Analysis
-
max time kernel
59s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 16:58
Behavioral task
behavioral1
Sample
c1cc1e47e2526287e602ae79c15d12bbbb834b04c91ff9ea5b4aedc1ce42c63a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c1cc1e47e2526287e602ae79c15d12bbbb834b04c91ff9ea5b4aedc1ce42c63a.exe
Resource
win10v2004-20220812-en
General
-
Target
c1cc1e47e2526287e602ae79c15d12bbbb834b04c91ff9ea5b4aedc1ce42c63a.exe
-
Size
291KB
-
MD5
0db1d0a17a8a433ab1eb508f66e75db0
-
SHA1
4b2069a2c7f3774e071cfbfc2138eee597ba1444
-
SHA256
c1cc1e47e2526287e602ae79c15d12bbbb834b04c91ff9ea5b4aedc1ce42c63a
-
SHA512
c48a3edc4623e75b5cc1a5b24187bb962fc26cb374029f9e80a4c41e2a84e9acdc771301714585edfc716b7cf68fd6f5330be4fec5b7f049dc40950aaad8c490
-
SSDEEP
6144:qdujrySFkPbOasLrGkTvqvxvavKvLvcN4:+4Qsmm4
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2480 Gx2r1do.exe 5112 Gx2r1do.exe 4264 Gx2r1do.exe 4188 Gx2r1do.exe 4720 Gx2r1do.exe 4656 Gx2r1do.exe 4844 Gx2r1do.exe 4548 Gx2r1do.exe 2232 Gx2r1do.exe 3168 Gx2r1do.exe 3100 Gx2r1do.exe 4348 Gx2r1do.exe 4828 Gx2r1do.exe 4644 Gx2r1do.exe 4836 Gx2r1do.exe 4476 Gx2r1do.exe 3824 Gx2r1do.exe 4320 Gx2r1do.exe 1104 Gx2r1do.exe 4912 Gx2r1do.exe 2448 Gx2r1do.exe 4404 Gx2r1do.exe 3768 Gx2r1do.exe 2396 Gx2r1do.exe 508 Gx2r1do.exe 3828 Gx2r1do.exe 3584 Gx2r1do.exe 3324 Gx2r1do.exe 3468 Gx2r1do.exe 2672 Gx2r1do.exe 4088 Gx2r1do.exe 2004 Gx2r1do.exe 4976 Gx2r1do.exe 2012 Gx2r1do.exe 744 Gx2r1do.exe 3360 Gx2r1do.exe 1932 Gx2r1do.exe 2392 Gx2r1do.exe 1468 Gx2r1do.exe 4400 Gx2r1do.exe 1008 Gx2r1do.exe 1460 Gx2r1do.exe 3720 Gx2r1do.exe 3396 Gx2r1do.exe 404 Gx2r1do.exe 3504 Gx2r1do.exe 4520 Gx2r1do.exe 3352 Gx2r1do.exe 1096 Gx2r1do.exe 1556 Gx2r1do.exe 1248 Gx2r1do.exe 3184 Gx2r1do.exe 764 Gx2r1do.exe 1992 Gx2r1do.exe 4084 Gx2r1do.exe 3888 Gx2r1do.exe 1676 Gx2r1do.exe 4864 Gx2r1do.exe 4112 Gx2r1do.exe 3992 Gx2r1do.exe 2580 Gx2r1do.exe 2736 Gx2r1do.exe 396 Gx2r1do.exe 2824 Gx2r1do.exe -
resource yara_rule behavioral2/memory/5012-132-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e0d-134.dat upx behavioral2/files/0x0007000000022e0d-135.dat upx behavioral2/files/0x0007000000022e0d-137.dat upx behavioral2/files/0x0007000000022e0d-139.dat upx behavioral2/files/0x0007000000022e0d-141.dat upx behavioral2/files/0x0007000000022e0d-143.dat upx behavioral2/files/0x0007000000022e0d-145.dat upx behavioral2/files/0x0007000000022e0d-147.dat upx behavioral2/files/0x0007000000022e0d-149.dat upx behavioral2/files/0x0007000000022e0d-151.dat upx behavioral2/files/0x0007000000022e0d-153.dat upx behavioral2/files/0x0007000000022e0d-155.dat upx behavioral2/files/0x0007000000022e0d-157.dat upx behavioral2/files/0x0007000000022e0d-159.dat upx behavioral2/files/0x0007000000022e0d-161.dat upx behavioral2/files/0x0007000000022e0d-163.dat upx behavioral2/memory/5112-164-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e0d-167.dat upx behavioral2/memory/4264-166-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/4188-169-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e0d-171.dat upx behavioral2/files/0x0007000000022e0d-178.dat upx behavioral2/memory/4548-177-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/3168-181-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e0d-182.dat upx behavioral2/files/0x0007000000022e0d-186.dat upx behavioral2/memory/4828-188-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/4836-192-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e0d-190.dat upx behavioral2/memory/4644-189-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/4348-185-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/3100-184-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/2232-179-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e0d-175.dat upx behavioral2/memory/4844-174-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/4656-172-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e0d-193.dat upx behavioral2/memory/4720-170-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e0d-195.dat upx behavioral2/files/0x0007000000022e0d-197.dat upx behavioral2/files/0x0007000000022e0d-199.dat upx behavioral2/files/0x0007000000022e0d-201.dat upx behavioral2/files/0x0007000000022e0d-203.dat upx behavioral2/files/0x0007000000022e0d-205.dat upx behavioral2/files/0x0007000000022e0d-207.dat upx behavioral2/files/0x0007000000022e0d-209.dat upx behavioral2/files/0x0007000000022e0d-211.dat upx behavioral2/files/0x0007000000022e0d-213.dat upx behavioral2/memory/4476-214-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/4320-217-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/3824-216-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e0d-221.dat upx behavioral2/memory/1104-220-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/4912-222-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e0d-218.dat upx behavioral2/memory/2448-225-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e0d-229.dat upx behavioral2/memory/508-231-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/2396-230-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/3768-228-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/4404-227-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0007000000022e0d-224.dat upx behavioral2/memory/3584-234-0x0000000000400000-0x0000000000449000-memory.dmp upx -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\q: Gx2r1do.exe File opened (read-only) \??