839d5bee94015e54b61a65b8b532eab7dcbd4c264ccd72c9e3ec65c5d5c18867e4a494592c1b2e9

Download Submit
C:\Windows\System\BaGUkNp.exe

Filesize
2.3MB

MD5
d5c4e3064a35fa6f67699653c391a543

SHA1
582dcde8a962dfe88bd0ddca9f0eac4f2165af4f

SHA256
e41a524f19412f076b426085ca754367f78167882936266e044d9a55310d3032

SHA512
37f803944b278c50ebfa06212a4a8653257d80cb6574b32ca493540eb3109f4dfe23d4c7d300369ee86cb83582eae5dc2d449bf1cd1d69fe7d9709445aac00e2

Download Submit
C:\Windows\System\CdgQqGh.exe

Filesize
2.3MB

MD5
e53532ab9f6583cb110e3d31fc95000a

SHA1
862494af5cccc409a2ecee8dc1cc01435610bb23

SHA256
5c6c0371b02d29bd1cc6674aae85628c2d09603d7975de1c1598636b4a0c269c

SHA512
ce5b3178177423199dbf36be7d5e5fe7568e61431bc25402cf1e1d027f192f6d7acb91896f3508aaee5ca9da35f205b51379511a3715980eeb6366cae407631a

Download Submit
C:\Windows\System\EJdfyqy.exe

Filesize
2.3MB

MD5
37d7c724163207c19ab086ab643f222e

SHA1
5448277efc8e588dbddbacd853393dc693621fd7

SHA256
f117de4cb6ce90452cf4d9a5a1136993e3e14bec8bfefc27bf74e7212a64b989

SHA512
1daef4d9cf14a60ced7ea40a20d28eefcaaa880dd84321a52ed2cadef8139f4894abae61f107e9edcf9ceed8309690243d707feca66d870ed3649a155ab2faa8

Download Submit
C:\Windows\System\EbwDTDV.exe

Filesize
2.3MB

MD5
a9e3b88197c74a9e8f890a3cf57facaf

SHA1
d515d2d57cf4ef9d4bee107d09220fc722bd442d

SHA256
736d2f024881c7a714f44f091dd44517d596957e9e40be791148e485fb0042b2

SHA512
55766e6f4f044f8b4ed5e3fd026e2e9d892d04a206d1f3dc66f1bd9a85f9c25c79d29e714ecd9ed49b51a79ab320fb4b7bccddbcb5f86bcd47a4f160cfab5cf8

Download Submit
C:\Windows\System\GBvdMkr.exe

Filesize
2.3MB

MD5
4395ce3e43323cc5e579a61431594ce6

SHA1
cdacfc739907dd9c08ccee26f2f4690fbd839239

SHA256
7171f0b7091b02c95a0e1280579418c15d00317cbcd54487966d943900f6132a

SHA512
8cb8cc2cb2e48a8340613af512c126e92fe7559a3ce404902fca430264a18b5f10153d49ccd8873e55c6bad52a875ba088da73139d011070413af58c17e19e3b

Download Submit
C:\Windows\System\JnQyBRW.exe

Filesize
2.3MB

MD5
61a30cf2d72e0b2211a7235181f89667

SHA1
6cb50f891d35acac80272b59ba325934337b20a9

SHA256
1aec4a8ec0c7c9138ae69ec651e16cb400f33b3c7cad55c05adf93071115c5c9

SHA512
ce957025367ff8cc980355d09ee471286af5fa3c2dacbee1591cc925a9fbd4103e9c6875bdd3405a60dbc5fbfc571ff0a256179c253d7e8e4fc68663f8a1a2f0

Download Submit
C:\Windows\System\KWJmfdZ.exe

Filesize
2.3MB

MD5
0d1bac6015472b7fa66207a157b8da47

SHA1
52fc85f7f546f7ba571fc462e49f30a493ebe981

SHA256
28845e6ace6a646d1f6b9e775ae738d42fa49f0ea2dea6f44455b2b58ccb81a3

SHA512
bf4fec66479b6b768d985d2e5cc196957e9bcb3412fef045862fa45acf70077416552e0efcfbf060093c7a27710a5d4e6ec93aca6e80f69fdba5e0416de29bb6

