Analysis
-
max time kernel
33s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 19:29
Behavioral task
behavioral1
Sample
8e1d3796039e5c4fe984d72b827ebdd1c65767dba9ef9caa20396ea5f2bc9884.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8e1d3796039e5c4fe984d72b827ebdd1c65767dba9ef9caa20396ea5f2bc9884.exe
Resource
win10v2004-20220812-en
General
-
Target
8e1d3796039e5c4fe984d72b827ebdd1c65767dba9ef9caa20396ea5f2bc9884.exe
-
Size
334KB
-
MD5
fb60e4350f65d88cdc21216fb9e4da5c
-
SHA1
be93353ba80ff4af24749cfd92b0d9ecfc88efa9
-
SHA256
8e1d3796039e5c4fe984d72b827ebdd1c65767dba9ef9caa20396ea5f2bc9884
-
SHA512
bd26821e58c5ba683aa19d8a9d6797f65916e39b891ac2a7db4ad5fc6ea0b92ae74c1efa8e935440f722b6799d5efbf90769e2a7911fe4206638c5e9ac42192d
-
SSDEEP
6144:K/snirzx/eGS/dc3rzCsITvqvxvKvKvLv8vtvHv3vyvxvyvEvPv6v4viMrz:sx/XS/dokM
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2032 KyXTCN5.exe 272 KyXTCN5.exe 1064 KyXTCN5.exe 1568 KyXTCN5.exe 580 KyXTCN5.exe 1104 KyXTCN5.exe 1464 KyXTCN5.exe 1852 KyXTCN5.exe 276 KyXTCN5.exe 1480 KyXTCN5.exe 1936 KyXTCN5.exe 1740 KyXTCN5.exe 1700 KyXTCN5.exe 940 KyXTCN5.exe 1800 KyXTCN5.exe 1404 KyXTCN5.exe 964 KyXTCN5.exe 952 KyXTCN5.exe 1864 KyXTCN5.exe 1204 KyXTCN5.exe 1428 KyXTCN5.exe 1320 KyXTCN5.exe 596 KyXTCN5.exe 1716 KyXTCN5.exe 1456 KyXTCN5.exe 1300 KyXTCN5.exe 1768 KyXTCN5.exe 1984 KyXTCN5.exe 1228 KyXTCN5.exe 1132 KyXTCN5.exe 1708 KyXTCN5.exe 1516 KyXTCN5.exe 1288 KyXTCN5.exe 2020 KyXTCN5.exe 1692 KyXTCN5.exe 1644 KyXTCN5.exe 340 KyXTCN5.exe 1004 KyXTCN5.exe 1556 KyXTCN5.exe 1924 KyXTCN5.exe 1604 KyXTCN5.exe 1000 KyXTCN5.exe 984 KyXTCN5.exe 1672 KyXTCN5.exe 1520 KyXTCN5.exe 2028 KyXTCN5.exe 1544 KyXTCN5.exe 1720 KyXTCN5.exe 948 KyXTCN5.exe 1744 KyXTCN5.exe 360 KyXTCN5.exe 1696 KyXTCN5.exe 1008 KyXTCN5.exe 2040 KyXTCN5.exe 2068 KyXTCN5.exe 2088 KyXTCN5.exe 2108 KyXTCN5.exe 2136 KyXTCN5.exe 2180 KyXTCN5.exe 2216 KyXTCN5.exe 2252 KyXTCN5.exe 2280 KyXTCN5.exe 2320 KyXTCN5.exe 2352 KyXTCN5.exe -
resource yara_rule behavioral1/memory/848-55-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral1/files/0x000a0000000122e5-56.dat upx behavioral1/files/0x000a0000000122e5-57.dat upx behavioral1/files/0x000a0000000122e5-59.dat upx behavioral1/files/0x000a0000000122e5-62.dat upx behavioral1/files/0x000a0000000122e5-61.dat upx behavioral1/files/0x000a0000000122e5-63.dat upx behavioral1/files/0x000a0000000122e5-65.dat upx behavioral1/memory/2032-72-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral1/files/0x000a0000000122e5-73.dat upx behavioral1/memory/272-75-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral1/files/0x000a0000000122e5-69.dat upx behavioral1/files/0x000a0000000122e5-68.dat upx behavioral1/files/0x000a0000000122e5-77.dat upx behavioral1/files/0x000a0000000122e5-76.dat upx behavioral1/files/0x000a0000000122e5-79.dat upx behavioral1/files/0x000a0000000122e5-81.dat upx behavioral1/files/0x000a0000000122e5-82.dat upx behavioral1/files/0x000a0000000122e5-84.dat upx behavioral1/files/0x000a0000000122e5-87.dat upx behavioral1/files/0x000a0000000122e5-86.dat upx behavioral1/files/0x000a0000000122e5-89.dat upx behavioral1/files/0x000a0000000122e5-91.dat upx behavioral1/files/0x000a0000000122e5-94.dat upx behavioral1/files/0x000a0000000122e5-92.dat upx behavioral1/files/0x000a0000000122e5-97.dat upx behavioral1/files/0x000a0000000122e5-96.dat upx behavioral1/files/0x000a0000000122e5-99.dat upx behavioral1/files/0x000a0000000122e5-101.dat upx behavioral1/files/0x000a0000000122e5-102.dat upx behavioral1/files/0x000a0000000122e5-104.dat upx behavioral1/files/0x000a0000000122e5-106.dat upx behavioral1/files/0x000a0000000122e5-107.dat upx behavioral1/files/0x000a0000000122e5-109.dat upx behavioral1/files/0x000a0000000122e5-111.dat upx behavioral1/files/0x000a0000000122e5-114.dat upx behavioral1/files/0x000a0000000122e5-112.dat upx behavioral1/files/0x000a0000000122e5-117.dat upx behavioral1/files/0x000a0000000122e5-119.dat upx behavioral1/files/0x000a0000000122e5-116.dat upx behavioral1/files/0x000a0000000122e5-121.dat upx behavioral1/files/0x000a0000000122e5-124.dat upx behavioral1/files/0x000a0000000122e5-129.dat upx behavioral1/files/0x000a0000000122e5-127.dat upx behavioral1/files/0x000a0000000122e5-126.dat upx behavioral1/files/0x000a0000000122e5-131.dat upx