\m: Gx2r1do.exe File opened (read-only) \??\x: Gx2r1do.exe File opened (read-only) \??\h: Gx2r1do.exe File opened (read-only) \??\r: Gx2r1do.exe File opened (read-only) \??\l: Gx2r1do.exe File opened (read-only) \??\n: Gx2r1do.exe File opened (read-only) \??\v: Gx2r1do.exe File opened (read-only) \??\s: Gx2r1do.exe File opened (read-only) \??\q: Gx2r1do.exe File opened (read-only) \??\m: Gx2r1do.exe File opened (read-only) \??\t: Gx2r1do.exe File opened (read-only) \??\y: Gx2r1do.exe File opened (read-only) \??\v: Gx2r1do.exe File opened (read-only) \??\q: Gx2r1do.exe File opened (read-only) \??\x: Gx2r1do.exe File opened (read-only) \??\q: Gx2r1do.exe File opened (read-only) \??\n: Gx2r1do.exe File opened (read-only) \??\j: Gx2r1do.exe File opened (read-only) \??\r: Gx2r1do.exe File opened (read-only) \??\w: Gx2r1do.exe File opened (read-only) \??\n: Gx2r1do.exe File opened (read-only) \??\r: Gx2r1do.exe File opened (read-only) \??\y: Gx2r1do.exe File opened (read-only) \??\n: Gx2r1do.exe File opened (read-only) \??\m: Gx2r1do.exe File opened (read-only) \??\h: Gx2r1do.exe File opened (read-only) \??\v: Gx2r1do.exe File opened (read-only) \??\k: Gx2r1do.exe File opened (read-only) \??\w: Gx2r1do.exe File opened (read-only) \??\j: Gx2r1do.exe File opened (read-only) \??\z: Gx2r1do.exe File opened (read-only) \??\j: Gx2r1do.exe File opened (read-only) \??\s: Gx2r1do.exe File opened (read-only) \??\o: Gx2r1do.exe File opened (read-only) \??\t: Gx2r1do.exe File opened (read-only) \??\j: Gx2r1do.exe File opened (read-only) \??\u: Gx2r1do.exe File opened (read-only) \??\q: Gx2r1do.exe File opened (read-only) \??\f: Gx2r1do.exe File opened (read-only) \??\j: Gx2r1do.exe File opened (read-only) \??\t: Gx2r1do.exe File opened (read-only) \??\z: Gx2r1do.exe File opened (read-only) \??\g: Gx2r1do.exe File opened (read-only) \??\w: Gx2r1do.exe File opened (read-only) \??\l: Gx2r1do.exe File opened (read-only) \??\e: Gx2r1do.exe File opened (read-only) \??\r: Gx2r1do.exe File opened (read-only) \??\k: Gx2r1do.exe File opened (read-only) \??\k: Gx2r1do.exe File opened (read-only) \??\v: Gx2r1do.exe File opened (read-only) \??\y: Gx2r1do.exe File opened (read-only) \??\n: Gx2r1do.exe File opened (read-only) \??\x: Gx2r1do.exe File opened (read-only) \??\q: Gx2r1do.exe File opened (read-only) \??\l: Gx2r1do.exe File opened (read-only) \??\l: Gx2r1do.exe File opened (read-only) \??\l: Gx2r1do.exe File opened (read-only) \??\m: Gx2r1do.exe File opened (read-only) \??\m: Gx2r1do.exe File opened (read-only) \??\v: Gx2r1do.exe File opened (read-only) \??\p: Gx2r1do.exe File opened (read-only) \??\y: Gx2r1do.exe File opened (read-only) \??\p: Gx2r1do.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe c1cc1e47e2526287e602ae79c15d12bbbb834b04c91ff9ea5b4aedc1ce42c63a.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe File created C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exe Gx2r1do.exe -
Program crash 2 IoCs
pid pid_target Process 30424 30560 Process not Found 27868 30552 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 5012 c1cc1e47e2526287e602ae79c15d12bbbb834b04c91ff9ea5b4aedc1ce42c63a.exe Token: SeLoadDriverPrivilege 2480 Gx2r1do.exe Token: SeLoadDriverPrivilege 5112 Gx2r1do.exe Token: SeLoadDriverPrivilege 4264 Gx2r1do.exe Token: SeLoadDriverPrivilege 4188 Gx2r1do.exe Token: SeLoadDriverPrivilege 4720 Gx2r1do.exe Token: SeLoadDriverPrivilege 4656 Gx2r1do.exe Token: SeLoadDriverPrivilege 4844 Gx2r1do.exe Token: SeLoadDriverPrivilege 4548 Gx2r1do.exe Token: SeLoadDriverPrivilege 2232 Gx2r1do.exe Token: SeLoadDriverPrivilege 3168 Gx2r1do.exe Token: SeLoadDriverPrivilege 3100 Gx2r1do.exe Token: SeLoadDriverPrivilege 4348 Gx2r1do.exe Token: SeLoadDriverPrivilege 4828 Gx2r1do.exe Token: SeLoadDriverPrivilege 4644 Gx2r1do.exe Token: SeLoadDriverPrivilege 4836 Gx2r1do.exe Token: SeLoadDriverPrivilege 4476 Gx2r1do.exe Token: SeLoadDriverPrivilege 3824 Gx2r1do.exe Token: SeLoadDriverPrivilege 4320 Gx2r1do.exe Token: SeLoadDriverPrivilege 1104 Gx2r1do.exe Token: SeLoadDriverPrivilege 4912 Gx2r1do.exe Token: SeLoadDriverPrivilege 2448 Gx2r1do.exe Token: SeLoadDriverPrivilege 4404 Gx2r1do.exe Token: SeLoadDriverPrivilege 3768 Gx2r1do.exe Token: SeLoadDriverPrivilege 2396 Gx2r1do.exe Token: SeLoadDriverPrivilege 508 Gx2r1do.exe Token: SeLoadDriverPrivilege 3828 Gx2r1do.exe Token: SeLoadDriverPrivilege 3584 Gx2r1do.exe Token: SeLoadDriverPrivilege 3324 Gx2r1do.exe Token: SeLoadDriverPrivilege 3468 Gx2r1do.exe Token: SeLoadDriverPrivilege 2672 Gx2r1do.exe Token: SeLoadDriverPrivilege 4088 