Analysis
-
max time kernel
24s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 18:53
Behavioral task
behavioral1
Sample
91121b15062f7e779dcc27564f72f1f1533289a47a10c0865b8d4e200fd3dc0f.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
91121b15062f7e779dcc27564f72f1f1533289a47a10c0865b8d4e200fd3dc0f.exe
Resource
win10v2004-20221111-en
General
-
Target
91121b15062f7e779dcc27564f72f1f1533289a47a10c0865b8d4e200fd3dc0f.exe
-
Size
112KB
-
MD5
469cbae6efa2166a09e8bf7e809a38f1
-
SHA1
8f64aacaf40872c43613cf600b00dcea32178ac1
-
SHA256
91121b15062f7e779dcc27564f72f1f1533289a47a10c0865b8d4e200fd3dc0f
-
SHA512
1687d37e13d9f85039278c90894b28288dc0400bb0d0372a4e786bf13fdf79a76b4de6f4bcd4f8b0905e44b949903fb14fc3d931f47a602c4da65f0252dfe6b3
-
SSDEEP
1536:ybBF9AiROgsyJvu1/RnsJExToz19gfBGD2t0raL5pDkJuPYrQ0gW:wB87yutsTR+fBm2t0KDCxrCW
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
XBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exepid process 1204 XBhRcqb.exe 556 XBhRcqb.exe 1408 XBhRcqb.exe 1280 XBhRcqb.exe 1036 XBhRcqb.exe 868 XBhRcqb.exe 980 XBhRcqb.exe 1552 XBhRcqb.exe 664 XBhRcqb.exe 960 XBhRcqb.exe 1976 XBhRcqb.exe 968 XBhRcqb.exe 1696 XBhRcqb.exe 1276 XBhRcqb.exe 1004 XBhRcqb.exe 1632 XBhRcqb.exe 1992 XBhRcqb.exe 836 XBhRcqb.exe 840 XBhRcqb.exe 1356 XBhRcqb.exe 1964 XBhRcqb.exe 1580 XBhRcqb.exe 1684 XBhRcqb.exe 1528 XBhRcqb.exe 904 XBhRcqb.exe 1660 XBhRcqb.exe 1912 XBhRcqb.exe 1520 XBhRcqb.exe 1776 XBhRcqb.exe 1680 XBhRcqb.exe 1100 XBhRcqb.exe 988 XBhRcqb.exe 1548 XBhRcqb.exe 1692 XBhRcqb.exe 1764 XBhRcqb.exe 1524 XBhRcqb.exe 2032 XBhRcqb.exe 640 XBhRcqb.exe 1556 XBhRcqb.exe 1608 XBhRcqb.exe 1656 XBhRcqb.exe 1948 XBhRcqb.exe 2040 XBhRcqb.exe 1916 XBhRcqb.exe 1792 XBhRcqb.exe 1124 XBhRcqb.exe 1500 XBhRcqb.exe 520 XBhRcqb.exe 1808 XBhRcqb.exe 2028 XBhRcqb.exe 824 XBhRcqb.exe 1376 XBhRcqb.exe 1532 XBhRcqb.exe 2052 XBhRcqb.exe 2072 XBhRcqb.exe 2092 XBhRcqb.exe 2112 XBhRcqb.exe 2132 XBhRcqb.exe 2152 XBhRcqb.exe 2172 XBhRcqb.exe 2196 XBhRcqb.exe 2216 XBhRcqb.exe 2244 XBhRcqb.exe 2280 XBhRcqb.exe -
Processes:
resource yara_rule behavioral1/memory/1744-55-0x0000000000400000-0x000000000046D000-memory.dmp upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx behavioral1/memory/1204-69-0x0000000000400000-0x000000000046D000-memory.dmp upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx behavioral1/memory/556-73-0x0000000000400000-0x000000000046D000-memory.dmp upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx \Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe upx -
Loads dropped DLL 64 IoCs
Processes:
91121b15062f7e779dcc27564f72f1f1533289a47a10c0865b8d4e200fd3dc0f.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exepid process 1744 91121b15062f7e779dcc27564f72f1f1533289a47a10c0865b8d4e200fd3dc0f.exe 1744 91121b15062f7e779dcc27564f72f1f1533289a47a10c0865b8d4e200fd3dc0f.exe 1204 XBhRcqb.exe 1204 XBhRcqb.exe 556 XBhRcqb.exe 556 XBhRcqb.exe 1408 XBhRcqb.exe 1408 XBhRcqb.exe 1280 XBhRcqb.exe 1280 XBhRcqb.exe 1036 XBhRcqb.exe 1036 XBhRcqb.exe 868 XBhRcqb.exe 868 XBhRcqb.exe 980 XBhRcqb.exe 980 XBhRcqb.exe 1552 XBhRcqb.exe 1552 XBhRcqb.exe 664 XBhRcqb.exe 664 XBhRcqb.exe 960 XBhRcqb.exe 960 XBhRcqb.exe 1976 XBhRcqb.exe 1976 XBhRcqb.exe 968 XBhRcqb.exe 968 XBhRcqb.exe 1696 XBhRcqb.exe 1696 XBhRcqb.exe 1276 XBhRcqb.exe 1276 XBhRcqb.exe 1004 XBhRcqb.exe 1004 XBhRcqb.exe 1632 XBhRcqb.exe 1632 XBhRcqb.exe 1992 XBhRcqb.exe 1992 XBhRcqb.exe 836 XBhRcqb.exe 836 XBhRcqb.exe 840 XBhRcqb.exe 840 XBhRcqb.exe 1356 XBhRcqb.exe 1356 XBhRcqb.exe 1964 XBhRcqb.exe 1964 XBhRcqb.exe 1580 XBhRcqb.exe 1580 XBhRcqb.exe 1684 XBhRcqb.exe 1684 XBhRcqb.exe 1528 XBhRcqb.exe 1528 XBhRcqb.exe 904 XBhRcqb.exe 904 XBhRcqb.exe 1660 XBhRcqb.exe 1660 XBhRcqb.exe 1912 XBhRcqb.exe 1912 XBhRcqb.exe 1520 XBhRcqb.exe 1520 XBhRcqb.exe 1776 XBhRcqb.exe 1776 XBhRcqb.exe 1680 XBhRcqb.exe 1680 XBhRcqb.exe 1100 XBhRcqb.exe 1100 XBhRcqb.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
XBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exedescription ioc process File opened (read-only) \??\f: XBhRcqb.exe File opened (read-only) \??\x: XBhRcqb.exe File opened (read-only) \??\w: XBhRcqb.exe File opened (read-only) \??\i: XBhRcqb.exe File opened (read-only) \??\j: XBhRcqb.exe File opened (read-only) \??\n: XBhRcqb.exe File opened (read-only) \??\l: XBhRcqb.exe File opened (read-only) \??\j: XBhRcqb.exe File opened (read-only) \??\r: XBhRcqb.exe File opened (read-only) \??\p: XBhRcqb.exe File opened (read-only) \??\z: XBhRcqb.exe File opened (read-only) \??\i: XBhRcqb.exe File opened (read-only) \??\q: XBhRcqb.exe File opened (read-only) \??\t: XBhRcqb.exe File opened (read-only) \??\e: XBhRcqb.exe File opened (read-only) \??\f: XBhRcqb.exe File opened (read-only) \??\q: XBhRcqb.exe File opened (read-only) \??\z: XBhRcqb.exe File opened (read-only) \??\j: XBhRcqb.exe File opened (read-only) \??\u: XBhRcqb.exe File opened (read-only) \??\l: XBhRcqb.exe File opened (read-only) \??\k: XBhRcqb.exe File opened (read-only) \??\x: XBhRcqb.exe File opened (read-only) \??\p: XBhRcqb.exe File opened (read-only) \??\h: XBhRcqb.exe File opened (read-only) \??\q: XBhRcqb.exe File opened (read-only) \??\f: XBhRcqb.exe File opened (read-only) \??\o: XBhRcqb.exe File opened (read-only) \??\v: XBhRcqb.exe File opened (read-only) \??\k: XBhRcqb.exe File opened (read-only) \??