Analysis
-
max time kernel
86s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2022 02:44
Behavioral task
behavioral1
Sample
9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe
Resource
win10v2004-20220812-en
General
-
Target
9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe
-
Size
99KB
-
MD5
7a3c3fc3693cd7fa613e5ea8f204bf40
-
SHA1
7b85325a5fdb808b30a0328325761d5b8d2f555c
-
SHA256
9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1
-
SHA512
11ef32be04ad3c1af2f94e2bd7bfd91456da50580a94ba23bea3b33a050a3d6ec09d3642ff9ce544db3b49295fd6dbe1b4cd9f219d11c4770e5c74c048fa58cf
-
SSDEEP
1536:32R41Jrt6Bi48Bcf1PJsQN7jDQqLDTysHrEnQ1g3:GPxGWvpDvE/3
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2120 3MW2BkP.exe 3676 3MW2BkP.exe 1864 3MW2BkP.exe 212 3MW2BkP.exe 952 3MW2BkP.exe 3948 3MW2BkP.exe 3260 3MW2BkP.exe 5056 3MW2BkP.exe 1840 3MW2BkP.exe 4920 3MW2BkP.exe 3872 3MW2BkP.exe 1404 3MW2BkP.exe 4916 3MW2BkP.exe 1808 3MW2BkP.exe 4616 3MW2BkP.exe 2072 3MW2BkP.exe 2340 3MW2BkP.exe 4996 3MW2BkP.exe 4448 3MW2BkP.exe 4512 3MW2BkP.exe 3632 3MW2BkP.exe 4220 3MW2BkP.exe 512 3MW2BkP.exe 1600 3MW2BkP.exe 3696 3MW2BkP.exe 3492 3MW2BkP.exe 1236 3MW2BkP.exe 3388 3MW2BkP.exe 2004 3MW2BkP.exe 2376 3MW2BkP.exe 5016 3MW2BkP.exe 5076 3MW2BkP.exe 4104 3MW2BkP.exe 4100 3MW2BkP.exe 768 3MW2BkP.exe 1572 3MW2BkP.exe 2720 3MW2BkP.exe 1896 3MW2BkP.exe 2180 3MW2BkP.exe 4376 3MW2BkP.exe 3880 3MW2BkP.exe 4148 3MW2BkP.exe 2156 3MW2BkP.exe 1632 3MW2BkP.exe 4520 3MW2BkP.exe 3940 3MW2BkP.exe 4568 3MW2BkP.exe 2300 3MW2BkP.exe 2288 3MW2BkP.exe 3376 3MW2BkP.exe 1964 3MW2BkP.exe 4960 3MW2BkP.exe 1456 3MW2BkP.exe 3680 3MW2BkP.exe 2696 3MW2BkP.exe 4576 3MW2BkP.exe 4580 3MW2BkP.exe 1804 3MW2BkP.exe 1452 3MW2BkP.exe 4860 3MW2BkP.exe 3912 3MW2BkP.exe 2572 3MW2BkP.exe 2860 3MW2BkP.exe 4688 3MW2BkP.exe -
resource yara_rule behavioral2/memory/4004-132-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/files/0x0007000000022e3e-134.dat upx behavioral2/files/0x0007000000022e3e-135.dat upx behavioral2/files/0x0007000000022e3e-137.dat upx behavioral2/files/0x0007000000022e3e-139.dat upx behavioral2/files/0x0007000000022e3e-141.dat upx behavioral2/files/0x0007000000022e3e-143.dat upx behavioral2/files/0x0007000000022e3e-145.dat upx behavioral2/files/0x0007000000022e3e-147.dat upx behavioral2/files/0x0007000000022e3e-149.dat upx behavioral2/files/0x0007000000022e3e-151.dat upx behavioral2/files/0x0007000000022e3e-153.dat upx behavioral2/files/0x0007000000022e3e-155.dat upx behavioral2/files/0x0007000000022e3e-157.dat upx behavioral2/files/0x0007000000022e3e-159.dat upx behavioral2/files/0x0007000000022e3e-161.dat upx behavioral2/files/0x0007000000022e3e-163.dat upx behavioral2/files/0x0007000000022e3e-165.dat upx behavioral2/files/0x0007000000022e3e-167.dat upx behavioral2/files/0x0007000000022e3e-169.dat upx behavioral2/files/0x0007000000022e3e-171.dat upx behavioral2/files/0x0007000000022e3e-173.dat upx behavioral2/files/0x0007000000022e3e-175.dat upx behavioral2/files/0x0007000000022e3e-177.dat upx behavioral2/files/0x0007000000022e3e-179.dat upx behavioral2/files/0x0007000000022e3e-181.dat upx behavioral2/memory/2120-182-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/3676-184-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/212-187-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/files/0x0007000000022e3e-186.dat upx behavioral2/memory/1864-185-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/952-189-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/3948-193-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/files/0x0007000000022e3e-197.dat upx behavioral2/memory/4920-200-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/3872-203-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/files/0x0007000000022e3e-211.dat upx behavioral2/memory/1808-210-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/4616-213-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/2340-217-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/files/0x0007000000022e3e-228.dat upx behavioral2/memory/3632-227-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/1600-234-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/memory/1236-236-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral2/files/0x0007000000022e3e-238.dat upx behavioral2/files/0x0007000000022e3e-240.dat upx behavioral2/files/0x0007000000022e3e-242.dat upx behavioral2/files/0x0007000000022e3e-244.dat upx behavioral2/files/0x0007000000022e3e-246.dat upx behavioral2/files/0x0007000000022e3e-248.dat upx behavioral2/files/0x0007000000022e3e-250.dat upx behavioral2/files/0x0007000000022e3e-252.dat upx behavioral2/files/0x0007000000022e3e-256.dat upx behavioral2/files/0x0007000000022e3e-258.dat upx behavioral2/files/0x0007000000022e3e-262.dat upx behavioral2/files/0x0007000000022e3e-264.dat upx behavioral2/files/0x0007000000022e3e-260.dat upx behavioral2/files/0x0007000000022e3e-266.dat upx behavioral2/files/0x0007000000022e3e-254.dat upx behavioral2/files/0x0007000000022e3e-268.dat upx behavioral2/files/0x0007000000022e3e-270.dat upx behavioral2/files/0x0007000000022e3e-274.dat upx behavioral2/files/0x0007000000022e3e-272.dat upx behavioral2/files/0x0007000000022e3e-276.dat upx -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\l: 3MW2BkP.exe File opened (read-only) \??