Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

71abcd053e...8f.exe

windows7-x64

10

71abcd053e...8f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    86s
  • max time network
    71s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 13:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    71abcd053e767e8463bd377c5c2b908f.exe

  • Size

    145KB

  • MD5

    71abcd053e767e8463bd377c5c2b908f

  • SHA1

    407e033b5effa9e02d148cfdc1edc73230f39274

  • SHA256

    77ee252b07e68dc35fc20b9c8b07b2bcce38d45912d9420239578a5e04131b8f

  • SHA512

    68e736496edcd412831eb7c3c526f2bc6eca14f007837d3ae15d187f312ee72afa3dddba33958d310c88ee07320f56035b07d82df2d580a28bdcb4f323158a1e

  • SSDEEP

    3072:/juq3BQoNypn9hvkwXtvmZ6Q4YxmiPkCaepM9GPw:/jdz0n9hvkwXtvmxmwXK94w

Score
10/10
persistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 64 IoCs
    persistence
  • Executes dropped EXE 64 IoCs
  • Checks for any installed AV software in registry 1 TTPs 64 IoCs
  • Modifies WinLogon 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71abcd053e767e8463bd377c5c2b908f.exe
    "C:\Users\Admin\AppData\Local\Temp\71abcd053e767e8463bd377c5c2b908f.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4280
    • C:\Windows\SysWOW64\tfbylw.exe
      C:\Windows\system32\tfbylw.exe
      2⤵
      • Executes dropped EXE
      • Checks for any installed AV software in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4844
      • C:\Windows\SysWOW64\fjnfjq.exe
        C:\Windows\system32\fjnfjq.exe
        3⤵
        • Executes dropped EXE
        • Modifies WinLogon
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3376
        • C:\Windows\SysWOW64\pgfnuz.exe
          C:\Windows\system32\pgfnuz.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2920
          • C:\Windows\SysWOW64\wenbgh.exe
            C:\Windows\system32\wenbgh.exe
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3208
            • C:\Windows\SysWOW64\xrpcwz.exe
              C:\Windows\system32\xrpcwz.exe
              6⤵
              • Modifies WinLogon for persistence
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:760
              • C:\Windows\SysWOW64\tixpcq.exe
                C:\Windows\system32\tixpcq.exe
                7⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3900
                • C:\Windows\SysWOW64\taabfa.exe
                  C:\Windows\system32\taabfa.exe
                  8⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4088
                  • C:\Windows\SysWOW64\hejiak.exe
                    C:\Windows\system32\hejiak.exe
                    9⤵
                    • Executes dropped EXE
                    • Checks for any installed AV software in registry
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3548
                    • C:\Windows\SysWOW64\hdtodd.exe
                      C:\Windows\system32\hdtodd.exe
                      10⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:408
                      • C:\Windows\SysWOW64\wykwml.exe
                        C:\Windows\system32\wykwml.exe
                        11⤵
                        • Modifies WinLogon for persistence
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:3076
                        • C:\Windows\SysWOW64\ktzkot.exe
                          C:\Windows\system32\ktzkot.exe
                          12⤵
                          • Modifies WinLogon for persistence
                          • Executes dropped EXE
                          • Modifies WinLogon
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1912
                          • C:\Windows\SysWOW64\iqasce.exe
                            C:\Windows\system32\iqasce.exe
                            13⤵
                            • Executes dropped EXE
                            • Modifies WinLogon
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1148
                            • C:\Windows\SysWOW64\pjmmoj.exe
                              C:\Windows\system32\pjmmoj.exe
                              14⤵
                              • Executes dropped EXE
                              • Modifies WinLogon
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:1900
                              • C:\Windows\SysWOW64\sefaug.exe
                                C:\Windows\system32\sefaug.exe
                                15⤵
                                • Modifies WinLogon for persistence
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:4976
                                • C:\Windows\SysWOW64\mnfnpx.exe
                                  C:\Windows\system32\mnfnpx.exe
                                  16⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:3612
                                  • C:\Windows\SysWOW64\xhyumh.exe
                                    C:\Windows\system32\xhyumh.exe
                                    17⤵
                                    • Modifies WinLogon for persistence
                                    • Executes dropped EXE
                                    • Checks for any installed AV software in registry
                                    • Modifies WinLogon
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:3168
                                    • C:\Windows\SysWOW64\kdyaqq.exe
                                      C:\Windows\system32\kdyaqq.exe
                                      18⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:3848
                                      • C:\Windows\SysWOW64\yeqgwi.exe
                                        C:\Windows\system32\yeqgwi.exe
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:3676
                                        • C:\Windows\SysWOW64\wwsdth.exe
                                          C:\Windows\system32\wwsdth.exe
                                          20⤵
                                          • Modifies WinLogon for persistence
                                          • Executes dropped EXE
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:2124
                                          • C:\Windows\SysWOW64\iumwil.exe
                                            C:\Windows\system32\iumwil.exe
                                            21⤵
                                            • Executes dropped EXE
                                            • Modifies WinLogon
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:1104
                                            • C:\Windows\SysWOW64\hicnyw.exe
                                              C:\Windows\system32\hicnyw.exe
                                              22⤵
                                              • Executes dropped EXE
                                              • Checks for any installed AV software in registry
                                              • Modifies WinLogon
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:1868
                                              • C:\Windows\SysWOW64\nwmwvb.exe
                                                C:\Windows\system32\nwmwvb.exe
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4868
                                                • C:\Windows\SysWOW64\skbxrw.exe
                                                  C:\Windows\system32\skbxrw.exe
                                                  24⤵
                                                  • Modifies WinLogon for persistence
                                                  • Executes dropped EXE
                                                  • Drops file in System32 directory
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2452
                                                  • C:\Windows\SysWOW64\byrynn.exe
                                                    C:\Windows\system32\byrynn.exe
                                                    25⤵
                                                    • Modifies WinLogon for persistence
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:3288
                                                    • C:\Windows\SysWOW64\rlcvdc.exe
                                                      C:\Windows\system32\rlcvdc.exe
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Checks for any installed AV software in registry
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2712
                                                      • C:\Windows\SysWOW64\kkehub.exe
                                                        C:\Windows\system32\kkehub.exe
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Checks for any installed AV software in registry
                                                        • Drops file in System32 directory
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3636
                                                        • C:\Windows\SysWOW64\bxuoio.exe
                                                          C:\Windows\system32\bxuoio.exe
                                                          28⤵
                                                          • Modifies WinLogon for persistence
                                                          • Executes dropped EXE
                                                          • Checks for any installed AV software in registry
                                                          • Drops file in System32 directory
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3096
                                                          • C:\Windows\SysWOW64\qnsqcb.exe
                                                            C:\Windows\system32\qnsqcb.exe
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1488
                                                            • C:\Windows\SysWOW64\wavxkk.exe
                                                              C:\Windows\system32\wavxkk.exe
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Checks for any installed AV software in registry
                                                              • Drops file in System32 directory
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:848
                                                              • C:\Windows\SysWOW64\bfcqbp.exe
                                                                C:\Windows\system32\bfcqbp.exe
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Checks for any installed AV software in registry
                                                                • Modifies WinLogon
                                                                • Drops file in System32 directory
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4324
                                                                • C:\Windows\SysWOW64\vgxbif.exe
                                                                  C:\Windows\system32\vgxbif.exe
                                                                  32⤵
                                                                  • Modifies WinLogon for persistence
                                                                  • Executes dropped EXE
                                                                  • Checks for any installed AV software in registry
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4124
                                                                  • C:\Windows\SysWOW64\zcrerf.exe
                                                                    C:\Windows\system32\zcrerf.exe
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Checks for any installed AV software in registry
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2128
                                                                    • C:\Windows\SysWOW64\linpqg.exe
                                                                      C:\Windows\system32\linpqg.exe
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Modifies WinLogon
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2852
                                                                      • C:\Windows\SysWOW64\ohlknf.exe
                                                                        C:\Windows\system32\ohlknf.exe
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in System32 directory
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:952
                                                                        • C:\Windows\SysWOW64\oitrwo.exe
                                                                          C:\Windows\system32\oitrwo.exe
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:1480
                                                                          • C:\Windows\SysWOW64\dbinzq.exe
                                                                            C:\Windows\system32\dbinzq.exe
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in System32 directory
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1772
                                                                            • C:\Windows\SysWOW64\irsels.exe
                                                                              C:\Windows\system32\irsels.exe
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              • Checks for any installed AV software in registry
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:3508
                                                                              • C:\Windows\SysWOW64\xlycje.exe
                                                                                C:\Windows\system32\xlycje.exe
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:1568