\o: XBhRcqb.exe File opened (read-only) \??\x: XBhRcqb.exe File opened (read-only) \??\g: XBhRcqb.exe File opened (read-only) \??\k: XBhRcqb.exe File opened (read-only) \??\x: XBhRcqb.exe File opened (read-only) \??\n: XBhRcqb.exe File opened (read-only) \??\y: XBhRcqb.exe File opened (read-only) \??\s: XBhRcqb.exe File opened (read-only) \??\z: XBhRcqb.exe File opened (read-only) \??\o: XBhRcqb.exe File opened (read-only) \??\t: XBhRcqb.exe File opened (read-only) \??\p: XBhRcqb.exe File opened (read-only) \??\w: XBhRcqb.exe File opened (read-only) \??\h: XBhRcqb.exe File opened (read-only) \??\u: XBhRcqb.exe File opened (read-only) \??\n: XBhRcqb.exe File opened (read-only) \??\f: XBhRcqb.exe File opened (read-only) \??\k: XBhRcqb.exe File opened (read-only) \??\o: XBhRcqb.exe File opened (read-only) \??\o: XBhRcqb.exe File opened (read-only) \??\g: XBhRcqb.exe File opened (read-only) \??\g: XBhRcqb.exe File opened (read-only) \??\y: XBhRcqb.exe File opened (read-only) \??\y: XBhRcqb.exe File opened (read-only) \??\h: XBhRcqb.exe File opened (read-only) \??\y: XBhRcqb.exe File opened (read-only) \??\p: XBhRcqb.exe File opened (read-only) \??\j: XBhRcqb.exe File opened (read-only) \??\y: XBhRcqb.exe File opened (read-only) \??\w: XBhRcqb.exe File opened (read-only) \??\f: XBhRcqb.exe File opened (read-only) \??\i: XBhRcqb.exe File opened (read-only) \??\p: XBhRcqb.exe File opened (read-only) \??\o: XBhRcqb.exe -
Drops file in System32 directory 64 IoCs
Processes:
XBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exedescription ioc process File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe File created C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exe XBhRcqb.exe File created C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exe XBhRcqb.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
91121b15062f7e779dcc27564f72f1f1533289a47a10c0865b8d4e200fd3dc0f.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exedescription pid process Token: SeLoadDriverPrivilege 1744 91121b15062f7e779dcc27564f72f1f1533289a47a10c0865b8d4e200fd3dc0f.exe Token: SeLoadDriverPrivilege 1204 XBhRcqb.exe Token: SeLoadDriverPrivilege 556 XBhRcqb.exe Token: SeLoadDriverPrivilege 1408 XBhRcqb.exe Token: SeLoadDriverPrivilege 1280 XBhRcqb.exe Token: SeLoadDriverPrivilege 1036 XBhRcqb.exe Token: SeLoadDriverPrivilege 868 XBhRcqb.exe Token: SeLoadDriverPrivilege 980 XBhRcqb.exe Token: SeLoadDriverPrivilege 1552 XBhRcqb.exe Token: SeLoadDriverPrivilege 664 XBhRcqb.exe Token: SeLoadDriverPrivilege 960 XBhRcqb.exe Token: SeLoadDriverPrivilege 1976 XBhRcqb.exe Token: SeLoadDriverPrivilege 968 XBhRcqb.exe Token: SeLoadDriverPrivilege 1696 XBhRcqb.exe Token: SeLoadDriverPrivilege 1276 XBhRcqb.exe Token: SeLoadDriverPrivilege 1004 XBhRcqb.exe Token: SeLoadDriverPrivilege 1632 XBhRcqb.exe Token: SeLoadDriverPrivilege 1992 XBhRcqb.exe Token: SeLoadDriverPrivilege 836 XBhRcqb.exe Token: SeLoadDriverPrivilege 840 XBhRcqb.exe Token: SeLoadDriverPrivilege 1356 XBhRcqb.exe Token: SeLoadDriverPrivilege 1964 XBhRcqb.exe Token: SeLoadDriverPrivilege 1580 XBhRcqb.exe Token: SeLoadDriverPrivilege 1684 XBhRcqb.exe Token: SeLoadDriverPrivilege 1528 XBhRcqb.exe Token: SeLoadDriverPrivilege 904 XBhRcqb.exe Token: SeLoadDriverPrivilege 1660 XBhRcqb.exe Token: SeLoadDriverPrivilege 1912 XBhRcqb.exe Token: SeLoadDriverPrivilege 1520 XBhRcqb.exe Token: SeLoadDriverPrivilege 1776 XBhRcqb.exe Token: SeLoadDriverPrivilege 1680 XBhRcqb.exe Token: SeLoadDriverPrivilege 1100 XBhRcqb.exe Token: SeLoadDriverPrivilege 1548 XBhRcqb.exe Token: SeLoadDriverPrivilege 1692 XBhRcqb.exe Token: SeLoadDriverPrivilege 1764 XBhRcqb.exe Token: SeLoadDriverPrivilege 1524 XBhRcqb.exe Token: SeLoadDriverPrivilege 2032 XBhRcqb.exe Token: SeLoadDriverPrivilege 640 XBhRcqb.exe Token: SeLoadDriverPrivilege 1556 XBhRcqb.exe Token: SeLoadDriverPrivilege 1608 XBhRcqb.exe Token: SeLoadDriverPrivilege 1656 XBhRcqb.exe Token: SeLoadDriverPrivilege 1948 XBhRcqb.exe Token: SeLoadDriverPrivilege 2040 XBhRcqb.exe Token: SeLoadDriverPrivilege 1916 XBhRcqb.exe Token: SeLoadDriverPrivilege 1792 XBhRcqb.exe Token: SeLoadDriverPrivilege 1124 XBhRcqb.exe Token: SeLoadDriverPrivilege 1500 XBhRcqb.exe Token: SeLoadDriverPrivilege 520 XBhRcqb.exe Token: SeLoadDriverPrivilege 1808 XBhRcqb.exe Token: SeLoadDriverPrivilege 2028 XBhRcqb.exe Token: SeLoadDriverPrivilege 824 XBhRcqb.exe Token: SeLoadDriverPrivilege 1376 XBhRcqb.exe Token: SeLoadDriverPrivilege 1532 XBhRcqb.exe Token: SeLoadDriverPrivilege 2052 XBhRcqb.exe Token: SeLoadDriverPrivilege 2072 XBhRcqb.exe Token: SeLoadDriverPrivilege 2092 XBhRcqb.exe Token: SeLoadDriverPrivilege 2112 XBhRcqb.exe Token: SeLoadDriverPrivilege 2132 XBhRcqb.exe Token: SeLoadDriverPrivilege 2152 XBhRcqb.exe Token: SeLoadDriverPrivilege 2172 XBhRcqb.exe Token: SeLoadDriverPrivilege 2196 XBhRcqb.exe Token: SeLoadDriverPrivilege 2216 XBhRcqb.exe Token: SeLoadDriverPrivilege 2244 XBhRcqb.exe Token: SeLoadDriverPrivilege 2280 XBhRcqb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