\m: 3MW2BkP.exe File opened (read-only) \??\p: 3MW2BkP.exe File opened (read-only) \??\h: 3MW2BkP.exe File opened (read-only) \??\h: 3MW2BkP.exe File opened (read-only) \??\f: 3MW2BkP.exe File opened (read-only) \??\v: 3MW2BkP.exe File opened (read-only) \??\e: 3MW2BkP.exe File opened (read-only) \??\u: 3MW2BkP.exe File opened (read-only) \??\g: 3MW2BkP.exe File opened (read-only) \??\w: 3MW2BkP.exe File opened (read-only) \??\j: 3MW2BkP.exe File opened (read-only) \??\p: 3MW2BkP.exe File opened (read-only) \??\m: 3MW2BkP.exe File opened (read-only) \??\w: 3MW2BkP.exe File opened (read-only) \??\s: 3MW2BkP.exe File opened (read-only) \??\p: 3MW2BkP.exe File opened (read-only) \??\w: 3MW2BkP.exe File opened (read-only) \??\o: 3MW2BkP.exe File opened (read-only) \??\j: 3MW2BkP.exe File opened (read-only) \??\j: 3MW2BkP.exe File opened (read-only) \??\m: 3MW2BkP.exe File opened (read-only) \??\o: 3MW2BkP.exe File opened (read-only) \??\j: 3MW2BkP.exe File opened (read-only) \??\r: 3MW2BkP.exe File opened (read-only) \??\f: 3MW2BkP.exe File opened (read-only) \??\g: 3MW2BkP.exe File opened (read-only) \??\u: 3MW2BkP.exe File opened (read-only) \??\z: 3MW2BkP.exe File opened (read-only) \??\m: 3MW2BkP.exe File opened (read-only) \??\k: 3MW2BkP.exe File opened (read-only) \??\m: 3MW2BkP.exe File opened (read-only) \??\j: 3MW2BkP.exe File opened (read-only) \??\l: 3MW2BkP.exe File opened (read-only) \??\h: 3MW2BkP.exe File opened (read-only) \??\j: 3MW2BkP.exe File opened (read-only) \??\u: 3MW2BkP.exe File opened (read-only) \??\u: 3MW2BkP.exe File opened (read-only) \??\i: 3MW2BkP.exe File opened (read-only) \??\m: 3MW2BkP.exe File opened (read-only) \??\u: 3MW2BkP.exe File opened (read-only) \??\s: 3MW2BkP.exe File opened (read-only) \??\u: 3MW2BkP.exe File opened (read-only) \??\j: 3MW2BkP.exe File opened (read-only) \??\u: 3MW2BkP.exe File opened (read-only) \??\t: 3MW2BkP.exe File opened (read-only) \??\h: 3MW2BkP.exe File opened (read-only) \??\f: 3MW2BkP.exe File opened (read-only) \??\w: 3MW2BkP.exe File opened (read-only) \??\n: 3MW2BkP.exe File opened (read-only) \??\m: 3MW2BkP.exe File opened (read-only) \??\q: 3MW2BkP.exe File opened (read-only) \??\t: 3MW2BkP.exe File opened (read-only) \??\g: 3MW2BkP.exe File opened (read-only) \??\e: 3MW2BkP.exe File opened (read-only) \??\v: 3MW2BkP.exe File opened (read-only) \??\n: 3MW2BkP.exe File opened (read-only) \??\y: 3MW2BkP.exe File opened (read-only) \??\h: 3MW2BkP.exe File opened (read-only) \??\f: 3MW2BkP.exe File opened (read-only) \??\h: 3MW2BkP.exe File opened (read-only) \??\n: 3MW2BkP.exe File opened (read-only) \??\l: 3MW2BkP.exe File opened (read-only) \??\v: 3MW2BkP.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 4004 9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe Token: SeLoadDriverPrivilege 2120 3MW2BkP.exe Token: SeLoadDriverPrivilege 3676 3MW2BkP.exe Token: SeLoadDriverPrivilege 1864 3MW2BkP.exe Token: SeLoadDriverPrivilege 212 3MW2BkP.exe Token: SeLoadDriverPrivilege 952 3MW2BkP.exe Token: SeLoadDriverPrivilege 3948 3MW2BkP.exe Token: SeLoadDriverPrivilege 3260 3MW2BkP.exe Token: SeLoadDriverPrivilege 5056 3MW2BkP.exe Token: SeLoadDriverPrivilege 1840 3MW2BkP.exe Token: SeLoadDriverPrivilege 4920 3MW2BkP.exe Token: SeLoadDriverPrivilege 3872 3MW2BkP.exe Token: SeLoadDriverPrivilege 1404 3MW2BkP.exe Token: SeLoadDriverPrivilege 4916 3MW2BkP.exe Token: SeLoadDriverPrivilege 1808 3MW2BkP.exe Token: SeLoadDriverPrivilege 4616 3MW2BkP.exe Token: SeLoadDriverPrivilege 2072 3MW2BkP.exe Token: SeLoadDriverPrivilege 2340 3MW2BkP.exe Token: SeLoadDriverPrivilege 4996 3MW2BkP.exe Token: SeLoadDriverPrivilege 4448 3MW2BkP.exe Token: SeLoadDriverPrivilege 4512 3MW2BkP.exe Token: SeLoadDriverPrivilege 3632 3MW2BkP.exe Token: SeLoadDriverPrivilege 4220 3MW2BkP.exe Token: SeLoadDriverPrivilege 512 3MW2BkP.exe Token: SeLoadDriverPrivilege 1600 3MW2BkP.exe Token: SeLoadDriverPrivilege 3696 3MW2BkP.exe Token: SeLoadDriverPrivilege 3492 3MW2BkP.exe Token: SeLoadDriverPrivilege 1236 3MW2BkP.exe Token: SeLoadDriverPrivilege 3388 3MW2BkP.exe Token: SeLoadDriverPrivilege 2004 3MW2BkP.exe Token: SeLoadDriverPrivilege 2376 3MW2BkP.exe Token: SeLoadDriverPrivilege 5016 3MW2BkP.exe Token: SeLoadDriverPrivilege 5076 3MW2BkP.exe Token: SeLoadDriverPrivilege 4104 3MW2BkP.exe Token: SeLoadDriverPrivilege 4100 3MW2BkP.exe Token: SeLoadDriverPrivilege 768 3MW2BkP.exe Token: SeLoadDriverPrivilege 1572 3MW2BkP.exe Token: SeLoadDriverPrivilege 2720 3MW2BkP.exe Token: SeLoadDriverPrivilege 1896 3MW2BkP.exe Token: SeLoadDriverPrivilege 2180 3MW2BkP.exe Token: SeLoadDriverPrivilege 4376 3MW2BkP.exe Token: SeLoadDriverPrivilege 3880 3MW2BkP.exe Token: SeLoadDriverPrivilege 4148 3MW2BkP.exe Token: SeLoadDriverPrivilege 2156 3MW2BkP.exe Token: SeLoadDriverPrivilege 1632 3MW2BkP.exe Token: SeLoadDriverPrivilege 4520 3MW2BkP.exe Token: SeLoadDriverPrivilege 3940 3MW2BkP.exe Token: SeLoadDriverPrivilege 4568 3MW2BkP.exe Token: SeLoadDriverPrivilege 2300 3MW2BkP.exe Token: SeLoadDriverPrivilege 2288 3MW2BkP.exe Token: SeLoadDriverPrivilege 3376 3MW2BkP.exe Token: SeLoadDriverPrivilege 1964 3MW2BkP.exe Token: SeLoadDriverPrivilege 4960 3MW2BkP.exe Token: SeLoadDriverPrivilege 1456 3MW2BkP.exe Token: SeLoadDriverPrivilege 3680 3MW2BkP.exe Token: SeLoadDriverPrivilege 2696 3MW2BkP.exe Token: SeLoadDriverPrivilege 4576 3MW2BkP.exe Token: SeLoadDriverPrivilege 4580 3MW2BkP.exe Token: SeLoadDriverPrivilege 1804 3MW2BkP.exe Token: SeLoadDriverPrivilege 1452 3MW2BkP.exe Token: SeLoadDriverPrivilege 4860 3MW2BkP.exe Token: SeLoadDriverPrivilege 3912 3MW2BkP.exe Token: SeLoadDriverPrivilege 2572 3MW2BkP.exe Token: SeLoadDriverPrivilege 2860 3MW2BkP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4004 wrote to memory of 2120 4004 9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe 81 PID 4004 wrote to memory of 2120 4004 9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe 81 PID 4004 wrote to memory of 2120 4004 9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe 81 PID 2120 wrote to memory of 3676 2120 3MW2BkP.exe 82 PID 2120 wrote to memory of 3676 2120 3MW2BkP.exe 82 PID 2120 wrote to memory of 3676 2120 3MW2BkP.exe 82 PID 3676 wrote to memory of 1864 3676 3MW2BkP.exe 83 PID 3676 wrote to memory of 1864 3676 3MW2BkP.exe 83 PID 3676 wrote to memory of 1864 3676 3MW2BkP.exe 83 PID 1864 wrote to memory of 212 1864 3MW2BkP.exe 84 PID 1864 wrote to memory of 212 1864 3MW2BkP.exe 84 PID 1864 wrote to memory of 212 1864 3MW2BkP.exe 84 PID 212 wrote to memory of 952 212 3MW2BkP.exe 85 PID 212 wrote to memory of 952 212 3MW2BkP.exe 85 PID 212 wrote to memory of 952 212 3MW2BkP.exe 85 PID 952 wrote to memory of 3948 952 3MW2BkP.exe 86 PID 952 wrote to memory of 3948 952 3MW2BkP.exe 86 PID 952 wrote to memory of 3948 952 3MW2BkP.exe 86 PID 3948 wrote to memory of 3260 3948 3MW2BkP.exe 87 PID 3948 wrote to memory of 3260 3948 3MW2BkP.exe 87 PID 3948 wrote to memory of 3260 3948 3MW2BkP.exe 87 PID 3260 wrote to memory of 5056 3260 3MW2BkP.exe 88 PID 3260 wrote to memory of 5056 3260 3MW2BkP.exe 88 PID 3260 wrote to memory of 5056 3260 3MW2BkP.exe 88 PID 5056 wrote to memory of 1840 5056 3MW2BkP.exe 89 PID 5056 wrote to memory of 1840 5056 3MW2BkP.exe 89 PID 5056 wrote to memory of 1840 5056 3MW2BkP.exe 89 PID 1840 wrote to memory of 4920 1840 3MW2BkP.exe 90 PID 1840 wrote to memory of 4920 1840 3MW2BkP.exe 90 PID 1840 wrote to memory of 4920 1840 3MW2BkP.exe 90 PID 4920 wrote to memory of 3872 4920 3MW2BkP.exe 91 PID 4920 wrote to memory of 3872 4920 3MW2BkP.exe 91 PID 4920 wrote to memory of 3872 4920 3MW2BkP.exe 91 PID 3872 wrote to memory of 1404 3872 3MW2BkP.exe 92 PID 3872 wrote to memory of 1404 3872 3MW2BkP.exe 92 PID 3872 wrote to memory of 1404 3872 3MW2BkP.exe 92 PID 1404 wrote to memory of 4916 1404 3MW2BkP.exe 93 PID 1404 wrote to memory of 4916 1404 3MW2BkP.exe 93 PID 1404 wrote to memory of 4916 1404 3MW2BkP.exe 93 PID 4916 wrote to memory of 1808 4916 3MW2BkP.exe 94 PID 4916 wrote to memory of 1808 4916 3MW2BkP.exe 94 PID 4916 wrote to memory of 1808 4916 3MW2BkP.exe 94 PID 1808 wrote to memory of 4616 1808 3MW2BkP.exe 95 PID 1808 wrote to memory of 4616 1808 3MW2BkP.exe 95 PID 1808 wrote to memory of 4616 1808 3MW2BkP.exe 95 PID 4616 wrote to memory of 2072 4616 3MW2BkP.exe 96 PID 4616 wrote to memory of 2072 4616 3MW2BkP.exe 96 PID 4616 wrote to memory of 2072 4616 3MW2BkP.exe 96 PID 2072 wrote to memory of 2340 2072 3MW2BkP.exe 97 PID 2072 wrote to memory of 2340 2072 3MW2BkP.exe 97 PID 2072 wrote to memory of 2340 2072 3MW2BkP.exe 97 PID 2340 wrote to memory of 4996 2340 3MW2BkP.exe 98 PID 2340 wrote to memory of 4996 2340 3MW2BkP.exe 98 PID 2340 wrote to memory of 4996 2340 3MW2BkP.exe 98 PID 4996 wrote to memory of 4448 4996 3MW2BkP.exe 99 PID 4996 wrote to memory of 4448 4996 3MW2BkP.exe 99 PID 4996 wrote to memory of 4448 4996 3MW2BkP.exe 99 PID 4448 wrote to memory of 4512 4448 3MW2BkP.exe 100 PID 4448 wrote to memory of 4512 4448 3MW2BkP.exe 100 PID 4448 wrote to memory of 4512 4448 3MW2BkP.exe 100 PID 4512 wrote to memory of 3632 4512 3MW2BkP.exe 101 PID 4512 wrote to memory of 3632 4512 3MW2BkP.exe 101 PID 4512 wrote to memory of 3632 4512 3MW2BkP.exe 101 PID 3632 wrote to memory of 4220 3632 3MW2BkP.