Analysis
-
max time kernel
61s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 21:17
Behavioral task
behavioral1
Sample
81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe
Resource
win10v2004-20220812-en
General
-
Target
81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe
-
Size
109KB
-
MD5
76ae68ebb4a1fa5ca8ba5f15bc26cc50
-
SHA1
605d5b43cfcd331b58402cbd7443bff4d25ef653
-
SHA256
81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb
-
SHA512
28ed996cc7d827fdcfd95b0fa31200f15d15fc1a8499037e3a51c38bb86e71ffd1028c679f73f098497bf3b50eceb76a51713480de66a5c7884082a12e8ac4be
-
SSDEEP
768:nSlJ0hEcH/5OXsui8BrzqNqJ+rqag4R5MEEOh5WFlMczc5dFa0M+V5nI9mQzTGfY:SIhL/MXsg9J+rqORFEJlMnFzM+hQbgw
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1780 ZENolUG.exe 956 ZENolUG.exe 1124 ZENolUG.exe 1748 ZENolUG.exe 1800 ZENolUG.exe 1220 ZENolUG.exe 316 ZENolUG.exe 1948 ZENolUG.exe 616 ZENolUG.exe 1696 ZENolUG.exe 1900 ZENolUG.exe 2016 ZENolUG.exe 1684 ZENolUG.exe 1316 ZENolUG.exe 472 ZENolUG.exe 1764 ZENolUG.exe 964 ZENolUG.exe 1952 ZENolUG.exe 856 ZENolUG.exe 1180 ZENolUG.exe 1508 ZENolUG.exe 1084 ZENolUG.exe 848 ZENolUG.exe 1140 ZENolUG.exe 1636 ZENolUG.exe 596 ZENolUG.exe 1584 ZENolUG.exe 1488 ZENolUG.exe 1208 ZENolUG.exe 2012 ZENolUG.exe 1972 ZENolUG.exe 1576 ZENolUG.exe 984 ZENolUG.exe 1136 ZENolUG.exe 1648 ZENolUG.exe 1936 ZENolUG.exe 976 ZENolUG.exe 1184 ZENolUG.exe 2040 ZENolUG.exe 1472 ZENolUG.exe 1676 ZENolUG.exe 1192 ZENolUG.exe 784 ZENolUG.exe 836 ZENolUG.exe 1932 ZENolUG.exe 1264 ZENolUG.exe 1032 ZENolUG.exe 1652 ZENolUG.exe 1036 ZENolUG.exe 912 ZENolUG.exe 780 ZENolUG.exe 2080 ZENolUG.exe 2108 ZENolUG.exe 2128 ZENolUG.exe 2148 ZENolUG.exe 2168 ZENolUG.exe 2188 ZENolUG.exe 2208 ZENolUG.exe 2228 ZENolUG.exe 2248 ZENolUG.exe 2268 ZENolUG.exe 2288 ZENolUG.exe 2308 ZENolUG.exe 2328 ZENolUG.exe -
resource yara_rule behavioral1/memory/1492-55-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral1/files/0x00080000000126c9-56.dat upx behavioral1/files/0x00080000000126c9-57.dat upx behavioral1/files/0x00080000000126c9-59.dat upx behavioral1/files/0x00080000000126c9-62.dat upx behavioral1/files/0x00080000000126c9-61.dat upx behavioral1/files/0x00080000000126c9-63.dat upx behavioral1/files/0x00080000000126c9-65.dat upx behavioral1/files/0x00080000000126c9-67.dat upx behavioral1/files/0x00080000000126c9-68.dat upx behavioral1/files/0x00080000000126c9-70.dat upx behavioral1/files/0x00080000000126c9-73.dat upx behavioral1/files/0x00080000000126c9-72.dat upx behavioral1/files/0x00080000000126c9-75.dat upx behavioral1/files/0x00080000000126c9-77.dat upx behavioral1/files/0x00080000000126c9-78.dat upx behavioral1/files/0x00080000000126c9-80.dat upx behavioral1/files/0x00080000000126c9-82.dat upx behavioral1/files/0x00080000000126c9-83.dat upx behavioral1/files/0x00080000000126c9-85.dat upx behavioral1/files/0x00080000000126c9-87.dat upx behavioral1/files/0x00080000000126c9-88.dat upx behavioral1/files/0x00080000000126c9-90.dat upx behavioral1/files/0x00080000000126c9-92.dat upx behavioral1/files/0x00080000000126c9-93.dat upx behavioral1/files/0x00080000000126c9-95.dat upx behavioral1/files/0x00080000000126c9-97.dat upx behavioral1/files/0x00080000000126c9-98.dat upx behavioral1/files/0x00080000000126c9-100.dat upx behavioral1/files/0x00080000000126c9-103.dat upx behavioral1/files/0x00080000000126c9-105.dat upx behavioral1/files/0x00080000000126c9-102.dat upx behavioral1/files/0x00080000000126c9-107.dat upx behavioral1/files/0x00080000000126c9-108.dat upx behavioral1/files/0x00080000000126c9-110.dat upx behavioral1/files/0x00080000000126c9-113.dat upx behavioral1/files/0x00080000000126c9-112.dat upx behavioral1/files/0x00080000000126c9-115.dat upx behavioral1/files/0x00080000000126c9-117.dat upx behavioral1/files/0x00080000000126c9-118.dat upx behavioral1/files/0x00080000000126c9-120.dat upx behavioral1/files/0x00080000000126c9-122.dat upx behavioral1/files/0x00080000000126c9-125.dat upx behavioral1/files/0x00080000000126c9-123.dat upx behavioral1/files/0x00080000000126c9-127.dat upx behavioral1/files/0x00080000000126c9-128.dat upx behavioral1/files/0x00080000000126c9-130.dat upx behavioral1/files/0x00080000000126c9-133.dat upx behavioral1/memory/1780-139-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral1/memory/956-141-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral1/files/0x00080000000126c9-140.dat upx behavioral1/files/0x00080000000126c9-135.dat upx