91121b15062f7e779dcc27564f72f1f1533289a47a10c0865b8d4e200fd3dc0f.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exeXBhRcqb.exedescription pid process target process PID 1744 wrote to memory of 1204 1744 91121b15062f7e779dcc27564f72f1f1533289a47a10c0865b8d4e200fd3dc0f.exe XBhRcqb.exe PID 1744 wrote to memory of 1204 1744 91121b15062f7e779dcc27564f72f1f1533289a47a10c0865b8d4e200fd3dc0f.exe XBhRcqb.exe PID 1744 wrote to memory of 1204 1744 91121b15062f7e779dcc27564f72f1f1533289a47a10c0865b8d4e200fd3dc0f.exe XBhRcqb.exe PID 1744 wrote to memory of 1204 1744 91121b15062f7e779dcc27564f72f1f1533289a47a10c0865b8d4e200fd3dc0f.exe XBhRcqb.exe PID 1204 wrote to memory of 556 1204 XBhRcqb.exe XBhRcqb.exe PID 1204 wrote to memory of 556 1204 XBhRcqb.exe XBhRcqb.exe PID 1204 wrote to memory of 556 1204 XBhRcqb.exe XBhRcqb.exe PID 1204 wrote to memory of 556 1204 XBhRcqb.exe XBhRcqb.exe PID 556 wrote to memory of 1408 556 XBhRcqb.exe XBhRcqb.exe PID 556 wrote to memory of 1408 556 XBhRcqb.exe XBhRcqb.exe PID 556 wrote to memory of 1408 556 XBhRcqb.exe XBhRcqb.exe PID 556 wrote to memory of 1408 556 XBhRcqb.exe XBhRcqb.exe PID 1408 wrote to memory of 1280 1408 XBhRcqb.exe XBhRcqb.exe PID 1408 wrote to memory of 1280 1408 XBhRcqb.exe XBhRcqb.exe PID 1408 wrote to memory of 1280 1408 XBhRcqb.exe XBhRcqb.exe PID 1408 wrote to memory of 1280 1408 XBhRcqb.exe XBhRcqb.exe PID 1280 wrote to memory of 1036 1280 XBhRcqb.exe XBhRcqb.exe PID 1280 wrote to memory of 1036 1280 XBhRcqb.exe XBhRcqb.exe PID 1280 wrote to memory of 1036 1280 XBhRcqb.exe XBhRcqb.exe PID 1280 wrote to memory of 1036 1280 XBhRcqb.exe XBhRcqb.exe PID 1036 wrote to memory of 868 1036 XBhRcqb.exe XBhRcqb.exe PID 1036 wrote to memory of 868 1036 XBhRcqb.exe XBhRcqb.exe PID 1036 wrote to memory of 868 1036 XBhRcqb.exe XBhRcqb.exe PID 1036 wrote to memory of 868 1036 XBhRcqb.exe XBhRcqb.exe PID 868 wrote to memory of 980 868 XBhRcqb.exe XBhRcqb.exe PID 868 wrote to memory of 980 868 XBhRcqb.exe XBhRcqb.exe PID 868 wrote to memory of 980 868 XBhRcqb.exe XBhRcqb.exe PID 868 wrote to memory of 980 868 XBhRcqb.exe XBhRcqb.exe PID 980 wrote to memory of 1552 980 XBhRcqb.exe XBhRcqb.exe PID 980 wrote to memory of 1552 980 XBhRcqb.exe XBhRcqb.exe PID 980 wrote to memory of 1552 980 XBhRcqb.exe XBhRcqb.exe PID 980 wrote to memory of 1552 980 XBhRcqb.exe XBhRcqb.exe PID 1552 wrote to memory of 664 1552 XBhRcqb.exe XBhRcqb.exe PID 1552 wrote to memory of 664 1552 XBhRcqb.exe XBhRcqb.exe PID 1552 wrote to memory of 664 1552 XBhRcqb.exe XBhRcqb.exe PID 1552 wrote to memory of 664 1552 XBhRcqb.exe XBhRcqb.exe PID 664 wrote to memory of 960 664 XBhRcqb.exe XBhRcqb.exe PID 664 wrote to memory of 960 664 XBhRcqb.exe XBhRcqb.exe PID 664 wrote to memory of 960 664 XBhRcqb.exe XBhRcqb.exe PID 664 wrote to memory of 960 664 XBhRcqb.exe XBhRcqb.exe PID 960 wrote to memory of 1976 960 XBhRcqb.exe XBhRcqb.exe PID 960 wrote to memory of 1976 960 XBhRcqb.exe XBhRcqb.exe PID 960 wrote to memory of 1976 960 XBhRcqb.exe XBhRcqb.exe PID 960 wrote to memory of 1976 960 XBhRcqb.exe XBhRcqb.exe PID 1976 wrote to memory of 968 1976 XBhRcqb.exe XBhRcqb.exe PID 1976 wrote to memory of 968 1976 XBhRcqb.exe XBhRcqb.exe PID 1976 wrote to memory of 968 1976 XBhRcqb.exe XBhRcqb.exe PID 1976 wrote to memory of 968 1976 XBhRcqb.exe XBhRcqb.exe PID 968 wrote to memory of 1696 968 XBhRcqb.exe XBhRcqb.exe PID 968 wrote to memory of 1696 968 XBhRcqb.exe XBhRcqb.exe PID 968 wrote to memory of 1696 968 XBhRcqb.exe XBhRcqb.exe PID 968 wrote to memory of 1696 968 XBhRcqb.exe XBhRcqb.exe PID 1696 wrote to memory of 1276 1696 XBhRcqb.exe XBhRcqb.exe PID 1696 wrote to memory of 1276 1696 XBhRcqb.exe XBhRcqb.exe PID 1696 wrote to memory of 1276 1696 XBhRcqb.exe XBhRcqb.exe PID 1696 wrote to memory of 1276 1696 XBhRcqb.exe XBhRcqb.exe PID 1276 wrote to memory of 1004 1276 XBhRcqb.exe XBhRcqb.exe PID 1276 wrote to memory of 1004 1276 XBhRcqb.exe XBhRcqb.exe PID 1276 wrote to memory of 1004 1276 XBhRcqb.exe XBhRcqb.exe PID 1276 wrote to memory of 1004 1276 XBhRcqb.exe XBhRcqb.exe PID 1004 wrote to memory of 1632 1004 XBhRcqb.exe XBhRcqb.exe PID 1004 wrote to memory of 1632 1004 XBhRcqb.exe XBhRcqb.exe PID 1004 wrote to memory of 1632 1004 XBhRcqb.exe XBhRcqb.exe PID 1004 wrote to memory of 1632 1004 XBhRcqb.exe XBhRcqb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91121b15062f7e779dcc27564f72f1f1533289a47a10c0865b8d4e200fd3dc0f.exe"C:\Users\Admin\AppData\Local\Temp\91121b15062f7e779dcc27564f72f1f1533289a47a10c0865b8d4e200fd3dc0f.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1632 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1992 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:836 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:840 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1356 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1964 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1580 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1684 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1528 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:904 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1660 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1912 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1520 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1776 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1680 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1100 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe33⤵
- Executes dropped EXE
