Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
39s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2024, 21:14
Behavioral task
behavioral1
Sample
1084c1ae3bc47570f5328522d6ff7c30N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
1084c1ae3bc47570f5328522d6ff7c30N.exe
Resource
win10v2004-20240709-en
General
-
Target
1084c1ae3bc47570f5328522d6ff7c30N.exe
-
Size
1.9MB
-
MD5
1084c1ae3bc47570f5328522d6ff7c30
-
SHA1
faa1dad41c8b8a911c6f945f4c229f169992b9d1
-
SHA256
d5bc49f5e6839a22344f3d938c8bc94902d9dbf0a3109c3f3636e175c6627041
-
SHA512
ad8596fd32d7ad43c3dc2e6a10d8d242c7b5872fc7c5965d8271ab581b89f157b6372289acdf987975761207cae17f4cad46b4babca8cd6a0d3138b08f49979d
-
SSDEEP
49152:ROdWCCi7/rahlqOdg6VLEL3e73DpSRdya5:RWWBiba+
Malware Config
Signatures
-
XMRig Miner payload 51 IoCs
resource yara_rule behavioral2/memory/4528-271-0x00007FF6AC530000-0x00007FF6AC881000-memory.dmp xmrig behavioral2/memory/1116-318-0x00007FF70B510000-0x00007FF70B861000-memory.dmp xmrig behavioral2/memory/2768-345-0x00007FF7F30E0000-0x00007FF7F3431000-memory.dmp xmrig behavioral2/memory/4868-354-0x00007FF7E07C0000-0x00007FF7E0B11000-memory.dmp xmrig behavioral2/memory/3048-370-0x00007FF7190C0000-0x00007FF719411000-memory.dmp xmrig behavioral2/memory/3324-371-0x00007FF66A550000-0x00007FF66A8A1000-memory.dmp xmrig behavioral2/memory/748-369-0x00007FF6C51D0000-0x00007FF6C5521000-memory.dmp xmrig behavioral2/memory/4572-368-0x00007FF6F4290000-0x00007FF6F45E1000-memory.dmp xmrig behavioral2/memory/4780-367-0x00007FF64BB30000-0x00007FF64BE81000-memory.dmp xmrig behavioral2/memory/3864-366-0x00007FF6F4A60000-0x00007FF6F4DB1000-memory.dmp xmrig behavioral2/memory/3640-365-0x00007FF797A30000-0x00007FF797D81000-memory.dmp xmrig behavioral2/memory/1888-364-0x00007FF76FC00000-0x00007FF76FF51000-memory.dmp xmrig behavioral2/memory/5032-363-0x00007FF6D3C20000-0x00007FF6D3F71000-memory.dmp xmrig behavioral2/memory/4488-344-0x00007FF79B070000-0x00007FF79B3C1000-memory.dmp xmrig behavioral2/memory/1876-335-0x00007FF6EA660000-0x00007FF6EA9B1000-memory.dmp xmrig behavioral2/memory/4544-334-0x00007FF68EF70000-0x00007FF68F2C1000-memory.dmp xmrig behavioral2/memory/3152-308-0x00007FF676EC0000-0x00007FF677211000-memory.dmp xmrig behavioral2/memory/2872-267-0x00007FF7CFAA0000-0x00007FF7CFDF1000-memory.dmp xmrig behavioral2/memory/2364-228-0x00007FF7815B0000-0x00007FF781901000-memory.dmp xmrig behavioral2/memory/4720-189-0x00007FF6719A0000-0x00007FF671CF1000-memory.dmp xmrig behavioral2/memory/4152-70-0x00007FF7D7D30000-0x00007FF7D8081000-memory.dmp xmrig behavioral2/memory/4372-2122-0x00007FF637B80000-0x00007FF637ED1000-memory.dmp xmrig behavioral2/memory/4832-2511-0x00007FF61F060000-0x00007FF61F3B1000-memory.dmp xmrig behavioral2/memory/4152-2513-0x00007FF7D7D30000-0x00007FF7D8081000-memory.dmp xmrig behavioral2/memory/3028-2515-0x00007FF666460000-0x00007FF6667B1000-memory.dmp xmrig behavioral2/memory/4780-2517-0x00007FF64BB30000-0x00007FF64BE81000-memory.dmp xmrig behavioral2/memory/3388-2519-0x00007FF6BE1A0000-0x00007FF6BE4F1000-memory.dmp xmrig behavioral2/memory/1504-2521-0x00007FF78FD80000-0x00007FF7900D1000-memory.dmp xmrig behavioral2/memory/4572-2523-0x00007FF6F4290000-0x00007FF6F45E1000-memory.dmp xmrig behavioral2/memory/4720-2525-0x00007FF6719A0000-0x00007FF671CF1000-memory.dmp xmrig behavioral2/memory/4520-2529-0x00007FF735EA0000-0x00007FF7361F1000-memory.dmp xmrig behavioral2/memory/1412-2531-0x00007FF6DFAF0000-0x00007FF6DFE41000-memory.dmp xmrig behavioral2/memory/2364-2534-0x00007FF7815B0000-0x00007FF781901000-memory.dmp xmrig behavioral2/memory/4488-2527-0x00007FF79B070000-0x00007FF79B3C1000-memory.dmp xmrig behavioral2/memory/3324-2588-0x00007FF66A550000-0x00007FF66A8A1000-memory.dmp xmrig behavioral2/memory/3152-2585-0x00007FF676EC0000-0x00007FF677211000-memory.dmp xmrig behavioral2/memory/2768-2581-0x00007FF7F30E0000-0x00007FF7F3431000-memory.dmp xmrig behavioral2/memory/2872-2579-0x00007FF7CFAA0000-0x00007FF7CFDF1000-memory.dmp xmrig behavioral2/memory/1116-2577-0x00007FF70B510000-0x00007FF70B861000-memory.dmp xmrig behavioral2/memory/4528-2575-0x00007FF6AC530000-0x00007FF6AC881000-memory.dmp xmrig behavioral2/memory/1876-2573-0x00007FF6EA660000-0x00007FF6EA9B1000-memory.dmp xmrig behavioral2/memory/4868-2569-0x00007FF7E07C0000-0x00007FF7E0B11000-memory.dmp xmrig behavioral2/memory/4544-2564-0x00007FF68EF70000-0x00007FF68F2C1000-memory.dmp xmrig behavioral2/memory/3640-2556-0x00007FF797A30000-0x00007FF797D81000-memory.dmp xmrig behavioral2/memory/3048-2583-0x00007FF7190C0000-0x00007FF719411000-memory.dmp xmrig behavioral2/memory/1888-2571-0x00007FF76FC00000-0x00007FF76FF51000-memory.dmp xmrig behavioral2/memory/748-2567-0x00007FF6C51D0000-0x00007FF6C5521000-memory.dmp xmrig behavioral2/memory/1200-2535-0x00007FF767D50000-0x00007FF7680A1000-memory.dmp xmrig behavioral2/memory/5032-2607-0x00007FF6D3C20000-0x00007FF6D3F71000-memory.dmp xmrig behavioral2/memory/3864-2636-0x00007FF6F4A60000-0x00007FF6F4DB1000-memory.dmp xmrig behavioral2/memory/4060-2605-0x00007FF675490000-0x00007FF6757E1000-memory.dmp xmrig -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Executes dropped EXE 64 IoCs
pid Process 4832 AqAhIlU.exe 3028 UizPyfr.exe 4780 XqudVqT.exe 3388 zziklvF.exe 1200 hWXUXpV.exe 4152 APIkpgT.exe 1504 XcWhuNP.exe 4572 PdYKCJI.exe 4520 XkeFHpJ.exe 1412 tglygOL.exe 4060 lPiGAey.exe 4720 DvWTZOR.exe 2364 lxVlbuP.exe 2872 rmWHQzK.exe 4528 JqwASVb.exe 748 YtoIdKa.exe 3152 HoAgYkT.exe 1116 sZnbIVT.exe 4544 lYuHnBe.exe 1876 eGaDwwb.exe 3048 uXsQjqa.exe 4488 nGGmzks.exe 2768 nbIGUet.exe 4868 WKYOhdH.exe 5032 ccfSdYp.exe 1888 fFJwUWu.exe 3640 pDHAXTU.exe 3324 ySSiLMx.exe 3864 RghyLKC.exe 408 SZuEBzt.exe 1612 HkOiSxW.exe 1704 DbdiYyF.exe 4828 vSwocCd.exe 952 RSGNflV.exe 3952 MHmzJDX.exe 4492 ydkyIqX.exe 1580 gPlnQZC.exe 2228 JXfMSaR.exe 4280 kAlfWRU.exe 4100 iGvuKbO.exe 1144 prjOCVA.exe 4384 lhZzfdm.exe 780 tFyvFcW.exe 4240 OmVHXFE.exe 2724 JFGkxep.exe 3576 UxXDTlY.exe 3948 fmBNjBE.exe 2352 BHLZzmt.exe 2428 DNwZodb.exe 4568 xjJgzaL.exe 2216 XwIzvPA.exe 1672 FNbxrLc.exe 4368 jzsoyaW.exe 4960 ZVJWQwh.exe 4128 eqGcPvB.exe 4340 YFUPVBE.exe 4228 vqOnrfq.exe 552 mqZvNwJ.exe 3120 MGuiBJX.exe 5028 bPzpvUj.exe 5048 WJSefWK.exe 1496 TmUsypJ.exe 5040 bttHJWV.exe 3544 gkrCZCA.exe -
resource yara_rule behavioral2/memory/4372-0-0x00007FF637B80000-0x00007FF637ED1000-memory.dmp upx behavioral2/files/0x000900000002340e-5.dat upx behavioral2/files/0x0007000000023421-58.dat upx behavioral2/files/0x0007000000023422-62.dat upx behavioral2/files/0x0007000000023436-178.dat upx behavioral2/memory/4528-271-0x00007FF6AC530000-0x00007FF6AC881000-memory.dmp upx behavioral2/memory/1116-318-0x00007FF70B510000-0x00007FF70B861000-memory.dmp upx behavioral2/memory/2768-345-0x00007FF7F30E0000-0x00007FF7F3431000-memory.dmp upx behavioral2/memory/4868-354-0x00007FF7E07C0000-0x00007FF7E0B11000-memory.dmp upx behavioral2/memory/3048-370-0x00007FF7190C0000-0x00007FF719411000-memory.dmp upx behavioral2/memory/3324-371-0x00007FF66A550000-0x00007FF66A8A1000-memory.dmp upx behavioral2/memory/748-369-0x00007FF6C51D0000-0x00007FF6C5521000-memory.dmp upx behavioral2/memory/4572-368-0x00007FF6F4290000-0x00007FF6F45E1000-memory.dmp upx behavioral2/memory/4780-367-0x00007FF64BB30000-0x00007FF64BE81000-memory.dmp upx behavioral2/memory/3864-366-0x00007FF6F4A60000-0x00007FF6F4DB1000-memory.dmp upx behavioral2/memory/3640-365-0x00007FF797A30000-0x00007FF797D81000-memory.dmp upx behavioral2/memory/1888-364-0x00007FF76FC00000-0x00007FF76FF51000-memory.dmp upx behavioral2/memory/5032-363-0x00007FF6D3C20000-0x00007FF6D3F71000-memory.dmp upx behavioral2/memory/4488-344-0x00007FF79B070000-0x00007FF79B3C1000-memory.dmp upx behavioral2/memory/1876-335-0x00007FF6EA660000-0x00007FF6EA9B1000-memory.dmp upx behavioral2/memory/4544-334-0x00007FF68EF70000-0x00007FF68F2C1000-memory.dmp upx behavioral2/memory/3152-308-0x00007FF676EC0000-0x00007FF677211000-memory.dmp upx behavioral2/memory/2872-267-0x00007FF7CFAA0000-0x00007FF7CFDF1000-memory.dmp upx behavioral2/memory/2364-228-0x00007FF7815B0000-0x00007FF781901000-memory.dmp upx behavioral2/files/0x000700000002342a-200.dat upx behavioral2/files/0x0007000000023428-195.dat upx behavioral2/memory/4060-187-0x00007FF675490000-0x00007FF6757E1000-memory.dmp upx behavioral2/files/0x000700000002343b-186.dat upx behavioral2/files/0x000700000002343a-185.dat upx behavioral2/files/0x0007000000023439-183.dat upx behavioral2/files/0x0007000000023438-182.dat upx behavioral2/files/0x0007000000023427-180.dat upx behavioral2/files/0x0007000000023425-170.dat upx behavioral2/files/0x0007000000023424-160.dat upx behavioral2/files/0x000700000002342b-158.dat upx behavioral2/files/0x0007000000023434-157.dat upx behavioral2/files/0x0007000000023433-156.dat upx behavioral2/files/0x0007000000023431-153.dat upx behavioral2/files/0x0007000000023430-152.dat upx behavioral2/memory/4720-189-0x00007FF6719A0000-0x00007FF671CF1000-memory.dmp upx behavioral2/files/0x0007000000023437-179.dat upx behavioral2/memory/1412-148-0x00007FF6DFAF0000-0x00007FF6DFE41000-memory.dmp upx behavioral2/files/0x000700000002342e-142.dat upx behavioral2/files/0x000700000002342d-139.dat upx behavioral2/files/0x0007000000023426-133.dat upx behavioral2/files/0x000700000002342c-130.dat upx behavioral2/files/0x0007000000023420-124.dat upx behavioral2/files/0x0007000000023423-154.dat upx behavioral2/files/0x000700000002341f-114.dat upx behavioral2/files/0x000700000002341a-110.dat upx behavioral2/files/0x0007000000023429-104.dat upx behavioral2/files/0x000700000002341e-103.dat upx behavioral2/files/0x000700000002342f-151.dat upx behavioral2/memory/4520-100-0x00007FF735EA0000-0x00007FF7361F1000-memory.dmp upx behavioral2/memory/1504-97-0x00007FF78FD80000-0x00007FF7900D1000-memory.dmp upx behavioral2/files/0x000700000002341d-88.dat upx behavioral2/files/0x000700000002341c-83.dat upx behavioral2/files/0x000700000002341b-79.dat upx behavioral2/files/0x0007000000023418-77.dat upx behavioral2/memory/4152-70-0x00007FF7D7D30000-0x00007FF7D8081000-memory.dmp upx behavioral2/files/0x0007000000023416-63.dat upx behavioral2/files/0x0007000000023417-71.dat upx behavioral2/memory/1200-67-0x00007FF767D50000-0x00007FF7680A1000-memory.dmp upx behavioral2/memory/3028-39-0x00007FF666460000-0x00007FF6667B1000-memory.dmp upx -
Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\System\KOVvqtx.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\ffHmGUF.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\PpZRdll.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\OSjpJMK.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\OmbAUjz.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\hWXUXpV.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\lPiGAey.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\iGvuKbO.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\oUcAuyU.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\PNosWSD.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\wSUbMLd.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\OKPxBDO.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\VoUaGIj.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\UizPyfr.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\WKYOhdH.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\yUhtZAa.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\EgybkAh.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\BumnvLd.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\pmXySvW.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\fYtIVly.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\jBwjbhx.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\fcbmvBM.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\UacpxVH.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\tglygOL.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\NIOQoTV.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\COTJlyj.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\shUOWqX.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\OMRFKSQ.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\XersVmf.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\kdvCJVG.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\iuFkXdL.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\lNtBDmV.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\avaEdQJ.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\XseQGdO.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\XgTMoce.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\jsXEhxP.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\WKbBDJi.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\nCZAulk.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\qbdaiwf.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\euBygRp.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\vWQgUxc.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\aNWxTbx.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\TmBVToT.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\uexCXQZ.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\bUjPjnu.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\qcnIOkd.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\PVugTQe.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\thcWdvX.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\lZlQKRt.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\sLIXRmT.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\YFUPVBE.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\izwOEAW.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\YjDUJcW.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\IjyRNYn.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\qMZmqRY.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\JqwASVb.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\HipygEq.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\KoEHkDv.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\FMNCzlI.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\iHbpRXO.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\tCPVEtU.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\vSwocCd.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\jEKvHTi.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe File created C:\Windows\System\kRtUUWJ.exe 1084c1ae3bc47570f5328522d6ff7c30N.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies registry class 62 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-464762018-485119342-1613148473-1000\{3159201B-800D-4D46-A3D5-C0FCA3386B01} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WasEverActivated = "1" sihost.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-464762018-485119342-1613148473-1000\{33E66D20-359E-4218-88EE-7AB2D9D347FE} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-464762018-485119342-1613148473-1000\{FDF94873-1393-483B-8636-77E6633943B7} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-464762018-485119342-1613148473-1000\{5AAB94AC-759B-4287-824A-F3BEA5C4F89B} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 14180 explorer.exe Token: SeCreatePagefilePrivilege 14180 explorer.exe Token: SeShutdownPrivilege 14180 explorer.exe Token: SeCreatePagefilePrivilege 14180 explorer.exe Token: SeShutdownPrivilege 14180 explorer.exe Token: SeCreatePagefilePrivilege 14180 explorer.exe Token: SeShutdownPrivilege 14180 explorer.exe Token: SeCreatePagefilePrivilege 14180 explorer.exe Token: SeShutdownPrivilege 14180 explorer.exe Token: SeCreatePagefilePrivilege 14180 explorer.exe Token: SeShutdownPrivilege 14180 explorer.exe Token: SeCreatePagefilePrivilege 14180 explorer.exe Token: SeShutdownPrivilege 14180 explorer.exe Token: SeCreatePagefilePrivilege 14180 explorer.exe Token: SeShutdownPrivilege 14180 explorer.exe Token: SeCreatePagefilePrivilege 14180 explorer.exe Token: SeShutdownPrivilege 14180 explorer.exe Token: SeCreatePagefilePrivilege 14180 explorer.exe Token: SeShutdownPrivilege 14180 explorer.exe Token: SeCreatePagefilePrivilege 14180 explorer.exe Token: SeShutdownPrivilege 14180 explorer.exe Token: SeCreatePagefilePrivilege 14180 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe Token: SeShutdownPrivilege 13328 explorer.exe Token: SeCreatePagefilePrivilege 13328 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 11872 sihost.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe -
Suspicious use of SendNotifyMessage 55 IoCs
pid Process 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 14180 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 13328 explorer.exe 10736 explorer.exe 10736 explorer.exe 10736 explorer.exe 10736 explorer.exe 10736 explorer.exe 10736 explorer.exe 10736 explorer.exe 10736 explorer.exe 10736 explorer.exe 10736 explorer.exe 10736 explorer.exe 4752 explorer.exe 4752 explorer.exe 4752 explorer.exe 4752 explorer.exe 4752 explorer.exe 4752 explorer.exe 4752 explorer.exe 4752 explorer.exe 4752 explorer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 15248 StartMenuExperienceHost.exe 3780 StartMenuExperienceHost.exe 14568 SearchApp.exe 14880 StartMenuExperienceHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4372 wrote to memory of 4832 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 85 PID 4372 wrote to memory of 4832 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 85 PID 4372 wrote to memory of 3028 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 86 PID 4372 wrote to memory of 3028 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 86 PID 4372 wrote to memory of 4780 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 87 PID 4372 wrote to memory of 4780 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 87 PID 4372 wrote to memory of 3388 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 88 PID 4372 wrote to memory of 3388 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 88 PID 4372 wrote to memory of 1200 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 89 PID 4372 wrote to memory of 1200 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 89 PID 4372 wrote to memory of 4152 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 90 PID 4372 wrote to memory of 4152 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 90 PID 4372 wrote to memory of 1412 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 91 PID 4372 wrote to memory of 1412 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 91 PID 4372 wrote to memory of 1504 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 92 PID 4372 wrote to memory of 1504 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 92 PID 4372 wrote to memory of 4720 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 93 PID 4372 wrote to memory of 4720 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 93 PID 4372 wrote to memory of 4572 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 94 PID 4372 wrote to memory of 4572 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 94 PID 4372 wrote to memory of 4520 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 95 PID 4372 wrote to memory of 4520 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 95 PID 4372 wrote to memory of 4060 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 96 PID 4372 wrote to memory of 4060 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 96 PID 4372 wrote to memory of 2364 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 97 PID 4372 wrote to memory of 2364 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 97 PID 4372 wrote to memory of 2872 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 98 PID 4372 wrote to memory of 2872 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 98 PID 4372 wrote to memory of 4528 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 99 PID 4372 wrote to memory of 4528 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 99 PID 4372 wrote to memory of 748 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 100 PID 4372 wrote to memory of 748 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 100 PID 4372 wrote to memory of 3152 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 101 PID 4372 wrote to memory of 3152 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 101 PID 4372 wrote to memory of 1116 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 102 PID 4372 wrote to memory of 1116 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 102 PID 4372 wrote to memory of 4544 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 103 PID 4372 wrote to memory of 4544 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 103 PID 4372 wrote to memory of 1876 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 104 PID 4372 wrote to memory of 1876 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 104 PID 4372 wrote to memory of 3048 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 105 PID 4372 wrote to memory of 3048 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 105 PID 4372 wrote to memory of 4488 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 106 PID 4372 wrote to memory of 4488 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 106 PID 4372 wrote to memory of 2768 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 107 PID 4372 wrote to memory of 2768 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 107 PID 4372 wrote to memory of 4868 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 108 PID 4372 wrote to memory of 4868 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 108 PID 4372 wrote to memory of 5032 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 109 PID 4372 wrote to memory of 5032 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 109 PID 4372 wrote to memory of 1888 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 110 PID 4372 wrote to memory of 1888 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 110 PID 4372 wrote to memory of 3640 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 111 PID 4372 wrote to memory of 3640 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 111 PID 4372 wrote to memory of 3324 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 112 PID 4372 wrote to memory of 3324 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 112 PID 4372 wrote to memory of 3864 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 113 PID 4372 wrote to memory of 3864 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 113 PID 4372 wrote to memory of 408 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 114 PID 4372 wrote to memory of 408 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 114 PID 4372 wrote to memory of 4280 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 115 PID 4372 wrote to memory of 4280 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 115 PID 4372 wrote to memory of 1612 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 116 PID 4372 wrote to memory of 1612 4372 1084c1ae3bc47570f5328522d6ff7c30N.exe 116 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1084c1ae3bc47570f5328522d6ff7c30N.exe"C:\Users\Admin\AppData\Local\Temp\1084c1ae3bc47570f5328522d6ff7c30N.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\System\AqAhIlU.exeC:\Windows\System\AqAhIlU.exe2⤵