behavioral1/files/0x00080000000126c9-132.dat upx behavioral1/memory/1124-142-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral1/memory/1748-143-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral1/memory/1800-144-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral1/memory/1220-145-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral1/memory/316-146-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral1/memory/1948-147-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral1/memory/616-148-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral1/memory/1696-149-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral1/memory/1900-150-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral1/memory/2016-151-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral1/memory/1684-152-0x0000000000400000-0x0000000000440000-memory.dmp upx -
Loads dropped DLL 64 IoCs
pid Process 1492 81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe 1492 81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe 1780 ZENolUG.exe 1780 ZENolUG.exe 956 ZENolUG.exe 956 ZENolUG.exe 1124 ZENolUG.exe 1124 ZENolUG.exe 1748 ZENolUG.exe 1748 ZENolUG.exe 1800 ZENolUG.exe 1800 ZENolUG.exe 1220 ZENolUG.exe 1220 ZENolUG.exe 316 ZENolUG.exe 316 ZENolUG.exe 1948 ZENolUG.exe 1948 ZENolUG.exe 616 ZENolUG.exe 616 ZENolUG.exe 1696 ZENolUG.exe 1696 ZENolUG.exe 1900 ZENolUG.exe 1900 ZENolUG.exe 2016 ZENolUG.exe 2016 ZENolUG.exe 1684 ZENolUG.exe 1684 ZENolUG.exe 1316 ZENolUG.exe 1316 ZENolUG.exe 472 ZENolUG.exe 472 ZENolUG.exe 1764 ZENolUG.exe 1764 ZENolUG.exe 964 ZENolUG.exe 964 ZENolUG.exe 1952 ZENolUG.exe 1952 ZENolUG.exe 856 ZENolUG.exe 856 ZENolUG.exe 1180 ZENolUG.exe 1180 ZENolUG.exe 1508 ZENolUG.exe 1508 ZENolUG.exe 1084 ZENolUG.exe 1084 ZENolUG.exe 848 ZENolUG.exe 848 ZENolUG.exe 1140 ZENolUG.exe 1140 ZENolUG.exe 1636 ZENolUG.exe 1636 ZENolUG.exe 596 ZENolUG.exe 596 ZENolUG.exe 1584 ZENolUG.exe 1584 ZENolUG.exe 1488 ZENolUG.exe 1488 ZENolUG.exe 1208 ZENolUG.exe 1208 ZENolUG.exe 2012 ZENolUG.exe 2012 ZENolUG.exe 1972 ZENolUG.exe 1972 ZENolUG.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: ZENolUG.exe File opened (read-only) \??\m: ZENolUG.exe File opened (read-only) \??\h: ZENolUG.exe File opened (read-only) \??\h: ZENolUG.exe File opened (read-only) \??\l: ZENolUG.exe File opened (read-only) \??\g: ZENolUG.exe File opened (read-only) \??\t: ZENolUG.exe File opened (read-only) \??\g: ZENolUG.exe File opened (read-only) \??\t: ZENolUG.exe File opened (read-only) \??\f: ZENolUG.exe File opened (read-only) \??\e: ZENolUG.exe File opened (read-only) \??\f: ZENolUG.exe File opened (read-only) \??\w: ZENolUG.exe File opened (read-only) \??\h: ZENolUG.exe File opened (read-only) \??\j: ZENolUG.exe File opened (read-only) \??\r: ZENolUG.exe File opened (read-only) \??\w: ZENolUG.exe File opened (read-only) \??\s: ZENolUG.exe File opened (read-only) \??\h: ZENolUG.exe File opened (read-only) \??\p: ZENolUG.exe File opened (read-only) \??\h: ZENolUG.exe File opened (read-only) \??\v: ZENolUG.exe File opened (read-only) \??\s: ZENolUG.exe File opened (read-only) \??\s: ZENolUG.exe File opened (read-only) \??\l: ZENolUG.exe File opened (read-only) \??\w: ZENolUG.exe File opened (read-only) \??\k: ZENolUG.exe File opened (read-only) \??\n: ZENolUG.exe File opened (read-only) \??\s: ZENolUG.exe File opened (read-only) \??\z: ZENolUG.exe File opened (read-only) \??\n: ZENolUG.exe File opened (read-only) \??\q: ZENolUG.exe File opened (read-only) \??\i: ZENolUG.exe File opened (read-only) \??\n: ZENolUG.exe File opened (read-only) \??\t: ZENolUG.exe File opened (read-only) \??\z: ZENolUG.exe File opened (read-only) \??\f: ZENolUG.exe File opened (read-only) \??\w: ZENolUG.exe File opened (read-only) \??\o: ZENolUG.exe File opened (read-only) \??\g: ZENolUG.exe File opened (read-only) \??\z: ZENolUG.exe File opened (read-only) \??\z: ZENolUG.exe File opened (read-only) \??\q: ZENolUG.exe File opened (read-only) \??\u: ZENolUG.exe File opened (read-only) \??\h: ZENolUG.exe File opened (read-only) \??\s: ZENolUG.exe File opened (read-only) \??\k: ZENolUG.exe File opened (read-only) \??\u: ZENolUG.exe File opened (read-only) \??\z: ZENolUG.exe File opened (read-only) \??\e: ZENolUG.exe File opened (read-only) \??\v: ZENolUG.exe File opened (read-only) \??\k: ZENolUG.exe File opened (read-only) \??\p: ZENolUG.exe File opened (read-only) \??\u: ZENolUG.exe File opened (read-only) \??\k: ZENolUG.exe File opened (read-only) \??