PID:988 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1548 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1692 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe36⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1764 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1524 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2032 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:640 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1556 -
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe41⤵PID:9704
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe40⤵PID:10300
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe39⤵PID:12304
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe38⤵PID:10660
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe37⤵PID:9684
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe36⤵PID:8480
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe35⤵PID:9268
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe34⤵PID:9432
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe33⤵PID:8908
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe32⤵PID:8440
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe31⤵PID:8720
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe30⤵PID:9220
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe29⤵PID:9024
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe28⤵PID:9052
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe27⤵PID:7188
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe26⤵PID:8088
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe25⤵PID:8004
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe24⤵PID:8068
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe23⤵PID:7808
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe24⤵PID:11104
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe25⤵PID:14508
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe26⤵PID:8644
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe22⤵PID:7800
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe23⤵PID:11712
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe24⤵PID:14600
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe21⤵PID:7752
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe22⤵PID:9448
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe23⤵PID:13828
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe24⤵PID:8408
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe20⤵PID:7760
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe21⤵PID:8280
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe22⤵PID:1868
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe23⤵PID:624
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe19⤵PID:7736
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe20⤵PID:8632
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe21⤵PID:7336
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe22⤵PID:8224
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe18⤵PID:7724
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe17⤵PID:7464
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe18⤵PID:8028
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe19⤵PID:14304
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe20⤵PID:8016
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe16⤵PID:7664
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe17⤵PID:8384
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe18⤵PID:6304
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe19⤵PID:8348
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe15⤵PID:7680
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe16⤵PID:8792
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe17⤵PID:6544
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe18⤵PID:7352
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe14⤵PID:7652
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe15⤵PID:8508
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe16⤵PID:13620
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe17⤵PID:8168
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe15⤵PID:7556
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe13⤵PID:7636
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe14⤵PID:8560
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe15⤵PID:284
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe16⤵PID:7820
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe12⤵PID:7592
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe13⤵PID:8128
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe14⤵PID:1744
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe15⤵PID:7864
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe13⤵PID:8232
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe11⤵PID:7576
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe12⤵PID:7992
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe13⤵PID:7052
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe14⤵PID:7984
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe12⤵PID:8012
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe10⤵PID:7540
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe11⤵PID:8080
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe12⤵PID:6888
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe13⤵PID:8040
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe9⤵PID:7520
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe10⤵PID:8112
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe11⤵PID:14280
