Analysis
-
max time kernel
52s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 00:02
Behavioral task
behavioral1
Sample
2cc84035b58a08356a4b4add6a6aa3ad9aaa2131ff586161037b5e07017806f5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2cc84035b58a08356a4b4add6a6aa3ad9aaa2131ff586161037b5e07017806f5.exe
Resource
win10v2004-20220812-en
General
-
Target
2cc84035b58a08356a4b4add6a6aa3ad9aaa2131ff586161037b5e07017806f5.exe
-
Size
271KB
-
MD5
12f4bc954c9710ded552bb53586e84d0
-
SHA1
20d798614d33e1aa2d1901845f8d5ec468556cdd
-
SHA256
2cc84035b58a08356a4b4add6a6aa3ad9aaa2131ff586161037b5e07017806f5
-
SHA512
096b5a348307b435b3e7410e9344b005d29d5a150d45c4dca0e5a26dcdfb4009159c9e7378961006ea25e6ebd5c1516e53e6e16c2854297123db8cc223aa8ea3
-
SSDEEP
3072:9/6I7Vz2rzGrcBMWxqUxZAxWxZiG8csa7nPgIDOWXZLJC198:9/6IErzfCIW/M7P5DxXZ1CY
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1684 nXDFBfW.exe 4200 nXDFBfW.exe 4320 nXDFBfW.exe 3660 nXDFBfW.exe 4404 nXDFBfW.exe 4808 nXDFBfW.exe 1528 nXDFBfW.exe 4780 nXDFBfW.exe 4792 nXDFBfW.exe 4800 nXDFBfW.exe 4668 nXDFBfW.exe 1600 nXDFBfW.exe 4552 nXDFBfW.exe 4184 nXDFBfW.exe 4380 nXDFBfW.exe 1752 nXDFBfW.exe 532 nXDFBfW.exe 620 nXDFBfW.exe 664 nXDFBfW.exe 1768 nXDFBfW.exe 616 nXDFBfW.exe 4296 nXDFBfW.exe 240 nXDFBfW.exe 100 nXDFBfW.exe 3100 nXDFBfW.exe 4304 nXDFBfW.exe 3032 nXDFBfW.exe 2912 nXDFBfW.exe 1300 nXDFBfW.exe 3752 nXDFBfW.exe 3528 nXDFBfW.exe 3404 nXDFBfW.exe 3644 nXDFBfW.exe 1660 nXDFBfW.exe 4076 nXDFBfW.exe 5072 nXDFBfW.exe 4236 nXDFBfW.exe 3496 nXDFBfW.exe 3120 nXDFBfW.exe 4228 nXDFBfW.exe 4572 nXDFBfW.exe 2708 nXDFBfW.exe 5044 nXDFBfW.exe 1764 nXDFBfW.exe 424 nXDFBfW.exe 4920 nXDFBfW.exe 2460 nXDFBfW.exe 2204 nXDFBfW.exe 4440 nXDFBfW.exe 4876 nXDFBfW.exe 4540 nXDFBfW.exe 5020 nXDFBfW.exe 8 nXDFBfW.exe 4368 nXDFBfW.exe 5096 nXDFBfW.exe 5092 nXDFBfW.exe 360 nXDFBfW.exe 4568 nXDFBfW.exe 5064 nXDFBfW.exe 608 nXDFBfW.exe 3152 nXDFBfW.exe 4468 nXDFBfW.exe 4180 nXDFBfW.exe 2496 nXDFBfW.exe -
resource yara_rule behavioral2/memory/4132-132-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/files/0x0008000000022dd9-134.dat upx behavioral2/files/0x0008000000022dd9-135.dat upx behavioral2/files/0x0008000000022dd9-137.dat upx behavioral2/files/0x0008000000022dd9-139.dat upx behavioral2/files/0x0008000000022dd9-141.dat upx behavioral2/memory/4200-144-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4320-145-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/3660-147-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/files/0x0008000000022dd9-149.dat upx behavioral2/files/0x0008000000022dd9-151.dat upx behavioral2/files/0x0008000000022dd9-146.dat upx behavioral2/memory/1684-142-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/files/0x0008000000022dd9-153.dat upx behavioral2/files/0x0008000000022dd9-155.dat upx behavioral2/files/0x0008000000022dd9-157.dat upx behavioral2/files/0x0008000000022dd9-159.dat upx behavioral2/files/0x0008000000022dd9-161.dat upx behavioral2/files/0x0008000000022dd9-163.dat upx behavioral2/files/0x0008000000022dd9-165.dat upx behavioral2/files/0x0008000000022dd9-167.dat upx behavioral2/files/0x0008000000022dd9-169.dat upx behavioral2/files/0x0008000000022dd9-171.dat upx behavioral2/files/0x0008000000022dd9-173.dat upx behavioral2/files/0x0008000000022dd9-175.dat upx behavioral2/files/0x0008000000022dd9-177.dat upx behavioral2/memory/4404-178-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4808-179-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/1528-180-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4780-181-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4792-182-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4800-183-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4668-184-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/1600-185-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4552-186-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4184-187-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4380-188-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/1752-189-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/532-190-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/620-191-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/1768-193-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/664-192-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/files/0x0008000000022dd9-195.dat upx behavioral2/files/0x0008000000022dd9-197.dat upx behavioral2/files/0x0008000000022dd9-199.dat upx