Download Submit
C:\Windows\System\MNSgCyq.exe

Filesize
2.3MB

MD5
39f7a8144bf3d1ffbdd267a86ec18527

SHA1
f6cb4232cbf669fccb33d1dce5766e1f875543cc

SHA256
0c1eb70d7a6d762c5348a6153cf17356e9270e765b35a487670114bdbf5d056e

SHA512
1710d321303723b67bdcfb8eca3feef21841544a71453f08577df1a9fc6a9b77a06668f6ce27a3592e924b5a5b9688e93addd765205f4e17906fc3668896646d

Download Submit
C:\Windows\System\PRlrJrM.exe

Filesize
2.3MB

MD5
5ec932723e73cc5386da1396b06f1bee

SHA1
0f177d3b02d462c84d11bffc56dfe775155525c2

SHA256
87e2ecc5d8899f0a7b255d28a802cb57f5808147eb8969060abbe4bcb3faa2e8

SHA512
bf241dc3d2357057b6badf09ed3bf1aa89bcc4a745625349c4ad263a76b69e82666c7a42964b1e5717eb2fcf2253409c68a98fd14e08d365c4fc98948c1fe0df

Download Submit
C:\Windows\System\YmGAXDE.exe

Filesize
2.3MB

MD5
5a1d0b1a6226c5b7458e2a631ea548dc

SHA1
2e4b1af11f17338804bca25c88e5aa952fa97461

SHA256
f11d576f46a4409e0e998a419d81e9044cc04bc2d33c0be17f3a15aba05269fb

SHA512
cc44081b8717c68d68ce4fb544832fcf534e2c26d6412eb7250b96057bcd2e4dca03dc05f8a64cddd9355564007cacc562f90574d452bf6001119cf9e2b04756

Download Submit
C:\Windows\System\ZjKRbwi.exe

Filesize
2.3MB

MD5
897a272e5605d2257b4f40728d98306f

SHA1
972da2a5525f8309d467091a65906c92953497a5

SHA256
1bad397554494fb84895355afeb5a86ed921ee0d468f44281c127078554ba3f8

SHA512
08d7e574137af450b7d21e206c8d259ed852d3d88ddbf460d9910426cba85d3f6147793bb465d2556167f9e19fa7f6f6142d45464db41f5a71a64ae741dfa0ae

Download Submit
C:\Windows\System\bRQJTFC.exe

Filesize
2.3MB

MD5
a54025d291683ef5aa37dce22bd29c88

SHA1
0ae9fba713b8f28f916e1e78ec72a6c0690c3f3f

SHA256
a1d09b617f250437b2f2f214f1dab39a9749bc04731f46a337e7428d6726f59e

SHA512
185bffbc510ed8e831154cc1c8656763e5a80d6e2234f6a8bc1f176ab70d4a93545cd22c529ff78c111506eec8921bfcf672bedbc96de1959b2dd9b32f21ed0d

Download Submit
C:\Windows\System\dJAxydw.exe

Filesize
2.3MB

MD5
4a9682f5736dd92a7b67f9066797301d

SHA1
ef4b1eafac92c584b1a84b11ea949b18fe191c6e

SHA256
91582f75e2795cb619ec7ce7c595eb70f85a677a08c1c5ae4ab63e20435d8de7

SHA512
961a44adfece395f143c7b52677ba65eca8f9c50087e76439637740ddac66540175b99427e651ce0c843ce36ed8641a142ddc0be5b91aab374f25005727028a6

Download Submit
C:\Windows\System\fsYwFFH.exe

Filesize
2.3MB

MD5
67e717cb27ee839b4a347ed11621f7fe

SHA1
29daceb7e421c05d992e4302e3e9c213fb5cda99

SHA256
7ec42e7d6486eabab751e0e98e230c01a3c53921972c8f184a8337462fd7abbe

SHA512
a7abb2d5fb72f9d98fd65ed5c87d09fab77df82dd49cf2f68546f3b00679bb105a9045c3d7acf554d56f98cd3d48eedc4825b7e5575ebb8ab3e4972329ed049a

