Analysis
-
max time kernel
57s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2022, 14:17
Behavioral task
behavioral1
Sample
249352108713894f9b6b0dd6c99e5cccfb1b3f6a7d863d32acca9eaa51b81cec.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
249352108713894f9b6b0dd6c99e5cccfb1b3f6a7d863d32acca9eaa51b81cec.exe
Resource
win10v2004-20220812-en
General
-
Target
249352108713894f9b6b0dd6c99e5cccfb1b3f6a7d863d32acca9eaa51b81cec.exe
-
Size
185KB
-
MD5
7829202c10534ed9cb942848c39e77f0
-
SHA1
2fc3ee5883a920108ec1f49c3f3c1ee94339dc80
-
SHA256
249352108713894f9b6b0dd6c99e5cccfb1b3f6a7d863d32acca9eaa51b81cec
-
SHA512
653d6489fd9836e9e4108f8df9a6972fd098c209e6a991c55311a823b72e5e371c9fac06afbb64582498111085606570c9a1ab7372ad99a84abdbbb2a1ef01c1
-
SSDEEP
3072:iQJfOxnw+v364WUDKQJfOxnw+v364WUD/:iQJfQw+C4WZQJfQw+C4Ww
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2324 zoJlhCx.exe 736 zoJlhCx.exe 1768 zoJlhCx.exe 800 zoJlhCx.exe 4560 zoJlhCx.exe 3560 zoJlhCx.exe 2120 zoJlhCx.exe 1620 zoJlhCx.exe 3076 zoJlhCx.exe 316 zoJlhCx.exe 3536 zoJlhCx.exe 3948 zoJlhCx.exe 5100 zoJlhCx.exe 3760 zoJlhCx.exe 4920 zoJlhCx.exe 1048 zoJlhCx.exe 1644 zoJlhCx.exe 4932 zoJlhCx.exe 2000 zoJlhCx.exe 996 zoJlhCx.exe 4764 zoJlhCx.exe 2212 zoJlhCx.exe 1752 zoJlhCx.exe 628 zoJlhCx.exe 3048 zoJlhCx.exe 3520 zoJlhCx.exe 1968 zoJlhCx.exe 1828 zoJlhCx.exe 2404 zoJlhCx.exe 3800 zoJlhCx.exe 4064 zoJlhCx.exe 2700 zoJlhCx.exe 4440 zoJlhCx.exe 4076 zoJlhCx.exe 2008 zoJlhCx.exe 3016 zoJlhCx.exe 5076 zoJlhCx.exe 4104 zoJlhCx.exe 4100 zoJlhCx.exe 4796 zoJlhCx.exe 4808 zoJlhCx.exe 3944 zoJlhCx.exe 540 zoJlhCx.exe 3516 zoJlhCx.exe 4864 zoJlhCx.exe 1492 zoJlhCx.exe 1388 zoJlhCx.exe 3420 zoJlhCx.exe 3604 zoJlhCx.exe 3440 zoJlhCx.exe 4648 zoJlhCx.exe 3784 zoJlhCx.exe 4956 zoJlhCx.exe 2296 zoJlhCx.exe 364 zoJlhCx.exe 444 zoJlhCx.exe 4820 zoJlhCx.exe 4328 zoJlhCx.exe 3780 zoJlhCx.exe 2884 zoJlhCx.exe 392 zoJlhCx.exe 4636 zoJlhCx.exe 2464 zoJlhCx.exe 2012 zoJlhCx.exe -
resource yara_rule behavioral2/memory/4112-133-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/4112-134-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e3e-136.dat upx behavioral2/files/0x0007000000022e3e-137.dat upx behavioral2/files/0x0007000000022e3e-139.dat upx behavioral2/files/0x0007000000022e3e-141.dat upx behavioral2/files/0x0007000000022e3e-143.dat upx behavioral2/files/0x0007000000022e3e-145.dat upx behavioral2/files/0x0007000000022e3e-147.dat upx behavioral2/files/0x0007000000022e3e-149.dat upx behavioral2/files/0x0007000000022e3e-151.dat upx behavioral2/files/0x0007000000022e3e-153.dat upx behavioral2/files/0x0007000000022e3e-155.dat upx behavioral2/files/0x0007000000022e3e-159.dat upx behavioral2/memory/736-158-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/2324-156-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e3e-163.dat upx behavioral2/memory/1768-161-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/800-162-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/4560-164-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/3560-166-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e3e-167.dat upx behavioral2/files/0x0007000000022e3e-170.dat upx behavioral2/memory/1620-171-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/3076-173-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e3e-177.dat upx behavioral2/files/0x0007000000022e3e-174.dat upx behavioral2/memory/2120-168-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/316-175-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e3e-179.dat upx behavioral2/files/0x0007000000022e3e-181.dat upx behavioral2/files/0x0007000000022e3e-183.dat upx behavioral2/files/0x0007000000022e3e-185.dat upx behavioral2/files/0x0007000000022e3e-187.dat upx behavioral2/files/0x0007000000022e3e-189.dat upx behavioral2/files/0x0007000000022e3e-191.dat upx behavioral2/files/0x0007000000022e3e-193.dat upx behavioral2/files/0x0007000000022e3e-195.dat upx behavioral2/files/0x0007000000022e3e-197.dat upx behavioral2/files/0x0007000000022e3e-199.dat upx behavioral2/files/0x0007000000022e3e-201.dat upx behavioral2/files/0x0007000000022e3e-203.dat upx behavioral2/files/0x0007000000022e3e-205.dat upx behavioral2/files/0x0007000000022e3e-207.dat upx behavioral2/memory/3536-209-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/3948-212-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e3e-213.dat upx behavioral2/files/0x0007000000022e3e-210.dat upx