Analysis
-
max time kernel
56s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 21:17
Behavioral task
behavioral1
Sample
81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe
Resource
win10v2004-20220812-en
General
-
Target
81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe
-
Size
109KB
-
MD5
76ae68ebb4a1fa5ca8ba5f15bc26cc50
-
SHA1
605d5b43cfcd331b58402cbd7443bff4d25ef653
-
SHA256
81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb
-
SHA512
28ed996cc7d827fdcfd95b0fa31200f15d15fc1a8499037e3a51c38bb86e71ffd1028c679f73f098497bf3b50eceb76a51713480de66a5c7884082a12e8ac4be
-
SSDEEP
768:nSlJ0hEcH/5OXsui8BrzqNqJ+rqag4R5MEEOh5WFlMczc5dFa0M+V5nI9mQzTGfY:SIhL/MXsg9J+rqORFEJlMnFzM+hQbgw
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4952 ZENolUG.exe 4924 ZENolUG.exe 4932 ZENolUG.exe 4836 ZENolUG.exe 2328 ZENolUG.exe 1260 ZENolUG.exe 5060 ZENolUG.exe 1884 ZENolUG.exe 3476 ZENolUG.exe 2432 ZENolUG.exe 3596 ZENolUG.exe 1856 ZENolUG.exe 2280 ZENolUG.exe 260 ZENolUG.exe 220 ZENolUG.exe 848 ZENolUG.exe 3796 ZENolUG.exe 608 ZENolUG.exe 4384 ZENolUG.exe 2880 ZENolUG.exe 64 ZENolUG.exe 4860 ZENolUG.exe 4512 ZENolUG.exe 4424 ZENolUG.exe 800 ZENolUG.exe 4496 ZENolUG.exe 664 ZENolUG.exe 2456 ZENolUG.exe 1936 ZENolUG.exe 2160 ZENolUG.exe 3936 ZENolUG.exe 4704 ZENolUG.exe 4556 ZENolUG.exe 4364 ZENolUG.exe 5028 ZENolUG.exe 1532 ZENolUG.exe 4492 ZENolUG.exe 3748 ZENolUG.exe 4760 ZENolUG.exe 4452 ZENolUG.exe 1676 ZENolUG.exe 3572 ZENolUG.exe 1456 ZENolUG.exe 3140 ZENolUG.exe 1204 ZENolUG.exe 3076 ZENolUG.exe 4828 ZENolUG.exe 3688 ZENolUG.exe 4448 ZENolUG.exe 756 ZENolUG.exe 3592 ZENolUG.exe 4472 ZENolUG.exe 3296 ZENolUG.exe 2472 ZENolUG.exe 2952 ZENolUG.exe 2680 ZENolUG.exe 3632 ZENolUG.exe 4580 ZENolUG.exe 1540 ZENolUG.exe 4632 ZENolUG.exe 2848 ZENolUG.exe 4412 ZENolUG.exe 4008 ZENolUG.exe 3952 ZENolUG.exe -
resource yara_rule behavioral2/memory/4756-132-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/files/0x0006000000022f68-134.dat upx behavioral2/files/0x0006000000022f68-135.dat upx behavioral2/files/0x0006000000022f68-137.dat upx behavioral2/files/0x0006000000022f68-139.dat upx behavioral2/files/0x0006000000022f68-141.dat upx behavioral2/files/0x0006000000022f68-143.dat upx behavioral2/files/0x0006000000022f68-145.dat upx behavioral2/files/0x0006000000022f68-147.dat upx behavioral2/files/0x0006000000022f68-149.dat upx behavioral2/files/0x0006000000022f68-151.dat upx behavioral2/files/0x0006000000022f68-153.dat upx behavioral2/files/0x0006000000022f68-156.dat upx behavioral2/memory/4952-155-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/4924-158-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/4932-160-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/files/0x0006000000022f68-162.dat upx behavioral2/files/0x0006000000022f68-159.dat upx behavioral2/memory/2328-165-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/1260-167-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/1884-170-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/3476-172-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/2432-174-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/files/0x0006000000022f68-179.dat upx behavioral2/files/0x0006000000022f68-177.dat upx behavioral2/files/0x0006000000022f68-175.dat upx behavioral2/files/0x0006000000022f68-171.dat upx behavioral2/memory/5060-169-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/files/0x0006000000022f68-166.dat upx behavioral2/memory/4836-163-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/files/0x0006000000022f68-181.dat upx behavioral2/files/0x0006000000022f68-183.dat upx behavioral2/files/0x0006000000022f68-185.dat upx behavioral2/files/0x0006000000022f68-187.dat upx behavioral2/files/0x0006000000022f68-189.dat upx behavioral2/files/0x0006000000022f68-191.dat upx behavioral2/files/0x0006000000022f68-193.dat upx behavioral2/files/0x0006000000022f68-195.dat upx behavioral2/files/0x0006000000022f68-197.dat upx behavioral2/files/0x0006000000022f68-199.dat upx behavioral2/files/0x0006000000022f68-201.dat upx behavioral2/files/0x0006000000022f68-203.dat upx behavioral2/memory/4756-204-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/3596-207-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/files/0x0006000000022f68-206.dat upx behavioral2/memory/1856-208-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/2280-210-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/260-211-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/files/0x0006000000022f68-212.dat upx behavioral2/memory/220-213-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/files/0x0006000000022f68-216.dat upx behavioral2/memory/848-214-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/3796-217-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/608-219-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/files/0x0006000000022f68-220.dat upx behavioral2/memory/4384-221-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/files/0x0006000000022f68-223.dat upx behavioral2/memory/2880-224-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/4512-230-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/64-226-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/4860-228-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/4424-231-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/memory/800-233-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral2/files/0x0006000000022f68-236.dat upx -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\x: ZENolUG.exe File opened (read-only) \??