Download Submit
C:\Windows\System\gJdTeVW.exe

Filesize
2.3MB

MD5
242e4445929e72ff5231dd38775a3972

SHA1
33bac256123b307ccb415599f77561c308e4e7e2

SHA256
bf85604c3ac5d2891cf126306faea4f5cf2391098b2943cdbd9f7fbca99b77b0

SHA512
5c79076dbcf9b4b0fbd6969c6329f8802b3ea255861bdf05329499b25db790cd79f534057be22b57a89579793c2268499e85b50538950e8fff98bc9476fdcce6

Download Submit
C:\Windows\System\glppxSl.exe

Filesize
2.3MB

MD5
7cbf3c6331e3c64fadeb9d96a0f9ee9f

SHA1
abd31f9b49e54c3e82696a88708574e1b9d54059

SHA256
f8fe38e55a2521f12598f6be90402c0ec28dd388890611a3694d70a7b46850d9

SHA512
ac100f87118799a60d3bb3f15a7cfdf38f13555c52fd43ec902961cf0bfb83813ffa159958eaca3f798bdd1a4076279e46b6ccf51f08b9f3e9acd0d0c6040699

Download Submit
C:\Windows\System\iHktXde.exe

Filesize
2.3MB

MD5
1d446286fe99a4c79098f927bc2de78d

SHA1
f2f518bc7cba2478171b3fb69174fdeddfe40769

SHA256
34e7ece2cb241b2d8f62cfafbe185901f9e17f116804d6a0db32cb0090886d4f

SHA512
e07d23cd1c61e53faa3d576f0780e7e8d261492d8738aabf509d077e1b4d37bd50eaa850993c2111b917a6071bfd2aea5cf3be1583ae16158924b0d78358f0c9

Download Submit
C:\Windows\System\itLBoXF.exe

Filesize
2.3MB

MD5
f46b284c0f9096a81607bc2e95ff7b57

SHA1
e3dca6a01517ccae9a5b3bd8054dd28ad259cdce

SHA256
758d4a014a77b893c72a00ded568ac2c051227abc8145d68a5f7b9c12ad2cbca

SHA512
9cf8f4c0cd69e394e9db2e3d824c321ea0ff52e0b489596bbd9ac157252792a4ffffa70015456c6ce5e591352956fcc09dadf3ed7c07ebdbb8d0d98d2a8438ba

Download Submit
C:\Windows\System\iwaExVL.exe

Filesize
2.3MB

MD5
1f78d6cce26db8f1e8aa03633ee101ab

SHA1
e88668747752d23dd34ea0adbdb11e3dfbf05a5e

SHA256
57aeccfaf64bcfb2fcb86a283959e1aa9549afe22834c42fff6882383efb6fb1

SHA512
b93ca644a3a54831870efbc58540dc4cfeee8ccc281a8554cfb1df0cf9df17f8c36eecb138d3cdc2b786034f04afedae425ab355542697ec55b51cfd094040ce

Download Submit
C:\Windows\System\kGUPAJy.exe

Filesize
2.3MB

MD5
43d876f7e2ae5049fe4a4538c683adba

SHA1
73a2b7b35f70aaa3cb98c6763035d98a133b25ae

SHA256
b550604dc959c529383647accbdce75692a31c946fc05305dbd1a153bba95d6e

SHA512
ec50a9eea749d5170d9ad1bdcd66705b94b26b6effb8576ede61c397f38fa1ebd6599517c6a4e36cd498aae3943934e8e70a758ee7f89ff3e1e7bdc758b48c28