- Executes dropped EXE
PID:4832
-
-
C:\Windows\System\UizPyfr.exeC:\Windows\System\UizPyfr.exe2⤵
- Executes dropped EXE
PID:3028
-
-
C:\Windows\System\XqudVqT.exeC:\Windows\System\XqudVqT.exe2⤵
- Executes dropped EXE
PID:4780
-
-
C:\Windows\System\zziklvF.exeC:\Windows\System\zziklvF.exe2⤵
- Executes dropped EXE
PID:3388
-
-
C:\Windows\System\hWXUXpV.exeC:\Windows\System\hWXUXpV.exe2⤵
- Executes dropped EXE
PID:1200
-
-
C:\Windows\System\APIkpgT.exeC:\Windows\System\APIkpgT.exe2⤵
- Executes dropped EXE
PID:4152
-
-
C:\Windows\System\tglygOL.exeC:\Windows\System\tglygOL.exe2⤵
- Executes dropped EXE
PID:1412
-
-
C:\Windows\System\XcWhuNP.exeC:\Windows\System\XcWhuNP.exe2⤵
- Executes dropped EXE
PID:1504
-
-
C:\Windows\System\DvWTZOR.exeC:\Windows\System\DvWTZOR.exe2⤵
- Executes dropped EXE
PID:4720
-
-
C:\Windows\System\PdYKCJI.exeC:\Windows\System\PdYKCJI.exe2⤵
- Executes dropped EXE
PID:4572
-
-
C:\Windows\System\XkeFHpJ.exeC:\Windows\System\XkeFHpJ.exe2⤵
- Executes dropped EXE
PID:4520
-
-
C:\Windows\System\lPiGAey.exeC:\Windows\System\lPiGAey.exe2⤵
- Executes dropped EXE
PID:4060
-
-
C:\Windows\System\lxVlbuP.exeC:\Windows\System\lxVlbuP.exe2⤵
- Executes dropped EXE
PID:2364
-
-
C:\Windows\System\rmWHQzK.exeC:\Windows\System\rmWHQzK.exe2⤵
- Executes dropped EXE
PID:2872
-
-
C:\Windows\System\JqwASVb.exeC:\Windows\System\JqwASVb.exe2⤵
- Executes dropped EXE
PID:4528
-
-
C:\Windows\System\YtoIdKa.exeC:\Windows\System\YtoIdKa.exe2⤵
- Executes dropped EXE
PID:748
-
-
C:\Windows\System\HoAgYkT.exeC:\Windows\System\HoAgYkT.exe2⤵
- Executes dropped EXE
PID:3152
-
-
C:\Windows\System\sZnbIVT.exeC:\Windows\System\sZnbIVT.exe2⤵
- Executes dropped EXE
PID:1116
-
-
C:\Windows\System\lYuHnBe.exeC:\Windows\System\lYuHnBe.exe2⤵
- Executes dropped EXE
PID:4544
-
-
C:\Windows\System\eGaDwwb.exeC:\Windows\System\eGaDwwb.exe2⤵
- Executes dropped EXE
PID:1876
-
-
C:\Windows\System\uXsQjqa.exeC:\Windows\System\uXsQjqa.exe2⤵
- Executes dropped EXE
PID:3048
-
-
C:\Windows\System\nGGmzks.exeC:\Windows\System\nGGmzks.exe2⤵
- Executes dropped EXE
PID:4488
-
-
C:\Windows\System\nbIGUet.exeC:\Windows\System\nbIGUet.exe2⤵
- Executes dropped EXE
PID:2768
-
-
C:\Windows\System\WKYOhdH.exeC:\Windows\System\WKYOhdH.exe2⤵
- Executes dropped EXE
PID:4868
-
-
C:\Windows\System\ccfSdYp.exeC:\Windows\System\ccfSdYp.exe2⤵
- Executes dropped EXE
PID:5032
-
-
C:\Windows\System\fFJwUWu.exeC:\Windows\System\fFJwUWu.exe2⤵
- Executes dropped EXE
PID:1888
-
-
C:\Windows\System\pDHAXTU.exeC:\Windows\System\pDHAXTU.exe2⤵
- Executes dropped EXE
PID:3640
-
-
C:\Windows\System\ySSiLMx.exeC:\Windows\System\ySSiLMx.exe2⤵
- Executes dropped EXE
PID:3324
-
-
C:\Windows\System\RghyLKC.exeC:\Windows\System\RghyLKC.exe2⤵
- Executes dropped EXE
PID:3864
-
-
C:\Windows\System\SZuEBzt.exeC:\Windows\System\SZuEBzt.exe2⤵
- Executes dropped EXE
PID:408
-
-
C:\Windows\System\kAlfWRU.exeC:\Windows\System\kAlfWRU.exe2⤵
- Executes dropped EXE
PID:4280
-
-
C:\Windows\System\HkOiSxW.exeC:\Windows\System\HkOiSxW.exe2⤵
- Executes dropped EXE
PID:1612
-
-
C:\Windows\System\DbdiYyF.exeC:\Windows\System\DbdiYyF.exe2⤵
- Executes dropped EXE
PID:1704
-
-
C:\Windows\System\tFyvFcW.exeC:\Windows\System\tFyvFcW.exe2⤵
- Executes dropped EXE
PID:780
-
-
C:\Windows\System\vSwocCd.exeC:\Windows\System\vSwocCd.exe2⤵
- Executes dropped EXE
PID:4828
-
-
C:\Windows\System\RSGNflV.exeC:\Windows\System\RSGNflV.exe2⤵
- Executes dropped EXE
PID:952
-
-
C:\Windows\System\MHmzJDX.exeC:\Windows\System\MHmzJDX.exe2⤵
- Executes dropped EXE
PID:3952
-
-
C:\Windows\System\ydkyIqX.exeC:\Windows\System\ydkyIqX.exe2⤵
- Executes dropped EXE
PID:4492
-
-
C:\Windows\System\gPlnQZC.exeC:\Windows\System\gPlnQZC.exe2⤵
- Executes dropped EXE
PID:1580
-
-
C:\Windows\System\JXfMSaR.exeC:\Windows\System\JXfMSaR.exe2⤵
- Executes dropped EXE
PID:2228
-
-
C:\Windows\System\iGvuKbO.exeC:\Windows\System\iGvuKbO.exe2⤵
- Executes dropped EXE
PID:4100
-
-
C:\Windows\System\prjOCVA.exeC:\Windows\System\prjOCVA.exe2⤵
- Executes dropped EXE
PID:1144
-
-
C:\Windows\System\lhZzfdm.exeC:\Windows\System\lhZzfdm.exe2⤵
- Executes dropped EXE
PID:4384
-
-
C:\Windows\System\ZVJWQwh.exeC:\Windows\System\ZVJWQwh.exe2⤵
- Executes dropped EXE
PID:4960
-
-
C:\Windows\System\eqGcPvB.exeC:\Windows\System\eqGcPvB.exe2⤵
- Executes dropped EXE
PID:4128
-
-
C:\Windows\System\OmVHXFE.exeC:\Windows\System\OmVHXFE.exe2⤵
- Executes dropped EXE
PID:4240
-
-
C:\Windows\System\JFGkxep.exeC:\Windows\System\JFGkxep.exe2⤵
- Executes dropped EXE
PID:2724
-
-
C:\Windows\System\UxXDTlY.exeC:\Windows\System\UxXDTlY.exe2⤵
- Executes dropped EXE
PID:3576
-
-
C:\Windows\System\fmBNjBE.exeC:\Windows\System\fmBNjBE.exe2⤵
- Executes dropped EXE
PID:3948
-
-
C:\Windows\System\BHLZzmt.exeC:\Windows\System\BHLZzmt.exe2⤵
- Executes dropped EXE
PID:2352
-
-
C:\Windows\System\DNwZodb.exeC:\Windows\System\DNwZodb.exe2⤵
- Executes dropped EXE
PID:2428
-
-
C:\Windows\System\xjJgzaL.exeC:\Windows\System\xjJgzaL.exe2⤵
- Executes dropped EXE
PID:4568
-
-
C:\Windows\System\XwIzvPA.exeC:\Windows\System\XwIzvPA.exe2⤵
- Executes dropped EXE
PID:2216
-
-
C:\Windows\System\FNbxrLc.exeC:\Windows\System\FNbxrLc.exe2⤵
- Executes dropped EXE
PID:1672
-
-
C:\Windows\System\jzsoyaW.exeC:\Windows\System\jzsoyaW.exe2⤵
- Executes dropped EXE
PID:4368
-
-
C:\Windows\System\YFUPVBE.exeC:\Windows\System\YFUPVBE.exe2⤵
- Executes dropped EXE
PID:4340
-
-
C:\Windows\System\vqOnrfq.exeC:\Windows\System\vqOnrfq.exe2⤵
- Executes dropped EXE
PID:4228
-
-
C:\Windows\System\mqZvNwJ.exeC:\Windows\System\mqZvNwJ.exe2⤵
- Executes dropped EXE
PID:552
-
-
C:\Windows\System\MGuiBJX.exeC:\Windows\System\MGuiBJX.exe2⤵
- Executes dropped EXE
PID:3120
-
-
C:\Windows\System\bPzpvUj.exeC:\Windows\System\bPzpvUj.exe2⤵
- Executes dropped EXE
PID:5028
-
-
C:\Windows\System\WJSefWK.exeC:\Windows\System\WJSefWK.exe2⤵
- Executes dropped EXE
PID:5048
-
-
C:\Windows\System\TmUsypJ.exeC:\Windows\System\TmUsypJ.exe2⤵
- Executes dropped EXE
PID:1496
-
-
C:\Windows\System\bttHJWV.exeC:\Windows\System\bttHJWV.exe2⤵
- Executes dropped EXE
PID:5040
-
-
C:\Windows\System\gkrCZCA.exeC:\Windows\System\gkrCZCA.exe2⤵
- Executes dropped EXE
PID:3544
-
-
C:\Windows\System\YXExZUq.exeC:\Windows\System\YXExZUq.exe2⤵PID:3064
-
-
C:\Windows\System\HoaMtJu.exeC:\Windows\System\HoaMtJu.exe2⤵PID:4392
-
-
C:\Windows\System\FANMJqk.exeC:\Windows\System\FANMJqk.exe2⤵PID:3608
-
-
C:\Windows\System\PDKCaYG.exeC:\Windows\System\PDKCaYG.exe2⤵PID:3816
-
-
C:\Windows\System\AJQUQjx.exeC:\Windows\System\AJQUQjx.exe2⤵PID:4408
-
-
C:\Windows\System\RaoOtxv.exeC:\Windows\System\RaoOtxv.exe2⤵PID:4168
-
-
C:\Windows\System\iczsbgs.exeC:\Windows\System\iczsbgs.exe2⤵PID:508
-
-
C:\Windows\System\ZpKylUC.exeC:\Windows\System\ZpKylUC.exe2⤵PID:2144
-
-
C:\Windows\System\XlBLxeo.exeC:\Windows\System\XlBLxeo.exe2⤵PID:4556
-
-
C:\Windows\System\JAgLlLj.exeC:\Windows\System\JAgLlLj.exe2⤵PID:3400
-
-
C:\Windows\System\DCAEIwP.exeC:\Windows\System\DCAEIwP.exe2⤵PID:4864
-
-
C:\Windows\System\ZknSPTe.exeC:\Windows\System\ZknSPTe.exe2⤵PID:4540
-
-
C:\Windows\System\kYffMrT.exeC:\Windows\System\kYffMrT.exe2⤵PID:1596
-
-
C:\Windows\System\ehcIgED.exeC:\Windows\System\ehcIgED.exe2⤵PID:432
-
-
C:\Windows\System\ThPzPfJ.exeC:\Windows\System\ThPzPfJ.exe2⤵PID:4460
-
-
C:\Windows\System\OQkvjTE.exeC:\Windows\System\OQkvjTE.exe2⤵PID:368
-
-
C:\Windows\System\pMAqiGi.exeC:\Windows\System\pMAqiGi.exe2⤵PID:312
-
-
C:\Windows\System\NZQwBUd.exeC:\Windows\System\NZQwBUd.exe2⤵PID:956
-
-
C:\Windows\System\vFsFATq.exeC:\Windows\System\vFsFATq.exe2⤵PID:5132
-
-
C:\Windows\System\yUhtZAa.exeC:\Windows\System\yUhtZAa.exe2⤵PID:5156
-
-
C:\Windows\System\ecxzlMj.exeC:\Windows\System\ecxzlMj.exe2⤵PID:5248
-
-
C:\Windows\System\uVKztMO.exeC:\Windows\System\uVKztMO.exe2⤵PID:5268
-
-
C:\Windows\System\tEcvCRN.exeC:\Windows\System\tEcvCRN.exe2⤵PID:5292
-
-
C:\Windows\System\KVYDydN.exeC:\Windows\System\KVYDydN.exe2⤵PID:5312
-
-
C:\Windows\System\SXPpQru.exeC:\Windows\System\SXPpQru.exe2⤵PID:5332
-
-
C:\Windows\System\JAkWDKQ.exeC:\Windows\System\JAkWDKQ.exe2⤵PID:5360
-
-
C:\Windows\System\MwbxgbA.exeC:\Windows\System\MwbxgbA.exe2⤵PID:5380
-
-
C:\Windows\System\dYVlQTz.exeC:\Windows\System\dYVlQTz.exe2⤵PID:5400
-
-
C:\Windows\System\OVVULYR.exeC:\Windows\System\OVVULYR.exe2⤵PID:5432
-
-
C:\Windows\System\MdWMYwQ.exeC:\Windows\System\MdWMYwQ.exe2⤵PID:6000
-
-
C:\Windows\System\rQJcRdy.exeC:\Windows\System\rQJcRdy.exe2⤵PID:6016
-
-
C:\Windows\System\dMDURGl.exeC:\Windows\System\dMDURGl.exe2⤵PID:6036
-
-
C:\Windows\System\gaMRCDj.exeC:\Windows\System\gaMRCDj.exe2⤵PID:6064
-
-
C:\Windows\System\GhibXVj.exeC:\Windows\System\GhibXVj.exe2⤵PID:6088
-
-
C:\Windows\System\YCnPLpL.exeC:\Windows\System\YCnPLpL.exe2⤵PID:6108
-
-
C:\Windows\System\WoaICQj.exeC:\Windows\System\WoaICQj.exe2⤵PID:6124
-
-
C:\Windows\System\XDlPPnP.exeC:\Windows\System\XDlPPnP.exe2⤵PID:6140
-
-
C:\Windows\System\IiXgnus.exeC:\Windows\System\IiXgnus.exe2⤵PID:2568
-
-
C:\Windows\System\jrYyDUK.exeC:\Windows\System\jrYyDUK.exe2⤵PID:2620
-
-
C:\Windows\System\FebUPta.exeC:\Windows\System\FebUPta.exe2⤵PID:2952
-
-
C:\Windows\System\YYMumDL.exeC:\Windows\System\YYMumDL.exe2⤵PID:4916
-
-
C:\Windows\System\AjPQudL.exeC:\Windows\System\AjPQudL.exe2⤵PID:4380
-
-
C:\Windows\System\EzxzaOg.exeC:\Windows\System\EzxzaOg.exe2⤵PID:4904
-
-
C:\Windows\System\RCkmCqL.exeC:\Windows\System\RCkmCqL.exe2⤵PID:4312
-
-
C:\Windows\System\zjMZTDi.exeC:\Windows\System\zjMZTDi.exe2⤵PID:2420
-
-
C:\Windows\System\ZJUruTv.exeC:\Windows\System\ZJUruTv.exe2⤵PID:2404
-
-
C:\Windows\System\XSZOAPa.exeC:\Windows\System\XSZOAPa.exe2⤵PID:4716
-
-
C:\Windows\System\ZpSbOrW.exeC:\Windows\System\ZpSbOrW.exe2⤵PID:4112
-
-
C:\Windows\System\hAJOcNz.exeC:\Windows\System\hAJOcNz.exe2⤵PID:2288
-
-
C:\Windows\System\EeQxHQk.exeC:\Windows\System\EeQxHQk.exe2⤵PID:4740
-
-
C:\Windows\System\bJvWcHU.exeC:\Windows\System\bJvWcHU.exe2⤵PID:2712
-
-
C:\Windows\System\daHQqlk.exeC:\Windows\System\daHQqlk.exe2⤵PID:3000
-
-
C:\Windows\System\rWjHeOA.exeC:\Windows\System\rWjHeOA.exe2⤵PID:4500
-
-
C:\Windows\System\xFbkHNa.exeC:\Windows\System\xFbkHNa.exe2⤵PID:2744
-
-
C:\Windows\System\FMJdAlU.exeC:\Windows\System\FMJdAlU.exe2⤵PID:3996
-
-
C:\Windows\System\CixrtFC.exeC:\Windows\System\CixrtFC.exe2⤵PID:1448
-
-
C:\Windows\System\sRkumrC.exeC:\Windows\System\sRkumrC.exe2⤵PID:4984
-
-
C:\Windows\System\AFCHBef.exeC:\Windows\System\AFCHBef.exe2⤵PID:5152
-
-
C:\Windows\System\GDZgXfj.exeC:\Windows\System\GDZgXfj.exe2⤵PID:5228
-
-
C:\Windows\System\JFvzQhD.exeC:\Windows\System\JFvzQhD.exe2⤵PID:5284