behavioral2/memory/1644-221-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/2000-224-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e3e-223.dat upx behavioral2/memory/4932-222-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/1048-219-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e3e-218.dat upx behavioral2/memory/4920-217-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/5100-214-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/3760-216-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/996-226-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/4764-228-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/2212-230-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/628-234-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/1752-233-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/3048-237-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e3e-238.dat upx -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\z: zoJlhCx.exe File opened (read-only) \??\u: zoJlhCx.exe File opened (read-only) \??\i: zoJlhCx.exe File opened (read-only) \??\s: zoJlhCx.exe File opened (read-only) \??\n: zoJlhCx.exe File opened (read-only) \??\s: zoJlhCx.exe File opened (read-only) \??\u: zoJlhCx.exe File opened (read-only) \??\m: zoJlhCx.exe File opened (read-only) \??\k: zoJlhCx.exe File opened (read-only) \??\g: zoJlhCx.exe File opened (read-only) \??\u: zoJlhCx.exe File opened (read-only) \??\s: zoJlhCx.exe File opened (read-only) \??\n: zoJlhCx.exe File opened (read-only) \??\x: zoJlhCx.exe File opened (read-only) \??\i: zoJlhCx.exe File opened (read-only) \??\l: zoJlhCx.exe File opened (read-only) \??\y: zoJlhCx.exe File opened (read-only) \??\i: zoJlhCx.exe File opened (read-only) \??\v: zoJlhCx.exe File opened (read-only) \??\u: zoJlhCx.exe File opened (read-only) \??\j: zoJlhCx.exe File opened (read-only) \??\l: zoJlhCx.exe File opened (read-only) \??\w: zoJlhCx.exe File opened (read-only) \??\n: zoJlhCx.exe File opened (read-only) \??\w: zoJlhCx.exe File opened (read-only) \??\z: zoJlhCx.exe File opened (read-only) \??\k: zoJlhCx.exe File opened (read-only) \??\e: zoJlhCx.exe File opened (read-only) \??\n: zoJlhCx.exe File opened (read-only) \??\l: zoJlhCx.exe File opened (read-only) \??\q: zoJlhCx.exe File opened (read-only) \??\q: zoJlhCx.exe File opened (read-only) \??\u: zoJlhCx.exe File opened (read-only) \??\k: zoJlhCx.exe File opened (read-only) \??\m: zoJlhCx.exe File opened (read-only) \??\v: zoJlhCx.exe File opened (read-only) \??\u: zoJlhCx.exe File opened (read-only) \??\m: zoJlhCx.exe File opened (read-only) \??\l: zoJlhCx.exe File opened (read-only) \??\k: zoJlhCx.exe File opened (read-only) \??\o: zoJlhCx.exe File opened (read-only) \??\y: zoJlhCx.exe File opened (read-only) \??\k: zoJlhCx.exe File opened (read-only) \??\x: zoJlhCx.exe File opened (read-only) \??\o: zoJlhCx.exe File opened (read-only) \??\l: zoJlhCx.exe File opened (read-only) \??\u: zoJlhCx.exe File opened (read-only) \??\i: zoJlhCx.exe File opened (read-only) \??\y: zoJlhCx.exe File opened (read-only) \??\t: zoJlhCx.exe File opened (read-only) \??\t: zoJlhCx.exe File opened (read-only) \??\t: zoJlhCx.exe File opened (read-only) \??\e: zoJlhCx.exe File opened (read-only) \??\e: zoJlhCx.exe File opened (read-only) \??\z: zoJlhCx.exe File opened (read-only) \??\r: zoJlhCx.exe File opened (read-only) \??\t: zoJlhCx.exe File opened (read-only) \??\n: zoJlhCx.exe File opened (read-only) \??\r: zoJlhCx.exe File opened (read-only) \??\x: zoJlhCx.exe File opened (read-only) \??\o: zoJlhCx.exe File opened (read-only) \??\p: zoJlhCx.exe File opened (read-only) \??\x: zoJlhCx.exe File opened (read-only) \??\u: zoJlhCx.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe File created C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exe zoJlhCx.exe File created C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exe zoJlhCx.