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe"C:\Users\Admin\AppData\Local\Temp\9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe6⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe7⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe10⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe11⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe15⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4220 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:512 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1600 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3696 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3492 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1236 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3388 -
C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exeC:\Windows\system32\3MW2BkP\FMjAUvT.exe30⤵PID:21224
-
-
-
C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exeC:\Windows\system32\3MW2BkP\FMjAUvT.exe29⤵PID:20812
-
-
-
C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exeC:\Windows\system32\3MW2BkP\FMjAUvT.exe28⤵PID:20784
-
-
-
-
C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exeC:\Windows\system32\3MW2BkP\FMjAUvT.exe26⤵PID:20656
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe27⤵PID:20868
-
-
-
-
C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exeC:\Windows\system32\3MW2BkP\FMjAUvT.exe25⤵PID:20412
-
-
-
-
-
C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exeC:\Windows\system32\3MW2BkP\FMjAUvT.exe22⤵PID:20056
-
-
-
C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exeC:\Windows\system32\3MW2BkP\FMjAUvT.exe21⤵PID:20012
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe22⤵PID:20384
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe23⤵PID:20648
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe24⤵PID:20888
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exeC:\Windows\system32\3MW2BkP\FMjAUvT.exe16⤵PID:19648
-
-
-
-
-
-
-
C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exeC:\Windows\system32\3MW2BkP\FMjAUvT.exe11⤵PID:19404
-
-
-
C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exeC:\Windows\system32\3MW2BkP\FMjAUvT.exe10⤵PID:19348
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exeC:\Windows\system32\3MW2BkP\FMjAUvT.exe4⤵PID:18904
-
-
-
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2004 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1572 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1896 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2156 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4568 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2300 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1456 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3680 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
-
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3376
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4576 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4580
-
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1804 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1452 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4860 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
-
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4520
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4148
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2860 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe2⤵
- Executes dropped EXE
PID:4688 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe3⤵PID:4872
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe4⤵PID:4640
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe5⤵PID:4480
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe6⤵PID:3976
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe7⤵
- Drops file in System32 directory
PID:8 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe8⤵PID:688
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe9⤵PID:2736
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe10⤵PID:220
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe11⤵PID:2132
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3880
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:768
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4100
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4104
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵
- Enumerates connected drives