behavioral2/files/0x0008000000022dd9-201.dat upx behavioral2/files/0x0008000000022dd9-203.dat upx behavioral2/files/0x0008000000022dd9-205.dat upx behavioral2/files/0x0008000000022dd9-207.dat upx behavioral2/files/0x0008000000022dd9-209.dat upx behavioral2/files/0x0008000000022dd9-211.dat upx behavioral2/files/0x0008000000022dd9-213.dat upx behavioral2/memory/4296-216-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/files/0x0008000000022dd9-217.dat upx behavioral2/memory/616-214-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4304-224-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/files/0x0008000000022dd9-226.dat upx behavioral2/memory/3032-225-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/files/0x0008000000022dd9-230.dat upx behavioral2/files/0x0008000000022dd9-232.dat upx behavioral2/memory/1300-229-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/2912-227-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/3100-223-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/files/0x0008000000022dd9-234.dat upx -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: nXDFBfW.exe File opened (read-only) \??\y: nXDFBfW.exe File opened (read-only) \??\k: nXDFBfW.exe File opened (read-only) \??\x: nXDFBfW.exe File opened (read-only) \??\y: nXDFBfW.exe File opened (read-only) \??\e: nXDFBfW.exe File opened (read-only) \??\j: nXDFBfW.exe File opened (read-only) \??\g: nXDFBfW.exe File opened (read-only) \??\s: nXDFBfW.exe File opened (read-only) \??\s: nXDFBfW.exe File opened (read-only) \??\u: nXDFBfW.exe File opened (read-only) \??\f: nXDFBfW.exe File opened (read-only) \??\e: nXDFBfW.exe File opened (read-only) \??\f: nXDFBfW.exe File opened (read-only) \??\m: nXDFBfW.exe File opened (read-only) \??\w: nXDFBfW.exe File opened (read-only) \??\k: nXDFBfW.exe File opened (read-only) \??\u: nXDFBfW.exe File opened (read-only) \??\r: nXDFBfW.exe File opened (read-only) \??\x: nXDFBfW.exe File opened (read-only) \??\u: nXDFBfW.exe File opened (read-only) \??\s: nXDFBfW.exe File opened (read-only) \??\e: nXDFBfW.exe File opened (read-only) \??\j: nXDFBfW.exe File opened (read-only) \??\o: nXDFBfW.exe File opened (read-only) \??\x: nXDFBfW.exe File opened (read-only) \??\h: nXDFBfW.exe File opened (read-only) \??\f: nXDFBfW.exe File opened (read-only) \??\h: nXDFBfW.exe File opened (read-only) \??\l: nXDFBfW.exe File opened (read-only) \??\y: nXDFBfW.exe File opened (read-only) \??\m: nXDFBfW.exe File opened (read-only) \??\j: nXDFBfW.exe File opened (read-only) \??\m: nXDFBfW.exe File opened (read-only) \??\i: 2cc84035b58a08356a4b4add6a6aa3ad9aaa2131ff586161037b5e07017806f5.exe File opened (read-only) \??\v: nXDFBfW.exe File opened (read-only) \??\o: nXDFBfW.exe File opened (read-only) \??\x: nXDFBfW.exe File opened (read-only) \??\y: nXDFBfW.exe File opened (read-only) \??\v: nXDFBfW.exe File opened (read-only) \??\h: nXDFBfW.exe File opened (read-only) \??\u: nXDFBfW.exe File opened (read-only) \??\g: nXDFBfW.exe File opened (read-only) \??\l: nXDFBfW.exe File opened (read-only) \??\z: nXDFBfW.exe File opened (read-only) \??\z: nXDFBfW.exe File opened (read-only) \??\i: nXDFBfW.exe File opened (read-only) \??\v: nXDFBfW.exe File opened (read-only) \??\x: nXDFBfW.exe File opened (read-only) \??\u: nXDFBfW.exe File opened (read-only) \??\s: nXDFBfW.exe File opened (read-only) \??\q: nXDFBfW.exe File opened (read-only) \??\o: nXDFBfW.exe File opened (read-only) \??\x: 2cc84035b58a08356a4b4add6a6aa3ad9aaa2131ff586161037b5e07017806f5.exe File opened (read-only) \??\j: nXDFBfW.exe File opened (read-only) \??\j: nXDFBfW.exe File opened (read-only) \??\l: nXDFBfW.exe File opened (read-only) \??\m: nXDFBfW.exe File opened (read-only) \??\h: nXDFBfW.exe File opened (read-only) \??\q: nXDFBfW.exe File opened (read-only) \??\z: nXDFBfW.exe File opened (read-only) \??\h: nXDFBfW.exe File opened (read-only) \??\r: nXDFBfW.exe File opened (read-only) \??\w: nXDFBfW.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe 2cc84035b58a08356a4b4add6a6aa3ad9aaa2131ff586161037b5e07017806f5.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exe nXDFBfW.exe File created C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exe nXDFBfW.