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 4112 249352108713894f9b6b0dd6c99e5cccfb1b3f6a7d863d32acca9eaa51b81cec.exe Token: SeLoadDriverPrivilege 2324 zoJlhCx.exe Token: SeLoadDriverPrivilege 736 zoJlhCx.exe Token: SeLoadDriverPrivilege 1768 zoJlhCx.exe Token: SeLoadDriverPrivilege 800 zoJlhCx.exe Token: SeLoadDriverPrivilege 4560 zoJlhCx.exe Token: SeLoadDriverPrivilege 3560 zoJlhCx.exe Token: SeLoadDriverPrivilege 2120 zoJlhCx.exe Token: SeLoadDriverPrivilege 1620 zoJlhCx.exe Token: SeLoadDriverPrivilege 3076 zoJlhCx.exe Token: SeLoadDriverPrivilege 316 zoJlhCx.exe Token: SeLoadDriverPrivilege 3536 zoJlhCx.exe Token: SeLoadDriverPrivilege 3948 zoJlhCx.exe Token: SeLoadDriverPrivilege 5100 zoJlhCx.exe Token: SeLoadDriverPrivilege 3760 zoJlhCx.exe Token: SeLoadDriverPrivilege 4920 zoJlhCx.exe Token: SeLoadDriverPrivilege 1048 zoJlhCx.exe Token: SeLoadDriverPrivilege 1644 zoJlhCx.exe Token: SeLoadDriverPrivilege 4932 zoJlhCx.exe Token: SeLoadDriverPrivilege 2000 zoJlhCx.exe Token: SeLoadDriverPrivilege 996 zoJlhCx.exe Token: SeLoadDriverPrivilege 4764 zoJlhCx.exe Token: SeLoadDriverPrivilege 2212 zoJlhCx.exe Token: SeLoadDriverPrivilege 1752 zoJlhCx.exe Token: SeLoadDriverPrivilege 628 zoJlhCx.exe Token: SeLoadDriverPrivilege 3048 zoJlhCx.exe Token: SeLoadDriverPrivilege 3520 zoJlhCx.exe Token: SeLoadDriverPrivilege 1968 zoJlhCx.exe Token: SeLoadDriverPrivilege 1828 zoJlhCx.exe Token: SeLoadDriverPrivilege 2404 zoJlhCx.exe Token: SeLoadDriverPrivilege 3800 zoJlhCx.exe Token: SeLoadDriverPrivilege 4064 zoJlhCx.exe Token: SeLoadDriverPrivilege 2700 zoJlhCx.exe Token: SeLoadDriverPrivilege 4440 zoJlhCx.exe Token: SeLoadDriverPrivilege 4076 zoJlhCx.exe Token: SeLoadDriverPrivilege 2008 zoJlhCx.exe Token: SeLoadDriverPrivilege 3016 zoJlhCx.exe Token: SeLoadDriverPrivilege 5076 zoJlhCx.exe Token: SeLoadDriverPrivilege 4104 zoJlhCx.exe Token: SeLoadDriverPrivilege 4100 zoJlhCx.exe Token: SeLoadDriverPrivilege 4796 zoJlhCx.exe Token: SeLoadDriverPrivilege 4808 zoJlhCx.exe Token: SeLoadDriverPrivilege 3944 zoJlhCx.exe Token: SeLoadDriverPrivilege 540 zoJlhCx.exe Token: SeLoadDriverPrivilege 3516 zoJlhCx.exe Token: SeLoadDriverPrivilege 4864 zoJlhCx.exe Token: SeLoadDriverPrivilege 1492 zoJlhCx.exe Token: SeLoadDriverPrivilege 1388 zoJlhCx.exe Token: SeLoadDriverPrivilege 3420 zoJlhCx.exe Token: SeLoadDriverPrivilege 3604 zoJlhCx.exe Token: SeLoadDriverPrivilege 3440 zoJlhCx.exe Token: SeLoadDriverPrivilege 4648 zoJlhCx.exe Token: SeLoadDriverPrivilege 3784 zoJlhCx.exe Token: SeLoadDriverPrivilege 4956 zoJlhCx.exe Token: SeLoadDriverPrivilege 2296 zoJlhCx.exe Token: SeLoadDriverPrivilege 364 zoJlhCx.exe Token: SeLoadDriverPrivilege 444 zoJlhCx.exe Token: SeLoadDriverPrivilege 4820 zoJlhCx.exe Token: SeLoadDriverPrivilege 4328 zoJlhCx.exe Token: SeLoadDriverPrivilege 3780 zoJlhCx.exe Token: SeLoadDriverPrivilege 2884 zoJlhCx.exe Token: SeLoadDriverPrivilege 392 zoJlhCx.exe Token: SeLoadDriverPrivilege 4636 zoJlhCx.exe Token: SeLoadDriverPrivilege 2464 zoJlhCx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4112 wrote to memory of 2324 4112 249352108713894f9b6b0dd6c99e5cccfb1b3f6a7d863d32acca9eaa51b81cec.exe 81 PID 4112 wrote to memory of 2324 4112 249352108713894f9b6b0dd6c99e5cccfb1b3f6a7d863d32acca9eaa51b81cec.exe 81 PID 4112 wrote to memory of 2324 4112 249352108713894f9b6b0dd6c99e5cccfb1b3f6a7d863d32acca9eaa51b81cec.exe 81 PID 2324 wrote to memory of 736 2324 zoJlhCx.exe 82 PID 2324 wrote to memory of 736 2324 zoJlhCx.exe 82 PID 2324 wrote to memory of 736 2324 zoJlhCx.exe 82 PID 736 wrote to memory of 1768 736 zoJlhCx.exe 83 PID 736 wrote to memory of 1768 736 zoJlhCx.exe 83 PID 736 wrote to memory of 1768 736 zoJlhCx.exe 83 PID 1768 wrote to memory of 800 1768 zoJlhCx.exe 84 PID 1768 wrote to memory of 800 1768 zoJlhCx.exe 84 PID 1768 wrote to memory of 800 1768 zoJlhCx.exe 84 PID 800 wrote to memory of 4560 800 zoJlhCx.exe 85 PID 800 wrote to memory of 4560 800 zoJlhCx.exe 85 PID 800 wrote to memory of 4560 800 zoJlhCx.exe 85 PID 4560 wrote to memory of 3560 4560 zoJlhCx.exe 86 PID 4560 wrote to memory of 3560 4560 zoJlhCx.exe 86 PID 4560 wrote to memory of 3560 4560 zoJlhCx.exe 86 PID 3560 wrote to memory of 2120 3560 zoJlhCx.exe 87 PID 3560 wrote to memory of 2120 3560 zoJlhCx.exe 87 PID 3560 wrote to memory of 2120 3560 zoJlhCx.exe 87 PID 2120 wrote to memory of 1620 2120 zoJlhCx.exe 88 PID 2120 wrote to memory of 1620 2120 zoJlhCx.exe 88 PID 2120 wrote to memory of 1620 2120 zoJlhCx.exe 88 PID 1620 wrote to memory of 3076 1620 zoJlhCx.exe 89 PID 1620 wrote to memory of 3076 1620 zoJlhCx.exe 89 PID 1620 wrote to memory of 3076 1620 zoJlhCx.exe 89 PID 3076 wrote to memory of 316 3076 zoJlhCx.exe 90 PID 3076 wrote to memory of 316 3076 zoJlhCx.exe 90 PID 3076 wrote to memory of 316 3076 zoJlhCx.exe 90 PID 316 wrote to memory of 3536 316 zoJlhCx.exe 91 PID 316 wrote to memory of 3536 316 zoJlhCx.exe 91 PID 316 wrote to memory of 3536 316 zoJlhCx.exe 91 PID 3536 wrote to memory of 3948 3536 zoJlhCx.exe 