PID:1496 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe2⤵PID:1376
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe3⤵PID:4556
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe4⤵PID:3156
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe5⤵
- Drops file in System32 directory
PID:1648 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe6⤵PID:996
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe7⤵PID:628
-
-
-
-
-
-
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵PID:1968
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe2⤵PID:2404
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe3⤵PID:3532
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe4⤵PID:2700
-
-
-
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵PID:1996
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe2⤵PID:4008
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe3⤵PID:3016
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe4⤵PID:4948
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe5⤵PID:1792
-
-
-
-
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵PID:1420
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe2⤵PID:1292
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe3⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:636 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe4⤵PID:1128
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe5⤵PID:532
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe6⤵PID:624
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe7⤵
- Drops file in System32 directory
PID:1196 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe8⤵PID:4656
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe9⤵PID:1308
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe10⤵PID:3352
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe11⤵PID:5100
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe12⤵
- Drops file in System32 directory
PID:3064
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵PID:3928
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵PID:2652
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵PID:2212
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe2⤵
- Enumerates connected drives
PID:1816 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe3⤵PID:2976
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe4⤵PID:4248
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe5⤵PID:4012
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe6⤵PID:2752
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe7⤵PID:3424
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe8⤵PID:2184
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe9⤵PID:5124
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe10⤵PID:5140
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe11⤵PID:5156
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe12⤵PID:5172
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe13⤵PID:5188
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe14⤵PID:5204
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe15⤵PID:5220
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe16⤵PID:5236
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe17⤵PID:5252
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe18⤵PID:5268
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe19⤵PID:5284
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe20⤵
- Enumerates connected drives
PID:5300 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe21⤵PID:5316
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe22⤵PID:5336
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe23⤵
- Enumerates connected drives
PID:5352 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe24⤵PID:5372
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe25⤵PID:5396
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe26⤵PID:5416
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe27⤵PID:5436
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe28⤵PID:5464
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe29⤵PID:5480
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe30⤵
- Enumerates connected drives
PID:5500 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe31⤵PID:5520
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe32⤵
- Drops file in System32 directory
PID:5544 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe33⤵
- Enumerates connected drives
PID:5564 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe34⤵PID:5588
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe35⤵PID:5604
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe36⤵PID:5632
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe37⤵
- Enumerates connected drives