\l: ZENolUG.exe File opened (read-only) \??\h: ZENolUG.exe File opened (read-only) \??\l: ZENolUG.exe File opened (read-only) \??\o: ZENolUG.exe File opened (read-only) \??\p: ZENolUG.exe File opened (read-only) \??\u: ZENolUG.exe File opened (read-only) \??\f: ZENolUG.exe File opened (read-only) \??\h: ZENolUG.exe File opened (read-only) \??\f: ZENolUG.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 1492 81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe Token: SeLoadDriverPrivilege 1780 ZENolUG.exe Token: SeLoadDriverPrivilege 956 ZENolUG.exe Token: SeLoadDriverPrivilege 1124 ZENolUG.exe Token: SeLoadDriverPrivilege 1748 ZENolUG.exe Token: SeLoadDriverPrivilege 1800 ZENolUG.exe Token: SeLoadDriverPrivilege 1220 ZENolUG.exe Token: SeLoadDriverPrivilege 316 ZENolUG.exe Token: SeLoadDriverPrivilege 1948 ZENolUG.exe Token: SeLoadDriverPrivilege 616 ZENolUG.exe Token: SeLoadDriverPrivilege 1696 ZENolUG.exe Token: SeLoadDriverPrivilege 1900 ZENolUG.exe Token: SeLoadDriverPrivilege 2016 ZENolUG.exe Token: SeLoadDriverPrivilege 1684 ZENolUG.exe Token: SeLoadDriverPrivilege 1316 ZENolUG.exe Token: SeLoadDriverPrivilege 472 ZENolUG.exe Token: SeLoadDriverPrivilege 1764 ZENolUG.exe Token: SeLoadDriverPrivilege 964 ZENolUG.exe Token: SeLoadDriverPrivilege 1952 ZENolUG.exe Token: SeLoadDriverPrivilege 856 ZENolUG.exe Token: SeLoadDriverPrivilege 1180 ZENolUG.exe Token: SeLoadDriverPrivilege 1508 ZENolUG.exe Token: SeLoadDriverPrivilege 1084 ZENolUG.exe Token: SeLoadDriverPrivilege 848 ZENolUG.exe Token: SeLoadDriverPrivilege 1140 ZENolUG.exe Token: SeLoadDriverPrivilege 1636 ZENolUG.exe Token: SeLoadDriverPrivilege 596 ZENolUG.exe Token: SeLoadDriverPrivilege 1584 ZENolUG.exe Token: SeLoadDriverPrivilege 1488 ZENolUG.exe Token: SeLoadDriverPrivilege 1208 ZENolUG.exe Token: SeLoadDriverPrivilege 2012 ZENolUG.exe Token: SeLoadDriverPrivilege 1972 ZENolUG.exe Token: SeLoadDriverPrivilege 1576 ZENolUG.exe Token: SeLoadDriverPrivilege 984 ZENolUG.exe Token: SeLoadDriverPrivilege 1136 ZENolUG.exe Token: SeLoadDriverPrivilege 1648 ZENolUG.exe Token: SeLoadDriverPrivilege 1936 ZENolUG.exe Token: SeLoadDriverPrivilege 976 ZENolUG.exe Token: SeLoadDriverPrivilege 1184 ZENolUG.exe Token: SeLoadDriverPrivilege 2040 ZENolUG.exe Token: SeLoadDriverPrivilege 1472 ZENolUG.exe Token: SeLoadDriverPrivilege 1676 ZENolUG.exe Token: SeLoadDriverPrivilege 1192 ZENolUG.exe Token: SeLoadDriverPrivilege 784 ZENolUG.exe Token: SeLoadDriverPrivilege 836 ZENolUG.exe Token: SeLoadDriverPrivilege 1932 ZENolUG.exe Token: SeLoadDriverPrivilege 1264 ZENolUG.exe Token: SeLoadDriverPrivilege 1032 ZENolUG.exe Token: SeLoadDriverPrivilege 1652 ZENolUG.exe Token: SeLoadDriverPrivilege 1036 ZENolUG.exe Token: SeLoadDriverPrivilege 912 ZENolUG.exe Token: SeLoadDriverPrivilege 780 ZENolUG.exe Token: SeLoadDriverPrivilege 2080 ZENolUG.exe Token: SeLoadDriverPrivilege 2108 ZENolUG.exe Token: SeLoadDriverPrivilege 2128 ZENolUG.exe Token: SeLoadDriverPrivilege 2148 ZENolUG.exe Token: SeLoadDriverPrivilege 2168 ZENolUG.exe Token: SeLoadDriverPrivilege 2188 ZENolUG.exe Token: SeLoadDriverPrivilege 2208 ZENolUG.exe Token: SeLoadDriverPrivilege 2228 ZENolUG.exe Token: SeLoadDriverPrivilege 2248 ZENolUG.exe Token: SeLoadDriverPrivilege 2268 ZENolUG.exe Token: SeLoadDriverPrivilege 2288 ZENolUG.exe Token: SeLoadDriverPrivilege 2308 ZENolUG.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1780 1492 81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe 28 PID 1492 wrote to memory of 1780 1492 81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe 28 PID 1492 wrote to memory of 1780 1492 81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe 28 PID 1492 wrote to memory of 1780 1492 81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe 28 PID 1780 wrote to memory of 956 1780 ZENolUG.exe 29 PID 1780 wrote to memory of 956 1780 ZENolUG.exe 29 PID 1780 wrote to memory of 956 1780 ZENolUG.exe 29 PID 1780 wrote to memory of 956 1780 ZENolUG.exe 29 PID 956 wrote to memory of 1124 956 ZENolUG.exe 30 PID 956 wrote to memory of 1124 956 ZENolUG.exe 30 PID 956 wrote to memory of 1124 956 ZENolUG.exe 30 PID 956 wrote to memory of 1124 956 ZENolUG.exe 30 PID 1124 wrote to memory of 1748 1124 ZENolUG.exe 31 PID 1124 wrote to memory of 1748 1124 ZENolUG.exe 31 PID 1124 wrote to memory of 1748 1124 ZENolUG.exe 31 PID 1124 wrote to memory of 1748 1124 ZENolUG.exe 31 PID 1748 wrote to memory of 1800 1748 ZENolUG.exe 