Analysis
- max time kernel
91s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
27/10/2024, 04:03
General
- Target 2024-10-27_79d0cf1e3f464efdc28dc62767a97fd2_cobalt-strike_cobaltstrike_poet-rat.exe
- Size 6.0MB
- Sample241027-emb2vs1mbl
- SHA256 19c98de0219f2159d33973b0035d5cf85913d00895d58a0f538444e60e05588b
Score
10/10
Malware Config
Extracted
Family
-
cobaltstrike
Botnet
-
0
C2
-
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
Attributes
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
- Cobalt Strike reflective loader 32 IoCs
Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Cobaltstrike family
- Xmrig family
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 64 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 64 IoCs
- Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 64 IoCs
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies registry class 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-27_79d0cf1e3f464efdc28dc62767a97fd2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-27_79d0cf1e3f464efdc28dc62767a97fd2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\BmOPihq.exeC:\Windows\System\BmOPihq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mVONXRV.exeC:\Windows\System\mVONXRV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\keWQmwH.exeC:\Windows\System\keWQmwH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FwguCqH.exeC:\Windows\System\FwguCqH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iuWfgFv.exeC:\Windows\System\iuWfgFv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CcQKLnl.exeC:\Windows\System\CcQKLnl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KDTDPHa.exeC:\Windows\System\KDTDPHa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wAJOnwD.exeC:\Windows\System\wAJOnwD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BrXkwaB.exeC:\Windows\System\BrXkwaB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hGgsTCo.exeC:\Windows\System\hGgsTCo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ePRNnYy.exeC:\Windows\System\ePRNnYy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zeGycAZ.exeC:\Windows\System\zeGycAZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UQMOtCb.exeC:\Windows\System\UQMOtCb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PgGJMfD.exeC:\Windows\System\PgGJMfD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vkuyaMd.exeC:\Windows\System\vkuyaMd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xoUmHFP.exeC:\Windows\System\xoUmHFP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hXJNAfw.exeC:\Windows\System\hXJNAfw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qxDKjAu.exeC:\Windows\System\qxDKjAu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\keuNbUw.exeC:\Windows\System\keuNbUw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LMafzor.exeC:\Windows\System\LMafzor.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xOCLuRm.exeC:\Windows\System\xOCLuRm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pUSBzMZ.exeC:\Windows\System\pUSBzMZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OeSTdhp.exeC:\Windows\System\OeSTdhp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZAxIPKo.exeC:\Windows\System\ZAxIPKo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tMKcLQn.exeC:\Windows\System\tMKcLQn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uWSAjmJ.exeC:\Windows\System\uWSAjmJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qzXXeAb.exeC:\Windows\System\qzXXeAb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LpPhKTC.exeC:\Windows\System\LpPhKTC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lYxBcEq.exeC:\Windows\System\lYxBcEq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BHCTxON.exeC:\Windows\System\BHCTxON.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qXKecSt.exeC:\Windows\System\qXKecSt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QdcxBqP.exeC:\Windows\System\QdcxBqP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NECASbt.exeC:\Windows\System\NECASbt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SSQIvZq.exeC:\Windows\System\SSQIvZq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DmqxHto.exeC:\Windows\System\DmqxHto.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hXxUpFm.exeC:\Windows\System\hXxUpFm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kzbkmmR.exeC:\Windows\System\kzbkmmR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nLdxfmx.exeC:\Windows\System\nLdxfmx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QoDZGME.exeC:\Windows\System\QoDZGME.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\txGmBMm.exeC:\Windows\System\txGmBMm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LtvrUAk.exeC:\Windows\System\LtvrUAk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RzHacEy.exeC:\Windows\System\RzHacEy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XOKkEWl.exeC:\Windows\System\XOKkEWl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\njolZLp.exeC:\Windows\System\njolZLp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ceABoBK.exeC:\Windows\System\ceABoBK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JByUEXW.exeC:\Windows\System\JByUEXW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hqsQrHx.exeC:\Windows\System\hqsQrHx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HeqAtMl.exeC:\Windows\System\HeqAtMl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iChGimQ.exeC:\Windows\System\iChGimQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UzewHWS.exeC:\Windows\System\UzewHWS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OnoWYjW.exeC:\Windows\System\OnoWYjW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hBknBpn.exeC:\Windows\System\hBknBpn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qSmBWdj.exeC:\Windows\System\qSmBWdj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OFnIale.exeC:\Windows\System\OFnIale.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KSHEvuU.exeC:\Windows\System\KSHEvuU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hyxXNPX.exeC:\Windows\System\hyxXNPX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aDutsHi.exeC:\Windows\System\aDutsHi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jEAWaKO.exeC:\Windows\System\jEAWaKO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wsiNMkc.exeC:\Windows\System\wsiNMkc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vUEtsLZ.exeC:\Windows\System\vUEtsLZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HamHvVB.exeC:\Windows\System\HamHvVB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ALHEHnZ.exeC:\Windows\System\ALHEHnZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JKCNQrp.exeC:\Windows\System\JKCNQrp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oGCTedR.exeC:\Windows\System\oGCTedR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UkYTwgn.exeC:\Windows\System\UkYTwgn.exe2⤵
-
-
C:\Windows\System\oqtdHii.exeC:\Windows\System\oqtdHii.exe2⤵