                                                                                • C:\Windows\SysWOW64\sheqkp.exe
                                                                                  C:\Windows\system32\sheqkp.exe
                                                                                  40⤵
                                                                                  • Modifies WinLogon for persistence
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:460
                                                                                  • C:\Windows\SysWOW64\zegybo.exe
                                                                                    C:\Windows\system32\zegybo.exe
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in System32 directory
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:2332
                                                                                    • C:\Windows\SysWOW64\rzlkdq.exe
                                                                                      C:\Windows\system32\rzlkdq.exe
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:1376
                                                                                      • C:\Windows\SysWOW64\nsppaw.exe
                                                                                        C:\Windows\system32\nsppaw.exe
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:4900
                                                                                        • C:\Windows\SysWOW64\hwkmfu.exe
                                                                                          C:\Windows\system32\hwkmfu.exe
                                                                                          44⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:3124
                                                                                          • C:\Windows\SysWOW64\nqpija.exe
                                                                                            C:\Windows\system32\nqpija.exe
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:3452
                                                                                            • C:\Windows\SysWOW64\rscquc.exe
                                                                                              C:\Windows\system32\rscquc.exe
                                                                                              46⤵
                                                                                              • Modifies WinLogon for persistence
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:4044
                                                                                              • C:\Windows\SysWOW64\ctlcat.exe
                                                                                                C:\Windows\system32\ctlcat.exe
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:3656
                                                                                                • C:\Windows\SysWOW64\gimivm.exe
                                                                                                  C:\Windows\system32\gimivm.exe
                                                                                                  48⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:3412
                                                                                                  • C:\Windows\SysWOW64\wvfgpw.exe
                                                                                                    C:\Windows\system32\wvfgpw.exe
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Checks for any installed AV software in registry
                                                                                                    • Modifies WinLogon
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:4988
                                                                                                    • C:\Windows\SysWOW64\itqdwx.exe
                                                                                                      C:\Windows\system32\itqdwx.exe
                                                                                                      50⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1608
                                                                                                      • C:\Windows\SysWOW64\qgtoel.exe
                                                                                                        C:\Windows\system32\qgtoel.exe
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:4448
                                                                                                        • C:\Windows\SysWOW64\cfdkvi.exe
                                                                                                          C:\Windows\system32\cfdkvi.exe
                                                                                                          52⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Modifies WinLogon
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:4668
                                                                                                          • C:\Windows\SysWOW64\smzrib.exe
                                                                                                            C:\Windows\system32\smzrib.exe
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Checks for any installed AV software in registry
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:2204
                                                                                                            • C:\Windows\SysWOW64\gwlndt.exe
                                                                                                              C:\Windows\system32\gwlndt.exe
                                                                                                              54⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2612
                                                                                                              • C:\Windows\SysWOW64\elsjui.exe
                                                                                                                C:\Windows\system32\elsjui.exe
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Checks for any installed AV software in registry
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4356
                                                                                                                • C:\Windows\SysWOW64\gsvfay.exe
                                                                                                                  C:\Windows\system32\gsvfay.exe
                                                                                                                  56⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Checks for any installed AV software in registry
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:1916
                                                                                                                  • C:\Windows\SysWOW64\vmfmau.exe
                                                                                                                    C:\Windows\system32\vmfmau.exe
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Modifies WinLogon
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:1548
                                                                                                                    • C:\Windows\SysWOW64\prpdwg.exe
                                                                                                                      C:\Windows\system32\prpdwg.exe
                                                                                                                      58⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks for any installed AV software in registry
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:3800
                                                                                                                      • C:\Windows\SysWOW64\pfeqcr.exe
                                                                                                                        C:\Windows\system32\pfeqcr.exe
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:4344
                                                                                                                        • C:\Windows\SysWOW64\wynfzf.exe
                                                                                                                          C:\Windows\system32\wynfzf.exe
                                                                                                                          60⤵
                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2708
                                                                                                                          • C:\Windows\SysWOW64\efmweh.exe
                                                                                                                            C:\Windows\system32\efmweh.exe
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:4060
                                                                                                                            • C:\Windows\SysWOW64\trsgps.exe
                                                                                                                              C:\Windows\system32\trsgps.exe
                                                                                                                              62⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:3320
                                                                                                                              • C:\Windows\SysWOW64\ywdqea.exe
                                                                                                                                C:\Windows\system32\ywdqea.exe
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:2456
                                                                                                                                • C:\Windows\SysWOW64\jcfcsf.exe
                                                                                                                                  C:\Windows\system32\jcfcsf.exe
                                                                                                                                  64⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Modifies WinLogon
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:4964
                                                                                                                                  • C:\Windows\SysWOW64\atgyaf.exe
                                                                                                                                    C:\Windows\system32\atgyaf.exe
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    PID:4888
                                                                                                                                    • C:\Windows\SysWOW64\fwqzuo.exe
                                                                                                                                      C:\Windows\system32\fwqzuo.exe
                                                                                                                                      66⤵
                                                                                                                                        PID:544
                                                                                                                                        • C:\Windows\SysWOW64\xhoesx.exe
                                                                                                                                          C:\Windows\system32\xhoesx.exe
                                                                                                                                          67⤵
                                                                                                                                          • Modifies WinLogon
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          PID:4664
                                                                                                                                          • C:\Windows\SysWOW64\xzcklj.exe
                                                                                                                                            C:\Windows\system32\xzcklj.exe
                                                                                                                                            68⤵
                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            PID:1612
                                                                                                                                            • C:\Windows\SysWOW64\buznhm.exe
                                                                                                                                              C:\Windows\system32\buznhm.exe
                                                                                                                                              69⤵
