Analysis
-
max time kernel
61s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 21:28
Behavioral task
behavioral1
Sample
63a8c11d299c321d9b2d820b39502a62768b6dcda28608001c9169b7fc371134.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
63a8c11d299c321d9b2d820b39502a62768b6dcda28608001c9169b7fc371134.exe
Resource
win10v2004-20220812-en
General
-
Target
63a8c11d299c321d9b2d820b39502a62768b6dcda28608001c9169b7fc371134.exe
-
Size
105KB
-
MD5
0e8c146f5d4a338cb2a7917e007682c7
-
SHA1
1f501029e54982566c141e28e8ed6a71b3127605
-
SHA256
63a8c11d299c321d9b2d820b39502a62768b6dcda28608001c9169b7fc371134
-
SHA512
acd2ef3ebc0d2cfb9106093f3b01c40f13a81a8a9c27d7568b88ed05ae25e99b94797227cf11d39018f32a9414084cf3dd41c84f245433f5a80853db24b5c889
-
SSDEEP
1536:UbBF9AiROgsyJvu1/RnsJExToz19gfBGD2t0raL5pDkJuPYrQ0gtu:GB87yutsTR+fBm2t0KDCxrCM
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1020 hAsnlxU.exe 2040 hAsnlxU.exe 1656 hAsnlxU.exe 3008 hAsnlxU.exe 2192 hAsnlxU.exe 4944 hAsnlxU.exe 4924 hAsnlxU.exe 4880 hAsnlxU.exe 4836 hAsnlxU.exe 4804 hAsnlxU.exe 4292 hAsnlxU.exe 4960 hAsnlxU.exe 2532 hAsnlxU.exe 3664 hAsnlxU.exe 1128 hAsnlxU.exe 3316 hAsnlxU.exe 1480 hAsnlxU.exe 5004 hAsnlxU.exe 860 hAsnlxU.exe 744 hAsnlxU.exe 432 hAsnlxU.exe 3924 hAsnlxU.exe 4280 hAsnlxU.exe 4664 hAsnlxU.exe 212 hAsnlxU.exe 116 hAsnlxU.exe 2016 hAsnlxU.exe 3892 hAsnlxU.exe 3804 hAsnlxU.exe 3528 hAsnlxU.exe 3564 hAsnlxU.exe 3656 hAsnlxU.exe 3484 hAsnlxU.exe 2276 hAsnlxU.exe 1720 hAsnlxU.exe 4160 hAsnlxU.exe 3648 hAsnlxU.exe 4624 hAsnlxU.exe 3440 hAsnlxU.exe 4564 hAsnlxU.exe 1100 hAsnlxU.exe 3744 hAsnlxU.exe 1472 hAsnlxU.exe 3812 hAsnlxU.exe 4428 hAsnlxU.exe 4524 hAsnlxU.exe 4716 hAsnlxU.exe 3500 hAsnlxU.exe 2096 hAsnlxU.exe 4868 hAsnlxU.exe 4416 hAsnlxU.exe 5068 hAsnlxU.exe 4560 hAsnlxU.exe 4068 hAsnlxU.exe 912 hAsnlxU.exe 1880 hAsnlxU.exe 4156 hAsnlxU.exe 4132 hAsnlxU.exe 3752 hAsnlxU.exe 1344 hAsnlxU.exe 1944 hAsnlxU.exe 4468 hAsnlxU.exe 4984 hAsnlxU.exe 632 hAsnlxU.exe -
resource yara_rule behavioral2/memory/2216-132-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/files/0x0007000000022e1b-134.dat upx behavioral2/files/0x0007000000022e1b-135.dat upx behavioral2/memory/1020-136-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/files/0x0007000000022e1b-138.dat upx behavioral2/files/0x0007000000022e1b-140.dat upx behavioral2/files/0x0007000000022e1b-142.dat upx behavioral2/files/0x0007000000022e1b-144.dat upx behavioral2/files/0x0007000000022e1b-146.dat upx behavioral2/files/0x0007000000022e1b-148.dat upx behavioral2/files/0x0007000000022e1b-150.dat upx behavioral2/files/0x0007000000022e1b-152.dat upx behavioral2/files/0x0007000000022e1b-154.dat upx behavioral2/files/0x0007000000022e1b-156.dat upx behavioral2/files/0x0007000000022e1b-158.dat upx behavioral2/files/0x0007000000022e1b-160.dat upx behavioral2/files/0x0007000000022e1b-162.dat upx behavioral2/files/0x0007000000022e1b-164.dat upx behavioral2/files/0x0007000000022e1b-166.dat upx behavioral2/files/0x0007000000022e1b-168.dat upx behavioral2/files/0x0007000000022e1b-170.dat upx behavioral2/files/0x0007000000022e1b-172.dat upx behavioral2/files/0x0007000000022e1b-174.dat upx behavioral2/files/0x0007000000022e1b-176.dat upx behavioral2/files/0x0007000000022e1b-178.dat upx behavioral2/memory/2040-179-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/files/0x0007000000022e1b-182.dat upx behavioral2/files/0x0007000000022e1b-188.dat upx behavioral2/memory/2192-186-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/files/0x0007000000022e1b-185.dat upx behavioral2/memory/3008-183-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/1656-181-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4924-191-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/files/0x0007000000022e1b-192.dat upx behavioral2/memory/4836-195-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4292-199-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4960-201-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/2532-203-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/1128-207-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/files/0x0007000000022e1b-204.dat upx behavioral2/memory/3664-206-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/files/0x0007000000022e1b-200.dat upx behavioral2/memory/4804-197-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/files/0x0007000000022e1b-196.dat upx behavioral2/memory/4880-193-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4944-189-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/files/0x0007000000022e1b-210.dat upx behavioral2/files/0x0007000000022e1b-208.dat upx behavioral2/files/0x0007000000022e1b-213.dat upx behavioral2/memory/5004-216-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/1480-214-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/3316-211-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/744-220-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/files/0x0007000000022e1b-221.dat upx behavioral2/files/0x0007000000022e1b-217.dat upx behavioral2/memory/860-219-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/3924-224-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/files/0x0007000000022e1b-228.dat upx behavioral2/files/0x0007000000022e1b-226.dat upx behavioral2/memory/212-225-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/432-222-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/files/0x0007000000022e1b-230.dat upx behavioral2/files/0x0007000000022e1b-232.dat upx behavioral2/files/0x0007000000022e1b-234.dat upx -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: hAsnlxU.exe File opened (read-only) \??