-
-
C:\Windows\System\vYotoBJ.exeC:\Windows\System\vYotoBJ.exe2⤵
-
-
C:\Windows\System\cklFxEa.exeC:\Windows\System\cklFxEa.exe2⤵
-
-
C:\Windows\System\vzoYyua.exeC:\Windows\System\vzoYyua.exe2⤵
-
-
C:\Windows\System\aFExJVX.exeC:\Windows\System\aFExJVX.exe2⤵
-
-
C:\Windows\System\YCVgKgO.exeC:\Windows\System\YCVgKgO.exe2⤵
-
-
C:\Windows\System\rbqaZGr.exeC:\Windows\System\rbqaZGr.exe2⤵
-
-
C:\Windows\System\cyLWnpz.exeC:\Windows\System\cyLWnpz.exe2⤵
-
-
C:\Windows\System\ksVYxkx.exeC:\Windows\System\ksVYxkx.exe2⤵
-
-
C:\Windows\System\lnDcLfL.exeC:\Windows\System\lnDcLfL.exe2⤵
-
-
C:\Windows\System\ifUUrYy.exeC:\Windows\System\ifUUrYy.exe2⤵
-
-
C:\Windows\System\KvaoUch.exeC:\Windows\System\KvaoUch.exe2⤵
-
-
C:\Windows\System\CVLtuAt.exeC:\Windows\System\CVLtuAt.exe2⤵
-
-
C:\Windows\System\wyIDMMw.exeC:\Windows\System\wyIDMMw.exe2⤵
-
-
C:\Windows\System\XUHOZgA.exeC:\Windows\System\XUHOZgA.exe2⤵
-
-
C:\Windows\System\QtrggeE.exeC:\Windows\System\QtrggeE.exe2⤵
-
-
C:\Windows\System\GbZGQOA.exeC:\Windows\System\GbZGQOA.exe2⤵
-
-
C:\Windows\System\jaJwsAe.exeC:\Windows\System\jaJwsAe.exe2⤵
-
-
C:\Windows\System\MOFbzLf.exeC:\Windows\System\MOFbzLf.exe2⤵
-
-
C:\Windows\System\BWOOExm.exeC:\Windows\System\BWOOExm.exe2⤵
-
-
C:\Windows\System\lCOTsmu.exeC:\Windows\System\lCOTsmu.exe2⤵
-
-
C:\Windows\System\uPBsUgp.exeC:\Windows\System\uPBsUgp.exe2⤵
-
-
C:\Windows\System\PIEoLpN.exeC:\Windows\System\PIEoLpN.exe2⤵
-
-
C:\Windows\System\hokeNJt.exeC:\Windows\System\hokeNJt.exe2⤵
-
-
C:\Windows\System\wdGJnid.exeC:\Windows\System\wdGJnid.exe2⤵
-
-
C:\Windows\System\VJRvsBX.exeC:\Windows\System\VJRvsBX.exe2⤵
-
-
C:\Windows\System\LTycREu.exeC:\Windows\System\LTycREu.exe2⤵
-
-
C:\Windows\System\NqmXwHS.exeC:\Windows\System\NqmXwHS.exe2⤵
-
-
C:\Windows\System\ttDzrpD.exeC:\Windows\System\ttDzrpD.exe2⤵
-
-
C:\Windows\System\ONYCxLA.exeC:\Windows\System\ONYCxLA.exe2⤵
-
-
C:\Windows\System\fdxAjex.exeC:\Windows\System\fdxAjex.exe2⤵
-
-
C:\Windows\System\SUWADQq.exeC:\Windows\System\SUWADQq.exe2⤵
-
-
C:\Windows\System\baXZHqX.exeC:\Windows\System\baXZHqX.exe2⤵
-
-
C:\Windows\System\lrjfJFH.exeC:\Windows\System\lrjfJFH.exe2⤵
-
-
C:\Windows\System\WgEDaBV.exeC:\Windows\System\WgEDaBV.exe2⤵
-
-
C:\Windows\System\LBWhykL.exeC:\Windows\System\LBWhykL.exe2⤵
-
-
C:\Windows\System\tiTslTq.exeC:\Windows\System\tiTslTq.exe2⤵
-
-
C:\Windows\System\PvBYSiq.exeC:\Windows\System\PvBYSiq.exe2⤵
-
-
C:\Windows\System\cnaMTPv.exeC:\Windows\System\cnaMTPv.exe2⤵
-
-
C:\Windows\System\pnkMsoc.exeC:\Windows\System\pnkMsoc.exe2⤵
-
-
C:\Windows\System\xeBGsMO.exeC:\Windows\System\xeBGsMO.exe2⤵
-
-
C:\Windows\System\HDiOlYh.exeC:\Windows\System\HDiOlYh.exe2⤵
-
-
C:\Windows\System\KtrqOwL.exeC:\Windows\System\KtrqOwL.exe2⤵
-
-
C:\Windows\System\xTpRbPh.exeC:\Windows\System\xTpRbPh.exe2⤵
-
-
C:\Windows\System\bNrqbCC.exeC:\Windows\System\bNrqbCC.exe2⤵
-
-
C:\Windows\System\TWxRIGE.exeC:\Windows\System\TWxRIGE.exe2⤵
-
-
C:\Windows\System\aTfoFNV.exeC:\Windows\System\aTfoFNV.exe2⤵
-
-
C:\Windows\System\TuKhhgT.exeC:\Windows\System\TuKhhgT.exe2⤵
-
-
C:\Windows\System\ToksgsN.exeC:\Windows\System\ToksgsN.exe2⤵
-
-
C:\Windows\System\cDGGZTQ.exeC:\Windows\System\cDGGZTQ.exe2⤵
-
-
C:\Windows\System\ZIGjcLD.exeC:\Windows\System\ZIGjcLD.exe2⤵
-
-
C:\Windows\System\SHMPSzC.exeC:\Windows\System\SHMPSzC.exe2⤵
-
-
C:\Windows\System\UcdrmeW.exeC:\Windows\System\UcdrmeW.exe2⤵
-
-
C:\Windows\System\hTTvXeW.exeC:\Windows\System\hTTvXeW.exe2⤵
-
-
C:\Windows\System\ydwskns.exeC:\Windows\System\ydwskns.exe2⤵
-
-
C:\Windows\System\KfMRvNm.exeC:\Windows\System\KfMRvNm.exe2⤵
-
-
C:\Windows\System\ShOuYoc.exeC:\Windows\System\ShOuYoc.exe2⤵
-
-
C:\Windows\System\sPikEPb.exeC:\Windows\System\sPikEPb.exe2⤵
-
-
C:\Windows\System\vGZKsBL.exeC:\Windows\System\vGZKsBL.exe2⤵
-
-
C:\Windows\System\SkiazsV.exeC:\Windows\System\SkiazsV.exe2⤵
-
-
C:\Windows\System\UsZPLjV.exeC:\Windows\System\UsZPLjV.exe2⤵
-
-
C:\Windows\System\XeqBDyI.exeC:\Windows\System\XeqBDyI.exe2⤵
-
-
C:\Windows\System\sGhayOV.exeC:\Windows\System\sGhayOV.exe2⤵
-
-
C:\Windows\System\jKgTzsD.exeC:\Windows\System\jKgTzsD.exe2⤵
-
-
C:\Windows\System\LxTnjaY.exeC:\Windows\System\LxTnjaY.exe2⤵
-
-
C:\Windows\System\kYdUylo.exeC:\Windows\System\kYdUylo.exe2⤵
-
-
C:\Windows\System\LXvQSGN.exeC:\Windows\System\LXvQSGN.exe2⤵
-
-
C:\Windows\System\vJZHEKf.exeC:\Windows\System\vJZHEKf.exe2⤵
-
-
C:\Windows\System\eOFhqQE.exeC:\Windows\System\eOFhqQE.exe2⤵
-
-
C:\Windows\System\DpgFHPi.exeC:\Windows\System\DpgFHPi.exe2⤵
-
-
C:\Windows\System\gxJCgJs.exeC:\Windows\System\gxJCgJs.exe2⤵
-
-
C:\Windows\System\LgsJrWZ.exeC:\Windows\System\LgsJrWZ.exe2⤵
-
-
C:\Windows\System\AEoHQxo.exeC:\Windows\System\AEoHQxo.exe2⤵
-
-
C:\Windows\System\uWxmvfL.exeC:\Windows\System\uWxmvfL.exe2⤵
-
-
C:\Windows\System\AVcQhml.exeC:\Windows\System\AVcQhml.exe2⤵
-
-
C:\Windows\System\ZSqkLWN.exeC:\Windows\System\ZSqkLWN.exe2⤵
-
-
C:\Windows\System\NSkSfgq.exeC:\Windows\System\NSkSfgq.exe2⤵
-
-
C:\Windows\System\AETckKg.exeC:\Windows\System\AETckKg.exe2⤵
-
-
C:\Windows\System\rOVBPvH.exeC:\Windows\System\rOVBPvH.exe2⤵
-
-
C:\Windows\System\zvrTSbj.exeC:\Windows\System\zvrTSbj.exe2⤵
-
-
C:\Windows\System\EOigODv.exeC:\Windows\System\EOigODv.exe2⤵
-
-
C:\Windows\System\lNrNBLI.exeC:\Windows\System\lNrNBLI.exe2⤵
-
-
C:\Windows\System\yvNAsxr.exeC:\Windows\System\yvNAsxr.exe2⤵
-
-
C:\Windows\System\KMoAeRL.exeC:\Windows\System\KMoAeRL.exe2⤵
-
-
C:\Windows\System\xeHqcGy.exeC:\Windows\System\xeHqcGy.exe2⤵
-
-
C:\Windows\System\RXOBRol.exeC:\Windows\System\RXOBRol.exe2⤵
-
-
C:\Windows\System\HyWTCck.exeC:\Windows\System\HyWTCck.exe2⤵
-
-
C:\Windows\System\pvudZXb.exeC:\Windows\System\pvudZXb.exe2⤵
-
-
C:\Windows\System\MvORYtu.exeC:\Windows\System\MvORYtu.exe2⤵
-
-
C:\Windows\System\ylSJBmY.exeC:\Windows\System\ylSJBmY.exe2⤵
-
-
C:\Windows\System\ThrYCHK.exeC:\Windows\System\ThrYCHK.exe2⤵
-
-
C:\Windows\System\PfhnwSn.exeC:\Windows\System\PfhnwSn.exe2⤵
-
-
C:\Windows\System\RaCwfSE.exeC:\Windows\System\RaCwfSE.exe2⤵
-
-
C:\Windows\System\zagCMJl.exeC:\Windows\System\zagCMJl.exe2⤵
-
-
C:\Windows\System\lqJhNQN.exeC:\Windows\System\lqJhNQN.exe2⤵
-
-
C:\Windows\System\jPIVBrG.exeC:\Windows\System\jPIVBrG.exe2⤵
-
-
C:\Windows\System\FwJMAuC.exeC:\Windows\System\FwJMAuC.exe2⤵
-
-
C:\Windows\System\xlUIryy.exeC:\Windows\System\xlUIryy.exe2⤵
-
-
C:\Windows\System\sVlrGjX.exeC:\Windows\System\sVlrGjX.exe2⤵
-
-
C:\Windows\System\MMtbOSD.exeC:\Windows\System\MMtbOSD.exe2⤵
-
-
C:\Windows\System\zZOIlJD.exeC:\Windows\System\zZOIlJD.exe2⤵
-
-
C:\Windows\System\xSZjNqQ.exeC:\Windows\System\xSZjNqQ.exe2⤵
-
-
C:\Windows\System\IgNMilA.exeC:\Windows\System\IgNMilA.exe2⤵
-
-
C:\Windows\System\cxGRhdg.exeC:\Windows\System\cxGRhdg.exe2⤵
-
-
C:\Windows\System\CnqMBjD.exeC:\Windows\System\CnqMBjD.exe2⤵
-
-
C:\Windows\System\OWBHTNf.exeC:\Windows\System\OWBHTNf.exe2⤵
-
-
C:\Windows\System\RujbwaE.exeC:\Windows\System\RujbwaE.exe2⤵