behavioral1/files/0x000a0000000122e5-122.dat upx behavioral1/files/0x000a0000000122e5-132.dat upx behavioral1/files/0x000a0000000122e5-134.dat upx behavioral1/files/0x000a0000000122e5-136.dat upx behavioral1/files/0x000a0000000122e5-139.dat upx behavioral1/files/0x000a0000000122e5-137.dat upx behavioral1/files/0x000a0000000122e5-142.dat upx behavioral1/files/0x000a0000000122e5-149.dat upx behavioral1/files/0x000a0000000122e5-147.dat upx behavioral1/files/0x000a0000000122e5-146.dat upx behavioral1/files/0x000a0000000122e5-144.dat upx behavioral1/files/0x000a0000000122e5-141.dat upx behavioral1/files/0x000a0000000122e5-151.dat upx behavioral1/files/0x000a0000000122e5-152.dat upx behavioral1/files/0x000a0000000122e5-154.dat upx behavioral1/files/0x000a0000000122e5-157.dat upx behavioral1/files/0x000a0000000122e5-156.dat upx behavioral1/files/0x000a0000000122e5-159.dat upx -
Loads dropped DLL 64 IoCs
pid Process 848 8e1d3796039e5c4fe984d72b827ebdd1c65767dba9ef9caa20396ea5f2bc9884.exe 848 8e1d3796039e5c4fe984d72b827ebdd1c65767dba9ef9caa20396ea5f2bc9884.exe 2032 KyXTCN5.exe 2032 KyXTCN5.exe 272 KyXTCN5.exe 272 KyXTCN5.exe 1064 KyXTCN5.exe 1064 KyXTCN5.exe 1568 KyXTCN5.exe 1568 KyXTCN5.exe 580 KyXTCN5.exe 580 KyXTCN5.exe 1104 KyXTCN5.exe 1104 KyXTCN5.exe 1464 KyXTCN5.exe 1464 KyXTCN5.exe 1852 KyXTCN5.exe 1852 KyXTCN5.exe 276 KyXTCN5.exe 276 KyXTCN5.exe 1480 KyXTCN5.exe 1480 KyXTCN5.exe 1936 KyXTCN5.exe 1936 KyXTCN5.exe 1740 KyXTCN5.exe 1740 KyXTCN5.exe 1700 KyXTCN5.exe 1700 KyXTCN5.exe 940 KyXTCN5.exe 940 KyXTCN5.exe 1800 KyXTCN5.exe 1800 KyXTCN5.exe 1404 KyXTCN5.exe 1404 KyXTCN5.exe 964 KyXTCN5.exe 964 KyXTCN5.exe 952 KyXTCN5.exe 952 KyXTCN5.exe 1864 KyXTCN5.exe 1864 KyXTCN5.exe 1204 KyXTCN5.exe 1204 KyXTCN5.exe 1428 KyXTCN5.exe 1428 KyXTCN5.exe 1320 KyXTCN5.exe 1320 KyXTCN5.exe 596 KyXTCN5.exe 596 KyXTCN5.exe 1716 KyXTCN5.exe 1716 KyXTCN5.exe 1456 KyXTCN5.exe 1456 KyXTCN5.exe 1300 KyXTCN5.exe 1300 KyXTCN5.exe 1768 KyXTCN5.exe 1768 KyXTCN5.exe 1984 KyXTCN5.exe 1984 KyXTCN5.exe 1228 KyXTCN5.exe 1228 KyXTCN5.exe 1132 KyXTCN5.exe 1132 KyXTCN5.exe 1708 KyXTCN5.exe 1708 KyXTCN5.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\n: KyXTCN5.exe File opened (read-only) \??\f: KyXTCN5.exe File opened (read-only) \??\j: KyXTCN5.exe File opened (read-only) \??\g: KyXTCN5.exe File opened (read-only) \??\n: KyXTCN5.exe File opened (read-only) \??\p: KyXTCN5.exe File opened (read-only) \??\x: KyXTCN5.exe File opened (read-only) \??\r: KyXTCN5.exe File opened (read-only) \??\h: KyXTCN5.exe File opened (read-only) \??\i: KyXTCN5.exe File opened (read-only) \??\j: KyXTCN5.exe File opened (read-only) \??\w: KyXTCN5.exe File opened (read-only) \??\e: KyXTCN5.exe File opened (read-only) \??\e: KyXTCN5.exe File opened (read-only) \??\l: KyXTCN5.exe File opened (read-only) \??\k: KyXTCN5.exe File opened (read-only) \??\l: KyXTCN5.exe File opened (read-only) \??\v: KyXTCN5.exe File opened (read-only) \??\s: KyXTCN5.exe File opened (read-only) \??\j: KyXTCN5.exe File opened (read-only) \??\p: KyXTCN5.exe File opened (read-only) \??\x: KyXTCN5.exe File opened (read-only) \??\r: KyXTCN5.exe File opened (read-only) \??\o: KyXTCN5.exe File opened (read-only) \??\z: KyXTCN5.exe File opened (read-only) \??\z: KyXTCN5.exe File opened (read-only) \??\f: KyXTCN5.exe File opened (read-only) \??\v: KyXTCN5.exe File opened (read-only) \??\g: KyXTCN5.exe File opened (read-only) \??\p: KyXTCN5.exe File opened (read-only) \??\g: KyXTCN5.exe File opened (read-only) \??\z: KyXTCN5.exe File opened (read-only) \??\h: KyXTCN5.exe File opened (read-only) \??\j: KyXTCN5.exe File opened (read-only) \??\x: KyXTCN5.exe File opened (read-only) \??\h: KyXTCN5.exe File opened (read-only) \??\k: KyXTCN5.exe File opened (read-only) \??\j: KyXTCN5.exe File opened (read-only) \??\j: KyXTCN5.exe File opened (read-only) \??\u: KyXTCN5.exe File opened (read-only) \??\t: KyXTCN5.exe File opened (read-only) \??\v: KyXTCN5.exe File opened (read-only) \??\q: KyXTCN5.exe File opened (read-only) \??\o: KyXTCN5.exe File opened (read-only) \??\y: KyXTCN5.exe File opened (read-only) \??\u: KyXTCN5.exe File opened (read-only) \??\h: KyXTCN5.exe File opened (read-only) \??\l: KyXTCN5.exe File opened (read-only) \??\h: KyXTCN5.exe File opened (read-only) \??