f5738961fc24bea9800ecadacb4b3026fea05f0edf3833ff6376fea6d6ca0aa8

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
31s
max time network
34s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-uk
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-uklocale:uk-uaos:windows10-ltsc_2021-x64systemwindows
submitted
01/10/2026, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
privet.exe
Size 2.1MB
Sample261001-v6sfysshld
SHA256 f5738961fc24bea9800ecadacb4b3026fea05f0edf3833ff6376fea6d6ca0aa8
MD5 040dd5f0a1c3732e3e814d882051fc3b
SHA1 a5d8f49479b8415618e56f4664c8fdd3771ac197
SHA512 51bbdd8936d0f48bc91a1b296ea36451ef22ea62749f067123976dc3b834ff7c6f46391896476989f67d615a04240505f70df06800608660b3f63edf8e065515
SSDEEP 6144:4lzRXxZ27OAfW7Qil0cxxerkIL/DcJKjtjorgLQTvDTw/rJyGj+TS+:iXO7hYxeZbDwwjoNHTwDg
TLSH
T159A54907B2A8CDF9F92B9178C99145E5A632BC41C320F5FB43603E563E37AD09A396D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion evasion execution persistence privilege_escalation trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	ws6g6y79.comehRQhyKoCKCe.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ws6g6y79.comehRQhyKoCKCe.exe

Blocks application from running via registry modification 2 IoCs

Adds application to list of disallowed applications.

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	ws6g6y79.comehRQhyKoCKCe.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	ws6g6y79.comehRQhyKoCKCe.exe

Disables RegEdit via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ws6g6y79.comehRQhyKoCKCe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ws6g6y79.comehRQhyKoCKCe.exe

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 14 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\2.exe\Debugger = "C:\\Windows\\Fonts\\ws6g6y79.comehRQhyKoCKCe.exe"	ws6g6y79.comehRQhyKoCKCe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3.exe	ws6g6y79.comehRQhyKoCKCe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3.exe\Debugger = "C:\\Windows\\Fonts\\ws6g6y79.comehRQhyKoCKCe.exe"	ws6g6y79.comehRQhyKoCKCe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\5.exe	ws6g6y79.comehRQhyKoCKCe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\7.exe\Debugger = "C:\\Windows\\Fonts\\ws6g6y79.comehRQhyKoCKCe.exe"	ws6g6y79.comehRQhyKoCKCe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\2.exe	ws6g6y79.comehRQhyKoCKCe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\4.exe	ws6g6y79.comehRQhyKoCKCe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\4.exe\Debugger = "C:\\Windows\\Fonts\\ws6g6y79.comehRQhyKoCKCe.exe"	ws6g6y79.comehRQhyKoCKCe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\5.exe\Debugger = "C:\\Windows\\Fonts\\ws6g6y79.comehRQhyKoCKCe.exe"	ws6g6y79.comehRQhyKoCKCe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\6.exe	ws6g6y79.comehRQhyKoCKCe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\6.exe\Debugger = "C:\\Windows\\Fonts\\ws6g6y79.comehRQhyKoCKCe.exe"	ws6g6y79.comehRQhyKoCKCe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\7.exe	ws6g6y79.comehRQhyKoCKCe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1.exe	ws6g6y79.comehRQhyKoCKCe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1.exe\Debugger = "C:\\Windows\\Fonts\\ws6g6y79.comehRQhyKoCKCe.exe"	ws6g6y79.comehRQhyKoCKCe.exe

Executes dropped EXE 1 IoCs

pid	Process
556	ws6g6y79.comehRQhyKoCKCe.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ws6g6y79.comehRQhyKoCKCe.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe	privet.exe
File opened for modification	C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe	privet.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1556	cmd.exe
4380	cmd.exe
5060	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
556	ws6g6y79.comehRQhyKoCKCe.exe
556	ws6g6y79.comehRQhyKoCKCe.exe
556	ws6g6y79.comehRQhyKoCKCe.exe
556	ws6g6y79.comehRQhyKoCKCe.exe
556	ws6g6y79.comehRQhyKoCKCe.exe
556	ws6g6y79.comehRQhyKoCKCe.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	556	ws6g6y79.comehRQhyKoCKCe.exe
Token: SeSystemEnvironmentPrivilege	556	ws6g6y79.comehRQhyKoCKCe.exe
Token: SeBackupPrivilege	556	ws6g6y79.comehRQhyKoCKCe.exe
Token: SeRestorePrivilege	556	ws6g6y79.comehRQhyKoCKCe.exe
Token: SeBackupPrivilege	556	ws6g6y79.comehRQhyKoCKCe.exe
Token: SeRestorePrivilege	556	ws6g6y79.comehRQhyKoCKCe.exe
Token: SeSystemEnvironmentPrivilege	556	ws6g6y79.comehRQhyKoCKCe.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 556	2316	privet.exe	86
PID 556 wrote to memory of 1556	556	ws6g6y79.comehRQhyKoCKCe.exe	88
PID 1556 wrote to memory of 2264	1556	cmd.exe	90
PID 556 wrote to memory of 4380	556	ws6g6y79.comehRQhyKoCKCe.exe	643
PID 556 wrote to memory of 5060	556	ws6g6y79.comehRQhyKoCKCe.exe	93

System policy modification 1 TTPs 14 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ws6g6y79.comehRQhyKoCKCe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ws6g6y79.comehRQhyKoCKCe.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	ws6g6y79.comehRQhyKoCKCe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	ws6g6y79.comehRQhyKoCKCe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ws6g6y79.comehRQhyKoCKCe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	ws6g6y79.comehRQhyKoCKCe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "4294967295"	ws6g6y79.comehRQhyKoCKCe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1"	ws6g6y79.comehRQhyKoCKCe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1"	ws6g6y79.comehRQhyKoCKCe.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	ws6g6y79.comehRQhyKoCKCe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	ws6g6y79.comehRQhyKoCKCe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	ws6g6y79.comehRQhyKoCKCe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewOnDrive = "4294967295"	ws6g6y79.comehRQhyKoCKCe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWinKeys = "1"	ws6g6y79.comehRQhyKoCKCe.exe

C:\Users\Admin\AppData\Local\Temp\privet.exe
"C:\Users\Admin\AppData\Local\Temp\privet.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
  "C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe" /main
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - UAC bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:556
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c reagentc /disable > nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Windows\system32\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:2264
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:4380
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    - Executes a command shell one-liner
    PID:5060
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c schtasks /create /tn "Update_main" /tr "\"C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe\"" /sc onlogon /ru SYSTEM /f
    3⤵
    PID:3420
  - - C:\Program Files\Common Files\microsoft shared\ClickToRun\fqncg0lt.scrTaB27w7I6YFh.exe
      "C:\Program Files\Common Files\microsoft shared\ClickToRun\fqncg0lt.scrTaB27w7I6YFh.exe" /main
      4⤵
      PID:848
    - - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        5⤵
        
        PID:1452
      - C:\Windows\SysWOW64\IME\UHQNxoit.commGdST481GlGa.exe
        
        "C:\Windows\SysWOW64\IME\UHQNxoit.commGdST481GlGa.exe" /main
        6⤵
        
        PID:4492
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        7⤵
        
        PID:2780
        
        C:\Program Files (x86)\Windows Multimedia Platform\RC8JdcJe.exev5dvmiFIpIle.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\RC8JdcJe.exev5dvmiFIpIle.exe" /main
        8⤵
        
        PID:4184
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        9⤵
        
        PID:3696
        
        C:\Program Files\Common Files\System\ado\nA31sypa.com16xiAIsJqWo2.exe
        
        "C:\Program Files\Common Files\System\ado\nA31sypa.com16xiAIsJqWo2.exe" /main
        10⤵
        
        PID:4212
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        11⤵
        
        PID:2528
        
        C:\Windows\Resources\Ease of Access Themes\HOCMptWQ.scrOgbUy2SgRXjO.exe
        
        "C:\Windows\Resources\Ease of Access Themes\HOCMptWQ.scrOgbUy2SgRXjO.exe" /main
        12⤵
        
        PID:3172
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        13⤵
        
        PID:4944
        
        C:\Program Files\Windows Defender\es-ES\8k9mBAtT.scrmw4Dgvb7IEGj.exe
        
        "C:\Program Files\Windows Defender\es-ES\8k9mBAtT.scrmw4Dgvb7IEGj.exe" /main
        14⤵
        
        PID:4976
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        15⤵
        
        PID:3308
        
        C:\Program Files\Windows Sidebar\U6KnpMSY.scruinHoaMtu53I.exe
        
        "C:\Program Files\Windows Sidebar\U6KnpMSY.scruinHoaMtu53I.exe" /main
        16⤵
        