-
-
C:\Windows\System\LqNCqQx.exeC:\Windows\System\LqNCqQx.exe2⤵
-
-
C:\Windows\System\SyNaBGZ.exeC:\Windows\System\SyNaBGZ.exe2⤵
-
-
C:\Windows\System\RKmrojv.exeC:\Windows\System\RKmrojv.exe2⤵
-
-
C:\Windows\System\PZSWiqH.exeC:\Windows\System\PZSWiqH.exe2⤵
-
-
C:\Windows\System\IhJJqLK.exeC:\Windows\System\IhJJqLK.exe2⤵
-
-
C:\Windows\System\gygMhJd.exeC:\Windows\System\gygMhJd.exe2⤵
-
-
C:\Windows\System\pQnYWev.exeC:\Windows\System\pQnYWev.exe2⤵
-
-
C:\Windows\System\UHpMozS.exeC:\Windows\System\UHpMozS.exe2⤵
-
-
C:\Windows\System\lKwlHsd.exeC:\Windows\System\lKwlHsd.exe2⤵
-
-
C:\Windows\System\fixCcsS.exeC:\Windows\System\fixCcsS.exe2⤵
-
-
C:\Windows\System\pTIPlfL.exeC:\Windows\System\pTIPlfL.exe2⤵
-
-
C:\Windows\System\payIYxf.exeC:\Windows\System\payIYxf.exe2⤵
-
-
C:\Windows\System\aGTeEwp.exeC:\Windows\System\aGTeEwp.exe2⤵
-
-
C:\Windows\System\bPbtHOX.exeC:\Windows\System\bPbtHOX.exe2⤵
-
-
C:\Windows\System\yflOAyD.exeC:\Windows\System\yflOAyD.exe2⤵
-
-
C:\Windows\System\HEiQiVY.exeC:\Windows\System\HEiQiVY.exe2⤵
-
-
C:\Windows\System\AndYDmT.exeC:\Windows\System\AndYDmT.exe2⤵
-
-
C:\Windows\System\QmpzoAv.exeC:\Windows\System\QmpzoAv.exe2⤵
-
-
C:\Windows\System\ROAGJPx.exeC:\Windows\System\ROAGJPx.exe2⤵
-
-
C:\Windows\System\uAyvzGX.exeC:\Windows\System\uAyvzGX.exe2⤵
-
-
C:\Windows\System\yvYwZJX.exeC:\Windows\System\yvYwZJX.exe2⤵
-
-
C:\Windows\System\xmNIAOM.exeC:\Windows\System\xmNIAOM.exe2⤵
-
-
C:\Windows\System\vGJXYel.exeC:\Windows\System\vGJXYel.exe2⤵
-
-
C:\Windows\System\DqiklfT.exeC:\Windows\System\DqiklfT.exe2⤵
-
-
C:\Windows\System\OlZxnFx.exeC:\Windows\System\OlZxnFx.exe2⤵
-
-
C:\Windows\System\fXatxdM.exeC:\Windows\System\fXatxdM.exe2⤵
-
-
C:\Windows\System\CEITjHB.exeC:\Windows\System\CEITjHB.exe2⤵
-
-
C:\Windows\System\sUwXyuG.exeC:\Windows\System\sUwXyuG.exe2⤵
-
-
C:\Windows\System\mqfQeNG.exeC:\Windows\System\mqfQeNG.exe2⤵
-
-
C:\Windows\System\rGXpnKj.exeC:\Windows\System\rGXpnKj.exe2⤵
-
-
C:\Windows\System\OeSaPtL.exeC:\Windows\System\OeSaPtL.exe2⤵
-
-
C:\Windows\System\racEsIw.exeC:\Windows\System\racEsIw.exe2⤵
-
-
C:\Windows\System\jAWHqPO.exeC:\Windows\System\jAWHqPO.exe2⤵
-
-
C:\Windows\System\MabkCJG.exeC:\Windows\System\MabkCJG.exe2⤵
-
-
C:\Windows\System\ENHSiZy.exeC:\Windows\System\ENHSiZy.exe2⤵
-
-
C:\Windows\System\tFyXNBH.exeC:\Windows\System\tFyXNBH.exe2⤵
-
-
C:\Windows\System\CQwzexh.exeC:\Windows\System\CQwzexh.exe2⤵
-
-
C:\Windows\System\sfWIfoE.exeC:\Windows\System\sfWIfoE.exe2⤵
-
-
C:\Windows\System\skkdWeI.exeC:\Windows\System\skkdWeI.exe2⤵
-
-
C:\Windows\System\TomFUwS.exeC:\Windows\System\TomFUwS.exe2⤵
-
-
C:\Windows\System\WMGNAth.exeC:\Windows\System\WMGNAth.exe2⤵
-
-
C:\Windows\System\ZbteFop.exeC:\Windows\System\ZbteFop.exe2⤵
-
-
C:\Windows\System\RmHDPmU.exeC:\Windows\System\RmHDPmU.exe2⤵
-
-
C:\Windows\System\FlAYurr.exeC:\Windows\System\FlAYurr.exe2⤵
-
-
C:\Windows\System\cGeovrf.exeC:\Windows\System\cGeovrf.exe2⤵
-
-
C:\Windows\System\GSYPtFk.exeC:\Windows\System\GSYPtFk.exe2⤵
-
-
C:\Windows\System\difmvnz.exeC:\Windows\System\difmvnz.exe2⤵
-
-
C:\Windows\System\yPhQJfk.exeC:\Windows\System\yPhQJfk.exe2⤵
-
-
C:\Windows\System\LxYpUkZ.exeC:\Windows\System\LxYpUkZ.exe2⤵
-
-
C:\Windows\System\JvqWhhQ.exeC:\Windows\System\JvqWhhQ.exe2⤵
-
-
C:\Windows\System\TwkjVhe.exeC:\Windows\System\TwkjVhe.exe2⤵
-
-
C:\Windows\System\spIeXHp.exeC:\Windows\System\spIeXHp.exe2⤵
-
-
C:\Windows\System\UGPqqHe.exeC:\Windows\System\UGPqqHe.exe2⤵
-
-
C:\Windows\System\qUqjYWu.exeC:\Windows\System\qUqjYWu.exe2⤵
-
-
C:\Windows\System\PiAEZNz.exeC:\Windows\System\PiAEZNz.exe2⤵
-
-
C:\Windows\System\duyYYKN.exeC:\Windows\System\duyYYKN.exe2⤵
-
-
C:\Windows\System\DdONaPf.exeC:\Windows\System\DdONaPf.exe2⤵
-
-
C:\Windows\System\tTKAPtj.exeC:\Windows\System\tTKAPtj.exe2⤵
-
-
C:\Windows\System\ogaHpjM.exeC:\Windows\System\ogaHpjM.exe2⤵
-
-
C:\Windows\System\vtXzMuH.exeC:\Windows\System\vtXzMuH.exe2⤵
-
-
C:\Windows\System\rzoKhli.exeC:\Windows\System\rzoKhli.exe2⤵
-
-
C:\Windows\System\GxbxiSJ.exeC:\Windows\System\GxbxiSJ.exe2⤵
-
-
C:\Windows\System\mPzHZxO.exeC:\Windows\System\mPzHZxO.exe2⤵
-
-
C:\Windows\System\gbEGBic.exeC:\Windows\System\gbEGBic.exe2⤵
-
-
C:\Windows\System\kWpnFVD.exeC:\Windows\System\kWpnFVD.exe2⤵
-
-
C:\Windows\System\yylhRgr.exeC:\Windows\System\yylhRgr.exe2⤵
-
-
C:\Windows\System\UtlNxFB.exeC:\Windows\System\UtlNxFB.exe2⤵
-
-
C:\Windows\System\GZNrWKN.exeC:\Windows\System\GZNrWKN.exe2⤵
-
-
C:\Windows\System\dUsKNEA.exeC:\Windows\System\dUsKNEA.exe2⤵
-
-
C:\Windows\System\XioWTOK.exeC:\Windows\System\XioWTOK.exe2⤵
-
-
C:\Windows\System\TaUVURH.exeC:\Windows\System\TaUVURH.exe2⤵
-
-
C:\Windows\System\kBxiDht.exeC:\Windows\System\kBxiDht.exe2⤵
-
-
C:\Windows\System\JSnpnqm.exeC:\Windows\System\JSnpnqm.exe2⤵
-
-
C:\Windows\System\ZhdGVVA.exeC:\Windows\System\ZhdGVVA.exe2⤵
-
-
C:\Windows\System\tGOHluU.exeC:\Windows\System\tGOHluU.exe2⤵
-
-
C:\Windows\System\yQbzoQX.exeC:\Windows\System\yQbzoQX.exe2⤵
-
-
C:\Windows\System\BgzYjZD.exeC:\Windows\System\BgzYjZD.exe2⤵
-
-
C:\Windows\System\uzvuOfk.exeC:\Windows\System\uzvuOfk.exe2⤵
-
-
C:\Windows\System\WujykBE.exeC:\Windows\System\WujykBE.exe2⤵
-
-
C:\Windows\System\WSgvOKr.exeC:\Windows\System\WSgvOKr.exe2⤵
-
-
C:\Windows\System\DEbgPUl.exeC:\Windows\System\DEbgPUl.exe2⤵
-
-
C:\Windows\System\MfdrzHB.exeC:\Windows\System\MfdrzHB.exe2⤵
-
-
C:\Windows\System\cxbHhyy.exeC:\Windows\System\cxbHhyy.exe2⤵
-
-
C:\Windows\System\HcrzvOC.exeC:\Windows\System\HcrzvOC.exe2⤵
-
-
C:\Windows\System\lgOOJFG.exeC:\Windows\System\lgOOJFG.exe2⤵
-
-
C:\Windows\System\wQJEQek.exeC:\Windows\System\wQJEQek.exe2⤵
-
-
C:\Windows\System\MdkvSNq.exeC:\Windows\System\MdkvSNq.exe2⤵
-
-
C:\Windows\System\bYWZeZk.exeC:\Windows\System\bYWZeZk.exe2⤵
-
-
C:\Windows\System\ybEWBQw.exeC:\Windows\System\ybEWBQw.exe2⤵
-
-
C:\Windows\System\nnVaaEz.exeC:\Windows\System\nnVaaEz.exe2⤵
-
-
C:\Windows\System\ADilUZM.exeC:\Windows\System\ADilUZM.exe2⤵
-
-
C:\Windows\System\dIGDxsy.exeC:\Windows\System\dIGDxsy.exe2⤵
-
-
C:\Windows\System\sMykXJZ.exeC:\Windows\System\sMykXJZ.exe2⤵
-
-
C:\Windows\System\slZhuPU.exeC:\Windows\System\slZhuPU.exe2⤵
-
-
C:\Windows\System\HPCtPQg.exeC:\Windows\System\HPCtPQg.exe2⤵
-
-
C:\Windows\System\GaOsaVB.exeC:\Windows\System\GaOsaVB.exe2⤵
-
-
C:\Windows\System\bXBlhgs.exeC:\Windows\System\bXBlhgs.exe2⤵
-
-
C:\Windows\System\bqTWPYS.exeC:\Windows\System\bqTWPYS.exe2⤵
-
-
C:\Windows\System\ZmEZXqr.exeC:\Windows\System\ZmEZXqr.exe2⤵
-
-
C:\Windows\System\JSLfobI.exeC:\Windows\System\JSLfobI.exe2⤵
-
-
C:\Windows\System\ZxewYMz.exeC:\Windows\System\ZxewYMz.exe2⤵
-
-
C:\Windows\System\CiCglNC.exeC:\Windows\System\CiCglNC.exe2⤵
-
-
C:\Windows\System\aOIrnJc.exeC:\Windows\System\aOIrnJc.exe2⤵
-
-
C:\Windows\System\NURbxUH.exeC:\Windows\System\NURbxUH.exe2⤵
-
-
C:\Windows\System\PNfwPow.exeC:\Windows\System\PNfwPow.exe2⤵
-
-
C:\Windows\System\erkSIfX.exeC:\Windows\System\erkSIfX.exe2⤵
-
-