32 PID 1748 wrote to memory of 1800 1748 ZENolUG.exe 32 PID 1748 wrote to memory of 1800 1748 ZENolUG.exe 32 PID 1748 wrote to memory of 1800 1748 ZENolUG.exe 32 PID 1800 wrote to memory of 1220 1800 ZENolUG.exe 33 PID 1800 wrote to memory of 1220 1800 ZENolUG.exe 33 PID 1800 wrote to memory of 1220 1800 ZENolUG.exe 33 PID 1800 wrote to memory of 1220 1800 ZENolUG.exe 33 PID 1220 wrote to memory of 316 1220 ZENolUG.exe 34 PID 1220 wrote to memory of 316 1220 ZENolUG.exe 34 PID 1220 wrote to memory of 316 1220 ZENolUG.exe 34 PID 1220 wrote to memory of 316 1220 ZENolUG.exe 34 PID 316 wrote to memory of 1948 316 ZENolUG.exe 35 PID 316 wrote to memory of 1948 316 ZENolUG.exe 35 PID 316 wrote to memory of 1948 316 ZENolUG.exe 35 PID 316 wrote to memory of 1948 316 ZENolUG.exe 35 PID 1948 wrote to memory of 616 1948 ZENolUG.exe 36 PID 1948 wrote to memory of 616 1948 ZENolUG.exe 36 PID 1948 wrote to memory of 616 1948 ZENolUG.exe 36 PID 1948 wrote to memory of 616 1948 ZENolUG.exe 36 PID 616 wrote to memory of 1696 616 ZENolUG.exe 37 PID 616 wrote to memory of 1696 616 ZENolUG.exe 37 PID 616 wrote to memory of 1696 616 ZENolUG.exe 37 PID 616 wrote to memory of 1696 616 ZENolUG.exe 37 PID 1696 wrote to memory of 1900 1696 ZENolUG.exe 38 PID 1696 wrote to memory of 1900 1696 ZENolUG.exe 38 PID 1696 wrote to memory of 1900 1696 ZENolUG.exe 38 PID 1696 wrote to memory of 1900 1696 ZENolUG.exe 38 PID 1900 wrote to memory of 2016 1900 ZENolUG.exe 39 PID 1900 wrote to memory of 2016 1900 ZENolUG.exe 39 PID 1900 wrote to memory of 2016 1900 ZENolUG.exe 39 PID 1900 wrote to memory of 2016 1900 ZENolUG.exe 39 PID 2016 wrote to memory of 1684 2016 ZENolUG.exe 40 PID 2016 wrote to memory of 1684 2016 ZENolUG.exe 40 PID 2016 wrote to memory of 1684 2016 ZENolUG.exe 40 PID 2016 wrote to memory of 1684 2016 ZENolUG.exe 40 PID 1684 wrote to memory of 1316 1684 ZENolUG.exe 41 PID 1684 wrote to memory of 1316 1684 ZENolUG.exe 41 PID 1684 wrote to memory of 1316 1684 ZENolUG.exe 41 PID 1684 wrote to memory of 1316 1684 ZENolUG.exe 41 PID 1316 wrote to memory of 472 1316 ZENolUG.exe 42 PID 1316 wrote to memory of 472 1316 ZENolUG.exe 42 PID 1316 wrote to memory of 472 1316 ZENolUG.exe 42 PID 1316 wrote to memory of 472 1316 ZENolUG.exe 42 PID 472 wrote to memory of 1764 472 ZENolUG.exe 43 PID 472 wrote to memory of 1764 472 ZENolUG.exe 43 PID 472 wrote to memory of 1764 472 ZENolUG.exe 43 PID 472 wrote to memory of 1764 472 ZENolUG.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe"C:\Users\Admin\AppData\Local\Temp\81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1764 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:964 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1952 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:856 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1180 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1508 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1084 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:848 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1140 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1636 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:596 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1584 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1488 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1208 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2012 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1972 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe33⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1576 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:984 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe35⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1136 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1648 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1936 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:976 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1184 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2040 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1472 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1676 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1192 -
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe44⤵PID:268
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe43⤵PID:17648
-
-
-
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe38⤵PID:7908