\k: hAsnlxU.exe File opened (read-only) \??\k: hAsnlxU.exe File opened (read-only) \??\p: hAsnlxU.exe File opened (read-only) \??\t: hAsnlxU.exe File opened (read-only) \??\o: hAsnlxU.exe File opened (read-only) \??\o: hAsnlxU.exe File opened (read-only) \??\z: hAsnlxU.exe File opened (read-only) \??\v: hAsnlxU.exe File opened (read-only) \??\p: hAsnlxU.exe File opened (read-only) \??\f: hAsnlxU.exe File opened (read-only) \??\x: hAsnlxU.exe File opened (read-only) \??\o: hAsnlxU.exe File opened (read-only) \??\x: hAsnlxU.exe File opened (read-only) \??\n: hAsnlxU.exe File opened (read-only) \??\z: hAsnlxU.exe File opened (read-only) \??\z: hAsnlxU.exe File opened (read-only) \??\l: hAsnlxU.exe File opened (read-only) \??\h: hAsnlxU.exe File opened (read-only) \??\z: hAsnlxU.exe File opened (read-only) \??\k: hAsnlxU.exe File opened (read-only) \??\r: hAsnlxU.exe File opened (read-only) \??\h: hAsnlxU.exe File opened (read-only) \??\t: hAsnlxU.exe File opened (read-only) \??\i: hAsnlxU.exe File opened (read-only) \??\t: hAsnlxU.exe File opened (read-only) \??\u: hAsnlxU.exe File opened (read-only) \??\w: hAsnlxU.exe File opened (read-only) \??\m: hAsnlxU.exe File opened (read-only) \??\m: hAsnlxU.exe File opened (read-only) \??\i: hAsnlxU.exe File opened (read-only) \??\h: hAsnlxU.exe File opened (read-only) \??\j: hAsnlxU.exe File opened (read-only) \??\r: hAsnlxU.exe File opened (read-only) \??\l: hAsnlxU.exe File opened (read-only) \??\v: hAsnlxU.exe File opened (read-only) \??\m: hAsnlxU.exe File opened (read-only) \??\h: hAsnlxU.exe File opened (read-only) \??\v: hAsnlxU.exe File opened (read-only) \??\m: hAsnlxU.exe File opened (read-only) \??\e: hAsnlxU.exe File opened (read-only) \??\p: hAsnlxU.exe File opened (read-only) \??\p: hAsnlxU.exe File opened (read-only) \??\s: hAsnlxU.exe File opened (read-only) \??\n: hAsnlxU.exe File opened (read-only) \??\g: hAsnlxU.exe File opened (read-only) \??\g: hAsnlxU.exe File opened (read-only) \??\k: hAsnlxU.exe File opened (read-only) \??\s: hAsnlxU.exe File opened (read-only) \??\v: hAsnlxU.exe File opened (read-only) \??\o: hAsnlxU.exe File opened (read-only) \??\t: hAsnlxU.exe File opened (read-only) \??\i: hAsnlxU.exe File opened (read-only) \??\x: hAsnlxU.exe File opened (read-only) \??\g: hAsnlxU.exe File opened (read-only) \??\f: hAsnlxU.exe File opened (read-only) \??\k: hAsnlxU.exe File opened (read-only) \??\h: hAsnlxU.exe File opened (read-only) \??\l: hAsnlxU.exe File opened (read-only) \??\s: hAsnlxU.exe File opened (read-only) \??\r: hAsnlxU.exe File opened (read-only) \??\p: hAsnlxU.exe File opened (read-only) \??\z: hAsnlxU.exe File opened (read-only) \??\k: hAsnlxU.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe File created C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exe hAsnlxU.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 2216 63a8c11d299c321d9b2d820b39502a62768b6dcda28608001c9169b7fc371134.exe Token: SeLoadDriverPrivilege 1020 hAsnlxU.exe Token: SeLoadDriverPrivilege 2040 hAsnlxU.exe Token: SeLoadDriverPrivilege 1656 hAsnlxU.exe Token: SeLoadDriverPrivilege 3008 hAsnlxU.exe Token: SeLoadDriverPrivilege 2192 hAsnlxU.exe Token: SeLoadDriverPrivilege 4944 hAsnlxU.exe Token: SeLoadDriverPrivilege 4924 hAsnlxU.exe Token: SeLoadDriverPrivilege 4880 hAsnlxU.exe Token: SeLoadDriverPrivilege 4836 hAsnlxU.exe Token: SeLoadDriverPrivilege 4804 hAsnlxU.exe Token: SeLoadDriverPrivilege 4292 hAsnlxU.exe Token: SeLoadDriverPrivilege 4960 hAsnlxU.exe Token: SeLoadDriverPrivilege 2532 hAsnlxU.exe Token: SeLoadDriverPrivilege 3664 hAsnlxU.exe Token: SeLoadDriverPrivilege 1128 hAsnlxU.exe Token: SeLoadDriverPrivilege 3316 hAsnlxU.exe Token: SeLoadDriverPrivilege 1480 hAsnlxU.exe Token: SeLoadDriverPrivilege 5004 hAsnlxU.exe Token: SeLoadDriverPrivilege 860 hAsnlxU.exe Token: SeLoadDriverPrivilege 744 hAsnlxU.exe Token: SeLoadDriverPrivilege 432 hAsnlxU.exe Token: SeLoadDriverPrivilege 3924 hAsnlxU.exe Token: SeLoadDriverPrivilege 4280 hAsnlxU.exe Token: SeLoadDriverPrivilege 4664 hAsnlxU.exe Token: SeLoadDriverPrivilege 212 hAsnlxU.exe Token: SeLoadDriverPrivilege 116 hAsnlxU.exe Token: SeLoadDriverPrivilege 2016 hAsnlxU.exe Token: SeLoadDriverPrivilege 3892 hAsnlxU.exe Token: SeLoadDriverPrivilege 3804 hAsnlxU.exe Token: SeLoadDriverPrivilege 3528 hAsnlxU.exe Token: SeLoadDriverPrivilege 3564 hAsnlxU.exe Token: SeLoadDriverPrivilege 3656 hAsnlxU.exe Token: SeLoadDriverPrivilege 3484 hAsnlxU.exe Token: SeLoadDriverPrivilege 2276 hAsnlxU.exe Token: SeLoadDriverPrivilege 1720 hAsnlxU.exe Token: SeLoadDriverPrivilege 4160 hAsnlxU.exe Token: SeLoadDriverPrivilege 3648 hAsnlxU.exe Token: SeLoadDriverPrivilege 4624 hAsnlxU.exe Token: SeLoadDriverPrivilege 3440 hAsnlxU.exe Token: SeLoadDriverPrivilege 4564 hAsnlxU.exe Token: SeLoadDriverPrivilege 1100 hAsnlxU.exe Token: SeLoadDriverPrivilege 3744 hAsnlxU.exe Token: SeLoadDriverPrivilege 