C:\Windows\System\YeSSwxm.exeC:\Windows\System\YeSSwxm.exe2⤵
-
-
C:\Windows\System\dekAZts.exeC:\Windows\System\dekAZts.exe2⤵
-
-
C:\Windows\System\wFDZYNT.exeC:\Windows\System\wFDZYNT.exe2⤵
-
-
C:\Windows\System\LOKgCXD.exeC:\Windows\System\LOKgCXD.exe2⤵
-
-
C:\Windows\System\WtqdRvu.exeC:\Windows\System\WtqdRvu.exe2⤵
-
-
C:\Windows\System\qNYJCpS.exeC:\Windows\System\qNYJCpS.exe2⤵
-
-
C:\Windows\System\qwtzZaY.exeC:\Windows\System\qwtzZaY.exe2⤵
-
-
C:\Windows\System\NEPECln.exeC:\Windows\System\NEPECln.exe2⤵
-
-
C:\Windows\System\otyNIqX.exeC:\Windows\System\otyNIqX.exe2⤵
-
-
C:\Windows\System\yNmNiVy.exeC:\Windows\System\yNmNiVy.exe2⤵
-
-
C:\Windows\System\xdogBBQ.exeC:\Windows\System\xdogBBQ.exe2⤵
-
-
C:\Windows\System\xFmstSb.exeC:\Windows\System\xFmstSb.exe2⤵
-
-
C:\Windows\System\vHOCrRp.exeC:\Windows\System\vHOCrRp.exe2⤵
-
-
C:\Windows\System\vqZBZfW.exeC:\Windows\System\vqZBZfW.exe2⤵
-
-
C:\Windows\System\tkbZLAl.exeC:\Windows\System\tkbZLAl.exe2⤵
-
-
C:\Windows\System\kJEhDmq.exeC:\Windows\System\kJEhDmq.exe2⤵
-
-
C:\Windows\System\LPEwMWg.exeC:\Windows\System\LPEwMWg.exe2⤵
-
-
C:\Windows\System\DxYdbjX.exeC:\Windows\System\DxYdbjX.exe2⤵
-
-
C:\Windows\System\qFtZnKQ.exeC:\Windows\System\qFtZnKQ.exe2⤵
-
-
C:\Windows\System\MlyZThR.exeC:\Windows\System\MlyZThR.exe2⤵
-
-
C:\Windows\System\NBNpPJC.exeC:\Windows\System\NBNpPJC.exe2⤵
-
-
C:\Windows\System\HDygjvE.exeC:\Windows\System\HDygjvE.exe2⤵
-
-
C:\Windows\System\LMTytat.exeC:\Windows\System\LMTytat.exe2⤵
-
-
C:\Windows\System\dOZWrPM.exeC:\Windows\System\dOZWrPM.exe2⤵
-
-
C:\Windows\System\OsxAkla.exeC:\Windows\System\OsxAkla.exe2⤵
-
-
C:\Windows\System\XHDLnCp.exeC:\Windows\System\XHDLnCp.exe2⤵
-
-
C:\Windows\System\SnkXbGZ.exeC:\Windows\System\SnkXbGZ.exe2⤵
-
-
C:\Windows\System\YDLiVeY.exeC:\Windows\System\YDLiVeY.exe2⤵
-
-
C:\Windows\System\AvDRpjg.exeC:\Windows\System\AvDRpjg.exe2⤵
-
-
C:\Windows\System\ozCgXcK.exeC:\Windows\System\ozCgXcK.exe2⤵
-
-
C:\Windows\System\sgWzgfU.exeC:\Windows\System\sgWzgfU.exe2⤵
-
-
C:\Windows\System\EmbOfLK.exeC:\Windows\System\EmbOfLK.exe2⤵
-
-
C:\Windows\System\YhSAjWL.exeC:\Windows\System\YhSAjWL.exe2⤵
-
-
C:\Windows\System\GMHsTKY.exeC:\Windows\System\GMHsTKY.exe2⤵
-
-
C:\Windows\System\SrBGVfQ.exeC:\Windows\System\SrBGVfQ.exe2⤵
-
-
C:\Windows\System\QQqbdHd.exeC:\Windows\System\QQqbdHd.exe2⤵
-
-
C:\Windows\System\slgFUjK.exeC:\Windows\System\slgFUjK.exe2⤵
-
-
C:\Windows\System\GkMmxZz.exeC:\Windows\System\GkMmxZz.exe2⤵
-
-
C:\Windows\System\kqkPUFN.exeC:\Windows\System\kqkPUFN.exe2⤵
-
-
C:\Windows\System\sLTnVQC.exeC:\Windows\System\sLTnVQC.exe2⤵
-
-
C:\Windows\System\qAvpjWV.exeC:\Windows\System\qAvpjWV.exe2⤵
-
-
C:\Windows\System\SZzJUqS.exeC:\Windows\System\SZzJUqS.exe2⤵
-
-
C:\Windows\System\RxpgvBg.exeC:\Windows\System\RxpgvBg.exe2⤵
-
-
C:\Windows\System\agliRRS.exeC:\Windows\System\agliRRS.exe2⤵
-
-
C:\Windows\System\ICXnMlZ.exeC:\Windows\System\ICXnMlZ.exe2⤵
-
-
C:\Windows\System\CybnpJF.exeC:\Windows\System\CybnpJF.exe2⤵
-
-
C:\Windows\System\IeLxUjs.exeC:\Windows\System\IeLxUjs.exe2⤵
-
-
C:\Windows\System\AfljpoC.exeC:\Windows\System\AfljpoC.exe2⤵
-
-
C:\Windows\System\zZkUItl.exeC:\Windows\System\zZkUItl.exe2⤵
-
-
C:\Windows\System\teuWgBK.exeC:\Windows\System\teuWgBK.exe2⤵
-
-
C:\Windows\System\ghLoZrE.exeC:\Windows\System\ghLoZrE.exe2⤵
-
-
C:\Windows\System\CuCgpYq.exeC:\Windows\System\CuCgpYq.exe2⤵
-
-
C:\Windows\System\zWRCzmj.exeC:\Windows\System\zWRCzmj.exe2⤵
-
-
C:\Windows\System\JPkGJHC.exeC:\Windows\System\JPkGJHC.exe2⤵
-
-
C:\Windows\System\UoTNIgX.exeC:\Windows\System\UoTNIgX.exe2⤵
-
-
C:\Windows\System\TloBiUY.exeC:\Windows\System\TloBiUY.exe2⤵
-
-
C:\Windows\System\tPHsWFc.exeC:\Windows\System\tPHsWFc.exe2⤵
-
-
C:\Windows\System\cRWWKNT.exeC:\Windows\System\cRWWKNT.exe2⤵
-
-
C:\Windows\System\FmxGFCY.exeC:\Windows\System\FmxGFCY.exe2⤵
-
-
C:\Windows\System\eaEWzdA.exeC:\Windows\System\eaEWzdA.exe2⤵
-
-
C:\Windows\System\idrMBLW.exeC:\Windows\System\idrMBLW.exe2⤵
-
-
C:\Windows\System\HAwyJWF.exeC:\Windows\System\HAwyJWF.exe2⤵
-
-
C:\Windows\System\XoYiBSF.exeC:\Windows\System\XoYiBSF.exe2⤵
-
-
C:\Windows\System\rrgKGMY.exeC:\Windows\System\rrgKGMY.exe2⤵
-
-
C:\Windows\System\MRudEvT.exeC:\Windows\System\MRudEvT.exe2⤵
-
-
C:\Windows\System\XRcfpTR.exeC:\Windows\System\XRcfpTR.exe2⤵
-
-
C:\Windows\System\BTRBOIm.exeC:\Windows\System\BTRBOIm.exe2⤵
-
-
C:\Windows\System\tpmjbSP.exeC:\Windows\System\tpmjbSP.exe2⤵
-
-
C:\Windows\System\Nqljkrb.exeC:\Windows\System\Nqljkrb.exe2⤵
-
-
C:\Windows\System\vqEmJde.exeC:\Windows\System\vqEmJde.exe2⤵
-
-
C:\Windows\System\OiKLlLt.exeC:\Windows\System\OiKLlLt.exe2⤵
-
-
C:\Windows\System\WdxzEqt.exeC:\Windows\System\WdxzEqt.exe2⤵
-
-
C:\Windows\System\cBwkVNe.exeC:\Windows\System\cBwkVNe.exe2⤵
-
-
C:\Windows\System\OPMGEGp.exeC:\Windows\System\OPMGEGp.exe2⤵
-
-
C:\Windows\System\DsRKuJh.exeC:\Windows\System\DsRKuJh.exe2⤵
-
-
C:\Windows\System\xjKHyRt.exeC:\Windows\System\xjKHyRt.exe2⤵
-
-
C:\Windows\System\VHMSSUM.exeC:\Windows\System\VHMSSUM.exe2⤵
-
-
C:\Windows\System\dKVnbil.exeC:\Windows\System\dKVnbil.exe2⤵
-
-
C:\Windows\System\oQnzDdP.exeC:\Windows\System\oQnzDdP.exe2⤵
-
-
C:\Windows\System\zHGnBJU.exeC:\Windows\System\zHGnBJU.exe2⤵
-
-
C:\Windows\System\icLVYmL.exeC:\Windows\System\icLVYmL.exe2⤵
-
-
C:\Windows\System\qaxNmss.exeC:\Windows\System\qaxNmss.exe2⤵
-
-
C:\Windows\System\dCiHTMk.exeC:\Windows\System\dCiHTMk.exe2⤵
-
-
C:\Windows\System\QTMfUAx.exeC:\Windows\System\QTMfUAx.exe2⤵
-
-
C:\Windows\System\axdpKFT.exeC:\Windows\System\axdpKFT.exe2⤵
-
-
C:\Windows\System\CUFgIma.exeC:\Windows\System\CUFgIma.exe2⤵
-
-
C:\Windows\System\oUdAUyB.exeC:\Windows\System\oUdAUyB.exe2⤵
-
-
C:\Windows\System\ENyXvpU.exeC:\Windows\System\ENyXvpU.exe2⤵
-
-
C:\Windows\System\hDicWqm.exeC:\Windows\System\hDicWqm.exe2⤵
-
-
C:\Windows\System\uvgBvVq.exeC:\Windows\System\uvgBvVq.exe2⤵
-
-
C:\Windows\System\gVuASqe.exeC:\Windows\System\gVuASqe.exe2⤵
-
-
C:\Windows\System\EGFuTib.exeC:\Windows\System\EGFuTib.exe2⤵
-
-
C:\Windows\System\bJyrTxT.exeC:\Windows\System\bJyrTxT.exe2⤵
-
-
C:\Windows\System\YBsPatP.exeC:\Windows\System\YBsPatP.exe2⤵
-
-
C:\Windows\System\BgcpkPr.exeC:\Windows\System\BgcpkPr.exe2⤵
-
-
C:\Windows\System\msyjUGa.exeC:\Windows\System\msyjUGa.exe2⤵
-
-
C:\Windows\System\YceRDAG.exeC:\Windows\System\YceRDAG.exe2⤵
-
-
C:\Windows\System\DNyAngy.exeC:\Windows\System\DNyAngy.exe2⤵
-
-
C:\Windows\System\mhrBcbg.exeC:\Windows\System\mhrBcbg.exe2⤵
-
-
C:\Windows\System\LvQNczU.exeC:\Windows\System\LvQNczU.exe2⤵
-
-
C:\Windows\System\JDhaUxV.exeC:\Windows\System\JDhaUxV.exe2⤵
-
-
C:\Windows\System\fVQFRth.exeC:\Windows\System\fVQFRth.exe2⤵
-
-
C:\Windows\System\oGksAzC.exeC:\Windows\System\oGksAzC.exe2⤵
-
-
C:\Windows\System\NMiZEXm.exeC:\Windows\System\NMiZEXm.exe2⤵
-
-
C:\Windows\System\JqJUwsk.exeC:\Windows\System\JqJUwsk.exe2⤵
-
-
C:\Windows\System\XMdaciz.exeC:\Windows\System\XMdaciz.exe2⤵
-
-
C:\Windows\System\gVpjnUR.exeC:\Windows\System\gVpjnUR.exe2⤵
