Nloader.exe

It modifies firewall settings via netsh.exe to allow network access for spawned processes.

While associated with legitimate-looking, albeit potentially unwanted, driver packages, the behavior exhibited (spawning many processes, modifying firewalls, and memory protection) is highly suspicious. NLoader.exe

The file often shows unusual entropy sections (e.g., .rdata), suggesting it may be packed or encrypted to evade signature-based detection. If you want to know more, I can help you with: Specific removal instructions A breakdown of the anti-debugging techniques It modifies firewall settings via netsh

Let me know which of these you'd like to explore. DriverPack-17-Online.exe - Hybrid Analysis albeit potentially unwanted