\m: KyXTCN5.exe File opened (read-only) \??\f: KyXTCN5.exe File opened (read-only) \??\t: KyXTCN5.exe File opened (read-only) \??\h: KyXTCN5.exe File opened (read-only) \??\u: KyXTCN5.exe File opened (read-only) \??\k: KyXTCN5.exe File opened (read-only) \??\u: KyXTCN5.exe File opened (read-only) \??\m: KyXTCN5.exe File opened (read-only) \??\f: KyXTCN5.exe File opened (read-only) \??\g: KyXTCN5.exe File opened (read-only) \??\f: KyXTCN5.exe File opened (read-only) \??\w: KyXTCN5.exe File opened (read-only) \??\o: KyXTCN5.exe File opened (read-only) \??\l: KyXTCN5.exe File opened (read-only) \??\v: KyXTCN5.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe File created C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exe KyXTCN5.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 848 8e1d3796039e5c4fe984d72b827ebdd1c65767dba9ef9caa20396ea5f2bc9884.exe Token: SeLoadDriverPrivilege 2032 KyXTCN5.exe Token: SeLoadDriverPrivilege 272 KyXTCN5.exe Token: SeLoadDriverPrivilege 1064 KyXTCN5.exe Token: SeLoadDriverPrivilege 1568 KyXTCN5.exe Token: SeLoadDriverPrivilege 580 KyXTCN5.exe Token: SeLoadDriverPrivilege 1104 KyXTCN5.exe Token: SeLoadDriverPrivilege 1464 KyXTCN5.exe Token: SeLoadDriverPrivilege 1852 KyXTCN5.exe Token: SeLoadDriverPrivilege 276 KyXTCN5.exe Token: SeLoadDriverPrivilege 1480 KyXTCN5.exe Token: SeLoadDriverPrivilege 1936 KyXTCN5.exe Token: SeLoadDriverPrivilege 1740 KyXTCN5.exe Token: SeLoadDriverPrivilege 1700 KyXTCN5.exe Token: SeLoadDriverPrivilege 940 KyXTCN5.exe Token: SeLoadDriverPrivilege 1800 KyXTCN5.exe Token: SeLoadDriverPrivilege 1404 KyXTCN5.exe Token: SeLoadDriverPrivilege 964 KyXTCN5.exe Token: SeLoadDriverPrivilege 952 KyXTCN5.exe Token: SeLoadDriverPrivilege 1864 KyXTCN5.exe Token: SeLoadDriverPrivilege 1204 KyXTCN5.exe Token: SeLoadDriverPrivilege 1428 KyXTCN5.exe Token: SeLoadDriverPrivilege 1320 KyXTCN5.exe Token: SeLoadDriverPrivilege 596 KyXTCN5.exe Token: SeLoadDriverPrivilege 1716 KyXTCN5.exe Token: SeLoadDriverPrivilege 1456 KyXTCN5.exe Token: SeLoadDriverPrivilege 1300 KyXTCN5.exe Token: SeLoadDriverPrivilege 1768 KyXTCN5.exe Token: SeLoadDriverPrivilege 1984 KyXTCN5.exe Token: SeLoadDriverPrivilege 1228 KyXTCN5.exe Token: SeLoadDriverPrivilege 1132 KyXTCN5.exe Token: SeLoadDriverPrivilege 1708 KyXTCN5.exe Token: SeLoadDriverPrivilege 1516 KyXTCN5.exe Token: SeLoadDriverPrivilege 1288 KyXTCN5.exe Token: SeLoadDriverPrivilege 2020 KyXTCN5.exe Token: SeLoadDriverPrivilege 1692 KyXTCN5.exe Token: SeLoadDriverPrivilege 1644 KyXTCN5.exe Token: SeLoadDriverPrivilege 340 KyXTCN5.exe Token: SeLoadDriverPrivilege 1004 KyXTCN5.exe Token: SeLoadDriverPrivilege 1556 KyXTCN5.exe Token: SeLoadDriverPrivilege 1924 KyXTCN5.exe Token: SeLoadDriverPrivilege 1604 KyXTCN5.exe Token: SeLoadDriverPrivilege 1000 KyXTCN5.exe Token: SeLoadDriverPrivilege 984 KyXTCN5.exe Token: SeLoadDriverPrivilege 1672 KyXTCN5.exe Token: SeLoadDriverPrivilege 1520 KyXTCN5.exe Token: SeLoadDriverPrivilege 2028 KyXTCN5.exe Token: SeLoadDriverPrivilege 1544 KyXTCN5.exe Token: SeLoadDriverPrivilege 1720 KyXTCN5.exe Token: SeLoadDriverPrivilege 948 KyXTCN5.exe Token: SeLoadDriverPrivilege 1744 KyXTCN5.exe Token: SeLoadDriverPrivilege 360 KyXTCN5.exe Token: SeLoadDriverPrivilege 1696 KyXTCN5.exe Token: SeLoadDriverPrivilege 1008 KyXTCN5.exe Token: SeLoadDriverPrivilege 2040 KyXTCN5.exe Token: SeLoadDriverPrivilege 2068 KyXTCN5.exe Token: SeLoadDriverPrivilege 2088 KyXTCN5.exe Token: SeLoadDriverPrivilege 2108 KyXTCN5.exe Token: SeLoadDriverPrivilege 2136 KyXTCN5.exe Token: SeLoadDriverPrivilege 2180 KyXTCN5.exe Token: SeLoadDriverPrivilege 2216 KyXTCN5.exe Token: SeLoadDriverPrivilege 2252 KyXTCN5.exe Token: SeLoadDriverPrivilege 2280 KyXTCN5.exe Token: SeLoadDriverPrivilege 2320 KyXTCN5.