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 4132 2cc84035b58a08356a4b4add6a6aa3ad9aaa2131ff586161037b5e07017806f5.exe Token: SeLoadDriverPrivilege 1684 nXDFBfW.exe Token: SeLoadDriverPrivilege 4200 nXDFBfW.exe Token: SeLoadDriverPrivilege 4320 nXDFBfW.exe Token: SeLoadDriverPrivilege 3660 nXDFBfW.exe Token: SeLoadDriverPrivilege 4404 nXDFBfW.exe Token: SeLoadDriverPrivilege 4808 nXDFBfW.exe Token: SeLoadDriverPrivilege 1528 nXDFBfW.exe Token: SeLoadDriverPrivilege 4780 nXDFBfW.exe Token: SeLoadDriverPrivilege 4792 nXDFBfW.exe Token: SeLoadDriverPrivilege 4800 nXDFBfW.exe Token: SeLoadDriverPrivilege 4668 nXDFBfW.exe Token: SeLoadDriverPrivilege 1600 nXDFBfW.exe Token: SeLoadDriverPrivilege 4552 nXDFBfW.exe Token: SeLoadDriverPrivilege 4184 nXDFBfW.exe Token: SeLoadDriverPrivilege 4380 nXDFBfW.exe Token: SeLoadDriverPrivilege 1752 nXDFBfW.exe Token: SeLoadDriverPrivilege 532 nXDFBfW.exe Token: SeLoadDriverPrivilege 620 nXDFBfW.exe Token: SeLoadDriverPrivilege 664 nXDFBfW.exe Token: SeLoadDriverPrivilege 1768 nXDFBfW.exe Token: SeLoadDriverPrivilege 616 nXDFBfW.exe Token: SeLoadDriverPrivilege 4296 nXDFBfW.exe Token: SeLoadDriverPrivilege 240 nXDFBfW.exe Token: SeLoadDriverPrivilege 100 nXDFBfW.exe Token: SeLoadDriverPrivilege 3100 nXDFBfW.exe Token: SeLoadDriverPrivilege 4304 nXDFBfW.exe Token: SeLoadDriverPrivilege 3032 nXDFBfW.exe Token: SeLoadDriverPrivilege 2912 nXDFBfW.exe Token: SeLoadDriverPrivilege 1300 nXDFBfW.exe Token: SeLoadDriverPrivilege 3752 nXDFBfW.exe Token: SeLoadDriverPrivilege 3528 nXDFBfW.exe Token: SeLoadDriverPrivilege 3404 nXDFBfW.exe Token: SeLoadDriverPrivilege 3644 nXDFBfW.exe Token: SeLoadDriverPrivilege 1660 nXDFBfW.exe Token: SeLoadDriverPrivilege 4076 nXDFBfW.exe Token: SeLoadDriverPrivilege 5072 nXDFBfW.exe Token: SeLoadDriverPrivilege 4236 nXDFBfW.exe Token: SeLoadDriverPrivilege 3496 nXDFBfW.exe Token: SeLoadDriverPrivilege 3120 nXDFBfW.exe Token: SeLoadDriverPrivilege 4228 nXDFBfW.exe Token: SeLoadDriverPrivilege 4572 nXDFBfW.exe Token: SeLoadDriverPrivilege 2708 nXDFBfW.exe Token: SeLoadDriverPrivilege 5044 nXDFBfW.exe Token: SeLoadDriverPrivilege 1764 nXDFBfW.exe Token: SeLoadDriverPrivilege 424 nXDFBfW.exe Token: SeLoadDriverPrivilege 4920 nXDFBfW.exe Token: SeLoadDriverPrivilege 2460 nXDFBfW.exe Token: SeLoadDriverPrivilege 2204 nXDFBfW.exe Token: SeLoadDriverPrivilege 4440 nXDFBfW.exe Token: SeLoadDriverPrivilege 4876 nXDFBfW.exe Token: SeLoadDriverPrivilege 4540 nXDFBfW.exe Token: SeLoadDriverPrivilege 5020 nXDFBfW.exe Token: SeLoadDriverPrivilege 8 nXDFBfW.exe Token: SeLoadDriverPrivilege 4368 nXDFBfW.exe Token: SeLoadDriverPrivilege 5096 nXDFBfW.exe Token: SeLoadDriverPrivilege 5092 nXDFBfW.exe Token: SeLoadDriverPrivilege 360 nXDFBfW.exe Token: SeLoadDriverPrivilege 4568 nXDFBfW.exe Token: SeLoadDriverPrivilege 5064 nXDFBfW.exe Token: SeLoadDriverPrivilege 608 nXDFBfW.exe Token: SeLoadDriverPrivilege 3152 nXDFBfW.exe Token: SeLoadDriverPrivilege 4468 nXDFBfW.exe Token: SeLoadDriverPrivilege 4180 nXDFBfW.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4132 wrote to memory of 1684 4132 2cc84035b58a08356a4b4add6a6aa3ad9aaa2131ff586161037b5e07017806f5.exe 79 PID 4132 wrote to memory of 1684 4132 2cc84035b58a08356a4b4add6a6aa3ad9aaa2131ff586161037b5e07017806f5.exe 79 PID 4132 wrote to memory of 1684 4132 2cc84035b58a08356a4b4add6a6aa3ad9aaa2131ff586161037b5e07017806f5.exe 79 PID 1684 wrote to memory of 4200 1684 nXDFBfW.exe 80 PID 1684 wrote to memory of 4200 1684 nXDFBfW.exe 80 PID 1684 wrote to memory of 4200 1684 nXDFBfW.exe 80 PID 4200 wrote to memory of 4320 4200 nXDFBfW.exe 81 PID 4200 wrote to memory of 4320 4200 nXDFBfW.exe 81 PID 4200 wrote to memory of 4320 4200 nXDFBfW.exe 81 PID 4320 wrote to memory of 3660 4320 nXDFBfW.exe 82 PID 4320 wrote to memory of 3660 4320 nXDFBfW.exe 82 PID 4320 wrote to memory of 3660 4320 nXDFBfW.exe 82 PID 3660 wrote to memory of 4404 3660 nXDFBfW.exe 83 PID 3660 wrote to memory of 4404 3660 nXDFBfW.exe 83 PID 3660 wrote to memory of 4404 3660 nXDFBfW.exe 83 PID 4404 wrote to memory of 4808 4404 nXDFBfW.exe 84 PID 4404 wrote to memory of 4808 4404 nXDFBfW.exe 84 PID 4404 wrote to memory of 4808 4404 nXDFBfW.exe 84 PID 4808 wrote to memory of 1528 4808 nXDFBfW.exe 85 PID 4808 wrote to memory of 1528 4808 nXDFBfW.exe 85 PID 4808 wrote to memory of 1528 4808 nXDFBfW.exe 85 PID 1528 wrote to memory of 4780 1528 nXDFBfW.exe 86 PID 1528 wrote to memory of 4780 1528 nXDFBfW.exe 86 PID 1528 wrote to memory of 4780 1528 nXDFBfW.exe 86 PID 4780 wrote to memory of 4792 4780 nXDFBfW.exe 87 PID 4780 wrote to memory of 4792 4780 nXDFBfW.exe 87 PID 4780 wrote to memory of 4792 4780 nXDFBfW.exe 87 PID 4792 wrote to memory of 4800 4792 nXDFBfW.exe 88 PID 4792 wrote to memory of 4800 4792 nXDFBfW.exe 88 PID 4792 wrote to