Download Submit
C:\Windows\System\lgAvCFz.exe

Filesize
2.3MB

MD5
24e7dc73281455996418b00e93f653dc

SHA1
c0bbbb88c7880c74dad771b7d2321d71a9900483

SHA256
17fdf13ab7a6320974a654966a81aebff3f77f5e3e1a47e211b05e2d4302327f

SHA512
89bec7f411a23d3aac352700fe4f2cc445ccaae63d2ff15707170058e355b80518b4b5344dd2d7d80095b015828969a81131b5f17f4cb7c3a5564fa210041dec

Download Submit
C:\Windows\System\mXRNFlA.exe

Filesize
2.3MB

MD5
423afce5577648087a87c762437575ed

SHA1
685f5791df9873b9fcd4e140f3ddf64d34c35ced

SHA256
8da171aebd0a79736842ec12740c8555319156df9d7308b2d5d65a6ab7e5a6e1

SHA512
42b07acb963ada791f85cca07c3d3a960d31c7ebf4ce20ebd9fe1d6c1f0e0abee9c0466412b001773cadf0b73ad88ce7b3fe7ab52e9304882e4e7cf3d44e2bd6

Download Submit
C:\Windows\System\oUuxUJV.exe

Filesize
2.3MB

MD5
9eaf227a8d8c64996245425743510f84

SHA1
4bf953e9363918f9f9734e3758b7f0bcb52f1a56

SHA256
746bd28ddf31096f4423b131e0ede51ed74bd195573c4eaa316cec7e43311988

SHA512
bec5186bc4e66273f20da5365bc75f99ccfe052a1e6277260ce16f50fb1425f773e25d727b97e5b10f60091317dd1e0658914f0c744efd88efa9297c6b26d348

Download Submit
C:\Windows\System\oYSkGZA.exe

Filesize
2.3MB

MD5
46cde177a43c63c47f1209ca779210a8

SHA1
32a284a9eca1eb570471adcdb72f108953e471ff

SHA256
6a58b323f19aca7f2f6c98bcfae44476826afabb6bdc2ed72b8f22e9346282f2

SHA512
451b06d9e8f102e709b7006be848053dcc6be8ac0c91553faa7ea611324fd5a1f5f7a86590011375cc7a6e466dab13abebb73a55854a908742d381d0bd2d2cb6

Download Submit
C:\Windows\System\pEPAZYM.exe

Filesize
2.3MB

MD5
6cc2422c4210c95cf27bc4b4dc287ee6

SHA1
6be6ecfc6ad6ef90fdf23a9b99a4d778f5eb9a7c

SHA256
e4ddc428ed10b151ac5c32de9884293f46f92a51746364623d2f68923e4fd742

SHA512
4d147b02adbf040426cfeb3d8a1e7496c1219bf5bf0f57052d0251e56b38036b5ef3099a08bc7036b5ee0b7e70ee154e60595f2081504b67e5d4882468f1b157

Download Submit
C:\Windows\System\ryQRuOp.exe

Filesize
2.3MB

MD5
f863cbd3c56c67aaeb6b907999b7412a

SHA1
dcfeb538f132a7ea770ba8002ea6437c29829df7

SHA256
602547aeb501ae431fdbfe68f0a2e9c882ad2e3ddc8c50f46c9792d4852fc374

SHA512
1a6a553e8653bd8ff64c18732f9dd00ec17380ccd74ba13c0fe29484ba26f4b34643d2cc436aef84658cdc3db38c26be67d6663c9bb84731225b95ef5521aba9

Download Submit
C:\Windows\System\tRsGdBu.exe

Filesize
2.3MB

MD5
344326234b87b1a6c61af10050ade83b

SHA1
8843d8114832044323f53722822e7db3a7ad6427

SHA256
451692b1957752d94332b4223a6c4da58dd9acdb38712ff57c86cbcaf6359baa

SHA512
04d283bce72835cac3fac9f98d49a2e6f896ed8a54c05d08abe7531340ec71996a995964ab68929130f25e3ef2735f0f9be4b1f02fb1635559b53a8b74579914