\k: ZENolUG.exe File opened (read-only) \??\z: ZENolUG.exe File opened (read-only) \??\x: ZENolUG.exe File opened (read-only) \??\f: ZENolUG.exe File opened (read-only) \??\l: ZENolUG.exe File opened (read-only) \??\p: ZENolUG.exe File opened (read-only) \??\j: ZENolUG.exe File opened (read-only) \??\f: ZENolUG.exe File opened (read-only) \??\n: ZENolUG.exe File opened (read-only) \??\t: ZENolUG.exe File opened (read-only) \??\i: ZENolUG.exe File opened (read-only) \??\t: ZENolUG.exe File opened (read-only) \??\g: ZENolUG.exe File opened (read-only) \??\x: ZENolUG.exe File opened (read-only) \??\y: ZENolUG.exe File opened (read-only) \??\l: ZENolUG.exe File opened (read-only) \??\y: ZENolUG.exe File opened (read-only) \??\g: ZENolUG.exe File opened (read-only) \??\v: ZENolUG.exe File opened (read-only) \??\v: ZENolUG.exe File opened (read-only) \??\y: ZENolUG.exe File opened (read-only) \??\f: ZENolUG.exe File opened (read-only) \??\y: ZENolUG.exe File opened (read-only) \??\v: ZENolUG.exe File opened (read-only) \??\p: ZENolUG.exe File opened (read-only) \??\f: ZENolUG.exe File opened (read-only) \??\z: ZENolUG.exe File opened (read-only) \??\i: ZENolUG.exe File opened (read-only) \??\r: ZENolUG.exe File opened (read-only) \??\f: ZENolUG.exe File opened (read-only) \??\v: ZENolUG.exe File opened (read-only) \??\f: ZENolUG.exe File opened (read-only) \??\k: ZENolUG.exe File opened (read-only) \??\g: ZENolUG.exe File opened (read-only) \??\w: ZENolUG.exe File opened (read-only) \??\e: ZENolUG.exe File opened (read-only) \??\z: ZENolUG.exe File opened (read-only) \??\u: ZENolUG.exe File opened (read-only) \??\k: ZENolUG.exe File opened (read-only) \??\p: ZENolUG.exe File opened (read-only) \??\r: ZENolUG.exe File opened (read-only) \??\k: ZENolUG.exe File opened (read-only) \??\e: ZENolUG.exe File opened (read-only) \??\k: ZENolUG.exe File opened (read-only) \??\z: ZENolUG.exe File opened (read-only) \??\m: ZENolUG.exe File opened (read-only) \??\t: ZENolUG.exe File opened (read-only) \??\l: ZENolUG.exe File opened (read-only) \??\l: ZENolUG.exe File opened (read-only) \??\j: ZENolUG.exe File opened (read-only) \??\f: ZENolUG.exe File opened (read-only) \??\i: ZENolUG.exe File opened (read-only) \??\o: ZENolUG.exe File opened (read-only) \??\j: ZENolUG.exe File opened (read-only) \??\x: ZENolUG.exe File opened (read-only) \??\o: ZENolUG.exe File opened (read-only) \??\g: ZENolUG.exe File opened (read-only) \??\s: ZENolUG.exe File opened (read-only) \??\k: ZENolUG.exe File opened (read-only) \??\u: ZENolUG.exe File opened (read-only) \??\j: ZENolUG.exe File opened (read-only) \??\o: ZENolUG.exe File opened (read-only) \??\u: ZENolUG.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe 81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe File created C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exe ZENolUG.exe File created C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exe ZENolUG.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 4756 81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe Token: SeLoadDriverPrivilege 4952 ZENolUG.exe Token: SeLoadDriverPrivilege 4924 ZENolUG.exe Token: SeLoadDriverPrivilege 4932 ZENolUG.exe Token: SeLoadDriverPrivilege 4836 ZENolUG.exe Token: SeLoadDriverPrivilege 2328 ZENolUG.exe Token: SeLoadDriverPrivilege 1260 ZENolUG.exe Token: SeLoadDriverPrivilege 5060 ZENolUG.exe Token: SeLoadDriverPrivilege 1884 ZENolUG.exe Token: SeLoadDriverPrivilege 3476 ZENolUG.exe Token: SeLoadDriverPrivilege 2432 ZENolUG.exe Token: SeLoadDriverPrivilege 3596 ZENolUG.exe Token: SeLoadDriverPrivilege 1856 ZENolUG.exe Token: SeLoadDriverPrivilege 2280 ZENolUG.exe Token: SeLoadDriverPrivilege 260 ZENolUG.exe Token: SeLoadDriverPrivilege 220 ZENolUG.exe Token: SeLoadDriverPrivilege 848 ZENolUG.exe Token: SeLoadDriverPrivilege 3796 ZENolUG.exe Token: SeLoadDriverPrivilege 608 ZENolUG.exe Token: SeLoadDriverPrivilege 4384 ZENolUG.exe Token: SeLoadDriverPrivilege 2880 ZENolUG.exe Token: SeLoadDriverPrivilege 64 ZENolUG.exe Token: SeLoadDriverPrivilege 4860 ZENolUG.exe Token: SeLoadDriverPrivilege 4512 ZENolUG.exe Token: SeLoadDriverPrivilege 4424 ZENolUG.exe Token: SeLoadDriverPrivilege 800 ZENolUG.exe Token: SeLoadDriverPrivilege 4496 ZENolUG.exe Token: SeLoadDriverPrivilege 664 ZENolUG.exe Token: SeLoadDriverPrivilege 2456 ZENolUG.exe Token: SeLoadDriverPrivilege 1936 ZENolUG.exe Token: SeLoadDriverPrivilege 2160 ZENolUG.exe Token: SeLoadDriverPrivilege 3936 ZENolUG.exe Token: SeLoadDriverPrivilege 4704 ZENolUG.exe Token: SeLoadDriverPrivilege 4556 ZENolUG.exe Token: SeLoadDriverPrivilege 4364 ZENolUG.exe Token: SeLoadDriverPrivilege 5028 ZENolUG.exe Token: SeLoadDriverPrivilege 1532 ZENolUG.exe