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe12⤵PID:7988
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe8⤵PID:7456
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe9⤵PID:7904
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe10⤵PID:6932
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe11⤵PID:8060
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe7⤵PID:7356
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe8⤵PID:7844
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe9⤵PID:7024
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe10⤵PID:7956
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe6⤵PID:7400
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe7⤵PID:7892
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe8⤵PID:14248
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe9⤵PID:7452
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe5⤵PID:7300
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe6⤵PID:7428
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe7⤵PID:10016
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe8⤵PID:1976
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe9⤵PID:8208
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe4⤵PID:6688
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe5⤵PID:7308
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe6⤵PID:7380
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe7⤵PID:10144
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe8⤵PID:14484
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe3⤵PID:6752
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe4⤵PID:6240
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe5⤵PID:14708
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe4⤵PID:15100
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe2⤵PID:6448
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe3⤵PID:6576
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe4⤵PID:6844
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe5⤵PID:7176
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe6⤵PID:7284
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe7⤵PID:7388
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe8⤵PID:9932
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe9⤵PID:14356
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe10⤵PID:8336
-
C:\Windows\SysWOW64\XBhRcqb\NWVoCJP.exeC:\Windows\system32\XBhRcqb\NWVoCJP.exe4⤵PID:14900
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1608 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1656 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1948 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2040 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1916 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1792 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1124 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1500 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe9⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:520 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1808 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2028 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:824 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1376 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1532 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2052 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2072 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe17⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2092 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2112 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2132 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2152 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2196 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2216 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2244 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2280 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe26⤵PID:2312
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe27⤵PID:2348
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe28⤵
- Enumerates connected drives
PID:2376 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe29⤵
- Drops file in System32 directory
PID:2404 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe30⤵PID:2432
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe31⤵
- Enumerates connected drives
PID:2468 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe32⤵PID:2492
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe33⤵PID:2516
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe34⤵
- Drops file in System32 directory
PID:2544 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe35⤵PID:2572
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe36⤵PID:2600
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe37⤵
- Drops file in System32 directory
PID:2628 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe38⤵PID:2652
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe39⤵
- Enumerates connected drives
PID:2676 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe40⤵PID:2700
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe41⤵PID:2728
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe42⤵
- Drops file in System32 directory