92 PID 3536 wrote to memory of 3948 3536 zoJlhCx.exe 92 PID 3536 wrote to memory of 3948 3536 zoJlhCx.exe 92 PID 3948 wrote to memory of 5100 3948 zoJlhCx.exe 93 PID 3948 wrote to memory of 5100 3948 zoJlhCx.exe 93 PID 3948 wrote to memory of 5100 3948 zoJlhCx.exe 93 PID 5100 wrote to memory of 3760 5100 zoJlhCx.exe 97 PID 5100 wrote to memory of 3760 5100 zoJlhCx.exe 97 PID 5100 wrote to memory of 3760 5100 zoJlhCx.exe 97 PID 3760 wrote to memory of 4920 3760 zoJlhCx.exe 96 PID 3760 wrote to memory of 4920 3760 zoJlhCx.exe 96 PID 3760 wrote to memory of 4920 3760 zoJlhCx.exe 96 PID 4920 wrote to memory of 1048 4920 zoJlhCx.exe 95 PID 4920 wrote to memory of 1048 4920 zoJlhCx.exe 95 PID 4920 wrote to memory of 1048 4920 zoJlhCx.exe 95 PID 1048 wrote to memory of 1644 1048 zoJlhCx.exe 94 PID 1048 wrote to memory of 1644 1048 zoJlhCx.exe 94 PID 1048 wrote to memory of 1644 1048 zoJlhCx.exe 94 PID 1644 wrote to memory of 4932 1644 zoJlhCx.exe 98 PID 1644 wrote to memory of 4932 1644 zoJlhCx.exe 98 PID 1644 wrote to memory of 4932 1644 zoJlhCx.exe 98 PID 4932 wrote to memory of 2000 4932 zoJlhCx.exe 99 PID 4932 wrote to memory of 2000 4932 zoJlhCx.exe 99 PID 4932 wrote to memory of 2000 4932 zoJlhCx.exe 99 PID 2000 wrote to memory of 996 2000 zoJlhCx.exe 100 PID 2000 wrote to memory of 996 2000 zoJlhCx.exe 100 PID 2000 wrote to memory of 996 2000 zoJlhCx.exe 100 PID 996 wrote to memory of 4764 996 zoJlhCx.exe 101 PID 996 wrote to memory of 4764 996 zoJlhCx.exe 101 PID 996 wrote to memory of 4764 996 zoJlhCx.exe 101 PID 4764 wrote to memory of 2212 4764 zoJlhCx.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\249352108713894f9b6b0dd6c99e5cccfb1b3f6a7d863d32acca9eaa51b81cec.exe"C:\Users\Admin\AppData\Local\Temp\249352108713894f9b6b0dd6c99e5cccfb1b3f6a7d863d32acca9eaa51b81cec.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe7⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe13⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe14⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe16⤵PID:18076
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe15⤵PID:17848
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe14⤵PID:17648
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe15⤵PID:17840
-
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe13⤵PID:17624
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe14⤵PID:17684
-
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe12⤵PID:17360
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe11⤵PID:17320
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe10⤵PID:17272
-
-
-
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe6⤵PID:16792
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe5⤵PID:16764
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe4⤵PID:16688
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe5⤵PID:16752
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe6⤵PID:16912
-
-
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe3⤵PID:16600
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe4⤵PID:16640
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe5⤵PID:16736
-
-
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe2⤵PID:16512
-
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2212 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1752 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:628 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3048 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3520 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1968 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1828 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2404 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3800 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4064 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2700 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4440 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4076 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2008 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3016 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe15⤵PID:19748
-
-
-
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe11⤵PID:19096
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe12⤵PID:20180
-
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe10⤵PID:19088
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe9⤵PID:18844
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe8⤵PID:18684