PID:5648 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe38⤵PID:5668
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe39⤵PID:5688
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe40⤵
- Enumerates connected drives
PID:5708 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe41⤵
- Enumerates connected drives
PID:5728 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe42⤵PID:5748
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe43⤵PID:5768
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe44⤵PID:5788
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe45⤵PID:5808
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe46⤵
- Enumerates connected drives
PID:5828 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe47⤵
- Drops file in System32 directory
PID:5848 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe48⤵PID:5868
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe49⤵PID:5888
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe50⤵PID:5908
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe51⤵PID:5936
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe52⤵
- Drops file in System32 directory
PID:5952 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe53⤵PID:5972
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe54⤵PID:5992
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe55⤵PID:6016
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe56⤵
- Enumerates connected drives
PID:6036 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe57⤵PID:6060
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe58⤵PID:6076
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe59⤵PID:6100
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe60⤵PID:6120
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe61⤵PID:6140
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe62⤵PID:5392
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe63⤵PID:5512
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe64⤵PID:5576
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe65⤵PID:5680
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe66⤵PID:5780
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe67⤵PID:5864
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe68⤵PID:5932
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe69⤵
- Drops file in System32 directory
PID:6024 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe70⤵PID:6068
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe71⤵PID:5360
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe72⤵PID:5552
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe73⤵PID:6156
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe74⤵
- Enumerates connected drives
PID:6172 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe75⤵PID:6188
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe76⤵PID:6204
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe77⤵
- Drops file in System32 directory
PID:6220 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe78⤵PID:6240
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe79⤵
- Drops file in System32 directory
PID:6252 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe80⤵PID:6284
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe81⤵PID:6300
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe82⤵PID:6320
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe83⤵
- Drops file in System32 directory
PID:6340 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe84⤵PID:6364
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe85⤵PID:6384
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe86⤵PID:6412
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe87⤵
- Drops file in System32 directory
PID:6428 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe88⤵PID:6448
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe89⤵PID:6468
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe90⤵PID:6488
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe91⤵
- Enumerates connected drives
PID:6508 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe92⤵PID:6528
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe93⤵PID:6552
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe94⤵PID:6568
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe95⤵
- Drops file in System32 directory
PID:6588 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe96⤵PID:6608
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe97⤵PID:6628
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe98⤵PID:6648
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe99⤵PID:6672
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe100⤵PID:6692
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe101⤵PID:6716
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe102⤵