-
-
C:\Windows\System\WaQvmAk.exeC:\Windows\System\WaQvmAk.exe2⤵
-
-
C:\Windows\System\xsEBrnY.exeC:\Windows\System\xsEBrnY.exe2⤵
-
-
C:\Windows\System\qgyRmeM.exeC:\Windows\System\qgyRmeM.exe2⤵
-
-
C:\Windows\System\tnkjWRq.exeC:\Windows\System\tnkjWRq.exe2⤵
-
-
C:\Windows\System\QaGNaWL.exeC:\Windows\System\QaGNaWL.exe2⤵
-
-
C:\Windows\System\uKkkhON.exeC:\Windows\System\uKkkhON.exe2⤵
-
-
C:\Windows\System\HuKgTSz.exeC:\Windows\System\HuKgTSz.exe2⤵
-
-
C:\Windows\System\PaNCeCL.exeC:\Windows\System\PaNCeCL.exe2⤵
-
-
C:\Windows\System\ncqpkcV.exeC:\Windows\System\ncqpkcV.exe2⤵
-
-
C:\Windows\System\tnXmDrK.exeC:\Windows\System\tnXmDrK.exe2⤵
-
-
C:\Windows\System\sicgXnG.exeC:\Windows\System\sicgXnG.exe2⤵
-
-
C:\Windows\System\wiAIUcD.exeC:\Windows\System\wiAIUcD.exe2⤵
-
-
C:\Windows\System\SBKAHWi.exeC:\Windows\System\SBKAHWi.exe2⤵
-
-
C:\Windows\System\SrqAalj.exeC:\Windows\System\SrqAalj.exe2⤵
-
-
C:\Windows\System\wxtUpLG.exeC:\Windows\System\wxtUpLG.exe2⤵
-
-
C:\Windows\System\kWZnnAD.exeC:\Windows\System\kWZnnAD.exe2⤵
-
-
C:\Windows\System\tQmWsdY.exeC:\Windows\System\tQmWsdY.exe2⤵
-
-
C:\Windows\System\XqlYyhV.exeC:\Windows\System\XqlYyhV.exe2⤵
-
-
C:\Windows\System\hvtdHud.exeC:\Windows\System\hvtdHud.exe2⤵
-
-
C:\Windows\System\REjzspS.exeC:\Windows\System\REjzspS.exe2⤵
-
-
C:\Windows\System\LaZUKWB.exeC:\Windows\System\LaZUKWB.exe2⤵
-
-
C:\Windows\System\sLDFxlj.exeC:\Windows\System\sLDFxlj.exe2⤵
-
-
C:\Windows\System\AtzEVZs.exeC:\Windows\System\AtzEVZs.exe2⤵
-
-
C:\Windows\System\RdkzrNY.exeC:\Windows\System\RdkzrNY.exe2⤵
-
-
C:\Windows\System\axqtYgM.exeC:\Windows\System\axqtYgM.exe2⤵
-
-
C:\Windows\System\bIrMevV.exeC:\Windows\System\bIrMevV.exe2⤵
-
-
C:\Windows\System\zzNcnGm.exeC:\Windows\System\zzNcnGm.exe2⤵
-
-
C:\Windows\System\NgiSxEe.exeC:\Windows\System\NgiSxEe.exe2⤵
-
-
C:\Windows\System\yBYPJCf.exeC:\Windows\System\yBYPJCf.exe2⤵
-
-
C:\Windows\System\pqgzYuo.exeC:\Windows\System\pqgzYuo.exe2⤵
-
-
C:\Windows\System\UXQnPgg.exeC:\Windows\System\UXQnPgg.exe2⤵
-
-
C:\Windows\System\YGnVtqu.exeC:\Windows\System\YGnVtqu.exe2⤵
-
-
C:\Windows\System\hMQJGzM.exeC:\Windows\System\hMQJGzM.exe2⤵
-
-
C:\Windows\System\OsFegnB.exeC:\Windows\System\OsFegnB.exe2⤵
-
-
C:\Windows\System\TxepbGo.exeC:\Windows\System\TxepbGo.exe2⤵
-
-
C:\Windows\System\auSpgpv.exeC:\Windows\System\auSpgpv.exe2⤵
-
-
C:\Windows\System\hECelKZ.exeC:\Windows\System\hECelKZ.exe2⤵
-
-
C:\Windows\System\BqTbbZZ.exeC:\Windows\System\BqTbbZZ.exe2⤵
-
-
C:\Windows\System\rkcgxlS.exeC:\Windows\System\rkcgxlS.exe2⤵
-
-
C:\Windows\System\MrAfFRY.exeC:\Windows\System\MrAfFRY.exe2⤵
-
-
C:\Windows\System\KGiEVhL.exeC:\Windows\System\KGiEVhL.exe2⤵
-
-
C:\Windows\System\pXFVkJV.exeC:\Windows\System\pXFVkJV.exe2⤵
-
-
C:\Windows\System\NbOMHPr.exeC:\Windows\System\NbOMHPr.exe2⤵
-
-
C:\Windows\System\LhBAkKe.exeC:\Windows\System\LhBAkKe.exe2⤵
-
-
C:\Windows\System\coNBtbD.exeC:\Windows\System\coNBtbD.exe2⤵
-
-
C:\Windows\System\AFMgWVl.exeC:\Windows\System\AFMgWVl.exe2⤵
-
-
C:\Windows\System\gAsOMds.exeC:\Windows\System\gAsOMds.exe2⤵
-
-
C:\Windows\System\hvtfIUp.exeC:\Windows\System\hvtfIUp.exe2⤵
-
-
C:\Windows\System\hLWroaI.exeC:\Windows\System\hLWroaI.exe2⤵
-
-
C:\Windows\System\cEEsgvW.exeC:\Windows\System\cEEsgvW.exe2⤵
-
-
C:\Windows\System\kLAzHYW.exeC:\Windows\System\kLAzHYW.exe2⤵
-
-
C:\Windows\System\AxpVFfX.exeC:\Windows\System\AxpVFfX.exe2⤵
-
-
C:\Windows\System\FxSkjbC.exeC:\Windows\System\FxSkjbC.exe2⤵
-
-
C:\Windows\System\wyjTBXY.exeC:\Windows\System\wyjTBXY.exe2⤵
-
-
C:\Windows\System\acVmrtC.exeC:\Windows\System\acVmrtC.exe2⤵
-
-
C:\Windows\System\OSTVKNg.exeC:\Windows\System\OSTVKNg.exe2⤵
-
-
C:\Windows\System\NwVDbTc.exeC:\Windows\System\NwVDbTc.exe2⤵
-
-
C:\Windows\System\nmUStey.exeC:\Windows\System\nmUStey.exe2⤵
-
-
C:\Windows\System\rdWWLDy.exeC:\Windows\System\rdWWLDy.exe2⤵
-
-
C:\Windows\System\FEUwtvk.exeC:\Windows\System\FEUwtvk.exe2⤵
-
-
C:\Windows\System\BDeXKnJ.exeC:\Windows\System\BDeXKnJ.exe2⤵
-
-
C:\Windows\System\YwXQKDq.exeC:\Windows\System\YwXQKDq.exe2⤵
-
-
C:\Windows\System\SYbBlRR.exeC:\Windows\System\SYbBlRR.exe2⤵
-
-
C:\Windows\System\kNCeFMB.exeC:\Windows\System\kNCeFMB.exe2⤵
-
-
C:\Windows\System\oVGrzTs.exeC:\Windows\System\oVGrzTs.exe2⤵
-
-
C:\Windows\System\AwtRiup.exeC:\Windows\System\AwtRiup.exe2⤵
-
-
C:\Windows\System\WddDOta.exeC:\Windows\System\WddDOta.exe2⤵
-
-
C:\Windows\System\viRghDo.exeC:\Windows\System\viRghDo.exe2⤵
-
-
C:\Windows\System\VtZUBSk.exeC:\Windows\System\VtZUBSk.exe2⤵
-
-
C:\Windows\System\hjRkRVh.exeC:\Windows\System\hjRkRVh.exe2⤵
-
-
C:\Windows\System\rYKgyOu.exeC:\Windows\System\rYKgyOu.exe2⤵
-
-
C:\Windows\System\OLQbyDI.exeC:\Windows\System\OLQbyDI.exe2⤵
-
-
C:\Windows\System\vNthXIB.exeC:\Windows\System\vNthXIB.exe2⤵
-
-
C:\Windows\System\ZNYRchL.exeC:\Windows\System\ZNYRchL.exe2⤵
-
-
C:\Windows\System\YyZmnJF.exeC:\Windows\System\YyZmnJF.exe2⤵
-
-
C:\Windows\System\nrUuXUI.exeC:\Windows\System\nrUuXUI.exe2⤵
-
-
C:\Windows\System\CHxcytj.exeC:\Windows\System\CHxcytj.exe2⤵
-
-
C:\Windows\System\LHHVRfK.exeC:\Windows\System\LHHVRfK.exe2⤵
-
-
C:\Windows\System\iXrAwID.exeC:\Windows\System\iXrAwID.exe2⤵
-
-
C:\Windows\System\EtCuEli.exeC:\Windows\System\EtCuEli.exe2⤵
-
-
C:\Windows\System\esDhStO.exeC:\Windows\System\esDhStO.exe2⤵
-
-
C:\Windows\System\cITCUSR.exeC:\Windows\System\cITCUSR.exe2⤵
-
-
C:\Windows\System\zPvNHPM.exeC:\Windows\System\zPvNHPM.exe2⤵
-
-
C:\Windows\System\WeJOLzN.exeC:\Windows\System\WeJOLzN.exe2⤵
-
-
C:\Windows\System\IVEhriM.exeC:\Windows\System\IVEhriM.exe2⤵
-
-
C:\Windows\System\kRhJQeL.exeC:\Windows\System\kRhJQeL.exe2⤵
-
-
C:\Windows\System\qvAUhqI.exeC:\Windows\System\qvAUhqI.exe2⤵
-
-
C:\Windows\System\haAppfJ.exeC:\Windows\System\haAppfJ.exe2⤵
-
-
C:\Windows\System\wSRWBaH.exeC:\Windows\System\wSRWBaH.exe2⤵
-
-
C:\Windows\System\iUwvIWg.exeC:\Windows\System\iUwvIWg.exe2⤵
-
-
C:\Windows\System\frXTyxd.exeC:\Windows\System\frXTyxd.exe2⤵
-
-
C:\Windows\System\RtdLeZJ.exeC:\Windows\System\RtdLeZJ.exe2⤵
-
-
C:\Windows\System\bkNDcHP.exeC:\Windows\System\bkNDcHP.exe2⤵
-
-
C:\Windows\System\iGhnlgy.exeC:\Windows\System\iGhnlgy.exe2⤵
-
-
C:\Windows\System\wcYCKhZ.exeC:\Windows\System\wcYCKhZ.exe2⤵
-
-
C:\Windows\System\WTbtmtC.exeC:\Windows\System\WTbtmtC.exe2⤵
-
-
C:\Windows\System\imyuguQ.exeC:\Windows\System\imyuguQ.exe2⤵
-
-
C:\Windows\System\snyUXZm.exeC:\Windows\System\snyUXZm.exe2⤵
-
-
C:\Windows\System\lIIAWku.exeC:\Windows\System\lIIAWku.exe2⤵
-
-
C:\Windows\System\JtYcVFs.exeC:\Windows\System\JtYcVFs.exe2⤵
-
-
C:\Windows\System\kxzZvBR.exeC:\Windows\System\kxzZvBR.exe2⤵
-
-
C:\Windows\System\orRqoAy.exeC:\Windows\System\orRqoAy.exe2⤵
-
-
C:\Windows\System\GJPdEZd.exeC:\Windows\System\GJPdEZd.exe2⤵
-
-
C:\Windows\System\gjEPJXX.exeC:\Windows\System\gjEPJXX.exe2⤵
-
-
C:\Windows\System\mzvrOnh.exeC:\Windows\System\mzvrOnh.exe2⤵
-
-
C:\Windows\System\miUzOwU.exeC:\Windows\System\miUzOwU.exe2⤵
-
-