Gx2r1do.exe Token: SeLoadDriverPrivilege 2004 Gx2r1do.exe Token: SeLoadDriverPrivilege 4976 Gx2r1do.exe Token: SeLoadDriverPrivilege 2012 Gx2r1do.exe Token: SeLoadDriverPrivilege 744 Gx2r1do.exe Token: SeLoadDriverPrivilege 3360 Gx2r1do.exe Token: SeLoadDriverPrivilege 1932 Gx2r1do.exe Token: SeLoadDriverPrivilege 2392 Gx2r1do.exe Token: SeLoadDriverPrivilege 1468 Gx2r1do.exe Token: SeLoadDriverPrivilege 4400 Gx2r1do.exe Token: SeLoadDriverPrivilege 1008 Gx2r1do.exe Token: SeLoadDriverPrivilege 1460 Gx2r1do.exe Token: SeLoadDriverPrivilege 3720 Gx2r1do.exe Token: SeLoadDriverPrivilege 3396 Gx2r1do.exe Token: SeLoadDriverPrivilege 404 Gx2r1do.exe Token: SeLoadDriverPrivilege 3504 Gx2r1do.exe Token: SeLoadDriverPrivilege 4520 Gx2r1do.exe Token: SeLoadDriverPrivilege 3352 Gx2r1do.exe Token: SeLoadDriverPrivilege 1096 Gx2r1do.exe Token: SeLoadDriverPrivilege 1556 Gx2r1do.exe Token: SeLoadDriverPrivilege 1248 Gx2r1do.exe Token: SeLoadDriverPrivilege 3184 Gx2r1do.exe Token: SeLoadDriverPrivilege 764 Gx2r1do.exe Token: SeLoadDriverPrivilege 1992 Gx2r1do.exe Token: SeLoadDriverPrivilege 4084 Gx2r1do.exe Token: SeLoadDriverPrivilege 3888 Gx2r1do.exe Token: SeLoadDriverPrivilege 1676 Gx2r1do.exe Token: SeLoadDriverPrivilege 4864 Gx2r1do.exe Token: SeLoadDriverPrivilege 4112 Gx2r1do.exe Token: SeLoadDriverPrivilege 3992 Gx2r1do.exe Token: SeLoadDriverPrivilege 2580 Gx2r1do.exe Token: SeLoadDriverPrivilege 2736 Gx2r1do.exe Token: SeLoadDriverPrivilege 396 Gx2r1do.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5012 wrote to memory of 2480 5012 c1cc1e47e2526287e602ae79c15d12bbbb834b04c91ff9ea5b4aedc1ce42c63a.exe 79 PID 5012 wrote to memory of 2480 5012 c1cc1e47e2526287e602ae79c15d12bbbb834b04c91ff9ea5b4aedc1ce42c63a.exe 79 PID 5012 wrote to memory of 2480 5012 c1cc1e47e2526287e602ae79c15d12bbbb834b04c91ff9ea5b4aedc1ce42c63a.exe 79 PID 2480 wrote to memory of 5112 2480 Gx2r1do.exe 80 PID 2480 wrote to memory of 5112 2480 Gx2r1do.exe 80 PID 2480 wrote to memory of 5112 2480 Gx2r1do.exe 80 PID 5112 wrote to memory of 4264 5112 Gx2r1do.exe 81 PID 5112 wrote to memory of 4264 5112 Gx2r1do.exe 81 PID 5112 wrote to memory of 4264 5112 Gx2r1do.exe 81 PID 4264 wrote to memory of 4188 4264 Gx2r1do.exe 82 PID 4264 wrote to memory of 4188 4264 Gx2r1do.exe 82 PID 4264 wrote to memory of 4188 4264 Gx2r1do.exe 82 PID 4188 wrote to memory of 4720 4188 Gx2r1do.exe 83 PID 4188 wrote to memory of 4720 4188 Gx2r1do.exe 83 PID 4188 wrote to memory of 4720 4188 Gx2r1do.exe 83 PID 4720 wrote to memory of 4656 4720 Gx2r1do.exe 84 PID 4720 wrote to memory of 4656 4720 Gx2r1do.exe 84 PID 4720 wrote to memory of 4656 4720 Gx2r1do.exe 84 PID 4656 wrote to memory of 4844 4656 Gx2r1do.exe 85 PID 4656 wrote to memory of 4844 4656 Gx2r1do.exe 85 PID 4656 wrote to memory of 4844 4656 Gx2r1do.exe 85 PID 4844 wrote to memory of 4548 4844 Gx2r1do.exe 86 PID 4844 wrote to memory of 4548 4844 Gx2r1do.exe 86 PID 4844 wrote to memory of 4548 4844 Gx2r1do.exe 86 PID 4548 wrote to memory of 2232 4548 Gx2r1do.exe 87 PID 4548 wrote to memory of 2232 4548 Gx2r1do.exe 87 PID 4548 wrote to memory of 2232 4548 Gx2r1do.exe 87 PID 2232 wrote to memory of 3168 2232 Gx2r1do.exe 88 PID 2232 wrote to memory of 3168 2232 Gx2r1do.exe 88 PID 2232 wrote to memory of 3168 2232 Gx2r1do.exe 88 PID 3168 wrote to memory of 3100 3168 Gx2r1do.exe 89 PID 3168 wrote to memory of 3100 3168 Gx2r1do.exe 89 PID 3168 wrote to memory of 3100 3168 Gx2r1do.exe 89 PID 3100 wrote to memory of 4348 3100 Gx2r1do.exe 90 PID 3100 wrote to memory of 4348 3100 Gx2r1do.exe 90 PID 3100 wrote to memory of 4348 3100 Gx2r1do.exe 90 PID 4348 wrote to memory of 4828 4348 Gx2r1do.exe 91 PID 4348 wrote to memory of 4828 4348 Gx2r1do.exe 91 PID 4348 wrote to memory of 4828 4348 Gx2r1do.exe 91 PID 4828 wrote to memory of 4644 4828 Gx2r1do.exe 92 PID 4828 wrote to memory of 4644 4828 Gx2r1do.exe 92 PID 4828 wrote to memory of 4644 4828 Gx2r1do.exe 92 PID 4644 wrote to memory of 4836 4644 Gx2r1do.exe 93 PID 4644 wrote to memory of 4836 4644 Gx2r1do.exe 93 PID 4644 wrote to memory of 4836 4644 Gx2r1do.exe 93 PID 4836 wrote to memory of 4476 4836 Gx2r1do.exe 94 PID 4836 wrote to memory of 4476 4836 Gx2r1do.exe 94 PID 4836 wrote to memory of 4476 4836 Gx2r1do.exe 94 PID 4476 wrote to memory of 3824 4476 Gx2r1do.exe 95 PID 4476 wrote to memory of 3824 4476 Gx2r1do.exe 95 PID 4476 wrote to memory of 3824 4476 Gx2r1do.exe 95 PID 3824 wrote to memory of 4320 3824 Gx2r1do.exe 96 PID 3824 wrote to memory of 4320 3824 Gx2r1do.exe 96 PID 3824 wrote to memory of 4320 3824 Gx2r1do.exe 96 PID 4320 wrote to memory of 1104 4320 Gx2r1do.exe 101 PID 4320 wrote to memory of 1104 4320 Gx2r1do.exe 101 PID 4320 wrote to memory of 1104 4320 Gx2r1do.exe 101 PID 1104 wrote to memory of 4912 1104 Gx2r1do.exe 100 PID 1104 wrote to memory of 4912 1104 Gx2r1do.exe 100 PID 1104 wrote to memory of 4912 1104 Gx2r1do.exe 100 PID 4912 wrote to memory of 2448 4912 Gx2r1do.exe 99 PID 4912 wrote to memory of 2448 4912 Gx2r1do.exe 99 PID 4912 wrote to memory of 2448 4912 Gx2r1do.exe 99 PID 2448 wrote to memory of 4404 2448 Gx2r1do.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1cc1e47e2526287e602ae79c15d12bbbb834b04c91ff9ea5b4aedc1ce42c63a.exe"C:\Users\Admin\AppData\Local\Temp\c1cc1e47e2526287e602ae79c15d12bbbb834b04c91ff9ea5b4aedc1ce42c63a.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe11⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe21⤵PID:19448