-
-
C:\Windows\System\NJiACXO.exeC:\Windows\System\NJiACXO.exe2⤵PID:5324
-
-
C:\Windows\System\wWOMoji.exeC:\Windows\System\wWOMoji.exe2⤵PID:5368
-
-
C:\Windows\System\rulymxk.exeC:\Windows\System\rulymxk.exe2⤵PID:5440
-
-
C:\Windows\System\KtCZGcr.exeC:\Windows\System\KtCZGcr.exe2⤵PID:5532
-
-
C:\Windows\System\JvnmlsQ.exeC:\Windows\System\JvnmlsQ.exe2⤵PID:5588
-
-
C:\Windows\System\KbeuyWV.exeC:\Windows\System\KbeuyWV.exe2⤵PID:5696
-
-
C:\Windows\System\TmBVToT.exeC:\Windows\System\TmBVToT.exe2⤵PID:5720
-
-
C:\Windows\System\JPqvTtr.exeC:\Windows\System\JPqvTtr.exe2⤵PID:5776
-
-
C:\Windows\System\OOpFicw.exeC:\Windows\System\OOpFicw.exe2⤵PID:5812
-
-
C:\Windows\System\QBDSZIs.exeC:\Windows\System\QBDSZIs.exe2⤵PID:1004
-
-
C:\Windows\System\nAEXSsr.exeC:\Windows\System\nAEXSsr.exe2⤵PID:2732
-
-
C:\Windows\System\vmypJLo.exeC:\Windows\System\vmypJLo.exe2⤵PID:3192
-
-
C:\Windows\System\ADTaRnA.exeC:\Windows\System\ADTaRnA.exe2⤵PID:2840
-
-
C:\Windows\System\EomSesJ.exeC:\Windows\System\EomSesJ.exe2⤵PID:2388
-
-
C:\Windows\System\acylsmA.exeC:\Windows\System\acylsmA.exe2⤵PID:3012
-
-
C:\Windows\System\kdvCJVG.exeC:\Windows\System\kdvCJVG.exe2⤵PID:3292
-
-
C:\Windows\System\jEKvHTi.exeC:\Windows\System\jEKvHTi.exe2⤵PID:1396
-
-
C:\Windows\System\YQJFPbM.exeC:\Windows\System\YQJFPbM.exe2⤵PID:3160
-
-
C:\Windows\System\yEQvjqa.exeC:\Windows\System\yEQvjqa.exe2⤵PID:760
-
-
C:\Windows\System\HYVjjbq.exeC:\Windows\System\HYVjjbq.exe2⤵PID:3632
-
-
C:\Windows\System\vEEJwkm.exeC:\Windows\System\vEEJwkm.exe2⤵PID:3416
-
-
C:\Windows\System\quNwxKN.exeC:\Windows\System\quNwxKN.exe2⤵PID:3828
-
-
C:\Windows\System\lUnNnMB.exeC:\Windows\System\lUnNnMB.exe2⤵PID:3376
-
-
C:\Windows\System\WNDylKf.exeC:\Windows\System\WNDylKf.exe2⤵PID:5352
-
-
C:\Windows\System\iGKghBT.exeC:\Windows\System\iGKghBT.exe2⤵PID:5656
-
-
C:\Windows\System\uHKUDpQ.exeC:\Windows\System\uHKUDpQ.exe2⤵PID:5936
-
-
C:\Windows\System\iUKhUkx.exeC:\Windows\System\iUKhUkx.exe2⤵PID:3976
-
-
C:\Windows\System\OdWHlAY.exeC:\Windows\System\OdWHlAY.exe2⤵PID:5996
-
-
C:\Windows\System\lFvbDDA.exeC:\Windows\System\lFvbDDA.exe2⤵PID:6060
-
-
C:\Windows\System\GnYurlp.exeC:\Windows\System\GnYurlp.exe2⤵PID:6072
-
-
C:\Windows\System\CCkLzDL.exeC:\Windows\System\CCkLzDL.exe2⤵PID:6080
-
-
C:\Windows\System\KZuIltl.exeC:\Windows\System\KZuIltl.exe2⤵PID:1960
-
-
C:\Windows\System\frpVAsl.exeC:\Windows\System\frpVAsl.exe2⤵PID:4084
-
-
C:\Windows\System\gxEsJyj.exeC:\Windows\System\gxEsJyj.exe2⤵PID:3912
-
-
C:\Windows\System\nzgRMSe.exeC:\Windows\System\nzgRMSe.exe2⤵PID:3656
-
-
C:\Windows\System\PNosWSD.exeC:\Windows\System\PNosWSD.exe2⤵PID:1444
-
-
C:\Windows\System\CDWYgaO.exeC:\Windows\System\CDWYgaO.exe2⤵PID:5024
-
-
C:\Windows\System\rfzdmuP.exeC:\Windows\System\rfzdmuP.exe2⤵PID:424
-
-
C:\Windows\System\vTzjwHg.exeC:\Windows\System\vTzjwHg.exe2⤵PID:5036
-
-
C:\Windows\System\gNBoQYU.exeC:\Windows\System\gNBoQYU.exe2⤵PID:2976
-
-
C:\Windows\System\GYEWGhZ.exeC:\Windows\System\GYEWGhZ.exe2⤵PID:4592
-
-
C:\Windows\System\MuKlVEt.exeC:\Windows\System\MuKlVEt.exe2⤵PID:5260
-
-
C:\Windows\System\DyKElBT.exeC:\Windows\System\DyKElBT.exe2⤵PID:5128
-
-
C:\Windows\System\pmXySvW.exeC:\Windows\System\pmXySvW.exe2⤵PID:5104
-
-
C:\Windows\System\MhmJWUm.exeC:\Windows\System\MhmJWUm.exe2⤵PID:3312
-
-
C:\Windows\System\qLGQMcA.exeC:\Windows\System\qLGQMcA.exe2⤵PID:2604
-
-
C:\Windows\System\wWeRqpM.exeC:\Windows\System\wWeRqpM.exe2⤵PID:1968
-
-
C:\Windows\System\uexCXQZ.exeC:\Windows\System\uexCXQZ.exe2⤵PID:4424
-
-
C:\Windows\System\gCjIRav.exeC:\Windows\System\gCjIRav.exe2⤵PID:1084
-
-
C:\Windows\System\Vfzcpqf.exeC:\Windows\System\Vfzcpqf.exe2⤵PID:1604
-
-
C:\Windows\System\vHSreYZ.exeC:\Windows\System\vHSreYZ.exe2⤵PID:1588
-
-
C:\Windows\System\iuFkXdL.exeC:\Windows\System\iuFkXdL.exe2⤵PID:3256
-
-
C:\Windows\System\NhQjcaj.exeC:\Windows\System\NhQjcaj.exe2⤵PID:2748
-
-
C:\Windows\System\HKhsliZ.exeC:\Windows\System\HKhsliZ.exe2⤵PID:5072
-
-
C:\Windows\System\vWuVZfZ.exeC:\Windows\System\vWuVZfZ.exe2⤵PID:5308
-
-
C:\Windows\System\ahVUQGY.exeC:\Windows\System\ahVUQGY.exe2⤵PID:6044
-
-
C:\Windows\System\SQTByUr.exeC:\Windows\System\SQTByUr.exe2⤵PID:5736
-
-
C:\Windows\System\mFmnfFM.exeC:\Windows\System\mFmnfFM.exe2⤵PID:6120
-
-
C:\Windows\System\YkEDSZo.exeC:\Windows\System\YkEDSZo.exe2⤵PID:5804
-
-
C:\Windows\System\LtrCawH.exeC:\Windows\System\LtrCawH.exe2⤵PID:1184
-
-
C:\Windows\System\GvkhcwO.exeC:\Windows\System\GvkhcwO.exe2⤵PID:6160
-
-
C:\Windows\System\FZMkOmL.exeC:\Windows\System\FZMkOmL.exe2⤵PID:6180
-
-
C:\Windows\System\QmMTuEi.exeC:\Windows\System\QmMTuEi.exe2⤵PID:6204
-
-
C:\Windows\System\AOKGFqU.exeC:\Windows\System\AOKGFqU.exe2⤵PID:6228
-
-
C:\Windows\System\HdWnenY.exeC:\Windows\System\HdWnenY.exe2⤵PID:6244
-
-
C:\Windows\System\nCZAulk.exeC:\Windows\System\nCZAulk.exe2⤵PID:6268
-
-
C:\Windows\System\cCiuGJj.exeC:\Windows\System\cCiuGJj.exe2⤵PID:6284
-
-
C:\Windows\System\QzhSIOw.exeC:\Windows\System\QzhSIOw.exe2⤵PID:6308
-
-
C:\Windows\System\UuozdBg.exeC:\Windows\System\UuozdBg.exe2⤵PID:6332
-
-
C:\Windows\System\AkLYYie.exeC:\Windows\System\AkLYYie.exe2⤵PID:6356
-
-
C:\Windows\System\lNtBDmV.exeC:\Windows\System\lNtBDmV.exe2⤵PID:6372
-
-
C:\Windows\System\UpgxDLh.exeC:\Windows\System\UpgxDLh.exe2⤵PID:6396
-
-
C:\Windows\System\NTmpKhC.exeC:\Windows\System\NTmpKhC.exe2⤵PID:6420
-
-
C:\Windows\System\liwFVkK.exeC:\Windows\System\liwFVkK.exe2⤵PID:6440
-
-
C:\Windows\System\LyryQKC.exeC:\Windows\System\LyryQKC.exe2⤵PID:6460
-
-
C:\Windows\System\ZtTaXMZ.exeC:\Windows\System\ZtTaXMZ.exe2⤵PID:6484
-
-
C:\Windows\System\yUjiBZc.exeC:\Windows\System\yUjiBZc.exe2⤵PID:6512
-
-
C:\Windows\System\ihcDkMC.exeC:\Windows\System\ihcDkMC.exe2⤵PID:6528
-
-
C:\Windows\System\dcVoxPr.exeC:\Windows\System\dcVoxPr.exe2⤵PID:6548
-
-
C:\Windows\System\vUCmyoP.exeC:\Windows\System\vUCmyoP.exe2⤵PID:6568
-
-
C:\Windows\System\BJBlUSI.exeC:\Windows\System\BJBlUSI.exe2⤵PID:6592
-
-
C:\Windows\System\nONGxfH.exeC:\Windows\System\nONGxfH.exe2⤵PID:6616
-
-
C:\Windows\System\viNmAuF.exeC:\Windows\System\viNmAuF.exe2⤵PID:6640
-
-
C:\Windows\System\rWfupPy.exeC:\Windows\System\rWfupPy.exe2⤵PID:6660
-
-
C:\Windows\System\QHNkuni.exeC:\Windows\System\QHNkuni.exe2⤵PID:6684
-
-
C:\Windows\System\eBTNGbA.exeC:\Windows\System\eBTNGbA.exe2⤵PID:6704
-
-
C:\Windows\System\zQrTXxP.exeC:\Windows\System\zQrTXxP.exe2⤵PID:6728
-
-
C:\Windows\System\FpAoyBY.exeC:\Windows\System\FpAoyBY.exe2⤵PID:6752
-
-
C:\Windows\System\xQALedp.exeC:\Windows\System\xQALedp.exe2⤵PID:6772
-
-
C:\Windows\System\ZEoBRIv.exeC:\Windows\System\ZEoBRIv.exe2⤵PID:6800
-
-
C:\Windows\System\fzDzNsz.exeC:\Windows\System\fzDzNsz.exe2⤵PID:6816
-
-
C:\Windows\System\RGwktzD.exeC:\Windows\System\RGwktzD.exe2⤵PID:6844
-
-
C:\Windows\System\qbdaiwf.exeC:\Windows\System\qbdaiwf.exe2⤵PID:6864
-
-
C:\Windows\System\TngZBzA.exeC:\Windows\System\TngZBzA.exe2⤵PID:6892
-
-
C:\Windows\System\kRtUUWJ.exeC:\Windows\System\kRtUUWJ.exe2⤵PID:6912
-
-
C:\Windows\System\cayfCHY.exeC:\Windows\System\cayfCHY.exe2⤵PID:6936
-
-
C:\Windows\System\HfdTnwt.exeC:\Windows\System\HfdTnwt.exe2⤵PID:6952
-
-
C:\Windows\System\CsJcXpI.exeC:\Windows\System\CsJcXpI.exe2⤵PID:6980
-
-
C:\Windows\System\KZRrSBd.exeC:\Windows\System\KZRrSBd.exe2⤵PID:7000
-
-
C:\Windows\System\JgxKJlY.exeC:\Windows\System\JgxKJlY.exe2⤵PID:7020
-
-
C:\Windows\System\ekGTqtl.exeC:\Windows\System\ekGTqtl.exe2⤵PID:7044
-
-
C:\Windows\System\nSoxgZl.exeC:\Windows\System\nSoxgZl.exe2⤵PID:7072
-
-
C:\Windows\System\fJACfwj.exeC:\Windows\System\fJACfwj.exe2⤵PID:7096
-
-
C:\Windows\System\MduQaxy.exeC:\Windows\System\MduQaxy.exe2⤵PID:7116
-
-
C:\Windows\System\Uasubjm.exeC:\Windows\System\Uasubjm.exe2⤵PID:7140
-
-
C:\Windows\System\utOyPyT.exeC:\Windows\System\utOyPyT.exe2⤵PID:7164
-
-
C:\Windows\System\pkrnAbN.exeC:\Windows\System\pkrnAbN.exe2⤵PID:3524
-
-
C:\Windows\System\gwkPnYI.exeC:\Windows\System\gwkPnYI.exe2⤵PID:2076
-
-
C:\Windows\System\GqkdRnA.exeC:\Windows\System\GqkdRnA.exe2⤵PID:6152
-
-
C:\Windows\System\INLWDOw.exeC:\Windows\System\INLWDOw.exe2⤵PID:1584
-
-
C:\Windows\System\izwOEAW.exeC:\Windows\System\izwOEAW.exe2⤵PID:6236
-
-
C:\Windows\System\VdRqdfo.exeC:\Windows\System\VdRqdfo.exe2⤵PID:5524
-
-
C:\Windows\System\ApjlcBC.exeC:\Windows\System\ApjlcBC.exe2⤵PID:4536
-
-
C:\Windows\System\Dtvlbqz.exeC:\Windows\System\Dtvlbqz.exe2⤵PID:6628
-
-
C:\Windows\System\FLldsXf.exeC:\Windows\System\FLldsXf.exe2⤵PID:3440
-
-
C:\Windows\System\fYtIVly.exeC:\Windows\System\fYtIVly.exe2⤵PID:6676
-
-
C:\Windows\System\mexwvgk.exeC:\Windows\System\mexwvgk.exe2⤵PID:6200
-
-
C:\Windows\System\tbkEZql.exeC:\Windows\System\tbkEZql.exe2⤵PID:6276
-
-
C:\Windows\System\aEyKwbo.exeC:\Windows\System\aEyKwbo.exe2⤵PID:7184
-
-
C:\Windows\System\GvcbWLm.exeC:\Windows\System\GvcbWLm.exe2⤵PID:7204
-
-
C:\Windows\System\pTLxlmV.exeC:\Windows\System\pTLxlmV.exe2⤵PID:7224
-
-
C:\Windows\System\NEAGGGo.exeC:\Windows\System\NEAGGGo.exe2⤵PID:7252
-
-
C:\Windows\System\ICmZvuL.exeC:\Windows\System\ICmZvuL.exe2⤵PID:7272
-
-
C:\Windows\System\AstulJv.exeC:\Windows\System\AstulJv.exe2⤵PID:7292
-
-
C:\Windows\System\akYzjJT.exeC:\Windows\System\akYzjJT.exe2⤵PID:7316
-
-
C:\Windows\System\aCzcgKB.exeC:\Windows\System\aCzcgKB.exe2⤵PID:7332
-
-
C:\Windows\System\amflkcb.exeC:\Windows\System\amflkcb.exe2⤵PID:7356
-
-
C:\Windows\System\SCXCFBp.exeC:\Windows\System\SCXCFBp.exe2⤵PID:7372
-
-
C:\Windows\System\lvXJQaR.exeC:\Windows\System\lvXJQaR.exe2⤵PID:7404
-
-
C:\Windows\System\TEwYfdm.exeC:\Windows\System\TEwYfdm.exe2⤵PID:7424
-
-
C:\Windows\System\XSDRGCX.exeC:\Windows\System\XSDRGCX.exe2⤵PID:7444
-
-
C:\Windows\System\dupRfSk.exeC:\Windows\System\dupRfSk.exe2⤵PID:7464
-
-
C:\Windows\System\JEEgUbz.exeC:\Windows\System\JEEgUbz.exe2⤵PID:7488
-
-
C:\Windows\System\qNVbUVx.exeC:\Windows\System\qNVbUVx.exe2⤵PID:7508
-
-
C:\Windows\System\CaSPsKy.exeC:\Windows\System\CaSPsKy.exe2⤵PID:7532
-
-
C:\Windows\System\MPkbzHM.exeC:\Windows\System\MPkbzHM.exe2⤵PID:7560
-
-
C:\Windows\System\HipygEq.exeC:\Windows\System\HipygEq.exe2⤵PID:7576
-
-
C:\Windows\System\HeEAhZg.exeC:\Windows\System\HeEAhZg.exe2⤵PID:7600
-
-
C:\Windows\System\swlcLkS.exeC:\Windows\System\swlcLkS.exe2⤵PID:7624
-
-
C:\Windows\System\CVsJHRt.exeC:\Windows\System\CVsJHRt.exe2⤵PID:7644
-
-
C:\Windows\System\qrmGYwW.exeC:\Windows\System\qrmGYwW.exe2⤵PID:7664
-
-
C:\Windows\System\cDPuUoR.exeC:\Windows\System\cDPuUoR.exe2⤵PID:7684
-
-
C:\Windows\System\bJRdoXZ.exeC:\Windows\System\bJRdoXZ.exe2⤵PID:7708
-
-
C:\Windows\System\hvLODAE.exeC:\Windows\System\hvLODAE.exe2⤵PID:7728
-
-
C:\Windows\System\oLlVysp.exeC:\Windows\System\oLlVysp.exe2⤵PID:7752
-
-
C:\Windows\System\IbDTDoJ.exeC:\Windows\System\IbDTDoJ.exe2⤵PID:7772
-
-
C:\Windows\System\pLcezfM.exeC:\Windows\System\pLcezfM.exe2⤵PID:7792
-
-
C:\Windows\System\kslLUJU.exeC:\Windows\System\kslLUJU.exe2⤵PID:7812
-
-
C:\Windows\System\yxSjLQX.exeC:\Windows\System\yxSjLQX.exe2⤵PID:7832
-
-
C:\Windows\System\WkaBIzB.exeC:\Windows\System\WkaBIzB.exe2⤵PID:7852
-
-
C:\Windows\System\YcHLZsT.exeC:\Windows\System\YcHLZsT.exe2⤵PID:7876
-
-
C:\Windows\System\NhnGmVe.exeC:\Windows\System\NhnGmVe.exe2⤵PID:7896
-
-
C:\Windows\System\oUHYJYn.exeC:\Windows\System\oUHYJYn.exe2⤵PID:7924
-
-