- Enumerates connected drives
PID:6732 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe103⤵PID:6752
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe104⤵PID:6772
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe105⤵PID:6796
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe106⤵
- Drops file in System32 directory
PID:6816 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe107⤵PID:6840
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe108⤵PID:6856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe1⤵PID:6876
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe2⤵PID:6896
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe3⤵PID:6924
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe4⤵PID:6940
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe5⤵
- Drops file in System32 directory
PID:6968 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe6⤵PID:6984
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe7⤵PID:7004
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe8⤵
- Enumerates connected drives
PID:7024 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe9⤵PID:7044
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe10⤵PID:7064
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe11⤵
- Drops file in System32 directory
PID:7088 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe12⤵PID:7108
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe13⤵PID:7128
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe14⤵PID:7148
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe15⤵PID:6236
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe16⤵
- Enumerates connected drives
PID:6316 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe17⤵PID:6376
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe18⤵PID:6500
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe19⤵PID:6580
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe20⤵PID:6684
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe21⤵PID:6764
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe22⤵PID:6828
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe23⤵
- Drops file in System32 directory
PID:6920 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe24⤵PID:6964
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe25⤵PID:7036
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe26⤵PID:7100
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe27⤵PID:6280
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe28⤵
- Enumerates connected drives
PID:6540 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe29⤵PID:2612
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe30⤵PID:7172
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe31⤵PID:7188
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe32⤵PID:7204
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe33⤵PID:7220
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe34⤵
- Drops file in System32 directory
PID:7244 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe35⤵PID:7264
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe36⤵PID:7284
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe37⤵PID:7304
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe38⤵PID:7324
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe39⤵PID:7344
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe40⤵PID:7364
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe41⤵PID:7388
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe42⤵
- Drops file in System32 directory
PID:7404 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe43⤵PID:7424
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe44⤵PID:7448
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe45⤵PID:7464
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe46⤵PID:7484
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe47⤵PID:7504
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe48⤵PID:7528
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe49⤵PID:7544
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe50⤵PID:7568
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe51⤵PID:7584
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe52⤵PID:7604
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe53⤵PID:7628
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe54⤵PID:7648
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe55⤵PID:7668
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe56⤵PID:7688
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe57⤵PID:7712
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe58⤵PID:7732
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe59⤵PID:7760
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe60⤵PID:7776
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe61⤵