        PID:3300
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        17⤵
        
        PID:5344
        
        C:\Windows\Logs\SettingSync\Iup28Rk7.exePMrzV17KrUpa.exe
        
        "C:\Windows\Logs\SettingSync\Iup28Rk7.exePMrzV17KrUpa.exe" /main
        18⤵
        
        PID:5780
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        19⤵
        
        PID:3912
        
        C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\hMMr2zmH.exeUXaBlMA4elbR.exe
        
        "C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\hMMr2zmH.exeUXaBlMA4elbR.exe" /main
        20⤵
        
        PID:5580
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        21⤵
        
        PID:6260
        
        C:\Windows\System32\config\systemprofile\haagEwvY.scrTWYg6MnT0UAa.exe
        
        "C:\Windows\System32\config\systemprofile\haagEwvY.scrTWYg6MnT0UAa.exe" /main
        22⤵
        
        PID:6708
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        23⤵
        
        PID:6284
        
        C:\Windows\Resources\Ease of Access Themes\HOCMptWQ.scr\k9mqDDRH.exemprMsgufuXdp.exe
        
        "C:\Windows\Resources\Ease of Access Themes\HOCMptWQ.scr\k9mqDDRH.exemprMsgufuXdp.exe" /main
        24⤵
        
        PID:7112
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        25⤵
        
        PID:7580
        
        C:\Program Files\Windows NT\Accessories\ja-JP\Pnba9krV.comQo5wlSb3xRY1.exe
        
        "C:\Program Files\Windows NT\Accessories\ja-JP\Pnba9krV.comQo5wlSb3xRY1.exe" /main
        26⤵
        
        PID:8044
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        27⤵
        
        PID:7868
        
        C:\Windows\Tasks\2taqhXgs.exe\sCMzbU0N.execSo7fsxEvOL7.exe
        
        "C:\Windows\Tasks\2taqhXgs.exe\sCMzbU0N.execSo7fsxEvOL7.exe" /main
        28⤵
        
        PID:8220
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        29⤵
        
        PID:8664
        
        C:\Windows\Temp\MsEdgeCrashpad\NCgNZxMS.exe2q8wdYJ6JgnY.exe
        
        "C:\Windows\Temp\MsEdgeCrashpad\NCgNZxMS.exe2q8wdYJ6JgnY.exe" /main
        30⤵
        
        PID:9060
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        31⤵
        
        PID:8956
        
        C:\Program Files\Java\jdk-1.8\SDkT46E3.scrpHSaHf8aN05t.exe
        
        "C:\Program Files\Java\jdk-1.8\SDkT46E3.scrpHSaHf8aN05t.exe" /main
        32⤵
        
        PID:9228
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        33⤵
        
        PID:9656
        
        C:\ProgramData\Microsoft\Network\Connections\Y6XPh1IU.comYNinQ8n43VwZ.exe
        
        "C:\ProgramData\Microsoft\Network\Connections\Y6XPh1IU.comYNinQ8n43VwZ.exe" /main
        34⤵
        
        PID:10060
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        35⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\IME\RO2kaJnj.scrfa8TJmefrNjt.exe
        
        "C:\Windows\SysWOW64\IME\RO2kaJnj.scrfa8TJmefrNjt.exe" /main
        36⤵
        
        PID:9336
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        37⤵
        
        PID:10648
        
        C:\Windows\System32\Tasks\Mozilla\OkmL2Gj9.com\9z3HRpCJ.exetmDW8pDEqaLf.exe
        
        "C:\Windows\System32\Tasks\Mozilla\OkmL2Gj9.com\9z3HRpCJ.exetmDW8pDEqaLf.exe" /main
        38⤵
        
        PID:11004
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        39⤵
        
        PID:3732
        
        C:\Windows\Tasks\2taqhXgs.exe\sCMzbU0N.exe\4QMm95mF.exe\IVDcfbbP.scrLxyCVx3jAwp9.exe
        
        "C:\Windows\Tasks\2taqhXgs.exe\sCMzbU0N.exe\4QMm95mF.exe\IVDcfbbP.scrLxyCVx3jAwp9.exe" /main
        40⤵
        
        PID:11408
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        41⤵
        
        PID:12200
        
        C:\Windows\Logs\CBS\lTOFn7S6.scr\GpyP0fxF.exeQCku9iPzHPwC.exe
        
        "C:\Windows\Logs\CBS\lTOFn7S6.scr\GpyP0fxF.exeQCku9iPzHPwC.exe" /main
        42⤵
        
        PID:12892
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        43⤵
        
        PID:13220
        
        C:\Windows\System32\drivers\ja-JP\EUJu0gta.scrHQ63571L3F82.exe
        
        "C:\Windows\System32\drivers\ja-JP\EUJu0gta.scrHQ63571L3F82.exe" /main
        44⤵
        
        PID:13108
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    /child
    3⤵
    PID:3220
  - - C:\Windows\System32\config\Journal\AFaQvP3e.scrn0R0zTBk43R1.exe
      "C:\Windows\System32\config\Journal\AFaQvP3e.scrn0R0zTBk43R1.exe" /main
      4⤵
      PID:10180
    - - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        5⤵
        
        PID:11320
      - C:\Windows\SysWOW64\el-GR\phS89zKl.exef2wDKemoG5iC.exe
        
        "C:\Windows\SysWOW64\el-GR\phS89zKl.exef2wDKemoG5iC.exe" /main
        6⤵
        
        PID:12048
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        7⤵
        
        PID:12760
        
        C:\Windows\Temp\MsEdgeCrashpad\reports\tPciNFUm.scr\03qn2wnI.exeKFBhLXkfW012.exe
        
        "C:\Windows\Temp\MsEdgeCrashpad\reports\tPciNFUm.scr\03qn2wnI.exeKFBhLXkfW012.exe" /main
        8⤵
        
        PID:10660
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        9⤵
        
        PID:11760
        
        C:\Windows\Help\OEM\hzLq5gBs.comVWJvM9CPFCVj.exe
        
        "C:\Windows\Help\OEM\hzLq5gBs.comVWJvM9CPFCVj.exe" /main
        10⤵
        
        PID:15188
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c schtasks /create /tn "Update_ZriWVC" /tr "\"C:\Program Files (x86)\Windows Defender\fr-FR\Y1V0mEk7.scr\"" /sc onlogon /ru SYSTEM /f
    3⤵
    PID:4640
  - - C:\Windows\System32\drivers\es-ES\5NxszWVf.comdaudzrblgaBQ.exe
      "C:\Windows\System32\drivers\es-ES\5NxszWVf.comdaudzrblgaBQ.exe" /main
      4⤵
      PID:3664
    - - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        5⤵
        
        PID:1708
      - C:\Program Files (x86)\Windows Defender\en-US\whGTnVkz.scr2WFuFSlQFgbp.exe
        
        "C:\Program Files (x86)\Windows Defender\en-US\whGTnVkz.scr2WFuFSlQFgbp.exe" /main
        6⤵
        
        PID:2116
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        7⤵
        
        PID:2284
        
        C:\Program Files\Internet Explorer\SIGNUP\77hhbHQb.comzz1TyIJPMx7A.exe
        
        "C:\Program Files\Internet Explorer\SIGNUP\77hhbHQb.comzz1TyIJPMx7A.exe" /main
        8⤵
        
        PID:1740
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        9⤵
        
        PID:4392
        
        C:\Program Files\Windows NT\TableTextService\wLVtt318.comenvzkxyIWC9Y.exe
        
        "C:\Program Files\Windows NT\TableTextService\wLVtt318.comenvzkxyIWC9Y.exe" /main
        10⤵
        
        PID:648
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        11⤵
        
        PID:4232
        
        C:\Program Files (x86)\Windows NT\TableTextService\PriYrVA4.scrlQT7hoq3G0uD.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\PriYrVA4.scrlQT7hoq3G0uD.exe" /main
        12⤵
        
        PID:5088
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        13⤵
        
        PID:1692
        
        C:\Windows\System32\config\systemprofile\AppData\e6lpD3kb.scrLFwoA6DTrQfC.exe
        
        "C:\Windows\System32\config\systemprofile\AppData\e6lpD3kb.scrLFwoA6DTrQfC.exe" /main
        14⤵
        
        PID:1088
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        15⤵
        
        PID:5216
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c schtasks /create /tn "Update_pMIJlt" /tr "\"C:\Windows\Temp\MsEdgeCrashpad\reports\soUfxNcl.exe\"" /sc onlogon /ru SYSTEM /f
    3⤵
    PID:4004
  - - C:\Program Files\Common Files\microsoft shared\Triedit\s4GeZrHT.exewab3ucdDOIJb.exe
      "C:\Program Files\Common Files\microsoft shared\Triedit\s4GeZrHT.exewab3ucdDOIJb.exe" /main
      4⤵
      PID:1520
    - - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        5⤵
        
        PID:1004
      - C:\ProgramData\Microsoft\Windows NT\BfMEYdzG.com34WcYP8vmNDr.exe
        