Download Submit
C:\Windows\System\tjiKHnD.exe

Filesize
2.3MB

MD5
015114e2ba0f288e2a2d08c0f0b08c66

SHA1
d4abec4d19096892a6b65aa1e08b50b187c33afd

SHA256
46715aba25fac6857420e75e217936f5f064ff9d2100d0a6ad1a3a9ff1d056a5

SHA512
ede57d98bbaae0c2fe6c989ec12717cb0287e406d08a55d93f221c871d573565f5703288cc18a9bd5e2b662ef0587c6f3755c45bba729e97517ca67217b513b1

Download Submit
C:\Windows\System\toBNQMA.exe

Filesize
2.3MB

MD5
f943477e3687d4fb9cffb5b8e14cf3a4

SHA1
035352b7b656acc90aca407858ab73fb0955ac9b

SHA256
c767a65e80f3ce24b1e450fb3865b96b574582c4b201753252c319a743c55ccc

SHA512
7a956555b9a68e9bc3e16aa7df416afdaa4882fe1fd64ad64592cfeeb3ef9d6c25a179586755f3e07029110b09008e08168b98b8e824fd19d9d8fd9a85d6dcde

Download Submit
C:\Windows\System\tsDFmTq.exe

Filesize
2.3MB

MD5
773192ecf9c243f6113e60accc3da198

SHA1
bb0ba9bddc4bee201df74d8ef872233c93a7842e

SHA256
e17ec019149f27c0f1e5b26673dd474b2669d4ca9069940eb242a4a58c96367b

SHA512
c8a32f8897430d36ce08fe33fc4e0fbef449811043b8872aefa3c317b98d63d120e76c2097566089964f310b1b218d96d25a8996d1cda6ba6739cfda18bcfc13

Download Submit
C:\Windows\System\uGirpfO.exe

Filesize
2.3MB

MD5
51dc55b40786184c544d7da03038bb2c

SHA1
6d47cd74a22485001412e31869e819296eca39e4

SHA256
0d303ec644584424c3fcdbbe81ffc30f630bee325775531942902ac29067efb4

SHA512
b13d0bbea044d555c5ae3a5e2d14eafb1e98beea0d1943782812fab6822548feb42b4481fd4e79538d34640722efa69279c2da26381bc77490a07c8a74c56be0