                                                                                                                                              • Modifies WinLogon
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              PID:2360
                                                                                                                                              • C:\Windows\SysWOW64\xdmuvz.exe
                                                                                                                                                C:\Windows\system32\xdmuvz.exe
                                                                                                                                                70⤵
                                                                                                                                                  PID:1860
                                                                                                                                                  • C:\Windows\SysWOW64\skhxnc.exe
                                                                                                                                                    C:\Windows\system32\skhxnc.exe
                                                                                                                                                    71⤵
                                                                                                                                                      PID:3128
                                                                                                                                                      • C:\Windows\SysWOW64\sirxot.exe
                                                                                                                                                        C:\Windows\system32\sirxot.exe
                                                                                                                                                        72⤵
                                                                                                                                                        • Checks for any installed AV software in registry
                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                        PID:1696
                                                                                                                                                        • C:\Windows\SysWOW64\dcguhk.exe
                                                                                                                                                          C:\Windows\system32\dcguhk.exe
                                                                                                                                                          73⤵
                                                                                                                                                            PID:4612
                                                                                                                                                            • C:\Windows\SysWOW64\papaex.exe
                                                                                                                                                              C:\Windows\system32\papaex.exe
                                                                                                                                                              74⤵
                                                                                                                                                                PID:2300
                                                                                                                                                                • C:\Windows\SysWOW64\dehdig.exe
                                                                                                                                                                  C:\Windows\system32\dehdig.exe
                                                                                                                                                                  75⤵
                                                                                                                                                                    PID:2008
                                                                                                                                                                    • C:\Windows\SysWOW64\dotnnz.exe
                                                                                                                                                                      C:\Windows\system32\dotnnz.exe
                                                                                                                                                                      76⤵
                                                                                                                                                                        PID:1556
                                                                                                                                                                        • C:\Windows\SysWOW64\gbwcon.exe
                                                                                                                                                                          C:\Windows\system32\gbwcon.exe
                                                                                                                                                                          77⤵
                                                                                                                                                                            PID:4392
                                                                                                                                                                            • C:\Windows\SysWOW64\vlgpiq.exe
                                                                                                                                                                              C:\Windows\system32\vlgpiq.exe
                                                                                                                                                                              78⤵
                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                              PID:620
                                                                                                                                                                              • C:\Windows\SysWOW64\hwwjbl.exe
                                                                                                                                                                                C:\Windows\system32\hwwjbl.exe
                                                                                                                                                                                79⤵
                                                                                                                                                                                  PID:4472
                                                                                                                                                                                  • C:\Windows\SysWOW64\kcgtua.exe
                                                                                                                                                                                    C:\Windows\system32\kcgtua.exe
                                                                                                                                                                                    80⤵
                                                                                                                                                                                    • Checks for any installed AV software in registry
                                                                                                                                                                                    PID:4456
                                                                                                                                                                                    • C:\Windows\SysWOW64\avxipl.exe
                                                                                                                                                                                      C:\Windows\system32\avxipl.exe
                                                                                                                                                                                      81⤵
                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                      • Checks for any installed AV software in registry
                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                      PID:2736
                                                                                                                                                                                      • C:\Windows\SysWOW64\swawro.exe
                                                                                                                                                                                        C:\Windows\system32\swawro.exe
                                                                                                                                                                                        82⤵
                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                        PID:5136
                                                                                                                                                                                        • C:\Windows\SysWOW64\bwjxba.exe
                                                                                                                                                                                          C:\Windows\system32\bwjxba.exe
                                                                                                                                                                                          83⤵
                                                                                                                                                                                          • Checks for any installed AV software in registry
                                                                                                                                                                                          PID:5164
                                                                                                                                                                                          • C:\Windows\SysWOW64\iswwtd.exe
                                                                                                                                                                                            C:\Windows\system32\iswwtd.exe
                                                                                                                                                                                            84⤵
                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                            • Checks for any installed AV software in registry
                                                                                                                                                                                            PID:5196
                                                                                                                                                                                            • C:\Windows\SysWOW64\behocl.exe
                                                                                                                                                                                              C:\Windows\system32\behocl.exe
                                                                                                                                                                                              85⤵
                                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                              PID:5228
                                                                                                                                                                                              • C:\Windows\SysWOW64\csbfzd.exe
                                                                                                                                                                                                C:\Windows\system32\csbfzd.exe
                                                                                                                                                                                                86⤵
                                                                                                                                                                                                  PID:5260