Token: SeLoadDriverPrivilege 4492 ZENolUG.exe Token: SeLoadDriverPrivilege 3748 ZENolUG.exe Token: SeLoadDriverPrivilege 4760 ZENolUG.exe Token: SeLoadDriverPrivilege 4452 ZENolUG.exe Token: SeLoadDriverPrivilege 1676 ZENolUG.exe Token: SeLoadDriverPrivilege 3572 ZENolUG.exe Token: SeLoadDriverPrivilege 1456 ZENolUG.exe Token: SeLoadDriverPrivilege 3140 ZENolUG.exe Token: SeLoadDriverPrivilege 1204 ZENolUG.exe Token: SeLoadDriverPrivilege 3076 ZENolUG.exe Token: SeLoadDriverPrivilege 4828 ZENolUG.exe Token: SeLoadDriverPrivilege 3688 ZENolUG.exe Token: SeLoadDriverPrivilege 4448 ZENolUG.exe Token: SeLoadDriverPrivilege 756 ZENolUG.exe Token: SeLoadDriverPrivilege 3592 ZENolUG.exe Token: SeLoadDriverPrivilege 4472 ZENolUG.exe Token: SeLoadDriverPrivilege 3296 ZENolUG.exe Token: SeLoadDriverPrivilege 2472 ZENolUG.exe Token: SeLoadDriverPrivilege 2952 ZENolUG.exe Token: SeLoadDriverPrivilege 2680 ZENolUG.exe Token: SeLoadDriverPrivilege 3632 ZENolUG.exe Token: SeLoadDriverPrivilege 4580 ZENolUG.exe Token: SeLoadDriverPrivilege 1540 ZENolUG.exe Token: SeLoadDriverPrivilege 4632 ZENolUG.exe Token: SeLoadDriverPrivilege 2848 ZENolUG.exe Token: SeLoadDriverPrivilege 4412 ZENolUG.exe Token: SeLoadDriverPrivilege 4008 ZENolUG.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4756 wrote to memory of 4952 4756 81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe 81 PID 4756 wrote to memory of 4952 4756 81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe 81 PID 4756 wrote to memory of 4952 4756 81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe 81 PID 4952 wrote to memory of 4924 4952 ZENolUG.exe 82 PID 4952 wrote to memory of 4924 4952 ZENolUG.exe 82 PID 4952 wrote to memory of 4924 4952 ZENolUG.exe 82 PID 4924 wrote to memory of 4932 4924 ZENolUG.exe 83 PID 4924 wrote to memory of 4932 4924 ZENolUG.exe 83 PID 4924 wrote to memory of 4932 4924 ZENolUG.exe 83 PID 4932 wrote to memory of 4836 4932 ZENolUG.exe 84 PID 4932 wrote to memory of 4836 4932 ZENolUG.exe 84 PID 4932 wrote to memory of 4836 4932 ZENolUG.exe 84 PID 4836 wrote to memory of 2328 4836 ZENolUG.exe 85 PID 4836 wrote to memory of 2328 4836 ZENolUG.exe 85 PID 4836 wrote to memory of 2328 4836 ZENolUG.exe 85 PID 2328 wrote to memory of 1260 2328 ZENolUG.exe 86 PID 2328 wrote to memory of 1260 2328 ZENolUG.exe 86 PID 2328 wrote to memory of 1260 2328 ZENolUG.exe 86 PID 1260 wrote to memory of 5060 1260 ZENolUG.exe 87 PID 1260 wrote to memory of 5060 1260 ZENolUG.exe 87 PID 1260 wrote to memory of 5060 1260 ZENolUG.exe 87 PID 5060 wrote to memory of 1884 5060 ZENolUG.exe 88 PID 5060 wrote to memory of 1884 5060 ZENolUG.exe 88 PID 5060 wrote to memory of 1884 5060 ZENolUG.exe 88 PID 1884 wrote to memory of 3476 1884 ZENolUG.exe 89 PID 1884 wrote to memory of 3476 1884 ZENolUG.exe 89 PID 1884 wrote to memory of 3476 1884 ZENolUG.exe 89 PID 3476 wrote to memory of 2432 3476 ZENolUG.exe 90 PID 3476 wrote to memory of 2432 3476 ZENolUG.exe 90 PID 3476 wrote to memory of 2432 3476 ZENolUG.exe 90 PID 2432 wrote to memory of 3596 2432 ZENolUG.exe 91 PID 2432 wrote to memory of 3596 2432 ZENolUG.exe 91 PID 2432 wrote to memory of 3596 2432 ZENolUG.exe 91 PID 3596 wrote to memory of 1856 3596 ZENolUG.exe 92 PID 3596 wrote to memory of 1856 3596 ZENolUG.exe 92 PID 3596 wrote to memory of 1856 3596 ZENolUG.exe 92 PID 1856 wrote to memory of 2280 1856 ZENolUG.exe 94 PID 1856 wrote to memory of 2280 1856 ZENolUG.exe 94 PID 1856 wrote to memory of 2280 1856 ZENolUG.exe 94 PID 2280 wrote to memory of 260 2280 ZENolUG.exe 93 PID 2280 wrote to memory of 260 2280 ZENolUG.exe 93 PID 2280 wrote to memory of 260 2280 ZENolUG.exe 93 PID 260 wrote to memory of 220 260 ZENolUG.exe 95 PID 260 wrote to memory of 220 260 ZENolUG.exe 95 PID 260 wrote to memory of 220 260 ZENolUG.exe 95 PID 220 wrote to memory of 848 220 ZENolUG.exe 96 PID 220 wrote to memory of 848 220 ZENolUG.exe 96 PID 220 wrote to memory of 848 220 ZENolUG.exe 96 PID 848 wrote to memory of 3796 848 ZENolUG.exe 98 PID 848 wrote to memory of 3796 848 ZENolUG.exe 98 PID 848 wrote to memory of 3796 848 ZENolUG.exe 98 PID 3796 wrote to memory of 608 3796 ZENolUG.exe 97 PID 3796 wrote to memory of 608 3796 ZENolUG.exe 97 PID 3796 wrote to memory of 608 3796 ZENolUG.exe 97 PID 608 wrote to memory of 4384 608 ZENolUG.exe 99 PID 608 wrote to memory of 4384 608 ZENolUG.exe 99 PID 608 wrote to memory of 4384 608 ZENolUG.exe 99 PID 4384 wrote to memory of 2880 4384 ZENolUG.exe 100 PID 4384 wrote to memory of 2880 4384 ZENolUG.exe 100 PID 4384 wrote to memory of 2880 4384 ZENolUG.exe 100 PID 2880 wrote to memory of 64 2880 ZENolUG.exe 101 PID 2880 wrote to memory of 64 2880 ZENolUG.exe 101 PID 2880 wrote to memory of 64 2880 ZENolUG.exe 101 PID 64 wrote to memory of 4860 64 ZENolUG.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe"C:\Users\Admin\AppData\Local\Temp\81a4545d1fb5b0f5edf1e6dc3006f3aadbecc646f369251b07ed44f95a1e15cb.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe6⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe13⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe14⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280