C:\Windows\System\hzDpkpE.exeC:\Windows\System\hzDpkpE.exe2⤵
-
-
C:\Windows\System\wEtLnSL.exeC:\Windows\System\wEtLnSL.exe2⤵
-
-
C:\Windows\System\fvJXmIt.exeC:\Windows\System\fvJXmIt.exe2⤵
-
-
C:\Windows\System\XfrdIaP.exeC:\Windows\System\XfrdIaP.exe2⤵
-
-
C:\Windows\System\orASdPz.exeC:\Windows\System\orASdPz.exe2⤵
-
-
C:\Windows\System\blZCUDo.exeC:\Windows\System\blZCUDo.exe2⤵
-
-
C:\Windows\System\JarovZG.exeC:\Windows\System\JarovZG.exe2⤵
-
-
C:\Windows\System\jRJAmUX.exeC:\Windows\System\jRJAmUX.exe2⤵
-
-
C:\Windows\System\YIoXukF.exeC:\Windows\System\YIoXukF.exe2⤵
-
-
C:\Windows\System\NARvaLc.exeC:\Windows\System\NARvaLc.exe2⤵
-
-
C:\Windows\System\IuzvYyZ.exeC:\Windows\System\IuzvYyZ.exe2⤵
-
-
C:\Windows\System\poKmaxF.exeC:\Windows\System\poKmaxF.exe2⤵
-
-
C:\Windows\System\gBOwnei.exeC:\Windows\System\gBOwnei.exe2⤵
-
-
C:\Windows\System\WcbRZEC.exeC:\Windows\System\WcbRZEC.exe2⤵
-
-
C:\Windows\System\YOyXGvx.exeC:\Windows\System\YOyXGvx.exe2⤵
-
-
C:\Windows\System\QyfBdXn.exeC:\Windows\System\QyfBdXn.exe2⤵
-
-
C:\Windows\System\DNFvAPP.exeC:\Windows\System\DNFvAPP.exe2⤵
-
-
C:\Windows\System\FXbrZoP.exeC:\Windows\System\FXbrZoP.exe2⤵
-
-
C:\Windows\System\uTDBmtn.exeC:\Windows\System\uTDBmtn.exe2⤵
-
-
C:\Windows\System\fGLkKVv.exeC:\Windows\System\fGLkKVv.exe2⤵
-
-
C:\Windows\System\jSkUmjB.exeC:\Windows\System\jSkUmjB.exe2⤵
-
-
C:\Windows\System\LwsqtCo.exeC:\Windows\System\LwsqtCo.exe2⤵
-
-
C:\Windows\System\FCbxANF.exeC:\Windows\System\FCbxANF.exe2⤵
-
-
C:\Windows\System\WxERIoH.exeC:\Windows\System\WxERIoH.exe2⤵
-
-
C:\Windows\System\HSiPAWY.exeC:\Windows\System\HSiPAWY.exe2⤵
-
-
C:\Windows\System\ImZHYpA.exeC:\Windows\System\ImZHYpA.exe2⤵
-
-
C:\Windows\System\KwwzjHE.exeC:\Windows\System\KwwzjHE.exe2⤵
-
-
C:\Windows\System\EofVbaU.exeC:\Windows\System\EofVbaU.exe2⤵
-
-
C:\Windows\System\tzYXhaC.exeC:\Windows\System\tzYXhaC.exe2⤵
-
-
C:\Windows\System\KHAiHqw.exeC:\Windows\System\KHAiHqw.exe2⤵
-
-
C:\Windows\System\kOrEKzn.exeC:\Windows\System\kOrEKzn.exe2⤵
-
-
C:\Windows\System\TNlCcuh.exeC:\Windows\System\TNlCcuh.exe2⤵
-
-
C:\Windows\System\LpvlSMc.exeC:\Windows\System\LpvlSMc.exe2⤵
-
-
C:\Windows\System\fcoeLPz.exeC:\Windows\System\fcoeLPz.exe2⤵
-
-
C:\Windows\System\pWNlYLf.exeC:\Windows\System\pWNlYLf.exe2⤵
-
-
C:\Windows\System\QzxmWjQ.exeC:\Windows\System\QzxmWjQ.exe2⤵
-
-
C:\Windows\System\vrDTTAE.exeC:\Windows\System\vrDTTAE.exe2⤵
-
-
C:\Windows\System\nhpRDnc.exeC:\Windows\System\nhpRDnc.exe2⤵
-
-
C:\Windows\System\kxHXdIg.exeC:\Windows\System\kxHXdIg.exe2⤵
-
-
C:\Windows\System\ykbzSrv.exeC:\Windows\System\ykbzSrv.exe2⤵
-
-
C:\Windows\System\hBKhFeS.exeC:\Windows\System\hBKhFeS.exe2⤵
-
-
C:\Windows\System\karIOAV.exeC:\Windows\System\karIOAV.exe2⤵
-
-
C:\Windows\System\dUIUDcD.exeC:\Windows\System\dUIUDcD.exe2⤵
-
-
C:\Windows\System\xfkCCYx.exeC:\Windows\System\xfkCCYx.exe2⤵
-
-
C:\Windows\System\jOxGGzZ.exeC:\Windows\System\jOxGGzZ.exe2⤵
-
-
C:\Windows\System\SfxXqjZ.exeC:\Windows\System\SfxXqjZ.exe2⤵
-
-
C:\Windows\System\ZFPdzbX.exeC:\Windows\System\ZFPdzbX.exe2⤵
-
-
C:\Windows\System\QdAVjZg.exeC:\Windows\System\QdAVjZg.exe2⤵
-
-
C:\Windows\System\MjPasJv.exeC:\Windows\System\MjPasJv.exe2⤵
-
-
C:\Windows\System\YrrPHFc.exeC:\Windows\System\YrrPHFc.exe2⤵
-
-
C:\Windows\System\XQeAhJb.exeC:\Windows\System\XQeAhJb.exe2⤵
-
-
C:\Windows\System\rJnrlUq.exeC:\Windows\System\rJnrlUq.exe2⤵
-
-
C:\Windows\System\qveXlFz.exeC:\Windows\System\qveXlFz.exe2⤵
-
-
C:\Windows\System\EsMuhCx.exeC:\Windows\System\EsMuhCx.exe2⤵
-
-
C:\Windows\System\VNKKVAS.exeC:\Windows\System\VNKKVAS.exe2⤵
-
-
C:\Windows\System\tTpQaXl.exeC:\Windows\System\tTpQaXl.exe2⤵
-
-
C:\Windows\System\PrjQrnj.exeC:\Windows\System\PrjQrnj.exe2⤵
-
-
C:\Windows\System\DSKDaoq.exeC:\Windows\System\DSKDaoq.exe2⤵
-
-
C:\Windows\System\rGVMoJo.exeC:\Windows\System\rGVMoJo.exe2⤵
-
-
C:\Windows\System\fkPVHCK.exeC:\Windows\System\fkPVHCK.exe2⤵
-
-
C:\Windows\System\UrllDlB.exeC:\Windows\System\UrllDlB.exe2⤵
-
-
C:\Windows\System\Tbckvqh.exeC:\Windows\System\Tbckvqh.exe2⤵
-
-
C:\Windows\System\UCKRIcJ.exeC:\Windows\System\UCKRIcJ.exe2⤵
-
-
C:\Windows\System\VjifVyF.exeC:\Windows\System\VjifVyF.exe2⤵
-
-
C:\Windows\System\wliCjJg.exeC:\Windows\System\wliCjJg.exe2⤵
-
-
C:\Windows\System\nwocXtC.exeC:\Windows\System\nwocXtC.exe2⤵
-
-
C:\Windows\System\vJuekaT.exeC:\Windows\System\vJuekaT.exe2⤵
-
-
C:\Windows\System\mQwHcpE.exeC:\Windows\System\mQwHcpE.exe2⤵
-
-
C:\Windows\System\ZLikKif.exeC:\Windows\System\ZLikKif.exe2⤵
-
-
C:\Windows\System\VqeRxIl.exeC:\Windows\System\VqeRxIl.exe2⤵
-
-
C:\Windows\System\rKKrJYM.exeC:\Windows\System\rKKrJYM.exe2⤵
-
-
C:\Windows\System\QcBeAtl.exeC:\Windows\System\QcBeAtl.exe2⤵
-
-
C:\Windows\System\ckawUun.exeC:\Windows\System\ckawUun.exe2⤵
-
-
C:\Windows\System\xQcQzmD.exeC:\Windows\System\xQcQzmD.exe2⤵
-
-
C:\Windows\System\XKVRfzc.exeC:\Windows\System\XKVRfzc.exe2⤵
-
-
C:\Windows\System\BquBcPB.exeC:\Windows\System\BquBcPB.exe2⤵
-
-
C:\Windows\System\oXjDsrY.exeC:\Windows\System\oXjDsrY.exe2⤵
-
-
C:\Windows\System\rdFaTpM.exeC:\Windows\System\rdFaTpM.exe2⤵
-
-
C:\Windows\System\OSlKGan.exeC:\Windows\System\OSlKGan.exe2⤵
-
-
C:\Windows\System\rJlamIi.exeC:\Windows\System\rJlamIi.exe2⤵
-
-
C:\Windows\System\IhlcPQC.exeC:\Windows\System\IhlcPQC.exe2⤵
-
-
C:\Windows\System\XEQwycs.exeC:\Windows\System\XEQwycs.exe2⤵
-
-
C:\Windows\System\LGRsYcQ.exeC:\Windows\System\LGRsYcQ.exe2⤵
-
-
C:\Windows\System\uXboVLf.exeC:\Windows\System\uXboVLf.exe2⤵
-
-
C:\Windows\System\uKdsnuN.exeC:\Windows\System\uKdsnuN.exe2⤵
-
-
C:\Windows\System\HXjHHRb.exeC:\Windows\System\HXjHHRb.exe2⤵
-
-
C:\Windows\System\DkXFVnH.exeC:\Windows\System\DkXFVnH.exe2⤵
-
-
C:\Windows\System\ClfWjmO.exeC:\Windows\System\ClfWjmO.exe2⤵
-
-
C:\Windows\System\jXgDvIJ.exeC:\Windows\System\jXgDvIJ.exe2⤵
-
-
C:\Windows\System\HcodvCA.exeC:\Windows\System\HcodvCA.exe2⤵
-
-
C:\Windows\System\rmMTWOX.exeC:\Windows\System\rmMTWOX.exe2⤵
-
-
C:\Windows\System\gRyevUK.exeC:\Windows\System\gRyevUK.exe2⤵
-
-
C:\Windows\System\BYlAsVT.exeC:\Windows\System\BYlAsVT.exe2⤵
-
-
C:\Windows\System\xXNVuqc.exeC:\Windows\System\xXNVuqc.exe2⤵
-
-
C:\Windows\System\bScWOaR.exeC:\Windows\System\bScWOaR.exe2⤵
-
-
C:\Windows\System\sPcqBew.exeC:\Windows\System\sPcqBew.exe2⤵
-
-
C:\Windows\System\HULtagV.exeC:\Windows\System\HULtagV.exe2⤵
-
-
C:\Windows\System\xQehjuy.exeC:\Windows\System\xQehjuy.exe2⤵
-
-
C:\Windows\System\FISindi.exeC:\Windows\System\FISindi.exe2⤵
-
-
C:\Windows\System\laIIlct.exeC:\Windows\System\laIIlct.exe2⤵
-
-
C:\Windows\System\qonYKAL.exeC:\Windows\System\qonYKAL.exe2⤵
-
-
C:\Windows\System\LQcdIHW.exeC:\Windows\System\LQcdIHW.exe2⤵
-
-
C:\Windows\System\lEqsbCH.exeC:\Windows\System\lEqsbCH.exe2⤵
-
-
C:\Windows\System\qWTSsIV.exeC:\Windows\System\qWTSsIV.exe2⤵
-
-
C:\Windows\System\cwCWBvQ.exeC:\Windows\System\cwCWBvQ.exe2⤵
-
-
C:\Windows\System\QbMYJVa.exeC:\Windows\System\QbMYJVa.exe2⤵
-
-
C:\Windows\System\OGonxLU.exeC:\Windows\System\OGonxLU.exe2⤵