Download Submit
memory/376-113-0x00007FF638B50000-0x00007FF638EA4000-memory.dmp

Filesize
3.3MB

Download
memory/376-2177-0x00007FF638B50000-0x00007FF638EA4000-memory.dmp

Filesize
3.3MB

Download
memory/692-130-0x00007FF7E08F0000-0x00007FF7E0C44000-memory.dmp

Filesize
3.3MB

Download
memory/692-2185-0x00007FF7E08F0000-0x00007FF7E0C44000-memory.dmp

Filesize
3.3MB

Download
memory/700-2173-0x00007FF75E300000-0x00007FF75E654000-memory.dmp

Filesize
3.3MB

Download
memory/700-74-0x00007FF75E300000-0x00007FF75E654000-memory.dmp

Filesize
3.3MB

Download
memory/768-2180-0x00007FF74E4F0000-0x00007FF74E844000-memory.dmp

Filesize
3.3MB

Download
memory/768-132-0x00007FF74E4F0000-0x00007FF74E844000-memory.dmp

Filesize
3.3MB

Download
memory/1360-54-0x00007FF720380000-0x00007FF7206D4000-memory.dmp

Filesize
3.3MB

Download
memory/1360-2175-0x00007FF720380000-0x00007FF7206D4000-memory.dmp

Filesize
3.3MB

Download
memory/1360-1274-0x00007FF720380000-0x00007FF7206D4000-memory.dmp

Filesize
3.3MB

Download
memory/1704-78-0x00007FF67C780000-0x00007FF67CAD4000-memory.dmp

Filesize
3.3MB

Download
memory/1704-2174-0x00007FF67C780000-0x00007FF67CAD4000-memory.dmp

Filesize
3.3MB

Download
memory/1772-156-0x00007FF656F50000-0x00007FF6572A4000-memory.dmp

Filesize
3.3MB

Download
memory/1772-2332-0x00007FF656F50000-0x00007FF6572A4000-memory.dmp

Filesize
3.3MB

Download
memory/1852-2178-0x00007FF794FE0000-0x00007FF795334000-memory.dmp

Filesize
3.3MB

Download
memory/1852-1279-0x00007FF794FE0000-0x00007FF795334000-memory.dmp

Filesize
3.3MB

Download
memory/1852-99-0x00007FF794FE0000-0x00007FF795334000-memory.dmp

Filesize
3.3MB

Download
memory/1948-136-0x00007FF622E60000-0x00007FF6231B4000-memory.dmp

Filesize
3.3MB

Download
memory/1948-2172-0x00007FF622E60000-0x00007FF6231B4000-memory.dmp

Filesize
3.3MB

Download
memory/2092-129-0x00007FF6CD8B0000-0x00007FF6CDC04000-memory.dmp

Filesize
3.3MB

Download
memory/2092-2184-0x00007FF6CD8B0000-0x00007FF6CDC04000-memory.dmp

Filesize
3.3MB

Download
memory/2168-920-0x00007FF75F690000-0x00007FF75F9E4000-memory.dmp

Filesize
3.3MB

Download
memory/2168-13-0x00007FF75F690000-0x00007FF75F9E4000-memory.dmp

Filesize
3.3MB

Download
memory/2168-2169-0x00007FF75F690000-0x00007FF75F9E4000-memory.dmp

Filesize
3.3MB

Download
memory/2268-2361-0x00007FF6BCDD0000-0x00007FF6BD124000-memory.dmp

Filesize
3.3MB

Download
memory/2268-188-0x00007FF6BCDD0000-0x00007FF6BD124000-memory.dmp

Filesize
3.3MB

Download
memory/2268-2164-0x00007FF6BCDD0000-0x00007FF6BD124000-memory.dmp

Filesize
3.3MB

Download
memory/2284-2186-0x00007FF63A820000-0x00007FF63AB74000-memory.dmp

Filesize
3.3MB

Download
memory/2284-139-0x00007FF63A820000-0x00007FF63AB74000-memory.dmp

Filesize
3.3MB

Download
memory/2728-2183-0x00007FF6C4CB0000-0x00007FF6C5004000-memory.dmp

Filesize
3.3MB

Download
memory/2728-1284-0x00007FF6C4CB0000-0x00007FF6C5004000-memory.dmp

Filesize
3.3MB

Download
memory/2728-112-0x00007FF6C4CB0000-0x00007FF6C5004000-memory.dmp

Filesize
3.3MB

Download
memory/2908-2188-0x00007FF6E4B00000-0x00007FF6E4E54000-memory.dmp

Filesize
3.3MB

Download
memory/2908-131-0x00007FF6E4B00000-0x00007FF6E4E54000-memory.dmp

Filesize
3.3MB

Download
memory/2960-2162-0x00007FF719BE0000-0x00007FF719F34000-memory.dmp

Filesize
3.3MB

Download
memory/2960-168-0x00007FF719BE0000-0x00007FF719F34000-memory.dmp