1472 hAsnlxU.exe Token: SeLoadDriverPrivilege 3812 hAsnlxU.exe Token: SeLoadDriverPrivilege 4428 hAsnlxU.exe Token: SeLoadDriverPrivilege 4524 hAsnlxU.exe Token: SeLoadDriverPrivilege 4716 hAsnlxU.exe Token: SeLoadDriverPrivilege 3500 hAsnlxU.exe Token: SeLoadDriverPrivilege 2096 hAsnlxU.exe Token: SeLoadDriverPrivilege 4868 hAsnlxU.exe Token: SeLoadDriverPrivilege 4416 hAsnlxU.exe Token: SeLoadDriverPrivilege 5068 hAsnlxU.exe Token: SeLoadDriverPrivilege 4560 hAsnlxU.exe Token: SeLoadDriverPrivilege 4068 hAsnlxU.exe Token: SeLoadDriverPrivilege 912 hAsnlxU.exe Token: SeLoadDriverPrivilege 1880 hAsnlxU.exe Token: SeLoadDriverPrivilege 4156 hAsnlxU.exe Token: SeLoadDriverPrivilege 4132 hAsnlxU.exe Token: SeLoadDriverPrivilege 3752 hAsnlxU.exe Token: SeLoadDriverPrivilege 1344 hAsnlxU.exe Token: SeLoadDriverPrivilege 1944 hAsnlxU.exe Token: SeLoadDriverPrivilege 4468 hAsnlxU.exe Token: SeLoadDriverPrivilege 4984 hAsnlxU.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 1020 2216 63a8c11d299c321d9b2d820b39502a62768b6dcda28608001c9169b7fc371134.exe 79 PID 2216 wrote to memory of 1020 2216 63a8c11d299c321d9b2d820b39502a62768b6dcda28608001c9169b7fc371134.exe 79 PID 2216 wrote to memory of 1020 2216 63a8c11d299c321d9b2d820b39502a62768b6dcda28608001c9169b7fc371134.exe 79 PID 1020 wrote to memory of 2040 1020 hAsnlxU.exe 80 PID 1020 wrote to memory of 2040 1020 hAsnlxU.exe 80 PID 1020 wrote to memory of 2040 1020 hAsnlxU.exe 80 PID 2040 wrote to memory of 1656 2040 hAsnlxU.exe 81 PID 2040 wrote to memory of 1656 2040 hAsnlxU.exe 81 PID 2040 wrote to memory of 1656 2040 hAsnlxU.exe 81 PID 1656 wrote to memory of 3008 1656 hAsnlxU.exe 82 PID 1656 wrote to memory of 3008 1656 hAsnlxU.exe 82 PID 1656 wrote to memory of 3008 1656 hAsnlxU.exe 82 PID 3008 wrote to memory of 2192 3008 hAsnlxU.exe 83 PID 3008 wrote to memory of 2192 3008 hAsnlxU.exe 83 PID 3008 wrote to memory of 2192 3008 hAsnlxU.exe 83 PID 2192 wrote to memory of 4944 2192 hAsnlxU.exe 84 PID 2192 wrote to memory of 4944 2192 hAsnlxU.exe 84 PID 2192 wrote to memory of 4944 2192 hAsnlxU.exe 84 PID 4944 wrote to memory of 4924 4944 hAsnlxU.exe 85 PID 4944 wrote to memory of 4924 4944 hAsnlxU.exe 85 PID 4944 wrote to memory of 4924 4944 hAsnlxU.exe 85 PID 4924 wrote to memory of 4880 4924 hAsnlxU.exe 86 PID 4924 wrote to memory of 4880 4924 hAsnlxU.exe 86 PID 4924 wrote to memory of 4880 4924 hAsnlxU.exe 86 PID 4880 wrote to memory of 4836 4880 hAsnlxU.exe 87 PID 4880 wrote to memory of 4836 4880 hAsnlxU.exe 87 PID 4880 wrote to memory of 4836 4880 hAsnlxU.exe 87 PID 4836 wrote to memory of 4804 4836 hAsnlxU.exe 88 PID 4836 wrote to memory of 4804 4836 hAsnlxU.exe 88 PID 4836 wrote to memory of 4804 4836 hAsnlxU.exe 88 PID 4804 wrote to memory of 4292 4804 hAsnlxU.exe 89 PID 4804 wrote to memory of 4292 4804 hAsnlxU.exe 89 PID 4804 wrote to memory of 4292 4804 hAsnlxU.exe 89 PID 4292 wrote to memory of 4960 4292 hAsnlxU.exe 90 PID 4292 wrote to memory of 4960 4292 hAsnlxU.exe 90 PID 4292 wrote to memory of 4960 4292 hAsnlxU.exe 90 PID 4960 wrote to memory of 2532 4960 hAsnlxU.exe 91 PID 4960 wrote to memory of 2532 4960 hAsnlxU.exe 91 PID 4960 wrote to memory of 2532 4960 hAsnlxU.exe 91 PID 2532 wrote to memory of 3664 2532 hAsnlxU.exe 92 PID 2532 wrote to memory of 3664 2532 hAsnlxU.exe 92 PID 2532 wrote to memory of 3664 2532 hAsnlxU.exe 92 PID 3664 wrote to memory of 1128 3664 hAsnlxU.exe 93 PID 3664 wrote to memory of 1128 3664 hAsnlxU.exe 93 PID 3664 wrote to memory of 1128 3664 hAsnlxU.exe 93 PID 1128 wrote to memory of 3316 1128 hAsnlxU.exe 94 PID 1128 wrote to memory of 3316 1128 hAsnlxU.exe 94 PID 1128 wrote to memory of 3316 1128 hAsnlxU.exe 94 PID 3316 wrote to memory of 1480 3316 hAsnlxU.exe 95 PID 3316 wrote to memory of 1480 3316 hAsnlxU.exe 95 PID 3316 wrote to memory of 1480 3316 hAsnlxU.exe 95 PID 1480 wrote to memory of 5004 1480 hAsnlxU.exe 96 PID 1480 wrote to memory of 5004 1480 hAsnlxU.exe 96 PID 1480 wrote to memory of 5004 1480 hAsnlxU.exe 96 PID 5004 wrote to memory of 860 5004 hAsnlxU.exe 97 PID 5004 wrote to memory of 860 5004 hAsnlxU.exe 97 PID 5004 wrote to memory of 860 5004 hAsnlxU.exe 97 PID 860 wrote to memory of 744 860 hAsnlxU.exe 98 PID 860 wrote to memory of 744 860 hAsnlxU.exe 98 PID 860 wrote to memory of 744 860 hAsnlxU.exe 98 PID 744 wrote to memory of 432 744 hAsnlxU.exe 99 PID 744 wrote to memory of 432 744 hAsnlxU.exe 99 PID 744 wrote to memory of 432 744 hAsnlxU.exe 99 PID 432 wrote to memory of 3924 432 hAsnlxU.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\63a8c11d299c321d9b2d820b39502a62768b6dcda28608001c9169b7fc371134.exe"C:\Users\Admin\AppData\Local\Temp\63a8c11d299c321d9b2d820b39502a62768b6dcda28608001c9169b7fc371134.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe10⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3924 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4280 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4664
-
-
-
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe21⤵PID:18788
-
-
-
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe17⤵PID:18440
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe16⤵PID:17764
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe15⤵PID:4688