C:\Windows\System\IYVCXzW.exeC:\Windows\System\IYVCXzW.exe2⤵PID:7948
-
-
C:\Windows\System\HRqUiOh.exeC:\Windows\System\HRqUiOh.exe2⤵PID:7968
-
-
C:\Windows\System\sgSkLQI.exeC:\Windows\System\sgSkLQI.exe2⤵PID:7992
-
-
C:\Windows\System\BLBNsju.exeC:\Windows\System\BLBNsju.exe2⤵PID:8016
-
-
C:\Windows\System\gptSMMi.exeC:\Windows\System\gptSMMi.exe2⤵PID:8036
-
-
C:\Windows\System\NpnPWgK.exeC:\Windows\System\NpnPWgK.exe2⤵PID:8060
-
-
C:\Windows\System\kddWGaf.exeC:\Windows\System\kddWGaf.exe2⤵PID:8084
-
-
C:\Windows\System\bHDMoXn.exeC:\Windows\System\bHDMoXn.exe2⤵PID:8112
-
-
C:\Windows\System\ByxoExg.exeC:\Windows\System\ByxoExg.exe2⤵PID:8132
-
-
C:\Windows\System\qmMwnEW.exeC:\Windows\System\qmMwnEW.exe2⤵PID:8152
-
-
C:\Windows\System\mgMGufz.exeC:\Windows\System\mgMGufz.exe2⤵PID:8172
-
-
C:\Windows\System\kAZWXqS.exeC:\Windows\System\kAZWXqS.exe2⤵PID:6368
-
-
C:\Windows\System\vZuIfoG.exeC:\Windows\System\vZuIfoG.exe2⤵PID:1892
-
-
C:\Windows\System\SIZvvER.exeC:\Windows\System\SIZvvER.exe2⤵PID:6452
-
-
C:\Windows\System\NIOQoTV.exeC:\Windows\System\NIOQoTV.exe2⤵PID:6472
-
-
C:\Windows\System\dqtpSEG.exeC:\Windows\System\dqtpSEG.exe2⤵PID:6136
-
-
C:\Windows\System\hrCnkqy.exeC:\Windows\System\hrCnkqy.exe2⤵PID:4124
-
-
C:\Windows\System\dpaytJz.exeC:\Windows\System\dpaytJz.exe2⤵PID:1060
-
-
C:\Windows\System\PeeRSIl.exeC:\Windows\System\PeeRSIl.exe2⤵PID:6716
-
-
C:\Windows\System\RVIBoLs.exeC:\Windows\System\RVIBoLs.exe2⤵PID:6252
-
-
C:\Windows\System\KoEHkDv.exeC:\Windows\System\KoEHkDv.exe2⤵PID:6784
-
-
C:\Windows\System\tISEoSf.exeC:\Windows\System\tISEoSf.exe2⤵PID:6856
-
-
C:\Windows\System\pTDmmQg.exeC:\Windows\System\pTDmmQg.exe2⤵PID:6388
-
-
C:\Windows\System\IqsYFiE.exeC:\Windows\System\IqsYFiE.exe2⤵PID:6428
-
-
C:\Windows\System\WyfnpMA.exeC:\Windows\System\WyfnpMA.exe2⤵PID:6996
-
-
C:\Windows\System\shUOWqX.exeC:\Windows\System\shUOWqX.exe2⤵PID:7304
-
-
C:\Windows\System\HjSWBFM.exeC:\Windows\System\HjSWBFM.exe2⤵PID:7368
-
-
C:\Windows\System\pVlxWvt.exeC:\Windows\System\pVlxWvt.exe2⤵PID:7160
-
-
C:\Windows\System\XtXLOWk.exeC:\Windows\System\XtXLOWk.exe2⤵PID:7440
-
-
C:\Windows\System\lgKeYeG.exeC:\Windows\System\lgKeYeG.exe2⤵PID:7544
-
-
C:\Windows\System\yIrLQxE.exeC:\Windows\System\yIrLQxE.exe2⤵PID:7596
-
-
C:\Windows\System\AAfPVHC.exeC:\Windows\System\AAfPVHC.exe2⤵PID:6624
-
-
C:\Windows\System\qZcmSAH.exeC:\Windows\System\qZcmSAH.exe2⤵PID:1556
-
-
C:\Windows\System\fgLGgoz.exeC:\Windows\System\fgLGgoz.exe2⤵PID:6760
-
-
C:\Windows\System\tlolSCe.exeC:\Windows\System\tlolSCe.exe2⤵PID:7764
-
-
C:\Windows\System\PEKKtQh.exeC:\Windows\System\PEKKtQh.exe2⤵PID:6836
-
-
C:\Windows\System\WECSRpm.exeC:\Windows\System\WECSRpm.exe2⤵PID:7872
-
-
C:\Windows\System\XuwVnwO.exeC:\Windows\System\XuwVnwO.exe2⤵PID:6920
-
-
C:\Windows\System\ARDhRpP.exeC:\Windows\System\ARDhRpP.exe2⤵PID:7240
-
-
C:\Windows\System\PmddLFQ.exeC:\Windows\System\PmddLFQ.exe2⤵PID:8220
-
-
C:\Windows\System\KxRokqC.exeC:\Windows\System\KxRokqC.exe2⤵PID:8240
-
-
C:\Windows\System\swlBiwI.exeC:\Windows\System\swlBiwI.exe2⤵PID:8256
-
-
C:\Windows\System\mauehuC.exeC:\Windows\System\mauehuC.exe2⤵PID:8280
-
-
C:\Windows\System\TCCZTro.exeC:\Windows\System\TCCZTro.exe2⤵PID:8308
-
-
C:\Windows\System\EnjsyXo.exeC:\Windows\System\EnjsyXo.exe2⤵PID:8328
-
-
C:\Windows\System\Tnsvbql.exeC:\Windows\System\Tnsvbql.exe2⤵PID:8348
-
-
C:\Windows\System\yIXxaUv.exeC:\Windows\System\yIXxaUv.exe2⤵PID:8376
-
-
C:\Windows\System\YiMmLzB.exeC:\Windows\System\YiMmLzB.exe2⤵PID:8400
-
-
C:\Windows\System\LyXEgvA.exeC:\Windows\System\LyXEgvA.exe2⤵PID:8420
-
-
C:\Windows\System\agGDgLa.exeC:\Windows\System\agGDgLa.exe2⤵PID:8444
-
-
C:\Windows\System\fbGvQdj.exeC:\Windows\System\fbGvQdj.exe2⤵PID:8472
-
-
C:\Windows\System\cmLGzED.exeC:\Windows\System\cmLGzED.exe2⤵PID:8500
-
-
C:\Windows\System\Nuebmaf.exeC:\Windows\System\Nuebmaf.exe2⤵PID:8524
-
-
C:\Windows\System\STSRwvR.exeC:\Windows\System\STSRwvR.exe2⤵PID:8544
-
-
C:\Windows\System\MhXucJi.exeC:\Windows\System\MhXucJi.exe2⤵PID:8568
-
-
C:\Windows\System\teevydI.exeC:\Windows\System\teevydI.exe2⤵PID:8588
-
-
C:\Windows\System\icUExGR.exeC:\Windows\System\icUExGR.exe2⤵PID:8612
-
-
C:\Windows\System\FMNCzlI.exeC:\Windows\System\FMNCzlI.exe2⤵PID:8628
-
-
C:\Windows\System\EUMCgSa.exeC:\Windows\System\EUMCgSa.exe2⤵PID:8656
-
-
C:\Windows\System\euBygRp.exeC:\Windows\System\euBygRp.exe2⤵PID:8672
-
-
C:\Windows\System\WZFDQCl.exeC:\Windows\System\WZFDQCl.exe2⤵PID:8692
-
-
C:\Windows\System\BKXuISS.exeC:\Windows\System\BKXuISS.exe2⤵PID:8712
-
-
C:\Windows\System\mLhMxec.exeC:\Windows\System\mLhMxec.exe2⤵PID:8736
-
-
C:\Windows\System\uCWLCyK.exeC:\Windows\System\uCWLCyK.exe2⤵PID:8764
-
-
C:\Windows\System\arYgIHL.exeC:\Windows\System\arYgIHL.exe2⤵PID:8784
-
-
C:\Windows\System\YnVCzsP.exeC:\Windows\System\YnVCzsP.exe2⤵PID:8808
-
-
C:\Windows\System\zUxSzhg.exeC:\Windows\System\zUxSzhg.exe2⤵PID:8828
-
-
C:\Windows\System\xDkcNue.exeC:\Windows\System\xDkcNue.exe2⤵PID:8844
-
-
C:\Windows\System\YjDUJcW.exeC:\Windows\System\YjDUJcW.exe2⤵PID:8864
-
-
C:\Windows\System\KOVvqtx.exeC:\Windows\System\KOVvqtx.exe2⤵PID:8888
-
-
C:\Windows\System\qYCpJGc.exeC:\Windows\System\qYCpJGc.exe2⤵PID:8912
-
-
C:\Windows\System\btpLGFg.exeC:\Windows\System\btpLGFg.exe2⤵PID:8932
-
-
C:\Windows\System\iHbpRXO.exeC:\Windows\System\iHbpRXO.exe2⤵PID:8952
-
-
C:\Windows\System\HWKGxwi.exeC:\Windows\System\HWKGxwi.exe2⤵PID:8976
-
-
C:\Windows\System\PhnpIYd.exeC:\Windows\System\PhnpIYd.exe2⤵PID:8996
-
-
C:\Windows\System\DfPxoom.exeC:\Windows\System\DfPxoom.exe2⤵PID:9016
-
-
C:\Windows\System\eLsUPCy.exeC:\Windows\System\eLsUPCy.exe2⤵PID:9036
-
-
C:\Windows\System\JMrGJvS.exeC:\Windows\System\JMrGJvS.exe2⤵PID:9060
-
-
C:\Windows\System\oqosOKJ.exeC:\Windows\System\oqosOKJ.exe2⤵PID:9080
-
-
C:\Windows\System\PCCZSow.exeC:\Windows\System\PCCZSow.exe2⤵PID:9100
-
-
C:\Windows\System\uoclFyJ.exeC:\Windows\System\uoclFyJ.exe2⤵PID:9120
-
-
C:\Windows\System\LRANvVh.exeC:\Windows\System\LRANvVh.exe2⤵PID:9140
-
-
C:\Windows\System\yWQGOLo.exeC:\Windows\System\yWQGOLo.exe2⤵PID:9164
-
-
C:\Windows\System\RYzZXME.exeC:\Windows\System\RYzZXME.exe2⤵PID:9188
-
-
C:\Windows\System\rQeRqnI.exeC:\Windows\System\rQeRqnI.exe2⤵PID:9208
-
-
C:\Windows\System\rnEYFPP.exeC:\Windows\System\rnEYFPP.exe2⤵PID:7260
-
-
C:\Windows\System\TVQOOOU.exeC:\Windows\System\TVQOOOU.exe2⤵PID:8004
-
-
C:\Windows\System\kkJOQvE.exeC:\Windows\System\kkJOQvE.exe2⤵PID:7060
-
-
C:\Windows\System\UpRUjCC.exeC:\Windows\System\UpRUjCC.exe2⤵PID:8052
-
-
C:\Windows\System\lHtcXrf.exeC:\Windows\System\lHtcXrf.exe2⤵PID:7380
-
-
C:\Windows\System\ffHmGUF.exeC:\Windows\System\ffHmGUF.exe2⤵PID:7112
-
-
C:\Windows\System\pQDuFDT.exeC:\Windows\System\pQDuFDT.exe2⤵PID:7156
-
-
C:\Windows\System\UUCwtgd.exeC:\Windows\System\UUCwtgd.exe2⤵PID:7432
-
-
C:\Windows\System\UUbLzUa.exeC:\Windows\System\UUbLzUa.exe2⤵PID:5548
-
-
C:\Windows\System\JYgrhdX.exeC:\Windows\System\JYgrhdX.exe2⤵PID:7500
-
-
C:\Windows\System\iqhwGad.exeC:\Windows\System\iqhwGad.exe2⤵PID:7540
-
-
C:\Windows\System\AGKBAnw.exeC:\Windows\System\AGKBAnw.exe2⤵PID:6416
-
-
C:\Windows\System\iJjswHE.exeC:\Windows\System\iJjswHE.exe2⤵PID:2156
-
-
C:\Windows\System\ezrKtef.exeC:\Windows\System\ezrKtef.exe2⤵PID:6600
-
-
C:\Windows\System\vwOFGIr.exeC:\Windows\System\vwOFGIr.exe2⤵PID:7572
-
-
C:\Windows\System\ufCGabu.exeC:\Windows\System\ufCGabu.exe2⤵PID:6768
-
-
C:\Windows\System\kgYzDLp.exeC:\Windows\System\kgYzDLp.exe2⤵PID:7180
-
-
C:\Windows\System\xvGYUCh.exeC:\Windows\System\xvGYUCh.exe2⤵PID:7232
-
-
C:\Windows\System\NWzeACe.exeC:\Windows\System\NWzeACe.exe2⤵PID:8296
-
-
C:\Windows\System\VONJBkJ.exeC:\Windows\System\VONJBkJ.exe2⤵PID:8368
-
-
C:\Windows\System\iWbshbV.exeC:\Windows\System\iWbshbV.exe2⤵PID:8124
-
-
C:\Windows\System\bjjqAlQ.exeC:\Windows\System\bjjqAlQ.exe2⤵PID:9236
-
-
C:\Windows\System\bGTSiLt.exeC:\Windows\System\bGTSiLt.exe2⤵PID:9260
-
-
C:\Windows\System\dzWHtNN.exeC:\Windows\System\dzWHtNN.exe2⤵PID:9280
-
-
C:\Windows\System\QOutMdT.exeC:\Windows\System\QOutMdT.exe2⤵PID:9308
-
-
C:\Windows\System\awFfyOH.exeC:\Windows\System\awFfyOH.exe2⤵PID:9328
-
-
C:\Windows\System\NDnQwYj.exeC:\Windows\System\NDnQwYj.exe2⤵PID:9348
-
-
C:\Windows\System\NtMjbbb.exeC:\Windows\System\NtMjbbb.exe2⤵PID:9364
-
-
C:\Windows\System\egZeaEE.exeC:\Windows\System\egZeaEE.exe2⤵PID:9384
-
-
C:\Windows\System\XxFWTwc.exeC:\Windows\System\XxFWTwc.exe2⤵PID:9408
-
-
C:\Windows\System\cEQGxZG.exeC:\Windows\System\cEQGxZG.exe2⤵PID:9432
-
-
C:\Windows\System\yDCrVwP.exeC:\Windows\System\yDCrVwP.exe2⤵PID:9452
-
-
C:\Windows\System\juXeGVw.exeC:\Windows\System\juXeGVw.exe2⤵PID:9476
-
-
C:\Windows\System\ZiVWcjh.exeC:\Windows\System\ZiVWcjh.exe2⤵PID:9500
-
-
C:\Windows\System\HHXQPNG.exeC:\Windows\System\HHXQPNG.exe2⤵PID:9528
-
-
C:\Windows\System\GDDevtl.exeC:\Windows\System\GDDevtl.exe2⤵PID:9548
-
-
C:\Windows\System\XHVpygs.exeC:\Windows\System\XHVpygs.exe2⤵PID:9572
-
-
C:\Windows\System\bUjPjnu.exeC:\Windows\System\bUjPjnu.exe2⤵PID:9592
-
-
C:\Windows\System\vizudkX.exeC:\Windows\System\vizudkX.exe2⤵PID:9616
-
-
C:\Windows\System\NzBLWMz.exeC:\Windows\System\NzBLWMz.exe2⤵PID:9636
-
-
C:\Windows\System\yldKtgk.exeC:\Windows\System\yldKtgk.exe2⤵PID:9664
-
-
C:\Windows\System\iBFqwYn.exeC:\Windows\System\iBFqwYn.exe2⤵PID:9688
-
-
C:\Windows\System\UQlsdMt.exeC:\Windows\System\UQlsdMt.exe2⤵PID:9708
-
-
C:\Windows\System\tKWZMpf.exeC:\Windows\System\tKWZMpf.exe2⤵PID:9728
-
-
C:\Windows\System\artRLsX.exeC:\Windows\System\artRLsX.exe2⤵PID:9748
-
-
C:\Windows\System\xgtWcgr.exeC:\Windows\System\xgtWcgr.exe2⤵PID:10080
-
-
C:\Windows\System\vOqffbL.exeC:\Windows\System\vOqffbL.exe2⤵PID:10096
-
-
C:\Windows\System\YHtlgwu.exeC:\Windows\System\YHtlgwu.exe2⤵PID:10116
-
-
C:\Windows\System\PdFDjNX.exeC:\Windows\System\PdFDjNX.exe2⤵PID:10136
-
-
C:\Windows\System\lOyxJIo.exeC:\Windows\System\lOyxJIo.exe2⤵PID:10164
-
-
C:\Windows\System\STzMuKT.exeC:\Windows\System\STzMuKT.exe2⤵PID:10192
-
-
C:\Windows\System\YrJhNdc.exeC:\Windows\System\YrJhNdc.exe2⤵PID:10208
-
-
C:\Windows\System\eFHEyeg.exeC:\Windows\System\eFHEyeg.exe2⤵PID:10232
-
-
C:\Windows\System\Xjfmokm.exeC:\Windows\System\Xjfmokm.exe2⤵PID:8560
-
-
C:\Windows\System\MpHREvI.exeC:\Windows\System\MpHREvI.exe2⤵PID:3468
-
-
C:\Windows\System\hJDSFXE.exeC:\Windows\System\hJDSFXE.exe2⤵PID:7016
-
-
C:\Windows\System\fWFjEOZ.exeC:\Windows\System\fWFjEOZ.exe2⤵PID:6700
-
-
C:\Windows\System\NsCIvLt.exeC:\Windows\System\NsCIvLt.exe2⤵PID:8776
-
-
C:\Windows\System\wscoHzB.exeC:\Windows\System\wscoHzB.exe2⤵PID:8880
-
-
C:\Windows\System\AMgjJQp.exeC:\Windows\System\AMgjJQp.exe2⤵PID:8928
-
-
C:\Windows\System\ylIUgOV.exeC:\Windows\System\ylIUgOV.exe2⤵PID:7700
-
-
C:\Windows\System\MvTYHOe.exeC:\Windows\System\MvTYHOe.exe2⤵PID:8948
-
-
C:\Windows\System\PpZRdll.exeC:\Windows\System\PpZRdll.exe2⤵PID:9108
-
-
C:\Windows\System\ghUFeyg.exeC:\Windows\System\ghUFeyg.exe2⤵PID:6960
-
-
C:\Windows\System\wSUbMLd.exeC:\Windows\System\wSUbMLd.exe2⤵PID:8232
-
-
C:\Windows\System\jBwjbhx.exeC:\Windows\System\jBwjbhx.exe2⤵PID:6280
-
-
C:\Windows\System\TrCNYrj.exeC:\Windows\System\TrCNYrj.exe2⤵PID:8480
-
-
C:\Windows\System\fsaFMuk.exeC:\Windows\System\fsaFMuk.exe2⤵PID:8180
-
-
C:\Windows\System\vEgiMBo.exeC:\Windows\System\vEgiMBo.exe2⤵PID:6972
-
-