                                                                                                                                                                                                  • C:\Windows\SysWOW64\chafdp.exe
                                                                                                                                                                                                    C:\Windows\system32\chafdp.exe
                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                    PID:5288
                                                                                                                                                                                                    • C:\Windows\SysWOW64\twahoy.exe
                                                                                                                                                                                                      C:\Windows\system32\twahoy.exe
                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                        PID:5328
                                                                                                                                                                                                        • C:\Windows\SysWOW64\pdcvhi.exe
                                                                                                                                                                                                          C:\Windows\system32\pdcvhi.exe
                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                          • Modifies WinLogon
                                                                                                                                                                                                          PID:5360
                                                                                                                                                                                                          • C:\Windows\SysWOW64\shcxwf.exe
                                                                                                                                                                                                            C:\Windows\system32\shcxwf.exe
                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                              PID:5392
                                                                                                                                                                                                              • C:\Windows\SysWOW64\rbrccz.exe
                                                                                                                                                                                                                C:\Windows\system32\rbrccz.exe
                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                PID:5432
                                                                                                                                                                                                                • C:\Windows\SysWOW64\naqqys.exe
                                                                                                                                                                                                                  C:\Windows\system32\naqqys.exe
                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                  PID:5464
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\lhlbwm.exe
                                                                                                                                                                                                                    C:\Windows\system32\lhlbwm.exe
                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                    PID:5496
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\yoslsy.exe
                                                                                                                                                                                                                      C:\Windows\system32\yoslsy.exe
                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                                                      PID:5528
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\vsegfn.exe
                                                                                                                                                                                                                        C:\Windows\system32\vsegfn.exe
                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                                                        PID:5564
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\pjtybd.exe
                                                                                                                                                                                                                          C:\Windows\system32\pjtybd.exe
                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                          • Checks for any installed AV software in registry
                                                                                                                                                                                                                          • Modifies WinLogon
                                                                                                                                                                                                                          PID:5596
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\tdqpsh.exe
                                                                                                                                                                                                                            C:\Windows\system32\tdqpsh.exe
                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                              PID:5680
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\jggmge.exe
                                                                                                                                                                                                                                C:\Windows\system32\jggmge.exe
                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                • Checks for any installed AV software in registry
                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                PID:5812
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\xhvhvr.exe
                                                                                                                                                                                                                                  C:\Windows\system32\xhvhvr.exe
                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                  PID:5848
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\gewbxy.exe
                                                                                                                                                                                                                                    C:\Windows\system32\gewbxy.exe
                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                    PID:5888
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rcldxz.exe
                                                                                                                                                                                                                                      C:\Windows\system32\rcldxz.exe
                                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                                      • Checks for any installed AV software in registry
                                                                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                                                                      PID:5936
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\slcsqj.exe
                                                                                                                                                                                                                                        C:\Windows\system32\slcsqj.exe
                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                          PID:5992
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\zyjoxm.exe
                                                                                                                                                                                                                                            C:\Windows\system32\zyjoxm.exe
                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                              PID:6028
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\khwmet.exe
                                                                                                                                                                                                                                                C:\Windows\system32\khwmet.exe
                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                                                                                                PID:6088
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\fubola.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\fubola.exe
                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                                  PID:6132
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rqinvt.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\rqinvt.exe
                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                    • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                    PID:5324
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\yzgzaq.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\yzgzaq.exe
                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                      • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                      PID:5420
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\lrxvku.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\lrxvku.exe
                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                          PID:5536
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\unktro.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\unktro.exe
                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                                                                                            PID:5628
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\nwgtfe.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\nwgtfe.exe
                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                PID:5796
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cpvxki.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cpvxki.exe
                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                  PID:5844
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\gnufeq.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\gnufeq.exe
                                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                    PID:5920
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\pvqkdx.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\pvqkdx.exe
                                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                                      • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                                                                                                      PID:5908
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\zoyjtg.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\zoyjtg.exe
                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                        PID:6020
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ipikhw.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\ipikhw.exe
                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                          PID:6084
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ymrcpa.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\ymrcpa.exe
                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                            • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                            PID:6120
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfqfsh.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\hfqfsh.exe
                                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                                              • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                              PID:3184
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\djrokq.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\djrokq.exe
                                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                                  PID:5320