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe37⤵PID:7900
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe36⤵PID:7892
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe35⤵PID:7864
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe34⤵PID:7872
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe33⤵PID:7856
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe32⤵PID:7836
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe31⤵PID:7828
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe30⤵PID:7820
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe29⤵PID:7800
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe28⤵PID:7780
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe27⤵PID:7772
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe26⤵PID:7764
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe25⤵PID:7736
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe26⤵PID:15796
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe27⤵PID:15876
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe28⤵PID:15952
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe29⤵PID:15992
-
-
-
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe24⤵PID:7744
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe25⤵PID:15376
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe26⤵PID:15416
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe27⤵PID:15468
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe28⤵PID:15520
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe29⤵PID:15556
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe30⤵PID:15588
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe31⤵PID:15628
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe32⤵PID:15700
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe33⤵PID:15736
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe34⤵PID:15788
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe35⤵PID:15844
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe36⤵PID:15892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe23⤵PID:7716
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe22⤵PID:7708
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe21⤵PID:7700
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe22⤵PID:8060
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe20⤵PID:7684
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe19⤵PID:7656
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe18⤵PID:7628
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe17⤵PID:7428
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe18⤵PID:9228
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe16⤵PID:7408
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe15⤵PID:7388
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe16⤵PID:9500
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe14⤵PID:7380
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe13⤵PID:7348
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe12⤵PID:7340
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe11⤵PID:7332
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe10⤵PID:7324
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe9⤵PID:7316
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe8⤵PID:7308
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe7⤵PID:7300
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe6⤵PID:7292
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe5⤵PID:7284
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe4⤵PID:7276
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe3⤵PID:7268
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe2⤵PID:7252
-
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:784 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:836 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1932 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1264 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe5⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1032 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1652 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe7⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1036 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe8⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:912 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:780 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2080 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2108 