-
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe11⤵PID:16464
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe9⤵PID:1564
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe8⤵PID:16348
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe9⤵PID:15580
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe7⤵PID:16288
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe6⤵PID:16132
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe7⤵PID:16220
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe5⤵PID:16040
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe6⤵PID:16116
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe7⤵PID:16196
-
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe4⤵PID:15940
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe5⤵PID:16012
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe6⤵PID:16068
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe7⤵PID:16156
-
-
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe3⤵PID:15904
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe2⤵PID:15804
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe3⤵PID:15836
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe4⤵PID:15860
-
-
-
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe4⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe5⤵PID:17212
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe4⤵PID:17176
-
-
-
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4860 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe6⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4512 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4424 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:800 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4496 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:664 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2456 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1936 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2160 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe14⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3936 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4704 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4556 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4364 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe18⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:5028 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1532 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe20⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4492 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3748 -
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe22⤵PID:19728
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe20⤵PID:19556
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe19⤵PID:19508
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe18⤵PID:19460
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe17⤵PID:19324
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe18⤵PID:3512
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe19⤵PID:20140
-
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe16⤵PID:19288
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe8⤵PID:18380
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe9⤵PID:18768
-
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe6⤵PID:17872
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe5⤵PID:17864
-
-
-
-
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4760 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4452 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1676 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3572 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1456 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3140 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1204 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3076 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4828 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3688 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4448 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:756 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3592 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4472 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3296 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2472 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe17⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2952 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe18⤵PID:21632
-
-
-
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe13⤵PID:21196
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe4⤵PID:20164
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe3⤵PID:20148
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe4⤵PID:20568
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe5⤵PID:20880
-
-
-
-
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4632 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2848 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4412 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4008 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe5⤵