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe14⤵PID:18416
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe13⤵PID:18312
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe12⤵PID:18208
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe11⤵PID:18164
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe10⤵PID:18148
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe11⤵PID:2764
-
-
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe8⤵PID:17976
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe9⤵PID:18044
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe10⤵PID:18180
-
-
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe7⤵PID:17880
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe6⤵PID:17780
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe5⤵PID:17752
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe6⤵PID:17840
-
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe4⤵PID:17720
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe5⤵PID:17788
-
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe3⤵PID:17620
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe2⤵PID:17528
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe3⤵PID:17572
-
-
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:212 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:116 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2016 -
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe4⤵PID:19700
-
-
-
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3892 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3804 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3528
-
-
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3564 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3656 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3484 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2276 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1720 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4160 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3648 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4624 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3440 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4564 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1100 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3744 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe13⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1472 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3812 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4428 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4524 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4716 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3500 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2096 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4868 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4416 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5068 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4560 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4068
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe13⤵PID:21616
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe14⤵PID:22036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1880 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4156 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4132 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3752
-
-
-
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:912
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4468 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe1⤵
- Executes dropped EXE
PID:632 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe2⤵PID:4040
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe3⤵PID:1608
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe4⤵PID:812
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe5⤵
- Enumerates connected drives
PID:3852 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe6⤵PID:1076
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe7⤵PID:4572
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe8⤵PID:4616
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe9⤵PID:4048
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe10⤵PID:3360
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe11⤵
- Drops file in System32 directory
PID:1576 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe12⤵PID:1528
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe13⤵PID:3976
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe14⤵PID:4056
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe15⤵PID:396
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe16⤵PID:5104
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe17⤵PID:804
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe18⤵PID:4460
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe19⤵PID:4488
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe20⤵PID:1116
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe21⤵PID:4916
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe22⤵PID:4504
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe23⤵PID:1904
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe24⤵PID:4008
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe25⤵PID:3472