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 848 wrote to memory of 2032 848 8e1d3796039e5c4fe984d72b827ebdd1c65767dba9ef9caa20396ea5f2bc9884.exe 27 PID 848 wrote to memory of 2032 848 8e1d3796039e5c4fe984d72b827ebdd1c65767dba9ef9caa20396ea5f2bc9884.exe 27 PID 848 wrote to memory of 2032 848 8e1d3796039e5c4fe984d72b827ebdd1c65767dba9ef9caa20396ea5f2bc9884.exe 27 PID 848 wrote to memory of 2032 848 8e1d3796039e5c4fe984d72b827ebdd1c65767dba9ef9caa20396ea5f2bc9884.exe 27 PID 2032 wrote to memory of 272 2032 KyXTCN5.exe 28 PID 2032 wrote to memory of 272 2032 KyXTCN5.exe 28 PID 2032 wrote to memory of 272 2032 KyXTCN5.exe 28 PID 2032 wrote to memory of 272 2032 KyXTCN5.exe 28 PID 272 wrote to memory of 1064 272 KyXTCN5.exe 29 PID 272 wrote to memory of 1064 272 KyXTCN5.exe 29 PID 272 wrote to memory of 1064 272 KyXTCN5.exe 29 PID 272 wrote to memory of 1064 272 KyXTCN5.exe 29 PID 1064 wrote to memory of 1568 1064 KyXTCN5.exe 30 PID 1064 wrote to memory of 1568 1064 KyXTCN5.exe 30 PID 1064 wrote to memory of 1568 1064 KyXTCN5.exe 30 PID 1064 wrote to memory of 1568 1064 KyXTCN5.exe 30 PID 1568 wrote to memory of 580 1568 KyXTCN5.exe 31 PID 1568 wrote to memory of 580 1568 KyXTCN5.exe 31 PID 1568 wrote to memory of 580 1568 KyXTCN5.exe 31 PID 1568 wrote to memory of 580 1568 KyXTCN5.exe 31 PID 580 wrote to memory of 1104 580 KyXTCN5.exe 32 PID 580 wrote to memory of 1104 580 KyXTCN5.exe 32 PID 580 wrote to memory of 1104 580 KyXTCN5.exe 32 PID 580 wrote to memory of 1104 580 KyXTCN5.exe 32 PID 1104 wrote to memory of 1464 1104 KyXTCN5.exe 33 PID 1104 wrote to memory of 1464 1104 KyXTCN5.exe 33 PID 1104 wrote to memory of 1464 1104 KyXTCN5.exe 33 PID 1104 wrote to memory of 1464 1104 KyXTCN5.exe 33 PID 1464 wrote to memory of 1852 1464 KyXTCN5.exe 34 PID 1464 wrote to memory of 1852 1464 KyXTCN5.exe 34 PID 1464 wrote to memory of 1852 1464 KyXTCN5.exe 34 PID 1464 wrote to memory of 1852 1464 KyXTCN5.exe 34 PID 1852 wrote to memory of 276 1852 KyXTCN5.exe 35 PID 1852 wrote to memory of 276 1852 KyXTCN5.exe 35 PID 1852 wrote to memory of 276 1852 KyXTCN5.exe 35 PID 1852 wrote to memory of 276 1852 KyXTCN5.exe 35 PID 276 wrote to memory of 1480 276 KyXTCN5.exe 36 PID 276 wrote to memory of 1480 276 KyXTCN5.exe 36 PID 276 wrote to memory of 1480 276 KyXTCN5.exe 36 PID 276 wrote to memory of 1480 276 KyXTCN5.exe 36 PID 1480 wrote to memory of 1936 1480 KyXTCN5.exe 37 PID 1480 wrote to memory of 1936 1480 KyXTCN5.exe 37 PID 1480 wrote to memory of 1936 1480 KyXTCN5.exe 37 PID 1480 wrote to memory of 1936 1480 KyXTCN5.exe 37 PID 1936 wrote to memory of 1740 1936 KyXTCN5.exe 38 PID 1936 wrote to memory of 1740 1936 KyXTCN5.exe 38 PID 1936 wrote to memory of 1740 1936 KyXTCN5.exe 38 PID 1936 wrote to memory of 1740 1936 KyXTCN5.exe 38 PID 1740 wrote to memory of 1700 1740 KyXTCN5.exe 41 PID 1740 wrote to memory of 1700 1740 KyXTCN5.exe 41 PID 1740 wrote to memory of 1700 1740 KyXTCN5.exe 41 PID 1740 wrote to memory of 1700 1740 KyXTCN5.exe 41 PID 1700 wrote to memory of 940 1700 KyXTCN5.exe 39 PID 1700 wrote to memory of 940 1700 KyXTCN5.exe 39 PID 1700 wrote to memory of 940 1700 KyXTCN5.exe 39 PID 1700 wrote to memory of 940 1700 KyXTCN5.exe 39 PID 940 wrote to memory of 1800 940 KyXTCN5.exe 40 PID 940 wrote to memory of 1800 940 KyXTCN5.exe 40 PID 940 wrote to memory of 1800 940 KyXTCN5.exe 40 PID 940 wrote to memory of 1800 940 KyXTCN5.exe 40 PID 1800 wrote to memory of 1404 1800 KyXTCN5.exe 42 PID 1800 wrote to memory of 1404 1800 KyXTCN5.exe 42 PID 1800 wrote to memory of 1404 1800 KyXTCN5.exe 42 PID 1800 wrote to memory of 1404 1800 KyXTCN5.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e1d3796039e5c4fe984d72b827ebdd1c65767dba9ef9caa20396ea5f2bc9884.exe"C:\Users\Admin\AppData\Local\Temp\8e1d3796039e5c4fe984d72b827ebdd1c65767dba9ef9caa20396ea5f2bc9884.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe15⤵PID:6880
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe16⤵PID:7356
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe17⤵PID:12264
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe18⤵PID:7668
-
-
-
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe14⤵PID:7372
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe13⤵PID:6512
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe14⤵PID:7932
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe15⤵PID:5560
-
-
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe12⤵PID:6176
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe13⤵PID:7076
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe14⤵PID:11272
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe15⤵PID:1752
-
-
-
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe11⤵PID:6320
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe12⤵PID:7264
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe13⤵PID:11712