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe22⤵PID:19484
-
-
-
-
-
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe19⤵PID:19296
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe20⤵PID:19588
-
-
-
-
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe18⤵PID:19192
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe19⤵PID:19224
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe20⤵PID:19788
-
-
-
-
-
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe17⤵PID:18984
-
-
-
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe16⤵PID:18864
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe17⤵PID:18996
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe18⤵PID:19288
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe19⤵PID:19372
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe20⤵PID:19416
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe21⤵PID:19476
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe15⤵PID:18720
-
-
-
-
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe13⤵PID:18520
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe14⤵PID:18552
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe15⤵PID:19016
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe16⤵PID:19324
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe17⤵PID:19640
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe12⤵PID:18436
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe13⤵PID:18504
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe14⤵PID:18904
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe15⤵PID:19216
-
-
-
-
-
-
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe11⤵PID:4384
-
-
-
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe10⤵PID:18216
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe11⤵PID:18260
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe12⤵PID:18376
-
-
-
-
-
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe9⤵PID:18176
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe10⤵PID:18424
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe11⤵PID:18944
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe12⤵PID:364
-
-
-
-
-
-
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe8⤵PID:17936
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe9⤵PID:17988
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe10⤵PID:18060
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe11⤵PID:18728
-
-
-
-
-
-
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe7⤵PID:17744
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe8⤵PID:17848
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe9⤵PID:17888
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe10⤵PID:17928
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe11⤵PID:18096
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe12⤵PID:18352
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe13⤵PID:1480
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe14⤵PID:18812
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe15⤵PID:19148
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe6⤵PID:17592
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe7⤵PID:17640
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe8⤵PID:17692
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe9⤵PID:17724
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe10⤵PID:17764
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe11⤵PID:17808
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe12⤵PID:17876
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe13⤵PID:18080
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe14⤵PID:18368
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe5⤵PID:17540
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe6⤵PID:17672
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe7⤵PID:17704
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe8⤵PID:18068
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe9⤵PID:18276
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe4⤵PID:4640
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe5⤵PID:17468
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe6⤵PID:17548
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe7⤵PID:17584
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe8⤵PID:17620
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe9⤵PID:17664
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe10⤵PID:17788
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe11⤵PID:17832
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe12⤵PID:18152