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\upcfcp.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\upcfcp.exe
                                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                                      PID:5284
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\oysvvx.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\oysvvx.exe
                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                                                                                                                        PID:5172
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\lwckyy.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\lwckyy.exe
                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                          • Modifies WinLogon
                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                          PID:5388
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\xrtlkf.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\xrtlkf.exe
                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                                                                                                                            PID:5588
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\qgmxgi.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\qgmxgi.exe
                                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                                              • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                              PID:408
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ibhzul.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\ibhzul.exe
                                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                PID:3256
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\duqgsb.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\duqgsb.exe
                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                  PID:3644
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\fnldcx.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\fnldcx.exe
                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                    PID:4192
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cgxdfn.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cgxdfn.exe
                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                      PID:2296
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\czrkrm.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\czrkrm.exe
                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                        PID:5980
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\tfcsbr.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\tfcsbr.exe
                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                            PID:2920
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\faubnm.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\faubnm.exe
                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                              PID:5160
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\mxbrqk.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\mxbrqk.exe
                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                  PID:5316
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\coqruz.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\coqruz.exe
                                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                                    • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                    PID:5184
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\gxbbym.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\gxbbym.exe
                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                      PID:5188
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\tniems.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\tniems.exe
                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                          PID:4100
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ociqvu.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\ociqvu.exe
                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                            PID:5604
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\mvoqzb.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\mvoqzb.exe
                                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                                                PID:2344
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sgokqm.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\sgokqm.exe
                                                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                                                  • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                  PID:3076
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\fbhdtu.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\fbhdtu.exe
                                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                    PID:4908
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ypzojy.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\ypzojy.exe
                                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                      PID:4772
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ffqhmw.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\ffqhmw.exe
                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                          PID:2712
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\qbcpwj.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\qbcpwj.exe
                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                              PID:2608
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\acqbqu.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\acqbqu.exe
                                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3568
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\dtvaak.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\dtvaak.exe
                                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                    PID:6100
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\depzyf.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\depzyf.exe
                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                      PID:4600
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\xkhjfk.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\xkhjfk.exe
                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                          PID:848
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\petccw.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\petccw.exe
                                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                                            • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                            PID:4324
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\zivgdr.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\zivgdr.exe
                                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                              PID:3240
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\jxueiv.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\jxueiv.exe
                                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                PID:2128
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\axlshx.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\axlshx.exe
                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1104
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ogqqvy.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\ogqqvy.exe
                                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                      PID:1516
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\scehtb.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\scehtb.exe
                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                        PID:732
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\easmsb.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\easmsb.exe
                                                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                          • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                          PID:3764
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\dllhru.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\dllhru.exe
                                                                                                                                                                                                                                                                                                                                                                            153⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                            PID:3356
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\llsisw.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\llsisw.exe
                                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3264
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ijhmkt.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\ijhmkt.exe
                                                                                                                                                                                                                                                                                                                                                                                  155⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                  PID:5644
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\frfkao.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\frfkao.exe
                                                                                                                                                                                                                                                                                                                                                                                    156⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                    PID:6000
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ajucip.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\ajucip.exe
                                                                                                                                                                                                                                                                                                                                                                                      157⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                      PID:4976
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\qvtbmp.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\qvtbmp.exe
                                                                                                                                                                                                                                                                                                                                                                                        158⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1672
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cspdsl.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cspdsl.exe
                                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:5156
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\nylnoa.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\nylnoa.exe
                                                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                              PID:760
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\jilqzg.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\jilqzg.exe
                                                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\xmbles.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\xmbles.exe
                                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\tmminn.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\tmminn.exe
                                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5112
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\whlgny.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\whlgny.exe
                                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\bonxso.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\bonxso.exe
                                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\jnxvbh.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\jnxvbh.exe
                                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5424
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\iuosuk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\iuosuk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ymxarg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\ymxarg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\oappow.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\oappow.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3080