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe14⤵PID:7536
-
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe12⤵PID:7080
-
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe10⤵PID:6908
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe11⤵PID:7948
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe12⤵PID:2044
-
-
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe9⤵PID:7048
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe8⤵PID:7028
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe9⤵PID:6212
-
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe7⤵PID:6888
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe6⤵PID:6960
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe7⤵PID:7100
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe8⤵PID:7752
-
-
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe5⤵PID:6440
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe4⤵PID:6712
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe5⤵PID:6776
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe6⤵PID:6900
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe7⤵PID:7012
-
-
-
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe3⤵PID:6632
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe4⤵PID:6704
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe5⤵PID:6796
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe6⤵PID:6848
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe7⤵PID:6932
-
-
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe4⤵PID:7604
-
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe2⤵PID:6532
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe3⤵PID:6568
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe4⤵PID:6608
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe5⤵PID:6672
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe6⤵PID:6748
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe7⤵PID:6856
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe8⤵PID:6952
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1404 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:964 -
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe5⤵PID:7328
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe6⤵PID:2036
-
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe4⤵PID:7184
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe5⤵PID:8268
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe6⤵PID:6520
-
-
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe3⤵PID:7200
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe4⤵PID:11308
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe5⤵PID:13296
-
-
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe2⤵PID:7124
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe3⤵PID:7468
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe4⤵PID:6420
-
-
-
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:952 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1864 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1204 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1428 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1320 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:596 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1716 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1456 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe8⤵PID:13000
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe7⤵PID:12048
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe6⤵PID:9656
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe5⤵PID:13072
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe4⤵PID:7444
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe5⤵PID:8088
-
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe3⤵PID:9440
-
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe2⤵PID:7404
-
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1768 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
-
C:\Windows\SysWOW64\KyXTCN5\c6YXybd.exeC:\Windows\system32\KyXTCN5\c6YXybd.exe2⤵PID:13280
-