PID:2752 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe43⤵PID:2776
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe44⤵
- Drops file in System32 directory
PID:2804 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe45⤵PID:2828
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe46⤵PID:2856
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe47⤵
- Enumerates connected drives
PID:2888 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe48⤵
- Enumerates connected drives
PID:2916 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe49⤵PID:2940
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe50⤵PID:2968
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe51⤵
- Enumerates connected drives
PID:2992 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe52⤵
- Drops file in System32 directory
PID:3020 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe53⤵
- Enumerates connected drives
PID:3044 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe54⤵PID:1908
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe55⤵PID:2124
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe56⤵PID:2188
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe57⤵
- Enumerates connected drives
PID:2236 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe58⤵PID:2276
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe59⤵PID:2320
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe60⤵PID:2360
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe61⤵PID:2420
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe62⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2456 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe63⤵
- Drops file in System32 directory
PID:2524 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe64⤵PID:2556
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe65⤵
- Enumerates connected drives
PID:2608 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe66⤵
- Drops file in System32 directory
PID:2648 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe67⤵
- Enumerates connected drives
PID:2708 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe68⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2748 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe69⤵PID:2792
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe70⤵
- Enumerates connected drives
PID:2844 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe71⤵PID:2876
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe72⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2928 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe73⤵PID:2964
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe74⤵
- Enumerates connected drives
PID:3012 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe75⤵PID:3068
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe76⤵PID:2164
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe77⤵PID:2260
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe78⤵PID:2328
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe79⤵PID:2400
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe80⤵PID:2428
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe81⤵PID:2580
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe82⤵PID:2668
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe83⤵PID:2764
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe84⤵PID:2852
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe85⤵
- Enumerates connected drives
PID:2956 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe86⤵PID:3036
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe87⤵
- Drops file in System32 directory
PID:2228 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe88⤵
- Drops file in System32 directory
PID:2356 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe89⤵
- Enumerates connected drives
PID:2440 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe90⤵
- Drops file in System32 directory
PID:660 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe91⤵PID:2588
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe92⤵
- Drops file in System32 directory
PID:2688 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe93⤵PID:2812
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe94⤵
- Enumerates connected drives
PID:2900 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe95⤵PID:3000
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe96⤵PID:2084
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe97⤵
- Enumerates connected drives
PID:2464 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe98⤵PID:2872
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe99⤵PID:2624
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe100⤵PID:3084
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe101⤵PID:3100
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe102⤵PID:3116
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe103⤵PID:3132
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe104⤵
- Enumerates connected drives
PID:3148 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe105⤵PID:3164
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe106⤵
- Enumerates connected drives
PID:3180 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe107⤵PID:3196
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe108⤵PID:3212
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe109⤵
- Drops file in System32 directory