        "C:\ProgramData\Microsoft\Windows NT\BfMEYdzG.com34WcYP8vmNDr.exe" /main
        6⤵
        
        PID:3564
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        7⤵
        
        PID:1372
        
        C:\Windows\System32\Tasks\Microsoft\OneCore\EmvHv1qq.screMJEog3uLYof.exe
        
        "C:\Windows\System32\Tasks\Microsoft\OneCore\EmvHv1qq.screMJEog3uLYof.exe" /main
        8⤵
        
        PID:4360
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        9⤵
        
        PID:4136
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        10⤵
        
        PID:3668
        
        C:\Program Files\Common Files\System\ja-JP\wfZPqwc5.exemtUMtLpUFw1U.exe
        
        "C:\Program Files\Common Files\System\ja-JP\wfZPqwc5.exemtUMtLpUFw1U.exe" /main
        11⤵
        
        PID:3584
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        12⤵
        
        PID:4192
        
        C:\Program Files\Windows Defender\en-US\BLB8NehX.scrThwqgohaqf5m.exe
        
        "C:\Program Files\Windows Defender\en-US\BLB8NehX.scrThwqgohaqf5m.exe" /main
        13⤵
        
        PID:5284
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        14⤵
        
        PID:5628
        
        C:\Windows\System32\ShellExperiences\v2En9ZOa.exeuwN3gJC8unsa.exe
        
        "C:\Windows\System32\ShellExperiences\v2En9ZOa.exeuwN3gJC8unsa.exe" /main
        15⤵
        
        PID:6104
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        16⤵
        
        PID:5592
        
        C:\Windows\Fonts\ws6g6y79.com\YAWn0X4o.exe\UQeG0vXR.exe6oz7EEUhHlH4.exe
        
        "C:\Windows\Fonts\ws6g6y79.com\YAWn0X4o.exe\UQeG0vXR.exe6oz7EEUhHlH4.exe" /main
        17⤵
        
        PID:6192
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        18⤵
        
        PID:6680
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c schtasks /create /tn "Update_Kqfnn6" /tr "\"C:\Program Files\Common Files\System\ado\de-DE\zclHEUlN.exe\"" /sc onlogon /ru SYSTEM /f
    3⤵
    PID:1904
  - - C:\Program Files (x86)\Windows NT\Accessories\orPeWcX6.exe3XItyVcvFLw9.exe
      "C:\Program Files (x86)\Windows NT\Accessories\orPeWcX6.exe3XItyVcvFLw9.exe" /main
      4⤵
      PID:4840
    - - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        5⤵
        
        PID:4860
      - C:\Windows\SysWOW64\Keywords\QwOnU7FT.scrTg3g1eyNPaq4.exe
        
        "C:\Windows\SysWOW64\Keywords\QwOnU7FT.scrTg3g1eyNPaq4.exe" /main
        6⤵
        
        PID:4568
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        7⤵
        
        PID:2744
        
        C:\Windows\Logs\DISM\it5BNWOh.scrre21XxgJypGX.exe
        
        "C:\Windows\Logs\DISM\it5BNWOh.scrre21XxgJypGX.exe" /main
        8⤵
        
        PID:1920
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        9⤵
        
        PID:2084
        
        C:\Windows\Fonts\ws6g6y79.com\YAWn0X4o.exe1bKICWWpXbp4.exe
        
        "C:\Windows\Fonts\ws6g6y79.com\YAWn0X4o.exe1bKICWWpXbp4.exe" /main
        10⤵
        
        PID:5008
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        11⤵
        
        PID:5356
        
        C:\Windows\Tasks\2taqhXgs.exeTTtiIusU6zuj.exe
        
        "C:\Windows\Tasks\2taqhXgs.exeTTtiIusU6zuj.exe" /main
        12⤵
        
        PID:5756
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        13⤵
        
        PID:2260
        
        C:\Program Files\Reference Assemblies\Microsoft\gtK2zhWj.compHKqNdmpiBF0.exe
        
        "C:\Program Files\Reference Assemblies\Microsoft\gtK2zhWj.compHKqNdmpiBF0.exe" /main
        14⤵
        
        PID:5576
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        15⤵
        
        PID:6308
        
        C:\Windows\System32\Tasks\Mozilla\hyGKLIVZ.scrzxtRBEehTBFg.exe
        
        "C:\Windows\System32\Tasks\Mozilla\hyGKLIVZ.scrzxtRBEehTBFg.exe" /main
        16⤵
        
        PID:6656
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        17⤵
        
        PID:5776
        
        C:\Program Files (x86)\Google\ubYuZmpN.scrXyfmsQ2ozl4m.exe
        
        "C:\Program Files (x86)\Google\ubYuZmpN.scrXyfmsQ2ozl4m.exe" /main
        18⤵
        
        PID:6372
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        19⤵
        
        PID:7372
        
        C:\ProgramData\Microsoft\AppV\i6iZVocb.scrbloq8pIDuUaZ.exe
        
        "C:\ProgramData\Microsoft\AppV\i6iZVocb.scrbloq8pIDuUaZ.exe" /main
        20⤵
        
        PID:7824
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        21⤵
        
        PID:7420
        
        C:\Windows\System32\config\TxR\A81iNiAO.exeR37U96cDVfQp.exe
        
        "C:\Windows\System32\config\TxR\A81iNiAO.exeR37U96cDVfQp.exe" /main
        22⤵
        
        PID:7848
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        23⤵
        
        PID:8504
        
        C:\Windows\Tasks\2taqhXgs.exe\sCMzbU0N.exe\4QMm95mF.exeRbALkA7IWK9r.exe
        
        "C:\Windows\Tasks\2taqhXgs.exe\sCMzbU0N.exe\4QMm95mF.exeRbALkA7IWK9r.exe" /main
        24⤵
        
        PID:8888
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        25⤵
        
        PID:7760
        
        C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\dVr6sI9M.scr5ID0DuiWs8Qa.exe
        
        "C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\dVr6sI9M.scr5ID0DuiWs8Qa.exe" /main
        26⤵
        
        PID:8784
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        27⤵
        
        PID:9436
        
        C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\UunloSIo.scr9LWJwzIRxpoW.exe
        
        "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\UunloSIo.scr9LWJwzIRxpoW.exe" /main
        28⤵
        
        PID:9916
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        29⤵
        
        PID:6748
        
        C:\Program Files (x86)\Windows Defender\en-US\whGTnVkz.scr\vr6w3RLL.comrgqPhFuceYSZ.exe
        
        "C:\Program Files (x86)\Windows Defender\en-US\whGTnVkz.scr\vr6w3RLL.comrgqPhFuceYSZ.exe" /main
        30⤵
        
        PID:9856
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        31⤵
        
        PID:10528
        
        C:\Program Files\Windows NT\Accessories\de-DE\8NotdhwX.exe5vLHZQCYJWkX.exe
        
        "C:\Program Files\Windows NT\Accessories\de-DE\8NotdhwX.exe5vLHZQCYJWkX.exe" /main
        32⤵
        
        PID:10872
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        33⤵
        
        PID:6768
        
        C:\Program Files\Windows Defender Advanced Threat Protection\en-US\gW4qWoyt.scrK4I2Ws5ChHBI.exe
        
        "C:\Program Files\Windows Defender Advanced Threat Protection\en-US\gW4qWoyt.scrK4I2Ws5ChHBI.exe" /main
        34⤵
        
        PID:3656
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        35⤵
        
        PID:11896
        
        C:\Windows\Tasks\2taqhXgs.exe\sCMzbU0N.exe\Fya7LtN2.exeBFb2DBArQZNR.exe
        
        "C:\Windows\Tasks\2taqhXgs.exe\sCMzbU0N.exe\Fya7LtN2.exeBFb2DBArQZNR.exe" /main
        36⤵
        
        PID:12044
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        37⤵
        
        PID:13132
        
        C:\Windows\Logs\WindowsUpdate\vQ736aZz.scr0n8Tf5C4BCly.exe
        
        "C:\Windows\Logs\WindowsUpdate\vQ736aZz.scr0n8Tf5C4BCly.exe" /main
        38⤵
        
        PID:13432
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        39⤵
        
        PID:4692
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c schtasks /create /tn "Update_C6CLS5" /tr "\"C:\Program Files\Common Files\microsoft shared\ink\fr-FR\jFEcExIz.scr\"" /sc onlogon /ru SYSTEM /f
    3⤵
    PID:2156
  - - C:\Windows\Logs\CBS\lTOFn7S6.scrkpBdeGfwHRg7.exe
      "C:\Windows\Logs\CBS\lTOFn7S6.scrkpBdeGfwHRg7.exe" /main
      4⤵
      PID:2716
    - - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        5⤵
        
        PID:1784
      - C:\Program Files\Windows NT\TableTextService\en-US\jOz5nJjD.exeNsURHZpTwCPH.exe
        