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\vysnky.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\vysnky.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\zoqyhx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\zoqyhx.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\bvdhqb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\bvdhqb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\xxritw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\xxritw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\nqchga.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\nqchga.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wdphqp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\wdphqp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\yuwmfz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\yuwmfz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3500
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wpydxc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\wpydxc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\gdjcuw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\gdjcuw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4044
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\deeimj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\deeimj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\chcmav.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\chcmav.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ybqyth.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ybqyth.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:800
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\anjwpo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\anjwpo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\jfmikw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\jfmikw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\yyukuy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\yyukuy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\fgeprd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\fgeprd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\augljr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\augljr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ryogez.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\ryogez.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ineglt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ineglt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\vvwgno.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\vvwgno.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\fckswk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\fckswk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\atlqrd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\atlqrd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\kmmaub.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\kmmaub.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\vnycgo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\vnycgo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wwhtdp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\wwhtdp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\fedewa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\fedewa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\uppava.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\uppava.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\enlvda.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\enlvda.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\tdslmr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\tdslmr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\bmrhyu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\bmrhyu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\kdsqil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\kdsqil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\zlurkh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\zlurkh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\htrlpp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\htrlpp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\zinphy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\zinphy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\tpddeh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\tpddeh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\qjextm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\qjextm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ptfjft.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\ptfjft.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\biywod.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\biywod.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rypwun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\rypwun.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ykuijb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\ykuijb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\krjjnr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\krjjnr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\gtrdwl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\gtrdwl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ceoupa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ceoupa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\blkhgj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\blkhgj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\qactxs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\qactxs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\epnjrm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\epnjrm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cbgntp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cbgntp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ryrjel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ryrjel.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\kcjphe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\kcjphe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfqcnz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfqcnz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wrtyab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\wrtyab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\blhslp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\blhslp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\fuuyek.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\fuuyek.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cfglfj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cfglfj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\azcoim.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\azcoim.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\uoiufi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\uoiufi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\bekhjz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\bekhjz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\gxwvni.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\gxwvni.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\inaxbg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\inaxbg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\yxbkgf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\yxbkgf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\fkggsj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\fkggsj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\lnyvvm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\lnyvvm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\lvbtyn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\lvbtyn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\tzeucq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\tzeucq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\qzspje.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\qzspje.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\isbtju.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\isbtju.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\absluj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\absluj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ysrrrp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\ysrrrp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\kebqzb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\kebqzb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\nbsluv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\nbsluv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\qgxoug.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\qgxoug.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\bfxfit.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\bfxfit.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\melwwg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\melwwg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hjhapo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hjhapo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hcpxku.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hcpxku.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\etrkzs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\etrkzs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ylksgq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ylksgq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\kvhzlo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\kvhzlo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\kmvuop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\kmvuop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\fwciad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\fwciad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\mdwmsi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\mdwmsi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\twoawz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\twoawz.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\zqvgyc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\zqvgyc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ilodpu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\ilodpu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\nebsrw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\nebsrw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\thbjgi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\thbjgi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\jfeuet.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\jfeuet.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ydrkzo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\ydrkzo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rgzxct.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\rgzxct.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\nchanf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\nchanf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\slhsbj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\slhsbj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ikzvbt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\ikzvbt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\tqhznv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\tqhznv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\zpbpug.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\zpbpug.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rjyavm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\rjyavm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\trzjri.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\trzjri.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\mvzgzy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\mvzgzy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\trmggk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\trmggk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\mxsfuh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\mxsfuh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\bflrge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\bflrge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\dsqanl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\dsqanl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\fzzdxi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\fzzdxi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\yqbhuq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\yqbhuq.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\tengge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\tengge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\oyvsze.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\oyvsze.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\tvajdw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\tvajdw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\jegxvv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\jegxvv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\zhdykn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\zhdykn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\yizzue.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\yizzue.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\pvfsvw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\pvfsvw.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6052