PID:3228 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe110⤵
- Drops file in System32 directory
PID:3244 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe111⤵PID:3260
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe112⤵PID:3276
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe113⤵PID:3292
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe114⤵
- Enumerates connected drives
PID:3308 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe115⤵PID:3324
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe116⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3340 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe117⤵PID:3356
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe118⤵
- Enumerates connected drives
PID:3372 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe119⤵PID:3388
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe120⤵
- Enumerates connected drives
PID:3404 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe121⤵PID:3420
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe122⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3436 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe123⤵PID:3452
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe124⤵
- Enumerates connected drives
PID:3468 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe125⤵PID:3484
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe126⤵PID:3500
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe127⤵PID:3516
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe128⤵PID:3532
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe129⤵
- Drops file in System32 directory
PID:3548 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe130⤵
- Drops file in System32 directory
PID:3564 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe131⤵
- Enumerates connected drives
PID:3580 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe132⤵
- Enumerates connected drives
PID:3596 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe133⤵
- Drops file in System32 directory
PID:3612 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe134⤵PID:3628
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe135⤵PID:3644
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe136⤵PID:3660
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe137⤵PID:3676
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe138⤵PID:3692
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe139⤵
- Drops file in System32 directory
PID:3708 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe140⤵PID:3724
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe141⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3740 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe142⤵PID:3756
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe143⤵PID:3772
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe144⤵PID:3788
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe145⤵PID:3804
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe146⤵
- Enumerates connected drives
PID:3820 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe147⤵
- Drops file in System32 directory
PID:3836 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe148⤵PID:3852
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe149⤵
- Drops file in System32 directory
PID:3868 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe150⤵
- Drops file in System32 directory
PID:3884 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe151⤵PID:3900
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe152⤵PID:3916
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe153⤵PID:3932
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe154⤵PID:3948
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe155⤵PID:3964
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe156⤵PID:3980
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe157⤵PID:3996
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe158⤵PID:4012
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe159⤵PID:4028
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe160⤵
- Enumerates connected drives
PID:4044 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe161⤵PID:4060
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe162⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:4076 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe163⤵PID:4092
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe164⤵PID:3124
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe165⤵PID:3188
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe166⤵PID:3252
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe167⤵PID:3316
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe168⤵PID:3380
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe169⤵PID:3444
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe170⤵
- Enumerates connected drives
PID:3508 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe171⤵PID:3572
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe172⤵PID:3636
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe173⤵PID:3700
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe174⤵PID:3764
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe175⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3828 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe176⤵
- Drops file in System32 directory