        "C:\Program Files\Windows NT\TableTextService\en-US\jOz5nJjD.exeNsURHZpTwCPH.exe" /main
        6⤵
        
        PID:4760
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        7⤵
        
        PID:3572
        
        C:\Program Files\Windows Defender\en-US\xB7DCf1V.scrTUM6cCQaJtZ6.exe
        
        "C:\Program Files\Windows Defender\en-US\xB7DCf1V.scrTUM6cCQaJtZ6.exe" /main
        8⤵
        
        PID:1036
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        9⤵
        
        PID:5368
        
        C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_miniTrace\w3xs8yY3.comVzcZZzJO2jxT.exe
        
        "C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_miniTrace\w3xs8yY3.comVzcZZzJO2jxT.exe" /main
        10⤵
        
        PID:5768
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        11⤵
        
        PID:4484
        
        C:\Windows\Temp\MsEdgeCrashpad\hqhcnvbd.comMvBSUsoGw6LU.exe
        
        "C:\Windows\Temp\MsEdgeCrashpad\hqhcnvbd.comMvBSUsoGw6LU.exe" /main
        12⤵
        
        PID:5476
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        13⤵
        
        PID:6272
        
        C:\Windows\CbsTemp\5k6YOpoQ.com0lCOE8UnPBAY.exe
        
        "C:\Windows\CbsTemp\5k6YOpoQ.com0lCOE8UnPBAY.exe" /main
        14⤵
        
        PID:6716
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        15⤵
        
        PID:5540
        
        C:\Program Files\Common Files\Services\7qCDH09F.comixeKpazfc7n9.exe
        
        "C:\Program Files\Common Files\Services\7qCDH09F.comixeKpazfc7n9.exe" /main
        16⤵
        
        PID:6812
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        17⤵
        
        PID:7568
        
        C:\Program Files (x86)\Windows Multimedia Platform\e0ogMpJ8.scrRzNmwsO5NvSs.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\e0ogMpJ8.scrRzNmwsO5NvSs.exe" /main
        18⤵
        
        PID:8032
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        19⤵
        
        PID:7504
        
        C:\Windows\Help\Help\f28eXNDW.scrAE2sQIa1IHG1.exe
        
        "C:\Windows\Help\Help\f28eXNDW.scrAE2sQIa1IHG1.exe" /main
        20⤵
        
        PID:8244
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        21⤵
        
        PID:8732
        
        C:\Windows\Fonts\ws6g6y79.com\YAWn0X4o.exe\UQeG0vXR.exe\cL1ZViUl.com36OUlWv2nwmo.exe
        
        "C:\Windows\Fonts\ws6g6y79.com\YAWn0X4o.exe\UQeG0vXR.exe\cL1ZViUl.com36OUlWv2nwmo.exe" /main
        22⤵
        
        PID:9084
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        23⤵
        
        PID:8412
        
        C:\Windows\twain_32\u3CrwN5n.scrOJU0ldXkKyln.exe
        
        "C:\Windows\twain_32\u3CrwN5n.scrOJU0ldXkKyln.exe" /main
        24⤵
        
        PID:9260
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        25⤵
        
        PID:9712
        
        C:\Program Files\Google\Chrome\wkXHTIDW.scr\dwGlA3Vt.exeAmJxgv1qfd1i.exe
        
        "C:\Program Files\Google\Chrome\wkXHTIDW.scr\dwGlA3Vt.exeAmJxgv1qfd1i.exe" /main
        26⤵
        
        PID:10084
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        27⤵
        
        PID:9428
        
        C:\ProgramData\Microsoft\Windows Defender\Platform\2qnhCNAC.comgHiibbSFsvFB.exe
        
        "C:\ProgramData\Microsoft\Windows Defender\Platform\2qnhCNAC.comgHiibbSFsvFB.exe" /main
        28⤵
        
        PID:9440
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        29⤵
        
        PID:10700
        
        C:\ProgramData\Microsoft\Storage Health\rWX623mu.exeUk5VRU3VXDja.exe
        
        "C:\ProgramData\Microsoft\Storage Health\rWX623mu.exeUk5VRU3VXDja.exe" /main
        30⤵
        
        PID:11080
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        31⤵
        
        PID:11076
        
        C:\Windows\Fonts\ws6g6y79.com\oy2LOn1t.scr\CRQKzMB3.scroecqM1mFlziB.exe
        
        "C:\Windows\Fonts\ws6g6y79.com\oy2LOn1t.scr\CRQKzMB3.scroecqM1mFlziB.exe" /main
        32⤵
        
        PID:11616
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        33⤵
        
        PID:12188
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        34⤵
        
        PID:4380
        
        C:\Program Files\Windows Security\BrowserCore\en-US\UsbUS6Gy.exeFUK37Lrqvsoj.exe
        
        "C:\Program Files\Windows Security\BrowserCore\en-US\UsbUS6Gy.exeFUK37Lrqvsoj.exe" /main
        34⤵
        
        PID:12792
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        35⤵
        
        PID:13172
        
        C:\Windows\Temp\MsEdgeCrashpad\hqhcnvbd.com\MI2vyocR.com\KpWl3lAK.scrZJ2pG7a6VDDE.exe
        
        "C:\Windows\Temp\MsEdgeCrashpad\hqhcnvbd.com\MI2vyocR.com\KpWl3lAK.scrZJ2pG7a6VDDE.exe" /main
        36⤵
        
        PID:5396
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c schtasks /create /tn "Update_AnyNJZ" /tr "\"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\ZlE1uEzT.exe\"" /sc onlogon /ru SYSTEM /f
    3⤵
    PID:892
  - - C:\Program Files\Windows Defender\de-DE\d4ELLEpE.comtJFkDfWy2PI2.exe
      "C:\Program Files\Windows Defender\de-DE\d4ELLEpE.comtJFkDfWy2PI2.exe" /main
      4⤵
      PID:1936
    - - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        5⤵
        
        PID:2448
      - C:\Windows\InputMethod\CHT\b8mZIBDb.exe6rJaALSfj1XX.exe
        
        "C:\Windows\InputMethod\CHT\b8mZIBDb.exe6rJaALSfj1XX.exe" /main
        6⤵
        
        PID:3760
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        7⤵
        
        PID:5228
        
        C:\Windows\System32\drivers\en-US\0Zjftdvj.scrgdGqmbkxQMwQ.exe
        
        "C:\Windows\System32\drivers\en-US\0Zjftdvj.scrgdGqmbkxQMwQ.exe" /main
        8⤵
        
        PID:5560
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        9⤵
        
        PID:5840
        
        C:\Windows\Logs\ReAgent\fKHNgadf.comYZNDduTxzuWf.exe
        
        "C:\Windows\Logs\ReAgent\fKHNgadf.comYZNDduTxzuWf.exe" /main
        10⤵
        
        PID:4948
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        11⤵
        
        PID:5608
        
        C:\Program Files\Common Files\Services\FfUgcEWE.comD48avPJKEuPH.exe
        
        "C:\Program Files\Common Files\Services\FfUgcEWE.comD48avPJKEuPH.exe" /main
        12⤵
        
        PID:6320
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        13⤵
        
        PID:6744
        
        C:\ProgramData\Microsoft\UEV\Scripts\cWfeHAzk.scrTh6L3KSLoPG9.exe
        
        "C:\ProgramData\Microsoft\UEV\Scripts\cWfeHAzk.scrTh6L3KSLoPG9.exe" /main
        14⤵
        
        PID:5304
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        15⤵
        
        PID:6980
        
        C:\Program Files (x86)\Windows NT\TableTextService\en-US\EiSKfNva.comKcheggbCMFzz.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\en-US\EiSKfNva.comKcheggbCMFzz.exe" /main
        16⤵
        
        PID:7440
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        17⤵
        
        PID:7900
        
        C:\Windows\System32\Tasks\Microsoft\Office\bIEuahyR.comlkDnBRsj7SYD.exe
        
        "C:\Windows\System32\Tasks\Microsoft\Office\bIEuahyR.comlkDnBRsj7SYD.exe" /main
        18⤵
        
        PID:7840
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        19⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\F12\de-DE\z07OAs5q.scrrMvpJqV7qhZR.exe
        
        "C:\Windows\SysWOW64\F12\de-DE\z07OAs5q.scrrMvpJqV7qhZR.exe" /main
        20⤵
        
        PID:8552
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        21⤵
        
        PID:8912
        
        C:\Windows\Fonts\ws6g6y79.com\YAWn0X4o.exe\UQeG0vXR.exe\cL1ZViUl.com\SwUsEGbV.exeHuxAuaJN0TlU.exe
        
        "C:\Windows\Fonts\ws6g6y79.com\YAWn0X4o.exe\UQeG0vXR.exe\cL1ZViUl.com\SwUsEGbV.exeHuxAuaJN0TlU.exe" /main
        22⤵
        