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2128 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe13⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2148 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2168 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2188 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2208 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2228 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe18⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2248 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2268 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2288 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2308 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe22⤵
- Executes dropped EXE
PID:2328 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe23⤵PID:2348
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe24⤵PID:2364
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe25⤵
- Enumerates connected drives
PID:2380 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe26⤵PID:2396
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe27⤵
- Enumerates connected drives
PID:2412 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe28⤵
- Enumerates connected drives
PID:2428 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe29⤵
- Enumerates connected drives
PID:2444 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe30⤵PID:2460
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe31⤵PID:2476
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe32⤵PID:2492
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe33⤵PID:2508
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe34⤵
- Drops file in System32 directory
PID:2524 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe35⤵
- Drops file in System32 directory
PID:2540 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe36⤵PID:2556
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe37⤵
- Drops file in System32 directory
PID:2572 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe38⤵PID:2588
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe39⤵
- Drops file in System32 directory
PID:2604 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe40⤵
- Enumerates connected drives
PID:2620 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe41⤵
- Enumerates connected drives
PID:2636 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe42⤵
- Enumerates connected drives
PID:2652 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe43⤵PID:2668
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe44⤵
- Drops file in System32 directory
PID:2684 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe45⤵
- Enumerates connected drives
PID:2700 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe46⤵PID:2716
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe47⤵PID:2732
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe48⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2748 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe49⤵PID:2764
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe50⤵PID:2780
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe51⤵
- Drops file in System32 directory
PID:2796 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe52⤵
- Drops file in System32 directory
PID:2812 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe53⤵
- Enumerates connected drives
PID:2828 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe54⤵
- Enumerates connected drives
PID:2844 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe55⤵PID:2860
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe56⤵
- Drops file in System32 directory
PID:2876 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe57⤵
- Enumerates connected drives
PID:2892 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe58⤵
- Drops file in System32 directory
PID:2908 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe59⤵PID:2924
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe60⤵PID:2940
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe61⤵
- Enumerates connected drives
PID:2956 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe62⤵PID:2972
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe63⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2988 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe64⤵PID:3004
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe65⤵
- Drops file in System32 directory
PID:3020 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe66⤵