memory of 4800 4792 nXDFBfW.exe 88 PID 4800 wrote to memory of 4668 4800 nXDFBfW.exe 89 PID 4800 wrote to memory of 4668 4800 nXDFBfW.exe 89 PID 4800 wrote to memory of 4668 4800 nXDFBfW.exe 89 PID 4668 wrote to memory of 1600 4668 nXDFBfW.exe 90 PID 4668 wrote to memory of 1600 4668 nXDFBfW.exe 90 PID 4668 wrote to memory of 1600 4668 nXDFBfW.exe 90 PID 1600 wrote to memory of 4552 1600 nXDFBfW.exe 91 PID 1600 wrote to memory of 4552 1600 nXDFBfW.exe 91 PID 1600 wrote to memory of 4552 1600 nXDFBfW.exe 91 PID 4552 wrote to memory of 4184 4552 nXDFBfW.exe 92 PID 4552 wrote to memory of 4184 4552 nXDFBfW.exe 92 PID 4552 wrote to memory of 4184 4552 nXDFBfW.exe 92 PID 4184 wrote to memory of 4380 4184 nXDFBfW.exe 93 PID 4184 wrote to memory of 4380 4184 nXDFBfW.exe 93 PID 4184 wrote to memory of 4380 4184 nXDFBfW.exe 93 PID 4380 wrote to memory of 1752 4380 nXDFBfW.exe 94 PID 4380 wrote to memory of 1752 4380 nXDFBfW.exe 94 PID 4380 wrote to memory of 1752 4380 nXDFBfW.exe 94 PID 1752 wrote to memory of 532 1752 nXDFBfW.exe 95 PID 1752 wrote to memory of 532 1752 nXDFBfW.exe 95 PID 1752 wrote to memory of 532 1752 nXDFBfW.exe 95 PID 532 wrote to memory of 620 532 nXDFBfW.exe 96 PID 532 wrote to memory of 620 532 nXDFBfW.exe 96 PID 532 wrote to memory of 620 532 nXDFBfW.exe 96 PID 620 wrote to memory of 664 620 nXDFBfW.exe 97 PID 620 wrote to memory of 664 620 nXDFBfW.exe 97 PID 620 wrote to memory of 664 620 nXDFBfW.exe 97 PID 664 wrote to memory of 1768 664 nXDFBfW.exe 98 PID 664 wrote to memory of 1768 664 nXDFBfW.exe 98 PID 664 wrote to memory of 1768 664 nXDFBfW.exe 98 PID 1768 wrote to memory of 616 1768 nXDFBfW.exe 99 PID 1768 wrote to memory of 616 1768 nXDFBfW.exe 99 PID 1768 wrote to memory of 616 1768 nXDFBfW.exe 99 PID 616 wrote to memory of 4296 616 nXDFBfW.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cc84035b58a08356a4b4add6a6aa3ad9aaa2131ff586161037b5e07017806f5.exe"C:\Users\Admin\AppData\Local\Temp\2cc84035b58a08356a4b4add6a6aa3ad9aaa2131ff586161037b5e07017806f5.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe6⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe7⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe10⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe15⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4296 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:240 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:100 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe26⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3100 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4304 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe28⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3032 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2912 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1300 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3752 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3528 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe33⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3404 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3644 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe35⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exeC:\Windows\system32\nXDFBfW\6PsZlQx.exe27⤵PID:26744
-
-
-
-
C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exeC:\Windows\system32\nXDFBfW\6PsZlQx.exe25⤵PID:26188
-
-
-
-
-
-
-
C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exeC:\Windows\system32\nXDFBfW\6PsZlQx.exe20⤵PID:16688
-
-
-
-
-
-
-
C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exeC:\Windows\system32\nXDFBfW\6PsZlQx.exe15⤵PID:15908
-
-
-
C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exeC:\Windows\system32\nXDFBfW\6PsZlQx.exe14⤵PID:15792
-
-
-
-
C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exeC:\Windows\system32\nXDFBfW\6PsZlQx.exe12⤵PID:15584
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe13⤵PID:15764
-
-
-
-
C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exeC:\Windows\system32\nXDFBfW\6PsZlQx.exe11⤵PID:15460
-
-
-
-
-
-
-
C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exeC:\Windows\system32\nXDFBfW\6PsZlQx.exe6⤵PID:14688
-
-
-
C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exeC:\Windows\system32\nXDFBfW\6PsZlQx.exe5⤵PID:14496
-
-
-
C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exeC:\Windows\system32\nXDFBfW\6PsZlQx.exe4⤵PID:14460
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe5⤵PID:14576