                                                                                                                                                            Network

                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            • C:\Windows\SysWOW64\bxuoio.exe
                                                                                                                                                              Filesize

                                                                                                                                                              93KB

                                                                                                                                                              MD5

                                                                                                                                                              f8adb793609c626beba142f17d4d69d1

                                                                                                                                                              SHA1

                                                                                                                                                              979a2dcdd9d03b97b4c82b5622d5c47f02d32e8b

                                                                                                                                                              SHA256

                                                                                                                                                              4a92a6a03250050410232a08bd367d6ccf43ac23ad639583560058e6def4005b

                                                                                                                                                              SHA512

                                                                                                                                                              4fe18707b5cbc3d41e2cb04bf7540ec77680b1908644c72195b5c7e3d7307a38d8aa8174716fb9c146d9cbf199236ea6050f3a11867bbbf5404bd8e876c1ca0f

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\SysWOW64\iumwil.exe
                                                                                                                                                              Filesize

                                                                                                                                                              104KB

                                                                                                                                                              MD5

                                                                                                                                                              ccda68507100d0fa60f512b43244b9f3

                                                                                                                                                              SHA1

                                                                                                                                                              609cb65234517fdc583bed2a065bff294130ca7f

                                                                                                                                                              SHA256

                                                                                                                                                              e492d943c5e429e9704d5e1279739fe6cf3a36b49f49896e150f1e758b132005

                                                                                                                                                              SHA512

                                                                                                                                                              591bdc72691484df2567ed9e65be40331c155367102cbb7fbff4ea3560b43d67ee4fd2be85bb214033292d80ec51148367ac1749d0f0cc0c983bcbdc31cd94c4