Filesize
3.3MB

Download
memory/2960-2363-0x00007FF719BE0000-0x00007FF719F34000-memory.dmp

Filesize
3.3MB

Download
memory/3068-917-0x00007FF655090000-0x00007FF6553E4000-memory.dmp

Filesize
3.3MB

Download
memory/3068-1-0x000001AA85E00000-0x000001AA85E10000-memory.dmp

Filesize
64KB

Download
memory/3068-0-0x00007FF655090000-0x00007FF6553E4000-memory.dmp

Filesize
3.3MB

Download
memory/3128-2171-0x00007FF7422F0000-0x00007FF742644000-memory.dmp

Filesize
3.3MB

Download
memory/3128-1273-0x00007FF7422F0000-0x00007FF742644000-memory.dmp

Filesize
3.3MB

Download
memory/3128-34-0x00007FF7422F0000-0x00007FF742644000-memory.dmp

Filesize
3.3MB

Download
memory/3380-2176-0x00007FF68F6D0000-0x00007FF68FA24000-memory.dmp

Filesize
3.3MB

Download
memory/3380-58-0x00007FF68F6D0000-0x00007FF68FA24000-memory.dmp

Filesize
3.3MB

Download
memory/3380-1752-0x00007FF68F6D0000-0x00007FF68FA24000-memory.dmp

Filesize
3.3MB

Download
memory/3392-2189-0x00007FF7CDD40000-0x00007FF7CE094000-memory.dmp

Filesize
3.3MB

Download
memory/3392-134-0x00007FF7CDD40000-0x00007FF7CE094000-memory.dmp

Filesize
3.3MB

Download
memory/3496-2182-0x00007FF7E7A70000-0x00007FF7E7DC4000-memory.dmp

Filesize
3.3MB

Download
memory/3496-120-0x00007FF7E7A70000-0x00007FF7E7DC4000-memory.dmp

Filesize
3.3MB

Download
memory/4016-133-0x00007FF632190000-0x00007FF6324E4000-memory.dmp

Filesize
3.3MB

Download
memory/4016-2191-0x00007FF632190000-0x00007FF6324E4000-memory.dmp

Filesize
3.3MB

Download
memory/4068-164-0x00007FF6C6D40000-0x00007FF6C7094000-memory.dmp

Filesize
3.3MB

Download
memory/4068-2161-0x00007FF6C6D40000-0x00007FF6C7094000-memory.dmp

Filesize
3.3MB

Download
memory/4068-2334-0x00007FF6C6D40000-0x00007FF6C7094000-memory.dmp

Filesize
3.3MB

Download
memory/4208-2179-0x00007FF70A830000-0x00007FF70AB84000-memory.dmp

Filesize
3.3MB

Download
memory/4208-137-0x00007FF70A830000-0x00007FF70AB84000-memory.dmp

Filesize
3.3MB

Download
memory/4304-144-0x00007FF75A120000-0x00007FF75A474000-memory.dmp

Filesize
3.3MB

Download
memory/4304-2160-0x00007FF75A120000-0x00007FF75A474000-memory.dmp

Filesize
3.3MB

Download
memory/4304-2333-0x00007FF75A120000-0x00007FF75A474000-memory.dmp

Filesize
3.3MB

Download
memory/4400-2190-0x00007FF64BBF0000-0x00007FF64BF44000-memory.dmp

Filesize
3.3MB

Download
memory/4400-135-0x00007FF64BBF0000-0x00007FF64BF44000-memory.dmp

Filesize
3.3MB

Download
memory/4596-2170-0x00007FF705FE0000-0x00007FF706334000-memory.dmp

Filesize
3.3MB

Download
memory/4596-1270-0x00007FF705FE0000-0x00007FF706334000-memory.dmp

Filesize
3.3MB

Download
memory/4596-20-0x00007FF705FE0000-0x00007FF706334000-memory.dmp

Filesize
3.3MB

Download
memory/4816-174-0x00007FF6FF490000-0x00007FF6FF7E4000-memory.dmp

Filesize
3.3MB

Download
memory/4816-2362-0x00007FF6FF490000-0x00007FF6FF7E4000-memory.dmp

Filesize
3.3MB

Download
memory/4816-2163-0x00007FF6FF490000-0x00007FF6FF7E4000-memory.dmp

Filesize
3.3MB

Download
memory/4856-2192-0x00007FF6720E0000-0x00007FF672434000-memory.dmp

Filesize
3.3MB

Download
memory/4856-140-0x00007FF6720E0000-0x00007FF672434000-memory.dmp

Filesize
3.3MB

Download
memory/4860-2181-0x00007FF6731E0000-0x00007FF673534000-memory.dmp

Filesize
3.3MB

Download
memory/4860-138-0x00007FF6731E0000-0x00007FF673534000-memory.dmp

Filesize
3.3MB

Download