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe18⤵PID:24648
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe17⤵PID:24628
-
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe15⤵PID:4980
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe14⤵PID:2876
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe13⤵PID:24604
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe12⤵PID:24596
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe11⤵PID:24588
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe10⤵PID:24580
-
-
-
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe6⤵PID:24116
-
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe4⤵PID:23948
-
-
-
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe1⤵PID:608
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe2⤵PID:3380
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe3⤵
- Drops file in System32 directory
PID:204
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe3⤵PID:25712
-
-
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe1⤵PID:344
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe2⤵PID:3672
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe3⤵PID:3568
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe4⤵PID:3184
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe5⤵PID:3740
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe6⤵PID:4752
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe7⤵
- Enumerates connected drives
PID:1784 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe8⤵PID:1884
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe9⤵PID:4364
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe10⤵PID:2384
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe11⤵PID:4976
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe12⤵PID:2668
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe13⤵
- Enumerates connected drives
PID:428 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe14⤵PID:1596
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe15⤵PID:2260
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe16⤵PID:1508
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe17⤵
- Drops file in System32 directory
PID:4184 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe18⤵PID:1476
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe19⤵PID:1556
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe20⤵PID:2440
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe21⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2196 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe22⤵PID:3908
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe23⤵
- Drops file in System32 directory
PID:2688 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe24⤵PID:2280
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe25⤵PID:112
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe26⤵PID:2300
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe27⤵PID:3260
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe28⤵
- Enumerates connected drives
PID:3252 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe29⤵PID:4820
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe30⤵PID:1536
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe31⤵PID:3400
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe32⤵PID:692
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe33⤵PID:5136
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe34⤵PID:5152
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe35⤵PID:5168
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe36⤵PID:5184
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe37⤵PID:5204
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe38⤵PID:5220
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe39⤵PID:5240
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe40⤵PID:5260
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe41⤵PID:5280
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe42⤵
- Drops file in System32 directory
PID:5304 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe43⤵PID:5320
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe44⤵
- Enumerates connected drives
PID:5340 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe45⤵PID:5360
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe46⤵
- Drops file in System32 directory
PID:5380 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe47⤵
- Drops file in System32 directory
PID:5404 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe48⤵PID:5424
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe49⤵PID:5444
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe50⤵PID:5464
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe51⤵PID:5488
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe52⤵PID:5508
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe53⤵PID:5528
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe54⤵PID:5552
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe55⤵PID:5568
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe56⤵
- Drops file in System32 directory
PID:5596 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe57⤵PID:5612
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe58⤵PID:5636
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe59⤵