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe9⤵PID:19396
-
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe7⤵PID:18660
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe6⤵PID:18608
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe7⤵PID:19360
-
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe5⤵PID:18588
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe6⤵PID:18888
-
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe4⤵PID:1656
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe3⤵PID:18412
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe2⤵PID:18164
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe3⤵PID:17676
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe4⤵PID:18572
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe5⤵PID:18960
-
-
-
-
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe2⤵PID:18088
-
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe2⤵PID:18144
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe3⤵PID:18248
-
-
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4796 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4808 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3944 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:540 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3516 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe6⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4864 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1492 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1388 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3420 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3604 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3440 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4648 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3784 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4956 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2296 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:364 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:444 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4820 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4328 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3780 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2884 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\zoJlhCx\ryKbBTd.exeC:\Windows\system32\zoJlhCx\ryKbBTd.exe2⤵PID:20932
-
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4100
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4104
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4636 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2464 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe3⤵
- Executes dropped EXE
PID:2012 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe4⤵PID:4588
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe5⤵PID:1392
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe6⤵
- Drops file in System32 directory
PID:2804 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe7⤵PID:820
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe8⤵PID:380
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe9⤵PID:4400
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe10⤵PID:3840
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe11⤵PID:1624
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe12⤵PID:4856
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe13⤵PID:480
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe14⤵PID:4804
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe15⤵PID:640
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe16⤵
- Enumerates connected drives
PID:3116 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe17⤵PID:1512
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe18⤵PID:5012
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe19⤵PID:2072
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe20⤵PID:4748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe1⤵
- Drops file in System32 directory
PID:2744 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe2⤵PID:4268
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe3⤵
- Drops file in System32 directory
PID:3532
-
-
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe1⤵PID:3424
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe2⤵PID:4992
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe3⤵PID:2376
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe4⤵PID:5032