- Enumerates connected drives
PID:3036 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe67⤵
- Drops file in System32 directory
PID:3052 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe68⤵PID:3068
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe69⤵PID:1984
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe70⤵
- Drops file in System32 directory
PID:2064 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe71⤵PID:2092
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe72⤵PID:2116
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe73⤵PID:2160
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe74⤵
- Drops file in System32 directory
PID:2200 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe75⤵PID:2236
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe76⤵
- Drops file in System32 directory
PID:2280 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe77⤵PID:2320
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe78⤵PID:2372
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe79⤵PID:2436
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe80⤵PID:2500
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe81⤵PID:2564
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe82⤵PID:2628
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe83⤵
- Enumerates connected drives
PID:2692 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe84⤵PID:2756
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe85⤵PID:2820
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe86⤵
- Drops file in System32 directory
PID:2884 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe87⤵PID:2948
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe88⤵PID:3012
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe89⤵PID:1752
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe90⤵PID:2140
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe91⤵PID:2300
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe92⤵
- Drops file in System32 directory
PID:2532 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe93⤵PID:2788
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe94⤵PID:3044
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe95⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2660 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe96⤵PID:3076
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe97⤵PID:3092
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe98⤵PID:3108
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe99⤵PID:3124
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe100⤵PID:3140
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe101⤵PID:3156
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe102⤵PID:3172
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe103⤵PID:3188
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe104⤵
- Drops file in System32 directory
PID:3204 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe105⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3220 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe106⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3236 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe107⤵PID:3252
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe108⤵
- Drops file in System32 directory
PID:3268 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe109⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3284 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe110⤵PID:3300
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe111⤵PID:3316
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe112⤵
- Drops file in System32 directory
PID:3332 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe113⤵PID:3348
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe114⤵PID:3364
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe115⤵PID:3380
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe116⤵
- Enumerates connected drives
PID:3396 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe117⤵PID:3412
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe118⤵PID:3428
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe119⤵PID:3444
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe120⤵PID:3460
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe121⤵PID:3476
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe122⤵
- Enumerates connected drives
PID:3492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-