C:\Windows\System\eElIaSk.exeC:\Windows\System\eElIaSk.exe2⤵PID:9484
-
-
C:\Windows\System\MuEUHxF.exeC:\Windows\System\MuEUHxF.exe2⤵PID:9564
-
-
C:\Windows\System\BZaTqSR.exeC:\Windows\System\BZaTqSR.exe2⤵PID:8708
-
-
C:\Windows\System\midrCxR.exeC:\Windows\System\midrCxR.exe2⤵PID:9628
-
-
C:\Windows\System\xbwAaiC.exeC:\Windows\System\xbwAaiC.exe2⤵PID:9716
-
-
C:\Windows\System\wkzSNNC.exeC:\Windows\System\wkzSNNC.exe2⤵PID:6880
-
-
C:\Windows\System\AuYBnrJ.exeC:\Windows\System\AuYBnrJ.exe2⤵PID:9720
-
-
C:\Windows\System\gZJvYXy.exeC:\Windows\System\gZJvYXy.exe2⤵PID:6564
-
-
C:\Windows\System\COTJlyj.exeC:\Windows\System\COTJlyj.exe2⤵PID:9032
-
-
C:\Windows\System\vWNgzWm.exeC:\Windows\System\vWNgzWm.exe2⤵PID:10248
-
-
C:\Windows\System\qcnIOkd.exeC:\Windows\System\qcnIOkd.exe2⤵PID:10272
-
-
C:\Windows\System\sTWzmpu.exeC:\Windows\System\sTWzmpu.exe2⤵PID:10296
-
-
C:\Windows\System\XkfAnAh.exeC:\Windows\System\XkfAnAh.exe2⤵PID:10320
-
-
C:\Windows\System\iLqWPnb.exeC:\Windows\System\iLqWPnb.exe2⤵PID:10356
-
-
C:\Windows\System\OKPxBDO.exeC:\Windows\System\OKPxBDO.exe2⤵PID:10380
-
-
C:\Windows\System\mfzYbrD.exeC:\Windows\System\mfzYbrD.exe2⤵PID:10408
-
-
C:\Windows\System\fmJconA.exeC:\Windows\System\fmJconA.exe2⤵PID:10436
-
-
C:\Windows\System\teToQBb.exeC:\Windows\System\teToQBb.exe2⤵PID:10472
-
-
C:\Windows\System\OMRFKSQ.exeC:\Windows\System\OMRFKSQ.exe2⤵PID:10496
-
-
C:\Windows\System\sOdhmHo.exeC:\Windows\System\sOdhmHo.exe2⤵PID:10520
-
-
C:\Windows\System\IzyBIVj.exeC:\Windows\System\IzyBIVj.exe2⤵PID:10536
-
-
C:\Windows\System\qNPYjJP.exeC:\Windows\System\qNPYjJP.exe2⤵PID:10552
-
-
C:\Windows\System\UTMHJXL.exeC:\Windows\System\UTMHJXL.exe2⤵PID:10576
-
-
C:\Windows\System\gHnezdR.exeC:\Windows\System\gHnezdR.exe2⤵PID:10600
-
-
C:\Windows\System\DsMcHKz.exeC:\Windows\System\DsMcHKz.exe2⤵PID:10620
-
-
C:\Windows\System\dmymzsx.exeC:\Windows\System\dmymzsx.exe2⤵PID:10636
-
-
C:\Windows\System\nRPMSdq.exeC:\Windows\System\nRPMSdq.exe2⤵PID:10656
-
-
C:\Windows\System\JfwuGPK.exeC:\Windows\System\JfwuGPK.exe2⤵PID:10676
-
-
C:\Windows\System\kSebwOU.exeC:\Windows\System\kSebwOU.exe2⤵PID:10696
-
-
C:\Windows\System\gwNSSgC.exeC:\Windows\System\gwNSSgC.exe2⤵PID:10716
-
-
C:\Windows\System\ECtzwlF.exeC:\Windows\System\ECtzwlF.exe2⤵PID:10740
-
-
C:\Windows\System\yKwVMJN.exeC:\Windows\System\yKwVMJN.exe2⤵PID:10760
-
-
C:\Windows\System\nSHSHjU.exeC:\Windows\System\nSHSHjU.exe2⤵PID:10776
-
-
C:\Windows\System\OSjpJMK.exeC:\Windows\System\OSjpJMK.exe2⤵PID:10796
-
-
C:\Windows\System\cCGptiF.exeC:\Windows\System\cCGptiF.exe2⤵PID:10812
-
-
C:\Windows\System\yqTtfhI.exeC:\Windows\System\yqTtfhI.exe2⤵PID:10828
-
-
C:\Windows\System\vScwjzX.exeC:\Windows\System\vScwjzX.exe2⤵PID:10848
-
-
C:\Windows\System\avaEdQJ.exeC:\Windows\System\avaEdQJ.exe2⤵PID:10872
-
-
C:\Windows\System\RcLPAsh.exeC:\Windows\System\RcLPAsh.exe2⤵PID:10896
-
-
C:\Windows\System\LHBPXpG.exeC:\Windows\System\LHBPXpG.exe2⤵PID:10916
-
-
C:\Windows\System\HSycnvE.exeC:\Windows\System\HSycnvE.exe2⤵PID:10940
-
-
C:\Windows\System\fcbmvBM.exeC:\Windows\System\fcbmvBM.exe2⤵PID:10960
-
-
C:\Windows\System\EEkkwuD.exeC:\Windows\System\EEkkwuD.exe2⤵PID:10992
-
-
C:\Windows\System\bwsQeZL.exeC:\Windows\System\bwsQeZL.exe2⤵PID:11008
-
-
C:\Windows\System\iPRkoXi.exeC:\Windows\System\iPRkoXi.exe2⤵PID:11024
-
-
C:\Windows\System\lnyDXyB.exeC:\Windows\System\lnyDXyB.exe2⤵PID:11044
-
-
C:\Windows\System\UacpxVH.exeC:\Windows\System\UacpxVH.exe2⤵PID:11068
-
-
C:\Windows\System\TvXuOBS.exeC:\Windows\System\TvXuOBS.exe2⤵PID:11100
-
-
C:\Windows\System\HyrYpgB.exeC:\Windows\System\HyrYpgB.exe2⤵PID:11120
-
-
C:\Windows\System\ameMdjq.exeC:\Windows\System\ameMdjq.exe2⤵PID:11148
-
-
C:\Windows\System\MIDvJMh.exeC:\Windows\System\MIDvJMh.exe2⤵PID:11180
-
-
C:\Windows\System\ZckSpLT.exeC:\Windows\System\ZckSpLT.exe2⤵PID:11204
-
-
C:\Windows\System\jcFsXMe.exeC:\Windows\System\jcFsXMe.exe2⤵PID:11220
-
-
C:\Windows\System\seCtPBZ.exeC:\Windows\System\seCtPBZ.exe2⤵PID:11244
-
-
C:\Windows\System\MscIGzm.exeC:\Windows\System\MscIGzm.exe2⤵PID:9096
-
-
C:\Windows\System\SnXblYB.exeC:\Windows\System\SnXblYB.exe2⤵PID:9184
-
-
C:\Windows\System\uNTxvTH.exeC:\Windows\System\uNTxvTH.exe2⤵PID:7056
-
-
C:\Windows\System\fWxJXBu.exeC:\Windows\System\fWxJXBu.exe2⤵PID:7132
-
-
C:\Windows\System\QvvQMYu.exeC:\Windows\System\QvvQMYu.exe2⤵PID:8324
-
-
C:\Windows\System\JTQAECq.exeC:\Windows\System\JTQAECq.exe2⤵PID:8344
-
-
C:\Windows\System\YRqLaVX.exeC:\Windows\System\YRqLaVX.exe2⤵PID:7788
-
-
C:\Windows\System\OzNzuWt.exeC:\Windows\System\OzNzuWt.exe2⤵PID:7892
-
-
C:\Windows\System\XqxPtjL.exeC:\Windows\System\XqxPtjL.exe2⤵PID:8464
-
-
C:\Windows\System\kECgoEN.exeC:\Windows\System\kECgoEN.exe2⤵PID:8108
-
-
C:\Windows\System\RCnomMm.exeC:\Windows\System\RCnomMm.exe2⤵PID:9296
-
-
C:\Windows\System\EPIVZDs.exeC:\Windows\System\EPIVZDs.exe2⤵PID:9344
-
-
C:\Windows\System\OmbAUjz.exeC:\Windows\System\OmbAUjz.exe2⤵PID:9404
-
-
C:\Windows\System\YBvcMyO.exeC:\Windows\System\YBvcMyO.exe2⤵PID:9448
-
-
C:\Windows\System\PVugTQe.exeC:\Windows\System\PVugTQe.exe2⤵PID:10108
-
-
C:\Windows\System\eQaziAG.exeC:\Windows\System\eQaziAG.exe2⤵PID:9536
-
-
C:\Windows\System\FSHhtIH.exeC:\Windows\System\FSHhtIH.exe2⤵PID:8748
-
-
C:\Windows\System\DNWdkRI.exeC:\Windows\System\DNWdkRI.exe2⤵PID:7452
-
-
C:\Windows\System\qPgTGER.exeC:\Windows\System\qPgTGER.exe2⤵PID:6524
-
-
C:\Windows\System\xsXYMYJ.exeC:\Windows\System\xsXYMYJ.exe2⤵PID:8840
-
-
C:\Windows\System\KZQwfwW.exeC:\Windows\System\KZQwfwW.exe2⤵PID:11272
-
-
C:\Windows\System\AHglNWx.exeC:\Windows\System\AHglNWx.exe2⤵PID:11292
-
-
C:\Windows\System\bBjDOPo.exeC:\Windows\System\bBjDOPo.exe2⤵PID:11312
-
-
C:\Windows\System\jKlojXC.exeC:\Windows\System\jKlojXC.exe2⤵PID:11336
-
-
C:\Windows\System\thcWdvX.exeC:\Windows\System\thcWdvX.exe2⤵PID:11364
-
-
C:\Windows\System\kqGcyYd.exeC:\Windows\System\kqGcyYd.exe2⤵PID:11384
-
-
C:\Windows\System\HaEXSUS.exeC:\Windows\System\HaEXSUS.exe2⤵PID:11408
-
-
C:\Windows\System\UpZJGTV.exeC:\Windows\System\UpZJGTV.exe2⤵PID:11432
-
-
C:\Windows\System\PmZcZpC.exeC:\Windows\System\PmZcZpC.exe2⤵PID:11460
-
-
C:\Windows\System\YvEjmIP.exeC:\Windows\System\YvEjmIP.exe2⤵PID:11476
-
-
C:\Windows\System\XdJgjpE.exeC:\Windows\System\XdJgjpE.exe2⤵PID:11508
-
-
C:\Windows\System\vwYWrxi.exeC:\Windows\System\vwYWrxi.exe2⤵PID:11536
-
-
C:\Windows\System\FIbvfBc.exeC:\Windows\System\FIbvfBc.exe2⤵PID:11564
-
-
C:\Windows\System\AZDBbos.exeC:\Windows\System\AZDBbos.exe2⤵PID:11592
-
-
C:\Windows\System\rtUAZvF.exeC:\Windows\System\rtUAZvF.exe2⤵PID:11608
-
-
C:\Windows\System\faIWVjw.exeC:\Windows\System\faIWVjw.exe2⤵PID:11624
-
-
C:\Windows\System\vLokEhg.exeC:\Windows\System\vLokEhg.exe2⤵PID:11644
-
-
C:\Windows\System\iAakHES.exeC:\Windows\System\iAakHES.exe2⤵PID:11668
-
-
C:\Windows\System\cqCIYnI.exeC:\Windows\System\cqCIYnI.exe2⤵PID:11692
-
-
C:\Windows\System\krgzPzV.exeC:\Windows\System\krgzPzV.exe2⤵PID:11712
-
-
C:\Windows\System\DzKlAra.exeC:\Windows\System\DzKlAra.exe2⤵PID:11736
-
-
C:\Windows\System\zfaZrTT.exeC:\Windows\System\zfaZrTT.exe2⤵PID:11772
-
-
C:\Windows\System\KRoPMtd.exeC:\Windows\System\KRoPMtd.exe2⤵PID:11788
-
-
C:\Windows\System\DIetJZF.exeC:\Windows\System\DIetJZF.exe2⤵PID:11816
-
-
C:\Windows\System\yKTVKWh.exeC:\Windows\System\yKTVKWh.exe2⤵PID:11840
-
-
C:\Windows\System\BbJZIhD.exeC:\Windows\System\BbJZIhD.exe2⤵PID:11864
-
-
C:\Windows\System\BSKrxff.exeC:\Windows\System\BSKrxff.exe2⤵PID:11888
-
-
C:\Windows\System\LYLGmMh.exeC:\Windows\System\LYLGmMh.exe2⤵PID:11908
-
-
C:\Windows\System\PoGBgwT.exeC:\Windows\System\PoGBgwT.exe2⤵PID:11928
-
-
C:\Windows\System\RunxSjb.exeC:\Windows\System\RunxSjb.exe2⤵PID:11952
-
-
C:\Windows\System\xZXRvlT.exeC:\Windows\System\xZXRvlT.exe2⤵PID:11968
-
-
C:\Windows\System\gxyJksO.exeC:\Windows\System\gxyJksO.exe2⤵PID:11984
-
-
C:\Windows\System\TSvaecc.exeC:\Windows\System\TSvaecc.exe2⤵PID:12000
-
-
C:\Windows\System\bFhLjLq.exeC:\Windows\System\bFhLjLq.exe2⤵PID:12016
-
-
C:\Windows\System\wPeIarg.exeC:\Windows\System\wPeIarg.exe2⤵PID:12036
-
-
C:\Windows\System\XseQGdO.exeC:\Windows\System\XseQGdO.exe2⤵PID:12056
-
-
C:\Windows\System\aVWqZti.exeC:\Windows\System\aVWqZti.exe2⤵PID:12080
-
-
C:\Windows\System\lZlQKRt.exeC:\Windows\System\lZlQKRt.exe2⤵PID:12104
-
-
C:\Windows\System\vaodMGL.exeC:\Windows\System\vaodMGL.exe2⤵PID:12124
-
-
C:\Windows\System\vWQgUxc.exeC:\Windows\System\vWQgUxc.exe2⤵PID:12144
-
-
C:\Windows\System\eYDSWPQ.exeC:\Windows\System\eYDSWPQ.exe2⤵PID:12164
-
-
C:\Windows\System\LUcDccI.exeC:\Windows\System\LUcDccI.exe2⤵PID:12184
-
-
C:\Windows\System\HEsYnnj.exeC:\Windows\System\HEsYnnj.exe2⤵PID:12200
-
-
C:\Windows\System\FepVIzD.exeC:\Windows\System\FepVIzD.exe2⤵PID:12216
-
-
C:\Windows\System\aShidnf.exeC:\Windows\System\aShidnf.exe2⤵PID:12236
-
-
C:\Windows\System\phNTNIJ.exeC:\Windows\System\phNTNIJ.exe2⤵PID:12260
-
-
C:\Windows\System\XgTMoce.exeC:\Windows\System\XgTMoce.exe2⤵PID:12280
-
-
C:\Windows\System\tCPVEtU.exeC:\Windows\System\tCPVEtU.exe2⤵PID:8540
-
-
C:\Windows\System\QabhvyD.exeC:\Windows\System\QabhvyD.exe2⤵PID:3396
-
-
C:\Windows\System\aBQWaUy.exeC:\Windows\System\aBQWaUy.exe2⤵PID:3628
-
-
C:\Windows\System\TMfIKOh.exeC:\Windows\System\TMfIKOh.exe2⤵PID:1828
-
-
C:\Windows\System\wEoGxgt.exeC:\Windows\System\wEoGxgt.exe2⤵PID:10268
-
-
C:\Windows\System\hEDQKZv.exeC:\Windows\System\hEDQKZv.exe2⤵PID:1764
-
-
C:\Windows\System\NfPGwYP.exeC:\Windows\System\NfPGwYP.exe2⤵PID:12120
-
-
C:\Windows\System\MuKjNQO.exeC:\Windows\System\MuKjNQO.exe2⤵PID:12300
-
-
C:\Windows\System\dTOfXPI.exeC:\Windows\System\dTOfXPI.exe2⤵PID:12324
-
-
C:\Windows\System\GRwnAPM.exeC:\Windows\System\GRwnAPM.exe2⤵PID:12348
-
-
C:\Windows\System\aJKszJf.exeC:\Windows\System\aJKszJf.exe2⤵PID:12372
-
-
C:\Windows\System\uTPsDHK.exeC:\Windows\System\uTPsDHK.exe2⤵PID:12400
-
-
C:\Windows\System\jNFthxZ.exeC:\Windows\System\jNFthxZ.exe2⤵PID:12424
-
-
C:\Windows\System\QQeZbiV.exeC:\Windows\System\QQeZbiV.exe2⤵PID:12452
-
-
C:\Windows\System\wzBrnHf.exeC:\Windows\System\wzBrnHf.exe2⤵PID:12484
-
-
C:\Windows\System\tYhOSqu.exeC:\Windows\System\tYhOSqu.exe2⤵PID:12512
-
-
C:\Windows\System\ddzLArl.exeC:\Windows\System\ddzLArl.exe2⤵PID:12532
-
-
C:\Windows\System\YYSqGnV.exeC:\Windows\System\YYSqGnV.exe2⤵PID:12556
-
-
C:\Windows\System\gRvRPWs.exeC:\Windows\System\gRvRPWs.exe2⤵PID:12580
-
-
C:\Windows\System\EgybkAh.exeC:\Windows\System\EgybkAh.exe2⤵PID:12608
-
-
C:\Windows\System\HlVBNBQ.exeC:\Windows\System\HlVBNBQ.exe2⤵PID:12632
-
-
C:\Windows\System\yHQyYMR.exeC:\Windows\System\yHQyYMR.exe2⤵PID:12648
-
-
C:\Windows\System\bxkRMTh.exeC:\Windows\System\bxkRMTh.exe2⤵PID:12664
-
-
C:\Windows\System\nOzxmcj.exeC:\Windows\System\nOzxmcj.exe2⤵PID:12680
-
-
C:\Windows\System\paazwHM.exeC:\Windows\System\paazwHM.exe2⤵PID:12696
-
-
C:\Windows\System\rtNOBEv.exeC:\Windows\System\rtNOBEv.exe2⤵PID:12712
-
-
C:\Windows\System\TBMbroR.exeC:\Windows\System\TBMbroR.exe2⤵PID:12732
-
-
C:\Windows\System\ImaCxme.exeC:\Windows\System\ImaCxme.exe2⤵PID:12756
-
-
C:\Windows\System\fAiaNUw.exeC:\Windows\System\fAiaNUw.exe2⤵PID:12772
-
-
C:\Windows\System\LwcDRzS.exeC:\Windows\System\LwcDRzS.exe2⤵PID:12788
-
-
C:\Windows\System\xqSIXoe.exeC:\Windows\System\xqSIXoe.exe2⤵PID:12804
-
-