        PID:8584
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        23⤵
        
        PID:8832
        
        C:\Program Files\Common Files\Services\7qCDH09F.com\FmiquWop.exeuUDNqALMvvoW.exe
        
        "C:\Program Files\Common Files\Services\7qCDH09F.com\FmiquWop.exeuUDNqALMvvoW.exe" /main
        24⤵
        
        PID:9564
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        25⤵
        
        PID:9936
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        26⤵
        
        PID:9200
        
        C:\Windows\Fonts\ws6g6y79.com\oy2LOn1t.scrW9jQBHjyxwll.exe
        
        "C:\Windows\Fonts\ws6g6y79.com\oy2LOn1t.scrW9jQBHjyxwll.exe" /main
        27⤵
        
        PID:9948
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        28⤵
        
        PID:10600
        
        C:\Program Files (x86)\Windows Defender\en-US\Xmh6jKFq.comgwYCrIkrDK9c.exe
        
        "C:\Program Files (x86)\Windows Defender\en-US\Xmh6jKFq.comgwYCrIkrDK9c.exe" /main
        29⤵
        
        PID:10956
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        30⤵
        
        PID:3904
        
        C:\Windows\System32\drivers\en-US\0Zjftdvj.scr\PNWXApAX.scrz1yalwn9sEIW.exe
        
        "C:\Windows\System32\drivers\en-US\0Zjftdvj.scr\PNWXApAX.scrz1yalwn9sEIW.exe" /main
        31⤵
        
        PID:11884
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        32⤵
        
        PID:10920
        
        C:\ProgramData\Microsoft\Windows\OneSettings\SxCFx9jF.comSKZ1CdNIqyhU.exe
        
        "C:\ProgramData\Microsoft\Windows\OneSettings\SxCFx9jF.comSKZ1CdNIqyhU.exe" /main
        33⤵
        
        PID:13112
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        34⤵
        
        PID:13320
        
        C:\Windows\SysWOW64\es\bNV8OL4g.scr7h9ldgpK8KIQ.exe
        
        "C:\Windows\SysWOW64\es\bNV8OL4g.scr7h9ldgpK8KIQ.exe" /main
        35⤵
        
        PID:13088
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c schtasks /create /tn "Update_rMRwYk" /tr "\"C:\Windows\Tasks\zOmutnCu.exe\"" /sc onlogon /ru SYSTEM /f
    3⤵
    PID:4952
  - - C:\Windows\IME\RdJuAxS4.scrJSqIRNKJtjWF.exe
      "C:\Windows\IME\RdJuAxS4.scrJSqIRNKJtjWF.exe" /main
      4⤵
      PID:4200
    - - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        5⤵
        
        PID:5468
      - C:\Program Files\Windows Defender\Offline\DG5NULHL.exedmY3NQx0s3uH.exe
        
        "C:\Program Files\Windows Defender\Offline\DG5NULHL.exedmY3NQx0s3uH.exe" /main
        6⤵
        
        PID:5812
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        7⤵
        
        PID:1068
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        8⤵
        
        PID:5512
        
        C:\ProgramData\Microsoft\Windows\DeviceMetadataStore\en-US\NJgvAITV.comE0K8zo6XtdyP.exe
        
        "C:\ProgramData\Microsoft\Windows\DeviceMetadataStore\en-US\NJgvAITV.comE0K8zo6XtdyP.exe" /main
        9⤵
        
        PID:6344
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        10⤵
        
        PID:6808
        
        C:\Program Files\Windows Defender\de-DE\d4ELLEpE.com\kSs8iT9h.comBSvPCr1yk8jY.exe
        
        "C:\Program Files\Windows Defender\de-DE\d4ELLEpE.com\kSs8iT9h.comBSvPCr1yk8jY.exe" /main
        11⤵
        
        PID:6464
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        12⤵
        
        PID:6764
        
        C:\ProgramData\Desktop\MRzEQoS3.exeJf3Wd4c7sISI.exe
        
        "C:\ProgramData\Desktop\MRzEQoS3.exeJf3Wd4c7sISI.exe" /main
        13⤵
        
        PID:7548
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        14⤵
        
        PID:8020
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c schtasks /create /tn "Update_e2E6J7" /tr "\"C:\Program Files (x86)\Windows Defender\es-ES\Hivj3QbQ.exe\"" /sc onlogon /ru SYSTEM /f
    3⤵
    PID:5456
  - - C:\ProgramData\Microsoft OneDrive\setup\MHSG4ifH.exeGChnudRByMem.exe
      "C:\ProgramData\Microsoft OneDrive\setup\MHSG4ifH.exeGChnudRByMem.exe" /main
      4⤵
      PID:5792
    - - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        5⤵
        
        PID:5204
      - C:\Windows\Temp\MsEdgeCrashpad\reports\tPciNFUm.scrHmsdJ6M6PJSr.exe
        
        "C:\Windows\Temp\MsEdgeCrashpad\reports\tPciNFUm.scrHmsdJ6M6PJSr.exe" /main
        6⤵
        
        PID:5520
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        7⤵
        
        PID:6388
        
        C:\Windows\Help\Corporate\8j7mdWGg.scrBidFjR0058lD.exe
        
        "C:\Windows\Help\Corporate\8j7mdWGg.scrBidFjR0058lD.exe" /main
        8⤵
        
        PID:6820
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        9⤵
        
        PID:2296
        
        C:\Windows\Branding\shellbrd\1U6LIyi2.exeJw9jUVoVl4Aa.exe
        
        "C:\Windows\Branding\shellbrd\1U6LIyi2.exeJw9jUVoVl4Aa.exe" /main
        10⤵
        
        PID:7096
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        11⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\F12\ja-JP\peDvFUla.comX0ReNDVP1S1F.exe
        
        "C:\Windows\SysWOW64\F12\ja-JP\peDvFUla.comX0ReNDVP1S1F.exe" /main
        12⤵
        
        PID:8012
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        13⤵
        
        PID:7820
        
        C:\Program Files (x86)\Windows Multimedia Platform\e0ogMpJ8.scr\gn32emZX.scrpCxladm4PqDa.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\e0ogMpJ8.scr\gn32emZX.scrpCxladm4PqDa.exe" /main
        14⤵
        
        PID:7640
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        15⤵
        
        PID:8652
        
        C:\Windows\Resources\Ease of Access Themes\HOCMptWQ.scr\k9mqDDRH.exe\tircWkad.scrt6IdfUhVpw2Y.exe
        
        "C:\Windows\Resources\Ease of Access Themes\HOCMptWQ.scr\k9mqDDRH.exe\tircWkad.scrt6IdfUhVpw2Y.exe" /main
        16⤵
        
        PID:9048
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        17⤵
        
        PID:8980
        
        C:\Program Files (x86)\Windows Defender\ja-JP\iMeK3vd4.scrDaEwbVX8xdQM.exe
        
        "C:\Program Files (x86)\Windows Defender\ja-JP\iMeK3vd4.scrDaEwbVX8xdQM.exe" /main
        18⤵
        
        PID:8600
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        19⤵
        
        PID:9644
        
        C:\Program Files (x86)\Windows Portable Devices\BlCXpsgY.combeMOrxegOTKG.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\BlCXpsgY.combeMOrxegOTKG.exe" /main
        20⤵
        
        PID:10048
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        21⤵
        
        PID:9412
        
        C:\ProgramData\Microsoft\Windows\WER\Temp\toQUvHme.exefWmGRcPEGbrn.exe
        
        "C:\ProgramData\Microsoft\Windows\WER\Temp\toQUvHme.exefWmGRcPEGbrn.exe" /main
        22⤵
        
        PID:9732
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        23⤵
        
        PID:10580
        
        C:\Windows\Temp\MsEdgeCrashpad\NCgNZxMS.exe\bQ544xVz.scrE04CrYrGEulS.exe
        
        "C:\Windows\Temp\MsEdgeCrashpad\NCgNZxMS.exe\bQ544xVz.scrE04CrYrGEulS.exe" /main
        24⤵
        
        PID:10928
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        25⤵
        
        PID:10824
        
        C:\Program Files (x86)\Windows Media Player\ja-JP\qnUV34YF.exejWFdwFslME2X.exe
        
        "C:\Program Files (x86)\Windows Media Player\ja-JP\qnUV34YF.exejWFdwFslME2X.exe" /main
        26⤵
        
        PID:11872
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        27⤵
        
        PID:12388
        
        C:\Windows\System32\LogFiles\xosVSua9.exe4fvqoyEHOwkg.exe
        
        "C:\Windows\System32\LogFiles\xosVSua9.exe4fvqoyEHOwkg.exe" /main
        28⤵
        
        PID:13224
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        29⤵
        
        PID:13504
        
        C:\Program Files\VideoLAN\VLC\0j8d1ewb.com4mPjnmRyT22u.exe
        
        "C:\Program Files\VideoLAN\VLC\0j8d1ewb.com4mPjnmRyT22u.exe" /main
        30⤵
        
        PID:14328
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        31⤵
        
        PID:13628
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c schtasks /create /tn "Update_8wKhLH" /tr "\"C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\7as6KH0X.scr\"" /sc onlogon /ru SYSTEM /f
    3⤵
    PID:6120
  - - C:\Windows\Help\Help\PUGmlO2J.com9Grh0CgAWHYW.exe
      "C:\Windows\Help\Help\PUGmlO2J.com9Grh0CgAWHYW.exe" /main
      4⤵
      PID:5372
    - - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        5⤵
        