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1228 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1132 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1708 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1516 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe5⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1288 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2020 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe7⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1692 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1644 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:340 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1004 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1556 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1924 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1604 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1000 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:984 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1672 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1520 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe18⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2028 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1544 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1720 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:948 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1744 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:360 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1696 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1008 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2040 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2068 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2088 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2108 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2136 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2180 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2216 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2252 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2280 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2320 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2352 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe37⤵PID:2380
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe38⤵PID:2404
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe39⤵PID:2432
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe40⤵PID:2456
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe41⤵PID:2488
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe42⤵PID:2516
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe43⤵
- Drops file in System32 directory
PID:2544 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe44⤵PID:2576
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe45⤵PID:2600
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe46⤵
- Drops file in System32 directory
PID:2628 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe47⤵PID:2656
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe48⤵PID:2680
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe49⤵PID:2712
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe50⤵PID:2740
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe51⤵PID:2768
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe52⤵PID:2800
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe53⤵PID:2828
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe54⤵PID:2856
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe55⤵
- Enumerates connected drives
PID:2884 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe56⤵PID:2912
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe57⤵PID:2940
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe58⤵PID:2968
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe59⤵PID:2992
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe60⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3020 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe61⤵PID:3044
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe62⤵PID:2060
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe63⤵PID:2156
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe64⤵
- Enumerates connected drives
PID:2164 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe65⤵PID:2232
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe66⤵
- Enumerates connected drives
PID:2212 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe67⤵PID:2296