- Enumerates connected drives
PID:5652 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe60⤵PID:5676
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe61⤵PID:5692
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe62⤵PID:5716
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe63⤵
- Drops file in System32 directory
PID:5732 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe64⤵PID:5752
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe65⤵
- Drops file in System32 directory
PID:5772 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe66⤵PID:5796
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe67⤵PID:5816
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe68⤵PID:5836
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe69⤵
- Drops file in System32 directory
PID:5856 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe70⤵PID:5876
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe71⤵PID:5896
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe72⤵PID:5916
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe73⤵PID:5940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe32⤵PID:27876
-
-
-
-
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe27⤵PID:26708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\hAsnlxU\UYDK0GV.exeC:\Windows\system32\hAsnlxU\UYDK0GV.exe13⤵PID:26136
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe1⤵PID:5956
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe2⤵PID:5984
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe3⤵PID:6000
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe4⤵PID:6028
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe5⤵PID:6044
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe6⤵PID:6064
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe7⤵PID:6084
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe8⤵PID:6104
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe9⤵PID:6120
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe10⤵PID:6136
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe11⤵PID:5232
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe12⤵PID:5332
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe13⤵
- Drops file in System32 directory
PID:5400 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe14⤵PID:5484
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe15⤵PID:5560
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe16⤵
- Drops file in System32 directory
PID:5624 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe17⤵PID:5724
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe18⤵PID:5784
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe19⤵PID:5848
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe20⤵
- Enumerates connected drives
PID:5928 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe21⤵PID:6024
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe22⤵
- Enumerates connected drives
PID:6076 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe23⤵PID:6160
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe24⤵
- Drops file in System32 directory
PID:6172 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe25⤵PID:6192
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe26⤵PID:6204
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe27⤵PID:6224
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe28⤵
- Drops file in System32 directory
PID:6240 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe29⤵PID:6252
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe30⤵
- Enumerates connected drives
PID:6268 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe31⤵PID:6288
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe32⤵
- Enumerates connected drives
PID:6308 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe33⤵PID:6328
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe34⤵PID:6344
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe35⤵PID:6360
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe36⤵PID:6376
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe37⤵PID:6396
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe38⤵PID:6412
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe39⤵
- Enumerates connected drives
PID:6436 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe40⤵PID:6452
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe41⤵PID:6476
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe42⤵PID:6492
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe43⤵
- Drops file in System32 directory
PID:6512 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe44⤵PID:6532
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe45⤵PID:6552
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe46⤵PID:6572
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe47⤵PID:6596
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe48⤵PID:6616
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe49⤵PID:6640
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe50⤵PID:6660
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe51⤵PID:6680
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe52⤵
- Enumerates connected drives
PID:6700 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe53⤵PID:6720
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe54⤵PID:6740