- Enumerates connected drives
PID:7796 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe62⤵PID:7816
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe63⤵PID:7836
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe64⤵PID:7856
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe65⤵
- Enumerates connected drives
PID:7876 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe66⤵PID:7896
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe67⤵PID:7920
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe68⤵
- Drops file in System32 directory
PID:7936 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe69⤵PID:7956
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe70⤵PID:7976
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe71⤵PID:7996
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe72⤵
- Enumerates connected drives
PID:8016 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe73⤵PID:8036
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe74⤵PID:8060
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe75⤵PID:8080
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe76⤵PID:8104
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe77⤵PID:8124
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe78⤵PID:8152
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe79⤵PID:8168
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe80⤵PID:2356
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe81⤵PID:7280
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe82⤵
- Enumerates connected drives
PID:7396 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe83⤵PID:7476
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe84⤵PID:7556
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe85⤵PID:7620
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe86⤵
- Drops file in System32 directory
PID:7680 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe87⤵
- Drops file in System32 directory
PID:7744 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe88⤵PID:7808
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe89⤵PID:7908
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe90⤵
- Drops file in System32 directory
PID:7948 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe91⤵PID:8028
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe92⤵PID:8100
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe93⤵PID:8160
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe94⤵PID:8092
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe95⤵PID:8212
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe96⤵PID:8236
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe97⤵
- Drops file in System32 directory
PID:8256 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe98⤵
- Enumerates connected drives
PID:8280 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe99⤵PID:8300
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe100⤵PID:8324
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe101⤵PID:8348
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe102⤵PID:8364
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe103⤵PID:8388
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe104⤵PID:8416
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe105⤵PID:8432
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe106⤵PID:8456
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe107⤵
- Drops file in System32 directory
PID:8476 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe108⤵
- Drops file in System32 directory
PID:8500 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe109⤵
- Enumerates connected drives
PID:8524 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe110⤵PID:8544
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe111⤵
- Enumerates connected drives
PID:8564 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe112⤵PID:8592
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe113⤵PID:8608
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe114⤵
- Drops file in System32 directory
PID:8632 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe115⤵PID:8652
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe116⤵
- Drops file in System32 directory
PID:8668 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe117⤵PID:8696
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe118⤵PID:8712
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe119⤵
- Enumerates connected drives
PID:8736 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe120⤵PID:8756
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe121⤵
- Drops file in System32 directory
PID:8788 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe122⤵
- Enumerates connected drives
PID:8808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-