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe5⤵PID:2476
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe6⤵
- Enumerates connected drives
PID:4720 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe7⤵PID:2292
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe8⤵PID:4324
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe9⤵
- Enumerates connected drives
PID:1292 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe10⤵PID:3880
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe11⤵PID:1468
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe12⤵PID:3120
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe13⤵PID:2300
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe14⤵
- Enumerates connected drives
PID:3376 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe15⤵PID:4124
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe16⤵PID:4684
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe17⤵PID:4012
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe18⤵PID:4668
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe19⤵PID:1456
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe20⤵PID:936
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe21⤵
- Drops file in System32 directory
PID:2728 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe22⤵PID:2340
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe23⤵PID:3452
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe24⤵PID:4984
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe25⤵PID:4484
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe26⤵PID:4504
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe27⤵
- Enumerates connected drives
PID:988 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe28⤵PID:3160
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe29⤵PID:5124
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe30⤵
- Drops file in System32 directory
PID:5140 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe31⤵PID:5156
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe32⤵PID:5172
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe33⤵PID:5188
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe34⤵PID:5208
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe35⤵
- Enumerates connected drives
PID:5228 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe36⤵
- Drops file in System32 directory
PID:5248 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe37⤵
- Drops file in System32 directory
PID:5268 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe38⤵PID:5292
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe39⤵PID:5312
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe40⤵PID:5336
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe41⤵PID:5356
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe42⤵PID:5380
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe43⤵PID:5400
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe44⤵PID:5420
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe45⤵
- Enumerates connected drives
PID:5440 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe46⤵PID:5464
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe47⤵PID:5480
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe48⤵PID:5500
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe49⤵PID:5520
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe50⤵
- Drops file in System32 directory
PID:5544 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe51⤵PID:5564
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe52⤵PID:5588
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe53⤵PID:5608
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe54⤵PID:5628
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe55⤵
- Drops file in System32 directory
PID:5648 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe56⤵PID:5672
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe57⤵PID:5692
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe58⤵PID:5716
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe59⤵
- Enumerates connected drives
PID:5732 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe60⤵PID:5756
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe61⤵PID:5772
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe62⤵
- Enumerates connected drives
PID:5788 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe63⤵PID:5804
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe64⤵PID:5820