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe55⤵PID:6760
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe56⤵
- Enumerates connected drives
PID:6780 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe57⤵
- Enumerates connected drives
PID:6800 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe58⤵PID:6824
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe59⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:6844 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe60⤵PID:6864
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe61⤵PID:6884
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe62⤵PID:6908
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe63⤵PID:6928
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe64⤵PID:6948
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe65⤵PID:6968
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe66⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:6992 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe67⤵
- Enumerates connected drives
PID:7012 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe68⤵PID:7032
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe69⤵
- Drops file in System32 directory
PID:7064 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe70⤵PID:7080
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe71⤵PID:7100
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe72⤵
- Enumerates connected drives
PID:7124 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe73⤵PID:7144
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe74⤵PID:6392
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe75⤵PID:6504
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe76⤵PID:6592
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe77⤵PID:6692
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe78⤵PID:6792
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe79⤵
- Enumerates connected drives
PID:6896 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe80⤵PID:6980
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe81⤵PID:7072
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe82⤵PID:7160
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe83⤵
- Enumerates connected drives
PID:6636 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe84⤵PID:7028
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe85⤵PID:7176
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe86⤵PID:7196
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe87⤵
- Enumerates connected drives
PID:7216 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe88⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:7240 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe89⤵PID:7260
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe90⤵PID:7284
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe91⤵PID:7300
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe92⤵PID:7320
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe93⤵
- Drops file in System32 directory
PID:7340 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe94⤵PID:7360
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe95⤵PID:7384
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe96⤵PID:7400
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe97⤵PID:7424
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe98⤵
- Drops file in System32 directory
PID:7440 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe99⤵PID:7460
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe100⤵PID:7480
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe101⤵PID:7496
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe102⤵PID:7512
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe103⤵PID:7528
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe104⤵PID:7544
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe105⤵PID:7560
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe106⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:7576 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe107⤵PID:7596
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe108⤵PID:7612
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe109⤵PID:7628
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe110⤵PID:7644
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe111⤵
- Drops file in System32 directory
PID:7660 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe112⤵PID:7676
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe113⤵PID:7692
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe114⤵PID:7708
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe115⤵PID:7724
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe116⤵PID:7744
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe117⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:7764 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe118⤵PID:7784
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe119⤵PID:7808
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe120⤵
- Drops file in System32 directory
PID:7824 -
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe121⤵PID:7844
-
C:\Windows\SysWOW64\UYDK0GV\hAsnlxU.exeC:\Windows\system32\UYDK0GV\hAsnlxU.exe122⤵
- Drops file in System32 directory
PID:7864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-