-
-
C:\Windows\System\FogoZLb.exeC:\Windows\System\FogoZLb.exe2⤵
-
-
C:\Windows\System\SzCXqbz.exeC:\Windows\System\SzCXqbz.exe2⤵
-
-
C:\Windows\System\KwcSNZs.exeC:\Windows\System\KwcSNZs.exe2⤵
-
-
C:\Windows\System\gSkDcor.exeC:\Windows\System\gSkDcor.exe2⤵
-
-
C:\Windows\System\AIgOKbx.exeC:\Windows\System\AIgOKbx.exe2⤵
-
-
C:\Windows\System\MjvCInE.exeC:\Windows\System\MjvCInE.exe2⤵
-
-
C:\Windows\System\hrZBsNx.exeC:\Windows\System\hrZBsNx.exe2⤵
-
-
C:\Windows\System\cfhCIiO.exeC:\Windows\System\cfhCIiO.exe2⤵
-
-
C:\Windows\System\UwukWyu.exeC:\Windows\System\UwukWyu.exe2⤵
-
-
C:\Windows\System\KIAboVO.exeC:\Windows\System\KIAboVO.exe2⤵
-
-
C:\Windows\System\qtBjjAf.exeC:\Windows\System\qtBjjAf.exe2⤵
-
-
C:\Windows\System\CjSUqlh.exeC:\Windows\System\CjSUqlh.exe2⤵
-
-
C:\Windows\System\AdHvJdQ.exeC:\Windows\System\AdHvJdQ.exe2⤵
-
-
C:\Windows\System\SJIYhgA.exeC:\Windows\System\SJIYhgA.exe2⤵
-
-
C:\Windows\System\zdKgHfx.exeC:\Windows\System\zdKgHfx.exe2⤵
-
-
C:\Windows\System\GiMNyuH.exeC:\Windows\System\GiMNyuH.exe2⤵
-
-
C:\Windows\System\WIrlwhK.exeC:\Windows\System\WIrlwhK.exe2⤵
-
-
C:\Windows\System\HCpgbES.exeC:\Windows\System\HCpgbES.exe2⤵
-
-
C:\Windows\System\XLGtULK.exeC:\Windows\System\XLGtULK.exe2⤵
-
-
C:\Windows\System\hyJuFty.exeC:\Windows\System\hyJuFty.exe2⤵
-
-
C:\Windows\System\DKnbkVi.exeC:\Windows\System\DKnbkVi.exe2⤵
-
-
C:\Windows\System\ssiNdWP.exeC:\Windows\System\ssiNdWP.exe2⤵
-
-
C:\Windows\System\xCSlnUm.exeC:\Windows\System\xCSlnUm.exe2⤵
-
-
C:\Windows\System\DjruVJn.exeC:\Windows\System\DjruVJn.exe2⤵
-
-
C:\Windows\System\VdFtqFJ.exeC:\Windows\System\VdFtqFJ.exe2⤵
-
-
C:\Windows\System\hhMZjUQ.exeC:\Windows\System\hhMZjUQ.exe2⤵
-
-
C:\Windows\System\vnIVJTG.exeC:\Windows\System\vnIVJTG.exe2⤵
-
-
C:\Windows\System\LXFxfjw.exeC:\Windows\System\LXFxfjw.exe2⤵
-
-
C:\Windows\System\jpYTKJQ.exeC:\Windows\System\jpYTKJQ.exe2⤵
-
-
C:\Windows\System\IFIFjKU.exeC:\Windows\System\IFIFjKU.exe2⤵
-
-
C:\Windows\System\muWgoZy.exeC:\Windows\System\muWgoZy.exe2⤵
-
-
C:\Windows\System\uWdlkpp.exeC:\Windows\System\uWdlkpp.exe2⤵
-
-
C:\Windows\System\tDDdtcA.exeC:\Windows\System\tDDdtcA.exe2⤵
-
-
C:\Windows\System\iTWacHP.exeC:\Windows\System\iTWacHP.exe2⤵
-
-
C:\Windows\System\glsEjAZ.exeC:\Windows\System\glsEjAZ.exe2⤵
-
-
C:\Windows\System\aoITthb.exeC:\Windows\System\aoITthb.exe2⤵
-
-
C:\Windows\System\nEKCvMK.exeC:\Windows\System\nEKCvMK.exe2⤵
-
-
C:\Windows\System\BNijgzx.exeC:\Windows\System\BNijgzx.exe2⤵
-
-
C:\Windows\System\TjFYjUd.exeC:\Windows\System\TjFYjUd.exe2⤵
-
-
C:\Windows\System\ghMkIdB.exeC:\Windows\System\ghMkIdB.exe2⤵
-
-
C:\Windows\System\tIpWyUz.exeC:\Windows\System\tIpWyUz.exe2⤵
-
-
C:\Windows\System\XnwkYcL.exeC:\Windows\System\XnwkYcL.exe2⤵
-
-
C:\Windows\System\rurwUSA.exeC:\Windows\System\rurwUSA.exe2⤵
-
-
C:\Windows\System\HonlDES.exeC:\Windows\System\HonlDES.exe2⤵
-
-
C:\Windows\System\ItpzOHa.exeC:\Windows\System\ItpzOHa.exe2⤵
-
-
C:\Windows\System\PzHHZcB.exeC:\Windows\System\PzHHZcB.exe2⤵
-
-
C:\Windows\System\MYeBGTm.exeC:\Windows\System\MYeBGTm.exe2⤵
-
-
C:\Windows\System\AUaYcmJ.exeC:\Windows\System\AUaYcmJ.exe2⤵
-
-
C:\Windows\System\HJCoFAb.exeC:\Windows\System\HJCoFAb.exe2⤵
-
-
C:\Windows\System\YaWwcAl.exeC:\Windows\System\YaWwcAl.exe2⤵
-
-
C:\Windows\System\tGrgowj.exeC:\Windows\System\tGrgowj.exe2⤵
-
-
C:\Windows\System\VfxFtxZ.exeC:\Windows\System\VfxFtxZ.exe2⤵
-
-
C:\Windows\System\aiLdCiw.exeC:\Windows\System\aiLdCiw.exe2⤵
-
-
C:\Windows\System\fqXJIzy.exeC:\Windows\System\fqXJIzy.exe2⤵
-
-
C:\Windows\System\GJgrTxT.exeC:\Windows\System\GJgrTxT.exe2⤵
-
-
C:\Windows\System\FapIxGs.exeC:\Windows\System\FapIxGs.exe2⤵
-
-
C:\Windows\System\KRUmyzt.exeC:\Windows\System\KRUmyzt.exe2⤵
-
-
C:\Windows\System\DnbYBsb.exeC:\Windows\System\DnbYBsb.exe2⤵
-
-
C:\Windows\System\jCBavUy.exeC:\Windows\System\jCBavUy.exe2⤵
-
-
C:\Windows\System\kooDphs.exeC:\Windows\System\kooDphs.exe2⤵
-
-
C:\Windows\System\EFWceJI.exeC:\Windows\System\EFWceJI.exe2⤵
-
-
C:\Windows\System\qqYAkFA.exeC:\Windows\System\qqYAkFA.exe2⤵
-
-
C:\Windows\System\PqDfMms.exeC:\Windows\System\PqDfMms.exe2⤵
-
-
C:\Windows\System\HAqrGAh.exeC:\Windows\System\HAqrGAh.exe2⤵
-
-
C:\Windows\System\lhdGXdc.exeC:\Windows\System\lhdGXdc.exe2⤵
-
-
C:\Windows\System\zqdPKjC.exeC:\Windows\System\zqdPKjC.exe2⤵
-
-
C:\Windows\System\HIHWOEX.exeC:\Windows\System\HIHWOEX.exe2⤵
-
-
C:\Windows\System\lIZkGQt.exeC:\Windows\System\lIZkGQt.exe2⤵
-
-
C:\Windows\System\WFaBcBA.exeC:\Windows\System\WFaBcBA.exe2⤵
-
-
C:\Windows\System\FCZaCfw.exeC:\Windows\System\FCZaCfw.exe2⤵
-
-
C:\Windows\System\YMNHpMz.exeC:\Windows\System\YMNHpMz.exe2⤵
-
-
C:\Windows\System\VxRkJzs.exeC:\Windows\System\VxRkJzs.exe2⤵
-
-
C:\Windows\System\ZPvluxh.exeC:\Windows\System\ZPvluxh.exe2⤵
-
-
C:\Windows\System\dSZSPVa.exeC:\Windows\System\dSZSPVa.exe2⤵
-
-
C:\Windows\System\YeMgKMM.exeC:\Windows\System\YeMgKMM.exe2⤵
-
-
C:\Windows\System\CldwPDA.exeC:\Windows\System\CldwPDA.exe2⤵
-
-
C:\Windows\System\tVxVgSp.exeC:\Windows\System\tVxVgSp.exe2⤵
-
-
C:\Windows\System\MHxtCfP.exeC:\Windows\System\MHxtCfP.exe2⤵
-
-
C:\Windows\System\RRewNaS.exeC:\Windows\System\RRewNaS.exe2⤵
-
-
C:\Windows\System\uScyPWs.exeC:\Windows\System\uScyPWs.exe2⤵
-
-
C:\Windows\System\msvtbRM.exeC:\Windows\System\msvtbRM.exe2⤵
-
-
C:\Windows\System\obSZKvx.exeC:\Windows\System\obSZKvx.exe2⤵
-
-
C:\Windows\System\DORDWqq.exeC:\Windows\System\DORDWqq.exe2⤵
-
-
C:\Windows\System\zUbxvSk.exeC:\Windows\System\zUbxvSk.exe2⤵
-
-
C:\Windows\System\ayrRrbZ.exeC:\Windows\System\ayrRrbZ.exe2⤵
-
-
C:\Windows\System\byvnkFR.exeC:\Windows\System\byvnkFR.exe2⤵
-
-
C:\Windows\System\smHcvGw.exeC:\Windows\System\smHcvGw.exe2⤵
-
-
C:\Windows\System\fYHWknT.exeC:\Windows\System\fYHWknT.exe2⤵
-
-
C:\Windows\System\siYjiGh.exeC:\Windows\System\siYjiGh.exe2⤵
-
-
C:\Windows\System\DVkEkOT.exeC:\Windows\System\DVkEkOT.exe2⤵
-
-
C:\Windows\System\BPfSzDu.exeC:\Windows\System\BPfSzDu.exe2⤵
-
-
C:\Windows\System\dDfVyZh.exeC:\Windows\System\dDfVyZh.exe2⤵
-
-
C:\Windows\System\FbnLsaQ.exeC:\Windows\System\FbnLsaQ.exe2⤵
-
-
C:\Windows\System\xEwjMrQ.exeC:\Windows\System\xEwjMrQ.exe2⤵
-
-
C:\Windows\System\yCvXhsL.exeC:\Windows\System\yCvXhsL.exe2⤵
-
-
C:\Windows\System\ZylRLQd.exeC:\Windows\System\ZylRLQd.exe2⤵
-
-
C:\Windows\System\OExGQSG.exeC:\Windows\System\OExGQSG.exe2⤵
-
-
C:\Windows\System\aZBLlLu.exeC:\Windows\System\aZBLlLu.exe2⤵
-
-
C:\Windows\System\MtESBsN.exeC:\Windows\System\MtESBsN.exe2⤵
-
-
C:\Windows\System\QDGfxLP.exeC:\Windows\System\QDGfxLP.exe2⤵
-
-
C:\Windows\System\KGWAnIH.exeC:\Windows\System\KGWAnIH.exe2⤵
-
-
C:\Windows\System\RIslrkz.exeC:\Windows\System\RIslrkz.exe2⤵
-
-
C:\Windows\System\NbVesLz.exeC:\Windows\System\NbVesLz.exe2⤵
-
-
C:\Windows\System\FnYsbMg.exeC:\Windows\System\FnYsbMg.exe2⤵
-
-
C:\Windows\System\odcjUWN.exeC:\Windows\System\odcjUWN.exe2⤵
-
-
C:\Windows\System\TezaedF.exeC:\Windows\System\TezaedF.exe2⤵