PID:3892 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe177⤵PID:3956
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe178⤵PID:4020
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe179⤵PID:4084
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe180⤵PID:3284
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe181⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3540 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe182⤵PID:3796
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe183⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:4052 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe184⤵PID:3924
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe185⤵PID:4108
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe186⤵
- Drops file in System32 directory
PID:4124 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe187⤵
- Enumerates connected drives
PID:4140 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe188⤵PID:4156
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe189⤵
- Drops file in System32 directory
PID:4172 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe190⤵
- Enumerates connected drives
PID:4188 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe191⤵
- Drops file in System32 directory
PID:4204 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe192⤵PID:4220
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe193⤵PID:4236
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe194⤵PID:4252
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe195⤵PID:4268
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe196⤵PID:4284
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe197⤵
- Drops file in System32 directory
PID:4300 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe198⤵PID:4316
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe199⤵PID:4332
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe200⤵PID:4348
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe201⤵PID:4364
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe202⤵PID:4380
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe203⤵PID:4396
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe204⤵PID:4412
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe205⤵PID:4428
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe206⤵PID:4444
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe207⤵PID:4460
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe208⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:4476 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe209⤵
- Enumerates connected drives
PID:4492 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe210⤵PID:4508
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe211⤵
- Drops file in System32 directory
PID:4524 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe212⤵PID:4540
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe213⤵PID:4556
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe214⤵
- Drops file in System32 directory
PID:4572 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe215⤵
- Drops file in System32 directory
PID:4588 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe216⤵PID:4604
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe217⤵PID:4620
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe218⤵
- Drops file in System32 directory
PID:4636 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe219⤵PID:4652
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe220⤵
- Enumerates connected drives
PID:4668 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe221⤵PID:4684
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe222⤵
- Enumerates connected drives
PID:4700 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe223⤵
- Enumerates connected drives
PID:4716 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe224⤵
- Drops file in System32 directory
PID:4732 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe225⤵PID:4748
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe226⤵
- Enumerates connected drives
PID:4764 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe227⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:4780 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe228⤵
- Enumerates connected drives
PID:4796 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe229⤵
- Drops file in System32 directory
PID:4812 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe230⤵PID:4828
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe231⤵PID:4844
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe232⤵PID:4860
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe233⤵
- Enumerates connected drives
PID:4876 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe234⤵PID:4892
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe235⤵
- Enumerates connected drives
PID:4908 -
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe236⤵PID:4924
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe237⤵PID:4940
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe238⤵PID:4956
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe239⤵PID:4972
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe240⤵PID:4988
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe241⤵PID:5004
-
C:\Windows\SysWOW64\NWVoCJP\XBhRcqb.exeC:\Windows\system32\NWVoCJP\XBhRcqb.exe242⤵PID:5020