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe65⤵PID:5836
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe66⤵PID:5852
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe67⤵PID:5868
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe68⤵
- Enumerates connected drives
PID:5884 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe69⤵PID:5900
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe70⤵PID:5924
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe71⤵PID:5940
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe72⤵PID:5964
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe73⤵PID:5980
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe74⤵PID:6000
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe75⤵PID:6020
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe76⤵
- Drops file in System32 directory
PID:6040 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe77⤵
- Drops file in System32 directory
PID:6060 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe78⤵PID:6088
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe79⤵
- Enumerates connected drives
PID:6104 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe80⤵PID:6124
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe81⤵PID:5184
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe82⤵PID:5280
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe83⤵PID:5368
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe84⤵PID:5428
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe85⤵PID:5556
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe86⤵PID:5584
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe87⤵
- Enumerates connected drives
PID:5684 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe88⤵
- Drops file in System32 directory
PID:5896 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe89⤵
- Enumerates connected drives
PID:5992 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe90⤵
- Drops file in System32 directory
PID:6084 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe91⤵PID:5392
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe92⤵PID:5740
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe93⤵PID:6152
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe94⤵PID:6172
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe95⤵PID:6192
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe96⤵PID:6216
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe97⤵PID:6232
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe98⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:6256 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe99⤵
- Drops file in System32 directory
PID:6272 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe100⤵PID:6292
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe101⤵PID:6312
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe102⤵PID:6332
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe103⤵PID:6352
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe104⤵PID:6372
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe105⤵PID:6388
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe106⤵PID:6404
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe107⤵PID:6420
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe108⤵PID:6436
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe109⤵PID:6452
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe110⤵
- Enumerates connected drives
PID:6468 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe111⤵
- Drops file in System32 directory
PID:6484 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe112⤵PID:6500
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe113⤵
- Drops file in System32 directory
PID:6516 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe114⤵
- Drops file in System32 directory
PID:6540 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe115⤵PID:6556
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe116⤵PID:6584
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe117⤵PID:6600
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe118⤵PID:6628
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe119⤵
- Drops file in System32 directory
PID:6644 -
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe120⤵PID:6664
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe121⤵PID:6688
-
C:\Windows\SysWOW64\ryKbBTd\zoJlhCx.exeC:\Windows\system32\ryKbBTd\zoJlhCx.exe122⤵PID:6704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-