-
-
C:\Windows\System\vAZmiVl.exeC:\Windows\System\vAZmiVl.exe2⤵
-
-
C:\Windows\System\yWNHgtv.exeC:\Windows\System\yWNHgtv.exe2⤵
-
-
C:\Windows\System\EoyWJtU.exeC:\Windows\System\EoyWJtU.exe2⤵
-
-
C:\Windows\System\AjnUFGw.exeC:\Windows\System\AjnUFGw.exe2⤵
-
-
C:\Windows\System\rZDoOMd.exeC:\Windows\System\rZDoOMd.exe2⤵
-
-
C:\Windows\System\qixpgsy.exeC:\Windows\System\qixpgsy.exe2⤵
-
-
C:\Windows\System\btDvmdr.exeC:\Windows\System\btDvmdr.exe2⤵
-
-
C:\Windows\System\wCFnzvI.exeC:\Windows\System\wCFnzvI.exe2⤵
-
-
C:\Windows\System\dNvFDgQ.exeC:\Windows\System\dNvFDgQ.exe2⤵
-
-
C:\Windows\System\gFxQFfd.exeC:\Windows\System\gFxQFfd.exe2⤵
-
-
C:\Windows\System\HfJarSd.exeC:\Windows\System\HfJarSd.exe2⤵
-
-
C:\Windows\System\GUBWRfl.exeC:\Windows\System\GUBWRfl.exe2⤵
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
microsoft.windows[1].xml
AppCache133744754652326560.txt
BHCTxON.exe
BmOPihq.exe
BrXkwaB.exe
CcQKLnl.exe
FwguCqH.exe
KDTDPHa.exe
LMafzor.exe
LpPhKTC.exe
OeSTdhp.exe
PgGJMfD.exe
QdcxBqP.exe
UQMOtCb.exe
ZAxIPKo.exe
ePRNnYy.exe
hGgsTCo.exe
hXJNAfw.exe
iuWfgFv.exe
keWQmwH.exe
keuNbUw.exe
lYxBcEq.exe
mVONXRV.exe
pUSBzMZ.exe
qXKecSt.exe
qxDKjAu.exe
qzXXeAb.exe
tMKcLQn.exe
uWSAjmJ.exe
vkuyaMd.exe
wAJOnwD.exe
xOCLuRm.exe
xoUmHFP.exe
zeGycAZ.exe
memory/644-70-0x00007FF68E3F0000-0x00007FF68E744000-memory.dmp
memory/644-1433-0x00007FF68E3F0000-0x00007FF68E744000-memory.dmp
memory/644-12-0x00007FF68E3F0000-0x00007FF68E744000-memory.dmp
memory/748-2157-0x00007FF72BE60000-0x00007FF72C1B4000-memory.dmp
memory/748-115-0x00007FF72BE60000-0x00007FF72C1B4000-memory.dmp
memory/748-201-0x00007FF72BE60000-0x00007FF72C1B4000-memory.dmp
memory/808-1679-0x00007FF6828B0000-0x00007FF682C04000-memory.dmp
memory/808-93-0x00007FF6828B0000-0x00007FF682C04000-memory.dmp
memory/808-37-0x00007FF6828B0000-0x00007FF682C04000-memory.dmp
memory/852-126-0x00007FF674C20000-0x00007FF674F74000-memory.dmp
memory/852-63-0x00007FF674C20000-0x00007FF674F74000-memory.dmp
memory/852-1694-0x00007FF674C20000-0x00007FF674F74000-memory.dmp
memory/860-1695-0x00007FF754EA0000-0x00007FF7551F4000-memory.dmp
memory/860-140-0x00007FF754EA0000-0x00007FF7551F4000-memory.dmp
memory/860-71-0x00007FF754EA0000-0x00007FF7551F4000-memory.dmp
memory/916-96-0x00007FF77FC70000-0x00007FF77FFC4000-memory.dmp
memory/916-2037-0x00007FF77FC70000-0x00007FF77FFC4000-memory.dmp
memory/956-527-0x00007FF655730000-0x00007FF655A84000-memory.dmp
memory/956-2192-0x00007FF655730000-0x00007FF655A84000-memory.dmp
memory/956-162-0x00007FF655730000-0x00007FF655A84000-memory.dmp
memory/1436-2174-0x00007FF6B0DE0000-0x00007FF6B1134000-memory.dmp
memory/1436-132-0x00007FF6B0DE0000-0x00007FF6B1134000-memory.dmp
memory/1436-283-0x00007FF6B0DE0000-0x00007FF6B1134000-memory.dmp
memory/1584-30-0x00007FF603800000-0x00007FF603B54000-memory.dmp
memory/1584-91-0x00007FF603800000-0x00007FF603B54000-memory.dmp
memory/1584-1614-0x00007FF603800000-0x00007FF603B54000-memory.dmp
memory/1692-143-0x00007FF632810000-0x00007FF632B64000-memory.dmp
memory/1692-341-0x00007FF632810000-0x00007FF632B64000-memory.dmp
memory/1692-2181-0x00007FF632810000-0x00007FF632B64000-memory.dmp
memory/1912-131-0x00007FF6693E0000-0x00007FF669734000-memory.dmp
memory/1912-2163-0x00007FF6693E0000-0x00007FF669734000-memory.dmp
memory/2036-24-0x00007FF7D4200000-0x00007FF7D4554000-memory.dmp
memory/2036-79-0x00007FF7D4200000-0x00007FF7D4554000-memory.dmp
memory/2036-1484-0x00007FF7D4200000-0x00007FF7D4554000-memory.dmp
memory/2072-1437-0x00007FF6E1E90000-0x00007FF6E21E4000-memory.dmp
memory/2072-17-0x00007FF6E1E90000-0x00007FF6E21E4000-memory.dmp
memory/2072-75-0x00007FF6E1E90000-0x00007FF6E21E4000-memory.dmp
memory/2144-1691-0x00007FF677700000-0x00007FF677A54000-memory.dmp
memory/2144-59-0x00007FF677700000-0x00007FF677A54000-memory.dmp
memory/2144-111-0x00007FF677700000-0x00007FF677A54000-memory.dmp
memory/2180-177-0x00007FF7E24F0000-0x00007FF7E2844000-memory.dmp
memory/2180-2200-0x00007FF7E24F0000-0x00007FF7E2844000-memory.dmp
memory/2180-594-0x00007FF7E24F0000-0x00007FF7E2844000-memory.dmp
memory/2276-1690-0x00007FF7B03B0000-0x00007FF7B0704000-memory.dmp
memory/2276-43-0x00007FF7B03B0000-0x00007FF7B0704000-memory.dmp
memory/2276-99-0x00007FF7B03B0000-0x00007FF7B0704000-memory.dmp
memory/2544-110-0x00007FF663330000-0x00007FF663684000-memory.dmp
memory/2544-2151-0x00007FF663330000-0x00007FF663684000-memory.dmp
memory/2544-191-0x00007FF663330000-0x00007FF663684000-memory.dmp
memory/2876-76-0x00007FF7D3B80000-0x00007FF7D3ED4000-memory.dmp
memory/2876-149-0x00007FF7D3B80000-0x00007FF7D3ED4000-memory.dmp
memory/2876-1699-0x00007FF7D3B80000-0x00007FF7D3ED4000-memory.dmp
memory/2912-719-0x00007FF62CA00000-0x00007FF62CD54000-memory.dmp
memory/2912-2194-0x00007FF62CA00000-0x00007FF62CD54000-memory.dmp
memory/2912-192-0x00007FF62CA00000-0x00007FF62CD54000-memory.dmp
memory/2984-2168-0x00007FF7324E0000-0x00007FF732834000-memory.dmp
memory/2984-134-0x00007FF7324E0000-0x00007FF732834000-memory.dmp
memory/2984-340-0x00007FF7324E0000-0x00007FF732834000-memory.dmp
memory/3264-2201-0x00007FF715E00000-0x00007FF716154000-memory.dmp
memory/3264-176-0x00007FF715E00000-0x00007FF716154000-memory.dmp
memory/3264-593-0x00007FF715E00000-0x00007FF716154000-memory.dmp
memory/3420-83-0x00007FF7C7D00000-0x00007FF7C8054000-memory.dmp
memory/3420-161-0x00007FF7C7D00000-0x00007FF7C8054000-memory.dmp
memory/3420-2033-0x00007FF7C7D00000-0x00007FF7C8054000-memory.dmp
memory/3744-106-0x00007FF7AE840000-0x00007FF7AEB94000-memory.dmp
memory/3744-1688-0x00007FF7AE840000-0x00007FF7AEB94000-memory.dmp
memory/3744-50-0x00007FF7AE840000-0x00007FF7AEB94000-memory.dmp
memory/3836-175-0x00007FF6790E0000-0x00007FF679434000-memory.dmp
memory/3836-592-0x00007FF6790E0000-0x00007FF679434000-memory.dmp
memory/3836-2198-0x00007FF6790E0000-0x00007FF679434000-memory.dmp
memory/4176-1427-0x00007FF6F9400000-0x00007FF6F9754000-memory.dmp
memory/4176-6-0x00007FF6F9400000-0x00007FF6F9754000-memory.dmp
memory/4176-61-0x00007FF6F9400000-0x00007FF6F9754000-memory.dmp
memory/4384-100-0x00007FF76C410000-0x00007FF76C764000-memory.dmp
memory/4384-2038-0x00007FF76C410000-0x00007FF76C764000-memory.dmp
memory/4752-160-0x00007FF6CDA40000-0x00007FF6CDD94000-memory.dmp
memory/4752-404-0x00007FF6CDA40000-0x00007FF6CDD94000-memory.dmp
memory/4752-2191-0x00007FF6CDA40000-0x00007FF6CDD94000-memory.dmp
memory/4908-460-0x00007FF7D7BF0000-0x00007FF7D7F44000-memory.dmp
memory/4908-156-0x00007FF7D7BF0000-0x00007FF7D7F44000-memory.dmp
memory/4908-2188-0x00007FF7D7BF0000-0x00007FF7D7F44000-memory.dmp
memory/4924-344-0x00007FF645F30000-0x00007FF646284000-memory.dmp
memory/4924-2186-0x00007FF645F30000-0x00007FF646284000-memory.dmp
memory/4924-148-0x00007FF645F30000-0x00007FF646284000-memory.dmp
memory/4984-0-0x00007FF6228F0000-0x00007FF622C44000-memory.dmp
memory/4984-54-0x00007FF6228F0000-0x00007FF622C44000-memory.dmp
memory/4984-1-0x000001B2DEF50000-0x000001B2DEF60000-memory.dmp