        PID:6204
      - C:\Program Files (x86)\Windows Sidebar\Lz2BanGy.exeWSkdIwMYQhYP.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Lz2BanGy.exeWSkdIwMYQhYP.exe" /main
        6⤵
        
        PID:6692
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        7⤵
        
        PID:6292
        
        C:\Program Files (x86)\Windows Defender\it-IT\iDB030I7.scrY3Lqu3mWfyiE.exe
        
        "C:\Program Files (x86)\Windows Defender\it-IT\iDB030I7.scrY3Lqu3mWfyiE.exe" /main
        8⤵
        
        PID:6996
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        9⤵
        
        PID:7592
        
        C:\Program Files\Windows NT\Accessories\en-US\kClVkO2F.exebIVuk33tvIaG.exe
        
        "C:\Program Files\Windows NT\Accessories\en-US\kClVkO2F.exebIVuk33tvIaG.exe" /main
        10⤵
        
        PID:8056
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        11⤵
        
        PID:7936
        
        C:\Program Files\Common Files\microsoft shared\VC\mJqJOsre.exeKGSBZ1EA6jnW.exe
        
        "C:\Program Files\Common Files\microsoft shared\VC\mJqJOsre.exeKGSBZ1EA6jnW.exe" /main
        12⤵
        
        PID:8232
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        13⤵
        
        PID:8696
        
        C:\Program Files\Windows NT\TableTextService\qUL8a6l6.comfE51CS9klYdt.exe
        
        "C:\Program Files\Windows NT\TableTextService\qUL8a6l6.comfE51CS9klYdt.exe" /main
        14⤵
        
        PID:9072
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        15⤵
        
        PID:8968
        
        C:\Windows\Tasks\2taqhXgs.exe\sCMzbU0N.exe\4QMm95mF.exe\HrYapE9t.scrRlgNZ3JgP2yT.exe
        
        "C:\Windows\Tasks\2taqhXgs.exe\sCMzbU0N.exe\4QMm95mF.exe\HrYapE9t.scrRlgNZ3JgP2yT.exe" /main
        16⤵
        
        PID:9240
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        17⤵
        
        PID:9676
        
        C:\Program Files\Common Files\System\es-ES\ecrAeRZf.scr0uO0SlgqFXLH.exe
        
        "C:\Program Files\Common Files\System\es-ES\ecrAeRZf.scr0uO0SlgqFXLH.exe" /main
        18⤵
        
        PID:10072
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        19⤵
        
        PID:9276
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\YnGsRZ0j.comm9Y0nBqJdi17.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\YnGsRZ0j.comm9Y0nBqJdi17.exe" /main
        20⤵
        
        PID:9964
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        21⤵
        
        PID:10688
        
        C:\Windows\System32\Tasks\Mozilla\hyGKLIVZ.scr\jb1jRnwy.scr8bWiYZUK3tG4.exe
        
        "C:\Windows\System32\Tasks\Mozilla\hyGKLIVZ.scr\jb1jRnwy.scr8bWiYZUK3tG4.exe" /main
        22⤵
        
        PID:11068
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        23⤵
        
        PID:10944
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        24⤵
        
        PID:11636
        
        C:\Program Files\Microsoft Office 15\ClientX64\GBrrejAO.exe7lmSBm4FebZd.exe
        
        "C:\Program Files\Microsoft Office 15\ClientX64\GBrrejAO.exe7lmSBm4FebZd.exe" /main
        25⤵
        
        PID:12236
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        26⤵
        
        PID:12816
        
        C:\ProgramData\Oracle\Q80IW6gt.commdPvmuxctKEa.exe
        
        "C:\ProgramData\Oracle\Q80IW6gt.commdPvmuxctKEa.exe" /main
        27⤵
        
        PID:12996
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        28⤵
        
        PID:12208
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c schtasks /create /tn "Update_bHkdot" /tr "\"C:\Windows\Tasks\2taqhXgs.exe\JYLDdzii.scr\"" /sc onlogon /ru SYSTEM /f
    3⤵
    PID:6228
  - - C:\Windows\System32\drivers\fr-FR\Du5mYZYl.scr425En4roswes.exe
      "C:\Windows\System32\drivers\fr-FR\Du5mYZYl.scr425En4roswes.exe" /main
      4⤵
      PID:6668
    - - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        5⤵
        
        PID:7148
      - C:\Windows\Resources\Ease of Access Themes\o6IqwAVG.exejTjz3ACnQmHQ.exe
        
        "C:\Windows\Resources\Ease of Access Themes\o6IqwAVG.exejTjz3ACnQmHQ.exe" /main
        6⤵
        
        PID:6528
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        7⤵
        
        PID:7404
        
        C:\Program Files (x86)\Windows NT\TableTextService\VFpW8zTa.scrtqpFxIadcgyo.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\VFpW8zTa.scrtqpFxIadcgyo.exe" /main
        8⤵
        
        PID:7812
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        9⤵
        
        PID:7484
        
        C:\Program Files\Google\Chrome\wkXHTIDW.scru7sQjaOa6Jgj.exe
        
        "C:\Program Files\Google\Chrome\wkXHTIDW.scru7sQjaOa6Jgj.exe" /main
        10⤵
        
        PID:3232
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        11⤵
        
        PID:8408
        
        C:\Program Files\Windows NT\TableTextService\en-US\rwEWvELv.comtH5775mJAqi9.exe
        
        "C:\Program Files\Windows NT\TableTextService\en-US\rwEWvELv.comtH5775mJAqi9.exe" /main
        12⤵
        
        PID:8876
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        13⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\fr\veabWYCB.scrG5FCcGmTC9iG.exe
        
        "C:\Windows\SysWOW64\fr\veabWYCB.scrG5FCcGmTC9iG.exe" /main
        14⤵
        
        PID:8612
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        15⤵
        
        PID:9272
        
        C:\Windows\Logs\NetSetup\wnvoVChm.exekyQOuCSEGriW.exe
        
        "C:\Windows\Logs\NetSetup\wnvoVChm.exekyQOuCSEGriW.exe" /main
        16⤵
        
        PID:9724
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        17⤵
        
        PID:10152
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        18⤵
        
        PID:9316
        
        C:\Program Files\Common Files\System\vsCCRQ69.scrFRTub2XYTNUx.exe
        
        "C:\Program Files\Common Files\System\vsCCRQ69.scrFRTub2XYTNUx.exe" /main
        19⤵
        
        PID:10080
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        20⤵
        
        PID:10712
        
        C:\Program Files (x86)\Windows Defender\es-ES\GhAARXEx.comxoTHb7pdRCGV.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\GhAARXEx.comxoTHb7pdRCGV.exe" /main
        21⤵
        
        PID:11100
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        22⤵
        
        PID:11152
        
        C:\Program Files\Common Files\microsoft shared\VGX\GqyNxU3q.exe10dwwdpfUiSW.exe
        
        "C:\Program Files\Common Files\microsoft shared\VGX\GqyNxU3q.exe10dwwdpfUiSW.exe" /main
        23⤵
        
        PID:11852
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        24⤵
        
        PID:10864
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c schtasks /create /tn "Update_Smg628" /tr "\"C:\Windows\Help\mui\aOnn0JiK.com\"" /sc onlogon /ru SYSTEM /f
    3⤵
    PID:6452
  - - C:\Program Files (x86)\Windows Media Player\fr-FR\UHsuNmfw.exedR9C1sgbTrOg.exe
      "C:\Program Files (x86)\Windows Media Player\fr-FR\UHsuNmfw.exedR9C1sgbTrOg.exe" /main
      4⤵
      PID:5428
    - - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        5⤵
        
        PID:7428
      - C:\Program Files (x86)\Windows Defender\uk-UA\E5HMCAld.scrumbjCrlQB2hS.exe
        
        "C:\Program Files (x86)\Windows Defender\uk-UA\E5HMCAld.scrumbjCrlQB2hS.exe" /main
        6⤵
        
        PID:7880
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        7⤵
        
        PID:7528
        
        C:\Windows\Fonts\ws6g6y79.com\YAWn0X4o.exe\rdwvh50C.comC5eOxTyFYKGR.exe
        
        "C:\Windows\Fonts\ws6g6y79.com\YAWn0X4o.exe\rdwvh50C.comC5eOxTyFYKGR.exe" /main
        8⤵
        