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe13⤵PID:18236
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe3⤵PID:17400
-
-
-
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe2⤵PID:13176
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe3⤵PID:13212
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe4⤵PID:13252
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe5⤵PID:13288
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe6⤵PID:12292
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe7⤵PID:12428
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe8⤵PID:12508
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe9⤵PID:12860
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe10⤵PID:13012
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe11⤵PID:13208
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe12⤵PID:13316
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe13⤵PID:13348
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe14⤵PID:13384
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe15⤵PID:13428
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe16⤵PID:13460
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe17⤵PID:13504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4404 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3768 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2396 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:508 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3828 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe6⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3584 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3324 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3468 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2672 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4088 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2004 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4976 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2012 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:744 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe2⤵PID:19600
-
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\Gx2r1do\yV8uM5F.exeC:\Windows\system32\Gx2r1do\yV8uM5F.exe2⤵PID:19512
-
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1932 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2392 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1468 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4400 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1008
-
-
-
-
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1460 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3720 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3396 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:404 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3504 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4520 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3352 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe8⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1096 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1556 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe10⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1248 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3184 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:764
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1992 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4084 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3888 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1676 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4864 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe6⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4112 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3992 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2580 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2736 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe10⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:396 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2824 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe12⤵PID:4304
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe13⤵
- Drops file in System32 directory
PID:3708 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe14⤵PID:1900
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe15⤵PID:2888
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe16⤵
- Enumerates connected drives
PID:620 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe17⤵PID:892
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe18⤵
- Drops file in System32 directory
PID:3220 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe19⤵PID:4624
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe20⤵PID:760
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe21⤵PID:4104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe1⤵PID:3920