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe6⤵PID:14628
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe7⤵PID:14720
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe8⤵PID:14816
-
-
-
-
-
-
-
C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exeC:\Windows\system32\nXDFBfW\6PsZlQx.exe3⤵PID:4748
-
-
-
C:\Windows\SysWOW64\nXDFBfW\6PsZlQx.exeC:\Windows\system32\nXDFBfW\6PsZlQx.exe2⤵PID:13428
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe3⤵PID:2228
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe4⤵PID:1960
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe5⤵PID:1912
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe6⤵PID:14256
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe7⤵PID:14364
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe8⤵PID:14408
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe9⤵PID:14476
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5072 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4236 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3496 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3120 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4228 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4572 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2708 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5044 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1764 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:424 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe11⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4920 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2460 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2204 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4076
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4876 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4540
-
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:8 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4368
-
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5092 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:360
-
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4568 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5064 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:608 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3152
-
-
-
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4468 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4180 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2496 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe4⤵
- Drops file in System32 directory
PID:3968 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe5⤵PID:5076
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe6⤵PID:2092
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe7⤵
- Enumerates connected drives
PID:1140 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe8⤵PID:2008
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe9⤵
- Drops file in System32 directory
PID:2908 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe10⤵PID:4648
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe11⤵PID:2324
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe12⤵
- Drops file in System32 directory
PID:4028 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe13⤵
- Drops file in System32 directory
PID:3208 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe14⤵PID:1668
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe15⤵
- Enumerates connected drives
PID:4424 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe16⤵PID:312
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe17⤵PID:3536
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe18⤵PID:1796
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe19⤵PID:2084
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe20⤵PID:4412
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe21⤵PID:3324
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe22⤵PID:3164
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe23⤵PID:4684
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe24⤵PID:4384
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe25⤵PID:4520
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe26⤵PID:4628
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe27⤵PID:1772
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe28⤵PID:4956
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe29⤵PID:936
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe30⤵
- Enumerates connected drives