C:\Windows\System\GipFBba.exeC:\Windows\System\GipFBba.exe2⤵PID:12820
-
-
C:\Windows\System\wyojmMF.exeC:\Windows\System\wyojmMF.exe2⤵PID:12836
-
-
C:\Windows\System\DHiOEYQ.exeC:\Windows\System\DHiOEYQ.exe2⤵PID:12852
-
-
C:\Windows\System\GnJQazR.exeC:\Windows\System\GnJQazR.exe2⤵PID:12872
-
-
C:\Windows\System\FocYvBp.exeC:\Windows\System\FocYvBp.exe2⤵PID:12900
-
-
C:\Windows\System\xeDZxkb.exeC:\Windows\System\xeDZxkb.exe2⤵PID:12920
-
-
C:\Windows\System\YohSBhU.exeC:\Windows\System\YohSBhU.exe2⤵PID:12952
-
-
C:\Windows\System\iMmKVZZ.exeC:\Windows\System\iMmKVZZ.exe2⤵PID:12980
-
-
C:\Windows\System\QZNfLDB.exeC:\Windows\System\QZNfLDB.exe2⤵PID:13004
-
-
C:\Windows\System\huoIAjt.exeC:\Windows\System\huoIAjt.exe2⤵PID:13028
-
-
C:\Windows\System\sLIXRmT.exeC:\Windows\System\sLIXRmT.exe2⤵PID:13052
-
-
C:\Windows\System\VZgcZwB.exeC:\Windows\System\VZgcZwB.exe2⤵PID:13076
-
-
C:\Windows\System\lJuNTNc.exeC:\Windows\System\lJuNTNc.exe2⤵PID:13100
-
-
C:\Windows\System\kJUBlnf.exeC:\Windows\System\kJUBlnf.exe2⤵PID:13124
-
-
C:\Windows\System\bsovccq.exeC:\Windows\System\bsovccq.exe2⤵PID:13144
-
-
C:\Windows\System\oUcAuyU.exeC:\Windows\System\oUcAuyU.exe2⤵PID:13176
-
-
C:\Windows\System\aBoTaKy.exeC:\Windows\System\aBoTaKy.exe2⤵PID:13228
-
-
C:\Windows\System\eWnpEYE.exeC:\Windows\System\eWnpEYE.exe2⤵PID:13268
-
-
C:\Windows\System\qpvFiBL.exeC:\Windows\System\qpvFiBL.exe2⤵PID:13308
-
-
C:\Windows\System\HPKItVv.exeC:\Windows\System\HPKItVv.exe2⤵PID:12276
-
-
C:\Windows\System\VmSsIzn.exeC:\Windows\System\VmSsIzn.exe2⤵PID:9076
-
-
C:\Windows\System\BumnvLd.exeC:\Windows\System\BumnvLd.exe2⤵PID:8792
-
-
C:\Windows\System\lCjfYjS.exeC:\Windows\System\lCjfYjS.exe2⤵PID:9468
-
-
C:\Windows\System\lVKCCGE.exeC:\Windows\System\lVKCCGE.exe2⤵PID:7516
-
-
C:\Windows\System\PDhUpUP.exeC:\Windows\System\PDhUpUP.exe2⤵PID:12268
-
-
C:\Windows\System\oKQXUjb.exeC:\Windows\System\oKQXUjb.exe2⤵PID:12136
-
-
C:\Windows\System\siAOBhq.exeC:\Windows\System\siAOBhq.exe2⤵PID:12008
-
-
C:\Windows\System\QcUDQwP.exeC:\Windows\System\QcUDQwP.exe2⤵PID:11876
-
-
C:\Windows\System\dPxBLvB.exeC:\Windows\System\dPxBLvB.exe2⤵PID:11680
-
-
C:\Windows\System\oLFGvzY.exeC:\Windows\System\oLFGvzY.exe2⤵PID:11376
-
-
C:\Windows\System\BkugVdR.exeC:\Windows\System\BkugVdR.exe2⤵PID:10404
-
-
C:\Windows\System\JxJiZoj.exeC:\Windows\System\JxJiZoj.exe2⤵PID:3680
-
-
C:\Windows\System\IEQdesA.exeC:\Windows\System\IEQdesA.exe2⤵PID:10616
-
-
C:\Windows\System\UBhSdWW.exeC:\Windows\System\UBhSdWW.exe2⤵PID:10880
-
-
C:\Windows\System\EiXccSP.exeC:\Windows\System\EiXccSP.exe2⤵PID:11116
-
-
C:\Windows\System\vghLeiw.exeC:\Windows\System\vghLeiw.exe2⤵PID:6588
-
-
C:\Windows\System\vqzJdwY.exeC:\Windows\System\vqzJdwY.exe2⤵PID:9744
-
-
C:\Windows\System\iePUuNY.exeC:\Windows\System\iePUuNY.exe2⤵PID:13344
-
-
C:\Windows\System\VoUaGIj.exeC:\Windows\System\VoUaGIj.exe2⤵PID:13364
-
-
C:\Windows\System\deWYcqu.exeC:\Windows\System\deWYcqu.exe2⤵PID:13384
-
-
C:\Windows\System\GSSfVzx.exeC:\Windows\System\GSSfVzx.exe2⤵PID:13404
-
-
C:\Windows\System\QOXJMrd.exeC:\Windows\System\QOXJMrd.exe2⤵PID:13428
-
-
C:\Windows\System\ihPtpDw.exeC:\Windows\System\ihPtpDw.exe2⤵PID:13452
-
-
C:\Windows\System\DKdqTwp.exeC:\Windows\System\DKdqTwp.exe2⤵PID:13472
-
-
C:\Windows\System\rILhbXD.exeC:\Windows\System\rILhbXD.exe2⤵PID:13500
-
-
C:\Windows\System\QkxOhlj.exeC:\Windows\System\QkxOhlj.exe2⤵PID:13520
-
-
C:\Windows\System\hFPlAKM.exeC:\Windows\System\hFPlAKM.exe2⤵PID:13540
-
-
C:\Windows\System\isrGqPK.exeC:\Windows\System\isrGqPK.exe2⤵PID:13564
-
-
C:\Windows\System\cnfQDmS.exeC:\Windows\System\cnfQDmS.exe2⤵PID:13588
-
-
C:\Windows\System\bYGXswi.exeC:\Windows\System\bYGXswi.exe2⤵PID:13612
-
-
C:\Windows\System\TTkKaNg.exeC:\Windows\System\TTkKaNg.exe2⤵PID:13632
-
-
C:\Windows\System\frywSBh.exeC:\Windows\System\frywSBh.exe2⤵PID:13652
-
-
C:\Windows\System\DjTnqVa.exeC:\Windows\System\DjTnqVa.exe2⤵PID:13672
-
-
C:\Windows\System\jGizcvl.exeC:\Windows\System\jGizcvl.exe2⤵PID:13692
-
-
C:\Windows\System\YwiDfHD.exeC:\Windows\System\YwiDfHD.exe2⤵PID:13708
-
-
C:\Windows\System\MAcdhWM.exeC:\Windows\System\MAcdhWM.exe2⤵PID:13724
-
-
C:\Windows\System\KITFvPj.exeC:\Windows\System\KITFvPj.exe2⤵PID:13740
-
-
C:\Windows\System\IjyRNYn.exeC:\Windows\System\IjyRNYn.exe2⤵PID:13756
-
-
C:\Windows\System\rhXCbCj.exeC:\Windows\System\rhXCbCj.exe2⤵PID:13772
-
-
C:\Windows\System\KVpWery.exeC:\Windows\System\KVpWery.exe2⤵PID:13788
-
-
C:\Windows\System\CWLprNg.exeC:\Windows\System\CWLprNg.exe2⤵PID:13804
-
-
C:\Windows\System\OuMgwuw.exeC:\Windows\System\OuMgwuw.exe2⤵PID:13820
-
-
C:\Windows\System\fzEjKXM.exeC:\Windows\System\fzEjKXM.exe2⤵PID:13836
-
-
C:\Windows\System\UCYgDVy.exeC:\Windows\System\UCYgDVy.exe2⤵PID:13852
-
-
C:\Windows\System\pdmZjel.exeC:\Windows\System\pdmZjel.exe2⤵PID:13872
-
-
C:\Windows\System\mgKHvul.exeC:\Windows\System\mgKHvul.exe2⤵PID:13888
-
-
C:\Windows\System\SkFauuT.exeC:\Windows\System\SkFauuT.exe2⤵PID:13912
-
-
C:\Windows\System\PqZqmKL.exeC:\Windows\System\PqZqmKL.exe2⤵PID:13936
-
-
C:\Windows\System\lKxJyjW.exeC:\Windows\System\lKxJyjW.exe2⤵PID:13960
-
-
C:\Windows\System\onzaNxf.exeC:\Windows\System\onzaNxf.exe2⤵PID:13980
-
-
C:\Windows\System\jsXEhxP.exeC:\Windows\System\jsXEhxP.exe2⤵PID:14136
-
-
C:\Windows\System\qMZmqRY.exeC:\Windows\System\qMZmqRY.exe2⤵PID:14152
-
-
C:\Windows\System\KurQwAv.exeC:\Windows\System\KurQwAv.exe2⤵PID:14192
-
-
C:\Windows\System\BfQUHbS.exeC:\Windows\System\BfQUHbS.exe2⤵PID:14220
-
-
C:\Windows\System\WOLAxRE.exeC:\Windows\System\WOLAxRE.exe2⤵PID:14240
-
-
C:\Windows\System\MlsVFit.exeC:\Windows\System\MlsVFit.exe2⤵PID:14256
-
-
C:\Windows\System\PjxghMd.exeC:\Windows\System\PjxghMd.exe2⤵PID:14276
-
-
C:\Windows\System\VkGDOcI.exeC:\Windows\System\VkGDOcI.exe2⤵PID:14296
-
-
C:\Windows\System\FHQdvfd.exeC:\Windows\System\FHQdvfd.exe2⤵PID:14320
-
-
C:\Windows\System\thHaEOe.exeC:\Windows\System\thHaEOe.exe2⤵PID:10752
-
-
C:\Windows\System\XersVmf.exeC:\Windows\System\XersVmf.exe2⤵PID:12368
-
-
C:\Windows\System\vRAoAtT.exeC:\Windows\System\vRAoAtT.exe2⤵PID:12548
-
-
C:\Windows\System\ISgGPJA.exeC:\Windows\System\ISgGPJA.exe2⤵PID:12596
-
-
C:\Windows\System\qyHYJKg.exeC:\Windows\System\qyHYJKg.exe2⤵PID:12656
-
-
C:\Windows\System\WotcmiG.exeC:\Windows\System\WotcmiG.exe2⤵PID:12720
-
-
C:\Windows\System\LlMkdpb.exeC:\Windows\System\LlMkdpb.exe2⤵PID:12752
-
-
C:\Windows\System\azfwriT.exeC:\Windows\System\azfwriT.exe2⤵PID:12784
-
-
C:\Windows\System\PNRROEs.exeC:\Windows\System\PNRROEs.exe2⤵PID:12972
-
-
C:\Windows\System\WKbBDJi.exeC:\Windows\System\WKbBDJi.exe2⤵PID:13044
-
-
C:\Windows\System\wcLTTfT.exeC:\Windows\System\wcLTTfT.exe2⤵PID:13092
-
-
C:\Windows\System\Ghxxmbr.exeC:\Windows\System\Ghxxmbr.exe2⤵PID:8440
-
-
C:\Windows\System\lmJAufx.exeC:\Windows\System\lmJAufx.exe2⤵PID:13260
-
-
C:\Windows\System\wRsmPUw.exeC:\Windows\System\wRsmPUw.exe2⤵PID:11260
-
-
C:\Windows\System\kRpZjrw.exeC:\Windows\System\kRpZjrw.exe2⤵PID:11556
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:11872 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:14180
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:15248
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:13328
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:11680
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3780
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:14568
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:13520
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:10736
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:14880
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:4752
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:14256
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4192
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5000
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:12328
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4220
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4368
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4152
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:13936
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:13424
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:15304
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5388
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3412
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4640
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:15136
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:7640
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:9464
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5668
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:7596
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:10504
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:9212
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:9280
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:11448
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1100
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:8464
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5440
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:12104
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5692
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:10444
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:14400
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:12716
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:11720
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:15252
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:13568
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:15288
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5644
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6204
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:6268
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:14792
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:7520
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4408
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2952
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:11416
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2136
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HJ7J86Y5\microsoft.windows[1].xml
Filesize97B
MD5a1d5ffdb726a9647b35792c516a012fc
SHA1ff330c546ecec38f962e90594f70abe2539f23e5
SHA256770d9ad3f136a240e498181127342c8282467e14b6dbe6cad10b20c5cba1ec09
SHA512ead7820a41f5e5e31b2b0b1c0b6bd441899b57fe549f685edda664272ef75e58e4598f2fe4d595bde1cb8c54aa244dda8577f3c10c66b49cc8c1815df02a6a94
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133660700974950546.txt
Filesize75KB
MD5af57e67456efd305d46e23149c8018d0
SHA192d8f2bb204a0e2c73f080485302331630ca3eca
SHA256adcd926ddffa3e9e3d2565d4988eefb6f1cecffae7b496b854156703accacad9
SHA5122ccf0a3e78f012e28f4611d35537d7a695c31c1d98ecab2cfc1167cfe5faf9b6b3f6f10f2f01b95fa7ca2b5fea85a0dbc115e375fcac5860fa6892664566d6b8
-
Filesize
1.9MB
MD54f069e45ddf4e757f9d0ea55e6c7e58d
SHA1bf9d1660a47158f7d335655a5f4260a65e82a504
SHA2561fbe4f206ada12a9b6e37dfc8e70e631164f2ec44c3b3666d84a538543079395
SHA51217d4dbfe240183f39c09cbebaf08c318a585cef9f9ccc79b6c8258a0e55f6420348bebf6a7ba91623321af95ca37699df7ea5ee74008d31e6d635cea2dcde90d
-
Filesize
1.9MB