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\SysWOW64\iumwil.exe
                                                                                                                                                              Filesize

                                                                                                                                                              72KB

                                                                                                                                                              MD5

                                                                                                                                                              df330fc30b850b5ddb64aa07ba40f8b9

                                                                                                                                                              SHA1

                                                                                                                                                              d08e1659c84113750177a25899ff9f3118b5e3c8

                                                                                                                                                              SHA256

                                                                                                                                                              f70f100bb282866bb61dcf87e7584596d17805ebc7746d245060623f700c2b5e

                                                                                                                                                              SHA512

                                                                                                                                                              c271eeade458a102e95274a0018bba5fd199bf19445baad6671d79f14556ad7fceed77cfb10b8f60ee81332b229190b5ccf13e8ddea28db51ded7cd6c4f862a5

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\SysWOW64\tfbylw.exe
                                                                                                                                                              Filesize

                                                                                                                                                              145KB

                                                                                                                                                              MD5

                                                                                                                                                              71abcd053e767e8463bd377c5c2b908f

                                                                                                                                                              SHA1

                                                                                                                                                              407e033b5effa9e02d148cfdc1edc73230f39274

                                                                                                                                                              SHA256

                                                                                                                                                              77ee252b07e68dc35fc20b9c8b07b2bcce38d45912d9420239578a5e04131b8f

                                                                                                                                                              SHA512

                                                                                                                                                              68e736496edcd412831eb7c3c526f2bc6eca14f007837d3ae15d187f312ee72afa3dddba33958d310c88ee07320f56035b07d82df2d580a28bdcb4f323158a1e

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\SysWOW64\wwsdth.exe
                                                                                                                                                              Filesize

                                                                                                                                                              62KB

                                                                                                                                                              MD5

                                                                                                                                                              7660551dca98489cecc761966b43ba09

                                                                                                                                                              SHA1

                                                                                                                                                              6639da70647b510eb39d8dafc110cb376d9911a3

                                                                                                                                                              SHA256

                                                                                                                                                              32a2cca3b244a6024d5addac8b9209793f34a883953543f3c8bbd8a6af615b22

                                                                                                                                                              SHA512

                                                                                                                                                              0146f0dd79631bd78c5ffaae9c29f030d0399b16a0f666f2eb24e56573e3567e99098c0fe1796f43b366982898090174ca2f931bf5c0a9a17bcb034d99b027ef

                                                                                                                                                              Download Submit

                                                                                                                                                            • C:\Windows\SysWOW64\wwsdth.exe
                                                                                                                                                              Filesize

                                                                                                                                                              108KB

                                                                                                                                                              MD5

                                                                                                                                                              3ffaa374e1eb5f3c9cdb82a928d75183

                                                                                                                                                              SHA1

                                                                                                                                                              8c41c33c99e6d209b941452eb922fe8a36d2283f

                                                                                                                                                              SHA256

                                                                                                                                                              baf14a97aa6113b3852288ec5a7b8978edb549825d2bf68d05d1334181ab3c5f

                                                                                                                                                              SHA512

                                                                                                                                                              ee896c6f4ed98313939128dda16082989a3c929cc369d6b2c417c78322d0fa1a77e135cd0f0aee132ae890320626e01a4176b06d78cecdc53501bc745c2f93e7

                                                                                                                                                              Download Submit

                                                                                                                                                            • memory/408-49-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/460-214-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/760-53-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/848-153-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/952-174-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1104-131-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1148-90-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1376-204-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1480-198-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1488-148-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1568-192-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1608-233-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1772-202-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1868-112-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1900-96-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1900-69-0x0000000002050000-0x0000000002069000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              100KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1912-61-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1912-58-0x00000000004C0000-0x00000000004D9000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              100KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1916-258-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2124-105-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2128-184-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2204-264-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2332-199-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2452-121-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2612-268-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2712-132-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2852-189-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2920-17-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3076-80-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3096-143-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3124-227-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3168-85-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3208-48-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3288-126-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3376-36-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3376-11-0x0000000002040000-0x0000000002059000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              100KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3412-245-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3452-231-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3508-187-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3548-43-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3612-81-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3636-137-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3656-222-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3676-98-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3848-92-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3900-59-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/3900-30-0x00000000005B0000-0x00000000005C9000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              100KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4044-236-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4088-37-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4124-181-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4280-1-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4280-25-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4280-0-0x00000000005A0000-0x00000000005B9000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              100KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4324-177-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4344-270-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4356-254-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4448-238-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4668-242-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4844-31-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4844-6-0x0000000000590000-0x00000000005A9000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              100KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4868-141-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4900-208-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4976-75-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/4988-249-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              160KB

                                                                                                                                                              Download