- Executes dropped EXE
PID:3952 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe6⤵
- Enumerates connected drives
PID:4640
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe4⤵PID:22560
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe5⤵PID:4172
-
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe3⤵PID:22540
-
-
-
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe2⤵PID:2108
-
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4580
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3632 -
C:\Windows\SysWOW64\ZENolUG\gUDyfFg.exeC:\Windows\system32\ZENolUG\gUDyfFg.exe2⤵PID:22100
-
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe1⤵PID:3472
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe2⤵PID:752
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe3⤵PID:4136
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe4⤵PID:3924
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe5⤵
- Enumerates connected drives
PID:4040 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe6⤵
- Drops file in System32 directory
PID:4648 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe7⤵PID:1320
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe8⤵PID:1720
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe9⤵
- Drops file in System32 directory
PID:4100 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe10⤵PID:5048
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe11⤵PID:4216
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe12⤵
- Drops file in System32 directory
PID:1836 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe13⤵
- Drops file in System32 directory
PID:1756 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe14⤵
- Enumerates connected drives
PID:3508 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe15⤵PID:3392
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe16⤵
- Drops file in System32 directory
PID:2884 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe17⤵PID:3088
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe18⤵
- Drops file in System32 directory
PID:2244 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe19⤵
- Enumerates connected drives
PID:3364 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe20⤵PID:4312
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe21⤵PID:976
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe22⤵PID:1776
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe23⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:1280 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe24⤵
- Drops file in System32 directory
PID:2452 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe25⤵PID:2424
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe26⤵PID:1724
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe27⤵PID:4404
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe28⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:1076 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe29⤵PID:4188
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe30⤵
- Enumerates connected drives
PID:3480 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe31⤵
- Drops file in System32 directory
PID:4288 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe32⤵PID:3160
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe33⤵
- Drops file in System32 directory
PID:1108 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe34⤵PID:5068
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe35⤵
- Enumerates connected drives
PID:3120 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe36⤵PID:3984
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe37⤵PID:3356
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe38⤵PID:2304
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe39⤵PID:2888
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe40⤵PID:5016
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe41⤵PID:1592
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe42⤵
- Enumerates connected drives
PID:4376 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe43⤵PID:1448
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe44⤵PID:2524
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe45⤵PID:3424
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe46⤵PID:1300
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe47⤵
- Enumerates connected drives
PID:5020 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe48⤵
- Enumerates connected drives
PID:5012 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe49⤵PID:256
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe50⤵PID:4484
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe51⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3128 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe52⤵PID:3840
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe53⤵PID:3708
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe54⤵
- Drops file in System32 directory
PID:1112 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe55⤵
- Enumerates connected drives
PID:3492 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe56⤵PID:5140