        PID:7856
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        9⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\setup\en-US\Otr42Phq.scrYhcXyMjk3hhM.exe
        
        "C:\Windows\SysWOW64\setup\en-US\Otr42Phq.scrYhcXyMjk3hhM.exe" /main
        10⤵
        
        PID:8900
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        11⤵
        
        PID:8624
        
        C:\Windows\ServiceProfiles\LocalService\Links\LxJxCo2F.com2YZkP6zTHp2G.exe
        
        "C:\Windows\ServiceProfiles\LocalService\Links\LxJxCo2F.com2YZkP6zTHp2G.exe" /main
        12⤵
        
        PID:8792
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        13⤵
        
        PID:9540
        
        C:\Windows\Logs\HomeGroup\t3jxxDGo.scr1CUzdSM83yQX.exe
        
        "C:\Windows\Logs\HomeGroup\t3jxxDGo.scr1CUzdSM83yQX.exe" /main
        14⤵
        
        PID:9924
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        15⤵
        
        PID:8472
        
        C:\Windows\System32\Tasks\Mozilla\OkmL2Gj9.comz4QlmhH4vhxL.exe
        
        "C:\Windows\System32\Tasks\Mozilla\OkmL2Gj9.comz4QlmhH4vhxL.exe" /main
        16⤵
        
        PID:9700
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        17⤵
        
        PID:10568
        
        C:\Program Files\Windows Defender\fr-FR\xEuWnwkN.comuf5fIcQInQda.exe
        
        "C:\Program Files\Windows Defender\fr-FR\xEuWnwkN.comuf5fIcQInQda.exe" /main
        18⤵
        
        PID:10896
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        19⤵
        
        PID:10828
        
        C:\Program Files\Windows NT\TableTextService\en-US\jOz5nJjD.exe\0daFegCE.comt6gb3skY2x5K.exe
        
        "C:\Program Files\Windows NT\TableTextService\en-US\jOz5nJjD.exe\0daFegCE.comt6gb3skY2x5K.exe" /main
        20⤵
        
        PID:11508
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        21⤵
        
        PID:12172
        
        C:\Program Files\Windows Defender\es-ES\8k9mBAtT.scr\TmMgPx3t.exeUb7vBCmV19zR.exe
        
        "C:\Program Files\Windows Defender\es-ES\8k9mBAtT.scr\TmMgPx3t.exeUb7vBCmV19zR.exe" /main
        22⤵
        
        PID:12804
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        23⤵
        
        PID:13100
        
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\eQNydokc.exeP27fZ2vkLpWO.exe
        
        "C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\eQNydokc.exeP27fZ2vkLpWO.exe" /main
        24⤵
        
        PID:12964
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        25⤵
        
        PID:14844
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c schtasks /create /tn "Update_ZriWVC" /tr "\"C:\Program Files (x86)\Windows Defender\fr-FR\Y1V0mEk7.scr\"" /sc onlogon /ru SYSTEM /f
    3⤵
    PID:9720
  - - C:\Program Files (x86)\Windows NT\Accessories\orPeWcX6.exe\Dw9ySz6q.com8hkmOwDkjYaF.exe
      "C:\Program Files (x86)\Windows NT\Accessories\orPeWcX6.exe\Dw9ySz6q.com8hkmOwDkjYaF.exe" /main
      4⤵
      PID:10836
    - - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        5⤵
        
        PID:11844
      - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        6⤵
        
        PID:10716
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        7⤵
        
        PID:13120
        
        C:\Windows\SysWOW64\de\o8wGwBCO.exe0sNeiwjAzpBz.exe
        
        "C:\Windows\SysWOW64\de\o8wGwBCO.exe0sNeiwjAzpBz.exe" /main
        8⤵
        
        PID:13440
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        9⤵
        
        PID:13652
        
        C:\Windows\System32\pt-BR\0pQW4GrX.scrd0qf0NNGiViS.exe
        
        "C:\Windows\System32\pt-BR\0pQW4GrX.scrd0qf0NNGiViS.exe" /main
        10⤵
        
        PID:15204
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c schtasks /create /tn "Update_pMIJlt" /tr "\"C:\Windows\Temp\MsEdgeCrashpad\reports\soUfxNcl.exe\"" /sc onlogon /ru SYSTEM /f
    3⤵
    PID:11364
  - - C:\Program Files\Common Files\Services\FfUgcEWE.com\mW72dZS4.exeHN4MI2yLyLnl.exe
      "C:\Program Files\Common Files\Services\FfUgcEWE.com\mW72dZS4.exeHN4MI2yLyLnl.exe" /main
      4⤵
      PID:12128
    - - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        5⤵
        
        PID:12768
      - C:\Windows\Tasks\2taqhXgs.exe\sCMzbU0N.exe\7FM0hJDK.scrhEa2JizhVrrj.exe
        
        "C:\Windows\Tasks\2taqhXgs.exe\sCMzbU0N.exe\7FM0hJDK.scrhEa2JizhVrrj.exe" /main
        6⤵
        
        PID:11536
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        7⤵
        
        PID:12908
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c schtasks /create /tn "Update_Kqfnn6" /tr "\"C:\Program Files\Common Files\System\ado\de-DE\zclHEUlN.exe\"" /sc onlogon /ru SYSTEM /f
    3⤵
    PID:12312
  - - C:\Windows\Temp\MsEdgeCrashpad\reports\tPciNFUm.scr\zt4wSo9M.scr3oNI0tJPivwN.exe
      "C:\Windows\Temp\MsEdgeCrashpad\reports\tPciNFUm.scr\zt4wSo9M.scr3oNI0tJPivwN.exe" /main
      4⤵
      PID:10672
    - - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        5⤵
        
        PID:13660
      - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        6⤵
        
        PID:13148
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c schtasks /create /tn "Update_C6CLS5" /tr "\"C:\Program Files\Common Files\microsoft shared\ink\fr-FR\jFEcExIz.scr\"" /sc onlogon /ru SYSTEM /f
    3⤵
    PID:12940
  - - C:\Windows\Logs\ReAgent\fKHNgadf.com\RABCr6tf.com8n2DTJEyFcCi.exe
      "C:\Windows\Logs\ReAgent\fKHNgadf.com\RABCr6tf.com8n2DTJEyFcCi.exe" /main
      4⤵
      PID:13500
    - - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        5⤵
        
        PID:14708
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c schtasks /create /tn "Update_AnyNJZ" /tr "\"C:\ProgramData\Microsoft\Windows\WER\ReportQueue\ZlE1uEzT.exe\"" /sc onlogon /ru SYSTEM /f
    3⤵
    PID:14424

C:\Windows\system32\atbroker.exe
atbroker.exe /start narrator /hardwarebuttonlaunch
1⤵
PID:8776
- C:\Windows\System32\ATBroker.exe
  C:\Windows\System32\ATBroker.exe /start narrator /hardwarebuttonlaunch
  2⤵
  PID:10952
- - C:\Windows\System32\Narrator.exe
    "C:\Windows\System32\Narrator.exe" /hardwarebuttonlaunch
    3⤵
    PID:3808

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe 0
1⤵
PID:9080

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe
1⤵
PID:11200

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe
1⤵
PID:10556

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe
1⤵
PID:2920

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe
1⤵
PID:10584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:11332

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe
1⤵
PID:11516

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe
1⤵
PID:12220

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe
1⤵
PID:12228

C:\Windows\system32\atbroker.exe
atbroker.exe /start narrator /hardwarebuttonlaunch
1⤵
PID:12264

C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe explorer.exe
1⤵
PID:11120
- C:\ProgramData\Microsoft\Settings\Accounts\z7krEM7d.scrkBZyp1MqYGHR.exe
  "C:\ProgramData\Microsoft\Settings\Accounts\z7krEM7d.scrkBZyp1MqYGHR.exe" /main
  2⤵
  PID:13668
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
    3⤵
    PID:3792

C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
1⤵
PID:11256
- C:\Windows\System32\drivers\de-DE\4gNCDNEc.comjW6tZ1siptFy.exe
  "C:\Windows\System32\drivers\de-DE\4gNCDNEc.comjW6tZ1siptFy.exe" /main
  2⤵
  PID:14020
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
    3⤵
    PID:14340

C:\Program Files (x86)\Windows Defender\fr-FR\Y1V0mEk7.scr
"C:\Program Files (x86)\Windows Defender\fr-FR\Y1V0mEk7.scr"
1⤵
PID:11272

C:\Windows\Temp\MsEdgeCrashpad\reports\soUfxNcl.exe
C:\Windows\Temp\MsEdgeCrashpad\reports\soUfxNcl.exe
1⤵
PID:10744
- C:\ProgramData\Microsoft\SmsRouter\8MS9cRIM.scr51449nhWKG8M.exe
  "C:\ProgramData\Microsoft\SmsRouter\8MS9cRIM.scr51449nhWKG8M.exe" /main
  2⤵
  PID:13992
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
    3⤵
    PID:13448