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe2⤵PID:4020
-
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe1⤵
- Enumerates connected drives
PID:5076 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe2⤵PID:1664
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe3⤵
- Drops file in System32 directory
PID:4672 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe4⤵PID:3820
-
-
-
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe1⤵PID:2144
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe2⤵PID:4344
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe3⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:4628 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe4⤵PID:836
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe5⤵
- Drops file in System32 directory
PID:1144 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe6⤵
- Enumerates connected drives
PID:224 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe7⤵PID:4292
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe8⤵PID:228
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe9⤵PID:3756
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe10⤵PID:4932
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe11⤵PID:1528
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe12⤵PID:540
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe13⤵
- Drops file in System32 directory
PID:1068 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe14⤵
- Drops file in System32 directory
PID:4884 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe15⤵PID:3464
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe16⤵PID:4456
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe17⤵PID:3936
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe18⤵PID:4968
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe19⤵
- Drops file in System32 directory
PID:4484 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe20⤵PID:4452
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe21⤵
- Drops file in System32 directory
PID:824 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe22⤵PID:3532
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe23⤵
- Enumerates connected drives
PID:8 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe24⤵
- Enumerates connected drives
PID:2856 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe25⤵
- Enumerates connected drives
PID:1832 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe26⤵PID:1408
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe27⤵PID:3224
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe28⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:1440 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe29⤵
- Enumerates connected drives
PID:3316 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe30⤵PID:2188
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe31⤵
- Drops file in System32 directory
PID:3340 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe32⤵PID:1444
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe33⤵PID:4296
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe34⤵PID:2500
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe35⤵PID:4604
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe36⤵PID:4032
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe37⤵PID:2840
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe38⤵PID:3760
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe39⤵PID:4592
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe40⤵PID:4332
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe41⤵PID:3060
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe42⤵
- Enumerates connected drives
PID:4788 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe43⤵PID:5144
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe44⤵PID:5164
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe45⤵
- Drops file in System32 directory
PID:5188 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe46⤵PID:5204
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe47⤵PID:5232
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe48⤵PID:5248
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe49⤵
- Enumerates connected drives
PID:5272 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe50⤵
- Enumerates connected drives
PID:5292 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe51⤵
- Enumerates connected drives
PID:5312 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe52⤵PID:5332
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe53⤵PID:5356
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe54⤵
- Drops file in System32 directory
PID:5376 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe55⤵PID:5404
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe56⤵PID:5420
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe57⤵PID:5444
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe58⤵
- Enumerates connected drives
PID:5464 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe59⤵PID:5492