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe57⤵
- Drops file in System32 directory
PID:5156 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe58⤵
- Drops file in System32 directory
PID:5176 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe59⤵PID:5204
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe60⤵
- Drops file in System32 directory
PID:5220 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe61⤵
- Enumerates connected drives
PID:5240 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe62⤵PID:5268
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe63⤵PID:5284
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe64⤵PID:5308
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe65⤵PID:5332
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe66⤵PID:5352
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe67⤵
- Enumerates connected drives
PID:5380 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe68⤵PID:5404
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe69⤵
- Drops file in System32 directory
PID:5424 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe70⤵PID:5444
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe71⤵PID:5464
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe72⤵
- Enumerates connected drives
PID:5484 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe73⤵PID:5504
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe74⤵PID:5524
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe75⤵PID:5548
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe76⤵PID:5568
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe77⤵
- Enumerates connected drives
PID:5588 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe78⤵PID:5612
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe79⤵PID:5636
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe80⤵PID:5660
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe81⤵PID:5676
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe82⤵PID:5692
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe83⤵
- Enumerates connected drives
PID:5708 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe84⤵PID:5728
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe85⤵PID:5744
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe86⤵PID:5764
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe87⤵PID:5780
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe88⤵PID:5796
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe89⤵PID:5812
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe90⤵
- Enumerates connected drives
PID:5828 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe91⤵PID:5844
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe92⤵PID:5864
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe93⤵PID:5880
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe94⤵
- Enumerates connected drives
PID:5896 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe95⤵
- Drops file in System32 directory
PID:5912 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe96⤵PID:5932
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe97⤵PID:5944
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe98⤵
- Drops file in System32 directory
PID:5960 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe99⤵PID:5980
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe100⤵
- Enumerates connected drives
PID:5992 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe101⤵PID:6012
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe102⤵PID:6024
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe103⤵PID:6040
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe104⤵PID:6056
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe105⤵PID:6072
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe106⤵PID:6092
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe107⤵
- Enumerates connected drives
PID:6112 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe108⤵PID:6136
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe109⤵PID:5128
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe110⤵PID:5212
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe111⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:5304 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe112⤵PID:5364
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe113⤵PID:5420
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe114⤵PID:5536
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe115⤵PID:5600
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe116⤵
- Enumerates connected drives
PID:6104 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe117⤵
- Enumerates connected drives
PID:5328 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe118⤵PID:5200
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe119⤵PID:6172
-
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe120⤵
- Drops file in System32 directory
PID:6188 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe121⤵
- Drops file in System32 directory
PID:6212 -
C:\Windows\SysWOW64\gUDyfFg\ZENolUG.exeC:\Windows\system32\gUDyfFg\ZENolUG.exe122⤵PID:6240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-