MD55d1a60c63074ea6888fe25bcaef082f2
SHA14f2c0ac3721e7918b4a01c40afd94a828072b66c
SHA25600024155cab8399039c2f628da7bbf0b28826dd5b4d2c47e0fdbf342bbfac349
SHA51232da2b1595183ae186789a530030f1f27656e7400818bafcea19e06c2e44d659d76e0ad80e405d79f3c776952b9aed2d77c061db900c13567b33982593ae40d4
-
Filesize
1.9MB
MD5a49198190781bbbd47381381529fd5af
SHA13161998ce75cc09afa806b861acd322cb10cfbb3
SHA256a0e3058ca244e5630bd01bf6db63d3d2716b55fb1618d0a4da876f7f2ce0595b
SHA51269ca9dfeffd3a8acacdb8a8bb224841a3acacbb896d3c8c611c1c1f20b3dea13aad2eeb005bbd09375ecb8483243939d6a956b001ce3651439d395ed488fda10
-
Filesize
1.9MB
MD5301367509101f19ee054c7b8aa5ab272
SHA1943bcc3015d38d2f6b589906c308cc6a8383ce12
SHA256f2aa1d5c8df7cf837e4ab031010d412d916e2c8c8853406a6f9c3d81afb761fe
SHA512aed3e7867013b683afaafe5892d299b3f1ba45fdb255bfc6f35d1cc07c7b12fd03c2ac463ef31aa91bd9c57e89c6a43fb6e99bdda1ca08a5e85f22909dc1b79f
-
Filesize
1.9MB
MD5241346142b331be4d2ffe0844e07cac4
SHA1345140bf21e9a3f84150260c0d806ed5394baccc
SHA25619abd0b2d0b3fda54991c55e883dc75763638b3ed0281d3ba7200483cee274f2
SHA5128b27b1cbe5d155e0a247fe8ecef0391bb6701d4178f065e725bb5c6e1ac6fc0995d7c738232ac3e7645a2add61b5e263f575c7a59e80ab473c24677df9a7101a
-
Filesize
1.9MB
MD587fbcebe2871ab698d39acec4c58402d
SHA1ecd3aedd49fa8b009eff3e1fa8f9c38ae1b6b039
SHA256441f93f1e3cdb2aef83ec86fbc9ec7950605da5703f8d23b1e89a1492dc2dc44
SHA51266171ac810f44e209fced44b8178da5d1bc15af539157b8bfc17bb6b7ce2bf55657ac9a36932f5aded6e57d83bc369676c640544af9ea91893de1c5c4612c5a8
-
Filesize
1.9MB
MD5dea52b28b5acd4ad718e015c88ca28d5
SHA1f9684286bac71c3f615d6eaffeb6910def609388
SHA256cc7029cb13dfe2e4297a0aee6e725e12032158d1a0fbdad559cd9079a9ecac01
SHA512f66ab03d83c5fa53870b2981f3b8e07a89c0b57b284556c28af1c5eeb5f1c6d071d74ddda715a58fcdb03894c4dc59937876b40818edc964bb9907cd9520c528
-
Filesize
1.9MB
MD5008d219bcde82d40d95f334ed62c6cc2
SHA14acd54d0663ef1a7be24c331d8de7d9d4ab4126d
SHA256ab6aa326033258d46ffbbb7283ca12aff511c741f30c6da89d9210d50c24947e
SHA5129a88f1bb385895926da5bdeaa5dd613ff323dcd0c6a938a8deec0ac763d5cd6af072f334d3db0e405d95a2aaff3b8e1540c72d5fbc57e64f50a91edc5d6f5ea8
-
Filesize
1.9MB
MD5984ecec9d3fbb314d62ba0265c541a4e
SHA13ec0ed0c9f28e0e3c33b3e7922d1c71200ff0c57
SHA2564cff5d43679f793e8244e9d55bca784fd5c61f84bacff0de9397e0a80aa347ab
SHA512507cc83e68e2817a10ac146522cf6c593eed3b2ab3bac665b5e503f5a89f6d6fc76e5d4a4b513e911b64a65baa751d83c658cda7a4f3b79d732e41d5b17ffe30
-
Filesize
1.9MB
MD5f4d4df83f193545f72d336504415c025
SHA1e352f47206182ab87879f263d99057db1981c3c7
SHA2567353c94063db6ba5149a3edd34ac1604aa5fb9aa97c00eda2a2edf27688fb811
SHA5125890c83581734f0ff7da4a70021d2b27555ffbc04f43fd257c51848f43b98d78643607416937e1cab97bef9a51f1e19101401b7c720d4870c89a4d8ac0406b11
-
Filesize
1.9MB
MD5348b337c152607affc89c7daa5f4efc0
SHA1bb179826a75cbb9823be25d41c5bc53c405e0f77
SHA2563d5c8567e247346a3b7b48fa9d47b6cd6b9e71afc38b06c796462c0c32f75107
SHA512c23ae42a1489074fa65f3767456adb3892f406a8c4eec53f944365c5f704cac324ff2ddd33a63bc306eb5206a2f007ede7be3a02beab76c31b42f4e7b076b293
-
Filesize
1.9MB
MD55ff8cd3261162b294d0b4f2a41f0edb0
SHA1451d88fe039fd8eb5f001ec1df6b2f70a7ea805d
SHA25670469e798bd1fd23396123c95c5633d3e722096fd75cf12780e9c2dbb366a393
SHA51233f0ddbd9602b0396e19dd599818b65c5df36d6ec38e5f36c94d7d418590e1c628e01468354a4919d8db6cfa2f9c56a52fa920d27471f4c60e3e9a79e6708ed8
-
Filesize
1.9MB
MD5615472e6f1e2a2ce9c0e83477cef89ae
SHA13e3316deb53e9d0d5044e28f8e3edd6a43d064c0
SHA256e51538a98510bfe6dc9738947aa9dff13871dbc182d3913921a0ff004946d7ea
SHA512bf4382e21a0183f40e8c680ae24fca0009172236ee3092f7bfda536cdf27377f1528a227168c7e92d6dcf75f3cd62ee0dc7b6870e5c770da866294b2f03e3142
-
Filesize
1.9MB
MD5525cdaff1f2b7910fbd228cd7649e1a4
SHA16cbd4162b63d6f9c44b1773bb608b2fe39217901
SHA256d7db3198701f6ab03d6dd0a3264bc9b58ea20e8506ab0feb3c1d70c05c6801b9
SHA5124216bfa082811a0551aa3e44a981d18fff1d9b5c63273296c18b51a5a7e6f5b5a11a8e4099b9a5a0c92ea0b64a746635335603756a2948c6f396b61d30907984
-
Filesize
1.9MB
MD5c001fb970d213cb8d250a7f87cd53c1b
SHA10ffacd7c74daf21f56d886a6c00560e3fadd2b12
SHA256747fa4ecef4718819ea6572977ad030c70d91c7eed126e04e4baabe772ceec37
SHA5126d198213ccee80508f63458290bfd7ad827def97a92fcd137c593315cd05d9506d5a1a0a37dda76def7154410959ba5e19f825621e290496c19df057343cbadd
-
Filesize
1.9MB
MD581a58369108c7491a1a054d978d48619
SHA17cb6fdfe97254224f49e914815c6c2ea481de6ab
SHA256f76b179d2ed6e2ef8deefdc5f9a0f7f16826c5111aaab77c0072ea7caeeb0299
SHA512786129fbc36dd426b380e603e92c287188cf6c2b404e9f83b5a56559ff739e62c84d793b8954ac067a12d5b3730558c497e1e2efa203ffeaada5009862f8f353
-
Filesize
1.9MB
MD566528f9e5ae5733acd4707056a6ec88e
SHA1b045ed8fe80cbab42a9dc1b144066b18967b756b
SHA2561a16363ab1d415372b76e462bbedaa14dc3c0f410ce11bd39698f41d5426edc1
SHA512464c31bdfbb6e7211b2d57cdf7289de7e23a9c7265747f738f320684803fb55aabebbcbd9f46b524cc0fb6096b344506014cd1959e1b9dabe128ba62e6605b77
-
Filesize
1.9MB
MD50cefc003346c9cd11863c1b2c6cb41e3
SHA1ce91f8a39c7bc74212c47461abdfc25928f56557
SHA256437aaa7b58bd28acf4e805c768938c0608582560564a205f5ec863d169b618bb
SHA51283225bccabf727f4486722231f0a9859a152c6c2aa152a988fc93afcb719a6f2a3b2ccbc0a45f9464f31b6f28bdb20d846da9790d4a82a5f6fb28b314a4daab8
-
Filesize
1.9MB
MD507e104279b3c68e4999ff9db1a12ebbb
SHA1268998121de579ef4260fcd9c2f4d0f8212d60ee
SHA2561abd4844c7f3d1b75ce2526eddb3112f44fb03595e8119ecee8ccf7c1afc37b7
SHA51254c4625f2e289bc6a40b5fd00cfdc5184fedbd51c0d15c5cf1fe22e161ad9770837b3e1211e01140cfbab4d18ea86d2ca12d83ec0a09bb4b94ffd42e07f72e05
-
Filesize
1.9MB
MD5921c3e99bac8c45ec10f20e6a7f5b22a
SHA1afbb8acf8d546863c702d84995276be1833e645e
SHA256c6417dcb7724659b96537ec8115d9d1d9e2b5d9024203728239dd81a84a2adc0
SHA512b1e64933861a0f864d0c9e28f8dcf6864c07be0a480640f0c2ef486fdd8bc918c0a8e654da4fe2338f9bf23c0713bd117e3446da071132c2601910ad367de026
-
Filesize
1.9MB
MD55f1224f66feae1049cd0b4b9c29dd836
SHA1117d8d4d313661a9bc87f75b2a44d9008790be8c
SHA256a64e87aac7c71528d221bc42c3fad7b044aeaf35aa88a3e87d6a9e932d133b24
SHA512bcfca053ea1427c1472d964d61551f0f65b26e0ac193b35edf97714609ea8d98e3be4b00ca8ea6c300b85ed64eeca9e4b95ac0ec6eb0b708a3115dbc41a4a0b1
-
Filesize
1.9MB
MD599f3f31cbaae69fdf2fce6663bfe7b69
SHA17913d4e06c87e279838109af6cbb3a0376728dbe
SHA256b3e67748a825a07c4e4e883fd162aa51456a8cc2e97ce82fda8fc65307ab5d61
SHA512167d08d330fa55d6f08c275a981255f23193e4a9058542fc336a32afe8cb38b8b59e44fb61fd3a2134886644b3f80d871b4f8edee2076076baba2f69a3af3aca
-
Filesize
1.9MB
MD501aa937e9f228748c6817e7b5494b9a3
SHA10de09bfcabb6cb9213880ffd662ccdb1b5917e28
SHA25611419e077e8c0037538286a3d97d71fb706509e6633347c6a77470ff5ffe1090
SHA51294708a529d8a08b0952367647d5f57c0fa099bf23a63bbe6a0b05a138e45dda955c10dd862f1106d5df9b9473fa4cc0b953ad4318f999ac78aa4d74e80f7be59
-
Filesize
1.9MB
MD55cf3d2b746efceaa202953ddcb60281b
SHA1aac110fa77666c17401d78642a3ee48ba5217691
SHA256489536a049cd299b9cd030b5d944b344b02ce642ce4e02f8bccb94f9a0b1e62b
SHA5123d6e43ab18c09fb46b9e4aea9429322f8df2bdd81a354899d9f98a4a85f6eefad66572aed1a36c6df1e156c46806559cd962f9010886bd92fde676eaa864a8f4
-
Filesize
1.9MB
MD581a14250ef997930583ca087f7b40afe
SHA1a26f2d44860de89a86133f672f8810fa916945d9
SHA2561ce9c26fa85c2d56baff87cf8d8daccd9276dc24fac302119c1211ee2bc03418
SHA512406ad730f37b826f57afc6a5835fcdded82344120799dc44d6920d032e59d351c1cd72e496a518bc929aa38127ff35dbacfd5043c4fce06c605fad11a565bc39
-
Filesize
1.9MB
MD5913a271f00bd920355dbb129eb69de77
SHA124015f7e417a4a39face89c4afea2eeda12bf948
SHA2569ebaff7abecd5e398c77f1eb0d3b25028408c663549ae0932942855c4921cae2
SHA5129d2b98b4aacf3c3f8a93b20efd84f2d9b885bd759b9b695afed7ad1656258c335a165bbc4abe673813877e2db9406d80539d7a18fc8b41dc014a40d2f87f4b35
-
Filesize
1.9MB
MD551a7778523a6be23597af45c5a64df46
SHA17deabeafc0314d6ad996e56046c022401dd8dda1
SHA25636bb67b08ecf401e58aac2cbba5fb5ae9bfd001d0658f63068fd0c0030066127
SHA512e0aaeaf4078ca739399f699643c63cddba7c776f049ee09b5db64fc0ecdc1ca9305717389cca80b8c5a09dc0f3dda82eb4968317845982205afe0c1b335b9d9d
-
Filesize
1.9MB
MD5010837be3b3f524f6845ef05e095f174
SHA1e76e2c10b6e92bc6fa80ee6612c9f4ceb91d1c55
SHA256168ef06e09730517d83e11c779325ce304a764d8bbc937eae093a5f47bff95cd
SHA5120ec3c7f9d19b588c216671afe141274ee3183b7462cbe22c0c218f418c24d5f2c0d4946b6c61d86dee967a35103d48eb1f80356e0cf9b8511b3a0d9813f368d6
-
Filesize
1.9MB
MD55919c8f598d2bb804c32e590b7b9630e
SHA1e645932d70e8971367527f917295d80e3592112a
SHA25693b2eccf2c5e5849c58a38cca626da10a75653408d0ecc7fbd535b348a824a80
SHA5124cd5aebbd73319442bfb40d27bbd5ec20c1c200f333b2c90800d5657ae1ce8484026eaffc0ace99614496d7f41df4deb52c2d670636803dd916be0e5582c0150
-
Filesize
1.9MB
MD52ed6bcaf0a9ae46080f553e84f28d871
SHA12e52fa17102b6ecdec154e9ca1cbd09a05938134
SHA256cf7c3e2f76b64c90a2fead878954fe96e8364bae5054bff8aee15556657fbf79
SHA5128785158add5957361e046e4b018a39ef493f1af428b68df1c7bf1c457e90eeb7682854bca495931c151397f56280c9be0c3cb9af7544a7ba6bf5ab66052e54c7
-
Filesize
1.9MB
MD501954343d6ed6ff1a56bf9ef1eb45ca1
SHA18660e5493aa5418c2980a88532004b7d4e4f625a
SHA256d50c6c972e6389108c4b94d66c04b70bab1cc904ed944f08b72e7f89220f5358
SHA51252464ccab9f416bff16bcd83681a87c5c52ed5a0adea251a84abe2806b23d74724386a4a7345bf750f9e2b1206dbe7ee9914794ab8e52c2891d42cdce9a44733
-
Filesize
1.9MB
MD596a49810927ed16ff6abe862b9c9a291
SHA11d8bec2f5822bea9b3863fe0e92f3bfaa97edaa9
SHA2568f3230a4e398b04dfd058f81ff93bfe6f5e39f31fd9335494e4f001dcd22a2c5
SHA512873a0beda67c6e5302c688cf997c6c708d2e378656033c570e3ef63093f46a15ec190fad18d55a9dc531768d694db036c23ae9f130db1410311836002e6a195c
-
Filesize
1.9MB
MD5de4982d8cc8bac7f2dd4f20c392c85f1
SHA139094697b34441c366ae50cee8df47e7b33d84b5
SHA256843b0a9f6cdb4f8370dd759e72d395ea9086d53c2e928dfa8c52675412c4b794
SHA5124b05c970493f7399613dda40ade7515f7de9892624956857bed666e0f0056d05132b18df975caae55d3c3c9befcb497120dd468692ec2ba3ec8ae8cd2b41d883
-
Filesize
1.9MB
MD5f7e88b195e35abb4b17830aca512118d
SHA19e9adc0d2f194c38c6d7d0c516f3639681bef5bb
SHA256e4e1ef1a8abad28309a89fc43a7a0e99600942e4977f1f06ec17046578a9fa5d
SHA512ce809bd32d477345eec1fc0cdfb865e7c7d607c72244e652008f9adb0597c312616c2172a9201f3c16b889a954ffbdbc04b6d57fe39686d7ccbcfb45ddb64678
-
Filesize
1.9MB
MD57e13360d665ae9e933c9b60b3cc4baae
SHA12dc3f8b35a497915af8a49926053a84a38b06dcf
SHA25609def39ef133e41c52e29d5a05868b899a041a2eced0170bb1701e2d8bdef790
SHA5121d56d0371fdc07b91cf64eafdf4ac15120fc70b377f7159a0ace47f1d6a38517b8fae65b0e1bee08c85d0a5f2fcfa0603616af4cda2e054685adedcf875b6997
-
Filesize
1.9MB
MD5e66ba9df9077072a1fd6067b0e503dc5
SHA13ad77979163c28d71cf5ab9e742086f4f4ffdb18
SHA25639acb53973edb0fc8c37748d1154652c75e1d42f8583c89abb4b61ba6530f4fa
SHA512fb6950750516eff918e8936b077a1f62170b57825e7f3ebe37a7f5ae71c1a34adc71ecae3df6b615a269c33edea32b39e3facac1ca61e7c7dee96057e21c61bf
-
Filesize
1.9MB
MD52223386ae5a06c8fee38de8ffe41051e
SHA14bfdf67f29699648126f2ba668af80123fc2b862
SHA2566fbf98a7bb6f542da313727290129df39d59412731262b51d8391ee2763abfa7
SHA5120f82a669a7d6f97d9cc67e378d69e5e5542d256fe5f93a884e613cefd0bce5918076f6e06548326454d7a46a883296ea49b560070e2945cf4fb1609203289de8
-
Filesize
1.9MB
MD515e4087139409095c669780805eb22ea
SHA10f8a505655004255c40520cf964f0cfa5abbb6a9
SHA256134d2d6241ae64e49b7a04761948127005c4b27e9e2411da061b870fb6c36e4d
SHA5126e800faca0ce59c9784d7cbd9e03f3b4b447f77f1a54ad87a0f1d712c89942d790010887700ea9e692ec27bd448ec3dcc049a16e90d8fa1434215668e1cac786