C:\Program Files\Common Files\System\ado\de-DE\zclHEUlN.exe
"C:\Program Files\Common Files\System\ado\de-DE\zclHEUlN.exe"
1⤵
PID:4736
- C:\ProgramData\Desktop\ZoSvEfKM.scr6KPxbyYjcWA4.exe
  "C:\ProgramData\Desktop\ZoSvEfKM.scr6KPxbyYjcWA4.exe" /main
  2⤵
  PID:13004
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
    3⤵
    PID:12400
  - - C:\Windows\Temp\MsEdgeCrashpad\hqhcnvbd.com\MI2vyocR.comUbnGapDzji75.exe
      "C:\Windows\Temp\MsEdgeCrashpad\hqhcnvbd.com\MI2vyocR.comUbnGapDzji75.exe" /main
      4⤵
      PID:13524
    - - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
        
        C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
        5⤵
        
        PID:14716

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\jFEcExIz.scr
"C:\Program Files\Common Files\microsoft shared\ink\fr-FR\jFEcExIz.scr"
1⤵
PID:10680
- C:\Windows\Help\mui\040C\Fpy86mtJ.exe3QsAL3CmMoIT.exe
  "C:\Windows\Help\mui\040C\Fpy86mtJ.exe3QsAL3CmMoIT.exe" /main
  2⤵
  PID:13176
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
    3⤵
    PID:13152
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\euRdJM3K.scrdA3hEOlb8g9o.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\euRdJM3K.scrdA3hEOlb8g9o.exe" /main
      4⤵
      PID:11596

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\ZlE1uEzT.exe
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\ZlE1uEzT.exe
1⤵
PID:4216
- C:\Windows\System32\Tasks\Mozilla\zJZXzdNn.comvkCymttt13Qc.exe
  "C:\Windows\System32\Tasks\Mozilla\zJZXzdNn.comvkCymttt13Qc.exe" /main
  2⤵
  PID:12688
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
    3⤵
    PID:12564

C:\Windows\Tasks\zOmutnCu.exe
C:\Windows\Tasks\zOmutnCu.exe
1⤵
PID:11672
- C:\Windows\System32\drivers\DriverData\QMLUPZH8.comj1Aky4M2SUJM.exe
  "C:\Windows\System32\drivers\DriverData\QMLUPZH8.comj1Aky4M2SUJM.exe" /main
  2⤵
  PID:14000
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
    3⤵
    PID:13624

C:\Program Files (x86)\Windows Defender\es-ES\Hivj3QbQ.exe
"C:\Program Files (x86)\Windows Defender\es-ES\Hivj3QbQ.exe"
1⤵
PID:11448
- C:\Windows\SysWOW64\hu-HU\kfFskr1e.comBABTwWad4QfL.exe
  "C:\Windows\SysWOW64\hu-HU\kfFskr1e.comBABTwWad4QfL.exe" /main
  2⤵
  PID:13676
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
    3⤵
    PID:14320

C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\7as6KH0X.scr
"C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\7as6KH0X.scr"
1⤵
PID:11752
- C:\Program Files (x86)\Windows Defender\uk-UA\uUxEO8TR.scrhgorF4v4jfHq.exe
  "C:\Program Files (x86)\Windows Defender\uk-UA\uUxEO8TR.scrhgorF4v4jfHq.exe" /main
  2⤵
  PID:14008
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
    3⤵
    PID:14044

C:\Windows\Tasks\2taqhXgs.exe\JYLDdzii.scr
C:\Windows\Tasks\2taqhXgs.exe\JYLDdzii.scr
1⤵
PID:9828
- C:\Program Files (x86)\Windows NT\Accessories\en-US\1ejFe9NZ.comi45iGIG3F8zV.exe
  "C:\Program Files (x86)\Windows NT\Accessories\en-US\1ejFe9NZ.comi45iGIG3F8zV.exe" /main
  2⤵
  PID:13692
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
    3⤵
    PID:13892

C:\Windows\Help\mui\aOnn0JiK.com
C:\Windows\Help\mui\aOnn0JiK.com
1⤵
PID:10172
- C:\ProgramData\Microsoft\Windows NT\MSFax\Queue\ii0MPdpx.comX6AhYzqcUMxC.exe
  "C:\ProgramData\Microsoft\Windows NT\MSFax\Queue\ii0MPdpx.comX6AhYzqcUMxC.exe" /main
  2⤵
  PID:13424
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
    3⤵
    PID:13136

C:\Program Files (x86)\Windows Defender\fr-FR\Y1V0mEk7.scr
"C:\Program Files (x86)\Windows Defender\fr-FR\Y1V0mEk7.scr"
1⤵
PID:11712
- C:\Windows\System32\Tasks\GoogleSystem\GoogleUpdater\nVf4KIAs.exe5WtLmew6e4l2.exe
  "C:\Windows\System32\Tasks\GoogleSystem\GoogleUpdater\nVf4KIAs.exe5WtLmew6e4l2.exe" /main
  2⤵
  PID:13684
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
    3⤵
    PID:12432

C:\Windows\Temp\MsEdgeCrashpad\reports\soUfxNcl.exe
C:\Windows\Temp\MsEdgeCrashpad\reports\soUfxNcl.exe
1⤵
PID:11748
- C:\Program Files\Windows NT\TableTextService\qUL8a6l6.com\xdCSH8tD.exekmfZrL35kFyX.exe
  "C:\Program Files\Windows NT\TableTextService\qUL8a6l6.com\xdCSH8tD.exekmfZrL35kFyX.exe" /main
  2⤵
  PID:14216
- - C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
    C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe cmd.exe /c reagentc /disable > nul 2>&1
    3⤵
    PID:14484

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe
1⤵
PID:12660

C:\Windows\system32\utilman.exe
utilman.exe /debug
1⤵
PID:12668

C:\Windows\system32\atbroker.exe
atbroker.exe /start narrator /hardwarebuttonlaunch
1⤵
PID:12996

C:\Windows\System32\DisplaySwitch.exe
C:\Windows\System32\DisplaySwitch.exe -Embedding
1⤵
PID:12176

C:\Windows\system32\atbroker.exe
atbroker.exe /start narrator /hardwarebuttonlaunch
1⤵
PID:12208

C:\Windows\system32\utilman.exe
utilman.exe /debug
1⤵
PID:12656

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe
1⤵
PID:12968

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe
1⤵
PID:11456

C:\Windows\system32\utilman.exe
utilman.exe /debug
1⤵
PID:14904

C:\Windows\system32\utilman.exe
utilman.exe /debug
1⤵
PID:14912

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe
1⤵
PID:14784

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe
1⤵
PID:15520

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe 0
1⤵
PID:15684

C:\Windows\system32\utilman.exe
utilman.exe /debug
1⤵
PID:15964

C:\Windows\system32\utilman.exe
utilman.exe /debug
1⤵
PID:16120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SP_CA307D5DA5574811A3F3E0AB2ABBDBDF.dat

Path C:\Users\Admin\AppData\Local\speech\Microsoft\Speech\Files\UserLexicons\SP_CA307D5DA5574811A3F3E0AB2ABBDBDF.dat
Size 940B
SHA256 665c6f7448b3a67728d35da9e5cf574771e592bdcb0919083aa84211f56eecc7
MD5 1f5967d4e607026a38d9b247dc5bfbdd
SHA1 4989de4cba69d3f220a16e0d08e74e38cc06f869
SHA512 41587fef86009937188f29aa96456777e506560feeacb3e922f7978a413837d0a2fdafd6eb08cc0466bceda5cd243793cba087d469669a2572d33b6a55b5e3b6
TLSH
T1E7112202AEC0FC38F82A0BB020B2232B03000E02C883AAF2C0FCACA02C22C808203020
MD5 SHA1 SHA512 TLSH

Submit Download

ws6g6y79.comehRQhyKoCKCe.exe

Path C:\Windows\Fonts\ws6g6y79.comehRQhyKoCKCe.exe
Size 2.1MB
SHA256 f5738961fc24bea9800ecadacb4b3026fea05f0edf3833ff6376fea6d6ca0aa8
MD5 040dd5f0a1c3732e3e814d882051fc3b
SHA1 a5d8f49479b8415618e56f4664c8fdd3771ac197
SHA512 51bbdd8936d0f48bc91a1b296ea36451ef22ea62749f067123976dc3b834ff7c6f46391896476989f67d615a04240505f70df06800608660b3f63edf8e065515
SSDEEP 6144:4lzRXxZ27OAfW7Qil0cxxerkIL/DcJKjtjorgLQTvDTw/rJyGj+TS+:iXO7hYxeZbDwwjoNHTwDg
TLSH
T159A54907B2A8CDF9F92B9178C99145E5A632BC41C320F5FB43603E563E37AD09A396D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download