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe60⤵PID:5508
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe61⤵PID:5524
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe62⤵PID:5540
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe63⤵PID:5556
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe64⤵PID:5576
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe65⤵
- Enumerates connected drives
PID:5592 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe66⤵PID:5608
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe67⤵
- Enumerates connected drives
PID:5624 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe68⤵PID:5640
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe69⤵
- Enumerates connected drives
PID:5656 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe70⤵
- Drops file in System32 directory
PID:5676 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe71⤵PID:5692
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe72⤵
- Drops file in System32 directory
PID:5708 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe73⤵PID:5728
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe74⤵PID:5744
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe75⤵PID:5772
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe76⤵PID:5788
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe77⤵
- Drops file in System32 directory
PID:5816 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe78⤵PID:5832
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe79⤵PID:5852
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe80⤵
- Drops file in System32 directory
PID:5872 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe81⤵PID:5892
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe82⤵PID:5912
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe83⤵PID:5932
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe84⤵
- Drops file in System32 directory
PID:5956 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe85⤵PID:5980
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe86⤵PID:5996
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe87⤵
- Enumerates connected drives
PID:6016 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe88⤵
- Enumerates connected drives
PID:6036 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe89⤵
- Enumerates connected drives
PID:6056 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe90⤵PID:6080
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe91⤵
- Enumerates connected drives
PID:6100 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe92⤵PID:6128
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe93⤵PID:424
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe94⤵
- Enumerates connected drives
PID:5196 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe95⤵PID:5284
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe96⤵PID:5364
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe97⤵
- Drops file in System32 directory
PID:5440 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe98⤵
- Drops file in System32 directory
PID:5756 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe99⤵PID:5844
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe100⤵PID:5944
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe101⤵PID:6068
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe102⤵PID:6124
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe103⤵PID:5720
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe104⤵
- Drops file in System32 directory
PID:6028 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe105⤵PID:6156
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe106⤵PID:6176
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe107⤵PID:6192
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe108⤵PID:6212
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe109⤵
- Drops file in System32 directory
PID:6228 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe110⤵PID:6248
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe111⤵
- Enumerates connected drives
PID:6264 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe112⤵
- Enumerates connected drives
PID:6280 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe113⤵PID:6296
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe114⤵PID:6316
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe115⤵PID:6344
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe116⤵PID:6364
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe117⤵PID:6396
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe118⤵
- Drops file in System32 directory
PID:6412 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe119⤵PID:6428
-
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe120⤵
- Drops file in System32 directory
PID:6444 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe121⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:6460 -
C:\Windows\SysWOW64\yV8uM5F\Gx2r1do.exeC:\Windows\system32\yV8uM5F\Gx2r1do.exe122⤵PID:6476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-