PID:2812 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe31⤵PID:208
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe32⤵PID:1676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe1⤵PID:2944
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe2⤵PID:3568
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe3⤵PID:1572
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe4⤵PID:2188
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe5⤵PID:1192
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe6⤵PID:3788
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe7⤵PID:3104
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe8⤵PID:3700
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe9⤵PID:996
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe10⤵PID:2380
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe11⤵PID:4272
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe12⤵PID:4480
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe13⤵PID:4740
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe14⤵
- Enumerates connected drives
PID:4616 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe15⤵PID:4752
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe16⤵PID:1592
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe17⤵
- Enumerates connected drives
PID:2836 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe18⤵PID:5052
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe19⤵PID:740
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe20⤵
- Drops file in System32 directory
PID:4724 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe21⤵PID:2044
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe22⤵
- Enumerates connected drives
PID:3640 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe23⤵PID:4664
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe24⤵PID:1948
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe25⤵PID:3096
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe26⤵
- Drops file in System32 directory
PID:2520 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe27⤵
- Drops file in System32 directory
PID:2336 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe28⤵PID:2392
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe29⤵PID:2952
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe30⤵PID:5132
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe31⤵
- Drops file in System32 directory
PID:5148 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe32⤵PID:5168
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe33⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:5192 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe34⤵
- Enumerates connected drives
PID:5208 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe35⤵PID:5228
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe36⤵
- Enumerates connected drives
PID:5248 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe37⤵PID:5268
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe38⤵PID:5288
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe39⤵PID:5308
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe40⤵PID:5328
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe41⤵PID:5348
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe42⤵PID:5372
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe43⤵PID:5392
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe44⤵PID:5416
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe45⤵PID:5436
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe46⤵PID:5456
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe47⤵PID:5480
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe48⤵PID:5500
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe49⤵PID:5520
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe50⤵PID:5540
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe51⤵
- Drops file in System32 directory
PID:5560 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe52⤵PID:5584
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe53⤵PID:5604
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe54⤵
- Drops file in System32 directory
PID:5628 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe55⤵
- Drops file in System32 directory
PID:5644 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe56⤵
- Enumerates connected drives
PID:5672 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe57⤵PID:5692
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe58⤵PID:5716
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe59⤵PID:5736