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe68⤵
- Enumerates connected drives
PID:2340 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe69⤵
- Drops file in System32 directory
PID:2392 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe70⤵PID:2444
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe71⤵PID:2484
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe72⤵
- Drops file in System32 directory
PID:2540 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe73⤵PID:2592
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe74⤵
- Enumerates connected drives
PID:2640 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe75⤵
- Enumerates connected drives
PID:2692 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe76⤵PID:2736
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe77⤵PID:2784
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe78⤵PID:2836
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe79⤵PID:2868
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe80⤵
- Enumerates connected drives
PID:2920 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe81⤵PID:2952
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe82⤵PID:2984
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe83⤵
- Drops file in System32 directory
PID:3008 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe84⤵PID:3036
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe85⤵PID:3064
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe86⤵PID:2096
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe87⤵PID:2160
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe88⤵PID:2204
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe89⤵PID:2268
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe90⤵PID:2312
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe91⤵PID:2332
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe92⤵PID:2368
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe93⤵PID:2416
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe94⤵PID:2464
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe95⤵PID:2512
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe96⤵PID:2560
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe97⤵PID:2612
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe98⤵
- Drops file in System32 directory
PID:2664 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe99⤵PID:2708
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe100⤵PID:2796
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe101⤵PID:2848
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe102⤵PID:3000
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe103⤵PID:2236
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe104⤵
- Enumerates connected drives
PID:2568 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe105⤵PID:2812
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe106⤵PID:2076
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe107⤵
- Drops file in System32 directory
PID:2672 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe108⤵
- Enumerates connected drives
PID:2900 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe109⤵PID:2724
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe110⤵
- Drops file in System32 directory
PID:2896 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe111⤵PID:3096
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe112⤵
- Enumerates connected drives
PID:3120 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe113⤵PID:3148
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe114⤵PID:3172
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe115⤵PID:3200
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe116⤵PID:3224
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe117⤵PID:3252
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe118⤵PID:3276
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe119⤵
- Drops file in System32 directory
PID:3304 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe120⤵
- Drops file in System32 directory
PID:3328 -
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe121⤵PID:3352
-
C:\Windows\SysWOW64\c6YXybd\KyXTCN5.exeC:\Windows\system32\c6YXybd\KyXTCN5.exe122⤵
- Drops file in System32 directory
PID:3376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-