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe60⤵PID:5764
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe61⤵PID:5780
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe62⤵
- Enumerates connected drives
PID:5808 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe63⤵PID:5824
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe64⤵PID:5848
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe65⤵PID:5868
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe66⤵PID:5884
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe67⤵PID:5900
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe68⤵PID:5916
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe69⤵PID:5932
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe70⤵PID:5948
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe71⤵PID:5964
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe72⤵PID:5980
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe73⤵PID:6004
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe74⤵PID:6020
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe75⤵PID:6036
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe76⤵PID:6056
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe77⤵PID:6076
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe78⤵
- Drops file in System32 directory
PID:6100 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe79⤵PID:6124
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe80⤵PID:5156
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe81⤵PID:5280
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe82⤵PID:5360
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe83⤵PID:5428
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe84⤵PID:5532
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe85⤵PID:5616
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe86⤵PID:5720
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe87⤵PID:5772
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe88⤵PID:6068
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe89⤵PID:5200
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe90⤵PID:5512
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe91⤵PID:5816
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe92⤵PID:5704
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe93⤵PID:6168
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe94⤵PID:6188
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe95⤵PID:6212
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe96⤵PID:6236
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe97⤵
- Enumerates connected drives
PID:6252 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe98⤵PID:6272
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe99⤵PID:6292
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe100⤵PID:6312
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe101⤵
- Drops file in System32 directory
PID:6336 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe102⤵PID:6356
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe103⤵
- Enumerates connected drives
PID:6376 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe104⤵PID:6396
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe105⤵PID:6416
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe106⤵PID:6436
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe107⤵PID:6452
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe108⤵PID:6472
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe109⤵PID:6492
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe110⤵PID:6516
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe111⤵
- Drops file in System32 directory
PID:6532 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe112⤵PID:6556
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe113⤵PID:6572
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe114⤵PID:6588
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe115⤵PID:6604
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe116⤵PID:6620
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe117⤵PID:6636
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe118⤵PID:6652
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe119⤵
- Drops file in System32 directory
PID:6668 -
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe120⤵PID:6684
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe121⤵PID:6700
-
C:\Windows\SysWOW64\6PsZlQx\nXDFBfW.exeC:\Windows\system32\6PsZlQx\nXDFBfW.exe122⤵PID:6716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-